@elevasis/sdk 1.47.0 → 1.49.0

package/dist/cli.cjs

@@ -22654,44 +22654,64 @@ var init_ontology = __esm({
     }).passthrough();
     OntologyObjectTypeSchema = OntologyRecordBaseSchema.extend({
       properties: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional(),
-      storage: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-    });
+      storage: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+      // Carried by the legacy entity projection (`addLegacyEntityProjections`); not
+      // authored directly, but a real key an authored record must not collide with.
+      rowSchema: external_exports.string().trim().min(1).optional(),
+      stateCatalogId: external_exports.string().trim().min(1).optional()
+    }).strict();
     OntologyLinkTypeSchema = OntologyRecordBaseSchema.extend({
       from: OntologyIdSchema,
       to: OntologyIdSchema,
       cardinality: external_exports.string().trim().min(1).max(80).optional(),
       via: external_exports.string().trim().min(1).max(255).optional()
-    });
+    }).strict();
     OntologyActionTypeSchema = OntologyRecordBaseSchema.extend({
       actsOn: OntologyReferenceListSchema,
       input: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional(),
-      effects: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).optional()
-    });
+      effects: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).optional(),
+      resourceId: external_exports.string().trim().min(1).optional(),
+      invocations: external_exports.array(external_exports.unknown()).optional(),
+      lifecycle: external_exports.string().trim().min(1).optional(),
+      // Carried by the legacy action projection (`addLegacyActionProjections`); not
+      // authored directly, but a real key an authored record must not collide with.
+      legacyActionId: external_exports.string().trim().min(1).optional()
+    }).strict();
     OntologyCatalogTypeSchema = OntologyRecordBaseSchema.extend({
       kind: external_exports.string().trim().min(1).max(120).optional(),
       appliesTo: OntologyIdSchema.optional(),
-      entries: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional()
-    });
+      entries: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional(),
+      // Carried by lead-gen's legacy stage-catalog projection
+      // (`createLeadGenStageCatalog`); not authored directly, but a real key an
+      // authored record must not collide with.
+      legacyCatalogKey: external_exports.string().trim().min(1).optional(),
+      // Carried in live tenant configs (Elevasis, `nirvana-marketing`, and the
+      // `_template` scaffold all author these on `sales.crm:catalog/crm.pipeline`)
+      // as a cross-reference to the pre-ontology CRM pipeline key/entity id. No
+      // code currently reads them back — do not silently normalize them away.
+      legacyPipelineKey: external_exports.string().trim().min(1).optional(),
+      legacyEntityKey: external_exports.string().trim().min(1).optional()
+    }).strict();
     OntologyEventTypeSchema = OntologyRecordBaseSchema.extend({
       payload: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional()
-    });
+    }).strict();
     OntologyInterfaceTypeSchema = OntologyRecordBaseSchema.extend({
       properties: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional()
-    });
+    }).strict();
     OntologyValueTypeSchema = OntologyRecordBaseSchema.extend({
       primitive: external_exports.string().trim().min(1).max(120).optional()
-    });
+    }).strict();
     OntologySharedPropertySchema = OntologyRecordBaseSchema.extend({
       valueType: OntologyIdSchema.optional(),
       searchable: external_exports.boolean().optional(),
       pii: external_exports.boolean().optional()
-    });
+    }).strict();
     OntologyGroupSchema = OntologyRecordBaseSchema.extend({
       members: OntologyReferenceListSchema
-    });
+    }).strict();
     OntologyEndpointTypeSchema = OntologyRecordBaseSchema.extend({
       route: external_exports.string().trim().min(1).max(500).optional()
-    });
+    }).strict();
     OntologyScopeSchema = external_exports.object({
       objectTypes: external_exports.record(OntologyIdSchema, OntologyObjectTypeSchema).default({}).optional(),
       linkTypes: external_exports.record(OntologyIdSchema, OntologyLinkTypeSchema).default({}).optional(),
@@ -22703,7 +22723,7 @@ var init_ontology = __esm({
       sharedProperties: external_exports.record(OntologyIdSchema, OntologySharedPropertySchema).default({}).optional(),
       groups: external_exports.record(OntologyIdSchema, OntologyGroupSchema).default({}).optional(),
       endpoints: external_exports.record(OntologyIdSchema, OntologyEndpointTypeSchema).default({}).optional()
-    }).default({});
+    }).strict().default({});
     DEFAULT_ONTOLOGY_SCOPE = {
       valueTypes: {
         "global:value-type/uuid": {
@@ -23551,12 +23571,12 @@ var init_profile_registry = __esm({
 
 // ../core/src/organization-model/domains/systems.ts
 function isReservedPlatformProfileId(profileId) {
-  return SYSTEM_INTERFACE_READINESS_PROFILES.includes(profileId);
+  return BUILT_IN_VALIDATED_PROFILE_IDS.includes(profileId);
 }
 function isBuiltInReadinessProfile(profileId) {
   return isReservedPlatformProfileId(profileId) || getBuiltInReadinessProfile(profileId) !== void 0;
 }
-var SystemKindSchema, SystemLifecycleSchema, SystemIdSchema, SystemPathSchema, UiPositionSchema, NodeIdStringSchema, SystemUiSchema, SystemInterfaceKeySchema, SystemInterfaceLifecycleSchema, SYSTEM_INTERFACE_PROFILES, SYSTEM_INTERFACE_READINESS_PROFILES, SystemInterfaceReadinessProfileSchema, SystemInterfaceResourceScopeSchema, SystemApiInterfaceReadinessContractSchema, SystemApiInterfaceSchema, SystemInterfaceRefSchema, JsonValueSchema, SystemConfigSchema, SystemEntrySchema, SystemsDomainSchema, DEFAULT_ORGANIZATION_MODEL_SYSTEMS;
+var SystemKindSchema, SystemLifecycleSchema, SystemIdSchema, SystemPathSchema, UiPositionSchema, NodeIdStringSchema, SystemUiSchema, SystemInterfaceKeySchema, SystemInterfaceLifecycleSchema, SYSTEM_INTERFACE_PROFILES, SYSTEM_INTERFACE_READINESS_PROFILES, BUILT_IN_VALIDATED_PROFILE_IDS, SystemInterfaceReadinessProfileSchema, SystemInterfaceResourceScopeSchema, SystemApiInterfaceReadinessContractSchema, SystemApiInterfaceSchema, SystemInterfaceRefSchema, JsonValueSchema, SystemConfigSchema, SystemEntrySchema, SystemsDomainSchema, DEFAULT_ORGANIZATION_MODEL_SYSTEMS;
 var init_systems = __esm({
   "../core/src/organization-model/domains/systems.ts"() {
     "use strict";
@@ -23581,29 +23601,45 @@ var init_systems = __esm({
       path: PathSchema,
       surfaces: ReferenceIdsSchema,
       icon: IconNameSchema.optional()
-    });
+    }).strict();
     SystemInterfaceKeySchema = ModelIdSchema;
     SystemInterfaceLifecycleSchema = external_exports.enum(["draft", "active", "disabled", "deprecated", "archived"]).meta({ label: "System interface lifecycle", color: "teal" });
     SYSTEM_INTERFACE_PROFILES = [
       {
         systemPath: "sales.lead-gen",
         interfaceKey: "api",
-        readinessProfile: "sales.lead-gen.api"
+        readinessProfile: "sales.lead-gen.api",
+        validation: "built-in"
       },
       {
         systemPath: "sales.crm",
         interfaceKey: "api",
-        readinessProfile: "sales.crm.api"
+        readinessProfile: "sales.crm.api",
+        validation: "built-in"
       },
       {
         systemPath: "sales.lead-gen",
         interfaceKey: "crm-handoff",
-        readinessProfile: "sales.lead-gen.crm-handoff"
+        readinessProfile: "sales.lead-gen.crm-handoff",
+        validation: "built-in"
+      },
+      {
+        // Gated by `CONTENT_API_INTERFACE` in `apps/api/src/business/content/organization-model.ts`,
+        // which every `/api/content/*` and `/api/external/content/*` route asserts. Contract-validated
+        // rather than built-in because the required step catalog is per-adopter: Elevasis declares
+        // `content:catalog/long-form-to-shorts-steps`, a tenant declares its own.
+        systemPath: "content",
+        interfaceKey: "api",
+        readinessProfile: "content.api",
+        validation: "contract"
       }
     ];
     SYSTEM_INTERFACE_READINESS_PROFILES = SYSTEM_INTERFACE_PROFILES.map(
       (profile) => profile.readinessProfile
     );
+    BUILT_IN_VALIDATED_PROFILE_IDS = SYSTEM_INTERFACE_PROFILES.filter(
+      (profile) => profile.validation === "built-in"
+    ).map((profile) => profile.readinessProfile);
     SystemInterfaceReadinessProfileSchema = external_exports.string().trim().min(1);
     SystemInterfaceResourceScopeSchema = external_exports.array(ModelIdSchema).default([]);
     SystemApiInterfaceReadinessContractSchema = external_exports.object({
@@ -25013,13 +25049,13 @@ var init_foundation = __esm({
 });
 
 // ../core/src/organization-model/catalogs/content.ts
-var ContentPipelineStepActorSchema, ContentPipelineStepReviewModeSchema, ContentPayloadFieldTypeSchema, ContentPayloadFieldDeclarationSchema, ContentPipelineStepDeclarationSchema, ContentSourceAssetKindDeclarationSchema;
+var ContentPipelineStepActorSchema, ContentPipelineStepReviewModeSchema, ContentPayloadFieldTypeSchema, ContentPayloadFieldDeclarationSchema, ContentWorkspaceRouteSchema, ContentPipelineStepDeclarationSchema, ContentSourceAssetKindDeclarationSchema;
 var init_content = __esm({
   "../core/src/organization-model/catalogs/content.ts"() {
     "use strict";
     init_zod();
     ContentPipelineStepActorSchema = external_exports.enum(["workflow", "agent", "vendor"]);
-    ContentPipelineStepReviewModeSchema = external_exports.enum(["live", "queued", "none"]);
+    ContentPipelineStepReviewModeSchema = external_exports.enum(["none", "required"]);
     ContentPayloadFieldTypeSchema = external_exports.enum(["string", "text", "number", "boolean", "url", "string-array"]);
     ContentPayloadFieldDeclarationSchema = external_exports.object({
       key: external_exports.string().trim().min(1).max(200),
@@ -25027,6 +25063,7 @@ var init_content = __esm({
       type: ContentPayloadFieldTypeSchema,
       required: external_exports.boolean().optional()
     });
+    ContentWorkspaceRouteSchema = external_exports.string().trim().min(1).max(400).regex(/^\//, 'workspaceRoute must be an app-relative path beginning with "/"');
     ContentPipelineStepDeclarationSchema = external_exports.object({
       label: external_exports.string().trim().min(1).max(160).optional(),
       description: external_exports.string().trim().min(1).max(2e3).optional(),
@@ -25052,6 +25089,16 @@ var init_content = __esm({
        * Resource at all.
        */
       actionId: external_exports.string().trim().min(1).max(200).optional(),
+      /**
+       * Per-step override of the pipeline's `workspaceRoute`. Absent on almost every
+       * step -- the pipeline-level route is the common case, and this exists for the
+       * chains whose gates are genuinely different screens (the video pipeline
+       * reviews text candidates, then rendered video, then copy plus a schedule).
+       *
+       * Resolution is override-then-fallback: a display surface takes this when the
+       * step declares one and the pipeline's otherwise. See `ContentWorkspaceRouteSchema`.
+       */
+      workspaceRoute: ContentWorkspaceRouteSchema.optional(),
       payloadFields: external_exports.array(ContentPayloadFieldDeclarationSchema).default([])
     });
     ContentSourceAssetKindDeclarationSchema = external_exports.object({
@@ -26244,6 +26291,13 @@ var init_lead_gen = __esm({
   }
 });
 
+// ../core/src/organization-model/catalogs/define-content-pipeline.ts
+var init_define_content_pipeline = __esm({
+  "../core/src/organization-model/catalogs/define-content-pipeline.ts"() {
+    "use strict";
+  }
+});
+
 // ../core/src/organization-model/readiness/engine.ts
 function addReadinessIssue(issues, family, code, message, details = {}) {
   issues.push({
@@ -26584,6 +26638,7 @@ var init_organization_model = __esm({
     init_graph();
     init_lead_gen();
     init_content();
+    init_define_content_pipeline();
     init_branding();
     init_systems();
     init_resources();
@@ -44068,7 +44123,7 @@ function getModelInfo(model) {
     return MODEL_INFO[model];
   }
   for (const knownModel of MODEL_KEYS_BY_SPECIFICITY) {
-    if (model.startsWith(knownModel)) {
+    if (model.startsWith(`${knownModel}-`)) {
       return MODEL_INFO[knownModel];
     }
   }
@@ -44094,7 +44149,7 @@ function validateModelConfig(config3) {
     throw new ModelConfigError(`Invalid config for ${model}: ${firstError.message}`, fieldName, model);
   }
 }
-var GPT5OptionsSchema, GPT5ConfigSchema, MockConfigSchema, OpenRouterOptionsSchema, OpenRouterConfigSchema, AnthropicOptionsSchema, AnthropicStandardConfigSchema, AnthropicClaude5ConfigSchema, AnthropicConfigSchema, MODEL_INFO, MODEL_KEYS_BY_SPECIFICITY;
+var GPT5OptionsSchema, GPT5ConfigSchema, GPT56OptionsSchema, GPT56ConfigSchema, MockConfigSchema, OpenRouterOptionsSchema, OpenRouterConfigSchema, AnthropicOptionsSchema, AnthropicStandardConfigSchema, AnthropicClaude5ConfigSchema, AnthropicConfigSchema, GPT56_CACHE_READ_RATE_MULTIPLIER, CACHE_CREATION_RATE_MULTIPLIER, MODEL_INFO, MODEL_KEYS_BY_SPECIFICITY;
 var init_model_info = __esm({
   "../core/src/execution/engine/llm/model-info.ts"() {
     "use strict";
@@ -44114,6 +44169,19 @@ var init_model_info = __esm({
       topP: external_exports.number().min(0).max(1).optional(),
       modelOptions: GPT5OptionsSchema.optional()
     });
+    GPT56OptionsSchema = external_exports.object({
+      reasoning_effort: external_exports.enum(["none", "low", "medium", "high", "xhigh", "max"]).optional(),
+      verbosity: external_exports.enum(["low", "medium", "high"]).optional()
+    });
+    GPT56ConfigSchema = external_exports.object({
+      model: external_exports.enum(["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"]),
+      provider: external_exports.enum(["openai"]),
+      apiKey: external_exports.string(),
+      temperature: external_exports.literal(1).optional(),
+      maxOutputTokens: external_exports.number().min(4e3).optional(),
+      topP: external_exports.number().min(0).max(1).optional(),
+      modelOptions: GPT56OptionsSchema.optional()
+    });
     MockConfigSchema = external_exports.object({
       model: external_exports.enum(["mock"]),
       provider: external_exports.enum(["mock"]),
@@ -44166,9 +44234,12 @@ var init_model_info = __esm({
       AnthropicClaude5ConfigSchema,
       AnthropicStandardConfigSchema
     ]);
+    GPT56_CACHE_READ_RATE_MULTIPLIER = 0.1;
+    CACHE_CREATION_RATE_MULTIPLIER = 1.25;
     MODEL_INFO = {
       // OpenAI GPT-5 (Reasoning Models)
       "gpt-5": {
+        provider: "openai",
         inputCostPer1M: 125,
         // $1.25 per 1M tokens
         outputCostPer1M: 1e3,
@@ -44182,6 +44253,7 @@ var init_model_info = __esm({
         configSchema: GPT5ConfigSchema
       },
       "gpt-5.4-mini": {
+        provider: "openai",
         inputCostPer1M: 75,
         // $0.75 per 1M tokens
         outputCostPer1M: 450,
@@ -44195,6 +44267,7 @@ var init_model_info = __esm({
         configSchema: GPT5ConfigSchema
       },
       "gpt-5.4-nano": {
+        provider: "openai",
         inputCostPer1M: 20,
         // $0.20 per 1M tokens
         outputCostPer1M: 125,
@@ -44206,8 +44279,60 @@ var init_model_info = __esm({
         category: "standard",
         configSchema: GPT5ConfigSchema
       },
+      // OpenAI GPT-5.6 family (GA 2026-07-09). All three tiers share 1.05M context, 128K max output,
+      // image input, tool use, structured outputs, and prompt caching -- they differ in reasoning depth
+      // and price, not capability. The bare `gpt-5.6` alias is deliberately unregistered; see OpenAIModel.
+      "gpt-5.6-sol": {
+        provider: "openai",
+        inputCostPer1M: 500,
+        // $5.00 per 1M tokens
+        outputCostPer1M: 3e3,
+        // $30.00 per 1M tokens
+        minTokens: 4e3,
+        recommendedTokens: 8e3,
+        maxTokens: 105e4,
+        // 1.05M context window
+        maxOutputTokens: 128e3,
+        category: "reasoning",
+        configSchema: GPT56ConfigSchema,
+        cacheReadRateMultiplier: GPT56_CACHE_READ_RATE_MULTIPLIER,
+        cacheCreationRateMultiplier: CACHE_CREATION_RATE_MULTIPLIER
+      },
+      "gpt-5.6-terra": {
+        provider: "openai",
+        inputCostPer1M: 250,
+        // $2.50 per 1M tokens
+        outputCostPer1M: 1500,
+        // $15.00 per 1M tokens
+        minTokens: 4e3,
+        recommendedTokens: 8e3,
+        maxTokens: 105e4,
+        // 1.05M context window
+        maxOutputTokens: 128e3,
+        category: "standard",
+        configSchema: GPT56ConfigSchema,
+        cacheReadRateMultiplier: GPT56_CACHE_READ_RATE_MULTIPLIER,
+        cacheCreationRateMultiplier: CACHE_CREATION_RATE_MULTIPLIER
+      },
+      "gpt-5.6-luna": {
+        provider: "openai",
+        inputCostPer1M: 100,
+        // $1.00 per 1M tokens
+        outputCostPer1M: 600,
+        // $6.00 per 1M tokens
+        minTokens: 4e3,
+        recommendedTokens: 8e3,
+        maxTokens: 105e4,
+        // 1.05M context window
+        maxOutputTokens: 128e3,
+        category: "standard",
+        configSchema: GPT56ConfigSchema,
+        cacheReadRateMultiplier: GPT56_CACHE_READ_RATE_MULTIPLIER,
+        cacheCreationRateMultiplier: CACHE_CREATION_RATE_MULTIPLIER
+      },
       // Mock model for testing
       mock: {
+        provider: "mock",
         inputCostPer1M: 0,
         // Free for tests
         outputCostPer1M: 0,
@@ -44221,6 +44346,7 @@ var init_model_info = __esm({
       },
       // OpenRouter Models (via openrouter.ai)
       "openrouter/z-ai/glm-5": {
+        provider: "openrouter",
         inputCostPer1M: 72,
         // $0.72 per 1M tokens
         outputCostPer1M: 230,
@@ -44234,6 +44360,7 @@ var init_model_info = __esm({
       },
       // Anthropic Claude Models (direct SDK access via @anthropic-ai/sdk)
       "claude-opus-5": {
+        provider: "anthropic",
         inputCostPer1M: 500,
         // $5.00 per 1M tokens
         outputCostPer1M: 2500,
@@ -44247,6 +44374,7 @@ var init_model_info = __esm({
         configSchema: AnthropicConfigSchema
       },
       "claude-sonnet-5": {
+        provider: "anthropic",
         // List pricing. An introductory rate of $2.00/$10.00 runs through 2026-08-31; encoding the
         // temporary rate would make historical cost analytics wrong once it lapses.
         inputCostPer1M: 300,
@@ -44262,6 +44390,7 @@ var init_model_info = __esm({
         configSchema: AnthropicConfigSchema
       },
       "claude-haiku-4-5-20251001": {
+        provider: "anthropic",
         inputCostPer1M: 100,
         // $1.00 per 1M tokens
         outputCostPer1M: 500,
@@ -44275,6 +44404,7 @@ var init_model_info = __esm({
         configSchema: AnthropicConfigSchema
       },
       "claude-haiku-4-5": {
+        provider: "anthropic",
         inputCostPer1M: 100,
         // $1.00 per 1M tokens
         outputCostPer1M: 500,
@@ -44663,6 +44793,138 @@ var init_response_schema = __esm({
   }
 });
 
+// ../core/src/execution/engine/workflow/types.ts
+var StepType;
+var init_types5 = __esm({
+  "../core/src/execution/engine/workflow/types.ts"() {
+    "use strict";
+    StepType = {
+      LINEAR: "linear",
+      CONDITIONAL: "conditional"
+    };
+  }
+});
+
+// ../core/src/execution/engine/workflow/errors.ts
+var WorkflowStepError, WorkflowValidationError;
+var init_errors5 = __esm({
+  "../core/src/execution/engine/workflow/errors.ts"() {
+    "use strict";
+    init_errors3();
+    WorkflowStepError = class extends ExecutionError {
+      type = "workflow_step_error";
+      severity = "critical";
+      category = "workflow";
+      /**
+       * @param cause - The error the step actually threw. Kept so the original stack and any
+       *   non-`ExecutionError` throw survive the wrap; its classification is additionally copied into
+       *   `context` by the caller, because `type`/`severity`/`category` are fixed on this class.
+       */
+      constructor(message, context, cause) {
+        super(message, context);
+        if (cause !== void 0) this.cause = cause;
+      }
+    };
+    WorkflowValidationError = class extends ExecutionError {
+      type = "workflow_validation_error";
+      severity = "info";
+      category = "validation";
+      constructor(message, context) {
+        super(message, context);
+      }
+    };
+  }
+});
+
+// ../core/src/execution/engine/workflow/utils.ts
+function validateEntryPoint(steps, entryPoint) {
+  if (!(entryPoint in steps)) {
+    throw new WorkflowValidationError(`Entry point step '${entryPoint}' not found in workflow`, {
+      entryPoint
+    });
+  }
+}
+function findTerminalSteps(steps) {
+  return Object.values(steps).filter((step) => step.next === null);
+}
+function validateTerminalSteps(steps, workflowId) {
+  const terminalSteps = findTerminalSteps(steps);
+  if (terminalSteps.length === 0) {
+    throw new WorkflowValidationError(`Workflow '${workflowId}' must have at least one terminal step (next: null)`, {
+      workflowId
+    });
+  }
+}
+function validateStepReferences(steps) {
+  for (const [id, step] of Object.entries(steps)) {
+    if (step.next === null) {
+      continue;
+    }
+    if (step.next.type === StepType.LINEAR) {
+      if (!(step.next.target in steps)) {
+        throw new WorkflowValidationError(`Step '${id}' references non-existent target '${step.next.target}'`, {
+          stepId: id,
+          target: step.next.target
+        });
+      }
+    } else if (step.next.type === StepType.CONDITIONAL) {
+      const targets = [...step.next.routes.map((r) => r.target), step.next.default];
+      for (const target of targets) {
+        if (!(target in steps)) {
+          throw new WorkflowValidationError(`Step '${id}' references non-existent target '${target}'`, {
+            stepId: id,
+            target
+          });
+        }
+      }
+    }
+  }
+}
+function detectCycle(visited, executionPath, currentStepId) {
+  if (visited.has(currentStepId)) {
+    const cycle = executionPath.slice(executionPath.indexOf(currentStepId));
+    throw new WorkflowStepError(`Cycle detected in workflow: ${cycle.join(" -> ")} -> ${currentStepId}`, {
+      stepId: currentStepId,
+      cycle: [...cycle, currentStepId]
+    });
+  }
+}
+function validateWorkflowGraph(steps, entryPoint, workflowId) {
+  const onPath = /* @__PURE__ */ new Set();
+  const executionPath = [];
+  const reached = /* @__PURE__ */ new Set();
+  const walk = (stepId) => {
+    detectCycle(onPath, executionPath, stepId);
+    onPath.add(stepId);
+    executionPath.push(stepId);
+    reached.add(stepId);
+    const step = steps[stepId];
+    if (step && step.next !== null) {
+      const targets = step.next.type === StepType.LINEAR ? [step.next.target] : [...step.next.routes.map((route) => route.target), step.next.default];
+      for (const target of targets) {
+        if (target in steps) walk(target);
+      }
+    }
+    executionPath.pop();
+    onPath.delete(stepId);
+  };
+  if (entryPoint in steps) walk(entryPoint);
+  const orphanIds = Object.keys(steps).filter((id) => !reached.has(id));
+  if (orphanIds.length > 0) {
+    throw new WorkflowValidationError(
+      `Workflow '${workflowId}' has step(s) unreachable from entry point '${entryPoint}': ${orphanIds.join(", ")}`,
+      { workflowId, entryPoint, orphanIds }
+    );
+  }
+}
+var init_utils3 = __esm({
+  "../core/src/execution/engine/workflow/utils.ts"() {
+    "use strict";
+    init_types5();
+    init_errors5();
+  }
+});
+
 // ../core/src/platform/registry/validation.ts
 function getResourceValidatorMode(explicitMode) {
   if (explicitMode) return explicitMode;
@@ -44681,7 +44943,14 @@ function emitGovernanceIssues(issues, mode, onWarning) {
   if (issues.length === 0) return;
   if (mode === "strict") {
     const first = issues[0];
-    throw new RegistryValidationError(first.orgName, first.resourceId, "organizationModel.resources", first.message);
+    const messages = issues.map((issue2) => issue2.message);
+    throw new RegistryValidationError(
+      first.orgName,
+      first.resourceId,
+      "organizationModel.resources",
+      messages.join("\n"),
+      messages
+    );
   }
   const warn2 = onWarning ?? ((issue2) => console.warn(issue2.message));
   for (const issue2 of issues) {
@@ -44842,7 +45111,7 @@ function addTopologyIssues(issues, orgName, deployment, organizationModel, syste
     if (ref.kind === "humanCheckpoint") return humanCheckpointIds.has(ref.id);
     if (ref.kind === "externalResource") return externalResourceIds.has(ref.id);
     if (ref.kind === "ontology") {
-      if (ontologyIndex === void 0) return true;
+      if (ontologyIndex === void 0) return false;
       return Object.values(ontologyIndex).some((records) => records[ref.id] !== void 0);
     }
     return false;
@@ -45032,7 +45301,8 @@ function detectMissingApiInterfaceDeclarations(orgName, organizationModel) {
   }
   return gaps;
 }
-function validateDeclaredSystemInterfaceReadiness(orgName, organizationModel) {
+function validateDeclaredSystemInterfaceReadiness(orgName, organizationModel, options = {}) {
+  const mode = getResourceValidatorMode(options.mode);
   const issues = [];
   if (organizationModel === void 0) return { valid: true, issues };
   const model = organizationModel;
@@ -45058,17 +45328,27 @@ function validateDeclaredSystemInterfaceReadiness(orgName, organizationModel) {
     }
   }
   if (issues.length > 0) {
-    const first = issues[0];
-    throw new RegistryValidationError(
-      first.orgName,
-      `${first.systemPath}/${first.interfaceKey}`,
-      first.path ?? "organizationModel.systems.apiInterface",
-      first.message
-    );
+    if (mode === "strict") {
+      const first = issues[0];
+      const messages = issues.map((issue2) => issue2.message);
+      throw new RegistryValidationError(
+        first.orgName,
+        `${first.systemPath}/${first.interfaceKey}`,
+        first.path ?? "organizationModel.systems.apiInterface",
+        messages.join("\n"),
+        messages
+      );
+    }
+    const warn2 = options.onWarning ?? ((issue2) => console.warn(issue2.message));
+    for (const issue2 of issues) {
+      warn2(issue2);
+    }
+    return { valid: false, issues };
   }
   return { valid: true, issues };
 }
-function validateDeploymentSpec(orgName, resources) {
+function validateDeploymentSpec(orgName, resources, options = {}) {
+  const warn2 = options.onWarning ?? ((message) => console.warn(message));
   const seenIds = /* @__PURE__ */ new Set();
   resources.workflows?.forEach((workflow) => {
     const id = workflow.config.resourceId;
@@ -45087,6 +45367,14 @@ function validateDeploymentSpec(orgName, resources) {
     if (workflow.interface) {
       validateExecutionInterface(orgName, id, workflow.interface, workflow.contract.inputSchema);
     }
+    try {
+      validateEntryPoint(workflow.steps, workflow.entryPoint);
+      validateTerminalSteps(workflow.steps, id);
+      validateStepReferences(workflow.steps);
+      validateWorkflowGraph(workflow.steps, workflow.entryPoint, id);
+    } catch (error46) {
+      warn2(`[${orgName}] Workflow '${id}' graph validation: ${error46 instanceof Error ? error46.message : String(error46)}`);
+    }
   });
   resources.agents?.forEach((agent) => {
     const id = agent.config.resourceId;
@@ -45100,14 +45388,20 @@ function validateDeploymentSpec(orgName, resources) {
     }
     seenIds.add(id);
     validateResourceModelConfig(orgName, id, agent.modelConfig);
-    validateAgentGrammar(orgName, id, agent);
-    validateAgentCheapAssertions(orgName, id, agent);
+    validateAgentGrammar(orgName, id, agent, options.mode);
+    validateAgentCheapAssertions(orgName, id, agent, options.mode);
     if (agent.interface) {
       validateExecutionInterface(orgName, id, agent.interface, agent.contract.inputSchema);
     }
   });
-  validateResourceGovernance(orgName, resources);
-  validateDeclaredSystemInterfaceReadiness(orgName, resources.organizationModel);
+  validateResourceGovernance(orgName, resources, void 0, {
+    mode: options.mode,
+    onWarning: (issue2) => warn2(issue2.message)
+  });
+  validateDeclaredSystemInterfaceReadiness(orgName, resources.organizationModel, {
+    mode: options.mode,
+    onWarning: (issue2) => warn2(issue2.message)
+  });
 }
 function validateResourceModelConfig(orgName, resourceId, modelConfig) {
   try {
@@ -45182,7 +45476,7 @@ function describeGrammarRefusal(reasons, toolInputSchema) {
   }
   return `refused strict mode: ${reasons.join(", ")}`;
 }
-function validateAgentGrammar(orgName, agentId, agent) {
+function validateAgentGrammar(orgName, agentId, agent, mode) {
   const dialect = dialectForProvider(agent.modelConfig.provider);
   if (!dialect) return;
   const capabilities = agentCapabilitiesForGrammarCheck(agent.config);
@@ -45203,12 +45497,12 @@ function validateAgentGrammar(orgName, agentId, agent) {
     compileSchema(offending.inputSchema, dialect).refusalReasons,
     offending.inputSchema
   )}. This silently drops strict-mode enforcement for the agent's ENTIRE iteration schema on every call, not just this tool -- compileSchema refuses whole-schema, never per-tool.` : `[${orgName}] Agent '${agentId}' iteration schema refused strict mode for provider '${agent.modelConfig.provider}': ${compiled.refusalReasons.join(", ")}. No single tool is independently responsible -- this is a whole-schema limit (e.g. total optional properties across every tool exceeding the provider's cap).`;
-  if (getResourceValidatorMode() === "strict") {
+  if (getResourceValidatorMode(mode) === "strict") {
     throw new RegistryValidationError(orgName, agentId, "tools", message);
   }
   console.warn(message);
 }
-function validateAgentCheapAssertions(orgName, agentId, agent) {
+function validateAgentCheapAssertions(orgName, agentId, agent, mode) {
   const issues = [];
   const config3 = agent.config;
   if (config3.sessionCapable && config3.securityLevel === "none") {
@@ -45238,7 +45532,7 @@ function validateAgentCheapAssertions(orgName, agentId, agent) {
   }
   if (issues.length === 0) return;
   const message = `[${orgName}] Agent '${agentId}': ${issues.join(" ")}`;
-  if (getResourceValidatorMode() === "strict") {
+  if (getResourceValidatorMode(mode) === "strict") {
     throw new RegistryValidationError(orgName, agentId, "config", message);
   }
   console.warn(message);
@@ -45505,34 +45799,24 @@ var init_validation2 = __esm({
     init_compile();
     init_dialect();
     init_response_schema();
+    init_utils3();
     init_helpers();
     init_ontology();
     init_readiness();
     init_systems();
     RegistryValidationError = class extends Error {
-      constructor(orgName, resourceId, field2, message) {
+      constructor(orgName, resourceId, field2, message, issues) {
         super(message);
         this.orgName = orgName;
         this.resourceId = resourceId;
         this.field = field2;
+        this.issues = issues;
         this.name = "RegistryValidationError";
       }
     };
   }
 });
 
-// ../core/src/execution/engine/workflow/types.ts
-var StepType;
-var init_types5 = __esm({
-  "../core/src/execution/engine/workflow/types.ts"() {
-    "use strict";
-    StepType = {
-      LINEAR: "linear",
-      CONDITIONAL: "conditional"
-    };
-  }
-});
-
 // ../core/src/execution/engine/base/serialization.ts
 function serializeDefinition(definition, options) {
   const opts = {
@@ -47268,7 +47552,7 @@ var init_croner = __esm({
 });
 
 // ../core/src/execution/scheduler/utils.ts
-var init_utils3 = __esm({
+var init_utils4 = __esm({
   "../core/src/execution/scheduler/utils.ts"() {
     "use strict";
     init_esm2();
@@ -47282,7 +47566,7 @@ var init_scheduler = __esm({
     "use strict";
     init_types8();
     init_schemas3();
-    init_utils3();
+    init_utils4();
   }
 });
 
@@ -47675,7 +47959,7 @@ var init_schemas6 = __esm({
 });
 
 // ../core/src/operations/observability/utils.ts
-var init_utils4 = __esm({
+var init_utils5 = __esm({
   "../core/src/operations/observability/utils.ts"() {
     "use strict";
   }
@@ -47687,7 +47971,7 @@ var init_observability = __esm({
     "use strict";
     init_types13();
     init_schemas6();
-    init_utils4();
+    init_utils5();
   }
 });
 
@@ -48555,6 +48839,21 @@ var init_credentials2 = __esm({
   }
 });
 
+// ../core/src/integrations/cloud-storage/types.ts
+var init_types20 = __esm({
+  "../core/src/integrations/cloud-storage/types.ts"() {
+    "use strict";
+  }
+});
+
+// ../core/src/integrations/cloud-storage/index.ts
+var init_cloud_storage = __esm({
+  "../core/src/integrations/cloud-storage/index.ts"() {
+    "use strict";
+    init_types20();
+  }
+});
+
 // ../core/src/index.ts
 var init_src = __esm({
   "../core/src/index.ts"() {
@@ -48571,6 +48870,7 @@ var init_src = __esm({
     init_forms();
     init_oauth();
     init_credentials2();
+    init_cloud_storage();
   }
 });
 
@@ -48627,6 +48927,12 @@ function resolveApiKey(prod) {
   }
   return process.env.ELEVASIS_PLATFORM_KEY ?? "";
 }
+function isProdApiUrl(apiUrl) {
+  return !apiUrl.includes("localhost");
+}
+function resolveApiKeyForUrl(apiUrl) {
+  return resolveApiKey(isProdApiUrl(apiUrl));
+}
 function tryFindProjectRoot(startDir) {
   const raw = (0, import_path.resolve)(startDir);
   let dir;
@@ -48711,12 +49017,89 @@ var init_config2 = __esm({
   }
 });
 
+// src/cli/readiness-failure.ts
+function isReadinessFailureDetails(details) {
+  if (!details || typeof details !== "object") return false;
+  const candidate = details;
+  return typeof candidate.systemPath === "string" && typeof candidate.interfaceKey === "string" && // Deliberately `string`, not a check against the known families. Narrowing
+  // it here would reject a readiness refusal carrying a family this build has
+  // not learned yet, and `request()` would fall through to the gateway
+  // message -- which tells the operator the API did not reject the request and
+  // it may still be running server-side. That is false for every readiness
+  // refusal, familiar family or not. An unrecognized code is handled where it
+  // can be handled honestly, in `guidanceForFamily`.
+  typeof candidate.readinessCode === "string" && Array.isArray(candidate.issues);
+}
+function parseReadinessFailureDetails(errorText) {
+  let parsed;
+  try {
+    parsed = JSON.parse(errorText);
+  } catch {
+    return void 0;
+  }
+  if (parsed.code !== "SERVICE_UNAVAILABLE") return void 0;
+  return isReadinessFailureDetails(parsed.details) ? parsed.details : void 0;
+}
+function formatIssue(issue2) {
+  let line = `    - [${issue2.code}] ${issue2.message}`;
+  if (issue2.path) line += ` (path: ${issue2.path})`;
+  if (issue2.ref) line += ` (ref: ${issue2.ref})`;
+  return line;
+}
+function describeUnknownFamily(readinessCode) {
+  return `This CLI does not recognize readiness code "${readinessCode}", so it cannot describe the general shape of the fix. The issues below are the API's own explanation and are the authoritative part of this message.
+  The likely cause is version skew -- this @elevasis/sdk is older than the API it just called. Update it (pnpm update @elevasis/sdk) and run this again.`;
+}
+function guidanceForFamily(details) {
+  const lookup = FAMILY_GUIDANCE;
+  return lookup[details.readinessCode]?.(details) ?? describeUnknownFamily(details.readinessCode);
+}
+function describeReadinessFailure(details, endpoint) {
+  const profileSuffix = details.readinessProfile ? ` (readiness profile: ${details.readinessProfile})` : "";
+  const lines = [
+    `API request refused (503): ${details.systemPath}/${details.interfaceKey} is not ready for this API surface${profileSuffix}.`,
+    `This IS the API rejecting the request -- it is not a gateway hiccup, and re-running it will not help.`,
+    `  Endpoint: ${endpoint}`,
+    ""
+  ];
+  lines.push(
+    details.readinessCode === "STALE_OM_SNAPSHOT" ? details.issues[0]?.message ?? "The deployed organization model snapshot is stale. Deploy again to fix this: elevasis-sdk deploy" : guidanceForFamily(details)
+  );
+  if (details.issues.length > 0) {
+    lines.push("", "  Issues:", ...details.issues.map(formatIssue));
+  }
+  lines.push("", `  Run 'elevasis-sdk doctor' to see what else is not ready.`);
+  return lines.join("\n");
+}
+var FAMILY_GUIDANCE;
+var init_readiness_failure = __esm({
+  "src/cli/readiness-failure.ts"() {
+    "use strict";
+    FAMILY_GUIDANCE = {
+      SYSTEM_INTERFACE_MISSING: ({ systemPath }) => `This organization has not adopted the "${systemPath}" System. Declare it in this project's core/config/organization-model/systems.ts with an apiInterface block, then deploy (elevasis-sdk deploy or pnpm operations:deploy).
+  Known trap: an empty apiInterface.resourceIds throws -- omit the apiInterface block entirely for the supported opt-out.`,
+      SYSTEM_INTERFACE_DISABLED: ({ systemPath }) => `The "${systemPath}" System declares an apiInterface but it is not active. Re-enable it (apiInterface.lifecycle: 'active') and redeploy.`,
+      // Two failures share this family and they need opposite advice.
+      //
+      // A validator that rejected a declaration emits a `path`, and pointing at it
+      // is the whole fix. A stored snapshot that would not parse emits no `path` --
+      // the API sets `ref` (a deployment or organization id) and never `path` --
+      // and the broken thing is the deployed copy, not the source the operator
+      // would go and edit. Sending them after a "path" that is not in the payload,
+      // to fix a declaration that may be perfectly fine, was the failure this
+      // wording had before.
+      SYSTEM_INTERFACE_INVALID: ({ systemPath, issues }) => issues.some((issue2) => issue2.path) ? `The "${systemPath}" System's apiInterface / readinessContract declaration is malformed. See the "path" on each issue below for the offending field.` : `The "${systemPath}" System's stored organization model snapshot could not be read. No field of your declaration is known to be wrong -- it is the deployed copy that failed, so deploy again first (elevasis-sdk deploy). If that does not clear it, the declaration is the next place to look.`,
+      SYSTEM_INTERFACE_NOT_READY: ({ systemPath }) => `The "${systemPath}" System's readinessContract is unsatisfied. See the issues below for the missing requiredObjects / requiredCatalogs refs.`,
+      SYSTEM_BRIDGE_NOT_READY: ({ systemPath }) => `The counterpart System of "${systemPath}"'s cross-System handoff is not ready. Check readiness on both sides of the bridge.`
+    };
+  }
+});
+
 // src/cli/api-client.ts
 function getApiKey(apiUrl) {
-  const isProd = !apiUrl.includes("localhost");
-  const key = resolveApiKey(isProd);
+  const key = resolveApiKeyForUrl(apiUrl);
   if (!key) {
-    const varName = isProd ? "ELEVASIS_PLATFORM_KEY" : "ELEVASIS_PLATFORM_KEY_DEV";
+    const varName = isProdApiUrl(apiUrl) ? "ELEVASIS_PLATFORM_KEY" : "ELEVASIS_PLATFORM_KEY_DEV";
     throw new Error(`${varName} environment variable is required.
 Set it in your .env file: ${varName}=sk_...`);
   }
@@ -48778,6 +49161,10 @@ async function request(method, endpoint, apiUrl, body) {
     if (response.status === 401) {
       throw new Error(`401 Unauthorized: Invalid or missing ELEVASIS_PLATFORM_KEY. Check your .env file.`);
     }
+    const readinessDetails = parseReadinessFailureDetails(errorText);
+    if (readinessDetails) {
+      throw new Error(describeReadinessFailure(readinessDetails, endpoint));
+    }
     if (GATEWAY_STATUSES.has(response.status)) {
       throw new Error(describeGatewayFailure(response.status, endpoint, elapsedMs));
     }
@@ -48805,6 +49192,7 @@ var init_api_client = __esm({
   "src/cli/api-client.ts"() {
     "use strict";
     init_config2();
+    init_readiness_failure();
     DEFAULT_TIMEOUT_MS = 2 * 60 * 60 * 1e3;
     GATEWAY_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
   }
@@ -48837,7 +49225,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@elevasis/sdk",
-      version: "1.47.0",
+      version: "1.49.0",
       description: "SDK for building Elevasis organization resources",
       type: "module",
       bin: {
@@ -49042,7 +49430,15 @@ function extractResourceMetadata(resource, schemaWarnings) {
   return meta;
 }
 function bumpVersion(current, type) {
-  const [major, minor, patch] = current.split(".").map(Number);
+  const match = PLAIN_SEMVER_RE.exec(current);
+  if (!match) {
+    throw new Error(
+      `Cannot bump version: "${current}" is not a plain "major.minor.patch" version (e.g. "1.0.0"). Set the deployment spec's version to a plain semver value before using --major/--minor/--patch.`
+    );
+  }
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  const patch = Number(match[3]);
   switch (type) {
     case "major":
       return `${major + 1}.0.0`;
@@ -49053,36 +49449,55 @@ function bumpVersion(current, type) {
   }
 }
 function updateDeploymentVersionSource(source, newVersion) {
-  let offset = 0;
+  const exportIndex = source.indexOf("export default");
+  if (exportIndex === -1) {
+    throw new Error('Unable to find "export default" in the deployment entry file');
+  }
+  const rootBraceIndex = source.indexOf("{", exportIndex);
+  if (rootBraceIndex === -1) {
+    throw new Error("Unable to find the default-exported object in the deployment entry file");
+  }
+  let depth = 0;
+  let offset = rootBraceIndex;
   while (offset < source.length) {
-    const keyIndex = source.indexOf("version", offset);
-    if (keyIndex === -1) break;
-    const before = source[keyIndex - 1];
-    const after = source[keyIndex + "version".length];
-    const isIdentifierBoundary = (before === void 0 || !/[A-Za-z0-9_$]/.test(before)) && (after === void 0 || !/[A-Za-z0-9_$]/.test(after));
-    if (!isIdentifierBoundary) {
-      offset = keyIndex + "version".length;
+    const char = source[offset];
+    if (char === "{" || char === "[" || char === "(") {
+      depth += 1;
+      offset += 1;
       continue;
     }
-    let cursor = keyIndex + "version".length;
-    while (/\s/.test(source[cursor] ?? "")) cursor += 1;
-    if (source[cursor] !== ":") {
-      offset = cursor;
+    if (char === "}" || char === "]" || char === ")") {
+      depth -= 1;
+      offset += 1;
+      if (depth === 0) break;
       continue;
     }
-    cursor += 1;
-    while (/\s/.test(source[cursor] ?? "")) cursor += 1;
-    const quote = source[cursor];
-    if (quote !== "'" && quote !== '"') {
-      offset = cursor;
-      continue;
+    if (depth === 1 && char === "v" && source.startsWith("version", offset)) {
+      const before = source[offset - 1];
+      const after = source[offset + "version".length];
+      const isIdentifierBoundary = (before === void 0 || !/[A-Za-z0-9_$]/.test(before)) && (after === void 0 || !/[A-Za-z0-9_$]/.test(after));
+      if (isIdentifierBoundary) {
+        let cursor = offset + "version".length;
+        while (/\s/.test(source[cursor] ?? "")) cursor += 1;
+        if (source[cursor] === ":") {
+          cursor += 1;
+          while (/\s/.test(source[cursor] ?? "")) cursor += 1;
+          const quote = source[cursor];
+          if (quote === "'" || quote === '"') {
+            const valueStart = cursor + 1;
+            const valueEnd = source.indexOf(quote, valueStart);
+            if (valueEnd !== -1) {
+              return `${source.slice(0, valueStart)}${newVersion}${source.slice(valueEnd)}`;
+            }
+          }
+        }
+      }
     }
-    const valueStart = cursor + 1;
-    const valueEnd = source.indexOf(quote, valueStart);
-    if (valueEnd === -1) break;
-    return `${source.slice(0, valueStart)}${newVersion}${source.slice(valueEnd)}`;
+    offset += 1;
   }
-  throw new Error("Unable to find a quoted version property in the deployment entry file");
+  throw new Error(
+    "Unable to find a quoted version property on the default-exported deployment spec (not nested inside a resource config) in the entry file"
+  );
 }
 function listOrganizationModelContractRefs(org) {
   return Object.values(org.organizationModel?.resources ?? {}).flatMap((resource) => {
@@ -49094,7 +49509,7 @@ function listOrganizationModelContractRefs(org) {
     ].filter((entry) => entry[1] !== void 0).map(([side, ref]) => ({ resourceId: resource.id, side, ref }));
   });
 }
-function validateResourceGovernancePreflight(orgName, org, contractRegistry) {
+function validateResourceGovernancePreflight(orgName, org, contractRegistry, onWarning = (message) => console.warn(message)) {
   if (org.organizationModel !== void 0) {
     OrganizationModelSchema.parse(org.organizationModel);
   }
@@ -49114,24 +49529,43 @@ Run \`pnpm exec elevasis-sdk om:scaffold:fill --gaps <path>\` to scaffold the mi
     );
   }
   validateDeclaredSystemInterfaceReadiness(orgName, org.organizationModel);
-  if (process.env.ELEVASIS_RESOURCE_VALIDATOR === "warn-only") return;
-  validateResourceGovernance(orgName, org, org.organizationModel, { mode: "strict" });
+  const mode = process.env.ELEVASIS_RESOURCE_VALIDATOR === "warn-only" ? "warn-only" : "strict";
+  validateResourceGovernance(orgName, org, org.organizationModel, {
+    mode,
+    onWarning: (issue2) => onWarning(issue2.message)
+  });
   const contractRefs = listOrganizationModelContractRefs(org);
-  if (contractRefs.length === 0 || contractRegistry === void 0) return;
+  if (contractRefs.length === 0) return;
+  if (contractRegistry === void 0) {
+    onWarning(
+      `[${orgName}] ${contractRefs.length} contract ref${contractRefs.length !== 1 ? "s" : ""} declared in organizationModel but no \`contractRegistry\` (or \`ELEVASIS_CONTRACT_REGISTRY\`) was exported from the entry file -- contract-ref resolution skipped.`
+    );
+    return;
+  }
   for (const { resourceId, side, ref } of contractRefs) {
     try {
       resolveContractRef(ref, contractRegistry);
     } catch (error46) {
       const message = error46 instanceof Error ? error46.message : String(error46);
-      throw new RegistryValidationError(
-        orgName,
-        resourceId,
-        `organizationModel.resources.${resourceId}.ontology.contract.${side}`,
-        message
-      );
+      const field2 = `organizationModel.resources.${resourceId}.ontology.contract.${side}`;
+      if (mode === "warn-only") {
+        onWarning(`[${orgName}] ${field2}: ${message}`);
+        continue;
+      }
+      throw new RegistryValidationError(orgName, resourceId, field2, message);
     }
   }
 }
+function formatZodValidationError(error46) {
+  return error46.issues.map((issue2) => {
+    const path3 = issue2.path.length > 0 ? issue2.path.join(".") : "(root)";
+    return `${path3}: ${issue2.message}`;
+  });
+}
+function formatRegistryValidationError(error46) {
+  if (error46.issues && error46.issues.length > 1) return error46.issues;
+  return [error46.message];
+}
 function registerDeployCommand(program3) {
   program3.command("deploy").description(
     "Validate, bundle, upload, and deploy project resources\n  Example: elevasis-sdk deploy --api-url http://localhost:5170"
@@ -49155,7 +49589,7 @@ function registerDeployCommand(program3) {
           authSpinner.fail(source_default.red("Authentication failed"));
           const errMsg = error46 instanceof Error ? error46.message : String(error46);
           if (errMsg.includes("401") || errMsg.toLowerCase().includes("unauthorized")) {
-            const keyVar = !options.prod && process.env.NODE_ENV === "development" && process.env.ELEVASIS_PLATFORM_KEY_DEV ? "ELEVASIS_PLATFORM_KEY_DEV" : "ELEVASIS_PLATFORM_KEY";
+            const keyVar = !isProdApiUrl(apiUrl) && process.env.NODE_ENV === "development" && process.env.ELEVASIS_PLATFORM_KEY_DEV ? "ELEVASIS_PLATFORM_KEY_DEV" : "ELEVASIS_PLATFORM_KEY";
             console.error(source_default.red("  Invalid API key."));
             console.error(source_default.gray(`  Your ${keyVar} was rejected by the server.`));
             console.error(source_default.gray("  Check your .env file and verify the key in the Elevasis dashboard."));
@@ -49179,7 +49613,13 @@ function registerDeployCommand(program3) {
             throw new Error("Invalid entry: no default export found");
           }
           const contractRegistry = deploymentModule.contractRegistry ?? deploymentModule.ELEVASIS_CONTRACT_REGISTRY;
-          validateResourceGovernancePreflight(orgName, org, contractRegistry);
+          const governanceWarnings = [];
+          validateResourceGovernancePreflight(
+            orgName,
+            org,
+            contractRegistry,
+            (message) => governanceWarnings.push(message)
+          );
           new ResourceRegistry({ [orgName]: org });
           activeWorkflows = (org.workflows ?? []).filter((w) => !w.config.archived);
           activeAgents = (org.agents ?? []).filter((a) => !a.config.archived);
@@ -49188,6 +49628,12 @@ function registerDeployCommand(program3) {
           validateSpinner.succeed(
             source_default.green("Validating...") + source_default.white("              done") + source_default.gray(` (${totalCount} resource${totalCount !== 1 ? "s" : ""}, 0 errors)`)
           );
+          if (governanceWarnings.length > 0) {
+            for (const warning of governanceWarnings) {
+              console.log(source_default.yellow(`  warn  ${warning}`));
+            }
+            console.log("");
+          }
           if (archivedCount > 0) {
             console.log(source_default.gray(`  Skipping ${archivedCount} archived resource${archivedCount !== 1 ? "s" : ""}`));
           }
@@ -49221,12 +49667,30 @@ function registerDeployCommand(program3) {
           if (error46 instanceof RegistryValidationError) {
             validateSpinner.fail(source_default.red("Validation failed"));
             console.error("");
-            console.error(source_default.red(`  ERROR  ${error46.message}`));
+            const issues = formatRegistryValidationError(error46);
+            if (issues.length > 1) {
+              console.error(source_default.red(`  ${issues.length} issues:`));
+              for (const issue2 of issues) {
+                console.error(source_default.red(`    - ${issue2}`));
+              }
+            } else {
+              console.error(source_default.red(`  ERROR  ${issues[0]}`));
+            }
             if (error46.resourceId) {
               console.error(source_default.gray(`  Resource: ${error46.resourceId}`));
             }
             console.error("");
             console.error(source_default.gray("  Deploy aborted."));
+          } else if (error46 instanceof external_exports.ZodError) {
+            validateSpinner.fail(source_default.red("Validation failed: organization model does not match the expected shape"));
+            console.error("");
+            for (const line of formatZodValidationError(error46)) {
+              console.error(source_default.red(`  ERROR  ${line}`));
+            }
+            console.error("");
+            console.error(source_default.gray("  Deploy aborted."));
+          } else if (validateSpinner.isSpinning) {
+            validateSpinner.fail(source_default.red("Validation failed"));
           }
           throw error46;
         }
@@ -49291,11 +49755,11 @@ import { startWorker } from '@elevasis/sdk/worker'
         const uploadSpinner = ora("Uploading...").start();
         try {
           const bundleBuffer = await (0, import_promises.readFile)(bundleOutfile);
-          const apiKey = resolveApiKey(options.prod);
+          const apiKey = resolveApiKeyForUrl(apiUrl);
           if (!apiKey) {
             uploadSpinner.fail(source_default.red("Missing API key environment variable"));
             console.error(source_default.gray("  Set it in your .env file or shell environment:"));
-            if (!options.prod && process.env.NODE_ENV === "development") {
+            if (!isProdApiUrl(apiUrl) && process.env.NODE_ENV === "development") {
               console.error(
                 source_default.gray("    ELEVASIS_PLATFORM_KEY_DEV=sk_...  (or ELEVASIS_PLATFORM_KEY as fallback)")
               );
@@ -49363,7 +49827,7 @@ import { startWorker } from '@elevasis/sdk/worker'
     )
   );
 }
-var import_path2, import_promises, import_fs2, import_crypto, import_url, import_module;
+var import_path2, import_promises, import_fs2, import_crypto, import_url, import_module, PLAIN_SEMVER_RE;
 var init_deploy = __esm({
   "src/cli/commands/deploy.ts"() {
     "use strict";
@@ -49384,6 +49848,7 @@ var init_deploy = __esm({
     init_api_client();
     init_wrap_action();
     init_version();
+    PLAIN_SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)$/;
   }
 });
 
@@ -49441,18 +49906,18 @@ function getOrganizationModelDir(projectDir) {
 }
 function assertSplitLayout(projectDir) {
   const omDir = getOrganizationModelDir(projectDir);
-  const missing = REQUIRED_FILES.filter((f) => !(0, import_node_fs13.existsSync)((0, import_node_path11.join)(omDir, f)));
+  const missing = REQUIRED_FILES.filter((f) => !(0, import_node_fs14.existsSync)((0, import_node_path11.join)(omDir, f)));
   if (missing.length > 0) {
     throw new Error(
       "Legacy single-file OM layout detected. Split into `core/config/organization-model/{profile.ts, systems.ts, navigation.ts}` before scaffolding."
     );
   }
 }
-var import_node_fs13, import_node_path11, REQUIRED_FILES;
+var import_node_fs14, import_node_path11, REQUIRED_FILES;
 var init_project_layout = __esm({
   "src/cli/commands/om/project-layout.ts"() {
     "use strict";
-    import_node_fs13 = require("node:fs");
+    import_node_fs14 = require("node:fs");
     import_node_path11 = require("node:path");
     REQUIRED_FILES = ["profile.ts", "systems.ts", "navigation.ts"];
   }
@@ -49552,8 +50017,9 @@ function emitSystemEntry(opts) {
     lifecycle: 'active',${apiInterfaceBlock}
   },
 `;
+  const startAnchor = /^(?!\s*(?:\/\/|\*|\/\*)).*\bexport const templateSystems\s*=/m;
   const anchor = /^\] as const\s*$/m;
-  return { code, anchor, apiInterfaceNote };
+  return { code, startAnchor, anchor, apiInterfaceNote };
 }
 var init_emit_system = __esm({
   "src/cli/commands/om/emit-system.ts"() {
@@ -49567,7 +50033,7 @@ async function withSnapshotRollback(filePaths, op) {
   const snapshots = /* @__PURE__ */ new Map();
   for (const filePath of filePaths) {
     try {
-      snapshots.set(filePath, (0, import_node_fs14.readFileSync)(filePath, "utf8"));
+      snapshots.set(filePath, (0, import_node_fs15.readFileSync)(filePath, "utf8"));
     } catch {
       snapshots.set(filePath, null);
     }
@@ -49578,7 +50044,7 @@ async function withSnapshotRollback(filePaths, op) {
     for (const [filePath, snapshot] of snapshots) {
       if (snapshot !== null) {
         try {
-          (0, import_node_fs14.writeFileSync)(filePath, snapshot, "utf8");
+          (0, import_node_fs15.writeFileSync)(filePath, snapshot, "utf8");
         } catch {
         }
       }
@@ -49615,9 +50081,9 @@ function reindent(code, baseIndent, extraIndent) {
   return lines.map((line) => line.trim() === "" ? line : baseIndent + extraIndent + line.slice(firstIndent.length)).join("\n");
 }
 async function appendBeforeAnchor(filePath, code, anchor, startAnchor) {
-  const content = (0, import_node_fs14.readFileSync)(filePath, "utf8");
+  const content = (0, import_node_fs15.readFileSync)(filePath, "utf8");
   if (startAnchor === void 0) {
-    (0, import_node_fs14.writeFileSync)(filePath, insertBeforeAnchorInContent(content, code, anchor), "utf8");
+    (0, import_node_fs15.writeFileSync)(filePath, insertBeforeAnchorInContent(content, code, anchor), "utf8");
     return;
   }
   const lines = content.split("\n");
@@ -49647,12 +50113,12 @@ async function appendBeforeAnchor(filePath, code, anchor, startAnchor) {
     lines[previousIndex] = previous.trimEnd() + ",";
   }
   lines.splice(anchorIndex, 0, ...indented.split("\n"));
-  (0, import_node_fs14.writeFileSync)(filePath, lines.join("\n"), "utf8");
+  (0, import_node_fs15.writeFileSync)(filePath, lines.join("\n"), "utf8");
 }
 async function applyConstImport(systemsFilePath, importLine, fieldLine, importAnchor, fieldAnchor, newConstFilePath, newConstFileCode) {
-  (0, import_node_fs14.mkdirSync)((0, import_node_path12.dirname)(newConstFilePath), { recursive: true });
-  (0, import_node_fs14.writeFileSync)(newConstFilePath, newConstFileCode, "utf8");
-  const systemsContent = (0, import_node_fs14.readFileSync)(systemsFilePath, "utf8");
+  (0, import_node_fs15.mkdirSync)((0, import_node_path12.dirname)(newConstFilePath), { recursive: true });
+  (0, import_node_fs15.writeFileSync)(newConstFilePath, newConstFileCode, "utf8");
+  const systemsContent = (0, import_node_fs15.readFileSync)(systemsFilePath, "utf8");
   const afterImport = insertBeforeAnchorInContent(systemsContent, importLine + "\n", importAnchor);
   const lines = afterImport.split("\n");
   const fieldAnchorIndex = findAnchorLineIndex(lines, afterImport, fieldAnchor);
@@ -49662,13 +50128,13 @@ async function applyConstImport(systemsFilePath, importLine, fieldLine, importAn
     );
   }
   lines.splice(fieldAnchorIndex + 1, 0, fieldLine);
-  (0, import_node_fs14.writeFileSync)(systemsFilePath, lines.join("\n"), "utf8");
+  (0, import_node_fs15.writeFileSync)(systemsFilePath, lines.join("\n"), "utf8");
 }
-var import_node_fs14, import_node_path12;
+var import_node_fs15, import_node_path12;
 var init_splice = __esm({
   "src/cli/commands/om/splice.ts"() {
     "use strict";
-    import_node_fs14 = require("node:fs");
+    import_node_fs15 = require("node:fs");
     import_node_path12 = require("node:path");
   }
 });
@@ -49720,7 +50186,7 @@ async function scaffoldSystem(opts) {
     });
     apiBacked = answer.trim().toLowerCase() === "y";
   }
-  const { code, anchor, apiInterfaceNote } = emitSystemEntry({ id, title, kind, apiBacked });
+  const { code, anchor, startAnchor, apiInterfaceNote } = emitSystemEntry({ id, title, kind, apiBacked });
   const shouldWrite = options.write === true || options.dryRun === false;
   if (!shouldWrite) {
     console.log(source_default.cyan("Dry-run mode (default) \u2014 no files written. Pass --write to apply.\n"));
@@ -49734,7 +50200,7 @@ async function scaffoldSystem(opts) {
   const systemsFilePath = (0, import_node_path13.join)(getOrganizationModelDir(projectDir), "systems.ts");
   try {
     await withSnapshotRollback([systemsFilePath], async () => {
-      await appendBeforeAnchor(systemsFilePath, code, anchor);
+      await appendBeforeAnchor(systemsFilePath, code, anchor, startAnchor);
       const validationError = runValidation(projectDir);
       if (validationError !== null) {
         throw new Error(validationError);
@@ -49786,8 +50252,9 @@ function emitResourceEntry(opts) {
 ${ontologyBlock}    codeRefs: []
   },
 `;
-  const anchor = /^export const templateResources\s*=/m;
-  return { code, anchor };
+  const startAnchor = /^(?!\s*(?:\/\/|\*|\/\*)).*\btemplateResourceDescriptors\s*=/m;
+  const anchor = /^\}/m;
+  return { code, startAnchor, anchor };
 }
 var init_emit_resource = __esm({
   "src/cli/commands/om/emit-resource.ts"() {
@@ -49841,7 +50308,7 @@ async function scaffoldResource(opts) {
     { default: "" }
   );
   const primaryAction = rawPrimaryAction || void 0;
-  const { code, anchor } = emitResourceEntry({ id, systemPath, title, primaryAction });
+  const { code, anchor, startAnchor } = emitResourceEntry({ id, systemPath, title, primaryAction });
   const shouldWrite = options.write === true || options.dryRun === false;
   if (!shouldWrite) {
     console.log(source_default.cyan("Dry-run mode (default) \u2014 no files written. Pass --write to apply.\n"));
@@ -49852,7 +50319,7 @@ async function scaffoldResource(opts) {
   const systemsFilePath = (0, import_node_path14.join)(getOrganizationModelDir(projectDir), "systems.ts");
   try {
     await withSnapshotRollback([systemsFilePath], async () => {
-      await appendBeforeAnchor(systemsFilePath, code, anchor);
+      await appendBeforeAnchor(systemsFilePath, code, anchor, startAnchor);
       const validationError = runValidation2(projectDir);
       if (validationError !== null) {
         const systemPathHint = /systemPath.*not assignable/i.test(validationError) ? `
@@ -50123,7 +50590,7 @@ async function scaffoldKnowledge(opts) {
   }
   const rawKind = await promptIfAbsent(
     options.kind,
-    "Node kind (playbook / strategy / reference / policy)",
+    "Node kind (playbook / strategy / reference)",
     { default: "reference" }
   );
   const kind = rawKind || "reference";
@@ -50148,30 +50615,30 @@ async function scaffoldKnowledge(opts) {
     return;
   }
   const absoluteFilePath = (0, import_node_path16.join)(projectDir, relativeFilePath);
-  if ((0, import_node_fs15.existsSync)(absoluteFilePath)) {
+  if ((0, import_node_fs16.existsSync)(absoluteFilePath)) {
     process.stderr.write(
       source_default.red(`Knowledge node file already exists at \`${relativeFilePath}\`. Choose a different id.
 `)
     );
     process.exit(1);
   }
-  (0, import_node_fs15.mkdirSync)((0, import_node_path16.join)(projectDir, "core", "config", "knowledge", "nodes"), { recursive: true });
-  (0, import_node_fs15.writeFileSync)(absoluteFilePath, content, "utf8");
+  (0, import_node_fs16.mkdirSync)((0, import_node_path16.join)(projectDir, "core", "config", "knowledge", "nodes"), { recursive: true });
+  (0, import_node_fs16.writeFileSync)(absoluteFilePath, content, "utf8");
   console.log(source_default.green(`Knowledge node \`${id}\` written to \`${relativeFilePath}\``));
   console.log(source_default.yellow("Run `elevasis-sdk knowledge:generate` to register this node."));
 }
-var import_node_path16, import_node_fs15, VALID_KINDS;
+var import_node_path16, import_node_fs16, VALID_KINDS;
 var init_scaffold_knowledge = __esm({
   "src/cli/commands/om/scaffold-knowledge.ts"() {
     "use strict";
     import_node_path16 = require("node:path");
-    import_node_fs15 = require("node:fs");
+    import_node_fs16 = require("node:fs");
     init_source();
     init_config2();
     init_project_layout();
     init_prompt_helpers();
     init_emit_knowledge();
-    VALID_KINDS = ["playbook", "strategy", "reference", "policy"];
+    VALID_KINDS = ["playbook", "strategy", "reference"];
   }
 });
 
@@ -50184,7 +50651,13 @@ function emitApiInterfaceBlock(gap) {
   const cataloged = SYSTEM_INTERFACE_PROFILES.find(
     (profile) => profile.systemPath === gap.systemPath && profile.interfaceKey === "api"
   );
-  const readinessProfile = cataloged?.readinessProfile ?? `${gap.systemPath}.api`;
+  if (cataloged === void 0) {
+    const adoptable = SYSTEM_INTERFACE_PROFILES.filter((profile) => profile.interfaceKey === "api").map((profile) => `"${profile.systemPath}"`).join(", ");
+    throw new Error(
+      `Cannot emit an apiInterface for system path "${gap.systemPath}": it adopts no cataloged platform API capability, so any readinessProfile emitted for it would name a route the API does not serve. Adoptable system paths are ${adoptable}. A custom System extends behavior through workflows/operations plus ontology, resources, and topology \u2014 omitting apiInterface entirely is the designed opt-out.`
+    );
+  }
+  const readinessProfile = cataloged.readinessProfile;
   const resourceIdsField = gap.resourceIds.length === 0 ? "" : `,
   resourceIds: [
     ${gap.resourceIds.map((id) => `'${id}'`).join(",\n    ")}
@@ -50247,7 +50720,7 @@ async function scaffoldFill(opts) {
     process.stderr.write(source_default.red("Missing gaps file. Pass --gaps <path> pointing to a conformance gap JSON file.\n"));
     process.exit(1);
   }
-  if (!(0, import_node_fs16.existsSync)(options.gaps)) {
+  if (!(0, import_node_fs17.existsSync)(options.gaps)) {
     process.stderr.write(
       source_default.red(
         `Missing gaps file. Pass --gaps <path> pointing to a conformance gap JSON file.
@@ -50259,7 +50732,7 @@ async function scaffoldFill(opts) {
   }
   let payload;
   try {
-    const raw = (0, import_node_fs16.readFileSync)(options.gaps, "utf8");
+    const raw = (0, import_node_fs17.readFileSync)(options.gaps, "utf8");
     payload = JSON.parse(raw);
   } catch {
     process.stderr.write(
@@ -50367,7 +50840,7 @@ async function scaffoldFill(opts) {
   }
   if (skippedGaps.length > 0) {
     const skippedPath = options.skipped ?? (0, import_node_path17.join)(os2.tmpdir(), `elevasis-fill-skipped-${systemPath}-${Date.now()}.json`);
-    (0, import_node_fs16.writeFileSync)(skippedPath, JSON.stringify({ systemPath, skipped: skippedGaps }, null, 2), "utf8");
+    (0, import_node_fs17.writeFileSync)(skippedPath, JSON.stringify({ systemPath, skipped: skippedGaps }, null, 2), "utf8");
     console.log(
       source_default.yellow(
         `Partial fill: ${appliedGaps.length} gap(s) applied, ${skippedGaps.length} skipped \u2014 see \`${skippedPath}\` for fields requiring manual input.`
@@ -50381,13 +50854,13 @@ async function scaffoldFill(opts) {
     )
   );
 }
-var import_node_path17, os2, import_node_fs16, import_node_child_process5;
+var import_node_path17, os2, import_node_fs17, import_node_child_process5;
 var init_scaffold_fill = __esm({
   "src/cli/commands/om/scaffold-fill.ts"() {
     "use strict";
     import_node_path17 = require("node:path");
     os2 = __toESM(require("node:os"), 1);
-    import_node_fs16 = require("node:fs");
+    import_node_fs17 = require("node:fs");
     import_node_child_process5 = require("node:child_process");
     init_source();
     init_config2();
@@ -55279,7 +55752,129 @@ function registerUiCommands(program3) {
 var import_node_fs9 = require("node:fs");
 var import_node_path8 = __toESM(require("node:path"), 1);
 init_source();
+init_organization_model();
 init_config2();
+init_load_org_model();
+
+// src/cli/commands/om/deployed-readiness.ts
+init_organization_model();
+init_api_client();
+function listApiInterfaceSystemPaths(model) {
+  return listAllSystems(model).filter(({ system }) => system.apiInterface !== void 0).map(({ path: path3 }) => path3);
+}
+function listDeployedReadinessTargets(model) {
+  const declared = new Set(listApiInterfaceSystemPaths(model));
+  const targets = SYSTEM_INTERFACE_PROFILES.map((profile) => ({
+    systemPath: profile.systemPath,
+    interfaceKey: profile.interfaceKey,
+    declaredLocally: declared.has(profile.systemPath)
+  }));
+  const covered = new Set(targets.map((target) => `${target.systemPath}::${target.interfaceKey}`));
+  for (const systemPath of declared) {
+    const key = `${systemPath}::api`;
+    if (covered.has(key)) continue;
+    covered.add(key);
+    targets.push({ systemPath, interfaceKey: "api", declaredLocally: true });
+  }
+  return targets;
+}
+async function fetchDeployedReadiness(model, options = {}) {
+  const targets = listDeployedReadinessTargets(model);
+  const report = {
+    activeDeploymentId: null,
+    snapshotHash: null,
+    kind: null,
+    entries: []
+  };
+  if (targets.length === 0) {
+    report.unavailableReason = "no System-interface profile to check \u2014 neither the platform catalog nor the project model declares one";
+    return report;
+  }
+  for (const target of targets) {
+    let response;
+    try {
+      const endpoint = `/api/external/organization-model/readiness?systemPath=${encodeURIComponent(target.systemPath)}&interfaceKey=${encodeURIComponent(target.interfaceKey)}`;
+      response = await apiGet(endpoint, options.apiUrl);
+    } catch (error46) {
+      report.unavailableReason = error46 instanceof Error ? error46.message : String(error46);
+      return report;
+    }
+    report.activeDeploymentId = response.activeDeploymentId;
+    report.snapshotHash = response.snapshotHash;
+    report.kind = response.kind;
+    report.entries.push({
+      systemPath: response.readiness.systemPath,
+      interfaceKey: response.readiness.interfaceKey,
+      ready: response.readiness.ready,
+      issues: response.readiness.issues,
+      declaredLocally: target.declaredLocally
+    });
+  }
+  return report;
+}
+function isUnadoptedNotDeclared(entry) {
+  return !entry.declaredLocally && entry.issues.every((issue2) => issue2.family === "SYSTEM_INTERFACE_MISSING");
+}
+function readinessDiagnostics(report) {
+  const diagnostics = [];
+  for (const entry of report.entries) {
+    if (entry.ready) {
+      diagnostics.push({
+        severity: "info",
+        code: "deployed-interface-ready",
+        systemPath: entry.systemPath,
+        message: `${entry.systemPath}/${entry.interfaceKey} is ready in the deployed snapshot.`
+      });
+      continue;
+    }
+    const unadopted = isUnadoptedNotDeclared(entry);
+    for (const issue2 of entry.issues) {
+      diagnostics.push({
+        severity: unadopted ? "info" : "error",
+        code: `deployed-${issue2.code}`,
+        systemPath: entry.systemPath,
+        ...issue2.ref !== void 0 && { targetId: issue2.ref },
+        message: `${entry.systemPath}/${entry.interfaceKey} ${unadopted ? "not adopted" : "not ready"} [${issue2.family}]: ${issue2.message}`,
+        source: "deployed-snapshot"
+      });
+    }
+  }
+  return diagnostics;
+}
+function readinessRoster(report) {
+  return report.entries.map((entry) => {
+    if (entry.ready) {
+      return {
+        systemPath: entry.systemPath,
+        interfaceKey: entry.interfaceKey,
+        status: "ready",
+        detail: "ready",
+        issues: []
+      };
+    }
+    if (isUnadoptedNotDeclared(entry)) {
+      return {
+        systemPath: entry.systemPath,
+        interfaceKey: entry.interfaceKey,
+        status: "not-adopted",
+        detail: "not adopted",
+        issues: entry.issues
+      };
+    }
+    return {
+      systemPath: entry.systemPath,
+      interfaceKey: entry.interfaceKey,
+      status: "not-ready",
+      detail: entry.issues[0]?.message ?? "not ready",
+      issues: entry.issues
+    };
+  });
+}
+function countReadinessRosterFailures(rows) {
+  return rows.filter((row) => row.status === "not-ready").length;
+}
+
+// src/cli/commands/doctor.ts
 function ok(label, detail) {
   console.log(`${source_default.green("[OK]")}   ${source_default.bold(label)}: ${detail}`);
 }
@@ -55387,6 +55982,38 @@ function registerDoctorCommand(program3) {
       if (isVerbose) verbose(`Error: ${networkError}`);
       failCount++;
     }
+    let model = DEFAULT_ORGANIZATION_MODEL;
+    try {
+      model = await loadOrgModel(projectRoot);
+    } catch (err) {
+      if (isVerbose) {
+        const msg = err instanceof Error ? err.message : String(err);
+        verbose(`Organization model load failed, roster limited to the platform catalog: ${msg}`);
+      }
+    }
+    const readiness = await fetchDeployedReadiness(model, { apiUrl });
+    if (readiness.unavailableReason !== void 0) {
+      warn("Systems", `Readiness unavailable \u2014 ${readiness.unavailableReason}`);
+      if (isVerbose) verbose(`GET ${apiUrl}/api/external/organization-model/readiness`);
+    } else {
+      const rows = readinessRoster(readiness);
+      for (const row of rows) {
+        const label = `Systems: ${row.systemPath}/${row.interfaceKey}`;
+        if (row.status === "ready") {
+          ok(label, row.detail);
+        } else if (row.status === "not-adopted") {
+          warn(label, row.detail);
+        } else {
+          fail(label, row.detail);
+        }
+        if (isVerbose) {
+          for (const issue2 of row.issues) {
+            verbose(`${issue2.code}: ${issue2.message}`);
+          }
+        }
+      }
+      failCount += countReadinessRosterFailures(rows);
+    }
     console.log();
     printSummary(failCount);
     if (failCount > 0) {
@@ -55883,6 +56510,12 @@ Content item: ${item.title}`));
 // src/cli/commands/content/board.ts
 init_source();
 
+// ../core/src/content/review-gates.ts
+function isAwaitingReview(item, step) {
+  if (!step) return false;
+  return step.reviewMode !== "none" && item.reviewedAt === null;
+}
+
 // ../core/src/content/derive-board.ts
 function sortPipelineSteps(steps) {
   return [...steps].sort((a, b) => {
@@ -55890,7 +56523,8 @@ function sortPipelineSteps(steps) {
     return a.key < b.key ? -1 : a.key > b.key ? 1 : 0;
   });
 }
-function deriveItemPlacement(processingState, sortedSteps) {
+function deriveItemPlacement(item, sortedSteps) {
+  const processingState = item.processingState;
   const stateKeys = Object.keys(processingState);
   if (stateKeys.length > 0) {
     const catalogKeys = new Set(sortedSteps.map((step) => step.key));
@@ -55904,14 +56538,14 @@ function deriveItemPlacement(processingState, sortedSteps) {
     return !entry || entry.status !== "success";
   });
   if (!currentStep) {
+    const lastStep = sortedSteps[sortedSteps.length - 1];
+    if (lastStep !== void 0 && isAwaitingReview(item, lastStep)) {
+      return { bucket: "column", stepKey: lastStep.key };
+    }
     return { bucket: "done", stepKey: null };
   }
   return { bucket: "column", stepKey: currentStep.key };
 }
-function deriveAwaitingReview(step, item) {
-  if (!step) return false;
-  return step.reviewMode !== "none" && item.reviewedAt === null;
-}
 function deriveContentBoard(items, pipeline, now) {
   const sortedSteps = sortPipelineSteps(pipeline.steps);
   const stepsByKey = new Map(sortedSteps.map((step) => [step.key, step]));
@@ -55919,13 +56553,13 @@ function deriveContentBoard(items, pipeline, now) {
   const done = [];
   const unplaced = [];
   for (const item of items) {
-    const placement = deriveItemPlacement(item.processingState, sortedSteps);
+    const placement = deriveItemPlacement(item, sortedSteps);
     const step = placement.stepKey ? stepsByKey.get(placement.stepKey) : void 0;
     const card = {
       item,
       stepKey: placement.stepKey,
       ageMs: now - Date.parse(item.updatedAt),
-      awaitingReview: deriveAwaitingReview(step, item)
+      awaitingReview: isAwaitingReview(item, step)
     };
     if (placement.bucket === "done") {
       done.push(card);
@@ -55949,9 +56583,9 @@ function deriveContentBoard(items, pipeline, now) {
   const columns = sortedSteps.map((step) => {
     const cards = cardsByStepKey.get(step.key) ?? [];
     const column = { step, cards };
-    if (step.reviewMode === "live" || step.reviewMode === "queued") {
+    if (step.reviewVenue !== "none") {
       column.gate = {
-        reviewMode: step.reviewMode,
+        venue: step.reviewVenue,
         waitingCount: cards.filter((card) => card.awaitingReview).length
       };
     }
@@ -56068,7 +56702,9 @@ Board: ${pipelineId}  ${source_default.gray(`${items.data.length} of ${items.tot
       }
       console.log();
       for (const column of board.columns) {
-        const gate = column.gate ? source_default.yellow(`  [${column.gate.reviewMode} gate -- ${column.gate.waitingCount} waiting]`) : "";
+        const gate = column.gate ? source_default.yellow(
+          `  [${column.gate.venue === "workspace" ? "workspace" : "queue"} gate -- ${column.gate.waitingCount} waiting]`
+        ) : "";
         console.log(`  ${source_default.bold(column.step.label)} ${source_default.gray(column.step.key)}${gate}`);
         printCards(column.cards, stepsByKey);
       }
@@ -56130,7 +56766,7 @@ Pipeline: ${pipeline.id}`));
   const steps = Array.isArray(pipeline.steps) ? pipeline.steps : [];
   console.log(source_default.gray(`  Steps (${steps.length}):`));
   for (const step of steps) {
-    console.log(source_default.gray(`    - ${step.key} (reviewMode: ${step.reviewMode})`));
+    console.log(source_default.gray(`    - ${step.key} (review: ${step.reviewMode}, venue: ${step.reviewVenue})`));
   }
   console.log();
 }
@@ -56267,6 +56903,203 @@ Content item ${itemId} ${verb} at step ${options.step}`));
   );
 }
 
+// src/cli/commands/content/source-assets.ts
+init_source();
+init_api_client();
+init_config2();
+init_wrap_action();
+function appendQuery6(params, key, value) {
+  if (value === void 0 || value === null || value === "") return;
+  params.set(key, String(value));
+}
+function registerContentSourceAssets(program3) {
+  program3.command("content:source-assets").description(
+    "List content source assets (raw material)\n  Example: elevasis-sdk content:source-assets --kind transcript --limit 10"
+  ).option("--kind <kind>", "Filter by source asset kind (e.g. transcript)").option("--limit <n>", "Maximum number of results").option("--offset <n>", "Pagination offset").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API base URL").option("--pretty", "Render human-readable output instead of raw JSON").action(
+    wrapAction("content:source-assets", async (options) => {
+      const apiUrl = resolveApiUrl(options.apiUrl, options.prod);
+      const params = new URLSearchParams();
+      appendQuery6(params, "kind", options.kind);
+      appendQuery6(params, "limit", options.limit);
+      appendQuery6(params, "offset", options.offset);
+      const query = params.toString();
+      const endpoint = query ? `/api/external/content/source-assets?${query}` : "/api/external/content/source-assets";
+      const result = await apiGet(endpoint, apiUrl);
+      if (!options.pretty) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+      }
+      if (result.data.length === 0) {
+        console.log(source_default.yellow("No content source assets found."));
+        return;
+      }
+      console.log(source_default.cyan(`
+Content source assets (${result.data.length} of ${result.total}):
+`));
+      for (const asset of result.data) {
+        console.log(`  ${source_default.bold(asset.title)}  ${source_default.gray(asset.kind)}`);
+        console.log(source_default.gray(`    ID: ${asset.id}`));
+        if (asset.externalUrl) console.log(source_default.gray(`    URL: ${asset.externalUrl}`));
+        if (asset.durationSeconds) console.log(source_default.gray(`    Duration: ${asset.durationSeconds}s`));
+      }
+      console.log();
+    })
+  );
+}
+
+// src/cli/commands/content/source-asset.ts
+init_source();
+init_api_client();
+init_config2();
+init_wrap_action();
+function registerContentSourceAsset(program3) {
+  program3.command("content:source-asset <sourceAssetId>").description(
+    "Get one content source asset, including its payload\n  Example: elevasis-sdk content:source-asset <uuid>"
+  ).option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API base URL").option("--pretty", "Render human-readable output instead of raw JSON").action(
+    wrapAction("content:source-asset", async (sourceAssetId, options) => {
+      const apiUrl = resolveApiUrl(options.apiUrl, options.prod);
+      const asset = await apiGet(`/api/external/content/source-assets/${sourceAssetId}`, apiUrl);
+      if (!options.pretty) {
+        console.log(JSON.stringify(asset, null, 2));
+        return;
+      }
+      console.log(source_default.cyan(`
+${asset.title}`));
+      console.log(source_default.gray(`  ID: ${asset.id}`));
+      console.log(source_default.gray(`  Kind: ${asset.kind}`));
+      if (asset.externalUrl) console.log(source_default.gray(`  URL: ${asset.externalUrl}`));
+      if (asset.durationSeconds) console.log(source_default.gray(`  Duration: ${asset.durationSeconds}s`));
+      const payloadKeys = Object.keys(asset.payload ?? {});
+      if (payloadKeys.length > 0) {
+        console.log(source_default.cyan("\n  Payload:"));
+        for (const key of payloadKeys) {
+          const value = asset.payload[key];
+          const rendered = typeof value === "string" ? value : JSON.stringify(value);
+          console.log(source_default.gray(`    ${key}:`));
+          console.log(`      ${rendered.split("\n").join("\n      ")}`);
+        }
+      }
+      console.log();
+    })
+  );
+}
+
+// src/cli/commands/content/source-asset-create.ts
+var import_node_fs10 = require("node:fs");
+init_source();
+init_api_client();
+init_config2();
+init_wrap_action();
+var PAYLOAD_MAX_BYTES = 5e5;
+function resolveTextArgument(value) {
+  if (!value.startsWith("@")) return value;
+  const path3 = value.slice(1);
+  try {
+    return (0, import_node_fs10.readFileSync)(path3, "utf8");
+  } catch (error46) {
+    throw new Error(`Could not read --text file "${path3}": ${error46 instanceof Error ? error46.message : String(error46)}`);
+  }
+}
+function resolveMetadataOption(options) {
+  if (options.metadata !== void 0 && options.metadataFile !== void 0) {
+    throw new Error("Pass exactly one of --metadata or --metadata-file, not both");
+  }
+  let raw;
+  if (options.metadataFile !== void 0) {
+    const path3 = resolveProjectRelative(options.metadataFile);
+    try {
+      raw = (0, import_node_fs10.readFileSync)(path3, "utf8");
+    } catch (error46) {
+      throw new Error(
+        `Could not read --metadata-file "${options.metadataFile}": ${error46 instanceof Error ? error46.message : String(error46)}`
+      );
+    }
+  } else {
+    raw = options.metadata;
+  }
+  if (raw === void 0) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error46) {
+    const source = options.metadataFile !== void 0 ? "--metadata-file" : "--metadata";
+    throw new Error(`${source} must be valid JSON: ${error46 instanceof Error ? error46.message : String(error46)}`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    const source = options.metadataFile !== void 0 ? "--metadata-file" : "--metadata";
+    throw new Error(`${source} must be a JSON object, e.g. {"key":"value"}`);
+  }
+  return parsed;
+}
+function registerContentSourceAssetCreate(program3) {
+  program3.command("content:source-asset:create").description(
+    'Create a content source asset from inline text or a URL, optionally linking it to an item\n  Example: elevasis-sdk content:source-asset:create --kind transcript --title "Episode 12" --text @transcript.txt --item <uuid>'
+  ).requiredOption("--kind <kind>", "Source asset kind (e.g. transcript) -- validated against the org model catalog").requiredOption("--title <title>", "Human-readable title (1..500 chars)").option("--text <value>", "Inline text, or @path to read a local file. Mutually exclusive with --url").option(
+    "--field <key>",
+    "Payload field the --text content is written to. Defaults to the --kind value, matching the catalog declaration"
+  ).option("--url <url>", "External URL the asset references. Mutually exclusive with --text").option("--duration <seconds>", "Duration in seconds, for time-based referenced media").option("--storage-path <path>", "Storage path the asset references (1..2000 chars)").option("--metadata <json>", "Arbitrary metadata as a JSON object string. Mutually exclusive with --metadata-file").option(
+    "--metadata-file <path>",
+    "Path to a JSON file containing metadata (project-relative unless absolute). Mutually exclusive with --metadata"
+  ).option("--item <itemId>", "Link the new asset to this content item after creating it").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API base URL").option("--pretty", "Render human-readable output instead of raw JSON").action(
+    wrapAction("content:source-asset:create", async (options) => {
+      if (options.text !== void 0 && options.url !== void 0) {
+        throw new Error("Pass exactly one of --text or --url, not both");
+      }
+      if (options.text === void 0 && options.url === void 0) {
+        throw new Error("Pass one of --text (inline content) or --url (a reference)");
+      }
+      if (options.field !== void 0 && options.text === void 0) {
+        throw new Error("--field only applies to --text");
+      }
+      const body = { kind: options.kind, title: options.title };
+      if (options.text !== void 0) {
+        const text = resolveTextArgument(options.text);
+        const field2 = options.field ?? options.kind;
+        const size = Buffer.byteLength(text, "utf8");
+        if (size > PAYLOAD_MAX_BYTES) {
+          throw new Error(
+            `--text content is ${size} bytes, over the ${PAYLOAD_MAX_BYTES}-byte payload limit. Split it or store it as a reference with --url`
+          );
+        }
+        body.payload = { [field2]: text };
+      }
+      if (options.url !== void 0) body.externalUrl = options.url;
+      if (options.duration !== void 0) {
+        const duration3 = Number(options.duration);
+        if (!Number.isInteger(duration3) || duration3 < 0) {
+          throw new Error("--duration must be a non-negative integer number of seconds");
+        }
+        body.durationSeconds = duration3;
+      }
+      if (options.storagePath !== void 0) body.storagePath = options.storagePath;
+      const metadata = resolveMetadataOption(options);
+      if (metadata !== void 0) body.metadata = metadata;
+      const apiUrl = resolveApiUrl(options.apiUrl, options.prod);
+      const asset = await apiPost("/api/external/content/source-assets", body, apiUrl);
+      let linkedItem;
+      if (options.item !== void 0) {
+        linkedItem = await apiPatch(
+          `/api/external/content/items/${options.item}`,
+          { sourceAssetId: asset.id },
+          apiUrl
+        );
+      }
+      if (!options.pretty) {
+        console.log(JSON.stringify(linkedItem ? { sourceAsset: asset, item: linkedItem } : asset, null, 2));
+        return;
+      }
+      console.log(source_default.green(`
+Created source asset ${asset.id}`));
+      console.log(source_default.gray(`  Title: ${asset.title}`));
+      console.log(source_default.gray(`  Kind: ${asset.kind}`));
+      if (asset.externalUrl) console.log(source_default.gray(`  URL: ${asset.externalUrl}`));
+      if (asset.storagePath) console.log(source_default.gray(`  Storage path: ${asset.storagePath}`));
+      if (linkedItem) console.log(source_default.cyan(`  Linked to item ${linkedItem.id} (${linkedItem.title})`));
+      console.log();
+    })
+  );
+}
+
 // src/cli/commands/content/index.ts
 function registerContentCommands(program3) {
   registerContentList(program3);
@@ -56276,6 +57109,9 @@ function registerContentCommands(program3) {
   registerContentPipeline(program3);
   registerContentDistributions(program3);
   registerContentReview(program3);
+  registerContentSourceAssets(program3);
+  registerContentSourceAsset(program3);
+  registerContentSourceAssetCreate(program3);
 }
 
 // src/cli/commands/queue/queue.ts
@@ -56286,7 +57122,7 @@ init_wrap_action();
 function printJson8(value) {
   console.log(JSON.stringify(value, null, 2));
 }
-function appendQuery6(params, key, value) {
+function appendQuery7(params, key, value) {
   if (value === void 0 || value === null || value === "") return;
   params.set(key, String(value));
 }
@@ -56312,13 +57148,13 @@ function registerQueueList(program3) {
       async (options) => {
         const apiUrl = resolveApiUrl(options.apiUrl, options.prod);
         const params = new URLSearchParams();
-        appendQuery6(params, "status", options.status);
-        appendQuery6(params, "humanCheckpoint", options.humanCheckpoint);
-        appendQuery6(params, "timeRange", options.timeRange);
-        appendQuery6(params, "priorityMin", options.priorityMin);
-        appendQuery6(params, "priorityMax", options.priorityMax);
-        appendQuery6(params, "limit", options.limit);
-        appendQuery6(params, "offset", options.offset);
+        appendQuery7(params, "status", options.status);
+        appendQuery7(params, "humanCheckpoint", options.humanCheckpoint);
+        appendQuery7(params, "timeRange", options.timeRange);
+        appendQuery7(params, "priorityMin", options.priorityMin);
+        appendQuery7(params, "priorityMax", options.priorityMax);
+        appendQuery7(params, "limit", options.limit);
+        appendQuery7(params, "offset", options.offset);
         const result = await apiGet(
           endpointWithQuery4("/api/external/command-queue", params),
           apiUrl
@@ -56423,10 +57259,10 @@ function registerQueueStatus(program3) {
       async (options) => {
         const apiUrl = resolveApiUrl(options.apiUrl, options.prod);
         const params = new URLSearchParams();
-        appendQuery6(params, "timeRange", options.timeRange);
-        appendQuery6(params, "priorityMin", options.priorityMin);
-        appendQuery6(params, "priorityMax", options.priorityMax);
-        appendQuery6(params, "status", options.status);
+        appendQuery7(params, "timeRange", options.timeRange);
+        appendQuery7(params, "priorityMin", options.priorityMin);
+        appendQuery7(params, "priorityMax", options.priorityMax);
+        appendQuery7(params, "status", options.status);
         const result = await apiGet(
           endpointWithQuery4("/api/external/command-queue/checkpoints", params),
           apiUrl
@@ -56475,7 +57311,7 @@ init_wrap_action();
 function printJson9(value) {
   console.log(JSON.stringify(value, null, 2));
 }
-function appendQuery7(params, key, value) {
+function appendQuery8(params, key, value) {
   if (value === void 0 || value === null || value === "") return;
   params.set(key, String(value));
 }
@@ -56504,11 +57340,11 @@ function registerScheduleList(program3) {
       async (options) => {
         const apiUrl = resolveApiUrl(options.apiUrl, options.prod);
         const params = new URLSearchParams();
-        appendQuery7(params, "status", options.status);
-        appendQuery7(params, "targetResourceType", options.targetResourceType);
-        appendQuery7(params, "targetResourceId", options.targetResourceId);
-        appendQuery7(params, "limit", options.limit);
-        appendQuery7(params, "offset", options.offset);
+        appendQuery8(params, "status", options.status);
+        appendQuery8(params, "targetResourceType", options.targetResourceType);
+        appendQuery8(params, "targetResourceId", options.targetResourceId);
+        appendQuery8(params, "limit", options.limit);
+        appendQuery8(params, "offset", options.offset);
         const result = await apiGet(
           endpointWithQuery5("/api/external/task-scheduler/schedules", params),
           apiUrl
@@ -56856,7 +57692,7 @@ function registerAgentCommands(program3) {
 }
 
 // src/cli/commands/session/session.ts
-var import_node_fs10 = require("node:fs");
+var import_node_fs11 = require("node:fs");
 init_source();
 init_api_client();
 init_config2();
@@ -56864,7 +57700,7 @@ init_wrap_action();
 function printJson11(value) {
   console.log(JSON.stringify(value, null, 2));
 }
-function appendQuery8(params, key, value) {
+function appendQuery9(params, key, value) {
   if (value === void 0 || value === null || value === "") return;
   params.set(key, String(value));
 }
@@ -56882,7 +57718,7 @@ function parseJson(value, label) {
 }
 function readJsonFile(path3, label) {
   const resolved = resolveProjectRelative(path3);
-  return parseJson((0, import_node_fs10.readFileSync)(resolved, "utf8"), label);
+  return parseJson((0, import_node_fs11.readFileSync)(resolved, "utf8"), label);
 }
 function resolveTurnInput(options) {
   if (options.input && options.inputFile) {
@@ -56898,8 +57734,8 @@ function resolveTurnInput(options) {
 }
 function messagesEndpoint(sessionId, limit, cursor) {
   const params = new URLSearchParams();
-  appendQuery8(params, "limit", limit);
-  appendQuery8(params, "cursor", cursor);
+  appendQuery9(params, "limit", limit);
+  appendQuery9(params, "cursor", cursor);
   return endpointWithQuery6(`/api/external/sessions/${sessionId}/messages`, params);
 }
 async function fetchSessionMessages(sessionId, apiUrl, options) {
@@ -56984,9 +57820,9 @@ function registerSessionList(program3) {
     wrapAction("session:list", async (options) => {
       const apiUrl = resolveApiUrl(options.apiUrl, options.prod);
       const params = new URLSearchParams();
-      appendQuery8(params, "resourceId", options.resourceId);
-      appendQuery8(params, "userId", options.userId);
-      appendQuery8(params, "limit", options.limit);
+      appendQuery9(params, "resourceId", options.resourceId);
+      appendQuery9(params, "userId", options.userId);
+      appendQuery9(params, "limit", options.limit);
       const result = await apiGet(endpointWithQuery6("/api/external/sessions", params), apiUrl);
       if (options.json) {
         printJson11(result);
@@ -57121,7 +57957,7 @@ init_wrap_action();
 function printJson12(value) {
   console.log(JSON.stringify(value, null, 2));
 }
-function appendQuery9(params, key, value) {
+function appendQuery10(params, key, value) {
   if (value === void 0 || value === null || value === "" || value === false) return;
   params.set(key, String(value));
 }
@@ -57186,8 +58022,8 @@ function registerGrantList(program3) {
     wrapAction("grant:list", async (options) => {
       const apiUrl = resolveApiUrl(options.apiUrl, options.prod);
       const params = new URLSearchParams();
-      appendQuery9(params, "resourceId", options.resourceId);
-      appendQuery9(params, "includeDisabled", options.includeDisabled ? "true" : void 0);
+      appendQuery10(params, "resourceId", options.resourceId);
+      appendQuery10(params, "includeDisabled", options.includeDisabled ? "true" : void 0);
       const result = await apiGet(
         endpointWithQuery7("/api/external/agent-access-grants", params),
         apiUrl
@@ -57634,71 +58470,6 @@ function formatOmDoctorReport(report) {
   return lines.join("\n");
 }
 
-// src/cli/commands/om/deployed-readiness.ts
-init_organization_model();
-init_api_client();
-function listApiInterfaceSystemPaths(model) {
-  return listAllSystems(model).filter(({ system }) => system.apiInterface !== void 0).map(({ path: path3 }) => path3);
-}
-async function fetchDeployedReadiness(model, options = {}) {
-  const systemPaths = listApiInterfaceSystemPaths(model);
-  const report = {
-    activeDeploymentId: null,
-    snapshotHash: null,
-    kind: null,
-    entries: []
-  };
-  if (systemPaths.length === 0) {
-    report.unavailableReason = "no System in the project model declares an apiInterface";
-    return report;
-  }
-  for (const systemPath of systemPaths) {
-    let response;
-    try {
-      const endpoint = `/api/external/organization-model/readiness?systemPath=${encodeURIComponent(systemPath)}&interfaceKey=api`;
-      response = await apiGet(endpoint, options.apiUrl);
-    } catch (error46) {
-      report.unavailableReason = error46 instanceof Error ? error46.message : String(error46);
-      return report;
-    }
-    report.activeDeploymentId = response.activeDeploymentId;
-    report.snapshotHash = response.snapshotHash;
-    report.kind = response.kind;
-    report.entries.push({
-      systemPath: response.readiness.systemPath,
-      interfaceKey: response.readiness.interfaceKey,
-      ready: response.readiness.ready,
-      issues: response.readiness.issues
-    });
-  }
-  return report;
-}
-function readinessDiagnostics(report) {
-  const diagnostics = [];
-  for (const entry of report.entries) {
-    if (entry.ready) {
-      diagnostics.push({
-        severity: "info",
-        code: "deployed-interface-ready",
-        systemPath: entry.systemPath,
-        message: `${entry.systemPath}/${entry.interfaceKey} is ready in the deployed snapshot.`
-      });
-      continue;
-    }
-    for (const issue2 of entry.issues) {
-      diagnostics.push({
-        severity: "error",
-        code: `deployed-${issue2.code}`,
-        systemPath: entry.systemPath,
-        ...issue2.ref !== void 0 && { targetId: issue2.ref },
-        message: `${entry.systemPath}/${entry.interfaceKey} not ready [${issue2.family}]: ${issue2.message}`,
-        source: "deployed-snapshot"
-      });
-    }
-  }
-  return diagnostics;
-}
-
 // src/cli/commands/om/doctor.ts
 function registerOmDoctorCommand(program3) {
   program3.command("om:doctor").description(
@@ -57762,7 +58533,7 @@ function registerOmDoctorCommand(program3) {
 }
 
 // src/cli/commands/om/rename.ts
-var import_node_fs11 = require("node:fs");
+var import_node_fs12 = require("node:fs");
 var import_node_path9 = require("node:path");
 init_config2();
 init_wrap_action();
@@ -57800,10 +58571,10 @@ function absolutePath(sourceRoot, relativePath) {
 }
 function walkFiles(sourceRoot, relativeRoot, extension) {
   const root = absolutePath(sourceRoot, relativeRoot);
-  if (!(0, import_node_fs11.existsSync)(root)) return [];
+  if (!(0, import_node_fs12.existsSync)(root)) return [];
   const targets = [];
   function visit(directory) {
-    for (const entry of (0, import_node_fs11.readdirSync)(directory, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs12.readdirSync)(directory, { withFileTypes: true })) {
       const fullPath = (0, import_node_path9.join)(directory, entry.name);
       if (entry.isDirectory()) {
         visit(fullPath);
@@ -57885,8 +58656,8 @@ function createOmRenamePlan(oldPathArg, newPathArg, options = {}) {
   const edits = [];
   for (const target of buildTargets(sourceRoot)) {
     const path3 = absolutePath(sourceRoot, target.path);
-    if (!(0, import_node_fs11.existsSync)(path3)) continue;
-    const source = (0, import_node_fs11.readFileSync)(path3, "utf8");
+    if (!(0, import_node_fs12.existsSync)(path3)) continue;
+    const source = (0, import_node_fs12.readFileSync)(path3, "utf8");
     const transformed = transformContent(source, target.path, oldPath, newPath);
     if (transformed.count === 0) continue;
     edits.push({
@@ -57913,20 +58684,20 @@ function createOmRenamePlan(oldPathArg, newPathArg, options = {}) {
 function snapshotEdits(sourceRoot, edits) {
   return edits.map((edit) => {
     const path3 = absolutePath(sourceRoot, edit.path);
-    return { path: path3, content: (0, import_node_fs11.readFileSync)(path3, "utf8") };
+    return { path: path3, content: (0, import_node_fs12.readFileSync)(path3, "utf8") };
   });
 }
 function restoreSnapshot(snapshot) {
   for (const entry of snapshot) {
-    (0, import_node_fs11.writeFileSync)(entry.path, entry.content);
+    (0, import_node_fs12.writeFileSync)(entry.path, entry.content);
   }
 }
 function applyPlan(sourceRoot, plan) {
   for (const edit of plan.edits) {
     const path3 = absolutePath(sourceRoot, edit.path);
-    const source = (0, import_node_fs11.readFileSync)(path3, "utf8");
+    const source = (0, import_node_fs12.readFileSync)(path3, "utf8");
     const transformed = transformContent(source, edit.path, plan.oldPath, plan.newPath);
-    (0, import_node_fs11.writeFileSync)(path3, transformed.output);
+    (0, import_node_fs12.writeFileSync)(path3, transformed.output);
   }
 }
 async function defaultOmRenameValidator(plan, sourceRoot) {
@@ -57934,7 +58705,7 @@ async function defaultOmRenameValidator(plan, sourceRoot) {
   try {
     if (plan.edits.some((edit) => edit.path.endsWith(".mdx"))) {
       const sourceDir = absolutePath(sourceRoot, KNOWLEDGE_ROOT);
-      if ((0, import_node_fs11.existsSync)(sourceDir)) {
+      if ((0, import_node_fs12.existsSync)(sourceDir)) {
         const generated = generateKnowledgeNodes({
           sourceDir,
           outputPath: absolutePath(sourceRoot, KNOWLEDGE_GENERATED_OUTPUT),
@@ -58022,7 +58793,7 @@ function registerOmRenameCommand(program3) {
 }
 
 // src/cli/commands/om/deprecate.ts
-var import_node_fs12 = require("node:fs");
+var import_node_fs13 = require("node:fs");
 var import_node_path10 = require("node:path");
 init_src();
 init_config2();
@@ -58131,8 +58902,8 @@ function createOmDeprecatePlan(model, systemPathArg, options = {}) {
   const warnings = hasDependents && to === "deprecated" ? ["Live dependents were found. Deprecation is allowed, but plan the dependent wind-down before archiving."] : [];
   const blocked = to === "archived" && hasDependents && !confirmed;
   let edit = null;
-  if ((0, import_node_fs12.existsSync)(systemsPath)) {
-    const source = (0, import_node_fs12.readFileSync)(systemsPath, "utf8");
+  if ((0, import_node_fs13.existsSync)(systemsPath)) {
+    const source = (0, import_node_fs13.readFileSync)(systemsPath, "utf8");
     edit = {
       path: SYSTEMS_FILE2,
       replacements: transformSystemLifecycle(source, systemPath, to).replacements
@@ -58177,13 +58948,13 @@ async function executeOmDeprecatePlan(plan, options = {}) {
     return { plan, wrote: false, validation: { ok: true, output: "no lifecycle change needed" }, rolledBack: false };
   }
   const systemsPath = absolutePath2(sourceRoot, SYSTEMS_FILE2);
-  const before = (0, import_node_fs12.readFileSync)(systemsPath, "utf8");
+  const before = (0, import_node_fs13.readFileSync)(systemsPath, "utf8");
   const transformed = transformSystemLifecycle(before, plan.systemPath, plan.to);
-  (0, import_node_fs12.writeFileSync)(systemsPath, transformed.output);
+  (0, import_node_fs13.writeFileSync)(systemsPath, transformed.output);
   const validator = options.validator ?? defaultOmDeprecateValidator;
   const validation = await validator(plan, sourceRoot);
   if (!validation.ok) {
-    (0, import_node_fs12.writeFileSync)(systemsPath, before);
+    (0, import_node_fs13.writeFileSync)(systemsPath, before);
     return { plan, wrote: true, validation, rolledBack: true };
   }
   return { plan, wrote: true, validation, rolledBack: false };
@@ -58278,7 +59049,7 @@ function registerOmScaffoldCommands(program3) {
     const mod = await Promise.resolve().then(() => (init_scaffold_ontology(), scaffold_ontology_exports));
     await mod.default(opts);
   });
-  program3.command("om:scaffold:knowledge").description("Create a new MDX knowledge node file in core/config/knowledge/nodes/").option("--id <id>", "knowledge node id, e.g. outreach-playbook (prompted if absent)").option("--kind <kind>", "node kind: playbook | strategy | reference | policy (prompted if absent)").option("--system-path <path>", "governing system path for mount (prompted; can be blank for global)").option("--write", "apply the change (default is a dry-run preview \u2014 no files written)").action(async (opts) => {
+  program3.command("om:scaffold:knowledge").description("Create a new MDX knowledge node file in core/config/knowledge/nodes/").option("--id <id>", "knowledge node id, e.g. outreach-playbook (prompted if absent)").option("--kind <kind>", "node kind: playbook | strategy | reference (prompted if absent)").option("--system-path <path>", "governing system path for mount (prompted; can be blank for global)").option("--write", "apply the change (default is a dry-run preview \u2014 no files written)").action(async (opts) => {
     const mod = await Promise.resolve().then(() => (init_scaffold_knowledge(), scaffold_knowledge_exports));
     await mod.default(opts);
   });
@@ -58373,7 +59144,7 @@ function registerSkillScaffoldCommand(program3) {
 }
 
 // src/cli/json-file-argv.ts
-var import_node_fs17 = require("node:fs");
+var import_node_fs18 = require("node:fs");
 var import_node_path18 = require("node:path");
 init_config2();
 var JSON_FILE_PREFIX = "@json:";
@@ -58404,7 +59175,7 @@ function resolveJsonFilePath(path3, options) {
 function readJsonFileReference(ref, options) {
   const relativeOrAbsolutePath = ref.slice(JSON_FILE_PREFIX.length);
   const resolvedPath = resolveJsonFilePath(relativeOrAbsolutePath, options);
-  const raw = (options.readFile ?? ((path3) => (0, import_node_fs17.readFileSync)(path3, "utf8")))(resolvedPath);
+  const raw = (options.readFile ?? ((path3) => (0, import_node_fs18.readFileSync)(path3, "utf8")))(resolvedPath);
   try {
     JSON.parse(raw);
   } catch {
@@ -58512,63 +59283,7 @@ if (envPath) {
 }
 var program2 = new Command();
 program2.name("elevasis-sdk").description(
-  source_default.cyan("Elevasis SDK CLI") + `
-
-Commands:
-  elevasis-sdk check                                Validate project resources
-  elevasis-sdk deploy                               Bundle and deploy to platform
-  elevasis-sdk resources                            List deployed resources
-  elevasis-sdk describe <resourceId>                Describe a resource
-  elevasis-sdk exec <resourceId> -i '{}'            Execute a resource
-  elevasis-sdk executions <resourceId>              List execution history
-  elevasis-sdk execution <resourceId> <id>          Get execution details
-  elevasis-sdk execution:cancel <resourceId> <id>   Cancel a running execution
-  elevasis-sdk executions:delete <resourceId>       Delete execution history (destructive)
-  elevasis-sdk deployments                          List deployments
-  elevasis-sdk project:list [--search <query>]      List projects with optional search
-  elevasis-sdk project:resolve <query>              Resolve a project ID from a name or UUID
-  elevasis-sdk project:work <query>                 Open a lifecycle-aware project work brief
-  elevasis-sdk client:list [--search <query>]       List clients with optional search
-  elevasis-sdk client:get <id>                      Get client detail and lineage
-  elevasis-sdk client:status                        Show client portfolio status
-  elevasis-sdk content:list [--status queued]       List content pipeline items
-  elevasis-sdk content:get <itemId>                 Get an item, its attempts, and distributions
-  elevasis-sdk content:queue                        List items awaiting a queued-gate review
-  elevasis-sdk content:pipeline [id]                List pipeline templates, or one step contract
-  elevasis-sdk content:distributions                List content distributions
-  elevasis-sdk content:review <itemId> --step <key> --approve|--reject --user <email>
-                                                     Clear a queued review gate on a content item
-  elevasis-sdk queue:list [--status pending]        List HITL command queue tasks
-  elevasis-sdk queue:select <id> --action-id <id>   Select and execute a HITL queue action
-  elevasis-sdk schedule:list [--status active]      List task schedules
-  elevasis-sdk schedule:create --name <name> ...    Create a task schedule
-  elevasis-sdk agent:list                           List deployed agents
-  elevasis-sdk agent:get <id>                       Get agent metadata and OM linkage
-  elevasis-sdk session:create <resourceId>          Create an agent session
-  elevasis-sdk session:turn <id> -f tmp/turn.json   Execute a session turn
-  elevasis-sdk session:messages <id>                Export session transcript messages
-  elevasis-sdk session:list                         List agent sessions
-  elevasis-sdk session:get <id>                     Get session details
-  elevasis-sdk session:end <id>                     End an active agent session
-  elevasis-sdk grant:list                           List public/code-gated agent access grants
-  elevasis-sdk grant:create --resource <id>       Create an agent access grant
-  elevasis-sdk grant:disable <slug>                  Disable an agent access grant
-  elevasis-sdk acquisition:list:list                 List acquisition lists
-  elevasis-sdk acquisition:deal:list                 List acquisition deals
-  elevasis-sdk knowledge:generate                   Generate knowledge nodes from MDX files
-  elevasis-sdk knowledge:ls <path>                  List knowledge nodes for a path
-  elevasis-sdk knowledge:cat <id>                   Print raw MDX body of a knowledge node
-  elevasis-sdk knowledge:graph <id>                 Show outgoing and incoming edges for a node
-  elevasis-sdk request:submit -f <path>             Submit a structured request report
-  elevasis-sdk request:list [--status open]         List reported requests
-  elevasis-sdk request:get <id>                     Get a reported request by id
-  elevasis-sdk ui:use-local                         Use a local @elevasis/ui tarball
-  elevasis-sdk ui:use-published                     Restore published @elevasis/ui
-  elevasis-sdk cli [domain]                         Generate a registered command catalog
-  elevasis-sdk rename <id> --to <newId> [--prod]     Rename resource across platform tables
-  elevasis-sdk doctor [--verbose]                    Check project environment and API connectivity
-
-Use "elevasis-sdk <command> --help" for more information about a command.`
+  source_default.cyan("Elevasis SDK CLI") + '\n\nRun `elevasis-sdk cli` for the full command catalog. It is built by scanning the\ncommands actually registered below, so it can never drift out of sync the way a\nhand-written list here would.\n\n  elevasis-sdk cli                      Full catalog, grouped by domain\n  elevasis-sdk cli --domain <domain>    Filter to one domain, e.g. project, content, agent\n  elevasis-sdk cli --format json         Machine-readable catalog\n\nUse "elevasis-sdk <command> --help" for a specific command\'s options.'
 ).version(SDK_VERSION);
 program2.hook("preAction", () => {
   runPreflight();