@elevasis/sdk 1.47.0 → 1.49.0

package/reference/sdk/cli-management.mdx

@@ -1,11 +1,11 @@
 ---
 title: CLI Management Commands
-description: elevasis-sdk management commands -- project, note, acquisition, client, agent, session, queue, schedule, om, ui, skill, and content subcommand families
+description: elevasis-sdk management commands -- project, note, acquisition, client, agent, session, queue, schedule, om, ui, skill, content, and grant subcommand families
 ---
 
 This page covers the domain management commands for `elevasis-sdk`. For core SDK commands (check, deploy, exec, resources, executions, describe, creds, rename), see [CLI Reference](cli.mdx).
 
-Every command family on this page -- `project`, `note`, `acquisition`, `client`, `agent`, `session`, `queue`, `schedule`, `om:doctor`, `request`, and `content` -- also accepts `--prod` to target production, overriding `NODE_ENV=development` (live as of `@elevasis/sdk` 1.45.0). See [CLI Reference's Global Flags](cli.mdx#global-flags) for the full description; per-command flag tables below list `--api-url` and other command-specific flags only, not `--prod` or `--json`.
+Every command family on this page -- `project`, `note`, `error`, `acquisition`, `client`, `agent`, `session`, `queue`, `schedule`, `om:doctor`, `request`, `content`, and `grant` -- also accepts `--prod` to target production, overriding `NODE_ENV=development` (live as of `@elevasis/sdk` 1.45.0). See [CLI Reference's Global Flags](cli.mdx#global-flags) for the full description; per-command flag tables below list `--api-url` and other command-specific flags only, not `--prod` or `--json`.
 
 ---
 
@@ -61,6 +61,8 @@ This CLI family is SDK-first, but it is not semantically standalone. It operates
 
 ```bash
 elevasis-sdk project:list
+elevasis-sdk project:resolve "Website Refresh"
+elevasis-sdk project:work "Website Refresh"
 elevasis-sdk project:get <id>
 elevasis-sdk project:create --name "Website Refresh" --kind client_engagement
 elevasis-sdk project:update <id> --status completed
@@ -69,7 +71,9 @@ elevasis-sdk project:delete <id>
 
 **Behavior:**
 
-- `project:list` filters by `--kind` and `--status`
+- `project:list` filters by `--kind`, `--status`, `--search`, and `--client` (a UUID or fuzzy client name, resolved through the same client-lookup helper `client:resolve` exposes)
+- `project:resolve <query>` resolves a project ID from a UUID, exact name, or search query and prints the ID (or the full record with `--pretty`) -- the same resolution logic used internally wherever a project command accepts a fuzzy identifier
+- `project:work <query>` (alias `project:open`) resolves a project and prints a lifecycle-aware work brief combining the project record and its notes; `--json` renders the structured brief instead of the formatted one
 - `project:get` returns a single project
 - `project:create` and `project:update` operate on `/api/external/projects`
 
@@ -188,6 +192,22 @@ elevasis-sdk request:get <id>
 | `--pretty`            | Human-readable output instead of raw JSON       |
 | `--api-url <url>`   | Override the API base URL                       |
 
+**Write-back commands** (amend or withdraw a request you filed):
+
+```bash
+elevasis-sdk request:update <id> --input '{"project_id":"<uuid>"}'
+elevasis-sdk request:delete <id>
+```
+
+`request:update` calls `PATCH /api/external/requests/:id` to backfill fields (for example `project_id` / `task_id` on rows filed before those were populated) -- the payload is validated against `UpdateRequestInputSchema`. `status` is not writable through this command; it is the platform's answer to the request, so poll `request:get` to read it instead. `request:delete` calls `DELETE /api/external/requests/:id` and is permanent -- the row is removed, not archived. Use `request:update` to amend a request instead of deleting and resubmitting.
+
+| Flag                        | Description                                                                 |
+| --------------------------- | --------------------------------------------------------------------------- |
+| `-i, --input <json>`      | Fields to change, as a JSON object (update: required unless `--input-file`) |
+| `-f, --input-file <path>` | Read the changed fields from a JSON file instead of `--input`               |
+| `--pretty`                  | Human-readable output instead of raw JSON                                   |
+| `--api-url <url>`         | Override the API base URL                                                   |
+
 ---
 
 ### Shared Flags
@@ -363,6 +383,31 @@ The following invariants govern the Notes feature and are relevant when building
 
 ---
 
+## elevasis-sdk error:\*
+
+Resolve execution errors surfaced by the observability layer -- mark one error, or every error tied to a single execution, as resolved.
+
+```bash
+elevasis-sdk error resolve <errorId>
+elevasis-sdk error resolve-execution <executionId>
+```
+
+- `error resolve <errorId>` -- calls `PATCH /api/external/observability/errors/:errorId/resolve` and marks that one error resolved
+- `error resolve-execution <executionId>` -- calls `PATCH /api/external/observability/errors/execution/:executionId/resolve` and marks every error tied to that execution resolved in one call
+
+These are space-separated subcommands under the `error` group (`error resolve`, not `error:resolve`), unlike every other domain on this page.
+
+**Flags:**
+
+| Flag                | Description                                          |
+| ------------------- | ---------------------------------------------------- |
+| `--prod`            | Target production (overrides `NODE_ENV=development`) |
+| `--api-url <url>` | Override the API base URL                            |
+
+**Implementation:** `packages/sdk/src/cli/commands/error/`
+
+---
+
 ## elevasis-sdk acquisition:\*
 
 Read-only access to acquisition lists and CRM deals. The acquisition CLI scope is intentionally read-only; mutating commands are deferred.
@@ -375,7 +420,7 @@ elevasis-sdk acquisition:list:get <id>
 elevasis-sdk acquisition:list:status
 ```
 
-- `acquisition:list:list` -- list all acquisition lists for the organization
+- `acquisition:list:list` -- list acquisition lists for the organization; filters: `--status` (`draft | enriching | launched | closing | archived`), `--batch`, `--vertical`, `--limit`, `--offset`
 - `acquisition:list:get <id>` -- get full detail for a single acquisition list by UUID
 - `acquisition:list:status` -- summarize counts and progress across all lists
 
@@ -387,7 +432,7 @@ elevasis-sdk acquisition:deal:get <id>
 elevasis-sdk acquisition:deal:status
 ```
 
-- `acquisition:deal:list` -- list all CRM deals visible to the organization
+- `acquisition:deal:list` -- list CRM deals visible to the organization; filters: `--stage`, `--list <id>`, `--batch`, `--stale-since <iso>`, `--search`, `--limit`, `--offset`
 - `acquisition:deal:get <id>` -- get a single deal record
 - `acquisition:deal:status` -- summarize deal pipeline counts
 
@@ -446,12 +491,18 @@ Full CRUD management for client records. The `client:*` family covers create, re
 
 ```bash
 elevasis-sdk client:list
+elevasis-sdk client:resolve "Acme"
 elevasis-sdk client:get <id>
+elevasis-sdk client:status
 elevasis-sdk client:create --name "Acme Corp"
 elevasis-sdk client:update <id> --name "Acme Corp Updated"
 elevasis-sdk client:delete <id>
 ```
 
+- `client:resolve <query>` resolves a client ID from a UUID, exact name, or search query and prints the ID (or the full record with `--pretty`) -- the same resolution `client:update`, `client:delete`, and `project:create --client` use internally
+- `client:status` summarizes the client portfolio: totals by status and linked-record counts (deals, projects, companies, contacts)
+- `client:update` supports `--clear-source-deal`, `--clear-primary-company`, and `--clear-primary-contact` to null out those links; each is mutually exclusive with its corresponding set flag
+
 **Flags:**
 
 | Flag                | Description                                        |
@@ -459,7 +510,7 @@ elevasis-sdk client:delete <id>
 | `--pretty`          | Human-readable terminal output instead of raw JSON |
 | `--api-url <url>` | Override the API base URL                          |
 
-**Implementation:** `packages/sdk/src/cli/commands/` (client family)
+**Implementation:** `packages/sdk/src/cli/commands/client/` (client family)
 
 ---
 
@@ -472,19 +523,22 @@ elevasis-sdk agent:list
 elevasis-sdk agent:get <id>
 ```
 
-- `agent:list` -- list all agents registered for the organization
-- `agent:get <id>` -- get metadata and schema for a specific agent
+- `agent:list` -- list resources for the organization, filtered client-side to `resourceType: 'agent'`
+- `agent:get <id>` -- get metadata and organization-model linkage for a specific agent
 
-**API routes:** `GET /api/external/agents`, `/api/external/agents/:id`
+**API routes:** `GET /api/external/resources` (filtered to agents), `GET /api/external/resources/:id/definition`
 
 **Flags:**
 
-| Flag                | Description                                        |
-| ------------------- | -------------------------------------------------- |
-| `--pretty`          | Human-readable terminal output instead of raw JSON |
-| `--api-url <url>` | Override the API base URL                          |
+| Flag                | Description                                              |
+| ------------------- | -------------------------------------------------------- |
+| `--json`            | Output raw JSON instead of the default formatted display |
+| `--prod`            | Target production (overrides `NODE_ENV=development`)     |
+| `--api-url <url>` | Override the API base URL                                |
+
+Note the direction: `agent:*` defaults to a formatted display and opts into JSON with `--json`, the opposite convention from the `--pretty`-to-opt-into-formatted commands elsewhere on this page.
 
-**Implementation:** `packages/sdk/src/cli/commands/` (agent family)
+**Implementation:** `packages/sdk/src/cli/commands/agent/`
 
 ---
 
@@ -607,13 +661,26 @@ elevasis-sdk queue:status --pretty
 | `--pretty`           | Human-readable output instead of raw JSON |
 | `--api-url <url>`  | Override the API base URL                 |
 
-**Shared flags (`queue:get`, `queue:expire`, `queue:status`):**
+**Shared flags (`queue:get`, `queue:expire`):**
 
 | Flag                | Description                               |
 | ------------------- | ----------------------------------------- |
 | `--pretty`          | Human-readable output instead of raw JSON |
 | `--api-url <url>` | Override the API base URL                 |
 
+**`queue:status` filter flags:**
+
+`queue:status` shares the checkpoint/status view rather than the task list, so it takes its own subset of filters, not the shared flags above:
+
+| Flag                        | Description                                                           |
+| --------------------------- | --------------------------------------------------------------------- |
+| `--time-range <range>`    | Filter by created time range: `1h`, `24h`, `7d`, `30d`                |
+| `--priority-min <number>` | Minimum priority, 1-10                                                |
+| `--priority-max <number>` | Maximum priority, 1-10                                                |
+| `--status <status>`       | Filter checkpoint totals by status: `pending`, `completed`, `expired` |
+| `--pretty`                  | Human-readable output instead of raw JSON                             |
+| `--api-url <url>`         | Override the API base URL                                             |
+
 **Auth:** Calls `/api/external/command-queue/*` with API-key auth.
 
 ---
@@ -678,12 +745,22 @@ At least one field must be provided. `--description` and `--clear-description` a
 
 Knowledge graph inspection, plus an Organization Model write surface (`om:scaffold:*`, `om:rename`, `om:deprecate`). The `om:*` (Organization Model) commands expose knowledge graph traversal via the CLI. `om:*` and `knowledge:*` are aliases of the same subcommands for the read-only surface described below -- the write commands are registered under `om:*` only, with no `knowledge:*` alias.
 
-**Path axes for `knowledge:ls` / `om:ls`:** `/by-system/<id>`, `/by-ontology/<ontologyId>`, `/by-kind/<kind>`, `/by-owner/<ownerId>`, `/by-domain/<domain>` (enumerate all items in a domain: `clients`, `roles`, `policies`, `customers`, `offerings`, `goals`), `/by-item/<domain>/<itemId>` (single domain-item profile), `/graph/<nodeId>/governs`, `/graph/<nodeId>/governed-by`, `/<nodeId>` (single node), `/all-systems`, `/all-resources`, `/all-roles`.
+**Path axes for `knowledge:ls` / `om:ls`:** `/by-system/<id>`, `/by-ontology/<ontologyId>`, `/by-kind/<kind>`, `/by-owner/<ownerId>`, `/by-domain/<domain>` (enumerate all items in a domain: `clients`, `roles`, `customers`, `offerings`, `goals`), `/by-item/<domain>/<itemId>` (single domain-item profile), `/graph/<nodeId>/governs`, `/graph/<nodeId>/governed-by`, `/<nodeId>` (single node), `/all-systems`, `/all-resources`, `/all-roles`.
 
 - `knowledge:ls <path>` -- list nodes/edges for the mount; default output is an id + summary table, `--json` returns `{ path, mount, args, results }`.
 - `knowledge:cat <id>` -- render a node's `body` MDX to stdout; `--json` returns the full node object (body, links, owners, timestamps).
 - `knowledge:graph <id>` -- show outgoing + incoming edges grouped by edge kind.
-- `om:doctor` -- validate Organization Model integrity against published `@elevasis/core/organization-model` primitives. This is a deliberately reduced 3-check command: two of the monorepo platform CLI's five checks assert monorepo-only paths that do not exist in a tenant project, so they are not ported. `--json` output includes `checksRun: 3` so a caller can tell it apart from the platform CLI's 5-check version.
+- `om:doctor` -- validate Organization Model integrity against published `@elevasis/core/organization-model` primitives. This is a deliberately reduced 3-check command: two of the monorepo platform CLI's five checks assert monorepo-only paths that do not exist in a tenant project, so they are not ported. `--json` output includes `checksRun: 3` so a caller can tell it apart from the platform CLI's 5-check version. `om:doctor` also asks the API about the deployed readiness snapshot and merges those diagnostics in, unless `--skip-deployed` is passed; it degrades to `NOT RUN` rather than failing when there is no key or no server reachable.
+
+**`om:doctor` flags:**
+
+| Flag                     | Description                                                  |
+| ------------------------ | ------------------------------------------------------------ |
+| `--scope <systemPath>` | Limit diagnostics to a system path and its descendants       |
+| `--skip-deployed`        | Structural checks only -- do not ask the API about readiness |
+| `--json`                 | Output as a grouped JSON envelope                            |
+| `--prod`                 | Target production (overrides `NODE_ENV=development`)         |
+| `--api-url <url>`      | Override the API base URL                                    |
 
 In tenant projects, SDK read commands load `core/config/organization-model.ts` through the SDK's layout-aware TypeScript loader. The temporary bundle and dependency resolution are anchored at the package root that owns SDK dependencies, so hoisted pnpm workspaces resolve `esbuild` and `@elevasis/core` correctly. Missing org-model files still return the default model; malformed files or files with no usable export emit diagnostics. `knowledge:generate` / `om:generate` is the exception because it reads MDX and codegen inputs directly.
 
@@ -697,14 +774,14 @@ elevasis-sdk knowledge:search <query>
 elevasis-sdk knowledge:describe <nodeId>
 elevasis-sdk knowledge:skills <nodeId>
 elevasis-sdk knowledge:generate
-elevasis-sdk om:doctor --org <OrgName>
+elevasis-sdk om:doctor --scope sales.crm
 ```
 
 These are registered as `knowledge:*` subcommands on `elevasis-sdk`. Both the SDK CLI (`elevasis-sdk knowledge:*`) and the platform CLI (`elevasis knowledge:*`) call the same query functions in `@repo/core/knowledge/queries`.
 
 ### knowledge:search
 
-Universal keyword search across the entire Organization Model (systems, resources, knowledge, ontology, roles, policies). Alias: `om:search`.
+Universal keyword search across the entire Organization Model (systems, resources, knowledge, ontology, roles). Alias: `om:search`.
 
 ```bash
 elevasis-sdk knowledge:search <query> [--limit <n>] [--kinds <list>] [--json] [--ids-only]
@@ -914,6 +991,8 @@ elevasis-sdk content:queue
 elevasis-sdk content:pipeline
 elevasis-sdk content:pipeline <pipelineId>
 elevasis-sdk content:distributions --pipeline-id short-form-repurpose
+elevasis-sdk content:source-assets --kind transcript
+elevasis-sdk content:source-asset <sourceAssetId>
 ```
 
 - `content:list` -- list content items. Filters: `--status`, `--pillar`, `--pipeline-id`, `--client-id`, `--reviewed-by`, `--search` (matches title), `--limit`, `--offset`.
@@ -922,12 +1001,14 @@ elevasis-sdk content:distributions --pipeline-id short-form-repurpose
 - `content:queue` -- items sitting on an open `queued`-gate review. Each row prints the item, the `stepKey` of the gate it is waiting on, and the attempt that opened it. This is the list `content:review` reads from -- see "Why `--step` is required" below.
 - `content:pipeline [id]` -- with no id, lists pipeline templates; with an id, returns that pipeline's step contract (step keys and review modes). Read from the **deployed** Organization Model snapshot, not a local project model -- a model edit that has not been redeployed produces a stale-snapshot 503 that looks like a code bug.
 - `content:distributions` -- list distribution rows (one per platform/format target per item). Filters: `--content-item-id`, `--pipeline-id`, `--platform`, `--status`, `--limit`, `--offset`.
+- `content:source-assets` -- list source assets, the raw material items are derived from. Filters: `--kind`, `--limit`, `--offset`. `--pretty` omits payloads, which can run to hundreds of kilobytes.
+- `content:source-asset <sourceAssetId>` -- one source asset in full, payload included. This is how you read back text you just created.
 
-**API routes:** `GET /api/external/content/items`, `/api/external/content/items/:itemId`, `/api/external/content/queue`, `/api/external/content/pipelines`, `/api/external/content/pipelines/:id`, `/api/external/content/distributions`.
+**API routes:** `GET /api/external/content/items`, `/api/external/content/items/:itemId`, `/api/external/content/queue`, `/api/external/content/pipelines`, `/api/external/content/pipelines/:id`, `/api/external/content/distributions`, `/api/external/content/source-assets`, `/api/external/content/source-assets/:sourceAssetId`.
 
 ### content:review
 
-The one write command in this namespace. Everything else that writes to an item -- creating it, recording an attempt, opening a distribution -- is producer work through the `content` worker adapter, not a CLI command.
+One of two write commands in this namespace. Everything else that writes to an item -- creating it, recording an attempt, opening a distribution -- is producer work through the `content` worker adapter, not a CLI command.
 
 **Synopsis:**
 
@@ -970,33 +1051,157 @@ elevasis-sdk content:review 3f9c1e20-... --step clip-selection --approve --user
 elevasis-sdk content:review 3f9c1e20-... --step copy-generation --reject --user ops@acme.com --reason "Off-brand tone" --pretty
 ```
 
+### content:source-asset:create
+
+The namespace's second write command. It exists for a caller no other channel serves: an agent
+working from a terminal with an API key. A deployed workflow already creates source assets through
+`content.createSourceAsset` in the worker tool map, and a person uses the Command Center; a terminal
+agent can reach neither, and before this command `content_source_assets` was unreachable for it with
+no workaround.
+
+**Synopsis:**
+
+```
+elevasis-sdk content:source-asset:create --kind <kind> --title <title> (--text <value> | --url <url>)
+                                         [--field <key>] [--duration <seconds>] [--storage-path <path>]
+                                         [--metadata <json> | --metadata-file <path>] [--item <itemId>]
+```
+
+A source asset holds its content in one of two places, and the flags mirror that exactly: `--text` is
+inline content and lands in `payload`, `--url` is a reference and lands in `externalUrl`. They are
+mutually exclusive because an asset is one shape or the other.
+
+**There is still no file upload.** `--storage-path` records a path a caller already knows about (for
+example one written by a Dropbox intake flow elsewhere) -- it writes the `storage_path` column, the
+same column the worker adapter's `content.createSourceAsset` already sets freely, but it does not write
+bytes to storage itself. `/api/storage` has no external mirror. A file lives wherever it already lives;
+this flag just lets the CLI-created asset point at it, alongside or instead of `--url`.
+
+**Flags:**
+
+| Flag                       | Description                                                                           |
+| -------------------------- | ------------------------------------------------------------------------------------- |
+| `--kind <kind>`          | Required. Source asset kind, validated against the org model catalog                  |
+| `--title <title>`        | Required. Human-readable title (1-500 chars)                                          |
+| `--text <value>`         | Inline text, or `@path` to read a local file. Mutually exclusive with `--url`         |
+| `--field <key>`          | Payload field the `--text` content is written to (default: the `--kind` value)        |
+| `--url <url>`            | External URL the asset references. Mutually exclusive with `--text`                   |
+| `--duration <seconds>`   | Duration in seconds, for time-based referenced media                                  |
+| `--storage-path <path>`  | Storage path the asset references (1-2000 chars)                                      |
+| `--metadata <json>`      | Arbitrary metadata as a JSON object string. Mutually exclusive with `--metadata-file` |
+| `--metadata-file <path>` | Path to a JSON file containing metadata. Mutually exclusive with `--metadata`         |
+| `--item <itemId>`        | Link the new asset to this content item after creating it                             |
+| `--prod`                   | Target production (overrides `NODE_ENV=development`)                                  |
+| `--api-url <url>`        | Override the API base URL                                                             |
+| `--pretty`                 | Human-readable output instead of raw JSON                                             |
+
+**`--text` accepts `@path` to read a local file**, the same convention as `exec --input`. Anything not
+starting with `@` is the literal value. The CLI refuses content over 500KB locally rather than sending
+it for the server to reject -- that is `CONTENT_PAYLOAD_MAX_BYTES`, enforced by
+`ContentPayloadEnvelopeSchema`.
+
+**The payload key defaults to the `--kind` value.** `--kind transcript` writes `payload.transcript`,
+matching what the Organization Model's `content:catalog/source-asset-kind` declares for that kind.
+Pass `--field` when a kind's declared field is named differently. A wrong key writes successfully and
+produces an asset no producer can read, so check the kind's declaration if unsure.
+
+**An unlisted kind is legal and writes unvalidated.** URL-referencing kinds typically have no catalog
+entry at all -- the catalog declares payload fields, and a reference kind has none, so its URL is
+validated by `UrlSchema` on the request body instead. The consequence worth knowing: nothing can
+express "kind `youtube-video` requires `externalUrl`."
+
+**Examples:**
+
+```bash
+# Inline text from a local file
+elevasis-sdk content:source-asset:create --kind transcript --title "Episode 12" --text @transcript.txt --pretty
+
+# A reference, linked to an item in the same invocation
+elevasis-sdk content:source-asset:create --kind youtube-video --title "The talk" \
+  --url https://youtu.be/abc --duration 3600 --item 3f9c1e20-... --pretty
+```
+
+Posts to `POST /api/external/content/source-assets`, then `PATCH /api/external/content/items/:itemId`
+when `--item` is given. The link is a second call on purpose: the asset exists either way, so a failed
+link leaves a usable row to retry against rather than losing the content just written.
+
+**That `PATCH` is a link, not a general item update** -- `sourceAssetId` is the only field it accepts,
+and any other field is a 400. Editing an item's title, body, status, or pillar is producer work
+through `content.updateItem`, or a person's work in the Command Center. There is also no update or
+delete for a source asset: correct a bad one by creating a replacement and re-linking.
+
 **Implementation:** `packages/sdk/src/cli/commands/content/`
 
 ---
 
+## elevasis-sdk grant:\*
+
+Manage public and code-gated agent access grants -- the surface that exposes a deployed agent at a shareable public URL (`/public/agents/<slug>`) without requiring a signed-in Command Center user.
+
+```bash
+elevasis-sdk grant:list
+elevasis-sdk grant:create --resource <resourceId> [--slug <slug>] [--mode public|code] [--code <code>]
+elevasis-sdk grant:update <slug> [--mode public|code] [--max-turns <n>] [--branding <json>]
+elevasis-sdk grant:disable <slug>
+```
+
+- `grant:list` -- list grants; `--resource-id` filters to one agent, `--include-disabled` includes disabled grants
+- `grant:create` -- create a grant for `--resource`; `--slug` defaults to a normalized form of the resource ID; `--mode code` requires `--code`
+- `grant:update <slug>` -- update mutable fields (mode, code, origins, expiry, limits, branding, capture fields, tool policy); at least one field is required
+- `grant:disable <slug>` -- disable a grant without deleting it (there is no `grant:delete` or `grant:enable`)
+
+**Flags:**
+
+| Flag                        | Description                                                    |
+| --------------------------- | -------------------------------------------------------------- |
+| `--resource <id>`         | Agent resource ID to expose (create: required)                 |
+| `--slug <slug>`           | Public slug; defaults to a normalized `--resource`             |
+| `--mode <mode>`           | Access mode: `public` (default) or `code`                      |
+| `--code <code>`           | Access code, required when `--mode code`                       |
+| `--origins <origins>`     | Comma-separated allowed origins; omit for any origin           |
+| `--expires-at <iso>`      | ISO timestamp when the grant expires                           |
+| `--max-turns <number>`    | Maximum turns per public session                               |
+| `--max-sessions <number>` | Maximum sessions per visitor                                   |
+| `--branding <json>`       | Branding metadata JSON object                                  |
+| `--capture-fields <json>` | Capture fields JSON array                                      |
+| `--tool-policy <json>`    | Tool policy JSON object                                        |
+| `--public-base-url <url>` | Base URL used to print the full public URL alongside the grant |
+| `--resource-id <id>`      | Filter by agent resource ID (list only)                        |
+| `--include-disabled`        | Include disabled grants (list only)                            |
+| `--prod`                    | Target production (overrides `NODE_ENV=development`)           |
+| `--api-url <url>`         | Override the API base URL                                      |
+| `--json`                    | Output as JSON                                                 |
+
+**API routes:** `GET /api/external/agent-access-grants`, `POST /api/external/agent-access-grants`, `PATCH /api/external/agent-access-grants/:slug`, `POST /api/external/agent-access-grants/:slug/disable`.
+
+**Implementation:** `packages/sdk/src/cli/commands/grant/`
+
+---
+
 ## Appendix: Domain Status
 
 Current status of all SDK CLI domains. Domains marked `deferred` have no CLI commands yet.
 
-| Domain      | CLI surface                                                                                                                    | API surface                                                    | Status                                |
-| ----------- | ------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------- | ------------------------------------- |
-| platform    | top-level SDK commands                                                                                                         | mixed platform APIs                                            | implemented                           |
-| project     | `project:*`                                                                                                                    | `apps/api/src/projects/`                                       | implemented                           |
-| knowledge   | `knowledge:*`                                                                                                                  | file/generated knowledge data                                  | implemented                           |
-| creds       | `creds *` nested Commander group                                                                                               | credentials API                                                | implemented                           |
-| ui          | `ui:*`                                                                                                                         | local project file edits                                       | implemented                           |
-| request     | `request:submit`, `request:list`, `request:get`                                                                                | requests API                                                   | implemented read/write scope          |
-| error       | `error resolve`, `error resolve-execution`                                                                                     | execution error APIs                                           | partial                               |
-| acquisition | `acquisition:list:*`, `acquisition:deal:*`                                                                                     | `/api/external/acquisition/lists*`, `/api/external/deals*`     | implemented read-only scope           |
-| client      | `client:*`                                                                                                                     | `/api/external/clients`                                        | implemented read/write scope          |
-| agent       | `agent:list`, `agent:get`                                                                                                      | `/api/external/agents*`                                        | implemented read-only scope           |
-| session     | `session:create`, `session:turn`, `session:messages`, `session:list`, `session:get`, `session:end`                             | `/api/external/sessions*`                                      | implemented multi-turn scope          |
-| queue       | `queue:list`, `queue:get`, `queue:select`, `queue:expire`, `queue:status`                                                      | `/api/external/command-queue*`                                 | implemented                           |
-| schedule    | `schedule:list`, `schedule:get`, `schedule:create`, `schedule:update`                                                          | `/api/external/task-scheduler/schedules*`                      | implemented                           |
-| skill       | `skill:scaffold`, `skill:check-coverage`                                                                                       | local CLI catalog and `.claude/registries/skill-coverage.json` | implemented developer tooling         |
-| content     | `content:list`, `content:get`, `content:board`, `content:queue`, `content:pipeline`, `content:distributions`, `content:review` | `/api/external/content*`                                       | implemented read + review-write scope |
-| seo         | none                                                                                                                           | not scoped here                                                | deferred                              |
-| monitoring  | none                                                                                                                           | not scoped here                                                | deferred                              |
+| Domain      | CLI surface                                                                                                                                                                                                    | API surface                                                                    | Status                                                      |
+| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------------------------- |
+| platform    | top-level SDK commands                                                                                                                                                                                         | mixed platform APIs                                                            | implemented                                                 |
+| project     | `project:*`                                                                                                                                                                                                    | `apps/api/src/projects/`                                                       | implemented                                                 |
+| knowledge   | `knowledge:*`                                                                                                                                                                                                  | file/generated knowledge data                                                  | implemented                                                 |
+| creds       | `creds *` nested Commander group                                                                                                                                                                               | credentials API                                                                | implemented                                                 |
+| ui          | `ui:*`                                                                                                                                                                                                         | local project file edits                                                       | implemented                                                 |
+| request     | `request:submit`, `request:list`, `request:get`, `request:update`, `request:delete`                                                                                                                            | requests API                                                                   | implemented read/write scope                                |
+| error       | `error resolve`, `error resolve-execution`                                                                                                                                                                     | execution error APIs                                                           | partial                                                     |
+| acquisition | `acquisition:list:*`, `acquisition:deal:*`                                                                                                                                                                     | `/api/external/acquisition/lists*`, `/api/external/deals*`                     | implemented read-only scope                                 |
+| client      | `client:*`                                                                                                                                                                                                     | `/api/external/clients`                                                        | implemented read/write scope                                |
+| agent       | `agent:list`, `agent:get`                                                                                                                                                                                      | `/api/external/resources` (filtered), `/api/external/resources/:id/definition` | implemented read-only scope                                 |
+| session     | `session:create`, `session:turn`, `session:messages`, `session:list`, `session:get`, `session:end`                                                                                                             | `/api/external/sessions*`                                                      | implemented multi-turn scope                                |
+| queue       | `queue:list`, `queue:get`, `queue:select`, `queue:expire`, `queue:status`                                                                                                                                      | `/api/external/command-queue*`                                                 | implemented                                                 |
+| schedule    | `schedule:list`, `schedule:get`, `schedule:create`, `schedule:update`, `schedule:pause`, `schedule:resume`, `schedule:cancel`                                                                                  | `/api/external/task-scheduler/schedules*`                                      | implemented                                                 |
+| skill       | `skill:scaffold`, `skill:check-coverage`                                                                                                                                                                       | local CLI catalog and `.claude/registries/skill-coverage.json`                 | implemented developer tooling                               |
+| content     | `content:list`, `content:get`, `content:board`, `content:queue`, `content:pipeline`, `content:distributions`, `content:review`, `content:source-assets`, `content:source-asset`, `content:source-asset:create` | `/api/external/content*`                                                       | implemented read + review-write + source-asset-create scope |
+| grant       | `grant:list`, `grant:create`, `grant:update`, `grant:disable`                                                                                                                                                  | `/api/external/agent-access-grants*`                                           | implemented read/write scope                                |
+| seo         | none                                                                                                                                                                                                           | not scoped here                                                                | deferred                                                    |
+| monitoring  | none                                                                                                                                                                                                           | not scoped here                                                                | deferred                                                    |
 
 ### Promotion Criteria
 
@@ -1009,4 +1214,4 @@ A domain should meet all four criteria before gaining a `*:list` / `*:get` surfa
 
 ---
 
-**Last Updated:** 2026-08-14
+**Last Updated:** 2026-08-17