@elevasis/sdk 1.48.0 → 1.49.0

package/dist/cli.cjs

@@ -22654,44 +22654,64 @@ var init_ontology = __esm({
     }).passthrough();
     OntologyObjectTypeSchema = OntologyRecordBaseSchema.extend({
       properties: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional(),
-      storage: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-    });
+      storage: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+      // Carried by the legacy entity projection (`addLegacyEntityProjections`); not
+      // authored directly, but a real key an authored record must not collide with.
+      rowSchema: external_exports.string().trim().min(1).optional(),
+      stateCatalogId: external_exports.string().trim().min(1).optional()
+    }).strict();
     OntologyLinkTypeSchema = OntologyRecordBaseSchema.extend({
       from: OntologyIdSchema,
       to: OntologyIdSchema,
       cardinality: external_exports.string().trim().min(1).max(80).optional(),
       via: external_exports.string().trim().min(1).max(255).optional()
-    });
+    }).strict();
     OntologyActionTypeSchema = OntologyRecordBaseSchema.extend({
       actsOn: OntologyReferenceListSchema,
       input: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional(),
-      effects: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).optional()
-    });
+      effects: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).optional(),
+      resourceId: external_exports.string().trim().min(1).optional(),
+      invocations: external_exports.array(external_exports.unknown()).optional(),
+      lifecycle: external_exports.string().trim().min(1).optional(),
+      // Carried by the legacy action projection (`addLegacyActionProjections`); not
+      // authored directly, but a real key an authored record must not collide with.
+      legacyActionId: external_exports.string().trim().min(1).optional()
+    }).strict();
     OntologyCatalogTypeSchema = OntologyRecordBaseSchema.extend({
       kind: external_exports.string().trim().min(1).max(120).optional(),
       appliesTo: OntologyIdSchema.optional(),
-      entries: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional()
-    });
+      entries: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional(),
+      // Carried by lead-gen's legacy stage-catalog projection
+      // (`createLeadGenStageCatalog`); not authored directly, but a real key an
+      // authored record must not collide with.
+      legacyCatalogKey: external_exports.string().trim().min(1).optional(),
+      // Carried in live tenant configs (Elevasis, `nirvana-marketing`, and the
+      // `_template` scaffold all author these on `sales.crm:catalog/crm.pipeline`)
+      // as a cross-reference to the pre-ontology CRM pipeline key/entity id. No
+      // code currently reads them back — do not silently normalize them away.
+      legacyPipelineKey: external_exports.string().trim().min(1).optional(),
+      legacyEntityKey: external_exports.string().trim().min(1).optional()
+    }).strict();
     OntologyEventTypeSchema = OntologyRecordBaseSchema.extend({
       payload: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional()
-    });
+    }).strict();
     OntologyInterfaceTypeSchema = OntologyRecordBaseSchema.extend({
       properties: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional()
-    });
+    }).strict();
     OntologyValueTypeSchema = OntologyRecordBaseSchema.extend({
       primitive: external_exports.string().trim().min(1).max(120).optional()
-    });
+    }).strict();
     OntologySharedPropertySchema = OntologyRecordBaseSchema.extend({
       valueType: OntologyIdSchema.optional(),
       searchable: external_exports.boolean().optional(),
       pii: external_exports.boolean().optional()
-    });
+    }).strict();
     OntologyGroupSchema = OntologyRecordBaseSchema.extend({
       members: OntologyReferenceListSchema
-    });
+    }).strict();
     OntologyEndpointTypeSchema = OntologyRecordBaseSchema.extend({
       route: external_exports.string().trim().min(1).max(500).optional()
-    });
+    }).strict();
     OntologyScopeSchema = external_exports.object({
       objectTypes: external_exports.record(OntologyIdSchema, OntologyObjectTypeSchema).default({}).optional(),
       linkTypes: external_exports.record(OntologyIdSchema, OntologyLinkTypeSchema).default({}).optional(),
@@ -25035,7 +25055,7 @@ var init_content = __esm({
     "use strict";
     init_zod();
     ContentPipelineStepActorSchema = external_exports.enum(["workflow", "agent", "vendor"]);
-    ContentPipelineStepReviewModeSchema = external_exports.enum(["live", "queued", "none"]);
+    ContentPipelineStepReviewModeSchema = external_exports.enum(["none", "required"]);
     ContentPayloadFieldTypeSchema = external_exports.enum(["string", "text", "number", "boolean", "url", "string-array"]);
     ContentPayloadFieldDeclarationSchema = external_exports.object({
       key: external_exports.string().trim().min(1).max(200),
@@ -26271,6 +26291,13 @@ var init_lead_gen = __esm({
   }
 });
 
+// ../core/src/organization-model/catalogs/define-content-pipeline.ts
+var init_define_content_pipeline = __esm({
+  "../core/src/organization-model/catalogs/define-content-pipeline.ts"() {
+    "use strict";
+  }
+});
+
 // ../core/src/organization-model/readiness/engine.ts
 function addReadinessIssue(issues, family, code, message, details = {}) {
   issues.push({
@@ -26611,6 +26638,7 @@ var init_organization_model = __esm({
     init_graph();
     init_lead_gen();
     init_content();
+    init_define_content_pipeline();
     init_branding();
     init_systems();
     init_resources();
@@ -44095,7 +44123,7 @@ function getModelInfo(model) {
     return MODEL_INFO[model];
   }
   for (const knownModel of MODEL_KEYS_BY_SPECIFICITY) {
-    if (model.startsWith(knownModel)) {
+    if (model.startsWith(`${knownModel}-`)) {
       return MODEL_INFO[knownModel];
     }
   }
@@ -44121,7 +44149,7 @@ function validateModelConfig(config3) {
     throw new ModelConfigError(`Invalid config for ${model}: ${firstError.message}`, fieldName, model);
   }
 }
-var GPT5OptionsSchema, GPT5ConfigSchema, MockConfigSchema, OpenRouterOptionsSchema, OpenRouterConfigSchema, AnthropicOptionsSchema, AnthropicStandardConfigSchema, AnthropicClaude5ConfigSchema, AnthropicConfigSchema, MODEL_INFO, MODEL_KEYS_BY_SPECIFICITY;
+var GPT5OptionsSchema, GPT5ConfigSchema, GPT56OptionsSchema, GPT56ConfigSchema, MockConfigSchema, OpenRouterOptionsSchema, OpenRouterConfigSchema, AnthropicOptionsSchema, AnthropicStandardConfigSchema, AnthropicClaude5ConfigSchema, AnthropicConfigSchema, GPT56_CACHE_READ_RATE_MULTIPLIER, CACHE_CREATION_RATE_MULTIPLIER, MODEL_INFO, MODEL_KEYS_BY_SPECIFICITY;
 var init_model_info = __esm({
   "../core/src/execution/engine/llm/model-info.ts"() {
     "use strict";
@@ -44141,6 +44169,19 @@ var init_model_info = __esm({
       topP: external_exports.number().min(0).max(1).optional(),
       modelOptions: GPT5OptionsSchema.optional()
     });
+    GPT56OptionsSchema = external_exports.object({
+      reasoning_effort: external_exports.enum(["none", "low", "medium", "high", "xhigh", "max"]).optional(),
+      verbosity: external_exports.enum(["low", "medium", "high"]).optional()
+    });
+    GPT56ConfigSchema = external_exports.object({
+      model: external_exports.enum(["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"]),
+      provider: external_exports.enum(["openai"]),
+      apiKey: external_exports.string(),
+      temperature: external_exports.literal(1).optional(),
+      maxOutputTokens: external_exports.number().min(4e3).optional(),
+      topP: external_exports.number().min(0).max(1).optional(),
+      modelOptions: GPT56OptionsSchema.optional()
+    });
     MockConfigSchema = external_exports.object({
       model: external_exports.enum(["mock"]),
       provider: external_exports.enum(["mock"]),
@@ -44193,9 +44234,12 @@ var init_model_info = __esm({
       AnthropicClaude5ConfigSchema,
       AnthropicStandardConfigSchema
     ]);
+    GPT56_CACHE_READ_RATE_MULTIPLIER = 0.1;
+    CACHE_CREATION_RATE_MULTIPLIER = 1.25;
     MODEL_INFO = {
       // OpenAI GPT-5 (Reasoning Models)
       "gpt-5": {
+        provider: "openai",
         inputCostPer1M: 125,
         // $1.25 per 1M tokens
         outputCostPer1M: 1e3,
@@ -44209,6 +44253,7 @@ var init_model_info = __esm({
         configSchema: GPT5ConfigSchema
       },
       "gpt-5.4-mini": {
+        provider: "openai",
         inputCostPer1M: 75,
         // $0.75 per 1M tokens
         outputCostPer1M: 450,
@@ -44222,6 +44267,7 @@ var init_model_info = __esm({
         configSchema: GPT5ConfigSchema
       },
       "gpt-5.4-nano": {
+        provider: "openai",
         inputCostPer1M: 20,
         // $0.20 per 1M tokens
         outputCostPer1M: 125,
@@ -44233,8 +44279,60 @@ var init_model_info = __esm({
         category: "standard",
         configSchema: GPT5ConfigSchema
       },
+      // OpenAI GPT-5.6 family (GA 2026-07-09). All three tiers share 1.05M context, 128K max output,
+      // image input, tool use, structured outputs, and prompt caching -- they differ in reasoning depth
+      // and price, not capability. The bare `gpt-5.6` alias is deliberately unregistered; see OpenAIModel.
+      "gpt-5.6-sol": {
+        provider: "openai",
+        inputCostPer1M: 500,
+        // $5.00 per 1M tokens
+        outputCostPer1M: 3e3,
+        // $30.00 per 1M tokens
+        minTokens: 4e3,
+        recommendedTokens: 8e3,
+        maxTokens: 105e4,
+        // 1.05M context window
+        maxOutputTokens: 128e3,
+        category: "reasoning",
+        configSchema: GPT56ConfigSchema,
+        cacheReadRateMultiplier: GPT56_CACHE_READ_RATE_MULTIPLIER,
+        cacheCreationRateMultiplier: CACHE_CREATION_RATE_MULTIPLIER
+      },
+      "gpt-5.6-terra": {
+        provider: "openai",
+        inputCostPer1M: 250,
+        // $2.50 per 1M tokens
+        outputCostPer1M: 1500,
+        // $15.00 per 1M tokens
+        minTokens: 4e3,
+        recommendedTokens: 8e3,
+        maxTokens: 105e4,
+        // 1.05M context window
+        maxOutputTokens: 128e3,
+        category: "standard",
+        configSchema: GPT56ConfigSchema,
+        cacheReadRateMultiplier: GPT56_CACHE_READ_RATE_MULTIPLIER,
+        cacheCreationRateMultiplier: CACHE_CREATION_RATE_MULTIPLIER
+      },
+      "gpt-5.6-luna": {
+        provider: "openai",
+        inputCostPer1M: 100,
+        // $1.00 per 1M tokens
+        outputCostPer1M: 600,
+        // $6.00 per 1M tokens
+        minTokens: 4e3,
+        recommendedTokens: 8e3,
+        maxTokens: 105e4,
+        // 1.05M context window
+        maxOutputTokens: 128e3,
+        category: "standard",
+        configSchema: GPT56ConfigSchema,
+        cacheReadRateMultiplier: GPT56_CACHE_READ_RATE_MULTIPLIER,
+        cacheCreationRateMultiplier: CACHE_CREATION_RATE_MULTIPLIER
+      },
       // Mock model for testing
       mock: {
+        provider: "mock",
         inputCostPer1M: 0,
         // Free for tests
         outputCostPer1M: 0,
@@ -44248,6 +44346,7 @@ var init_model_info = __esm({
       },
       // OpenRouter Models (via openrouter.ai)
       "openrouter/z-ai/glm-5": {
+        provider: "openrouter",
         inputCostPer1M: 72,
         // $0.72 per 1M tokens
         outputCostPer1M: 230,
@@ -44261,6 +44360,7 @@ var init_model_info = __esm({
       },
       // Anthropic Claude Models (direct SDK access via @anthropic-ai/sdk)
       "claude-opus-5": {
+        provider: "anthropic",
         inputCostPer1M: 500,
         // $5.00 per 1M tokens
         outputCostPer1M: 2500,
@@ -44274,6 +44374,7 @@ var init_model_info = __esm({
         configSchema: AnthropicConfigSchema
       },
       "claude-sonnet-5": {
+        provider: "anthropic",
         // List pricing. An introductory rate of $2.00/$10.00 runs through 2026-08-31; encoding the
         // temporary rate would make historical cost analytics wrong once it lapses.
         inputCostPer1M: 300,
@@ -44289,6 +44390,7 @@ var init_model_info = __esm({
         configSchema: AnthropicConfigSchema
       },
       "claude-haiku-4-5-20251001": {
+        provider: "anthropic",
         inputCostPer1M: 100,
         // $1.00 per 1M tokens
         outputCostPer1M: 500,
@@ -44302,6 +44404,7 @@ var init_model_info = __esm({
         configSchema: AnthropicConfigSchema
       },
       "claude-haiku-4-5": {
+        provider: "anthropic",
         inputCostPer1M: 100,
         // $1.00 per 1M tokens
         outputCostPer1M: 500,
@@ -44690,6 +44793,138 @@ var init_response_schema = __esm({
   }
 });
 
+// ../core/src/execution/engine/workflow/types.ts
+var StepType;
+var init_types5 = __esm({
+  "../core/src/execution/engine/workflow/types.ts"() {
+    "use strict";
+    StepType = {
+      LINEAR: "linear",
+      CONDITIONAL: "conditional"
+    };
+  }
+});
+
+// ../core/src/execution/engine/workflow/errors.ts
+var WorkflowStepError, WorkflowValidationError;
+var init_errors5 = __esm({
+  "../core/src/execution/engine/workflow/errors.ts"() {
+    "use strict";
+    init_errors3();
+    WorkflowStepError = class extends ExecutionError {
+      type = "workflow_step_error";
+      severity = "critical";
+      category = "workflow";
+      /**
+       * @param cause - The error the step actually threw. Kept so the original stack and any
+       *   non-`ExecutionError` throw survive the wrap; its classification is additionally copied into
+       *   `context` by the caller, because `type`/`severity`/`category` are fixed on this class.
+       */
+      constructor(message, context, cause) {
+        super(message, context);
+        if (cause !== void 0) this.cause = cause;
+      }
+    };
+    WorkflowValidationError = class extends ExecutionError {
+      type = "workflow_validation_error";
+      severity = "info";
+      category = "validation";
+      constructor(message, context) {
+        super(message, context);
+      }
+    };
+  }
+});
+
+// ../core/src/execution/engine/workflow/utils.ts
+function validateEntryPoint(steps, entryPoint) {
+  if (!(entryPoint in steps)) {
+    throw new WorkflowValidationError(`Entry point step '${entryPoint}' not found in workflow`, {
+      entryPoint
+    });
+  }
+}
+function findTerminalSteps(steps) {
+  return Object.values(steps).filter((step) => step.next === null);
+}
+function validateTerminalSteps(steps, workflowId) {
+  const terminalSteps = findTerminalSteps(steps);
+  if (terminalSteps.length === 0) {
+    throw new WorkflowValidationError(`Workflow '${workflowId}' must have at least one terminal step (next: null)`, {
+      workflowId
+    });
+  }
+}
+function validateStepReferences(steps) {
+  for (const [id, step] of Object.entries(steps)) {
+    if (step.next === null) {
+      continue;
+    }
+    if (step.next.type === StepType.LINEAR) {
+      if (!(step.next.target in steps)) {
+        throw new WorkflowValidationError(`Step '${id}' references non-existent target '${step.next.target}'`, {
+          stepId: id,
+          target: step.next.target
+        });
+      }
+    } else if (step.next.type === StepType.CONDITIONAL) {
+      const targets = [...step.next.routes.map((r) => r.target), step.next.default];
+      for (const target of targets) {
+        if (!(target in steps)) {
+          throw new WorkflowValidationError(`Step '${id}' references non-existent target '${target}'`, {
+            stepId: id,
+            target
+          });
+        }
+      }
+    }
+  }
+}
+function detectCycle(visited, executionPath, currentStepId) {
+  if (visited.has(currentStepId)) {
+    const cycle = executionPath.slice(executionPath.indexOf(currentStepId));
+    throw new WorkflowStepError(`Cycle detected in workflow: ${cycle.join(" -> ")} -> ${currentStepId}`, {
+      stepId: currentStepId,
+      cycle: [...cycle, currentStepId]
+    });
+  }
+}
+function validateWorkflowGraph(steps, entryPoint, workflowId) {
+  const onPath = /* @__PURE__ */ new Set();
+  const executionPath = [];
+  const reached = /* @__PURE__ */ new Set();
+  const walk = (stepId) => {
+    detectCycle(onPath, executionPath, stepId);
+    onPath.add(stepId);
+    executionPath.push(stepId);
+    reached.add(stepId);
+    const step = steps[stepId];
+    if (step && step.next !== null) {
+      const targets = step.next.type === StepType.LINEAR ? [step.next.target] : [...step.next.routes.map((route) => route.target), step.next.default];
+      for (const target of targets) {
+        if (target in steps) walk(target);
+      }
+    }
+    executionPath.pop();
+    onPath.delete(stepId);
+  };
+  if (entryPoint in steps) walk(entryPoint);
+  const orphanIds = Object.keys(steps).filter((id) => !reached.has(id));
+  if (orphanIds.length > 0) {
+    throw new WorkflowValidationError(
+      `Workflow '${workflowId}' has step(s) unreachable from entry point '${entryPoint}': ${orphanIds.join(", ")}`,
+      { workflowId, entryPoint, orphanIds }
+    );
+  }
+}
+var init_utils3 = __esm({
+  "../core/src/execution/engine/workflow/utils.ts"() {
+    "use strict";
+    init_types5();
+    init_errors5();
+  }
+});
+
 // ../core/src/platform/registry/validation.ts
 function getResourceValidatorMode(explicitMode) {
   if (explicitMode) return explicitMode;
@@ -44708,7 +44943,14 @@ function emitGovernanceIssues(issues, mode, onWarning) {
   if (issues.length === 0) return;
   if (mode === "strict") {
     const first = issues[0];
-    throw new RegistryValidationError(first.orgName, first.resourceId, "organizationModel.resources", first.message);
+    const messages = issues.map((issue2) => issue2.message);
+    throw new RegistryValidationError(
+      first.orgName,
+      first.resourceId,
+      "organizationModel.resources",
+      messages.join("\n"),
+      messages
+    );
   }
   const warn2 = onWarning ?? ((issue2) => console.warn(issue2.message));
   for (const issue2 of issues) {
@@ -44869,7 +45111,7 @@ function addTopologyIssues(issues, orgName, deployment, organizationModel, syste
     if (ref.kind === "humanCheckpoint") return humanCheckpointIds.has(ref.id);
     if (ref.kind === "externalResource") return externalResourceIds.has(ref.id);
     if (ref.kind === "ontology") {
-      if (ontologyIndex === void 0) return true;
+      if (ontologyIndex === void 0) return false;
       return Object.values(ontologyIndex).some((records) => records[ref.id] !== void 0);
     }
     return false;
@@ -45059,7 +45301,8 @@ function detectMissingApiInterfaceDeclarations(orgName, organizationModel) {
   }
   return gaps;
 }
-function validateDeclaredSystemInterfaceReadiness(orgName, organizationModel) {
+function validateDeclaredSystemInterfaceReadiness(orgName, organizationModel, options = {}) {
+  const mode = getResourceValidatorMode(options.mode);
   const issues = [];
   if (organizationModel === void 0) return { valid: true, issues };
   const model = organizationModel;
@@ -45085,17 +45328,27 @@ function validateDeclaredSystemInterfaceReadiness(orgName, organizationModel) {
     }
   }
   if (issues.length > 0) {
-    const first = issues[0];
-    throw new RegistryValidationError(
-      first.orgName,
-      `${first.systemPath}/${first.interfaceKey}`,
-      first.path ?? "organizationModel.systems.apiInterface",
-      first.message
-    );
+    if (mode === "strict") {
+      const first = issues[0];
+      const messages = issues.map((issue2) => issue2.message);
+      throw new RegistryValidationError(
+        first.orgName,
+        `${first.systemPath}/${first.interfaceKey}`,
+        first.path ?? "organizationModel.systems.apiInterface",
+        messages.join("\n"),
+        messages
+      );
+    }
+    const warn2 = options.onWarning ?? ((issue2) => console.warn(issue2.message));
+    for (const issue2 of issues) {
+      warn2(issue2);
+    }
+    return { valid: false, issues };
   }
   return { valid: true, issues };
 }
-function validateDeploymentSpec(orgName, resources) {
+function validateDeploymentSpec(orgName, resources, options = {}) {
+  const warn2 = options.onWarning ?? ((message) => console.warn(message));
   const seenIds = /* @__PURE__ */ new Set();
   resources.workflows?.forEach((workflow) => {
     const id = workflow.config.resourceId;
@@ -45114,6 +45367,14 @@ function validateDeploymentSpec(orgName, resources) {
     if (workflow.interface) {
       validateExecutionInterface(orgName, id, workflow.interface, workflow.contract.inputSchema);
     }
+    try {
+      validateEntryPoint(workflow.steps, workflow.entryPoint);
+      validateTerminalSteps(workflow.steps, id);
+      validateStepReferences(workflow.steps);
+      validateWorkflowGraph(workflow.steps, workflow.entryPoint, id);
+    } catch (error46) {
+      warn2(`[${orgName}] Workflow '${id}' graph validation: ${error46 instanceof Error ? error46.message : String(error46)}`);
+    }
   });
   resources.agents?.forEach((agent) => {
     const id = agent.config.resourceId;
@@ -45127,14 +45388,20 @@ function validateDeploymentSpec(orgName, resources) {
     }
     seenIds.add(id);
     validateResourceModelConfig(orgName, id, agent.modelConfig);
-    validateAgentGrammar(orgName, id, agent);
-    validateAgentCheapAssertions(orgName, id, agent);
+    validateAgentGrammar(orgName, id, agent, options.mode);
+    validateAgentCheapAssertions(orgName, id, agent, options.mode);
     if (agent.interface) {
       validateExecutionInterface(orgName, id, agent.interface, agent.contract.inputSchema);
     }
   });
-  validateResourceGovernance(orgName, resources);
-  validateDeclaredSystemInterfaceReadiness(orgName, resources.organizationModel);
+  validateResourceGovernance(orgName, resources, void 0, {
+    mode: options.mode,
+    onWarning: (issue2) => warn2(issue2.message)
+  });
+  validateDeclaredSystemInterfaceReadiness(orgName, resources.organizationModel, {
+    mode: options.mode,
+    onWarning: (issue2) => warn2(issue2.message)
+  });
 }
 function validateResourceModelConfig(orgName, resourceId, modelConfig) {
   try {
@@ -45209,7 +45476,7 @@ function describeGrammarRefusal(reasons, toolInputSchema) {
   }
   return `refused strict mode: ${reasons.join(", ")}`;
 }
-function validateAgentGrammar(orgName, agentId, agent) {
+function validateAgentGrammar(orgName, agentId, agent, mode) {
   const dialect = dialectForProvider(agent.modelConfig.provider);
   if (!dialect) return;
   const capabilities = agentCapabilitiesForGrammarCheck(agent.config);
@@ -45230,12 +45497,12 @@ function validateAgentGrammar(orgName, agentId, agent) {
     compileSchema(offending.inputSchema, dialect).refusalReasons,
     offending.inputSchema
   )}. This silently drops strict-mode enforcement for the agent's ENTIRE iteration schema on every call, not just this tool -- compileSchema refuses whole-schema, never per-tool.` : `[${orgName}] Agent '${agentId}' iteration schema refused strict mode for provider '${agent.modelConfig.provider}': ${compiled.refusalReasons.join(", ")}. No single tool is independently responsible -- this is a whole-schema limit (e.g. total optional properties across every tool exceeding the provider's cap).`;
-  if (getResourceValidatorMode() === "strict") {
+  if (getResourceValidatorMode(mode) === "strict") {
     throw new RegistryValidationError(orgName, agentId, "tools", message);
   }
   console.warn(message);
 }
-function validateAgentCheapAssertions(orgName, agentId, agent) {
+function validateAgentCheapAssertions(orgName, agentId, agent, mode) {
   const issues = [];
   const config3 = agent.config;
   if (config3.sessionCapable && config3.securityLevel === "none") {
@@ -45265,7 +45532,7 @@ function validateAgentCheapAssertions(orgName, agentId, agent) {
   }
   if (issues.length === 0) return;
   const message = `[${orgName}] Agent '${agentId}': ${issues.join(" ")}`;
-  if (getResourceValidatorMode() === "strict") {
+  if (getResourceValidatorMode(mode) === "strict") {
     throw new RegistryValidationError(orgName, agentId, "config", message);
   }
   console.warn(message);
@@ -45532,34 +45799,24 @@ var init_validation2 = __esm({
     init_compile();
     init_dialect();
     init_response_schema();
+    init_utils3();
     init_helpers();
     init_ontology();
     init_readiness();
     init_systems();
     RegistryValidationError = class extends Error {
-      constructor(orgName, resourceId, field2, message) {
+      constructor(orgName, resourceId, field2, message, issues) {
         super(message);
         this.orgName = orgName;
         this.resourceId = resourceId;
         this.field = field2;
+        this.issues = issues;
         this.name = "RegistryValidationError";
       }
     };
   }
 });
 
-// ../core/src/execution/engine/workflow/types.ts
-var StepType;
-var init_types5 = __esm({
-  "../core/src/execution/engine/workflow/types.ts"() {
-    "use strict";
-    StepType = {
-      LINEAR: "linear",
-      CONDITIONAL: "conditional"
-    };
-  }
-});
-
 // ../core/src/execution/engine/base/serialization.ts
 function serializeDefinition(definition, options) {
   const opts = {
@@ -47295,7 +47552,7 @@ var init_croner = __esm({
 });
 
 // ../core/src/execution/scheduler/utils.ts
-var init_utils3 = __esm({
+var init_utils4 = __esm({
   "../core/src/execution/scheduler/utils.ts"() {
     "use strict";
     init_esm2();
@@ -47309,7 +47566,7 @@ var init_scheduler = __esm({
     "use strict";
     init_types8();
     init_schemas3();
-    init_utils3();
+    init_utils4();
   }
 });
 
@@ -47702,7 +47959,7 @@ var init_schemas6 = __esm({
 });
 
 // ../core/src/operations/observability/utils.ts
-var init_utils4 = __esm({
+var init_utils5 = __esm({
   "../core/src/operations/observability/utils.ts"() {
     "use strict";
   }
@@ -47714,7 +47971,7 @@ var init_observability = __esm({
     "use strict";
     init_types13();
     init_schemas6();
-    init_utils4();
+    init_utils5();
   }
 });
 
@@ -48582,6 +48839,21 @@ var init_credentials2 = __esm({
   }
 });
 
+// ../core/src/integrations/cloud-storage/types.ts
+var init_types20 = __esm({
+  "../core/src/integrations/cloud-storage/types.ts"() {
+    "use strict";
+  }
+});
+
+// ../core/src/integrations/cloud-storage/index.ts
+var init_cloud_storage = __esm({
+  "../core/src/integrations/cloud-storage/index.ts"() {
+    "use strict";
+    init_types20();
+  }
+});
+
 // ../core/src/index.ts
 var init_src = __esm({
   "../core/src/index.ts"() {
@@ -48598,6 +48870,7 @@ var init_src = __esm({
     init_forms();
     init_oauth();
     init_credentials2();
+    init_cloud_storage();
   }
 });
 
@@ -48654,6 +48927,12 @@ function resolveApiKey(prod) {
   }
   return process.env.ELEVASIS_PLATFORM_KEY ?? "";
 }
+function isProdApiUrl(apiUrl) {
+  return !apiUrl.includes("localhost");
+}
+function resolveApiKeyForUrl(apiUrl) {
+  return resolveApiKey(isProdApiUrl(apiUrl));
+}
 function tryFindProjectRoot(startDir) {
   const raw = (0, import_path.resolve)(startDir);
   let dir;
@@ -48738,12 +49017,89 @@ var init_config2 = __esm({
   }
 });
 
+// src/cli/readiness-failure.ts
+function isReadinessFailureDetails(details) {
+  if (!details || typeof details !== "object") return false;
+  const candidate = details;
+  return typeof candidate.systemPath === "string" && typeof candidate.interfaceKey === "string" && // Deliberately `string`, not a check against the known families. Narrowing
+  // it here would reject a readiness refusal carrying a family this build has
+  // not learned yet, and `request()` would fall through to the gateway
+  // message -- which tells the operator the API did not reject the request and
+  // it may still be running server-side. That is false for every readiness
+  // refusal, familiar family or not. An unrecognized code is handled where it
+  // can be handled honestly, in `guidanceForFamily`.
+  typeof candidate.readinessCode === "string" && Array.isArray(candidate.issues);
+}
+function parseReadinessFailureDetails(errorText) {
+  let parsed;
+  try {
+    parsed = JSON.parse(errorText);
+  } catch {
+    return void 0;
+  }
+  if (parsed.code !== "SERVICE_UNAVAILABLE") return void 0;
+  return isReadinessFailureDetails(parsed.details) ? parsed.details : void 0;
+}
+function formatIssue(issue2) {
+  let line = `    - [${issue2.code}] ${issue2.message}`;
+  if (issue2.path) line += ` (path: ${issue2.path})`;
+  if (issue2.ref) line += ` (ref: ${issue2.ref})`;
+  return line;
+}
+function describeUnknownFamily(readinessCode) {
+  return `This CLI does not recognize readiness code "${readinessCode}", so it cannot describe the general shape of the fix. The issues below are the API's own explanation and are the authoritative part of this message.
+  The likely cause is version skew -- this @elevasis/sdk is older than the API it just called. Update it (pnpm update @elevasis/sdk) and run this again.`;
+}
+function guidanceForFamily(details) {
+  const lookup = FAMILY_GUIDANCE;
+  return lookup[details.readinessCode]?.(details) ?? describeUnknownFamily(details.readinessCode);
+}
+function describeReadinessFailure(details, endpoint) {
+  const profileSuffix = details.readinessProfile ? ` (readiness profile: ${details.readinessProfile})` : "";
+  const lines = [
+    `API request refused (503): ${details.systemPath}/${details.interfaceKey} is not ready for this API surface${profileSuffix}.`,
+    `This IS the API rejecting the request -- it is not a gateway hiccup, and re-running it will not help.`,
+    `  Endpoint: ${endpoint}`,
+    ""
+  ];
+  lines.push(
+    details.readinessCode === "STALE_OM_SNAPSHOT" ? details.issues[0]?.message ?? "The deployed organization model snapshot is stale. Deploy again to fix this: elevasis-sdk deploy" : guidanceForFamily(details)
+  );
+  if (details.issues.length > 0) {
+    lines.push("", "  Issues:", ...details.issues.map(formatIssue));
+  }
+  lines.push("", `  Run 'elevasis-sdk doctor' to see what else is not ready.`);
+  return lines.join("\n");
+}
+var FAMILY_GUIDANCE;
+var init_readiness_failure = __esm({
+  "src/cli/readiness-failure.ts"() {
+    "use strict";
+    FAMILY_GUIDANCE = {
+      SYSTEM_INTERFACE_MISSING: ({ systemPath }) => `This organization has not adopted the "${systemPath}" System. Declare it in this project's core/config/organization-model/systems.ts with an apiInterface block, then deploy (elevasis-sdk deploy or pnpm operations:deploy).
+  Known trap: an empty apiInterface.resourceIds throws -- omit the apiInterface block entirely for the supported opt-out.`,
+      SYSTEM_INTERFACE_DISABLED: ({ systemPath }) => `The "${systemPath}" System declares an apiInterface but it is not active. Re-enable it (apiInterface.lifecycle: 'active') and redeploy.`,
+      // Two failures share this family and they need opposite advice.
+      //
+      // A validator that rejected a declaration emits a `path`, and pointing at it
+      // is the whole fix. A stored snapshot that would not parse emits no `path` --
+      // the API sets `ref` (a deployment or organization id) and never `path` --
+      // and the broken thing is the deployed copy, not the source the operator
+      // would go and edit. Sending them after a "path" that is not in the payload,
+      // to fix a declaration that may be perfectly fine, was the failure this
+      // wording had before.
+      SYSTEM_INTERFACE_INVALID: ({ systemPath, issues }) => issues.some((issue2) => issue2.path) ? `The "${systemPath}" System's apiInterface / readinessContract declaration is malformed. See the "path" on each issue below for the offending field.` : `The "${systemPath}" System's stored organization model snapshot could not be read. No field of your declaration is known to be wrong -- it is the deployed copy that failed, so deploy again first (elevasis-sdk deploy). If that does not clear it, the declaration is the next place to look.`,
+      SYSTEM_INTERFACE_NOT_READY: ({ systemPath }) => `The "${systemPath}" System's readinessContract is unsatisfied. See the issues below for the missing requiredObjects / requiredCatalogs refs.`,
+      SYSTEM_BRIDGE_NOT_READY: ({ systemPath }) => `The counterpart System of "${systemPath}"'s cross-System handoff is not ready. Check readiness on both sides of the bridge.`
+    };
+  }
+});
+
 // src/cli/api-client.ts
 function getApiKey(apiUrl) {
-  const isProd = !apiUrl.includes("localhost");
-  const key = resolveApiKey(isProd);
+  const key = resolveApiKeyForUrl(apiUrl);
   if (!key) {
-    const varName = isProd ? "ELEVASIS_PLATFORM_KEY" : "ELEVASIS_PLATFORM_KEY_DEV";
+    const varName = isProdApiUrl(apiUrl) ? "ELEVASIS_PLATFORM_KEY" : "ELEVASIS_PLATFORM_KEY_DEV";
     throw new Error(`${varName} environment variable is required.
 Set it in your .env file: ${varName}=sk_...`);
   }
@@ -48805,6 +49161,10 @@ async function request(method, endpoint, apiUrl, body) {
     if (response.status === 401) {
       throw new Error(`401 Unauthorized: Invalid or missing ELEVASIS_PLATFORM_KEY. Check your .env file.`);
     }
+    const readinessDetails = parseReadinessFailureDetails(errorText);
+    if (readinessDetails) {
+      throw new Error(describeReadinessFailure(readinessDetails, endpoint));
+    }
     if (GATEWAY_STATUSES.has(response.status)) {
       throw new Error(describeGatewayFailure(response.status, endpoint, elapsedMs));
     }
@@ -48832,6 +49192,7 @@ var init_api_client = __esm({
   "src/cli/api-client.ts"() {
     "use strict";
     init_config2();
+    init_readiness_failure();
     DEFAULT_TIMEOUT_MS = 2 * 60 * 60 * 1e3;
     GATEWAY_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
   }
@@ -48864,7 +49225,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@elevasis/sdk",
-      version: "1.48.0",
+      version: "1.49.0",
       description: "SDK for building Elevasis organization resources",
       type: "module",
       bin: {
@@ -49069,7 +49430,15 @@ function extractResourceMetadata(resource, schemaWarnings) {
   return meta;
 }
 function bumpVersion(current, type) {
-  const [major, minor, patch] = current.split(".").map(Number);
+  const match = PLAIN_SEMVER_RE.exec(current);
+  if (!match) {
+    throw new Error(
+      `Cannot bump version: "${current}" is not a plain "major.minor.patch" version (e.g. "1.0.0"). Set the deployment spec's version to a plain semver value before using --major/--minor/--patch.`
+    );
+  }
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  const patch = Number(match[3]);
   switch (type) {
     case "major":
       return `${major + 1}.0.0`;
@@ -49080,36 +49449,55 @@ function bumpVersion(current, type) {
   }
 }
 function updateDeploymentVersionSource(source, newVersion) {
-  let offset = 0;
+  const exportIndex = source.indexOf("export default");
+  if (exportIndex === -1) {
+    throw new Error('Unable to find "export default" in the deployment entry file');
+  }
+  const rootBraceIndex = source.indexOf("{", exportIndex);
+  if (rootBraceIndex === -1) {
+    throw new Error("Unable to find the default-exported object in the deployment entry file");
+  }
+  let depth = 0;
+  let offset = rootBraceIndex;
   while (offset < source.length) {
-    const keyIndex = source.indexOf("version", offset);
-    if (keyIndex === -1) break;
-    const before = source[keyIndex - 1];
-    const after = source[keyIndex + "version".length];
-    const isIdentifierBoundary = (before === void 0 || !/[A-Za-z0-9_$]/.test(before)) && (after === void 0 || !/[A-Za-z0-9_$]/.test(after));
-    if (!isIdentifierBoundary) {
-      offset = keyIndex + "version".length;
+    const char = source[offset];
+    if (char === "{" || char === "[" || char === "(") {
+      depth += 1;
+      offset += 1;
       continue;
     }
-    let cursor = keyIndex + "version".length;
-    while (/\s/.test(source[cursor] ?? "")) cursor += 1;
-    if (source[cursor] !== ":") {
-      offset = cursor;
+    if (char === "}" || char === "]" || char === ")") {
+      depth -= 1;
+      offset += 1;
+      if (depth === 0) break;
       continue;
     }
-    cursor += 1;
-    while (/\s/.test(source[cursor] ?? "")) cursor += 1;
-    const quote = source[cursor];
-    if (quote !== "'" && quote !== '"') {
-      offset = cursor;
-      continue;
+    if (depth === 1 && char === "v" && source.startsWith("version", offset)) {
+      const before = source[offset - 1];
+      const after = source[offset + "version".length];
+      const isIdentifierBoundary = (before === void 0 || !/[A-Za-z0-9_$]/.test(before)) && (after === void 0 || !/[A-Za-z0-9_$]/.test(after));
+      if (isIdentifierBoundary) {
+        let cursor = offset + "version".length;
+        while (/\s/.test(source[cursor] ?? "")) cursor += 1;
+        if (source[cursor] === ":") {
+          cursor += 1;
+          while (/\s/.test(source[cursor] ?? "")) cursor += 1;
+          const quote = source[cursor];
+          if (quote === "'" || quote === '"') {
+            const valueStart = cursor + 1;
+            const valueEnd = source.indexOf(quote, valueStart);
+            if (valueEnd !== -1) {
+              return `${source.slice(0, valueStart)}${newVersion}${source.slice(valueEnd)}`;
+            }
+          }
+        }
+      }
     }
-    const valueStart = cursor + 1;
-    const valueEnd = source.indexOf(quote, valueStart);
-    if (valueEnd === -1) break;
-    return `${source.slice(0, valueStart)}${newVersion}${source.slice(valueEnd)}`;
+    offset += 1;
   }
-  throw new Error("Unable to find a quoted version property in the deployment entry file");
+  throw new Error(
+    "Unable to find a quoted version property on the default-exported deployment spec (not nested inside a resource config) in the entry file"
+  );
 }
 function listOrganizationModelContractRefs(org) {
   return Object.values(org.organizationModel?.resources ?? {}).flatMap((resource) => {
@@ -49121,7 +49509,7 @@ function listOrganizationModelContractRefs(org) {
     ].filter((entry) => entry[1] !== void 0).map(([side, ref]) => ({ resourceId: resource.id, side, ref }));
   });
 }
-function validateResourceGovernancePreflight(orgName, org, contractRegistry) {
+function validateResourceGovernancePreflight(orgName, org, contractRegistry, onWarning = (message) => console.warn(message)) {
   if (org.organizationModel !== void 0) {
     OrganizationModelSchema.parse(org.organizationModel);
   }
@@ -49141,24 +49529,43 @@ Run \`pnpm exec elevasis-sdk om:scaffold:fill --gaps <path>\` to scaffold the mi
     );
   }
   validateDeclaredSystemInterfaceReadiness(orgName, org.organizationModel);
-  if (process.env.ELEVASIS_RESOURCE_VALIDATOR === "warn-only") return;
-  validateResourceGovernance(orgName, org, org.organizationModel, { mode: "strict" });
+  const mode = process.env.ELEVASIS_RESOURCE_VALIDATOR === "warn-only" ? "warn-only" : "strict";
+  validateResourceGovernance(orgName, org, org.organizationModel, {
+    mode,
+    onWarning: (issue2) => onWarning(issue2.message)
+  });
   const contractRefs = listOrganizationModelContractRefs(org);
-  if (contractRefs.length === 0 || contractRegistry === void 0) return;
+  if (contractRefs.length === 0) return;
+  if (contractRegistry === void 0) {
+    onWarning(
+      `[${orgName}] ${contractRefs.length} contract ref${contractRefs.length !== 1 ? "s" : ""} declared in organizationModel but no \`contractRegistry\` (or \`ELEVASIS_CONTRACT_REGISTRY\`) was exported from the entry file -- contract-ref resolution skipped.`
+    );
+    return;
+  }
   for (const { resourceId, side, ref } of contractRefs) {
     try {
       resolveContractRef(ref, contractRegistry);
     } catch (error46) {
       const message = error46 instanceof Error ? error46.message : String(error46);
-      throw new RegistryValidationError(
-        orgName,
-        resourceId,
-        `organizationModel.resources.${resourceId}.ontology.contract.${side}`,
-        message
-      );
+      const field2 = `organizationModel.resources.${resourceId}.ontology.contract.${side}`;
+      if (mode === "warn-only") {
+        onWarning(`[${orgName}] ${field2}: ${message}`);
+        continue;
+      }
+      throw new RegistryValidationError(orgName, resourceId, field2, message);
     }
   }
 }
+function formatZodValidationError(error46) {
+  return error46.issues.map((issue2) => {
+    const path3 = issue2.path.length > 0 ? issue2.path.join(".") : "(root)";
+    return `${path3}: ${issue2.message}`;
+  });
+}
+function formatRegistryValidationError(error46) {
+  if (error46.issues && error46.issues.length > 1) return error46.issues;
+  return [error46.message];
+}
 function registerDeployCommand(program3) {
   program3.command("deploy").description(
     "Validate, bundle, upload, and deploy project resources\n  Example: elevasis-sdk deploy --api-url http://localhost:5170"
@@ -49182,7 +49589,7 @@ function registerDeployCommand(program3) {
           authSpinner.fail(source_default.red("Authentication failed"));
           const errMsg = error46 instanceof Error ? error46.message : String(error46);
           if (errMsg.includes("401") || errMsg.toLowerCase().includes("unauthorized")) {
-            const keyVar = !options.prod && process.env.NODE_ENV === "development" && process.env.ELEVASIS_PLATFORM_KEY_DEV ? "ELEVASIS_PLATFORM_KEY_DEV" : "ELEVASIS_PLATFORM_KEY";
+            const keyVar = !isProdApiUrl(apiUrl) && process.env.NODE_ENV === "development" && process.env.ELEVASIS_PLATFORM_KEY_DEV ? "ELEVASIS_PLATFORM_KEY_DEV" : "ELEVASIS_PLATFORM_KEY";
             console.error(source_default.red("  Invalid API key."));
             console.error(source_default.gray(`  Your ${keyVar} was rejected by the server.`));
             console.error(source_default.gray("  Check your .env file and verify the key in the Elevasis dashboard."));
@@ -49206,7 +49613,13 @@ function registerDeployCommand(program3) {
             throw new Error("Invalid entry: no default export found");
           }
           const contractRegistry = deploymentModule.contractRegistry ?? deploymentModule.ELEVASIS_CONTRACT_REGISTRY;
-          validateResourceGovernancePreflight(orgName, org, contractRegistry);
+          const governanceWarnings = [];
+          validateResourceGovernancePreflight(
+            orgName,
+            org,
+            contractRegistry,
+            (message) => governanceWarnings.push(message)
+          );
           new ResourceRegistry({ [orgName]: org });
           activeWorkflows = (org.workflows ?? []).filter((w) => !w.config.archived);
           activeAgents = (org.agents ?? []).filter((a) => !a.config.archived);
@@ -49215,6 +49628,12 @@ function registerDeployCommand(program3) {
           validateSpinner.succeed(
             source_default.green("Validating...") + source_default.white("              done") + source_default.gray(` (${totalCount} resource${totalCount !== 1 ? "s" : ""}, 0 errors)`)
           );
+          if (governanceWarnings.length > 0) {
+            for (const warning of governanceWarnings) {
+              console.log(source_default.yellow(`  warn  ${warning}`));
+            }
+            console.log("");
+          }
           if (archivedCount > 0) {
             console.log(source_default.gray(`  Skipping ${archivedCount} archived resource${archivedCount !== 1 ? "s" : ""}`));
           }
@@ -49248,12 +49667,30 @@ function registerDeployCommand(program3) {
           if (error46 instanceof RegistryValidationError) {
             validateSpinner.fail(source_default.red("Validation failed"));
             console.error("");
-            console.error(source_default.red(`  ERROR  ${error46.message}`));
+            const issues = formatRegistryValidationError(error46);
+            if (issues.length > 1) {
+              console.error(source_default.red(`  ${issues.length} issues:`));
+              for (const issue2 of issues) {
+                console.error(source_default.red(`    - ${issue2}`));
+              }
+            } else {
+              console.error(source_default.red(`  ERROR  ${issues[0]}`));
+            }
             if (error46.resourceId) {
               console.error(source_default.gray(`  Resource: ${error46.resourceId}`));
             }
             console.error("");
             console.error(source_default.gray("  Deploy aborted."));
+          } else if (error46 instanceof external_exports.ZodError) {
+            validateSpinner.fail(source_default.red("Validation failed: organization model does not match the expected shape"));
+            console.error("");
+            for (const line of formatZodValidationError(error46)) {
+              console.error(source_default.red(`  ERROR  ${line}`));
+            }
+            console.error("");
+            console.error(source_default.gray("  Deploy aborted."));
+          } else if (validateSpinner.isSpinning) {
+            validateSpinner.fail(source_default.red("Validation failed"));
           }
           throw error46;
         }
@@ -49318,11 +49755,11 @@ import { startWorker } from '@elevasis/sdk/worker'
         const uploadSpinner = ora("Uploading...").start();
         try {
           const bundleBuffer = await (0, import_promises.readFile)(bundleOutfile);
-          const apiKey = resolveApiKey(options.prod);
+          const apiKey = resolveApiKeyForUrl(apiUrl);
           if (!apiKey) {
             uploadSpinner.fail(source_default.red("Missing API key environment variable"));
             console.error(source_default.gray("  Set it in your .env file or shell environment:"));
-            if (!options.prod && process.env.NODE_ENV === "development") {
+            if (!isProdApiUrl(apiUrl) && process.env.NODE_ENV === "development") {
               console.error(
                 source_default.gray("    ELEVASIS_PLATFORM_KEY_DEV=sk_...  (or ELEVASIS_PLATFORM_KEY as fallback)")
               );
@@ -49390,7 +49827,7 @@ import { startWorker } from '@elevasis/sdk/worker'
     )
   );
 }
-var import_path2, import_promises, import_fs2, import_crypto, import_url, import_module;
+var import_path2, import_promises, import_fs2, import_crypto, import_url, import_module, PLAIN_SEMVER_RE;
 var init_deploy = __esm({
   "src/cli/commands/deploy.ts"() {
     "use strict";
@@ -49411,6 +49848,7 @@ var init_deploy = __esm({
     init_api_client();
     init_wrap_action();
     init_version();
+    PLAIN_SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)$/;
   }
 });
 
@@ -55314,7 +55752,129 @@ function registerUiCommands(program3) {
 var import_node_fs9 = require("node:fs");
 var import_node_path8 = __toESM(require("node:path"), 1);
 init_source();
+init_organization_model();
 init_config2();
+init_load_org_model();
+
+// src/cli/commands/om/deployed-readiness.ts
+init_organization_model();
+init_api_client();
+function listApiInterfaceSystemPaths(model) {
+  return listAllSystems(model).filter(({ system }) => system.apiInterface !== void 0).map(({ path: path3 }) => path3);
+}
+function listDeployedReadinessTargets(model) {
+  const declared = new Set(listApiInterfaceSystemPaths(model));
+  const targets = SYSTEM_INTERFACE_PROFILES.map((profile) => ({
+    systemPath: profile.systemPath,
+    interfaceKey: profile.interfaceKey,
+    declaredLocally: declared.has(profile.systemPath)
+  }));
+  const covered = new Set(targets.map((target) => `${target.systemPath}::${target.interfaceKey}`));
+  for (const systemPath of declared) {
+    const key = `${systemPath}::api`;
+    if (covered.has(key)) continue;
+    covered.add(key);
+    targets.push({ systemPath, interfaceKey: "api", declaredLocally: true });
+  }
+  return targets;
+}
+async function fetchDeployedReadiness(model, options = {}) {
+  const targets = listDeployedReadinessTargets(model);
+  const report = {
+    activeDeploymentId: null,
+    snapshotHash: null,
+    kind: null,
+    entries: []
+  };
+  if (targets.length === 0) {
+    report.unavailableReason = "no System-interface profile to check \u2014 neither the platform catalog nor the project model declares one";
+    return report;
+  }
+  for (const target of targets) {
+    let response;
+    try {
+      const endpoint = `/api/external/organization-model/readiness?systemPath=${encodeURIComponent(target.systemPath)}&interfaceKey=${encodeURIComponent(target.interfaceKey)}`;
+      response = await apiGet(endpoint, options.apiUrl);
+    } catch (error46) {
+      report.unavailableReason = error46 instanceof Error ? error46.message : String(error46);
+      return report;
+    }
+    report.activeDeploymentId = response.activeDeploymentId;
+    report.snapshotHash = response.snapshotHash;
+    report.kind = response.kind;
+    report.entries.push({
+      systemPath: response.readiness.systemPath,
+      interfaceKey: response.readiness.interfaceKey,
+      ready: response.readiness.ready,
+      issues: response.readiness.issues,
+      declaredLocally: target.declaredLocally
+    });
+  }
+  return report;
+}
+function isUnadoptedNotDeclared(entry) {
+  return !entry.declaredLocally && entry.issues.every((issue2) => issue2.family === "SYSTEM_INTERFACE_MISSING");
+}
+function readinessDiagnostics(report) {
+  const diagnostics = [];
+  for (const entry of report.entries) {
+    if (entry.ready) {
+      diagnostics.push({
+        severity: "info",
+        code: "deployed-interface-ready",
+        systemPath: entry.systemPath,
+        message: `${entry.systemPath}/${entry.interfaceKey} is ready in the deployed snapshot.`
+      });
+      continue;
+    }
+    const unadopted = isUnadoptedNotDeclared(entry);
+    for (const issue2 of entry.issues) {
+      diagnostics.push({
+        severity: unadopted ? "info" : "error",
+        code: `deployed-${issue2.code}`,
+        systemPath: entry.systemPath,
+        ...issue2.ref !== void 0 && { targetId: issue2.ref },
+        message: `${entry.systemPath}/${entry.interfaceKey} ${unadopted ? "not adopted" : "not ready"} [${issue2.family}]: ${issue2.message}`,
+        source: "deployed-snapshot"
+      });
+    }
+  }
+  return diagnostics;
+}
+function readinessRoster(report) {
+  return report.entries.map((entry) => {
+    if (entry.ready) {
+      return {
+        systemPath: entry.systemPath,
+        interfaceKey: entry.interfaceKey,
+        status: "ready",
+        detail: "ready",
+        issues: []
+      };
+    }
+    if (isUnadoptedNotDeclared(entry)) {
+      return {
+        systemPath: entry.systemPath,
+        interfaceKey: entry.interfaceKey,
+        status: "not-adopted",
+        detail: "not adopted",
+        issues: entry.issues
+      };
+    }
+    return {
+      systemPath: entry.systemPath,
+      interfaceKey: entry.interfaceKey,
+      status: "not-ready",
+      detail: entry.issues[0]?.message ?? "not ready",
+      issues: entry.issues
+    };
+  });
+}
+function countReadinessRosterFailures(rows) {
+  return rows.filter((row) => row.status === "not-ready").length;
+}
+
+// src/cli/commands/doctor.ts
 function ok(label, detail) {
   console.log(`${source_default.green("[OK]")}   ${source_default.bold(label)}: ${detail}`);
 }
@@ -55422,6 +55982,38 @@ function registerDoctorCommand(program3) {
       if (isVerbose) verbose(`Error: ${networkError}`);
       failCount++;
     }
+    let model = DEFAULT_ORGANIZATION_MODEL;
+    try {
+      model = await loadOrgModel(projectRoot);
+    } catch (err) {
+      if (isVerbose) {
+        const msg = err instanceof Error ? err.message : String(err);
+        verbose(`Organization model load failed, roster limited to the platform catalog: ${msg}`);
+      }
+    }
+    const readiness = await fetchDeployedReadiness(model, { apiUrl });
+    if (readiness.unavailableReason !== void 0) {
+      warn("Systems", `Readiness unavailable \u2014 ${readiness.unavailableReason}`);
+      if (isVerbose) verbose(`GET ${apiUrl}/api/external/organization-model/readiness`);
+    } else {
+      const rows = readinessRoster(readiness);
+      for (const row of rows) {
+        const label = `Systems: ${row.systemPath}/${row.interfaceKey}`;
+        if (row.status === "ready") {
+          ok(label, row.detail);
+        } else if (row.status === "not-adopted") {
+          warn(label, row.detail);
+        } else {
+          fail(label, row.detail);
+        }
+        if (isVerbose) {
+          for (const issue2 of row.issues) {
+            verbose(`${issue2.code}: ${issue2.message}`);
+          }
+        }
+      }
+      failCount += countReadinessRosterFailures(rows);
+    }
     console.log();
     printSummary(failCount);
     if (failCount > 0) {
@@ -55918,6 +56510,12 @@ Content item: ${item.title}`));
 // src/cli/commands/content/board.ts
 init_source();
 
+// ../core/src/content/review-gates.ts
+function isAwaitingReview(item, step) {
+  if (!step) return false;
+  return step.reviewMode !== "none" && item.reviewedAt === null;
+}
+
 // ../core/src/content/derive-board.ts
 function sortPipelineSteps(steps) {
   return [...steps].sort((a, b) => {
@@ -55941,17 +56539,13 @@ function deriveItemPlacement(item, sortedSteps) {
   });
   if (!currentStep) {
     const lastStep = sortedSteps[sortedSteps.length - 1];
-    if (lastStep !== void 0 && lastStep.reviewMode !== "none" && item.reviewedAt === null) {
+    if (lastStep !== void 0 && isAwaitingReview(item, lastStep)) {
       return { bucket: "column", stepKey: lastStep.key };
     }
     return { bucket: "done", stepKey: null };
   }
   return { bucket: "column", stepKey: currentStep.key };
 }
-function deriveAwaitingReview(step, item) {
-  if (!step) return false;
-  return step.reviewMode !== "none" && item.reviewedAt === null;
-}
 function deriveContentBoard(items, pipeline, now) {
   const sortedSteps = sortPipelineSteps(pipeline.steps);
   const stepsByKey = new Map(sortedSteps.map((step) => [step.key, step]));
@@ -55965,7 +56559,7 @@ function deriveContentBoard(items, pipeline, now) {
       item,
       stepKey: placement.stepKey,
       ageMs: now - Date.parse(item.updatedAt),
-      awaitingReview: deriveAwaitingReview(step, item)
+      awaitingReview: isAwaitingReview(item, step)
     };
     if (placement.bucket === "done") {
       done.push(card);
@@ -55989,9 +56583,9 @@ function deriveContentBoard(items, pipeline, now) {
   const columns = sortedSteps.map((step) => {
     const cards = cardsByStepKey.get(step.key) ?? [];
     const column = { step, cards };
-    if (step.reviewMode === "live" || step.reviewMode === "queued") {
+    if (step.reviewVenue !== "none") {
       column.gate = {
-        reviewMode: step.reviewMode,
+        venue: step.reviewVenue,
         waitingCount: cards.filter((card) => card.awaitingReview).length
       };
     }
@@ -56108,7 +56702,9 @@ Board: ${pipelineId}  ${source_default.gray(`${items.data.length} of ${items.tot
       }
       console.log();
       for (const column of board.columns) {
-        const gate = column.gate ? source_default.yellow(`  [${column.gate.reviewMode} gate -- ${column.gate.waitingCount} waiting]`) : "";
+        const gate = column.gate ? source_default.yellow(
+          `  [${column.gate.venue === "workspace" ? "workspace" : "queue"} gate -- ${column.gate.waitingCount} waiting]`
+        ) : "";
         console.log(`  ${source_default.bold(column.step.label)} ${source_default.gray(column.step.key)}${gate}`);
         printCards(column.cards, stepsByKey);
       }
@@ -56170,7 +56766,7 @@ Pipeline: ${pipeline.id}`));
   const steps = Array.isArray(pipeline.steps) ? pipeline.steps : [];
   console.log(source_default.gray(`  Steps (${steps.length}):`));
   for (const step of steps) {
-    console.log(source_default.gray(`    - ${step.key} (reviewMode: ${step.reviewMode})`));
+    console.log(source_default.gray(`    - ${step.key} (review: ${step.reviewMode}, venue: ${step.reviewVenue})`));
   }
   console.log();
 }
@@ -56404,13 +57000,47 @@ function resolveTextArgument(value) {
     throw new Error(`Could not read --text file "${path3}": ${error46 instanceof Error ? error46.message : String(error46)}`);
   }
 }
+function resolveMetadataOption(options) {
+  if (options.metadata !== void 0 && options.metadataFile !== void 0) {
+    throw new Error("Pass exactly one of --metadata or --metadata-file, not both");
+  }
+  let raw;
+  if (options.metadataFile !== void 0) {
+    const path3 = resolveProjectRelative(options.metadataFile);
+    try {
+      raw = (0, import_node_fs10.readFileSync)(path3, "utf8");
+    } catch (error46) {
+      throw new Error(
+        `Could not read --metadata-file "${options.metadataFile}": ${error46 instanceof Error ? error46.message : String(error46)}`
+      );
+    }
+  } else {
+    raw = options.metadata;
+  }
+  if (raw === void 0) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error46) {
+    const source = options.metadataFile !== void 0 ? "--metadata-file" : "--metadata";
+    throw new Error(`${source} must be valid JSON: ${error46 instanceof Error ? error46.message : String(error46)}`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    const source = options.metadataFile !== void 0 ? "--metadata-file" : "--metadata";
+    throw new Error(`${source} must be a JSON object, e.g. {"key":"value"}`);
+  }
+  return parsed;
+}
 function registerContentSourceAssetCreate(program3) {
   program3.command("content:source-asset:create").description(
     'Create a content source asset from inline text or a URL, optionally linking it to an item\n  Example: elevasis-sdk content:source-asset:create --kind transcript --title "Episode 12" --text @transcript.txt --item <uuid>'
   ).requiredOption("--kind <kind>", "Source asset kind (e.g. transcript) -- validated against the org model catalog").requiredOption("--title <title>", "Human-readable title (1..500 chars)").option("--text <value>", "Inline text, or @path to read a local file. Mutually exclusive with --url").option(
     "--field <key>",
     "Payload field the --text content is written to. Defaults to the --kind value, matching the catalog declaration"
-  ).option("--url <url>", "External URL the asset references. Mutually exclusive with --text").option("--duration <seconds>", "Duration in seconds, for time-based referenced media").option("--item <itemId>", "Link the new asset to this content item after creating it").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API base URL").option("--pretty", "Render human-readable output instead of raw JSON").action(
+  ).option("--url <url>", "External URL the asset references. Mutually exclusive with --text").option("--duration <seconds>", "Duration in seconds, for time-based referenced media").option("--storage-path <path>", "Storage path the asset references (1..2000 chars)").option("--metadata <json>", "Arbitrary metadata as a JSON object string. Mutually exclusive with --metadata-file").option(
+    "--metadata-file <path>",
+    "Path to a JSON file containing metadata (project-relative unless absolute). Mutually exclusive with --metadata"
+  ).option("--item <itemId>", "Link the new asset to this content item after creating it").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API base URL").option("--pretty", "Render human-readable output instead of raw JSON").action(
     wrapAction("content:source-asset:create", async (options) => {
       if (options.text !== void 0 && options.url !== void 0) {
         throw new Error("Pass exactly one of --text or --url, not both");
@@ -56441,6 +57071,9 @@ function registerContentSourceAssetCreate(program3) {
         }
         body.durationSeconds = duration3;
       }
+      if (options.storagePath !== void 0) body.storagePath = options.storagePath;
+      const metadata = resolveMetadataOption(options);
+      if (metadata !== void 0) body.metadata = metadata;
       const apiUrl = resolveApiUrl(options.apiUrl, options.prod);
       const asset = await apiPost("/api/external/content/source-assets", body, apiUrl);
       let linkedItem;
@@ -56460,6 +57093,7 @@ Created source asset ${asset.id}`));
       console.log(source_default.gray(`  Title: ${asset.title}`));
       console.log(source_default.gray(`  Kind: ${asset.kind}`));
       if (asset.externalUrl) console.log(source_default.gray(`  URL: ${asset.externalUrl}`));
+      if (asset.storagePath) console.log(source_default.gray(`  Storage path: ${asset.storagePath}`));
       if (linkedItem) console.log(source_default.cyan(`  Linked to item ${linkedItem.id} (${linkedItem.title})`));
       console.log();
     })
@@ -57836,71 +58470,6 @@ function formatOmDoctorReport(report) {
   return lines.join("\n");
 }
 
-// src/cli/commands/om/deployed-readiness.ts
-init_organization_model();
-init_api_client();
-function listApiInterfaceSystemPaths(model) {
-  return listAllSystems(model).filter(({ system }) => system.apiInterface !== void 0).map(({ path: path3 }) => path3);
-}
-async function fetchDeployedReadiness(model, options = {}) {
-  const systemPaths = listApiInterfaceSystemPaths(model);
-  const report = {
-    activeDeploymentId: null,
-    snapshotHash: null,
-    kind: null,
-    entries: []
-  };
-  if (systemPaths.length === 0) {
-    report.unavailableReason = "no System in the project model declares an apiInterface";
-    return report;
-  }
-  for (const systemPath of systemPaths) {
-    let response;
-    try {
-      const endpoint = `/api/external/organization-model/readiness?systemPath=${encodeURIComponent(systemPath)}&interfaceKey=api`;
-      response = await apiGet(endpoint, options.apiUrl);
-    } catch (error46) {
-      report.unavailableReason = error46 instanceof Error ? error46.message : String(error46);
-      return report;
-    }
-    report.activeDeploymentId = response.activeDeploymentId;
-    report.snapshotHash = response.snapshotHash;
-    report.kind = response.kind;
-    report.entries.push({
-      systemPath: response.readiness.systemPath,
-      interfaceKey: response.readiness.interfaceKey,
-      ready: response.readiness.ready,
-      issues: response.readiness.issues
-    });
-  }
-  return report;
-}
-function readinessDiagnostics(report) {
-  const diagnostics = [];
-  for (const entry of report.entries) {
-    if (entry.ready) {
-      diagnostics.push({
-        severity: "info",
-        code: "deployed-interface-ready",
-        systemPath: entry.systemPath,
-        message: `${entry.systemPath}/${entry.interfaceKey} is ready in the deployed snapshot.`
-      });
-      continue;
-    }
-    for (const issue2 of entry.issues) {
-      diagnostics.push({
-        severity: "error",
-        code: `deployed-${issue2.code}`,
-        systemPath: entry.systemPath,
-        ...issue2.ref !== void 0 && { targetId: issue2.ref },
-        message: `${entry.systemPath}/${entry.interfaceKey} not ready [${issue2.family}]: ${issue2.message}`,
-        source: "deployed-snapshot"
-      });
-    }
-  }
-  return diagnostics;
-}
-
 // src/cli/commands/om/doctor.ts
 function registerOmDoctorCommand(program3) {
   program3.command("om:doctor").description(
@@ -58714,65 +59283,7 @@ if (envPath) {
 }
 var program2 = new Command();
 program2.name("elevasis-sdk").description(
-  source_default.cyan("Elevasis SDK CLI") + `
-
-Commands:
-  elevasis-sdk check                                Validate project resources
-  elevasis-sdk deploy                               Bundle and deploy to platform
-  elevasis-sdk resources                            List deployed resources
-  elevasis-sdk describe <resourceId>                Describe a resource
-  elevasis-sdk exec <resourceId> -i '{}'            Execute a resource
-  elevasis-sdk executions <resourceId>              List execution history
-  elevasis-sdk execution <resourceId> <id>          Get execution details
-  elevasis-sdk execution:cancel <resourceId> <id>   Cancel a running execution
-  elevasis-sdk executions:delete <resourceId>       Delete execution history (destructive)
-  elevasis-sdk deployments                          List deployments
-  elevasis-sdk project:list [--search <query>]      List projects with optional search
-  elevasis-sdk project:resolve <query>              Resolve a project ID from a name or UUID
-  elevasis-sdk project:work <query>                 Open a lifecycle-aware project work brief
-  elevasis-sdk client:list [--search <query>]       List clients with optional search
-  elevasis-sdk client:get <id>                      Get client detail and lineage
-  elevasis-sdk client:status                        Show client portfolio status
-  elevasis-sdk content:list [--status queued]       List content pipeline items
-  elevasis-sdk content:get <itemId>                 Get an item, its attempts, and distributions
-  elevasis-sdk content:queue                        List items awaiting a queued-gate review
-  elevasis-sdk content:pipeline [id]                List pipeline templates, or one step contract
-  elevasis-sdk content:distributions                List content distributions
-  elevasis-sdk content:review <itemId> --step <key> --approve|--reject --user <email>
-                                                     Clear a queued review gate on a content item
-  elevasis-sdk queue:list [--status pending]        List HITL command queue tasks
-  elevasis-sdk queue:select <id> --action-id <id>   Select and execute a HITL queue action
-  elevasis-sdk schedule:list [--status active]      List task schedules
-  elevasis-sdk schedule:create --name <name> ...    Create a task schedule
-  elevasis-sdk agent:list                           List deployed agents
-  elevasis-sdk agent:get <id>                       Get agent metadata and OM linkage
-  elevasis-sdk session:create <resourceId>          Create an agent session
-  elevasis-sdk session:turn <id> -f tmp/turn.json   Execute a session turn
-  elevasis-sdk session:messages <id>                Export session transcript messages
-  elevasis-sdk session:list                         List agent sessions
-  elevasis-sdk session:get <id>                     Get session details
-  elevasis-sdk session:end <id>                     End an active agent session
-  elevasis-sdk grant:list                           List public/code-gated agent access grants
-  elevasis-sdk grant:create --resource <id>       Create an agent access grant
-  elevasis-sdk grant:disable <slug>                  Disable an agent access grant
-  elevasis-sdk acquisition:list:list                 List acquisition lists
-  elevasis-sdk acquisition:deal:list                 List acquisition deals
-  elevasis-sdk knowledge:generate                   Generate knowledge nodes from MDX files
-  elevasis-sdk knowledge:ls <path>                  List knowledge nodes for a path
-  elevasis-sdk knowledge:cat <id>                   Print raw MDX body of a knowledge node
-  elevasis-sdk knowledge:graph <id>                 Show outgoing and incoming edges for a node
-  elevasis-sdk request:submit -f <path>             Submit a structured request report
-  elevasis-sdk request:list [--status open]         List reported requests
-  elevasis-sdk request:get <id>                     Get a reported request by id
-  elevasis-sdk request:update <id> -i <json>        Amend a request you filed
-  elevasis-sdk request:delete <id>                  Withdraw a request you filed
-  elevasis-sdk ui:use-local                         Use a local @elevasis/ui tarball
-  elevasis-sdk ui:use-published                     Restore published @elevasis/ui
-  elevasis-sdk cli [domain]                         Generate a registered command catalog
-  elevasis-sdk rename <id> --to <newId> [--prod]     Rename resource across platform tables
-  elevasis-sdk doctor [--verbose]                    Check project environment and API connectivity
-
-Use "elevasis-sdk <command> --help" for more information about a command.`
+  source_default.cyan("Elevasis SDK CLI") + '\n\nRun `elevasis-sdk cli` for the full command catalog. It is built by scanning the\ncommands actually registered below, so it can never drift out of sync the way a\nhand-written list here would.\n\n  elevasis-sdk cli                      Full catalog, grouped by domain\n  elevasis-sdk cli --domain <domain>    Filter to one domain, e.g. project, content, agent\n  elevasis-sdk cli --format json         Machine-readable catalog\n\nUse "elevasis-sdk <command> --help" for a specific command\'s options.'
 ).version(SDK_VERSION);
 program2.hook("preAction", () => {
   runPreflight();