@elevasis/sdk 1.48.0 → 1.50.0

package/dist/cli.cjs

@@ -22654,44 +22654,64 @@ var init_ontology = __esm({
     }).passthrough();
     OntologyObjectTypeSchema = OntologyRecordBaseSchema.extend({
       properties: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional(),
-      storage: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-    });
+      storage: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+      // Carried by the legacy entity projection (`addLegacyEntityProjections`); not
+      // authored directly, but a real key an authored record must not collide with.
+      rowSchema: external_exports.string().trim().min(1).optional(),
+      stateCatalogId: external_exports.string().trim().min(1).optional()
+    }).strict();
     OntologyLinkTypeSchema = OntologyRecordBaseSchema.extend({
       from: OntologyIdSchema,
       to: OntologyIdSchema,
       cardinality: external_exports.string().trim().min(1).max(80).optional(),
       via: external_exports.string().trim().min(1).max(255).optional()
-    });
+    }).strict();
     OntologyActionTypeSchema = OntologyRecordBaseSchema.extend({
       actsOn: OntologyReferenceListSchema,
       input: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional(),
-      effects: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).optional()
-    });
+      effects: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).optional(),
+      resourceId: external_exports.string().trim().min(1).optional(),
+      invocations: external_exports.array(external_exports.unknown()).optional(),
+      lifecycle: external_exports.string().trim().min(1).optional(),
+      // Carried by the legacy action projection (`addLegacyActionProjections`); not
+      // authored directly, but a real key an authored record must not collide with.
+      legacyActionId: external_exports.string().trim().min(1).optional()
+    }).strict();
     OntologyCatalogTypeSchema = OntologyRecordBaseSchema.extend({
       kind: external_exports.string().trim().min(1).max(120).optional(),
       appliesTo: OntologyIdSchema.optional(),
-      entries: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional()
-    });
+      entries: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional(),
+      // Carried by lead-gen's legacy stage-catalog projection
+      // (`createLeadGenStageCatalog`); not authored directly, but a real key an
+      // authored record must not collide with.
+      legacyCatalogKey: external_exports.string().trim().min(1).optional(),
+      // Carried in live tenant configs (Elevasis, `nirvana-marketing`, and the
+      // `_template` scaffold all author these on `sales.crm:catalog/crm.pipeline`)
+      // as a cross-reference to the pre-ontology CRM pipeline key/entity id. No
+      // code currently reads them back — do not silently normalize them away.
+      legacyPipelineKey: external_exports.string().trim().min(1).optional(),
+      legacyEntityKey: external_exports.string().trim().min(1).optional()
+    }).strict();
     OntologyEventTypeSchema = OntologyRecordBaseSchema.extend({
       payload: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional()
-    });
+    }).strict();
     OntologyInterfaceTypeSchema = OntologyRecordBaseSchema.extend({
       properties: external_exports.record(external_exports.string().trim().min(1).max(200), external_exports.unknown()).optional()
-    });
+    }).strict();
     OntologyValueTypeSchema = OntologyRecordBaseSchema.extend({
       primitive: external_exports.string().trim().min(1).max(120).optional()
-    });
+    }).strict();
     OntologySharedPropertySchema = OntologyRecordBaseSchema.extend({
       valueType: OntologyIdSchema.optional(),
       searchable: external_exports.boolean().optional(),
       pii: external_exports.boolean().optional()
-    });
+    }).strict();
     OntologyGroupSchema = OntologyRecordBaseSchema.extend({
       members: OntologyReferenceListSchema
-    });
+    }).strict();
     OntologyEndpointTypeSchema = OntologyRecordBaseSchema.extend({
       route: external_exports.string().trim().min(1).max(500).optional()
-    });
+    }).strict();
     OntologyScopeSchema = external_exports.object({
       objectTypes: external_exports.record(OntologyIdSchema, OntologyObjectTypeSchema).default({}).optional(),
       linkTypes: external_exports.record(OntologyIdSchema, OntologyLinkTypeSchema).default({}).optional(),
@@ -23550,6 +23570,10 @@ var init_profile_registry = __esm({
 });
 
 // ../core/src/organization-model/domains/systems.ts
+function isSystemLifecycleVisible(lifecycle, enabled) {
+  if (enabled === false) return false;
+  return lifecycle !== "draft" && lifecycle !== "deprecated" && lifecycle !== "archived";
+}
 function isReservedPlatformProfileId(profileId) {
   return BUILT_IN_VALIDATED_PROFILE_IDS.includes(profileId);
 }
@@ -23566,7 +23590,10 @@ var init_systems = __esm({
     init_ontology();
     init_profile_registry();
     SystemKindSchema = external_exports.enum(["product", "operational", "platform", "diagnostic"]).meta({ label: "System kind", color: "blue" });
-    SystemLifecycleSchema = external_exports.enum(["draft", "beta", "active", "deprecated", "archived"]).meta({ label: "Lifecycle", color: "teal" });
+    SystemLifecycleSchema = external_exports.enum(["draft", "beta", "active", "deprecated", "archived"]).meta({
+      label: "Lifecycle",
+      color: "teal"
+    });
     SystemIdSchema = ModelIdSchema;
     SystemPathSchema = external_exports.string().trim().min(1).regex(
       /^[a-z0-9][a-z0-9-]*(?:\.[a-z0-9][a-z0-9-]*)*$/,
@@ -23686,8 +23713,13 @@ var init_systems = __esm({
       parentSystemId: SystemIdSchema.optional(),
       /** Optional UI presence. Systems without UI omit this. */
       ui: SystemUiSchema.optional(),
-      /** Canonical lifecycle state. `beta` is what gates a System to dev-mode viewers. */
-      lifecycle: SystemLifecycleSchema.optional(),
+      /**
+       * Canonical lifecycle state. `beta` is what gates a System to dev-mode
+       * viewers. Defaults to `active` (not `.optional()`) so an omitted field
+       * never reaches a consumer as `undefined` -- see `isSystemLifecycleVisible`
+       * and `systemLifecycleAllowsAccess` above.
+       */
+      lifecycle: SystemLifecycleSchema.default("active"),
       /** Optional role responsible for this system. */
       responsibleRoleId: ModelIdSchema.meta({ ref: "role" }).optional(),
       /** Optional knowledge nodes that govern this system. */
@@ -24209,10 +24241,6 @@ function addIssue(ctx, path3, message) {
     message
   });
 }
-function isLifecycleEnabled(lifecycle, enabled) {
-  if (enabled === false) return false;
-  return lifecycle !== "deprecated" && lifecycle !== "archived";
-}
 function defaultSystemPathFor(id) {
   return `/${id.replaceAll(".", "/")}`;
 }
@@ -24283,11 +24311,11 @@ function refineOrganizationModel(model, ctx) {
         systemIdsByEffectivePath.set(effectivePath, path3);
       }
     }
-    if (hasChildren && isLifecycleEnabled(system.lifecycle, system.enabled)) {
+    if (hasChildren && isSystemLifecycleVisible(system.lifecycle, system.enabled)) {
       const hasEnabledDescendant = Object.values(system.systems ?? system.subsystems ?? {}).some(
-        (candidate) => isLifecycleEnabled(candidate.lifecycle, candidate.enabled)
+        (candidate) => isSystemLifecycleVisible(candidate.lifecycle, candidate.enabled)
       ) || allSystems.some(
-        (candidate) => candidate.path.startsWith(`${path3}.`) && !candidate.path.slice(path3.length + 1).includes(".") && isLifecycleEnabled(candidate.system.lifecycle, candidate.system.enabled)
+        (candidate) => candidate.path.startsWith(`${path3}.`) && !candidate.path.slice(path3.length + 1).includes(".") && isSystemLifecycleVisible(candidate.system.lifecycle, candidate.system.enabled)
       );
       if (!hasEnabledDescendant) {
         addIssue(ctx, [...schemaPath, "lifecycle"], `System "${path3}" is active but has no active descendants`);
@@ -24702,6 +24730,7 @@ var init_schema_refinements = __esm({
     "use strict";
     init_zod();
     init_resources();
+    init_systems();
     init_cross_ref();
     init_ontology();
   }
@@ -25034,8 +25063,8 @@ var init_content = __esm({
   "../core/src/organization-model/catalogs/content.ts"() {
     "use strict";
     init_zod();
-    ContentPipelineStepActorSchema = external_exports.enum(["workflow", "agent", "vendor"]);
-    ContentPipelineStepReviewModeSchema = external_exports.enum(["live", "queued", "none"]);
+    ContentPipelineStepActorSchema = external_exports.enum(["workflow", "agent", "vendor", "human"]);
+    ContentPipelineStepReviewModeSchema = external_exports.enum(["none", "required"]);
     ContentPayloadFieldTypeSchema = external_exports.enum(["string", "text", "number", "boolean", "url", "string-array"]);
     ContentPayloadFieldDeclarationSchema = external_exports.object({
       key: external_exports.string().trim().min(1).max(200),
@@ -26271,6 +26300,63 @@ var init_lead_gen = __esm({
   }
 });
 
+// ../core/src/organization-model/catalogs/content-producer-factory.ts
+var init_content_producer_factory = __esm({
+  "../core/src/organization-model/catalogs/content-producer-factory.ts"() {
+    "use strict";
+  }
+});
+
+// ../core/src/organization-model/catalogs/define-content-pipeline.ts
+var init_define_content_pipeline = __esm({
+  "../core/src/organization-model/catalogs/define-content-pipeline.ts"() {
+    "use strict";
+  }
+});
+
+// ../core/src/organization-model/catalogs/define-system-api-interface.ts
+function formatAdoptableProfiles() {
+  return SYSTEM_INTERFACE_PROFILES.map((profile) => `"${profile.readinessProfile}"`).join(", ");
+}
+function defineSystemApiInterface(input) {
+  const interfaceKey = input.interfaceKey ?? "api";
+  const identity = `${input.systemPath}/${interfaceKey}`;
+  const catalogEntry = SYSTEM_INTERFACE_PROFILES.find((profile) => profile.readinessProfile === input.readinessProfile);
+  if (catalogEntry === void 0) {
+    throw new Error(
+      `System Interface "${identity}" declares readinessProfile "${input.readinessProfile}", which is not a member of SYSTEM_INTERFACE_PROFILES. Adoptable profiles: ${formatAdoptableProfiles()}. An uncataloged id names no route platform code actually serves -- it computes as ready and answers every request with a 503. Add an entry to SYSTEM_INTERFACE_PROFILES (packages/core/src/organization-model/domains/systems.ts) before declaring it on System "${input.systemPath}", or use one of the ids above.`
+    );
+  }
+  if (input.resourceIds.length === 0) {
+    throw new Error(
+      `System Interface "${identity}" declares an empty resourceIds list. An interface with no scoped active resource computes as ready and answers every route with a 503 -- scope at least one active resource for System "${input.systemPath}".`
+    );
+  }
+  const isBuiltIn = catalogEntry.validation === "built-in";
+  if (!isBuiltIn && input.readinessContract === void 0) {
+    throw new Error(
+      `System Interface "${identity}" adopts contract-validated profile "${input.readinessProfile}" but declares no readinessContract. Contract-validated profiles have no registered platform validator -- each adopter's structural requirements differ, so System "${input.systemPath}" must pass a readinessContract with at least one requiredCatalogs entry.`
+    );
+  }
+  if (isBuiltIn && input.readinessContract !== void 0) {
+    throw new Error(
+      `System Interface "${identity}" declares a readinessContract against built-in profile "${input.readinessProfile}". Built-in profiles derive their requirements from platform code registered via registerBuiltInReadinessProfile, and the readiness engine never reads an authored contract against one -- it is silently ignored (the "else if (readinessContract)" branch in readiness/engine.ts is unreachable for a built-in profile). Delete the readinessContract on System "${input.systemPath}"; it asserts nothing today.`
+    );
+  }
+  return {
+    lifecycle: input.lifecycle ?? "active",
+    readinessProfile: input.readinessProfile,
+    resourceIds: input.resourceIds,
+    ...input.readinessContract !== void 0 ? { readinessContract: input.readinessContract } : {}
+  };
+}
+var init_define_system_api_interface = __esm({
+  "../core/src/organization-model/catalogs/define-system-api-interface.ts"() {
+    "use strict";
+    init_systems();
+  }
+});
+
 // ../core/src/organization-model/readiness/engine.ts
 function addReadinessIssue(issues, family, code, message, details = {}) {
   issues.push({
@@ -26611,6 +26697,9 @@ var init_organization_model = __esm({
     init_graph();
     init_lead_gen();
     init_content();
+    init_content_producer_factory();
+    init_define_content_pipeline();
+    init_define_system_api_interface();
     init_branding();
     init_systems();
     init_resources();
@@ -44095,7 +44184,7 @@ function getModelInfo(model) {
     return MODEL_INFO[model];
   }
   for (const knownModel of MODEL_KEYS_BY_SPECIFICITY) {
-    if (model.startsWith(knownModel)) {
+    if (model.startsWith(`${knownModel}-`)) {
       return MODEL_INFO[knownModel];
     }
   }
@@ -44121,7 +44210,7 @@ function validateModelConfig(config3) {
     throw new ModelConfigError(`Invalid config for ${model}: ${firstError.message}`, fieldName, model);
   }
 }
-var GPT5OptionsSchema, GPT5ConfigSchema, MockConfigSchema, OpenRouterOptionsSchema, OpenRouterConfigSchema, AnthropicOptionsSchema, AnthropicStandardConfigSchema, AnthropicClaude5ConfigSchema, AnthropicConfigSchema, MODEL_INFO, MODEL_KEYS_BY_SPECIFICITY;
+var GPT5OptionsSchema, GPT5ConfigSchema, GPT56OptionsSchema, GPT56ConfigSchema, MockConfigSchema, OpenRouterOptionsSchema, OpenRouterConfigSchema, AnthropicOptionsSchema, AnthropicStandardConfigSchema, AnthropicClaude5ConfigSchema, AnthropicConfigSchema, GPT56_CACHE_READ_RATE_MULTIPLIER, CACHE_CREATION_RATE_MULTIPLIER, MODEL_INFO, MODEL_KEYS_BY_SPECIFICITY;
 var init_model_info = __esm({
   "../core/src/execution/engine/llm/model-info.ts"() {
     "use strict";
@@ -44141,6 +44230,19 @@ var init_model_info = __esm({
       topP: external_exports.number().min(0).max(1).optional(),
       modelOptions: GPT5OptionsSchema.optional()
     });
+    GPT56OptionsSchema = external_exports.object({
+      reasoning_effort: external_exports.enum(["none", "low", "medium", "high", "xhigh", "max"]).optional(),
+      verbosity: external_exports.enum(["low", "medium", "high"]).optional()
+    });
+    GPT56ConfigSchema = external_exports.object({
+      model: external_exports.enum(["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"]),
+      provider: external_exports.enum(["openai"]),
+      apiKey: external_exports.string(),
+      temperature: external_exports.literal(1).optional(),
+      maxOutputTokens: external_exports.number().min(4e3).optional(),
+      topP: external_exports.number().min(0).max(1).optional(),
+      modelOptions: GPT56OptionsSchema.optional()
+    });
     MockConfigSchema = external_exports.object({
       model: external_exports.enum(["mock"]),
       provider: external_exports.enum(["mock"]),
@@ -44193,9 +44295,12 @@ var init_model_info = __esm({
       AnthropicClaude5ConfigSchema,
       AnthropicStandardConfigSchema
     ]);
+    GPT56_CACHE_READ_RATE_MULTIPLIER = 0.1;
+    CACHE_CREATION_RATE_MULTIPLIER = 1.25;
     MODEL_INFO = {
       // OpenAI GPT-5 (Reasoning Models)
       "gpt-5": {
+        provider: "openai",
         inputCostPer1M: 125,
         // $1.25 per 1M tokens
         outputCostPer1M: 1e3,
@@ -44209,6 +44314,7 @@ var init_model_info = __esm({
         configSchema: GPT5ConfigSchema
       },
       "gpt-5.4-mini": {
+        provider: "openai",
         inputCostPer1M: 75,
         // $0.75 per 1M tokens
         outputCostPer1M: 450,
@@ -44222,6 +44328,7 @@ var init_model_info = __esm({
         configSchema: GPT5ConfigSchema
       },
       "gpt-5.4-nano": {
+        provider: "openai",
         inputCostPer1M: 20,
         // $0.20 per 1M tokens
         outputCostPer1M: 125,
@@ -44233,8 +44340,60 @@ var init_model_info = __esm({
         category: "standard",
         configSchema: GPT5ConfigSchema
       },
+      // OpenAI GPT-5.6 family (GA 2026-07-09). All three tiers share 1.05M context, 128K max output,
+      // image input, tool use, structured outputs, and prompt caching -- they differ in reasoning depth
+      // and price, not capability. The bare `gpt-5.6` alias is deliberately unregistered; see OpenAIModel.
+      "gpt-5.6-sol": {
+        provider: "openai",
+        inputCostPer1M: 500,
+        // $5.00 per 1M tokens
+        outputCostPer1M: 3e3,
+        // $30.00 per 1M tokens
+        minTokens: 4e3,
+        recommendedTokens: 8e3,
+        maxTokens: 105e4,
+        // 1.05M context window
+        maxOutputTokens: 128e3,
+        category: "reasoning",
+        configSchema: GPT56ConfigSchema,
+        cacheReadRateMultiplier: GPT56_CACHE_READ_RATE_MULTIPLIER,
+        cacheCreationRateMultiplier: CACHE_CREATION_RATE_MULTIPLIER
+      },
+      "gpt-5.6-terra": {
+        provider: "openai",
+        inputCostPer1M: 250,
+        // $2.50 per 1M tokens
+        outputCostPer1M: 1500,
+        // $15.00 per 1M tokens
+        minTokens: 4e3,
+        recommendedTokens: 8e3,
+        maxTokens: 105e4,
+        // 1.05M context window
+        maxOutputTokens: 128e3,
+        category: "standard",
+        configSchema: GPT56ConfigSchema,
+        cacheReadRateMultiplier: GPT56_CACHE_READ_RATE_MULTIPLIER,
+        cacheCreationRateMultiplier: CACHE_CREATION_RATE_MULTIPLIER
+      },
+      "gpt-5.6-luna": {
+        provider: "openai",
+        inputCostPer1M: 100,
+        // $1.00 per 1M tokens
+        outputCostPer1M: 600,
+        // $6.00 per 1M tokens
+        minTokens: 4e3,
+        recommendedTokens: 8e3,
+        maxTokens: 105e4,
+        // 1.05M context window
+        maxOutputTokens: 128e3,
+        category: "standard",
+        configSchema: GPT56ConfigSchema,
+        cacheReadRateMultiplier: GPT56_CACHE_READ_RATE_MULTIPLIER,
+        cacheCreationRateMultiplier: CACHE_CREATION_RATE_MULTIPLIER
+      },
       // Mock model for testing
       mock: {
+        provider: "mock",
         inputCostPer1M: 0,
         // Free for tests
         outputCostPer1M: 0,
@@ -44248,6 +44407,7 @@ var init_model_info = __esm({
       },
       // OpenRouter Models (via openrouter.ai)
       "openrouter/z-ai/glm-5": {
+        provider: "openrouter",
         inputCostPer1M: 72,
         // $0.72 per 1M tokens
         outputCostPer1M: 230,
@@ -44261,6 +44421,7 @@ var init_model_info = __esm({
       },
       // Anthropic Claude Models (direct SDK access via @anthropic-ai/sdk)
       "claude-opus-5": {
+        provider: "anthropic",
         inputCostPer1M: 500,
         // $5.00 per 1M tokens
         outputCostPer1M: 2500,
@@ -44274,6 +44435,7 @@ var init_model_info = __esm({
         configSchema: AnthropicConfigSchema
       },
       "claude-sonnet-5": {
+        provider: "anthropic",
         // List pricing. An introductory rate of $2.00/$10.00 runs through 2026-08-31; encoding the
         // temporary rate would make historical cost analytics wrong once it lapses.
         inputCostPer1M: 300,
@@ -44289,6 +44451,7 @@ var init_model_info = __esm({
         configSchema: AnthropicConfigSchema
       },
       "claude-haiku-4-5-20251001": {
+        provider: "anthropic",
         inputCostPer1M: 100,
         // $1.00 per 1M tokens
         outputCostPer1M: 500,
@@ -44302,6 +44465,7 @@ var init_model_info = __esm({
         configSchema: AnthropicConfigSchema
       },
       "claude-haiku-4-5": {
+        provider: "anthropic",
         inputCostPer1M: 100,
         // $1.00 per 1M tokens
         outputCostPer1M: 500,
@@ -44690,6 +44854,138 @@ var init_response_schema = __esm({
   }
 });
 
+// ../core/src/execution/engine/workflow/types.ts
+var StepType;
+var init_types5 = __esm({
+  "../core/src/execution/engine/workflow/types.ts"() {
+    "use strict";
+    StepType = {
+      LINEAR: "linear",
+      CONDITIONAL: "conditional"
+    };
+  }
+});
+
+// ../core/src/execution/engine/workflow/errors.ts
+var WorkflowStepError, WorkflowValidationError;
+var init_errors5 = __esm({
+  "../core/src/execution/engine/workflow/errors.ts"() {
+    "use strict";
+    init_errors3();
+    WorkflowStepError = class extends ExecutionError {
+      type = "workflow_step_error";
+      severity = "critical";
+      category = "workflow";
+      /**
+       * @param cause - The error the step actually threw. Kept so the original stack and any
+       *   non-`ExecutionError` throw survive the wrap; its classification is additionally copied into
+       *   `context` by the caller, because `type`/`severity`/`category` are fixed on this class.
+       */
+      constructor(message, context, cause) {
+        super(message, context);
+        if (cause !== void 0) this.cause = cause;
+      }
+    };
+    WorkflowValidationError = class extends ExecutionError {
+      type = "workflow_validation_error";
+      severity = "info";
+      category = "validation";
+      constructor(message, context) {
+        super(message, context);
+      }
+    };
+  }
+});
+
+// ../core/src/execution/engine/workflow/utils.ts
+function validateEntryPoint(steps, entryPoint) {
+  if (!(entryPoint in steps)) {
+    throw new WorkflowValidationError(`Entry point step '${entryPoint}' not found in workflow`, {
+      entryPoint
+    });
+  }
+}
+function findTerminalSteps(steps) {
+  return Object.values(steps).filter((step) => step.next === null);
+}
+function validateTerminalSteps(steps, workflowId) {
+  const terminalSteps = findTerminalSteps(steps);
+  if (terminalSteps.length === 0) {
+    throw new WorkflowValidationError(`Workflow '${workflowId}' must have at least one terminal step (next: null)`, {
+      workflowId
+    });
+  }
+}
+function validateStepReferences(steps) {
+  for (const [id, step] of Object.entries(steps)) {
+    if (step.next === null) {
+      continue;
+    }
+    if (step.next.type === StepType.LINEAR) {
+      if (!(step.next.target in steps)) {
+        throw new WorkflowValidationError(`Step '${id}' references non-existent target '${step.next.target}'`, {
+          stepId: id,
+          target: step.next.target
+        });
+      }
+    } else if (step.next.type === StepType.CONDITIONAL) {
+      const targets = [...step.next.routes.map((r) => r.target), step.next.default];
+      for (const target of targets) {
+        if (!(target in steps)) {
+          throw new WorkflowValidationError(`Step '${id}' references non-existent target '${target}'`, {
+            stepId: id,
+            target
+          });
+        }
+      }
+    }
+  }
+}
+function detectCycle(visited, executionPath, currentStepId) {
+  if (visited.has(currentStepId)) {
+    const cycle = executionPath.slice(executionPath.indexOf(currentStepId));
+    throw new WorkflowStepError(`Cycle detected in workflow: ${cycle.join(" -> ")} -> ${currentStepId}`, {
+      stepId: currentStepId,
+      cycle: [...cycle, currentStepId]
+    });
+  }
+}
+function validateWorkflowGraph(steps, entryPoint, workflowId) {
+  const onPath = /* @__PURE__ */ new Set();
+  const executionPath = [];
+  const reached = /* @__PURE__ */ new Set();
+  const walk = (stepId) => {
+    detectCycle(onPath, executionPath, stepId);
+    onPath.add(stepId);
+    executionPath.push(stepId);
+    reached.add(stepId);
+    const step = steps[stepId];
+    if (step && step.next !== null) {
+      const targets = step.next.type === StepType.LINEAR ? [step.next.target] : [...step.next.routes.map((route) => route.target), step.next.default];
+      for (const target of targets) {
+        if (target in steps) walk(target);
+      }
+    }
+    executionPath.pop();
+    onPath.delete(stepId);
+  };
+  if (entryPoint in steps) walk(entryPoint);
+  const orphanIds = Object.keys(steps).filter((id) => !reached.has(id));
+  if (orphanIds.length > 0) {
+    throw new WorkflowValidationError(
+      `Workflow '${workflowId}' has step(s) unreachable from entry point '${entryPoint}': ${orphanIds.join(", ")}`,
+      { workflowId, entryPoint, orphanIds }
+    );
+  }
+}
+var init_utils3 = __esm({
+  "../core/src/execution/engine/workflow/utils.ts"() {
+    "use strict";
+    init_types5();
+    init_errors5();
+  }
+});
+
 // ../core/src/platform/registry/validation.ts
 function getResourceValidatorMode(explicitMode) {
   if (explicitMode) return explicitMode;
@@ -44708,7 +45004,14 @@ function emitGovernanceIssues(issues, mode, onWarning) {
   if (issues.length === 0) return;
   if (mode === "strict") {
     const first = issues[0];
-    throw new RegistryValidationError(first.orgName, first.resourceId, "organizationModel.resources", first.message);
+    const messages = issues.map((issue2) => issue2.message);
+    throw new RegistryValidationError(
+      first.orgName,
+      first.resourceId,
+      "organizationModel.resources",
+      messages.join("\n"),
+      messages
+    );
   }
   const warn2 = onWarning ?? ((issue2) => console.warn(issue2.message));
   for (const issue2 of issues) {
@@ -44869,7 +45172,7 @@ function addTopologyIssues(issues, orgName, deployment, organizationModel, syste
     if (ref.kind === "humanCheckpoint") return humanCheckpointIds.has(ref.id);
     if (ref.kind === "externalResource") return externalResourceIds.has(ref.id);
     if (ref.kind === "ontology") {
-      if (ontologyIndex === void 0) return true;
+      if (ontologyIndex === void 0) return false;
       return Object.values(ontologyIndex).some((records) => records[ref.id] !== void 0);
     }
     return false;
@@ -45034,7 +45337,7 @@ function detectMissingApiInterfaceDeclarations(orgName, organizationModel) {
   for (const resource of Object.values(organizationModel.resources ?? {})) {
     const ontology = resource.ontology;
     if (ontology === void 0) continue;
-    const hasOntologyBindings = ontology.actions !== void 0 && ontology.actions.length > 0 || ontology.writes !== void 0 && ontology.writes.length > 0;
+    const hasOntologyBindings = ontology.actions !== void 0 && ontology.actions.length > 0 || ontology.writes !== void 0 && ontology.writes.length > 0 || ontology.reads !== void 0 && ontology.reads.length > 0 || ontology.usesCatalogs !== void 0 && ontology.usesCatalogs.length > 0;
     if (!hasOntologyBindings) continue;
     const existing = apiBoundResourcesBySystemPath.get(resource.systemPath);
     if (existing) {
@@ -45059,25 +45362,23 @@ function detectMissingApiInterfaceDeclarations(orgName, organizationModel) {
   }
   return gaps;
 }
-function validateDeclaredSystemInterfaceReadiness(orgName, organizationModel) {
+function validateDeclaredSystemInterfaceReadiness(orgName, organizationModel, options = {}) {
+  const mode = getResourceValidatorMode(options.mode);
   const issues = [];
   if (organizationModel === void 0) return { valid: true, issues };
   const model = organizationModel;
   for (const { path: path3, system } of listAllSystems(model)) {
     if (system.apiInterface === void 0) continue;
     const interfaceKey = "api";
-    const resourceIds = system.apiInterface.resourceIds ?? [];
-    if (resourceIds.length === 0) {
-      const readinessProfile = system.apiInterface.readinessProfile;
-      if (readinessProfile !== void 0 && !SYSTEM_INTERFACE_PROFILES.some((profile) => profile.readinessProfile === readinessProfile)) {
-        addSystemInterfaceIssue(issues, orgName, path3, interfaceKey, {
-          family: "SYSTEM_INTERFACE_INVALID",
-          code: "unknown-readiness-profile",
-          path: `systems.${path3}.apiInterface.readinessProfile`,
-          ref: readinessProfile,
-          message: `System Interface "${path3}/${interfaceKey}" references unknown readiness profile "${readinessProfile}".`
-        });
-      }
+    const readinessProfile = system.apiInterface.readinessProfile;
+    if (readinessProfile !== void 0 && !SYSTEM_INTERFACE_PROFILES.some((profile) => profile.readinessProfile === readinessProfile)) {
+      addSystemInterfaceIssue(issues, orgName, path3, interfaceKey, {
+        family: "SYSTEM_INTERFACE_INVALID",
+        code: "unknown-readiness-profile",
+        path: `systems.${path3}.apiInterface.readinessProfile`,
+        ref: readinessProfile,
+        message: `System Interface "${path3}/${interfaceKey}" references unknown readiness profile "${readinessProfile}".`
+      });
     }
     const result = computeInterfaceReadiness(model, { systemPath: path3, interfaceKey });
     for (const issue2 of result.issues) {
@@ -45085,17 +45386,27 @@ function validateDeclaredSystemInterfaceReadiness(orgName, organizationModel) {
     }
   }
   if (issues.length > 0) {
-    const first = issues[0];
-    throw new RegistryValidationError(
-      first.orgName,
-      `${first.systemPath}/${first.interfaceKey}`,
-      first.path ?? "organizationModel.systems.apiInterface",
-      first.message
-    );
+    if (mode === "strict") {
+      const first = issues[0];
+      const messages = issues.map((issue2) => issue2.message);
+      throw new RegistryValidationError(
+        first.orgName,
+        `${first.systemPath}/${first.interfaceKey}`,
+        first.path ?? "organizationModel.systems.apiInterface",
+        messages.join("\n"),
+        messages
+      );
+    }
+    const warn2 = options.onWarning ?? ((issue2) => console.warn(issue2.message));
+    for (const issue2 of issues) {
+      warn2(issue2);
+    }
+    return { valid: false, issues };
   }
   return { valid: true, issues };
 }
-function validateDeploymentSpec(orgName, resources) {
+function validateDeploymentSpec(orgName, resources, options = {}) {
+  const warn2 = options.onWarning ?? ((message) => console.warn(message));
   const seenIds = /* @__PURE__ */ new Set();
   resources.workflows?.forEach((workflow) => {
     const id = workflow.config.resourceId;
@@ -45114,6 +45425,14 @@ function validateDeploymentSpec(orgName, resources) {
     if (workflow.interface) {
       validateExecutionInterface(orgName, id, workflow.interface, workflow.contract.inputSchema);
     }
+    try {
+      validateEntryPoint(workflow.steps, workflow.entryPoint);
+      validateTerminalSteps(workflow.steps, id);
+      validateStepReferences(workflow.steps);
+      validateWorkflowGraph(workflow.steps, workflow.entryPoint, id);
+    } catch (error46) {
+      warn2(`[${orgName}] Workflow '${id}' graph validation: ${error46 instanceof Error ? error46.message : String(error46)}`);
+    }
   });
   resources.agents?.forEach((agent) => {
     const id = agent.config.resourceId;
@@ -45127,14 +45446,20 @@ function validateDeploymentSpec(orgName, resources) {
     }
     seenIds.add(id);
     validateResourceModelConfig(orgName, id, agent.modelConfig);
-    validateAgentGrammar(orgName, id, agent);
-    validateAgentCheapAssertions(orgName, id, agent);
+    validateAgentGrammar(orgName, id, agent, options.mode);
+    validateAgentCheapAssertions(orgName, id, agent, options.mode);
     if (agent.interface) {
       validateExecutionInterface(orgName, id, agent.interface, agent.contract.inputSchema);
     }
   });
-  validateResourceGovernance(orgName, resources);
-  validateDeclaredSystemInterfaceReadiness(orgName, resources.organizationModel);
+  validateResourceGovernance(orgName, resources, void 0, {
+    mode: options.mode,
+    onWarning: (issue2) => warn2(issue2.message)
+  });
+  validateDeclaredSystemInterfaceReadiness(orgName, resources.organizationModel, {
+    mode: options.mode,
+    onWarning: (issue2) => warn2(issue2.message)
+  });
 }
 function validateResourceModelConfig(orgName, resourceId, modelConfig) {
   try {
@@ -45209,7 +45534,7 @@ function describeGrammarRefusal(reasons, toolInputSchema) {
   }
   return `refused strict mode: ${reasons.join(", ")}`;
 }
-function validateAgentGrammar(orgName, agentId, agent) {
+function validateAgentGrammar(orgName, agentId, agent, mode) {
   const dialect = dialectForProvider(agent.modelConfig.provider);
   if (!dialect) return;
   const capabilities = agentCapabilitiesForGrammarCheck(agent.config);
@@ -45230,12 +45555,12 @@ function validateAgentGrammar(orgName, agentId, agent) {
     compileSchema(offending.inputSchema, dialect).refusalReasons,
     offending.inputSchema
   )}. This silently drops strict-mode enforcement for the agent's ENTIRE iteration schema on every call, not just this tool -- compileSchema refuses whole-schema, never per-tool.` : `[${orgName}] Agent '${agentId}' iteration schema refused strict mode for provider '${agent.modelConfig.provider}': ${compiled.refusalReasons.join(", ")}. No single tool is independently responsible -- this is a whole-schema limit (e.g. total optional properties across every tool exceeding the provider's cap).`;
-  if (getResourceValidatorMode() === "strict") {
+  if (getResourceValidatorMode(mode) === "strict") {
     throw new RegistryValidationError(orgName, agentId, "tools", message);
   }
   console.warn(message);
 }
-function validateAgentCheapAssertions(orgName, agentId, agent) {
+function validateAgentCheapAssertions(orgName, agentId, agent, mode) {
   const issues = [];
   const config3 = agent.config;
   if (config3.sessionCapable && config3.securityLevel === "none") {
@@ -45265,7 +45590,7 @@ function validateAgentCheapAssertions(orgName, agentId, agent) {
   }
   if (issues.length === 0) return;
   const message = `[${orgName}] Agent '${agentId}': ${issues.join(" ")}`;
-  if (getResourceValidatorMode() === "strict") {
+  if (getResourceValidatorMode(mode) === "strict") {
     throw new RegistryValidationError(orgName, agentId, "config", message);
   }
   console.warn(message);
@@ -45532,34 +45857,24 @@ var init_validation2 = __esm({
     init_compile();
     init_dialect();
     init_response_schema();
+    init_utils3();
     init_helpers();
     init_ontology();
     init_readiness();
     init_systems();
     RegistryValidationError = class extends Error {
-      constructor(orgName, resourceId, field2, message) {
+      constructor(orgName, resourceId, field2, message, issues) {
         super(message);
         this.orgName = orgName;
         this.resourceId = resourceId;
         this.field = field2;
+        this.issues = issues;
         this.name = "RegistryValidationError";
       }
     };
   }
 });
 
-// ../core/src/execution/engine/workflow/types.ts
-var StepType;
-var init_types5 = __esm({
-  "../core/src/execution/engine/workflow/types.ts"() {
-    "use strict";
-    StepType = {
-      LINEAR: "linear",
-      CONDITIONAL: "conditional"
-    };
-  }
-});
-
 // ../core/src/execution/engine/base/serialization.ts
 function serializeDefinition(definition, options) {
   const opts = {
@@ -47295,7 +47610,7 @@ var init_croner = __esm({
 });
 
 // ../core/src/execution/scheduler/utils.ts
-var init_utils3 = __esm({
+var init_utils4 = __esm({
   "../core/src/execution/scheduler/utils.ts"() {
     "use strict";
     init_esm2();
@@ -47309,7 +47624,7 @@ var init_scheduler = __esm({
     "use strict";
     init_types8();
     init_schemas3();
-    init_utils3();
+    init_utils4();
   }
 });
 
@@ -47404,6 +47719,13 @@ var init_clickup = __esm({
   }
 });
 
+// ../core/src/execution/engine/tools/integration/types/instagram.ts
+var init_instagram = __esm({
+  "../core/src/execution/engine/tools/integration/types/instagram.ts"() {
+    "use strict";
+  }
+});
+
 // ../core/src/execution/engine/tools/integration/types/index.ts
 var init_types9 = __esm({
   "../core/src/execution/engine/tools/integration/types/index.ts"() {
@@ -47421,6 +47743,7 @@ var init_types9 = __esm({
     init_tomba();
     init_millionverifier();
     init_clickup();
+    init_instagram();
   }
 });
 
@@ -47702,7 +48025,7 @@ var init_schemas6 = __esm({
 });
 
 // ../core/src/operations/observability/utils.ts
-var init_utils4 = __esm({
+var init_utils5 = __esm({
   "../core/src/operations/observability/utils.ts"() {
     "use strict";
   }
@@ -47714,7 +48037,7 @@ var init_observability = __esm({
     "use strict";
     init_types13();
     init_schemas6();
-    init_utils4();
+    init_utils5();
   }
 });
 
@@ -48514,7 +48837,14 @@ var init_api_schemas5 = __esm({
     "use strict";
     init_zod();
     init_validation();
-    CredentialTypeSchema = external_exports.enum(["oauth", "api-key", "webhook-secret", "api-key-secret", "clickup"]);
+    CredentialTypeSchema = external_exports.enum([
+      "oauth",
+      "api-key",
+      "webhook-secret",
+      "api-key-secret",
+      "clickup",
+      "instagram"
+    ]);
     CredentialValueSchema = external_exports.record(external_exports.string(), external_exports.unknown()).refine((val) => Object.keys(val).length > 0, { message: "Credential value must not be empty" }).refine((val) => Object.keys(val).length <= 50, { message: "Credential value has too many keys (max 50)" }).refine(
       (val) => {
         for (const v of Object.values(val)) {
@@ -48582,6 +48912,21 @@ var init_credentials2 = __esm({
   }
 });
 
+// ../core/src/integrations/cloud-storage/types.ts
+var init_types20 = __esm({
+  "../core/src/integrations/cloud-storage/types.ts"() {
+    "use strict";
+  }
+});
+
+// ../core/src/integrations/cloud-storage/index.ts
+var init_cloud_storage = __esm({
+  "../core/src/integrations/cloud-storage/index.ts"() {
+    "use strict";
+    init_types20();
+  }
+});
+
 // ../core/src/index.ts
 var init_src = __esm({
   "../core/src/index.ts"() {
@@ -48598,6 +48943,7 @@ var init_src = __esm({
     init_forms();
     init_oauth();
     init_credentials2();
+    init_cloud_storage();
   }
 });
 
@@ -48654,6 +49000,12 @@ function resolveApiKey(prod) {
   }
   return process.env.ELEVASIS_PLATFORM_KEY ?? "";
 }
+function isProdApiUrl(apiUrl) {
+  return !apiUrl.includes("localhost");
+}
+function resolveApiKeyForUrl(apiUrl) {
+  return resolveApiKey(isProdApiUrl(apiUrl));
+}
 function tryFindProjectRoot(startDir) {
   const raw = (0, import_path.resolve)(startDir);
   let dir;
@@ -48738,12 +49090,89 @@ var init_config2 = __esm({
   }
 });
 
+// src/cli/readiness-failure.ts
+function isReadinessFailureDetails(details) {
+  if (!details || typeof details !== "object") return false;
+  const candidate = details;
+  return typeof candidate.systemPath === "string" && typeof candidate.interfaceKey === "string" && // Deliberately `string`, not a check against the known families. Narrowing
+  // it here would reject a readiness refusal carrying a family this build has
+  // not learned yet, and `request()` would fall through to the gateway
+  // message -- which tells the operator the API did not reject the request and
+  // it may still be running server-side. That is false for every readiness
+  // refusal, familiar family or not. An unrecognized code is handled where it
+  // can be handled honestly, in `guidanceForFamily`.
+  typeof candidate.readinessCode === "string" && Array.isArray(candidate.issues);
+}
+function parseReadinessFailureDetails(errorText) {
+  let parsed;
+  try {
+    parsed = JSON.parse(errorText);
+  } catch {
+    return void 0;
+  }
+  if (parsed.code !== "SERVICE_UNAVAILABLE") return void 0;
+  return isReadinessFailureDetails(parsed.details) ? parsed.details : void 0;
+}
+function formatIssue(issue2) {
+  let line = `    - [${issue2.code}] ${issue2.message}`;
+  if (issue2.path) line += ` (path: ${issue2.path})`;
+  if (issue2.ref) line += ` (ref: ${issue2.ref})`;
+  return line;
+}
+function describeUnknownFamily(readinessCode) {
+  return `This CLI does not recognize readiness code "${readinessCode}", so it cannot describe the general shape of the fix. The issues below are the API's own explanation and are the authoritative part of this message.
+  The likely cause is version skew -- this @elevasis/sdk is older than the API it just called. Update it (pnpm update @elevasis/sdk) and run this again.`;
+}
+function guidanceForFamily(details) {
+  const lookup = FAMILY_GUIDANCE;
+  return lookup[details.readinessCode]?.(details) ?? describeUnknownFamily(details.readinessCode);
+}
+function describeReadinessFailure(details, endpoint) {
+  const profileSuffix = details.readinessProfile ? ` (readiness profile: ${details.readinessProfile})` : "";
+  const lines = [
+    `API request refused (503): ${details.systemPath}/${details.interfaceKey} is not ready for this API surface${profileSuffix}.`,
+    `This IS the API rejecting the request -- it is not a gateway hiccup, and re-running it will not help.`,
+    `  Endpoint: ${endpoint}`,
+    ""
+  ];
+  lines.push(
+    details.readinessCode === "STALE_OM_SNAPSHOT" ? details.issues[0]?.message ?? "The deployed organization model snapshot is stale. Deploy again to fix this: elevasis-sdk deploy" : guidanceForFamily(details)
+  );
+  if (details.issues.length > 0) {
+    lines.push("", "  Issues:", ...details.issues.map(formatIssue));
+  }
+  lines.push("", `  Run 'elevasis-sdk doctor' to see what else is not ready.`);
+  return lines.join("\n");
+}
+var FAMILY_GUIDANCE;
+var init_readiness_failure = __esm({
+  "src/cli/readiness-failure.ts"() {
+    "use strict";
+    FAMILY_GUIDANCE = {
+      SYSTEM_INTERFACE_MISSING: ({ systemPath }) => `This organization has not adopted the "${systemPath}" System. Declare it in this project's core/config/organization-model/systems.ts with an apiInterface block, then deploy (elevasis-sdk deploy or pnpm operations:deploy).
+  Known trap: an empty apiInterface.resourceIds throws -- omit the apiInterface block entirely for the supported opt-out.`,
+      SYSTEM_INTERFACE_DISABLED: ({ systemPath }) => `The "${systemPath}" System declares an apiInterface but it is not active. Re-enable it (apiInterface.lifecycle: 'active') and redeploy.`,
+      // Two failures share this family and they need opposite advice.
+      //
+      // A validator that rejected a declaration emits a `path`, and pointing at it
+      // is the whole fix. A stored snapshot that would not parse emits no `path` --
+      // the API sets `ref` (a deployment or organization id) and never `path` --
+      // and the broken thing is the deployed copy, not the source the operator
+      // would go and edit. Sending them after a "path" that is not in the payload,
+      // to fix a declaration that may be perfectly fine, was the failure this
+      // wording had before.
+      SYSTEM_INTERFACE_INVALID: ({ systemPath, issues }) => issues.some((issue2) => issue2.path) ? `The "${systemPath}" System's apiInterface / readinessContract declaration is malformed. See the "path" on each issue below for the offending field.` : `The "${systemPath}" System's stored organization model snapshot could not be read. No field of your declaration is known to be wrong -- it is the deployed copy that failed, so deploy again first (elevasis-sdk deploy). If that does not clear it, the declaration is the next place to look.`,
+      SYSTEM_INTERFACE_NOT_READY: ({ systemPath }) => `The "${systemPath}" System's readinessContract is unsatisfied. See the issues below for the missing requiredObjects / requiredCatalogs refs.`,
+      SYSTEM_BRIDGE_NOT_READY: ({ systemPath }) => `The counterpart System of "${systemPath}"'s cross-System handoff is not ready. Check readiness on both sides of the bridge.`
+    };
+  }
+});
+
 // src/cli/api-client.ts
 function getApiKey(apiUrl) {
-  const isProd = !apiUrl.includes("localhost");
-  const key = resolveApiKey(isProd);
+  const key = resolveApiKeyForUrl(apiUrl);
   if (!key) {
-    const varName = isProd ? "ELEVASIS_PLATFORM_KEY" : "ELEVASIS_PLATFORM_KEY_DEV";
+    const varName = isProdApiUrl(apiUrl) ? "ELEVASIS_PLATFORM_KEY" : "ELEVASIS_PLATFORM_KEY_DEV";
     throw new Error(`${varName} environment variable is required.
 Set it in your .env file: ${varName}=sk_...`);
   }
@@ -48805,6 +49234,10 @@ async function request(method, endpoint, apiUrl, body) {
     if (response.status === 401) {
       throw new Error(`401 Unauthorized: Invalid or missing ELEVASIS_PLATFORM_KEY. Check your .env file.`);
     }
+    const readinessDetails = parseReadinessFailureDetails(errorText);
+    if (readinessDetails) {
+      throw new Error(describeReadinessFailure(readinessDetails, endpoint));
+    }
     if (GATEWAY_STATUSES.has(response.status)) {
       throw new Error(describeGatewayFailure(response.status, endpoint, elapsedMs));
     }
@@ -48832,6 +49265,7 @@ var init_api_client = __esm({
   "src/cli/api-client.ts"() {
     "use strict";
     init_config2();
+    init_readiness_failure();
     DEFAULT_TIMEOUT_MS = 2 * 60 * 60 * 1e3;
     GATEWAY_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
   }
@@ -48864,7 +49298,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@elevasis/sdk",
-      version: "1.48.0",
+      version: "1.50.0",
       description: "SDK for building Elevasis organization resources",
       type: "module",
       bin: {
@@ -48896,6 +49330,7 @@ var init_package = __esm({
         "dist/test-utils/index.js",
         "dist/test-utils/index.d.ts",
         "dist/node/",
+        "dist/chunk-*.js",
         "dist/cli.cjs",
         "reference/"
       ],
@@ -48915,8 +49350,14 @@ var init_package = __esm({
         "remark-gfm": "^4.0.1"
       },
       peerDependencies: {
+        vitest: ">=3",
         zod: "^4.1.0"
       },
+      peerDependenciesMeta: {
+        vitest: {
+          optional: true
+        }
+      },
       devDependencies: {
         "@repo/core": "workspace:*",
         "@repo/eslint-config": "workspace:*",
@@ -48931,6 +49372,7 @@ var init_package = __esm({
         "rollup-plugin-dts": "^6.3.0",
         tsup: "^8.0.0",
         typescript: "5.9.2",
+        vitest: "^3.2.4",
         zod: "^4.1.0"
       }
     };
@@ -49069,7 +49511,15 @@ function extractResourceMetadata(resource, schemaWarnings) {
   return meta;
 }
 function bumpVersion(current, type) {
-  const [major, minor, patch] = current.split(".").map(Number);
+  const match = PLAIN_SEMVER_RE.exec(current);
+  if (!match) {
+    throw new Error(
+      `Cannot bump version: "${current}" is not a plain "major.minor.patch" version (e.g. "1.0.0"). Set the deployment spec's version to a plain semver value before using --major/--minor/--patch.`
+    );
+  }
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  const patch = Number(match[3]);
   switch (type) {
     case "major":
       return `${major + 1}.0.0`;
@@ -49080,36 +49530,55 @@ function bumpVersion(current, type) {
   }
 }
 function updateDeploymentVersionSource(source, newVersion) {
-  let offset = 0;
+  const exportIndex = source.indexOf("export default");
+  if (exportIndex === -1) {
+    throw new Error('Unable to find "export default" in the deployment entry file');
+  }
+  const rootBraceIndex = source.indexOf("{", exportIndex);
+  if (rootBraceIndex === -1) {
+    throw new Error("Unable to find the default-exported object in the deployment entry file");
+  }
+  let depth = 0;
+  let offset = rootBraceIndex;
   while (offset < source.length) {
-    const keyIndex = source.indexOf("version", offset);
-    if (keyIndex === -1) break;
-    const before = source[keyIndex - 1];
-    const after = source[keyIndex + "version".length];
-    const isIdentifierBoundary = (before === void 0 || !/[A-Za-z0-9_$]/.test(before)) && (after === void 0 || !/[A-Za-z0-9_$]/.test(after));
-    if (!isIdentifierBoundary) {
-      offset = keyIndex + "version".length;
+    const char = source[offset];
+    if (char === "{" || char === "[" || char === "(") {
+      depth += 1;
+      offset += 1;
       continue;
     }
-    let cursor = keyIndex + "version".length;
-    while (/\s/.test(source[cursor] ?? "")) cursor += 1;
-    if (source[cursor] !== ":") {
-      offset = cursor;
+    if (char === "}" || char === "]" || char === ")") {
+      depth -= 1;
+      offset += 1;
+      if (depth === 0) break;
       continue;
     }
-    cursor += 1;
-    while (/\s/.test(source[cursor] ?? "")) cursor += 1;
-    const quote = source[cursor];
-    if (quote !== "'" && quote !== '"') {
-      offset = cursor;
-      continue;
+    if (depth === 1 && char === "v" && source.startsWith("version", offset)) {
+      const before = source[offset - 1];
+      const after = source[offset + "version".length];
+      const isIdentifierBoundary = (before === void 0 || !/[A-Za-z0-9_$]/.test(before)) && (after === void 0 || !/[A-Za-z0-9_$]/.test(after));
+      if (isIdentifierBoundary) {
+        let cursor = offset + "version".length;
+        while (/\s/.test(source[cursor] ?? "")) cursor += 1;
+        if (source[cursor] === ":") {
+          cursor += 1;
+          while (/\s/.test(source[cursor] ?? "")) cursor += 1;
+          const quote = source[cursor];
+          if (quote === "'" || quote === '"') {
+            const valueStart = cursor + 1;
+            const valueEnd = source.indexOf(quote, valueStart);
+            if (valueEnd !== -1) {
+              return `${source.slice(0, valueStart)}${newVersion}${source.slice(valueEnd)}`;
+            }
+          }
+        }
+      }
     }
-    const valueStart = cursor + 1;
-    const valueEnd = source.indexOf(quote, valueStart);
-    if (valueEnd === -1) break;
-    return `${source.slice(0, valueStart)}${newVersion}${source.slice(valueEnd)}`;
+    offset += 1;
   }
-  throw new Error("Unable to find a quoted version property in the deployment entry file");
+  throw new Error(
+    "Unable to find a quoted version property on the default-exported deployment spec (not nested inside a resource config) in the entry file"
+  );
 }
 function listOrganizationModelContractRefs(org) {
   return Object.values(org.organizationModel?.resources ?? {}).flatMap((resource) => {
@@ -49121,7 +49590,7 @@ function listOrganizationModelContractRefs(org) {
     ].filter((entry) => entry[1] !== void 0).map(([side, ref]) => ({ resourceId: resource.id, side, ref }));
   });
 }
-function validateResourceGovernancePreflight(orgName, org, contractRegistry) {
+function validateResourceGovernancePreflight(orgName, org, contractRegistry, onWarning = (message) => console.warn(message)) {
   if (org.organizationModel !== void 0) {
     OrganizationModelSchema.parse(org.organizationModel);
   }
@@ -49141,24 +49610,43 @@ Run \`pnpm exec elevasis-sdk om:scaffold:fill --gaps <path>\` to scaffold the mi
     );
   }
   validateDeclaredSystemInterfaceReadiness(orgName, org.organizationModel);
-  if (process.env.ELEVASIS_RESOURCE_VALIDATOR === "warn-only") return;
-  validateResourceGovernance(orgName, org, org.organizationModel, { mode: "strict" });
+  const mode = process.env.ELEVASIS_RESOURCE_VALIDATOR === "warn-only" ? "warn-only" : "strict";
+  validateResourceGovernance(orgName, org, org.organizationModel, {
+    mode,
+    onWarning: (issue2) => onWarning(issue2.message)
+  });
   const contractRefs = listOrganizationModelContractRefs(org);
-  if (contractRefs.length === 0 || contractRegistry === void 0) return;
+  if (contractRefs.length === 0) return;
+  if (contractRegistry === void 0) {
+    onWarning(
+      `[${orgName}] ${contractRefs.length} contract ref${contractRefs.length !== 1 ? "s" : ""} declared in organizationModel but no \`contractRegistry\` (or \`ELEVASIS_CONTRACT_REGISTRY\`) was exported from the entry file -- contract-ref resolution skipped.`
+    );
+    return;
+  }
   for (const { resourceId, side, ref } of contractRefs) {
     try {
       resolveContractRef(ref, contractRegistry);
     } catch (error46) {
       const message = error46 instanceof Error ? error46.message : String(error46);
-      throw new RegistryValidationError(
-        orgName,
-        resourceId,
-        `organizationModel.resources.${resourceId}.ontology.contract.${side}`,
-        message
-      );
+      const field2 = `organizationModel.resources.${resourceId}.ontology.contract.${side}`;
+      if (mode === "warn-only") {
+        onWarning(`[${orgName}] ${field2}: ${message}`);
+        continue;
+      }
+      throw new RegistryValidationError(orgName, resourceId, field2, message);
     }
   }
 }
+function formatZodValidationError(error46) {
+  return error46.issues.map((issue2) => {
+    const path3 = issue2.path.length > 0 ? issue2.path.join(".") : "(root)";
+    return `${path3}: ${issue2.message}`;
+  });
+}
+function formatRegistryValidationError(error46) {
+  if (error46.issues && error46.issues.length > 1) return error46.issues;
+  return [error46.message];
+}
 function registerDeployCommand(program3) {
   program3.command("deploy").description(
     "Validate, bundle, upload, and deploy project resources\n  Example: elevasis-sdk deploy --api-url http://localhost:5170"
@@ -49182,7 +49670,7 @@ function registerDeployCommand(program3) {
           authSpinner.fail(source_default.red("Authentication failed"));
           const errMsg = error46 instanceof Error ? error46.message : String(error46);
           if (errMsg.includes("401") || errMsg.toLowerCase().includes("unauthorized")) {
-            const keyVar = !options.prod && process.env.NODE_ENV === "development" && process.env.ELEVASIS_PLATFORM_KEY_DEV ? "ELEVASIS_PLATFORM_KEY_DEV" : "ELEVASIS_PLATFORM_KEY";
+            const keyVar = !isProdApiUrl(apiUrl) && process.env.NODE_ENV === "development" && process.env.ELEVASIS_PLATFORM_KEY_DEV ? "ELEVASIS_PLATFORM_KEY_DEV" : "ELEVASIS_PLATFORM_KEY";
             console.error(source_default.red("  Invalid API key."));
             console.error(source_default.gray(`  Your ${keyVar} was rejected by the server.`));
             console.error(source_default.gray("  Check your .env file and verify the key in the Elevasis dashboard."));
@@ -49206,7 +49694,13 @@ function registerDeployCommand(program3) {
             throw new Error("Invalid entry: no default export found");
           }
           const contractRegistry = deploymentModule.contractRegistry ?? deploymentModule.ELEVASIS_CONTRACT_REGISTRY;
-          validateResourceGovernancePreflight(orgName, org, contractRegistry);
+          const governanceWarnings = [];
+          validateResourceGovernancePreflight(
+            orgName,
+            org,
+            contractRegistry,
+            (message) => governanceWarnings.push(message)
+          );
           new ResourceRegistry({ [orgName]: org });
           activeWorkflows = (org.workflows ?? []).filter((w) => !w.config.archived);
           activeAgents = (org.agents ?? []).filter((a) => !a.config.archived);
@@ -49215,6 +49709,12 @@ function registerDeployCommand(program3) {
           validateSpinner.succeed(
             source_default.green("Validating...") + source_default.white("              done") + source_default.gray(` (${totalCount} resource${totalCount !== 1 ? "s" : ""}, 0 errors)`)
           );
+          if (governanceWarnings.length > 0) {
+            for (const warning of governanceWarnings) {
+              console.log(source_default.yellow(`  warn  ${warning}`));
+            }
+            console.log("");
+          }
           if (archivedCount > 0) {
             console.log(source_default.gray(`  Skipping ${archivedCount} archived resource${archivedCount !== 1 ? "s" : ""}`));
           }
@@ -49248,12 +49748,30 @@ function registerDeployCommand(program3) {
           if (error46 instanceof RegistryValidationError) {
             validateSpinner.fail(source_default.red("Validation failed"));
             console.error("");
-            console.error(source_default.red(`  ERROR  ${error46.message}`));
+            const issues = formatRegistryValidationError(error46);
+            if (issues.length > 1) {
+              console.error(source_default.red(`  ${issues.length} issues:`));
+              for (const issue2 of issues) {
+                console.error(source_default.red(`    - ${issue2}`));
+              }
+            } else {
+              console.error(source_default.red(`  ERROR  ${issues[0]}`));
+            }
             if (error46.resourceId) {
               console.error(source_default.gray(`  Resource: ${error46.resourceId}`));
             }
             console.error("");
             console.error(source_default.gray("  Deploy aborted."));
+          } else if (error46 instanceof external_exports.ZodError) {
+            validateSpinner.fail(source_default.red("Validation failed: organization model does not match the expected shape"));
+            console.error("");
+            for (const line of formatZodValidationError(error46)) {
+              console.error(source_default.red(`  ERROR  ${line}`));
+            }
+            console.error("");
+            console.error(source_default.gray("  Deploy aborted."));
+          } else if (validateSpinner.isSpinning) {
+            validateSpinner.fail(source_default.red("Validation failed"));
           }
           throw error46;
         }
@@ -49318,11 +49836,11 @@ import { startWorker } from '@elevasis/sdk/worker'
         const uploadSpinner = ora("Uploading...").start();
         try {
           const bundleBuffer = await (0, import_promises.readFile)(bundleOutfile);
-          const apiKey = resolveApiKey(options.prod);
+          const apiKey = resolveApiKeyForUrl(apiUrl);
           if (!apiKey) {
             uploadSpinner.fail(source_default.red("Missing API key environment variable"));
             console.error(source_default.gray("  Set it in your .env file or shell environment:"));
-            if (!options.prod && process.env.NODE_ENV === "development") {
+            if (!isProdApiUrl(apiUrl) && process.env.NODE_ENV === "development") {
               console.error(
                 source_default.gray("    ELEVASIS_PLATFORM_KEY_DEV=sk_...  (or ELEVASIS_PLATFORM_KEY as fallback)")
               );
@@ -49390,7 +49908,7 @@ import { startWorker } from '@elevasis/sdk/worker'
     )
   );
 }
-var import_path2, import_promises, import_fs2, import_crypto, import_url, import_module;
+var import_path2, import_promises, import_fs2, import_crypto, import_url, import_module, PLAIN_SEMVER_RE;
 var init_deploy = __esm({
   "src/cli/commands/deploy.ts"() {
     "use strict";
@@ -49411,6 +49929,7 @@ var init_deploy = __esm({
     init_api_client();
     init_wrap_action();
     init_version();
+    PLAIN_SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)$/;
   }
 });
 
@@ -49554,18 +50073,35 @@ function emitSystemEntry(opts) {
   const order = opts.order ?? 10;
   let apiInterfaceBlock = "";
   let apiInterfaceNote;
+  let importLine;
   if (opts.apiBacked) {
     const cataloged = SYSTEM_INTERFACE_PROFILES.find(
       (profile) => profile.systemPath === opts.id && profile.interfaceKey === "api"
     );
-    if (cataloged !== void 0) {
+    const resourceIds = (opts.resourceIds ?? []).filter((id) => id.trim().length > 0);
+    if (cataloged !== void 0 && cataloged.validation === "built-in" && resourceIds.length > 0) {
+      defineSystemApiInterface({
+        systemPath: opts.id,
+        readinessProfile: cataloged.readinessProfile,
+        resourceIds
+      });
+      importLine = `import { defineSystemApiInterface } from '@elevasis/core/organization-model'`;
+      const resourceIdsLines = resourceIds.map((id) => `        '${id}'`).join(",\n");
       apiInterfaceBlock = `
-    apiInterface: {
-      lifecycle: 'active',
-      readinessProfile: '${cataloged.readinessProfile}'
-    },`;
+    apiInterface: defineSystemApiInterface({
+      systemPath: '${opts.id}',
+      readinessProfile: '${cataloged.readinessProfile}',
+      resourceIds: [
+${resourceIdsLines}
+      ]
+    }),`;
+    } else if (cataloged !== void 0 && cataloged.validation === "built-in") {
+      apiInterfaceNote = `System \`${opts.id}\` is cataloged for readiness profile "${cataloged.readinessProfile}", but a brand-new System has no scoped resources yet to back an \`apiInterface\`. \`apiInterface\` was NOT added. Once real resource ids exist for this system, declare it with \`defineSystemApiInterface\` from '@elevasis/core/organization-model' (or re-run \`om:scaffold:fill\`, which does this for you).`;
+    } else if (cataloged !== void 0) {
+      apiInterfaceNote = `System \`${opts.id}\` adopts contract-validated readiness profile "${cataloged.readinessProfile}". \`apiInterface\` was NOT added \u2014 declare it with \`defineContentSystem\` from '@elevasis/core/organization-model', which derives the readinessContract, content:object/item, and status catalog from your pipelines, item voice, and status vocabulary.`;
     } else {
-      apiInterfaceNote = `System \`${opts.id}\` is not on a cataloged readiness profile (only sales.lead-gen and sales.crm ship built-in profiles today). \`apiInterface\` was NOT added. Declare it manually once real resourceIds exist for this system, using either a cataloged profile or a custom \`readinessProfile\` paired with a \`readinessContract\`.`;
+      const adoptable = SYSTEM_INTERFACE_PROFILES.filter((profile) => profile.interfaceKey === "api").map((profile) => `"${profile.systemPath}"`).join(", ");
+      apiInterfaceNote = `System \`${opts.id}\` is not on a cataloged readiness profile (adoptable system paths today: ${adoptable}). \`apiInterface\` was NOT added. A custom System extends behavior through workflows/operations plus ontology, resources, and topology \u2014 omitting apiInterface entirely is the designed opt-out.`;
     }
   }
   const code = `  {
@@ -49581,7 +50117,8 @@ function emitSystemEntry(opts) {
 `;
   const startAnchor = /^(?!\s*(?:\/\/|\*|\/\*)).*\bexport const templateSystems\s*=/m;
   const anchor = /^\] as const\s*$/m;
-  return { code, startAnchor, anchor, apiInterfaceNote };
+  const importAnchor = /^\/\/ -{75,}\n\/\/ Feature/m;
+  return { code, startAnchor, anchor, apiInterfaceNote, importLine, importAnchor };
 }
 var init_emit_system = __esm({
   "src/cli/commands/om/emit-system.ts"() {
@@ -49748,10 +50285,20 @@ async function scaffoldSystem(opts) {
     });
     apiBacked = answer.trim().toLowerCase() === "y";
   }
-  const { code, anchor, startAnchor, apiInterfaceNote } = emitSystemEntry({ id, title, kind, apiBacked });
+  const { code, anchor, startAnchor, apiInterfaceNote, importLine, importAnchor } = emitSystemEntry({
+    id,
+    title,
+    kind,
+    apiBacked,
+    resourceIds: options.resourceIds
+  });
   const shouldWrite = options.write === true || options.dryRun === false;
   if (!shouldWrite) {
     console.log(source_default.cyan("Dry-run mode (default) \u2014 no files written. Pass --write to apply.\n"));
+    if (importLine !== void 0) {
+      console.log(source_default.gray("Import line to add near the top of core/config/organization-model/systems.ts:"));
+      console.log(importLine);
+    }
     console.log(source_default.gray("Proposed addition to core/config/organization-model/systems.ts:"));
     console.log(code);
     if (apiInterfaceNote !== void 0) {
@@ -49762,6 +50309,9 @@ async function scaffoldSystem(opts) {
   const systemsFilePath = (0, import_node_path13.join)(getOrganizationModelDir(projectDir), "systems.ts");
   try {
     await withSnapshotRollback([systemsFilePath], async () => {
+      if (importLine !== void 0) {
+        await appendBeforeAnchor(systemsFilePath, importLine + "\n", importAnchor);
+      }
       await appendBeforeAnchor(systemsFilePath, code, anchor, startAnchor);
       const validationError = runValidation(projectDir);
       if (validationError !== null) {
@@ -50208,6 +50758,14 @@ var init_scaffold_knowledge = __esm({
 function toConstName(systemPath) {
   return systemPath.split(/[.-]/).map((segment, index) => index === 0 ? segment : segment.charAt(0).toUpperCase() + segment.slice(1)).join("") + "ApiInterface";
 }
+function buildContentPlaceholderReadinessContract(systemPath) {
+  return {
+    requiredObjects: [`${systemPath}:object/item`],
+    requiredCatalogs: [
+      "TODO -- replace with this System real pipeline, step, and status catalog ids (see defineContentPipeline and defineContentSystem in the organization-model subpath)"
+    ]
+  };
+}
 function emitApiInterfaceBlock(gap) {
   const constName = toConstName(gap.systemPath);
   const cataloged = SYSTEM_INTERFACE_PROFILES.find(
@@ -50220,17 +50778,44 @@ function emitApiInterfaceBlock(gap) {
     );
   }
   const readinessProfile = cataloged.readinessProfile;
-  const resourceIdsField = gap.resourceIds.length === 0 ? "" : `,
-  resourceIds: [
-    ${gap.resourceIds.map((id) => `'${id}'`).join(",\n    ")}
-  ]`;
+  if (gap.resourceIds.length === 0) {
+    throw new Error(
+      `Cannot emit an apiInterface for system path "${gap.systemPath}": the gap carries no resourceIds. defineSystemApiInterface requires at least one scoped resource id \u2014 an interface with none computes as ready and answers every route with a 503. Re-run this scaffolder once the system has at least one API-backed resource declared.`
+    );
+  }
+  const resourceIds = gap.resourceIds;
+  const isContractValidated = cataloged.validation === "contract";
+  const readinessContract = isContractValidated ? buildContentPlaceholderReadinessContract(gap.systemPath) : void 0;
+  defineSystemApiInterface({
+    systemPath: gap.systemPath,
+    readinessProfile,
+    resourceIds,
+    ...readinessContract !== void 0 ? { readinessContract } : {}
+  });
+  const resourceIdsLines = resourceIds.map((id) => `    '${id}'`).join(",\n");
+  const readinessContractField = readinessContract === void 0 ? "" : `,
+  // TODO: requiredCatalogs below is a placeholder. Replace it with this System's actual pipeline,
+  // step, and status catalog ids before deploying \u2014 see extend-content.md in the SDK scaffold docs.
+  readinessContract: {
+    requiredObjects: [
+      ${readinessContract.requiredObjects.map((id) => `'${id}'`).join(",\n      ")}
+    ],
+    requiredCatalogs: [
+      ${readinessContract.requiredCatalogs.map((id) => `'${id}'`).join(",\n      ")}
+    ]
+  }`;
   const constFileCode = `// Auto-generated by om:scaffold:fill \u2014 do not edit manually.
 // Regenerate by running: elevasis-sdk om:scaffold:fill --gaps <path>
 
-export const ${constName} = {
-  lifecycle: 'active' as const,
-  readinessProfile: '${readinessProfile}'${resourceIdsField}
-}
+import { defineSystemApiInterface } from '@elevasis/core/organization-model'
+
+export const ${constName} = defineSystemApiInterface({
+  systemPath: '${gap.systemPath}',
+  readinessProfile: '${readinessProfile}',
+  resourceIds: [
+${resourceIdsLines}
+  ]${readinessContractField}
+})
 `;
   const importLine = `import { ${constName} } from './api-interfaces/${gap.systemPath}'`;
   const fieldLine = `    apiInterface: ${constName},`;
@@ -50331,11 +50916,21 @@ async function scaffoldFill(opts) {
           gap.resourceIds
         ) : gap.resourceId ? [gap.resourceId] : []
       );
-      const emitResult = emitApiInterfaceBlock({
-        systemPath,
-        resourceIds,
-        message: gap.reason
-      });
+      let emitResult;
+      try {
+        emitResult = emitApiInterfaceBlock({
+          systemPath,
+          resourceIds,
+          message: gap.reason
+        });
+      } catch (err) {
+        skippedGaps.push({
+          field: gap.field,
+          resourceId: gap.resourceId,
+          reason: err instanceof Error ? err.message : String(err)
+        });
+        continue;
+      }
       const constFilePath = (0, import_node_path17.join)(getOrganizationModelDir(projectDir), "api-interfaces", `${systemPath}.ts`);
       touchedFiles.push(constFilePath);
       emitResults.push(emitResult);
@@ -55314,7 +55909,129 @@ function registerUiCommands(program3) {
 var import_node_fs9 = require("node:fs");
 var import_node_path8 = __toESM(require("node:path"), 1);
 init_source();
+init_organization_model();
 init_config2();
+init_load_org_model();
+
+// src/cli/commands/om/deployed-readiness.ts
+init_organization_model();
+init_api_client();
+function listApiInterfaceSystemPaths(model) {
+  return listAllSystems(model).filter(({ system }) => system.apiInterface !== void 0).map(({ path: path3 }) => path3);
+}
+function listDeployedReadinessTargets(model) {
+  const declared = new Set(listApiInterfaceSystemPaths(model));
+  const targets = SYSTEM_INTERFACE_PROFILES.map((profile) => ({
+    systemPath: profile.systemPath,
+    interfaceKey: profile.interfaceKey,
+    declaredLocally: declared.has(profile.systemPath)
+  }));
+  const covered = new Set(targets.map((target) => `${target.systemPath}::${target.interfaceKey}`));
+  for (const systemPath of declared) {
+    const key = `${systemPath}::api`;
+    if (covered.has(key)) continue;
+    covered.add(key);
+    targets.push({ systemPath, interfaceKey: "api", declaredLocally: true });
+  }
+  return targets;
+}
+async function fetchDeployedReadiness(model, options = {}) {
+  const targets = listDeployedReadinessTargets(model);
+  const report = {
+    activeDeploymentId: null,
+    snapshotHash: null,
+    kind: null,
+    entries: []
+  };
+  if (targets.length === 0) {
+    report.unavailableReason = "no System-interface profile to check \u2014 neither the platform catalog nor the project model declares one";
+    return report;
+  }
+  for (const target of targets) {
+    let response;
+    try {
+      const endpoint = `/api/external/organization-model/readiness?systemPath=${encodeURIComponent(target.systemPath)}&interfaceKey=${encodeURIComponent(target.interfaceKey)}`;
+      response = await apiGet(endpoint, options.apiUrl);
+    } catch (error46) {
+      report.unavailableReason = error46 instanceof Error ? error46.message : String(error46);
+      return report;
+    }
+    report.activeDeploymentId = response.activeDeploymentId;
+    report.snapshotHash = response.snapshotHash;
+    report.kind = response.kind;
+    report.entries.push({
+      systemPath: response.readiness.systemPath,
+      interfaceKey: response.readiness.interfaceKey,
+      ready: response.readiness.ready,
+      issues: response.readiness.issues,
+      declaredLocally: target.declaredLocally
+    });
+  }
+  return report;
+}
+function isUnadoptedNotDeclared(entry) {
+  return !entry.declaredLocally && entry.issues.every((issue2) => issue2.family === "SYSTEM_INTERFACE_MISSING");
+}
+function readinessDiagnostics(report) {
+  const diagnostics = [];
+  for (const entry of report.entries) {
+    if (entry.ready) {
+      diagnostics.push({
+        severity: "info",
+        code: "deployed-interface-ready",
+        systemPath: entry.systemPath,
+        message: `${entry.systemPath}/${entry.interfaceKey} is ready in the deployed snapshot.`
+      });
+      continue;
+    }
+    const unadopted = isUnadoptedNotDeclared(entry);
+    for (const issue2 of entry.issues) {
+      diagnostics.push({
+        severity: unadopted ? "info" : "error",
+        code: `deployed-${issue2.code}`,
+        systemPath: entry.systemPath,
+        ...issue2.ref !== void 0 && { targetId: issue2.ref },
+        message: `${entry.systemPath}/${entry.interfaceKey} ${unadopted ? "not adopted" : "not ready"} [${issue2.family}]: ${issue2.message}`,
+        source: "deployed-snapshot"
+      });
+    }
+  }
+  return diagnostics;
+}
+function readinessRoster(report) {
+  return report.entries.map((entry) => {
+    if (entry.ready) {
+      return {
+        systemPath: entry.systemPath,
+        interfaceKey: entry.interfaceKey,
+        status: "ready",
+        detail: "ready",
+        issues: []
+      };
+    }
+    if (isUnadoptedNotDeclared(entry)) {
+      return {
+        systemPath: entry.systemPath,
+        interfaceKey: entry.interfaceKey,
+        status: "not-adopted",
+        detail: "not adopted",
+        issues: entry.issues
+      };
+    }
+    return {
+      systemPath: entry.systemPath,
+      interfaceKey: entry.interfaceKey,
+      status: "not-ready",
+      detail: entry.issues[0]?.message ?? "not ready",
+      issues: entry.issues
+    };
+  });
+}
+function countReadinessRosterFailures(rows) {
+  return rows.filter((row) => row.status === "not-ready").length;
+}
+
+// src/cli/commands/doctor.ts
 function ok(label, detail) {
   console.log(`${source_default.green("[OK]")}   ${source_default.bold(label)}: ${detail}`);
 }
@@ -55422,6 +56139,38 @@ function registerDoctorCommand(program3) {
       if (isVerbose) verbose(`Error: ${networkError}`);
       failCount++;
     }
+    let model = DEFAULT_ORGANIZATION_MODEL;
+    try {
+      model = await loadOrgModel(projectRoot);
+    } catch (err) {
+      if (isVerbose) {
+        const msg = err instanceof Error ? err.message : String(err);
+        verbose(`Organization model load failed, roster limited to the platform catalog: ${msg}`);
+      }
+    }
+    const readiness = await fetchDeployedReadiness(model, { apiUrl });
+    if (readiness.unavailableReason !== void 0) {
+      warn("Systems", `Readiness unavailable \u2014 ${readiness.unavailableReason}`);
+      if (isVerbose) verbose(`GET ${apiUrl}/api/external/organization-model/readiness`);
+    } else {
+      const rows = readinessRoster(readiness);
+      for (const row of rows) {
+        const label = `Systems: ${row.systemPath}/${row.interfaceKey}`;
+        if (row.status === "ready") {
+          ok(label, row.detail);
+        } else if (row.status === "not-adopted") {
+          warn(label, row.detail);
+        } else {
+          fail(label, row.detail);
+        }
+        if (isVerbose) {
+          for (const issue2 of row.issues) {
+            verbose(`${issue2.code}: ${issue2.message}`);
+          }
+        }
+      }
+      failCount += countReadinessRosterFailures(rows);
+    }
     console.log();
     printSummary(failCount);
     if (failCount > 0) {
@@ -55841,7 +56590,7 @@ function appendQuery4(params, key, value) {
 }
 function registerContentList(program3) {
   program3.command("content:list").description(
-    "List content pipeline items\n  Example: elevasis-sdk content:list --status queued --pipeline-id short-form-repurpose"
+    'List content pipeline items\n  Example: elevasis-sdk content:list --status <status> --pipeline-id <pipelineId>\n  Note: both values come from the org model this project declares, not a platform enum --\n  read them from the content:catalog/status catalog and content:pipeline.\n  Note: "awaiting review" is not a status -- that read is content:queue.'
   ).option("--status <status>", "Filter by content item status").option("--pillar <pillar>", "Filter by content pillar").option("--pipeline-id <id>", "Filter by pipeline template id").option("--client-id <id>", "Filter by client id").option("--reviewed-by <id>", "Filter by reviewer user id").option("--search <query>", "Search by title").option("--limit <n>", "Maximum number of results").option("--offset <n>", "Pagination offset").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API base URL").option("--pretty", "Render human-readable output instead of raw JSON").action(
     wrapAction("content:list", async (options) => {
       const apiUrl = resolveApiUrl(options.apiUrl, options.prod);
@@ -55918,6 +56667,12 @@ Content item: ${item.title}`));
 // src/cli/commands/content/board.ts
 init_source();
 
+// ../core/src/content/review-gates.ts
+function isAwaitingReview(item, step) {
+  if (!step) return false;
+  return step.reviewMode !== "none" && item.reviewedAt === null;
+}
+
 // ../core/src/content/derive-board.ts
 function sortPipelineSteps(steps) {
   return [...steps].sort((a, b) => {
@@ -55941,17 +56696,13 @@ function deriveItemPlacement(item, sortedSteps) {
   });
   if (!currentStep) {
     const lastStep = sortedSteps[sortedSteps.length - 1];
-    if (lastStep !== void 0 && lastStep.reviewMode !== "none" && item.reviewedAt === null) {
+    if (lastStep !== void 0 && isAwaitingReview(item, lastStep)) {
       return { bucket: "column", stepKey: lastStep.key };
     }
     return { bucket: "done", stepKey: null };
   }
   return { bucket: "column", stepKey: currentStep.key };
 }
-function deriveAwaitingReview(step, item) {
-  if (!step) return false;
-  return step.reviewMode !== "none" && item.reviewedAt === null;
-}
 function deriveContentBoard(items, pipeline, now) {
   const sortedSteps = sortPipelineSteps(pipeline.steps);
   const stepsByKey = new Map(sortedSteps.map((step) => [step.key, step]));
@@ -55965,7 +56716,7 @@ function deriveContentBoard(items, pipeline, now) {
       item,
       stepKey: placement.stepKey,
       ageMs: now - Date.parse(item.updatedAt),
-      awaitingReview: deriveAwaitingReview(step, item)
+      awaitingReview: isAwaitingReview(item, step)
     };
     if (placement.bucket === "done") {
       done.push(card);
@@ -55989,9 +56740,9 @@ function deriveContentBoard(items, pipeline, now) {
   const columns = sortedSteps.map((step) => {
     const cards = cardsByStepKey.get(step.key) ?? [];
     const column = { step, cards };
-    if (step.reviewMode === "live" || step.reviewMode === "queued") {
+    if (step.reviewVenue !== "none") {
       column.gate = {
-        reviewMode: step.reviewMode,
+        venue: step.reviewVenue,
         waitingCount: cards.filter((card) => card.awaitingReview).length
       };
     }
@@ -56077,7 +56828,7 @@ function printCards(cards, stepsByKey) {
 }
 function registerContentBoard(program3) {
   program3.command("content:board <pipelineId>").description(
-    "Render one pipeline as a board -- columns, review gates, and waiting counts\n  Example: elevasis-sdk content:board short-form-repurpose --pretty"
+    "Render one pipeline as a board -- columns, review gates, and waiting counts\n  Example: elevasis-sdk content:board <pipelineId> --pretty\n  Note: pipeline ids come from the org model this project declares -- list them with content:pipeline."
   ).option("--limit <n>", `Items to pull before deriving (default and API maximum ${DEFAULT_ITEM_LIMIT})`).option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API base URL").option("--pretty", "Render human-readable output instead of raw JSON").action(
     wrapAction("content:board", async (pipelineId, options) => {
       const apiUrl = resolveApiUrl(options.apiUrl, options.prod);
@@ -56108,7 +56859,9 @@ Board: ${pipelineId}  ${source_default.gray(`${items.data.length} of ${items.tot
       }
       console.log();
       for (const column of board.columns) {
-        const gate = column.gate ? source_default.yellow(`  [${column.gate.reviewMode} gate -- ${column.gate.waitingCount} waiting]`) : "";
+        const gate = column.gate ? source_default.yellow(
+          `  [${column.gate.venue === "workspace" ? "workspace" : "queue"} gate -- ${column.gate.waitingCount} waiting]`
+        ) : "";
         console.log(`  ${source_default.bold(column.step.label)} ${source_default.gray(column.step.key)}${gate}`);
         printCards(column.cards, stepsByKey);
       }
@@ -56170,13 +56923,13 @@ Pipeline: ${pipeline.id}`));
   const steps = Array.isArray(pipeline.steps) ? pipeline.steps : [];
   console.log(source_default.gray(`  Steps (${steps.length}):`));
   for (const step of steps) {
-    console.log(source_default.gray(`    - ${step.key} (reviewMode: ${step.reviewMode})`));
+    console.log(source_default.gray(`    - ${step.key} (review: ${step.reviewMode}, venue: ${step.reviewVenue})`));
   }
   console.log();
 }
 function registerContentPipeline(program3) {
   program3.command("content:pipeline [id]").description(
-    "List content pipeline templates, or show one pipeline's step contract\n  Example: elevasis-sdk content:pipeline short-form-repurpose"
+    "List content pipeline templates, or show one pipeline's step contract\n  Example: elevasis-sdk content:pipeline <pipelineId>\n  Note: run without an id to list the pipeline ids this project declares in its org model."
   ).option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API base URL").option("--pretty", "Render human-readable output instead of raw JSON").action(
     wrapAction("content:pipeline", async (id, options) => {
       const apiUrl = resolveApiUrl(options.apiUrl, options.prod);
@@ -56221,7 +56974,7 @@ function appendQuery5(params, key, value) {
 }
 function registerContentDistributions(program3) {
   program3.command("content:distributions").description(
-    "List content distributions\n  Example: elevasis-sdk content:distributions --pipeline-id short-form-repurpose"
+    "List content distributions\n  Example: elevasis-sdk content:distributions --pipeline-id <pipelineId>\n  Note: pipeline ids come from the org model this project declares -- list them with content:pipeline."
   ).option("--content-item-id <id>", "Filter by content item id").option("--pipeline-id <id>", "Filter by pipeline template id").option("--platform <platform>", "Filter by distribution platform").option("--status <status>", "Filter by distribution status").option("--limit <n>", "Maximum number of results").option("--offset <n>", "Pagination offset").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API base URL").option("--pretty", "Render human-readable output instead of raw JSON").action(
     wrapAction("content:distributions", async (options) => {
       const apiUrl = resolveApiUrl(options.apiUrl, options.prod);
@@ -56404,13 +57157,47 @@ function resolveTextArgument(value) {
     throw new Error(`Could not read --text file "${path3}": ${error46 instanceof Error ? error46.message : String(error46)}`);
   }
 }
+function resolveMetadataOption(options) {
+  if (options.metadata !== void 0 && options.metadataFile !== void 0) {
+    throw new Error("Pass exactly one of --metadata or --metadata-file, not both");
+  }
+  let raw;
+  if (options.metadataFile !== void 0) {
+    const path3 = resolveProjectRelative(options.metadataFile);
+    try {
+      raw = (0, import_node_fs10.readFileSync)(path3, "utf8");
+    } catch (error46) {
+      throw new Error(
+        `Could not read --metadata-file "${options.metadataFile}": ${error46 instanceof Error ? error46.message : String(error46)}`
+      );
+    }
+  } else {
+    raw = options.metadata;
+  }
+  if (raw === void 0) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error46) {
+    const source = options.metadataFile !== void 0 ? "--metadata-file" : "--metadata";
+    throw new Error(`${source} must be valid JSON: ${error46 instanceof Error ? error46.message : String(error46)}`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    const source = options.metadataFile !== void 0 ? "--metadata-file" : "--metadata";
+    throw new Error(`${source} must be a JSON object, e.g. {"key":"value"}`);
+  }
+  return parsed;
+}
 function registerContentSourceAssetCreate(program3) {
   program3.command("content:source-asset:create").description(
     'Create a content source asset from inline text or a URL, optionally linking it to an item\n  Example: elevasis-sdk content:source-asset:create --kind transcript --title "Episode 12" --text @transcript.txt --item <uuid>'
   ).requiredOption("--kind <kind>", "Source asset kind (e.g. transcript) -- validated against the org model catalog").requiredOption("--title <title>", "Human-readable title (1..500 chars)").option("--text <value>", "Inline text, or @path to read a local file. Mutually exclusive with --url").option(
     "--field <key>",
     "Payload field the --text content is written to. Defaults to the --kind value, matching the catalog declaration"
-  ).option("--url <url>", "External URL the asset references. Mutually exclusive with --text").option("--duration <seconds>", "Duration in seconds, for time-based referenced media").option("--item <itemId>", "Link the new asset to this content item after creating it").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API base URL").option("--pretty", "Render human-readable output instead of raw JSON").action(
+  ).option("--url <url>", "External URL the asset references. Mutually exclusive with --text").option("--duration <seconds>", "Duration in seconds, for time-based referenced media").option("--storage-path <path>", "Storage path the asset references (1..2000 chars)").option("--metadata <json>", "Arbitrary metadata as a JSON object string. Mutually exclusive with --metadata-file").option(
+    "--metadata-file <path>",
+    "Path to a JSON file containing metadata (project-relative unless absolute). Mutually exclusive with --metadata"
+  ).option("--item <itemId>", "Link the new asset to this content item after creating it").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API base URL").option("--pretty", "Render human-readable output instead of raw JSON").action(
     wrapAction("content:source-asset:create", async (options) => {
       if (options.text !== void 0 && options.url !== void 0) {
         throw new Error("Pass exactly one of --text or --url, not both");
@@ -56441,6 +57228,9 @@ function registerContentSourceAssetCreate(program3) {
         }
         body.durationSeconds = duration3;
       }
+      if (options.storagePath !== void 0) body.storagePath = options.storagePath;
+      const metadata = resolveMetadataOption(options);
+      if (metadata !== void 0) body.metadata = metadata;
       const apiUrl = resolveApiUrl(options.apiUrl, options.prod);
       const asset = await apiPost("/api/external/content/source-assets", body, apiUrl);
       let linkedItem;
@@ -56460,6 +57250,7 @@ Created source asset ${asset.id}`));
       console.log(source_default.gray(`  Title: ${asset.title}`));
       console.log(source_default.gray(`  Kind: ${asset.kind}`));
       if (asset.externalUrl) console.log(source_default.gray(`  URL: ${asset.externalUrl}`));
+      if (asset.storagePath) console.log(source_default.gray(`  Storage path: ${asset.storagePath}`));
       if (linkedItem) console.log(source_default.cyan(`  Linked to item ${linkedItem.id} (${linkedItem.title})`));
       console.log();
     })
@@ -57836,71 +58627,6 @@ function formatOmDoctorReport(report) {
   return lines.join("\n");
 }
 
-// src/cli/commands/om/deployed-readiness.ts
-init_organization_model();
-init_api_client();
-function listApiInterfaceSystemPaths(model) {
-  return listAllSystems(model).filter(({ system }) => system.apiInterface !== void 0).map(({ path: path3 }) => path3);
-}
-async function fetchDeployedReadiness(model, options = {}) {
-  const systemPaths = listApiInterfaceSystemPaths(model);
-  const report = {
-    activeDeploymentId: null,
-    snapshotHash: null,
-    kind: null,
-    entries: []
-  };
-  if (systemPaths.length === 0) {
-    report.unavailableReason = "no System in the project model declares an apiInterface";
-    return report;
-  }
-  for (const systemPath of systemPaths) {
-    let response;
-    try {
-      const endpoint = `/api/external/organization-model/readiness?systemPath=${encodeURIComponent(systemPath)}&interfaceKey=api`;
-      response = await apiGet(endpoint, options.apiUrl);
-    } catch (error46) {
-      report.unavailableReason = error46 instanceof Error ? error46.message : String(error46);
-      return report;
-    }
-    report.activeDeploymentId = response.activeDeploymentId;
-    report.snapshotHash = response.snapshotHash;
-    report.kind = response.kind;
-    report.entries.push({
-      systemPath: response.readiness.systemPath,
-      interfaceKey: response.readiness.interfaceKey,
-      ready: response.readiness.ready,
-      issues: response.readiness.issues
-    });
-  }
-  return report;
-}
-function readinessDiagnostics(report) {
-  const diagnostics = [];
-  for (const entry of report.entries) {
-    if (entry.ready) {
-      diagnostics.push({
-        severity: "info",
-        code: "deployed-interface-ready",
-        systemPath: entry.systemPath,
-        message: `${entry.systemPath}/${entry.interfaceKey} is ready in the deployed snapshot.`
-      });
-      continue;
-    }
-    for (const issue2 of entry.issues) {
-      diagnostics.push({
-        severity: "error",
-        code: `deployed-${issue2.code}`,
-        systemPath: entry.systemPath,
-        ...issue2.ref !== void 0 && { targetId: issue2.ref },
-        message: `${entry.systemPath}/${entry.interfaceKey} not ready [${issue2.family}]: ${issue2.message}`,
-        source: "deployed-snapshot"
-      });
-    }
-  }
-  return diagnostics;
-}
-
 // src/cli/commands/om/doctor.ts
 function registerOmDoctorCommand(program3) {
   program3.command("om:doctor").description(
@@ -58714,65 +59440,7 @@ if (envPath) {
 }
 var program2 = new Command();
 program2.name("elevasis-sdk").description(
-  source_default.cyan("Elevasis SDK CLI") + `
-
-Commands:
-  elevasis-sdk check                                Validate project resources
-  elevasis-sdk deploy                               Bundle and deploy to platform
-  elevasis-sdk resources                            List deployed resources
-  elevasis-sdk describe <resourceId>                Describe a resource
-  elevasis-sdk exec <resourceId> -i '{}'            Execute a resource
-  elevasis-sdk executions <resourceId>              List execution history
-  elevasis-sdk execution <resourceId> <id>          Get execution details
-  elevasis-sdk execution:cancel <resourceId> <id>   Cancel a running execution
-  elevasis-sdk executions:delete <resourceId>       Delete execution history (destructive)
-  elevasis-sdk deployments                          List deployments
-  elevasis-sdk project:list [--search <query>]      List projects with optional search
-  elevasis-sdk project:resolve <query>              Resolve a project ID from a name or UUID
-  elevasis-sdk project:work <query>                 Open a lifecycle-aware project work brief
-  elevasis-sdk client:list [--search <query>]       List clients with optional search
-  elevasis-sdk client:get <id>                      Get client detail and lineage
-  elevasis-sdk client:status                        Show client portfolio status
-  elevasis-sdk content:list [--status queued]       List content pipeline items
-  elevasis-sdk content:get <itemId>                 Get an item, its attempts, and distributions
-  elevasis-sdk content:queue                        List items awaiting a queued-gate review
-  elevasis-sdk content:pipeline [id]                List pipeline templates, or one step contract
-  elevasis-sdk content:distributions                List content distributions
-  elevasis-sdk content:review <itemId> --step <key> --approve|--reject --user <email>
-                                                     Clear a queued review gate on a content item
-  elevasis-sdk queue:list [--status pending]        List HITL command queue tasks
-  elevasis-sdk queue:select <id> --action-id <id>   Select and execute a HITL queue action
-  elevasis-sdk schedule:list [--status active]      List task schedules
-  elevasis-sdk schedule:create --name <name> ...    Create a task schedule
-  elevasis-sdk agent:list                           List deployed agents
-  elevasis-sdk agent:get <id>                       Get agent metadata and OM linkage
-  elevasis-sdk session:create <resourceId>          Create an agent session
-  elevasis-sdk session:turn <id> -f tmp/turn.json   Execute a session turn
-  elevasis-sdk session:messages <id>                Export session transcript messages
-  elevasis-sdk session:list                         List agent sessions
-  elevasis-sdk session:get <id>                     Get session details
-  elevasis-sdk session:end <id>                     End an active agent session
-  elevasis-sdk grant:list                           List public/code-gated agent access grants
-  elevasis-sdk grant:create --resource <id>       Create an agent access grant
-  elevasis-sdk grant:disable <slug>                  Disable an agent access grant
-  elevasis-sdk acquisition:list:list                 List acquisition lists
-  elevasis-sdk acquisition:deal:list                 List acquisition deals
-  elevasis-sdk knowledge:generate                   Generate knowledge nodes from MDX files
-  elevasis-sdk knowledge:ls <path>                  List knowledge nodes for a path
-  elevasis-sdk knowledge:cat <id>                   Print raw MDX body of a knowledge node
-  elevasis-sdk knowledge:graph <id>                 Show outgoing and incoming edges for a node
-  elevasis-sdk request:submit -f <path>             Submit a structured request report
-  elevasis-sdk request:list [--status open]         List reported requests
-  elevasis-sdk request:get <id>                     Get a reported request by id
-  elevasis-sdk request:update <id> -i <json>        Amend a request you filed
-  elevasis-sdk request:delete <id>                  Withdraw a request you filed
-  elevasis-sdk ui:use-local                         Use a local @elevasis/ui tarball
-  elevasis-sdk ui:use-published                     Restore published @elevasis/ui
-  elevasis-sdk cli [domain]                         Generate a registered command catalog
-  elevasis-sdk rename <id> --to <newId> [--prod]     Rename resource across platform tables
-  elevasis-sdk doctor [--verbose]                    Check project environment and API connectivity
-
-Use "elevasis-sdk <command> --help" for more information about a command.`
+  source_default.cyan("Elevasis SDK CLI") + '\n\nRun `elevasis-sdk cli` for the full command catalog. It is built by scanning the\ncommands actually registered below, so it can never drift out of sync the way a\nhand-written list here would.\n\n  elevasis-sdk cli                      Full catalog, grouped by domain\n  elevasis-sdk cli --domain <domain>    Filter to one domain, e.g. project, content, agent\n  elevasis-sdk cli --format json         Machine-readable catalog\n\nUse "elevasis-sdk <command> --help" for a specific command\'s options.'
 ).version(SDK_VERSION);
 program2.hook("preAction", () => {
   runPreflight();