@elevasis/sdk 1.48.0 → 1.50.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (56) hide show
  1. package/dist/chunk-MGZZ4HL4.js +4399 -0
  2. package/dist/chunk-VYWGWJRW.js +130 -0
  3. package/dist/chunk-YJDXRHNP.js +7901 -0
  4. package/dist/cli.cjs +949 -281
  5. package/dist/index.d.ts +1031 -48
  6. package/dist/index.js +2 -7597
  7. package/dist/node/index.d.ts +3 -3675
  8. package/dist/node/index.js +2 -124
  9. package/dist/test-utils/index.d.ts +2 -12051
  10. package/dist/test-utils/index.js +113 -27891
  11. package/dist/worker/index.d.ts +548 -12264
  12. package/dist/worker/index.js +3 -7400
  13. package/package.json +12 -4
  14. package/reference/_navigation.md +4 -4
  15. package/reference/_reference-manifest.json +1 -1
  16. package/reference/core/index.mdx +6 -4
  17. package/reference/index.mdx +11 -5
  18. package/reference/packages/core/src/README.md +46 -44
  19. package/reference/packages/core/src/content/README.md +16 -12
  20. package/reference/rules/agent-start-here.md +1 -1
  21. package/reference/rules/frontend.md +3 -1
  22. package/reference/rules/package-taxonomy.md +7 -5
  23. package/reference/rules/ui.md +31 -5
  24. package/reference/rules/vibe-intents.md +2 -2
  25. package/reference/rules/vibe.md +30 -10
  26. package/reference/scaffold/recipes/extend-content.md +82 -3
  27. package/reference/scaffold/recipes/gate-by-feature-or-admin.md +8 -6
  28. package/reference/scaffold/ui/feature-flags-and-gating.md +11 -1
  29. package/reference/sdk/cli-management.mdx +284 -139
  30. package/reference/sdk/cli.mdx +136 -88
  31. package/reference/sdk/define-builders.mdx +1 -1
  32. package/reference/sdk/deployment/command-center.mdx +2 -2
  33. package/reference/sdk/deployment/index.mdx +24 -7
  34. package/reference/sdk/exports.mdx +4 -4
  35. package/reference/sdk/framework/agent.mdx +4 -3
  36. package/reference/sdk/framework/index.mdx +1 -1
  37. package/reference/sdk/framework/project-structure.mdx +34 -23
  38. package/reference/sdk/framework/tutorial-system.mdx +1 -1
  39. package/reference/sdk/getting-started.mdx +25 -52
  40. package/reference/sdk/index.mdx +3 -3
  41. package/reference/sdk/platform-tools/adapters-integration.mdx +1 -1
  42. package/reference/sdk/platform-tools/adapters-platform.mdx +1 -1
  43. package/reference/sdk/platform-tools/type-safety.mdx +1 -1
  44. package/reference/sdk/resources/patterns.mdx +10 -11
  45. package/reference/sdk/resources/types.mdx +15 -9
  46. package/reference/sdk/templates/data-enrichment.mdx +1 -1
  47. package/reference/sdk/templates/email-sender.mdx +1 -1
  48. package/reference/sdk/templates/index.mdx +47 -47
  49. package/reference/sdk/templates/lead-scorer.mdx +1 -1
  50. package/reference/sdk/templates/pdf-generator.mdx +42 -24
  51. package/reference/sdk/templates/recurring-job.mdx +20 -15
  52. package/reference/sdk/templates/text-classifier.mdx +1 -1
  53. package/reference/sdk/templates/web-scraper.mdx +9 -5
  54. package/reference/sdk/troubleshooting.mdx +72 -1
  55. package/reference/ui/exports.mdx +1 -1
  56. package/reference/ui/index.mdx +2 -2
package/reference/sdk/cli-management.mdx CHANGED
@@ -1,11 +1,11 @@
1
1
  ---
2
2
  title: CLI Management Commands
3
- description: elevasis-sdk management commands -- project, note, acquisition, client, agent, session, queue, schedule, om, ui, skill, and content subcommand families
3
+ description: elevasis-sdk management commands -- project, note, acquisition, client, agent, session, queue, schedule, om, ui, skill, content, and grant subcommand families
4
4
  ---
5
5
 
6
6
  This page covers the domain management commands for `elevasis-sdk`. For core SDK commands (check, deploy, exec, resources, executions, describe, creds, rename), see [CLI Reference](cli.mdx).
7
7
 
8
- Every command family on this page -- `project`, `note`, `acquisition`, `client`, `agent`, `session`, `queue`, `schedule`, `om:doctor`, `request`, and `content` -- also accepts `--prod` to target production, overriding `NODE_ENV=development` (live as of `@elevasis/sdk` 1.45.0). See [CLI Reference's Global Flags](cli.mdx#global-flags) for the full description; per-command flag tables below list `--api-url` and other command-specific flags only, not `--prod` or `--json`.
8
+ Every command family on this page -- `project`, `note`, `error`, `acquisition`, `client`, `agent`, `session`, `queue`, `schedule`, `om:doctor`, `request`, `content`, and `grant` -- also accepts `--prod` to target production, overriding `NODE_ENV=development` (live as of `@elevasis/sdk` 1.45.0). See [CLI Reference's Global Flags](cli.mdx#global-flags) for the full description; per-command flag tables below list `--api-url` and other command-specific flags only, not `--prod` or `--json`.
9
9
 
10
10
  ---
11
11
 
@@ -37,11 +37,11 @@ Each shell fails at a different layer, so a single inline-quoting fix does not c
37
37
 
38
38
  **Cross-shell rule:** file-based input is shell-agnostic -- only a path crosses the shell boundary. Prefer `@json:<path>` (or `-f` / `--input-file` for `exec` and `request:submit`) for any non-trivial JSON, and write the file with an editor rather than a shell heredoc.
39
39
 
40
- | Shell | Inline JSON | Why | Use instead |
41
- | -------------- | --------------------------------------- | --------------------------------------------- | ------------------------------------ |
40
+ | Shell | Inline JSON | Why | Use instead |
41
+ | -------------- | ------------------------------------- | --------------------------------------------- | ------------------------------------ |
42
42
  | bash | OK if values avoid `( ) & < > | ^ %` | run-script `cmd.exe` re-parses metacharacters | direct exec form, or `@json:<path>` |
43
- | PowerShell 5.1 | Never reliable | strips embedded `"`; `--%` and `\"` both fail | `@json:<path>` |
44
- | either | n/a | path arguments avoid all JSON shell escaping | `@json:<path>` + editor-written file |
43
+ | PowerShell 5.1 | Never reliable | strips embedded `"`; `--%` and `\"` both fail | `@json:<path>` |
44
+ | either | n/a | path arguments avoid all JSON shell escaping | `@json:<path>` + editor-written file |
45
45
 
46
46
  ---
47
47
 
@@ -61,6 +61,8 @@ This CLI family is SDK-first, but it is not semantically standalone. It operates
61
61
 
62
62
  ```bash
63
63
  elevasis-sdk project:list
64
+ elevasis-sdk project:resolve "Website Refresh"
65
+ elevasis-sdk project:work "Website Refresh"
64
66
  elevasis-sdk project:get <id>
65
67
  elevasis-sdk project:create --name "Website Refresh" --kind client_engagement
66
68
  elevasis-sdk project:update <id> --status completed
@@ -69,7 +71,9 @@ elevasis-sdk project:delete <id>
69
71
 
70
72
  **Behavior:**
71
73
 
72
- - `project:list` filters by `--kind` and `--status`
74
+ - `project:list` filters by `--kind`, `--status`, `--search`, and `--client` (a UUID or fuzzy client name, resolved through the same client-lookup helper `client:resolve` exposes)
75
+ - `project:resolve <query>` resolves a project ID from a UUID, exact name, or search query and prints the ID (or the full record with `--pretty`) -- the same resolution logic used internally wherever a project command accepts a fuzzy identifier
76
+ - `project:work <query>` (alias `project:open`) resolves a project and prints a lifecycle-aware work brief combining the project record and its notes; `--json` renders the structured brief instead of the formatted one
73
77
  - `project:get` returns a single project
74
78
  - `project:create` and `project:update` operate on `/api/external/projects`
75
79
 
@@ -121,14 +125,14 @@ Task checklist flags are also full replacements. `project:task:create`, `project
121
125
 
122
126
  **`project:task:save` flags:**
123
127
 
124
- | Flag | Description |
125
- | --------------------------- | ----------------------------------------- |
128
+ | Flag | Description |
129
+ | ------------------------- | ----------------------------------------- |
126
130
  | `--current-state <text>` | Required. Current state description |
127
131
  | `--files-modified <json>` | JSON array of modified file paths |
128
132
  | `--next-steps <text>` | Next steps description |
129
133
  | `--key-docs <json>` | JSON array of key doc paths |
130
134
  | `--tools <json>` | JSON array of tool names used |
131
- | `--pretty` | Human-readable output instead of raw JSON |
135
+ | `--pretty` | Human-readable output instead of raw JSON |
132
136
  | `--api-url <url>` | Override the API base URL |
133
137
 
134
138
  ### Notes
@@ -162,13 +166,13 @@ Submits a structured request report to `POST /api/external/requests`. The payloa
162
166
 
163
167
  **Flags:**
164
168
 
165
- | Flag | Description |
166
- | --------------------------- | ----------------------------------------------------------------------------- |
167
- | `-i, --input <json>` | Request body as JSON string |
168
- | `-f, --input-file <path>` | Read body from a JSON file; relative paths resolve against the project root |
169
- | `--pretty` | Human-readable output instead of raw JSON |
170
- | `--cleanup-input` | Delete the input file after success (only files under `<projectRoot>/tmp/`) |
171
- | `--api-url <url>` | Override the API base URL |
169
+ | Flag | Description |
170
+ | ------------------------- | --------------------------------------------------------------------------- |
171
+ | `-i, --input <json>` | Request body as JSON string |
172
+ | `-f, --input-file <path>` | Read body from a JSON file; relative paths resolve against the project root |
173
+ | `--pretty` | Human-readable output instead of raw JSON |
174
+ | `--cleanup-input` | Delete the input file after success (only files under `<projectRoot>/tmp/`) |
175
+ | `--api-url <url>` | Override the API base URL |
172
176
 
173
177
  **Read commands** (added once `request` cleared the 4-point promotion bar):
174
178
 
@@ -179,24 +183,40 @@ elevasis-sdk request:get <id>
179
183
 
180
184
  `request:list` calls `GET /api/external/requests` and `request:get` calls `GET /api/external/requests/:id`. Both default to raw JSON; pass `--pretty` for human-readable output (mirrors `request:submit`). Organization scope is derived from the API key, so `request:get` returns 404 for an id belonging to another tenant -- a cross-tenant id is indistinguishable from a missing one (no existence oracle).
181
185
 
182
- | Flag | Description |
183
- | --------------------- | ----------------------------------------------- |
186
+ | Flag | Description |
187
+ | ------------------- | ----------------------------------------------- |
184
188
  | `--status <status>` | Filter list by status (`RequestStatusEnum`) |
185
189
  | `--severity <sev>` | Filter list by severity (`RequestSeverityEnum`) |
186
190
  | `--project-id <id>` | Filter list by project id |
187
191
  | `--limit <n>` | Max rows (1-200, default 50) |
188
- | `--pretty` | Human-readable output instead of raw JSON |
192
+ | `--pretty` | Human-readable output instead of raw JSON |
189
193
  | `--api-url <url>` | Override the API base URL |
190
194
 
195
+ **Write-back commands** (amend or withdraw a request you filed):
196
+
197
+ ```bash
198
+ elevasis-sdk request:update <id> --input '{"project_id":"<uuid>"}'
199
+ elevasis-sdk request:delete <id>
200
+ ```
201
+
202
+ `request:update` calls `PATCH /api/external/requests/:id` to backfill fields (for example `project_id` / `task_id` on rows filed before those were populated) -- the payload is validated against `UpdateRequestInputSchema`. `status` is not writable through this command; it is the platform's answer to the request, so poll `request:get` to read it instead. `request:delete` calls `DELETE /api/external/requests/:id` and is permanent -- the row is removed, not archived. Use `request:update` to amend a request instead of deleting and resubmitting.
203
+
204
+ | Flag | Description |
205
+ | ------------------------- | --------------------------------------------------------------------------- |
206
+ | `-i, --input <json>` | Fields to change, as a JSON object (update: required unless `--input-file`) |
207
+ | `-f, --input-file <path>` | Read the changed fields from a JSON file instead of `--input` |
208
+ | `--pretty` | Human-readable output instead of raw JSON |
209
+ | `--api-url <url>` | Override the API base URL |
210
+
191
211
  ---
192
212
 
193
213
  ### Shared Flags
194
214
 
195
215
  Most `project:*` commands support:
196
216
 
197
- | Flag | Description |
198
- | ------------------- | -------------------------------------------------- |
199
- | `--pretty` | Human-readable terminal output instead of raw JSON |
217
+ | Flag | Description |
218
+ | ----------------- | -------------------------------------------------- |
219
+ | `--pretty` | Human-readable terminal output instead of raw JSON |
200
220
  | `--api-url <url>` | Override the API base URL |
201
221
 
202
222
  For exact required flags and accepted enum values, see the command source under `packages/sdk/src/cli/commands/project/`.
@@ -234,16 +254,16 @@ elevasis-sdk note:create --content <text>
234
254
 
235
255
  **Flags:**
236
256
 
237
- | Flag | Description |
238
- | ------------------------- | ----------------------------------------------------------------------------------------- |
257
+ | Flag | Description |
258
+ | ----------------------- | ----------------------------------------------------------------------------------------- |
239
259
  | `--content <text>` | Required. The note body text |
240
260
  | `--user <email>` | **Required.** Target user email |
241
261
  | `--title <text>` | Optional note title |
242
262
  | `--priority <priority>` | Priority level: `low`, `normal` (default), `high`, or `urgent` |
243
- | `--pinned` | Pin the note to the top of the panel |
263
+ | `--pinned` | Pin the note to the top of the panel |
244
264
  | `--source <id>` | Source identifier -- set this to the workflow or agent ID when calling from agent runtime |
245
265
  | `--api-url <url>` | Override the API base URL |
246
- | `--pretty` | Human-readable terminal output instead of raw JSON |
266
+ | `--pretty` | Human-readable terminal output instead of raw JSON |
247
267
 
248
268
  **Behavior:**
249
269
 
@@ -294,15 +314,15 @@ elevasis-sdk note:list --user <email>
294
314
 
295
315
  **Flags:**
296
316
 
297
- | Flag | Description |
298
- | ------------------------- | -------------------------------------------------------- |
317
+ | Flag | Description |
318
+ | ----------------------- | -------------------------------------------------------- |
299
319
  | `--user <email>` | Required. The user whose notes to retrieve |
300
320
  | `--priority <priority>` | Filter by priority: `low`, `normal`, `high`, or `urgent` |
301
- | `--pinned` | Return only pinned notes |
321
+ | `--pinned` | Return only pinned notes |
302
322
  | `--limit <n>` | Maximum number of results to return |
303
323
  | `--offset <n>` | Pagination offset |
304
324
  | `--api-url <url>` | Override the API base URL |
305
- | `--pretty` | Human-readable terminal output instead of raw JSON |
325
+ | `--pretty` | Human-readable terminal output instead of raw JSON |
306
326
 
307
327
  **Behavior:**
308
328
 
@@ -337,9 +357,9 @@ elevasis-sdk note:list --user ops@acme.com --priority high --pinned --pretty
337
357
 
338
358
  ### Shared Flags
339
359
 
340
- | Flag | Description |
341
- | ------------------- | -------------------------------------------------- |
342
- | `--pretty` | Human-readable terminal output instead of raw JSON |
360
+ | Flag | Description |
361
+ | ----------------- | -------------------------------------------------- |
362
+ | `--pretty` | Human-readable terminal output instead of raw JSON |
343
363
  | `--api-url <url>` | Override the API base URL |
344
364
 
345
365
  ### Command Boundary
@@ -363,6 +383,31 @@ The following invariants govern the Notes feature and are relevant when building
363
383
 
364
384
  ---
365
385
 
386
+ ## elevasis-sdk error:\*
387
+
388
+ Resolve execution errors surfaced by the observability layer -- mark one error, or every error tied to a single execution, as resolved.
389
+
390
+ ```bash
391
+ elevasis-sdk error resolve <errorId>
392
+ elevasis-sdk error resolve-execution <executionId>
393
+ ```
394
+
395
+ - `error resolve <errorId>` -- calls `PATCH /api/external/observability/errors/:errorId/resolve` and marks that one error resolved
396
+ - `error resolve-execution <executionId>` -- calls `PATCH /api/external/observability/errors/execution/:executionId/resolve` and marks every error tied to that execution resolved in one call
397
+
398
+ These are space-separated subcommands under the `error` group (`error resolve`, not `error:resolve`), unlike every other domain on this page.
399
+
400
+ **Flags:**
401
+
402
+ | Flag | Description |
403
+ | ----------------- | ---------------------------------------------------- |
404
+ | `--prod` | Target production (overrides `NODE_ENV=development`) |
405
+ | `--api-url <url>` | Override the API base URL |
406
+
407
+ **Implementation:** `packages/sdk/src/cli/commands/error/`
408
+
409
+ ---
410
+
366
411
  ## elevasis-sdk acquisition:\*
367
412
 
368
413
  Read-only access to acquisition lists and CRM deals. The acquisition CLI scope is intentionally read-only; mutating commands are deferred.
@@ -375,7 +420,7 @@ elevasis-sdk acquisition:list:get <id>
375
420
  elevasis-sdk acquisition:list:status
376
421
  ```
377
422
 
378
- - `acquisition:list:list` -- list all acquisition lists for the organization
423
+ - `acquisition:list:list` -- list acquisition lists for the organization; filters: `--status` (`draft | enriching | launched | closing | archived`), `--batch`, `--vertical`, `--limit`, `--offset`
379
424
  - `acquisition:list:get <id>` -- get full detail for a single acquisition list by UUID
380
425
  - `acquisition:list:status` -- summarize counts and progress across all lists
381
426
 
@@ -387,7 +432,7 @@ elevasis-sdk acquisition:deal:get <id>
387
432
  elevasis-sdk acquisition:deal:status
388
433
  ```
389
434
 
390
- - `acquisition:deal:list` -- list all CRM deals visible to the organization
435
+ - `acquisition:deal:list` -- list CRM deals visible to the organization; filters: `--stage`, `--list <id>`, `--batch`, `--stale-since <iso>`, `--search`, `--limit`, `--offset`
391
436
  - `acquisition:deal:get <id>` -- get a single deal record
392
437
  - `acquisition:deal:status` -- summarize deal pipeline counts
393
438
 
@@ -402,19 +447,19 @@ JWT-gated routes at the original unprefixed paths remain for the Command Center.
402
447
 
403
448
  **`acquisition:list:get` flags:**
404
449
 
405
- | Flag | Description |
406
- | ------------------------ | -------------------------------------------------- |
407
- | `--no-include-deals` | Exclude thin deal lineage refs from the response |
450
+ | Flag | Description |
451
+ | ---------------------- | -------------------------------------------------- |
452
+ | `--no-include-deals` | Exclude thin deal lineage refs from the response |
408
453
  | `--deal-limit <limit>` | Maximum number of thin deal refs to include |
409
- | `--include-progress` | Include processing progress aggregates |
410
- | `--pretty` | Human-readable terminal output instead of raw JSON |
454
+ | `--include-progress` | Include processing progress aggregates |
455
+ | `--pretty` | Human-readable terminal output instead of raw JSON |
411
456
  | `--api-url <url>` | Override the API base URL |
412
457
 
413
458
  **Shared flags (all other acquisition commands):**
414
459
 
415
- | Flag | Description |
416
- | ------------------- | -------------------------------------------------- |
417
- | `--pretty` | Human-readable terminal output instead of raw JSON |
460
+ | Flag | Description |
461
+ | ----------------- | -------------------------------------------------- |
462
+ | `--pretty` | Human-readable terminal output instead of raw JSON |
418
463
  | `--api-url <url>` | Override the API base URL |
419
464
 
420
465
  **Implementation:** `packages/sdk/src/cli/commands/acquisition/`
@@ -446,20 +491,26 @@ Full CRUD management for client records. The `client:*` family covers create, re
446
491
 
447
492
  ```bash
448
493
  elevasis-sdk client:list
494
+ elevasis-sdk client:resolve "Acme"
449
495
  elevasis-sdk client:get <id>
496
+ elevasis-sdk client:status
450
497
  elevasis-sdk client:create --name "Acme Corp"
451
498
  elevasis-sdk client:update <id> --name "Acme Corp Updated"
452
499
  elevasis-sdk client:delete <id>
453
500
  ```
454
501
 
502
+ - `client:resolve <query>` resolves a client ID from a UUID, exact name, or search query and prints the ID (or the full record with `--pretty`) -- the same resolution `client:update`, `client:delete`, and `project:create --client` use internally
503
+ - `client:status` summarizes the client portfolio: totals by status and linked-record counts (deals, projects, companies, contacts)
504
+ - `client:update` supports `--clear-source-deal`, `--clear-primary-company`, and `--clear-primary-contact` to null out those links; each is mutually exclusive with its corresponding set flag
505
+
455
506
  **Flags:**
456
507
 
457
- | Flag | Description |
458
- | ------------------- | -------------------------------------------------- |
459
- | `--pretty` | Human-readable terminal output instead of raw JSON |
508
+ | Flag | Description |
509
+ | ----------------- | -------------------------------------------------- |
510
+ | `--pretty` | Human-readable terminal output instead of raw JSON |
460
511
  | `--api-url <url>` | Override the API base URL |
461
512
 
462
- **Implementation:** `packages/sdk/src/cli/commands/` (client family)
513
+ **Implementation:** `packages/sdk/src/cli/commands/client/` (client family)
463
514
 
464
515
  ---
465
516
 
@@ -472,19 +523,22 @@ elevasis-sdk agent:list
472
523
  elevasis-sdk agent:get <id>
473
524
  ```
474
525
 
475
- - `agent:list` -- list all agents registered for the organization
476
- - `agent:get <id>` -- get metadata and schema for a specific agent
526
+ - `agent:list` -- list resources for the organization, filtered client-side to `resourceType: 'agent'`
527
+ - `agent:get <id>` -- get metadata and organization-model linkage for a specific agent
477
528
 
478
- **API routes:** `GET /api/external/agents`, `/api/external/agents/:id`
529
+ **API routes:** `GET /api/external/resources` (filtered to agents), `GET /api/external/resources/:id/definition`
479
530
 
480
531
  **Flags:**
481
532
 
482
- | Flag | Description |
483
- | ------------------- | -------------------------------------------------- |
484
- | `--pretty` | Human-readable terminal output instead of raw JSON |
485
- | `--api-url <url>` | Override the API base URL |
533
+ | Flag | Description |
534
+ | ----------------- | -------------------------------------------------------- |
535
+ | `--json` | Output raw JSON instead of the default formatted display |
536
+ | `--prod` | Target production (overrides `NODE_ENV=development`) |
537
+ | `--api-url <url>` | Override the API base URL |
538
+
539
+ Note the direction: `agent:*` defaults to a formatted display and opts into JSON with `--json`, the opposite convention from the `--pretty`-to-opt-into-formatted commands elsewhere on this page.
486
540
 
487
- **Implementation:** `packages/sdk/src/cli/commands/` (agent family)
541
+ **Implementation:** `packages/sdk/src/cli/commands/agent/`
488
542
 
489
543
  ---
490
544
 
@@ -521,48 +575,48 @@ must be exposed as a separate explicit command.
521
575
 
522
576
  **`session:create` flags:**
523
577
 
524
- | Flag | Description |
525
- | --------------------- | ------------------------------ |
578
+ | Flag | Description |
579
+ | ------------------- | ------------------------------ |
526
580
  | `--user-id <id>` | Optional user ID for session |
527
581
  | `--metadata <json>` | Optional session metadata JSON |
528
- | `--json` | Output as JSON |
582
+ | `--json` | Output as JSON |
529
583
  | `--api-url <url>` | Override the API base URL |
530
584
 
531
585
  **`session:turn` flags:**
532
586
 
533
- | Flag | Description |
534
- | --------------------------- | -------------------------------- |
587
+ | Flag | Description |
588
+ | ------------------------- | -------------------------------- |
535
589
  | `-i, --input <json>` | Turn input as JSON |
536
590
  | `-f, --input-file <path>` | Read turn input from a JSON file |
537
- | `--json` | Output as JSON |
591
+ | `--json` | Output as JSON |
538
592
  | `--api-url <url>` | Override the API base URL |
539
593
 
540
594
  **`session:messages` flags:**
541
595
 
542
- | Flag | Description |
543
- | --------------------- | ----------------------------------------------------------- |
596
+ | Flag | Description |
597
+ | ------------------- | ----------------------------------------------------------- |
544
598
  | `--limit <limit>` | Messages per API page; default comes from the API |
545
599
  | `--cursor <cursor>` | Message index cursor to start after |
546
- | `--page` | Fetch one API page for debugging instead of all pages |
547
- | `--all` | Fetch all pages; this is the default transcript export mode |
548
- | `--json` | Output as JSON |
600
+ | `--page` | Fetch one API page for debugging instead of all pages |
601
+ | `--all` | Fetch all pages; this is the default transcript export mode |
602
+ | `--json` | Output as JSON |
549
603
  | `--api-url <url>` | Override the API base URL |
550
604
 
551
605
  **`session:list` flags:**
552
606
 
553
- | Flag | Description |
554
- | ---------------------- | ------------------------------------ |
607
+ | Flag | Description |
608
+ | -------------------- | ------------------------------------ |
555
609
  | `--resource-id <id>` | Filter by agent resource ID |
556
610
  | `--user-id <id>` | Filter by user ID |
557
611
  | `--limit <limit>` | Maximum number of sessions to return |
558
- | `--json` | Output as JSON |
612
+ | `--json` | Output as JSON |
559
613
  | `--api-url <url>` | Override the API base URL |
560
614
 
561
615
  **Shared flags (`session:get`, `session:end`):**
562
616
 
563
- | Flag | Description |
564
- | ------------------- | ------------------------- |
565
- | `--json` | Output as JSON |
617
+ | Flag | Description |
618
+ | ----------------- | ------------------------- |
619
+ | `--json` | Output as JSON |
566
620
  | `--api-url <url>` | Override the API base URL |
567
621
 
568
622
  **Implementation:** `packages/sdk/src/cli/commands/session/session.ts`
@@ -585,8 +639,8 @@ elevasis-sdk queue:status --pretty
585
639
 
586
640
  **`queue:list` filter flags:**
587
641
 
588
- | Flag | Description |
589
- | --------------------------- | --------------------------------------------------------------------------- |
642
+ | Flag | Description |
643
+ | ------------------------- | --------------------------------------------------------------------------- |
590
644
  | `--status <status>` | Filter by status: `pending`, `processing`, `completed`, `failed`, `expired` |
591
645
  | `--human-checkpoint <id>` | Filter by checkpoint ID, or `ungrouped` for tasks without a checkpoint |
592
646
  | `--time-range <range>` | Filter by created time range: `1h`, `24h`, `7d`, `30d` |
@@ -594,26 +648,39 @@ elevasis-sdk queue:status --pretty
594
648
  | `--priority-max <number>` | Maximum priority, 1-10 |
595
649
  | `--limit <limit>` | Maximum number of tasks to return |
596
650
  | `--offset <offset>` | Number of tasks to skip |
597
- | `--pretty` | Human-readable output instead of raw JSON |
651
+ | `--pretty` | Human-readable output instead of raw JSON |
598
652
  | `--api-url <url>` | Override the API base URL |
599
653
 
600
654
  **`queue:select` flags:**
601
655
 
602
- | Flag | Description |
603
- | -------------------- | ----------------------------------------- |
656
+ | Flag | Description |
657
+ | ------------------ | ----------------------------------------- |
604
658
  | `--action-id <id>` | Required. Action ID to select |
605
659
  | `--payload <json>` | Optional action payload as JSON |
606
660
  | `--notes <notes>` | Optional human decision notes |
607
- | `--pretty` | Human-readable output instead of raw JSON |
661
+ | `--pretty` | Human-readable output instead of raw JSON |
608
662
  | `--api-url <url>` | Override the API base URL |
609
663
 
610
- **Shared flags (`queue:get`, `queue:expire`, `queue:status`):**
664
+ **Shared flags (`queue:get`, `queue:expire`):**
611
665
 
612
- | Flag | Description |
613
- | ------------------- | ----------------------------------------- |
614
- | `--pretty` | Human-readable output instead of raw JSON |
666
+ | Flag | Description |
667
+ | ----------------- | ----------------------------------------- |
668
+ | `--pretty` | Human-readable output instead of raw JSON |
615
669
  | `--api-url <url>` | Override the API base URL |
616
670
 
671
+ **`queue:status` filter flags:**
672
+
673
+ `queue:status` shares the checkpoint/status view rather than the task list, so it takes its own subset of filters, not the shared flags above:
674
+
675
+ | Flag | Description |
676
+ | ------------------------- | --------------------------------------------------------------------- |
677
+ | `--time-range <range>` | Filter by created time range: `1h`, `24h`, `7d`, `30d` |
678
+ | `--priority-min <number>` | Minimum priority, 1-10 |
679
+ | `--priority-max <number>` | Maximum priority, 1-10 |
680
+ | `--status <status>` | Filter checkpoint totals by status: `pending`, `completed`, `expired` |
681
+ | `--pretty` | Human-readable output instead of raw JSON |
682
+ | `--api-url <url>` | Override the API base URL |
683
+
617
684
  **Auth:** Calls `/api/external/command-queue/*` with API-key auth.
618
685
 
619
686
  ---
@@ -658,14 +725,14 @@ elevasis-sdk schedule:cancel <id> --pretty
658
725
 
659
726
  **`schedule:update` flags:**
660
727
 
661
- | Flag | Description |
662
- | ---------------------------- | ------------------------------------------------------------------------- |
728
+ | Flag | Description |
729
+ | -------------------------- | ------------------------------------------------------------------------- |
663
730
  | `--name <name>` | New schedule name |
664
731
  | `--description <text>` | New schedule description |
665
- | `--clear-description` | Remove the schedule description (mutually exclusive with `--description`) |
732
+ | `--clear-description` | Remove the schedule description (mutually exclusive with `--description`) |
666
733
  | `--schedule-config <json>` | Replacement schedule config JSON |
667
734
  | `--max-retries <number>` | Maximum retry attempts, 0-10 |
668
- | `--pretty` | Human-readable output instead of raw JSON |
735
+ | `--pretty` | Human-readable output instead of raw JSON |
669
736
  | `--api-url <url>` | Override the API base URL |
670
737
 
671
738
  At least one field must be provided. `--description` and `--clear-description` are mutually exclusive.
@@ -683,7 +750,19 @@ Knowledge graph inspection, plus an Organization Model write surface (`om:scaffo
683
750
  - `knowledge:ls <path>` -- list nodes/edges for the mount; default output is an id + summary table, `--json` returns `{ path, mount, args, results }`.
684
751
  - `knowledge:cat <id>` -- render a node's `body` MDX to stdout; `--json` returns the full node object (body, links, owners, timestamps).
685
752
  - `knowledge:graph <id>` -- show outgoing + incoming edges grouped by edge kind.
686
- - `om:doctor` -- validate Organization Model integrity against published `@elevasis/core/organization-model` primitives. This is a deliberately reduced 3-check command: two of the monorepo platform CLI's five checks assert monorepo-only paths that do not exist in a tenant project, so they are not ported. `--json` output includes `checksRun: 3` so a caller can tell it apart from the platform CLI's 5-check version.
753
+ - `om:doctor` -- validate Organization Model integrity against published `@elevasis/core/organization-model` primitives. This is a deliberately reduced 3-check command: two of the monorepo platform CLI's five checks assert monorepo-only paths that do not exist in a tenant project, so they are not ported. `--json` output includes `checksRun: 3` so a caller can tell it apart from the platform CLI's 5-check version. `om:doctor` also asks the API about the deployed readiness snapshot and merges those diagnostics in, unless `--skip-deployed` is passed; it degrades to `NOT RUN` rather than failing when there is no key or no server reachable.
754
+
755
+ **`om:doctor` flags:**
756
+
757
+ | Flag | Description |
758
+ | ---------------------- | ------------------------------------------------------------ |
759
+ | `--scope <systemPath>` | Limit diagnostics to a system path and its descendants |
760
+ | `--skip-deployed` | Structural checks only -- do not ask the API about readiness |
761
+ | `--json` | Output as a grouped JSON envelope |
762
+ | `--prod` | Target production (overrides `NODE_ENV=development`) |
763
+ | `--api-url <url>` | Override the API base URL |
764
+
765
+ The readiness arm enumerates the **platform catalog** of System Interfaces, not only the Systems your own model declares, so a System you have not adopted still appears with diagnostics. An unadopted System is informational and does not affect the exit code; a System you declared locally that is missing from the deployed snapshot is drift and does. For the compact one-line-per-System version of the same data, use [`elevasis-sdk doctor`](cli.mdx#elevasis-sdk-doctor) -- both commands share one fetch.
687
766
 
688
767
  In tenant projects, SDK read commands load `core/config/organization-model.ts` through the SDK's layout-aware TypeScript loader. The temporary bundle and dependency resolution are anchored at the package root that owns SDK dependencies, so hoisted pnpm workspaces resolve `esbuild` and `@elevasis/core` correctly. Missing org-model files still return the default model; malformed files or files with no usable export emit diagnostics. `knowledge:generate` / `om:generate` is the exception because it reads MDX and codegen inputs directly.
689
768
 
@@ -697,7 +776,7 @@ elevasis-sdk knowledge:search <query>
697
776
  elevasis-sdk knowledge:describe <nodeId>
698
777
  elevasis-sdk knowledge:skills <nodeId>
699
778
  elevasis-sdk knowledge:generate
700
- elevasis-sdk om:doctor --org <OrgName>
779
+ elevasis-sdk om:doctor --scope sales.crm
701
780
  ```
702
781
 
703
782
  These are registered as `knowledge:*` subcommands on `elevasis-sdk`. Both the SDK CLI (`elevasis-sdk knowledge:*`) and the platform CLI (`elevasis knowledge:*`) call the same query functions in `@repo/core/knowledge/queries`.
@@ -710,12 +789,12 @@ Universal keyword search across the entire Organization Model (systems, resource
710
789
  elevasis-sdk knowledge:search <query> [--limit <n>] [--kinds <list>] [--json] [--ids-only]
711
790
  ```
712
791
 
713
- | Flag | Description |
714
- | ------------------ | ------------------------------------------------------------------------------ |
792
+ | Flag | Description |
793
+ | ---------------- | ------------------------------------------------------------------------------ |
715
794
  | `--limit <n>` | Max hits to return; `0` = unlimited. Default: 10 |
716
795
  | `--kinds <list>` | Comma-separated kinds filter: `system,resource,knowledge,ontology,role,policy` |
717
- | `--json` | Print wrapped JSON envelope `{ query, limit, kinds, count, results }` |
718
- | `--ids-only` | Print one ID per line (for piping) |
796
+ | `--json` | Print wrapped JSON envelope `{ query, limit, kinds, count, results }` |
797
+ | `--ids-only` | Print one ID per line (for piping) |
719
798
 
720
799
  **Examples:**
721
800
 
@@ -762,8 +841,8 @@ Generate Organization Model knowledge nodes from MDX source files. Alias: `om:ge
762
841
  elevasis-sdk knowledge:generate [--source <path>] [--output <path>] [--flags-output <path>]
763
842
  ```
764
843
 
765
- | Flag | Description |
766
- | ------------------------- | ----------------------------------------------------------------------------------------------------- |
844
+ | Flag | Description |
845
+ | ----------------------- | ----------------------------------------------------------------------------------------------------- |
767
846
  | `--source <path>` | MDX source directory relative to project root. Default: `core/config/knowledge/nodes` |
768
847
  | `--output <path>` | Generated TS file path relative to project root. Default: `core/config/knowledge/_generated/nodes.ts` |
769
848
  | `--flags-output <path>` | Generated knowledge flag registry path. Default: `.claude/registries/knowledge-flags.json` |
@@ -793,13 +872,13 @@ elevasis-sdk om:scaffold:fill --gaps tmp/conformance-gaps.json
793
872
 
794
873
  **Splice targets:**
795
874
 
796
- | Subcommand | Writes |
797
- | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
798
- | `om:scaffold:system` | Splices `core/config/organization-model/systems.ts` |
799
- | `om:scaffold:resource` | Splices `core/config/organization-model/systems.ts` -- **known-broken, see below** |
800
- | `om:scaffold:role` | Splices `core/config/organization-model/profile.ts` |
875
+ | Subcommand | Writes |
876
+ | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
877
+ | `om:scaffold:system` | Splices `core/config/organization-model/systems.ts` |
878
+ | `om:scaffold:resource` | Splices `core/config/organization-model/systems.ts` -- **known-broken, see below** |
879
+ | `om:scaffold:role` | Splices `core/config/organization-model/profile.ts` |
801
880
  | `om:scaffold:knowledge` | Writes a new `core/config/knowledge/nodes/<id>.mdx` file (no splice) |
802
- | `om:scaffold:ontology` | Print-only by design -- writes nothing, and carries no `--write` flag |
881
+ | `om:scaffold:ontology` | Print-only by design -- writes nothing, and carries no `--write` flag |
803
882
  | `om:scaffold:fill` | Writes new `core/config/organization-model/api-interfaces/<systemPath>.ts` const files and splices the import + field into `systems.ts` |
804
883
 
805
884
  **`om:scaffold:resource` is currently non-functional against all three real project layouts.** Its splice anchor never received the anchor-scoping fix that landed for `om:scaffold:role` on 2026-08-11, so it still searches for the resource-descriptors closing brace unscoped -- in a real file that closing-brace shape recurs, and it splices into the wrong one, producing invalid TypeScript. The command's own post-write validation catches this and rolls the file back, so it fails safely, but it does not currently produce a usable result. Do not rely on it until the anchor fix ships.
@@ -838,14 +917,14 @@ elevasis-sdk om:deprecate sales.crm --to archived --force --confirm archive:sale
838
917
 
839
918
  **`om:deprecate <systemPath>` flags:**
840
919
 
841
- | Flag | Description |
842
- | --------------------- | -------------------------------------------------------------------------- |
920
+ | Flag | Description |
921
+ | ------------------- | -------------------------------------------------------------------------- |
843
922
  | `--to <lifecycle>` | Target lifecycle: `deprecated` or `archived`. Default: `deprecated` |
844
- | `--dry-run` | Preview only (default) |
845
- | `--write` | Apply the lifecycle edit and run `om:doctor` |
846
- | `--force` | Allow archiving despite live dependents when paired with exact `--confirm` |
923
+ | `--dry-run` | Preview only (default) |
924
+ | `--write` | Apply the lifecycle edit and run `om:doctor` |
925
+ | `--force` | Allow archiving despite live dependents when paired with exact `--confirm` |
847
926
  | `--confirm <token>` | Exact archive confirmation token: `archive:<systemPath>` |
848
- | `--json` | Output JSON |
927
+ | `--json` | Output JSON |
849
928
 
850
929
  **Implementation:** `packages/sdk/src/cli/commands/om/rename.ts`, `packages/sdk/src/cli/commands/om/deprecate.ts` -- registered in `packages/sdk/src/cli/index.ts`
851
930
 
@@ -907,20 +986,20 @@ Matches the DB-backed namespaces documented above (`project:`, `client:`, `note:
907
986
  ### Reads
908
987
 
909
988
  ```bash
910
- elevasis-sdk content:list --status queued --pipeline-id short-form-repurpose
989
+ elevasis-sdk content:list --status <status> --pipeline-id <pipelineId>
911
990
  elevasis-sdk content:get <itemId>
912
991
  elevasis-sdk content:board <pipelineId> --pretty
913
992
  elevasis-sdk content:queue
914
993
  elevasis-sdk content:pipeline
915
994
  elevasis-sdk content:pipeline <pipelineId>
916
- elevasis-sdk content:distributions --pipeline-id short-form-repurpose
995
+ elevasis-sdk content:distributions --pipeline-id <pipelineId>
917
996
  elevasis-sdk content:source-assets --kind transcript
918
997
  elevasis-sdk content:source-asset <sourceAssetId>
919
998
  ```
920
999
 
921
1000
  - `content:list` -- list content items. Filters: `--status`, `--pillar`, `--pipeline-id`, `--client-id`, `--reviewed-by`, `--search` (matches title), `--limit`, `--offset`.
922
1001
  - `content:get <itemId>` -- one item plus its full attempt history and its distributions, in a single response. Each attempt carries a `sourceExecutionId`, so this call is the item's execution lineage in one hop -- feed any id straight into `elevasis-sdk execution` / `pnpm exec elevasis execution`.
923
- - `content:board <pipelineId>` -- one pipeline rendered as columns: each declared step in `order`, each card at the first step its `processingState` has not recorded as `success`, and a gate with a waiting count on every `live` or `queued` step. Two buckets sit outside the columns: `done` (every declared step succeeded) and `unplaced` (the item's `processingState` names only steps the pipeline no longer declares). Unplaced items are never folded into column 1, so a non-empty bucket is a real signal that the step catalog moved underneath live items. `--limit` defaults to 100, the API's page ceiling for this route, and the command reports a **partial** board rather than truncating silently when a pipeline holds more items than one page.
1002
+ - `content:board <pipelineId>` -- one pipeline rendered as columns: each declared step in `order`, each card at the first step its `processingState` has not recorded as `success`, and a gate with a waiting count on every step whose `reviewVenue` is not `none`. Each gate reports its venue -- `queue` or `workspace` -- so the board says where the review happens rather than only that one is owed. Two buckets sit outside the columns: `done` (every declared step succeeded) and `unplaced` (the item's `processingState` names only steps the pipeline no longer declares). Unplaced items are never folded into column 1, so a non-empty bucket is a real signal that the step catalog moved underneath live items. `--limit` defaults to 100, the API's page ceiling for this route, and the command reports a **partial** board rather than truncating silently when a pipeline holds more items than one page.
924
1003
  - `content:queue` -- items sitting on an open `queued`-gate review. Each row prints the item, the `stepKey` of the gate it is waiting on, and the attempt that opened it. This is the list `content:review` reads from -- see "Why `--step` is required" below.
925
1004
  - `content:pipeline [id]` -- with no id, lists pipeline templates; with an id, returns that pipeline's step contract (step keys and review modes). Read from the **deployed** Organization Model snapshot, not a local project model -- a model edit that has not been redeployed produces a stale-snapshot 503 that looks like a code bug.
926
1005
  - `content:distributions` -- list distribution rows (one per platform/format target per item). Filters: `--content-item-id`, `--pipeline-id`, `--platform`, `--status`, `--limit`, `--offset`.
@@ -943,16 +1022,16 @@ elevasis-sdk content:review <itemId> --step <key> (--approve | --reject) --user
943
1022
 
944
1023
  **Flags:**
945
1024
 
946
- | Flag | Description |
947
- | --------------------- | ----------------------------------------------------- |
1025
+ | Flag | Description |
1026
+ | ------------------- | ----------------------------------------------------- |
948
1027
  | `--step <key>` | Required. The `stepKey` of the `queued` gate to clear |
949
- | `--approve` | Approve the item at that step |
950
- | `--reject` | Reject the item at that step. Requires `--reason` |
1028
+ | `--approve` | Approve the item at that step |
1029
+ | `--reject` | Reject the item at that step. Requires `--reason` |
951
1030
  | `--user <email>` | Required. The acting reviewer's email |
952
1031
  | `--feedback <text>` | Optional reviewer feedback, recorded on the review |
953
1032
  | `--reason <text>` | Rejection reason. Required when `--reject` is used |
954
1033
  | `--api-url <url>` | Override the API base URL |
955
- | `--pretty` | Human-readable output instead of raw JSON |
1034
+ | `--pretty` | Human-readable output instead of raw JSON |
956
1035
 
957
1036
  `--approve` and `--reject` are mutually exclusive; exactly one is required.
958
1037
 
@@ -986,16 +1065,37 @@ no workaround.
986
1065
 
987
1066
  ```
988
1067
  elevasis-sdk content:source-asset:create --kind <kind> --title <title> (--text <value> | --url <url>)
989
- [--field <key>] [--duration <seconds>] [--item <itemId>]
1068
+ [--field <key>] [--duration <seconds>] [--storage-path <path>]
1069
+ [--metadata <json> | --metadata-file <path>] [--item <itemId>]
990
1070
  ```
991
1071
 
992
1072
  A source asset holds its content in one of two places, and the flags mirror that exactly: `--text` is
993
1073
  inline content and lands in `payload`, `--url` is a reference and lands in `externalUrl`. They are
994
1074
  mutually exclusive because an asset is one shape or the other.
995
1075
 
996
- **There is no file upload, deliberately.** `storage_path` on the table is written by nothing, and
997
- `/api/storage` has no external mirror. A file lives wherever it already lives and the asset points at
998
- it with `--url`.
1076
+ **There is still no file upload.** `--storage-path` records a path a caller already knows about (for
1077
+ example one written by a Dropbox intake flow elsewhere) -- it writes the `storage_path` column, the
1078
+ same column the worker adapter's `content.createSourceAsset` already sets freely, but it does not write
1079
+ bytes to storage itself. `/api/storage` has no external mirror. A file lives wherever it already lives;
1080
+ this flag just lets the CLI-created asset point at it, alongside or instead of `--url`.
1081
+
1082
+ **Flags:**
1083
+
1084
+ | Flag | Description |
1085
+ | ------------------------ | ------------------------------------------------------------------------------------- |
1086
+ | `--kind <kind>` | Required. Source asset kind, validated against the org model catalog |
1087
+ | `--title <title>` | Required. Human-readable title (1-500 chars) |
1088
+ | `--text <value>` | Inline text, or `@path` to read a local file. Mutually exclusive with `--url` |
1089
+ | `--field <key>` | Payload field the `--text` content is written to (default: the `--kind` value) |
1090
+ | `--url <url>` | External URL the asset references. Mutually exclusive with `--text` |
1091
+ | `--duration <seconds>` | Duration in seconds, for time-based referenced media |
1092
+ | `--storage-path <path>` | Storage path the asset references (1-2000 chars) |
1093
+ | `--metadata <json>` | Arbitrary metadata as a JSON object string. Mutually exclusive with `--metadata-file` |
1094
+ | `--metadata-file <path>` | Path to a JSON file containing metadata. Mutually exclusive with `--metadata` |
1095
+ | `--item <itemId>` | Link the new asset to this content item after creating it |
1096
+ | `--prod` | Target production (overrides `NODE_ENV=development`) |
1097
+ | `--api-url <url>` | Override the API base URL |
1098
+ | `--pretty` | Human-readable output instead of raw JSON |
999
1099
 
1000
1100
  **`--text` accepts `@path` to read a local file**, the same convention as `exec --input`. Anything not
1001
1101
  starting with `@` is the literal value. The CLI refuses content over 500KB locally rather than sending
@@ -1036,29 +1136,74 @@ delete for a source asset: correct a bad one by creating a replacement and re-li
1036
1136
 
1037
1137
  ---
1038
1138
 
1139
+ ## elevasis-sdk grant:\*
1140
+
1141
+ Manage public and code-gated agent access grants -- the surface that exposes a deployed agent at a shareable public URL (`/public/agents/<slug>`) without requiring a signed-in Command Center user.
1142
+
1143
+ ```bash
1144
+ elevasis-sdk grant:list
1145
+ elevasis-sdk grant:create --resource <resourceId> [--slug <slug>] [--mode public|code] [--code <code>]
1146
+ elevasis-sdk grant:update <slug> [--mode public|code] [--max-turns <n>] [--branding <json>]
1147
+ elevasis-sdk grant:disable <slug>
1148
+ ```
1149
+
1150
+ - `grant:list` -- list grants; `--resource-id` filters to one agent, `--include-disabled` includes disabled grants
1151
+ - `grant:create` -- create a grant for `--resource`; `--slug` defaults to a normalized form of the resource ID; `--mode code` requires `--code`
1152
+ - `grant:update <slug>` -- update mutable fields (mode, code, origins, expiry, limits, branding, capture fields, tool policy); at least one field is required
1153
+ - `grant:disable <slug>` -- disable a grant without deleting it (there is no `grant:delete` or `grant:enable`)
1154
+
1155
+ **Flags:**
1156
+
1157
+ | Flag | Description |
1158
+ | ------------------------- | -------------------------------------------------------------- |
1159
+ | `--resource <id>` | Agent resource ID to expose (create: required) |
1160
+ | `--slug <slug>` | Public slug; defaults to a normalized `--resource` |
1161
+ | `--mode <mode>` | Access mode: `public` (default) or `code` |
1162
+ | `--code <code>` | Access code, required when `--mode code` |
1163
+ | `--origins <origins>` | Comma-separated allowed origins; omit for any origin |
1164
+ | `--expires-at <iso>` | ISO timestamp when the grant expires |
1165
+ | `--max-turns <number>` | Maximum turns per public session |
1166
+ | `--max-sessions <number>` | Maximum sessions per visitor |
1167
+ | `--branding <json>` | Branding metadata JSON object |
1168
+ | `--capture-fields <json>` | Capture fields JSON array |
1169
+ | `--tool-policy <json>` | Tool policy JSON object |
1170
+ | `--public-base-url <url>` | Base URL used to print the full public URL alongside the grant |
1171
+ | `--resource-id <id>` | Filter by agent resource ID (list only) |
1172
+ | `--include-disabled` | Include disabled grants (list only) |
1173
+ | `--prod` | Target production (overrides `NODE_ENV=development`) |
1174
+ | `--api-url <url>` | Override the API base URL |
1175
+ | `--json` | Output as JSON |
1176
+
1177
+ **API routes:** `GET /api/external/agent-access-grants`, `POST /api/external/agent-access-grants`, `PATCH /api/external/agent-access-grants/:slug`, `POST /api/external/agent-access-grants/:slug/disable`.
1178
+
1179
+ **Implementation:** `packages/sdk/src/cli/commands/grant/`
1180
+
1181
+ ---
1182
+
1039
1183
  ## Appendix: Domain Status
1040
1184
 
1041
1185
  Current status of all SDK CLI domains. Domains marked `deferred` have no CLI commands yet.
1042
1186
 
1043
- | Domain | CLI surface | API surface | Status |
1044
- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | ----------------------------------------------------------- |
1045
- | platform | top-level SDK commands | mixed platform APIs | implemented |
1046
- | project | `project:*` | `apps/api/src/projects/` | implemented |
1047
- | knowledge | `knowledge:*` | file/generated knowledge data | implemented |
1048
- | creds | `creds *` nested Commander group | credentials API | implemented |
1049
- | ui | `ui:*` | local project file edits | implemented |
1050
- | request | `request:submit`, `request:list`, `request:get`, `request:update`, `request:delete` | requests API | implemented read/write scope |
1051
- | error | `error resolve`, `error resolve-execution` | execution error APIs | partial |
1052
- | acquisition | `acquisition:list:*`, `acquisition:deal:*` | `/api/external/acquisition/lists*`, `/api/external/deals*` | implemented read-only scope |
1053
- | client | `client:*` | `/api/external/clients` | implemented read/write scope |
1054
- | agent | `agent:list`, `agent:get` | `/api/external/agents*` | implemented read-only scope |
1055
- | session | `session:create`, `session:turn`, `session:messages`, `session:list`, `session:get`, `session:end` | `/api/external/sessions*` | implemented multi-turn scope |
1056
- | queue | `queue:list`, `queue:get`, `queue:select`, `queue:expire`, `queue:status` | `/api/external/command-queue*` | implemented |
1057
- | schedule | `schedule:list`, `schedule:get`, `schedule:create`, `schedule:update` | `/api/external/task-scheduler/schedules*` | implemented |
1058
- | skill | `skill:scaffold`, `skill:check-coverage` | local CLI catalog and `.claude/registries/skill-coverage.json` | implemented developer tooling |
1059
- | content | `content:list`, `content:get`, `content:board`, `content:queue`, `content:pipeline`, `content:distributions`, `content:review`, `content:source-assets`, `content:source-asset`, `content:source-asset:create` | `/api/external/content*` | implemented read + review-write + source-asset-create scope |
1060
- | seo | none | not scoped here | deferred |
1061
- | monitoring | none | not scoped here | deferred |
1187
+ | Domain | CLI surface | API surface | Status |
1188
+ | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------------------------- |
1189
+ | platform | top-level SDK commands | mixed platform APIs | implemented |
1190
+ | project | `project:*` | `apps/api/src/projects/` | implemented |
1191
+ | knowledge | `knowledge:*` | file/generated knowledge data | implemented |
1192
+ | creds | `creds *` nested Commander group | credentials API | implemented |
1193
+ | ui | `ui:*` | local project file edits | implemented |
1194
+ | request | `request:submit`, `request:list`, `request:get`, `request:update`, `request:delete` | requests API | implemented read/write scope |
1195
+ | error | `error resolve`, `error resolve-execution` | execution error APIs | partial |
1196
+ | acquisition | `acquisition:list:*`, `acquisition:deal:*` | `/api/external/acquisition/lists*`, `/api/external/deals*` | implemented read-only scope |
1197
+ | client | `client:*` | `/api/external/clients` | implemented read/write scope |
1198
+ | agent | `agent:list`, `agent:get` | `/api/external/resources` (filtered), `/api/external/resources/:id/definition` | implemented read-only scope |
1199
+ | session | `session:create`, `session:turn`, `session:messages`, `session:list`, `session:get`, `session:end` | `/api/external/sessions*` | implemented multi-turn scope |
1200
+ | queue | `queue:list`, `queue:get`, `queue:select`, `queue:expire`, `queue:status` | `/api/external/command-queue*` | implemented |
1201
+ | schedule | `schedule:list`, `schedule:get`, `schedule:create`, `schedule:update`, `schedule:pause`, `schedule:resume`, `schedule:cancel` | `/api/external/task-scheduler/schedules*` | implemented |
1202
+ | skill | `skill:scaffold`, `skill:check-coverage` | local CLI catalog and `.claude/registries/skill-coverage.json` | implemented developer tooling |
1203
+ | content | `content:list`, `content:get`, `content:board`, `content:queue`, `content:pipeline`, `content:distributions`, `content:review`, `content:source-assets`, `content:source-asset`, `content:source-asset:create` | `/api/external/content*` | implemented read + review-write + source-asset-create scope |
1204
+ | grant | `grant:list`, `grant:create`, `grant:update`, `grant:disable` | `/api/external/agent-access-grants*` | implemented read/write scope |
1205
+ | seo | none | not scoped here | deferred |
1206
+ | monitoring | none | not scoped here | deferred |
1062
1207
 
1063
1208
  ### Promotion Criteria
1064
1209
 
@@ -1071,4 +1216,4 @@ A domain should meet all four criteria before gaining a `*:list` / `*:get` surfa
1071
1216
 
1072
1217
  ---
1073
1218
 
1074
- **Last Updated:** 2026-08-14
1219
+ **Last Updated:** 2026-08-17