agent-contracts 0.19.5 → 0.21.0

package/dist/cli.js

@@ -40457,9 +40457,9 @@ var require_errors = __commonJS({
   }
 });
 
-// node_modules/ajv-formats/dist/formats.js
+// node_modules/@stoplight/spectral-core/node_modules/ajv-formats/dist/formats.js
 var require_formats2 = __commonJS({
-  "node_modules/ajv-formats/dist/formats.js"(exports) {
+  "node_modules/@stoplight/spectral-core/node_modules/ajv-formats/dist/formats.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.formatNames = exports.fastFormats = exports.fullFormats = void 0;
@@ -40624,9 +40624,9 @@ var require_formats2 = __commonJS({
   }
 });
 
-// node_modules/ajv-formats/dist/limit.js
+// node_modules/@stoplight/spectral-core/node_modules/ajv-formats/dist/limit.js
 var require_limit = __commonJS({
-  "node_modules/ajv-formats/dist/limit.js"(exports) {
+  "node_modules/@stoplight/spectral-core/node_modules/ajv-formats/dist/limit.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.formatLimitDefinition = void 0;
@@ -40696,9 +40696,9 @@ var require_limit = __commonJS({
   }
 });
 
-// node_modules/ajv-formats/dist/index.js
+// node_modules/@stoplight/spectral-core/node_modules/ajv-formats/dist/index.js
 var require_dist7 = __commonJS({
-  "node_modules/ajv-formats/dist/index.js"(exports, module) {
+  "node_modules/@stoplight/spectral-core/node_modules/ajv-formats/dist/index.js"(exports, module) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     var formats_1 = require_formats2();
@@ -48101,6 +48101,287 @@ var require_dist12 = __commonJS({
   }
 });
 
+// node_modules/@stoplight/spectral-functions/node_modules/ajv-formats/dist/formats.js
+var require_formats3 = __commonJS({
+  "node_modules/@stoplight/spectral-functions/node_modules/ajv-formats/dist/formats.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.formatNames = exports.fastFormats = exports.fullFormats = void 0;
+    function fmtDef(validate, compare) {
+      return { validate, compare };
+    }
+    exports.fullFormats = {
+      // date: http://tools.ietf.org/html/rfc3339#section-5.6
+      date: fmtDef(date, compareDate),
+      // date-time: http://tools.ietf.org/html/rfc3339#section-5.6
+      time: fmtDef(time, compareTime),
+      "date-time": fmtDef(date_time, compareDateTime),
+      // duration: https://tools.ietf.org/html/rfc3339#appendix-A
+      duration: /^P(?!$)((\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+S)?)?|(\d+W)?)$/,
+      uri,
+      "uri-reference": /^(?:[a-z][a-z0-9+\-.]*:)?(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'"()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*)?(?:\?(?:[a-z0-9\-._~!$&'"()*+,;=:@/?]|%[0-9a-f]{2})*)?(?:#(?:[a-z0-9\-._~!$&'"()*+,;=:@/?]|%[0-9a-f]{2})*)?$/i,
+      // uri-template: https://tools.ietf.org/html/rfc6570
+      "uri-template": /^(?:(?:[^\x00-\x20"'<>%\\^`{|}]|%[0-9a-f]{2})|\{[+#./;?&=,!@|]?(?:[a-z0-9_]|%[0-9a-f]{2})+(?::[1-9][0-9]{0,3}|\*)?(?:,(?:[a-z0-9_]|%[0-9a-f]{2})+(?::[1-9][0-9]{0,3}|\*)?)*\})*$/i,
+      // For the source: https://gist.github.com/dperini/729294
+      // For test cases: https://mathiasbynens.be/demo/url-regex
+      url: /^(?:https?|ftp):\/\/(?:\S+(?::\S*)?@)?(?:(?!(?:10|127)(?:\.\d{1,3}){3})(?!(?:169\.254|192\.168)(?:\.\d{1,3}){2})(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u{00a1}-\u{ffff}]+-)*[a-z0-9\u{00a1}-\u{ffff}]+)(?:\.(?:[a-z0-9\u{00a1}-\u{ffff}]+-)*[a-z0-9\u{00a1}-\u{ffff}]+)*(?:\.(?:[a-z\u{00a1}-\u{ffff}]{2,})))(?::\d{2,5})?(?:\/[^\s]*)?$/iu,
+      email: /^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i,
+      hostname: /^(?=.{1,253}\.?$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[-0-9a-z]{0,61}[0-9a-z])?)*\.?$/i,
+      // optimized https://www.safaribooksonline.com/library/view/regular-expressions-cookbook/9780596802837/ch07s16.html
+      ipv4: /^(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)$/,
+      ipv6: /^((([0-9a-f]{1,4}:){7}([0-9a-f]{1,4}|:))|(([0-9a-f]{1,4}:){6}(:[0-9a-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9a-f]{1,4}:){5}(((:[0-9a-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9a-f]{1,4}:){4}(((:[0-9a-f]{1,4}){1,3})|((:[0-9a-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){3}(((:[0-9a-f]{1,4}){1,4})|((:[0-9a-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){2}(((:[0-9a-f]{1,4}){1,5})|((:[0-9a-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){1}(((:[0-9a-f]{1,4}){1,6})|((:[0-9a-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9a-f]{1,4}){1,7})|((:[0-9a-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))$/i,
+      regex,
+      // uuid: http://tools.ietf.org/html/rfc4122
+      uuid: /^(?:urn:uuid:)?[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i,
+      // JSON-pointer: https://tools.ietf.org/html/rfc6901
+      // uri fragment: https://tools.ietf.org/html/rfc3986#appendix-A
+      "json-pointer": /^(?:\/(?:[^~/]|~0|~1)*)*$/,
+      "json-pointer-uri-fragment": /^#(?:\/(?:[a-z0-9_\-.!$&'()*+,;:=@]|%[0-9a-f]{2}|~0|~1)*)*$/i,
+      // relative JSON-pointer: http://tools.ietf.org/html/draft-luff-relative-json-pointer-00
+      "relative-json-pointer": /^(?:0|[1-9][0-9]*)(?:#|(?:\/(?:[^~/]|~0|~1)*)*)$/,
+      // the following formats are used by the openapi specification: https://spec.openapis.org/oas/v3.0.0#data-types
+      // byte: https://github.com/miguelmota/is-base64
+      byte,
+      // signed 32 bit integer
+      int32: { type: "number", validate: validateInt32 },
+      // signed 64 bit integer
+      int64: { type: "number", validate: validateInt64 },
+      // C-type float
+      float: { type: "number", validate: validateNumber },
+      // C-type double
+      double: { type: "number", validate: validateNumber },
+      // hint to the UI to hide input strings
+      password: true,
+      // unchecked string payload
+      binary: true
+    };
+    exports.fastFormats = {
+      ...exports.fullFormats,
+      date: fmtDef(/^\d\d\d\d-[0-1]\d-[0-3]\d$/, compareDate),
+      time: fmtDef(/^(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:z|[+-]\d\d(?::?\d\d)?)?$/i, compareTime),
+      "date-time": fmtDef(/^\d\d\d\d-[0-1]\d-[0-3]\d[t\s](?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:z|[+-]\d\d(?::?\d\d)?)$/i, compareDateTime),
+      // uri: https://github.com/mafintosh/is-my-json-valid/blob/master/formats.js
+      uri: /^(?:[a-z][a-z0-9+\-.]*:)(?:\/?\/)?[^\s]*$/i,
+      "uri-reference": /^(?:(?:[a-z][a-z0-9+\-.]*:)?\/?\/)?(?:[^\\\s#][^\s#]*)?(?:#[^\\\s]*)?$/i,
+      // email (sources from jsen validator):
+      // http://stackoverflow.com/questions/201323/using-a-regular-expression-to-validate-an-email-address#answer-8829363
+      // http://www.w3.org/TR/html5/forms.html#valid-e-mail-address (search for 'wilful violation')
+      email: /^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i
+    };
+    exports.formatNames = Object.keys(exports.fullFormats);
+    function isLeapYear(year) {
+      return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+    }
+    var DATE = /^(\d\d\d\d)-(\d\d)-(\d\d)$/;
+    var DAYS = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+    function date(str) {
+      const matches = DATE.exec(str);
+      if (!matches)
+        return false;
+      const year = +matches[1];
+      const month = +matches[2];
+      const day = +matches[3];
+      return month >= 1 && month <= 12 && day >= 1 && day <= (month === 2 && isLeapYear(year) ? 29 : DAYS[month]);
+    }
+    function compareDate(d1, d2) {
+      if (!(d1 && d2))
+        return void 0;
+      if (d1 > d2)
+        return 1;
+      if (d1 < d2)
+        return -1;
+      return 0;
+    }
+    var TIME = /^(\d\d):(\d\d):(\d\d)(\.\d+)?(z|[+-]\d\d(?::?\d\d)?)?$/i;
+    function time(str, withTimeZone) {
+      const matches = TIME.exec(str);
+      if (!matches)
+        return false;
+      const hour = +matches[1];
+      const minute = +matches[2];
+      const second = +matches[3];
+      const timeZone = matches[5];
+      return (hour <= 23 && minute <= 59 && second <= 59 || hour === 23 && minute === 59 && second === 60) && (!withTimeZone || timeZone !== "");
+    }
+    function compareTime(t1, t22) {
+      if (!(t1 && t22))
+        return void 0;
+      const a1 = TIME.exec(t1);
+      const a22 = TIME.exec(t22);
+      if (!(a1 && a22))
+        return void 0;
+      t1 = a1[1] + a1[2] + a1[3] + (a1[4] || "");
+      t22 = a22[1] + a22[2] + a22[3] + (a22[4] || "");
+      if (t1 > t22)
+        return 1;
+      if (t1 < t22)
+        return -1;
+      return 0;
+    }
+    var DATE_TIME_SEPARATOR = /t|\s/i;
+    function date_time(str) {
+      const dateTime = str.split(DATE_TIME_SEPARATOR);
+      return dateTime.length === 2 && date(dateTime[0]) && time(dateTime[1], true);
+    }
+    function compareDateTime(dt1, dt2) {
+      if (!(dt1 && dt2))
+        return void 0;
+      const [d1, t1] = dt1.split(DATE_TIME_SEPARATOR);
+      const [d2, t22] = dt2.split(DATE_TIME_SEPARATOR);
+      const res = compareDate(d1, d2);
+      if (res === void 0)
+        return void 0;
+      return res || compareTime(t1, t22);
+    }
+    var NOT_URI_FRAGMENT = /\/|:/;
+    var URI = /^(?:[a-z][a-z0-9+\-.]*:)(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)(?:\?(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?(?:#(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?$/i;
+    function uri(str) {
+      return NOT_URI_FRAGMENT.test(str) && URI.test(str);
+    }
+    var BYTE = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/gm;
+    function byte(str) {
+      BYTE.lastIndex = 0;
+      return BYTE.test(str);
+    }
+    var MIN_INT32 = -(2 ** 31);
+    var MAX_INT32 = 2 ** 31 - 1;
+    function validateInt32(value) {
+      return Number.isInteger(value) && value <= MAX_INT32 && value >= MIN_INT32;
+    }
+    function validateInt64(value) {
+      return Number.isInteger(value);
+    }
+    function validateNumber() {
+      return true;
+    }
+    var Z_ANCHOR = /[^\\]\\Z/;
+    function regex(str) {
+      if (Z_ANCHOR.test(str))
+        return false;
+      try {
+        new RegExp(str);
+        return true;
+      } catch (e3) {
+        return false;
+      }
+    }
+  }
+});
+
+// node_modules/@stoplight/spectral-functions/node_modules/ajv-formats/dist/limit.js
+var require_limit2 = __commonJS({
+  "node_modules/@stoplight/spectral-functions/node_modules/ajv-formats/dist/limit.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.formatLimitDefinition = void 0;
+    var ajv_1 = __require("ajv");
+    var codegen_1 = __require("ajv/dist/compile/codegen");
+    var ops = codegen_1.operators;
+    var KWDs = {
+      formatMaximum: { okStr: "<=", ok: ops.LTE, fail: ops.GT },
+      formatMinimum: { okStr: ">=", ok: ops.GTE, fail: ops.LT },
+      formatExclusiveMaximum: { okStr: "<", ok: ops.LT, fail: ops.GTE },
+      formatExclusiveMinimum: { okStr: ">", ok: ops.GT, fail: ops.LTE }
+    };
+    var error = {
+      message: ({ keyword, schemaCode }) => codegen_1.str`should be ${KWDs[keyword].okStr} ${schemaCode}`,
+      params: ({ keyword, schemaCode }) => codegen_1._`{comparison: ${KWDs[keyword].okStr}, limit: ${schemaCode}}`
+    };
+    exports.formatLimitDefinition = {
+      keyword: Object.keys(KWDs),
+      type: "string",
+      schemaType: "string",
+      $data: true,
+      error,
+      code(cxt) {
+        const { gen, data, schemaCode, keyword, it } = cxt;
+        const { opts, self: self2 } = it;
+        if (!opts.validateFormats)
+          return;
+        const fCxt = new ajv_1.KeywordCxt(it, self2.RULES.all.format.definition, "format");
+        if (fCxt.$data)
+          validate$DataFormat();
+        else
+          validateFormat();
+        function validate$DataFormat() {
+          const fmts = gen.scopeValue("formats", {
+            ref: self2.formats,
+            code: opts.code.formats
+          });
+          const fmt = gen.const("fmt", codegen_1._`${fmts}[${fCxt.schemaCode}]`);
+          cxt.fail$data(codegen_1.or(codegen_1._`typeof ${fmt} != "object"`, codegen_1._`${fmt} instanceof RegExp`, codegen_1._`typeof ${fmt}.compare != "function"`, compareCode(fmt)));
+        }
+        function validateFormat() {
+          const format2 = fCxt.schema;
+          const fmtDef = self2.formats[format2];
+          if (!fmtDef || fmtDef === true)
+            return;
+          if (typeof fmtDef != "object" || fmtDef instanceof RegExp || typeof fmtDef.compare != "function") {
+            throw new Error(`"${keyword}": format "${format2}" does not define "compare" function`);
+          }
+          const fmt = gen.scopeValue("formats", {
+            key: format2,
+            ref: fmtDef,
+            code: opts.code.formats ? codegen_1._`${opts.code.formats}${codegen_1.getProperty(format2)}` : void 0
+          });
+          cxt.fail$data(compareCode(fmt));
+        }
+        function compareCode(fmt) {
+          return codegen_1._`${fmt}.compare(${data}, ${schemaCode}) ${KWDs[keyword].fail} 0`;
+        }
+      },
+      dependencies: ["format"]
+    };
+    var formatLimitPlugin = (ajv2) => {
+      ajv2.addKeyword(exports.formatLimitDefinition);
+      return ajv2;
+    };
+    exports.default = formatLimitPlugin;
+  }
+});
+
+// node_modules/@stoplight/spectral-functions/node_modules/ajv-formats/dist/index.js
+var require_dist13 = __commonJS({
+  "node_modules/@stoplight/spectral-functions/node_modules/ajv-formats/dist/index.js"(exports, module) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    var formats_1 = require_formats3();
+    var limit_1 = require_limit2();
+    var codegen_1 = __require("ajv/dist/compile/codegen");
+    var fullName = new codegen_1.Name("fullFormats");
+    var fastName = new codegen_1.Name("fastFormats");
+    var formatsPlugin = (ajv2, opts = { keywords: true }) => {
+      if (Array.isArray(opts)) {
+        addFormats(ajv2, opts, formats_1.fullFormats, fullName);
+        return ajv2;
+      }
+      const [formats, exportName] = opts.mode === "fast" ? [formats_1.fastFormats, fastName] : [formats_1.fullFormats, fullName];
+      const list = opts.formats || formats_1.formatNames;
+      addFormats(ajv2, list, formats, exportName);
+      if (opts.keywords)
+        limit_1.default(ajv2);
+      return ajv2;
+    };
+    formatsPlugin.get = (name, mode = "full") => {
+      const formats = mode === "fast" ? formats_1.fastFormats : formats_1.fullFormats;
+      const f2 = formats[name];
+      if (!f2)
+        throw new Error(`Unknown format "${name}"`);
+      return f2;
+    };
+    function addFormats(ajv2, list, fs, exportName) {
+      var _a;
+      var _b;
+      (_a = (_b = ajv2.opts.code).formats) !== null && _a !== void 0 ? _a : _b.formats = codegen_1._`require("ajv-formats/dist/formats").${exportName}`;
+      for (const f2 of list)
+        ajv2.addFormat(f2, fs[f2]);
+    }
+    module.exports = exports = formatsPlugin;
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.default = formatsPlugin;
+  }
+});
+
 // node_modules/@stoplight/spectral-functions/dist/schema/draft4.json
 var require_draft42 = __commonJS({
   "node_modules/@stoplight/spectral-functions/dist/schema/draft4.json"(exports, module) {
@@ -48255,7 +48536,7 @@ var require_ajv2 = __commonJS({
     var _2019_1 = (0, tslib_1.__importDefault)(__require("ajv/dist/2019"));
     var _2020_1 = (0, tslib_1.__importDefault)(__require("ajv/dist/2020"));
     var ajv_draft_04_1 = (0, tslib_1.__importDefault)(require_dist12());
-    var ajv_formats_1 = (0, tslib_1.__importDefault)(require_dist7());
+    var ajv_formats_1 = (0, tslib_1.__importDefault)(require_dist13());
     var ajv_errors_1 = (0, tslib_1.__importDefault)(require_dist8());
     var draft6MetaSchema = (0, tslib_1.__importStar)(__require("ajv/dist/refs/json-schema-draft-06.json"));
     var draft4MetaSchema = (0, tslib_1.__importStar)(require_draft42());
@@ -48546,7 +48827,7 @@ var require_or = __commonJS({
 });
 
 // node_modules/@stoplight/spectral-functions/dist/index.js
-var require_dist13 = __commonJS({
+var require_dist14 = __commonJS({
   "node_modules/@stoplight/spectral-functions/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -52251,7 +52532,7 @@ function lint(dsl, rules = builtinRules) {
 var import_spectral_core7 = __toESM(require_dist9(), 1);
 
 // src/linter/spectral/ruleset.ts
-var import_spectral_functions = __toESM(require_dist13(), 1);
+var import_spectral_functions = __toESM(require_dist14(), 1);
 
 // src/linter/spectral/functions/ref-exists.ts
 var import_spectral_core = __toESM(require_dist9(), 1);
@@ -52709,2184 +52990,1738 @@ var ruleset = {
       severity: "error",
       given: "$.tools.*",
       then: {
-        field: "invokable_by",
-        function: ref_exists_default,
-        functionOptions: { referenceTo: "agents" }
-      }
-    },
-    // ========== 15.2.2 Artifact responsibility integrity ==========
-    "artifact-editors-not-empty": {
-      description: "Artifact editors must not be empty (15.2.2)",
-      message: "{{error}}",
-      severity: "error",
-      given: "$.artifacts.*.editors",
-      then: {
-        function: editors_not_empty_default
-      }
-    },
-    "artifact-owner-exists": {
-      description: "Every artifact must have an owner",
-      severity: "error",
-      given: "$.artifacts.*",
-      then: {
-        field: "owner",
-        function: import_spectral_functions.truthy
-      }
-    },
-    // ========== 15.2.5 Handoff integrity ==========
-    "workflow-step-refs": {
-      description: "Workflow step references (task, from_agent, gate_kind, handoff_kind, validation) must exist",
-      message: "{{error}}",
-      severity: "error",
-      given: "$.workflow.*",
-      then: {
-        function: workflow_handoff_kind_exists_default
-      }
-    },
-    // ========== 15.2.7 Agent behavioral spec integrity ==========
-    "readonly-agent-no-writes": {
-      description: 'Agent with mode "read-only" must have empty can_write_artifacts',
-      message: "{{error}}",
-      severity: "error",
-      given: "$.agents.*",
-      then: {
-        function: readonly_no_writes_default
-      }
-    },
-    "agent-prerequisite-readable": {
-      description: "Agent prerequisites target must be in can_read_artifacts",
-      message: "{{error}}",
-      severity: "error",
-      given: "$.agents.*",
-      then: {
-        function: prerequisite_readable_default
-      }
-    },
-    // ========== 15.2.10 Handoff schema integrity ==========
-    "handoff-payload-integrity": {
-      description: "Handoff schema required/properties consistency, enum non-empty, nested validation",
-      message: "{{error}}",
-      severity: "error",
-      given: "$.handoff_types.*.schema",
-      then: {
-        function: payload_schema_integrity_default
-      }
-    },
-    // ========== naming convention ==========
-    "agent-key-casing": {
-      description: "Agent keys must use kebab-case",
-      severity: "warn",
-      given: "$.agents",
-      then: {
-        field: "@key",
-        function: import_spectral_functions.casing,
-        functionOptions: { type: "kebab" }
-      }
-    },
-    "task-key-casing": {
-      description: "Task keys must use kebab-case",
-      severity: "warn",
-      given: "$.tasks",
-      then: {
-        field: "@key",
-        function: import_spectral_functions.casing,
-        functionOptions: { type: "kebab" }
-      }
-    },
-    "artifact-key-casing": {
-      description: "Artifact keys must use kebab-case",
-      severity: "warn",
-      given: "$.artifacts",
-      then: {
-        field: "@key",
-        function: import_spectral_functions.casing,
-        functionOptions: { type: "kebab" }
-      }
-    },
-    "tool-key-casing": {
-      description: "Tool keys must use kebab-case",
-      severity: "warn",
-      given: "$.tools",
-      then: {
-        field: "@key",
-        function: import_spectral_functions.casing,
-        functionOptions: { type: "kebab" }
-      }
-    },
-    "validation-key-casing": {
-      description: "Validation keys must use kebab-case",
-      severity: "warn",
-      given: "$.validations",
-      then: {
-        field: "@key",
-        function: import_spectral_functions.casing,
-        functionOptions: { type: "kebab" }
-      }
-    },
-    "handoff-type-key-casing": {
-      description: "Handoff type keys must use kebab-case",
-      severity: "warn",
-      given: "$.handoff_types",
-      then: {
-        field: "@key",
-        function: import_spectral_functions.casing,
-        functionOptions: { type: "kebab" }
-      }
-    },
-    "policy-key-casing": {
-      description: "Policy keys must use kebab-case",
-      severity: "warn",
-      given: "$.policies",
-      then: {
-        field: "@key",
-        function: import_spectral_functions.casing,
-        functionOptions: { type: "kebab" }
-      }
-    },
-    // ========== version ==========
-    "version-must-be-1": {
-      description: "DSL version must be 1",
-      severity: "error",
-      given: "$.version",
-      then: {
-        function: import_spectral_functions.enumeration,
-        functionOptions: { values: [1] }
-      }
-    }
-  }
-};
-var ruleset_default = ruleset;
-
-// src/linter/spectral-lint.ts
-var severityMap = {
-  0: "error",
-  1: "warning",
-  2: "info",
-  3: "info"
-};
-var spectralInstance = null;
-function getSpectral() {
-  if (!spectralInstance) {
-    spectralInstance = new import_spectral_core7.Spectral();
-    spectralInstance.setRuleset(ruleset_default);
-  }
-  return spectralInstance;
-}
-async function spectralLint(dslObject) {
-  const spectral = getSpectral();
-  const results = await spectral.run(dslObject);
-  return results.map((r3) => ({
-    ruleId: r3.code,
-    severity: severityMap[r3.severity] ?? "info",
-    path: r3.path.join("."),
-    message: r3.message
-  }));
-}
-
-// src/cli/commands/lint.ts
-var DIR_DEFAULT3 = "agent-contracts.yaml";
-var lintCommand = new Command3("lint").description("Run semantic lint rules on resolved DSL").argument("[dir]", "Path to agent-contracts.yaml", DIR_DEFAULT3).option("-c, --config <path>", "Path to agent-contracts.config.yaml").option("--team <id>", "Limit to one team (multi-team config only)").option("--format <format>", "Output format (text|json)", "text").option("--quiet", "Suppress output on success", false).option("--strict", "Treat warnings as errors", false).action(
-  async (dir, opts) => {
-    try {
-      const config = await loadConfig(opts.config);
-      if (config !== null && isMultiTeamConfig(config)) {
-        const teamEntries = getTeamEntries(config, opts.team);
-        let hasErrors = false;
-        let allClean = true;
-        for (const [teamId, teamConfig] of teamEntries) {
-          if (!opts.quiet) process.stdout.write(`
---- Team: ${teamId} ---
-`);
-          const resolved2 = await resolve4(teamConfig.dsl);
-          const data2 = teamConfig.vars ? substituteVars(resolved2.data, teamConfig.vars) : resolved2.data;
-          const schemaResult2 = validateSchema(data2);
-          const schemaWarnings2 = schemaResult2.diagnostics.filter(
-            (d2) => d2.severity === "warning"
-          );
-          if (!schemaResult2.success) {
-            const output = formatDiagnostics(schemaResult2.diagnostics, {
-              format: opts.format,
-              quiet: opts.quiet
-            });
-            if (output) process.stderr.write(output + "\n");
-            hasErrors = true;
-            allClean = false;
-            continue;
-          }
-          const tsDiagnostics2 = lint(schemaResult2.data);
-          const spectralDiagnostics2 = await spectralLint(
-            schemaResult2.data
-          );
-          const diagnostics2 = [
-            ...tsDiagnostics2,
-            ...spectralDiagnostics2,
-            ...schemaWarnings2
-          ];
-          if (diagnostics2.length > 0) {
-            allClean = false;
-            const output = formatDiagnostics(diagnostics2, {
-              format: opts.format,
-              quiet: opts.quiet
-            });
-            if (output) process.stderr.write(output + "\n");
-            const teamHasErrors = diagnostics2.some((d2) => d2.severity === "error");
-            const teamHasWarnings = diagnostics2.some((d2) => d2.severity === "warning");
-            if (teamHasErrors || opts.strict && teamHasWarnings) {
-              hasErrors = true;
-            }
-          }
-        }
-        if (hasErrors) process.exit(1);
-        if (!opts.quiet && allClean) {
-          process.stdout.write("Lint passed.\n");
-        }
-        return;
-      }
-      const dslPath = resolveDslPath(dir, DIR_DEFAULT3, config);
-      const resolved = await resolve4(dslPath);
-      const data = config?.vars ? substituteVars(resolved.data, config.vars) : resolved.data;
-      const schemaResult = validateSchema(data);
-      const schemaWarnings = schemaResult.diagnostics.filter(
-        (d2) => d2.severity === "warning"
-      );
-      if (!schemaResult.success) {
-        const output = formatDiagnostics(schemaResult.diagnostics, {
-          format: opts.format,
-          quiet: opts.quiet
-        });
-        if (output) process.stderr.write(output + "\n");
-        process.exit(1);
+        field: "invokable_by",
+        function: ref_exists_default,
+        functionOptions: { referenceTo: "agents" }
       }
-      const tsDiagnostics = lint(schemaResult.data);
-      const spectralDiagnostics = await spectralLint(schemaResult.data);
-      const diagnostics = [...tsDiagnostics, ...spectralDiagnostics, ...schemaWarnings];
-      if (diagnostics.length > 0) {
-        const output = formatDiagnostics(diagnostics, {
-          format: opts.format,
-          quiet: opts.quiet
-        });
-        if (output) process.stderr.write(output + "\n");
-        const hasErrors = diagnostics.some((d2) => d2.severity === "error");
-        const hasWarnings = diagnostics.some((d2) => d2.severity === "warning");
-        if (hasErrors || opts.strict && hasWarnings) {
-          process.exit(1);
-        }
+    },
+    // ========== 15.2.2 Artifact responsibility integrity ==========
+    "artifact-editors-not-empty": {
+      description: "Artifact editors must not be empty (15.2.2)",
+      message: "{{error}}",
+      severity: "error",
+      given: "$.artifacts.*.editors",
+      then: {
+        function: editors_not_empty_default
       }
-      if (!opts.quiet && diagnostics.length === 0) {
-        process.stdout.write("Lint passed.\n");
+    },
+    "artifact-owner-exists": {
+      description: "Every artifact must have an owner",
+      severity: "error",
+      given: "$.artifacts.*",
+      then: {
+        field: "owner",
+        function: import_spectral_functions.truthy
       }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(`Error: ${msg}
-`);
-      process.exit(1);
-    }
-  }
-);
-
-// src/cli/commands/render.ts
-import { Command as Command4 } from "commander";
-
-// src/renderer/renderer.ts
-import { readFile as readFile4, writeFile, mkdir, unlink } from "fs/promises";
-import { dirname as dirname5 } from "path";
-import Handlebars from "handlebars";
-
-// src/renderer/context.ts
-function buildSystemContext(dsl, options) {
-  const ctx = { system: dsl.system, dsl };
-  if (options?.loadedBindings && options.loadedBindings.length > 0) {
-    ctx.bindings = options.loadedBindings.map((lb) => lb.binding);
-    const policyName = options.activeGuardrailPolicy;
-    const policy = policyName ? dsl.guardrail_policies[policyName] : void 0;
-    if (policy) {
-      ctx.guardrailEnforcement = buildGuardrailEnforcement(dsl, policy, options.loadedBindings);
-    }
-  }
-  return ctx;
-}
-function buildGuardrailEnforcement(dsl, policy, loadedBindings) {
-  const entries = [];
-  const bindingTriggers = /* @__PURE__ */ new Map();
-  for (const lb of loadedBindings) {
-    const impl = lb.binding.guardrail_impl ?? {};
-    for (const [guardrailId, gi] of Object.entries(impl)) {
-      for (const check of gi.checks) {
-        if (check.matcher) {
-          bindingTriggers.set(guardrailId, check.matcher.type);
-        }
+    },
+    // ========== 15.2.5 Handoff integrity ==========
+    "workflow-step-refs": {
+      description: "Workflow step references (task, from_agent, gate_kind, handoff_kind, validation) must exist",
+      message: "{{error}}",
+      severity: "error",
+      given: "$.workflow.*",
+      then: {
+        function: workflow_handoff_kind_exists_default
       }
-    }
-  }
-  for (const rule of policy.rules) {
-    const guardrail = dsl.guardrails[rule.guardrail];
-    if (!guardrail) continue;
-    const scope = guardrail.scope ?? {};
-    entries.push({
-      guardrail_id: rule.guardrail,
-      description: guardrail.description,
-      severity: rule.severity,
-      action: rule.action,
-      scoped_agents: scope.agents ?? [],
-      scoped_tasks: scope.tasks ?? [],
-      scoped_workflows: scope.workflows ?? [],
-      scoped_tools: scope.tools ?? [],
-      scoped_artifacts: scope.artifacts ?? [],
-      allow_override: rule.allow_override,
-      override_requires: rule.override_requires ?? [],
-      trigger: bindingTriggers.get(rule.guardrail) ?? null,
-      escalation: rule.escalation ? { target: rule.escalation.target, condition: rule.escalation.condition } : null
-    });
-  }
-  return entries;
-}
-function resolveEffectiveGuardrails(dsl, entityType, entityId) {
-  const entityDef = dsl[entityType][entityId];
-  const entitySide = new Set(entityDef?.guardrails ?? []);
-  const scopeSide = /* @__PURE__ */ new Set();
-  for (const [guardrailId, guardrail] of Object.entries(dsl.guardrails)) {
-    const scopeIds = guardrail.scope[entityType];
-    if (scopeIds?.includes(entityId)) {
-      scopeSide.add(guardrailId);
-    }
-  }
-  const allIds = /* @__PURE__ */ new Set([...entitySide, ...scopeSide]);
-  const activePolicyRules = /* @__PURE__ */ new Map();
-  for (const policy of Object.values(dsl.guardrail_policies)) {
-    for (const rule of policy.rules) {
-      if (!activePolicyRules.has(rule.guardrail)) {
-        activePolicyRules.set(rule.guardrail, {
-          severity: rule.severity,
-          action: rule.action
-        });
+    },
+    // ========== 15.2.7 Agent behavioral spec integrity ==========
+    "readonly-agent-no-writes": {
+      description: 'Agent with mode "read-only" must have empty can_write_artifacts',
+      message: "{{error}}",
+      severity: "error",
+      given: "$.agents.*",
+      then: {
+        function: readonly_no_writes_default
       }
-    }
-  }
-  const entries = [];
-  for (const id of allIds) {
-    const guardrail = dsl.guardrails[id];
-    if (!guardrail) continue;
-    const fromEntity = entitySide.has(id);
-    const fromScope = scopeSide.has(id);
-    const source = fromEntity && fromScope ? "both" : fromEntity ? "entity" : "scope";
-    const policyInfo = activePolicyRules.get(id);
-    entries.push({
-      guardrail_id: id,
-      description: guardrail.description,
-      rationale: guardrail.rationale,
-      tags: guardrail.tags,
-      source,
-      severity: policyInfo?.severity,
-      action: policyInfo?.action
-    });
-  }
-  return entries;
-}
-function validationToEntityEntry(validationId, validation) {
-  return {
-    validation_id: validationId,
-    kind: validation.kind,
-    target_artifact: validation.target_artifact,
-    executor_type: validation.executor_type,
-    blocking: validation.blocking,
-    produces_evidence: validation.produces_evidence
-  };
-}
-function resolveEntityValidations(dsl, entityType, entityId) {
-  if (entityType === "agents") {
-    const agent = dsl.agents[entityId];
-    if (!agent) return [];
-    const entries2 = [];
-    for (const vid of agent.can_perform_validations ?? []) {
-      const v2 = dsl.validations[vid];
-      if (v2) entries2.push(validationToEntityEntry(vid, v2));
-    }
-    return entries2;
-  }
-  if (entityType === "tasks") {
-    const task = dsl.tasks[entityId];
-    if (!task) return [];
-    const entries2 = [];
-    for (const vid of task.validations ?? []) {
-      const v2 = dsl.validations[vid];
-      if (v2) entries2.push(validationToEntityEntry(vid, v2));
-    }
-    return entries2;
-  }
-  const entries = [];
-  for (const [vid, v2] of Object.entries(dsl.validations)) {
-    if (v2.executor_type === "tool" && v2.executor === entityId) {
-      entries.push(validationToEntityEntry(vid, v2));
-    }
-  }
-  entries.sort((a3, b3) => a3.validation_id.localeCompare(b3.validation_id));
-  return entries;
-}
-function buildTaskContext(dsl, taskId) {
-  const taskDef = dsl.tasks[taskId];
-  const task = { ...taskDef, id: taskId };
-  const agentDef = dsl.agents[taskDef.target_agent];
-  const targetAgent = agentDef ? { ...agentDef, id: taskDef.target_agent } : null;
-  const relatedGuardrails = resolveEffectiveGuardrails(dsl, "tasks", taskId);
-  const relatedValidations = resolveEntityValidations(dsl, "tasks", taskId);
-  return { task, targetAgent, relatedGuardrails, relatedValidations, dsl };
-}
-function buildArtifactContext(dsl, artifactId) {
-  const artifactDef = dsl.artifacts[artifactId];
-  const artifact = { ...artifactDef, id: artifactId };
-  const relatedTools = {};
-  for (const [id, tool] of Object.entries(dsl.tools)) {
-    if (tool.input_artifacts.includes(artifactId) || tool.output_artifacts.includes(artifactId)) {
-      relatedTools[id] = tool;
-    }
-  }
-  const relatedValidations = {};
-  for (const [id, val] of Object.entries(dsl.validations)) {
-    if (val.target_artifact === artifactId) {
-      relatedValidations[id] = val;
-    }
-  }
-  const pickAgents = (ids) => {
-    const result = {};
-    for (const id of ids) {
-      if (dsl.agents[id]) result[id] = dsl.agents[id];
-    }
-    return result;
-  };
-  const producerAgents = pickAgents(artifactDef.producers);
-  const consumerAgents = pickAgents(artifactDef.consumers);
-  const editorAgents = pickAgents(artifactDef.editors);
-  const createdInWorkflows = [];
-  for (const [_taskId, task] of Object.entries(dsl.tasks)) {
-    if (createdInWorkflows.includes(task.workflow)) continue;
-    const targetAgent = dsl.agents[task.target_agent];
-    if (targetAgent?.can_write_artifacts.includes(artifactId)) {
-      createdInWorkflows.push(task.workflow);
-      continue;
-    }
-    const steps = task.execution_steps ?? [];
-    for (const step of steps) {
-      if (step["produces_artifact"] === artifactId) {
-        createdInWorkflows.push(task.workflow);
-        break;
+    },
+    "agent-prerequisite-readable": {
+      description: "Agent prerequisites target must be in can_read_artifacts",
+      message: "{{error}}",
+      severity: "error",
+      given: "$.agents.*",
+      then: {
+        function: prerequisite_readable_default
+      }
+    },
+    // ========== 15.2.10 Handoff schema integrity ==========
+    "handoff-payload-integrity": {
+      description: "Handoff schema required/properties consistency, enum non-empty, nested validation",
+      message: "{{error}}",
+      severity: "error",
+      given: "$.handoff_types.*.schema",
+      then: {
+        function: payload_schema_integrity_default
       }
-    }
-  }
-  const relatedGuardrails = resolveEffectiveGuardrails(dsl, "artifacts", artifactId);
-  return {
-    artifact,
-    relatedTools,
-    relatedValidations,
-    producerAgents,
-    consumerAgents,
-    editorAgents,
-    createdInWorkflows,
-    relatedGuardrails,
-    dsl
-  };
-}
-function buildToolContext(dsl, toolId) {
-  const toolDef = dsl.tools[toolId];
-  const tool = { ...toolDef, id: toolId };
-  const invokableAgents = {};
-  for (const agentId of toolDef.invokable_by) {
-    if (dsl.agents[agentId]) invokableAgents[agentId] = dsl.agents[agentId];
-  }
-  const pickArtifacts = (ids) => {
-    const result = {};
-    for (const id of ids) {
-      if (dsl.artifacts[id]) result[id] = dsl.artifacts[id];
-    }
-    return result;
-  };
-  const relatedGuardrails = resolveEffectiveGuardrails(dsl, "tools", toolId);
-  const relatedValidations = resolveEntityValidations(dsl, "tools", toolId);
-  return {
-    tool,
-    invokableAgents,
-    inputArtifactDetails: pickArtifacts(toolDef.input_artifacts),
-    outputArtifactDetails: pickArtifacts(toolDef.output_artifacts),
-    relatedGuardrails,
-    relatedValidations,
-    dsl
-  };
-}
-function buildValidationContext(dsl, validationId) {
-  const validationDef = dsl.validations[validationId];
-  const validation = { ...validationDef, id: validationId };
-  return { validation, dsl };
-}
-function buildHandoffTypeContext(dsl, handoffTypeId) {
-  const htDef = dsl.handoff_types[handoffTypeId];
-  const handoff_type = { ...htDef, id: handoffTypeId };
-  const relatedTasks = Object.entries(dsl.tasks).filter(
-    ([, t3]) => t3.invocation_handoff === handoffTypeId || t3.result_handoff === handoffTypeId
-  ).map(([id, t3]) => ({ ...t3, id }));
-  return { handoff_type, relatedTasks, dsl };
-}
-function buildWorkflowContext(dsl, workflowId) {
-  const wfDef = dsl.workflow[workflowId];
-  const workflow = { ...wfDef, id: workflowId };
-  const stepReferencedTaskIds = /* @__PURE__ */ new Set();
-  for (const step of wfDef.steps) {
-    if (step.type === "delegate") {
-      stepReferencedTaskIds.add(step.task);
-      if (step.retry) {
-        stepReferencedTaskIds.add(step.retry.fix_task);
-        if (step.retry.revalidate_task) stepReferencedTaskIds.add(step.retry.revalidate_task);
+    },
+    // ========== naming convention ==========
+    "agent-key-casing": {
+      description: "Agent keys must use kebab-case",
+      severity: "warn",
+      given: "$.agents",
+      then: {
+        field: "@key",
+        function: import_spectral_functions.casing,
+        functionOptions: { type: "kebab" }
       }
-    } else if (step.type === "handoff" && step.task) {
-      stepReferencedTaskIds.add(step.task);
-      if (step.retry) {
-        stepReferencedTaskIds.add(step.retry.fix_task);
-        if (step.retry.revalidate_task) stepReferencedTaskIds.add(step.retry.revalidate_task);
+    },
+    "task-key-casing": {
+      description: "Task keys must use kebab-case",
+      severity: "warn",
+      given: "$.tasks",
+      then: {
+        field: "@key",
+        function: import_spectral_functions.casing,
+        functionOptions: { type: "kebab" }
       }
-    }
-  }
-  const relatedTasks = Object.entries(dsl.tasks).filter(([id, t3]) => t3.workflow === workflowId || stepReferencedTaskIds.has(id)).map(([id, t3]) => ({ ...t3, id }));
-  const agentIds = /* @__PURE__ */ new Set();
-  for (const task of relatedTasks) {
-    agentIds.add(task.target_agent);
-    for (const fromAgent of task.allowed_from_agents) {
-      agentIds.add(fromAgent);
-    }
-  }
-  for (const step of wfDef.steps) {
-    if (step.type === "delegate") {
-      agentIds.add(step.from_agent);
-    } else if (step.type === "handoff" && step.from_agent) {
-      agentIds.add(step.from_agent);
-    }
-    if (step.type === "validation") {
-      const val = dsl.validations[step.validation];
-      if (val?.executor_type === "agent" && val.executor) {
-        agentIds.add(val.executor);
+    },
+    "artifact-key-casing": {
+      description: "Artifact keys must use kebab-case",
+      severity: "warn",
+      given: "$.artifacts",
+      then: {
+        field: "@key",
+        function: import_spectral_functions.casing,
+        functionOptions: { type: "kebab" }
       }
-    }
-  }
-  const relatedAgents = {};
-  for (const id of agentIds) {
-    if (dsl.agents[id]) relatedAgents[id] = dsl.agents[id];
-  }
-  const toolIds = /* @__PURE__ */ new Set();
-  for (const id of agentIds) {
-    const agent = dsl.agents[id];
-    if (agent) {
-      for (const toolId of agent.can_execute_tools) {
-        toolIds.add(toolId);
+    },
+    "tool-key-casing": {
+      description: "Tool keys must use kebab-case",
+      severity: "warn",
+      given: "$.tools",
+      then: {
+        field: "@key",
+        function: import_spectral_functions.casing,
+        functionOptions: { type: "kebab" }
+      }
+    },
+    "validation-key-casing": {
+      description: "Validation keys must use kebab-case",
+      severity: "warn",
+      given: "$.validations",
+      then: {
+        field: "@key",
+        function: import_spectral_functions.casing,
+        functionOptions: { type: "kebab" }
+      }
+    },
+    "handoff-type-key-casing": {
+      description: "Handoff type keys must use kebab-case",
+      severity: "warn",
+      given: "$.handoff_types",
+      then: {
+        field: "@key",
+        function: import_spectral_functions.casing,
+        functionOptions: { type: "kebab" }
+      }
+    },
+    "policy-key-casing": {
+      description: "Policy keys must use kebab-case",
+      severity: "warn",
+      given: "$.policies",
+      then: {
+        field: "@key",
+        function: import_spectral_functions.casing,
+        functionOptions: { type: "kebab" }
+      }
+    },
+    // ========== version ==========
+    "version-must-be-1": {
+      description: "DSL version must be 1",
+      severity: "error",
+      given: "$.version",
+      then: {
+        function: import_spectral_functions.enumeration,
+        functionOptions: { values: [1] }
       }
     }
   }
-  for (const task of relatedTasks) {
-    for (const step of task.execution_steps ?? []) {
-      if (step.uses_tool) toolIds.add(step.uses_tool);
-    }
-  }
-  const relatedTools = {};
-  for (const id of toolIds) {
-    if (dsl.tools[id]) relatedTools[id] = dsl.tools[id];
-  }
-  const artifactIds = /* @__PURE__ */ new Set();
-  for (const task of relatedTasks) {
-    for (const artId of task.input_artifacts) artifactIds.add(artId);
-    for (const step of task.execution_steps ?? []) {
-      if (step.produces_artifact) artifactIds.add(step.produces_artifact);
-      if (step.reads_artifact) artifactIds.add(step.reads_artifact);
-    }
-  }
-  for (const id of agentIds) {
-    const agent = dsl.agents[id];
-    if (agent) {
-      for (const artId of agent.can_read_artifacts) artifactIds.add(artId);
-      for (const artId of agent.can_write_artifacts) artifactIds.add(artId);
-    }
-  }
-  const relatedArtifacts = {};
-  for (const id of artifactIds) {
-    if (dsl.artifacts[id]) relatedArtifacts[id] = dsl.artifacts[id];
-  }
-  const validationIds = /* @__PURE__ */ new Set();
-  for (const step of wfDef.steps) {
-    if (step.type === "validation") {
-      validationIds.add(step.validation);
-    }
-  }
-  for (const task of relatedTasks) {
-    for (const valId of task.validations ?? []) {
-      validationIds.add(valId);
-    }
-  }
-  const relatedValidations = {};
-  for (const id of validationIds) {
-    if (dsl.validations[id]) relatedValidations[id] = dsl.validations[id];
-  }
-  return {
-    workflow,
-    relatedAgents,
-    relatedTasks,
-    relatedTools,
-    relatedArtifacts,
-    relatedValidations,
-    dsl
-  };
-}
-function buildPolicyContext(dsl, policyId) {
-  const policyDef = dsl.policies[policyId];
-  const policy = { ...policyDef, id: policyId };
-  return { policy, dsl };
-}
-function buildGuardrailContext(dsl, guardrailId) {
-  const guardrailDef = dsl.guardrails[guardrailId];
-  const guardrail = { ...guardrailDef, id: guardrailId };
-  return { guardrail, dsl };
-}
-function buildGuardrailPolicyContext(dsl, policyId) {
-  const policyDef = dsl.guardrail_policies[policyId];
-  const guardrail_policy = { ...policyDef, id: policyId };
-  return { guardrail_policy, dsl };
-}
-function mergeRules(agentRules, taskRules) {
-  const result = [...agentRules];
-  const existingIds = new Set(result.map((r3) => r3["id"]));
-  for (const rule of taskRules) {
-    const id = rule["id"];
-    if (existingIds.has(id)) {
-      const idx = result.findIndex((r3) => r3["id"] === id);
-      result[idx] = rule;
-    } else {
-      result.push(rule);
-    }
-  }
-  return result;
-}
-function mergeBehavioralSpec(agent, tasks) {
-  let responsibilities = agent.responsibilities ?? [];
-  let constraints = agent.constraints ?? [];
-  let rules = agent.rules ?? [];
-  let antiPatterns = agent.anti_patterns ?? [];
-  let escalation = agent.escalation_criteria ?? [];
-  let executionSteps = [];
-  let completionCriteria = [];
-  for (const task of tasks) {
-    responsibilities = [...responsibilities, ...task.responsibilities ?? []];
-    constraints = [...constraints, ...task.constraints ?? []];
-    rules = mergeRules(rules, task.rules ?? []);
-    antiPatterns = [...antiPatterns, ...task.anti_patterns ?? []];
-    escalation = [...escalation, ...task.escalation_criteria ?? []];
-    executionSteps = [...executionSteps, ...task.execution_steps ?? []];
-    completionCriteria = [...completionCriteria, ...task.completion_criteria ?? []];
-  }
-  return {
-    responsibilities,
-    constraints,
-    rules,
-    anti_patterns: antiPatterns,
-    escalation_criteria: escalation,
-    execution_steps: executionSteps,
-    completion_criteria: completionCriteria
-  };
-}
-function extractSchemaFieldNames(schema) {
-  const effective = resolveAllOf(schema);
-  const props = effective["properties"];
-  if (props && typeof props === "object") {
-    return Object.keys(props);
-  }
-  return Object.keys(schema);
-}
-function buildDelegatableTasks(dsl, agentId) {
-  return Object.entries(dsl.tasks).filter(([, t3]) => t3.allowed_from_agents.includes(agentId)).map(([taskId, t3]) => {
-    const invocationHandoff = dsl.handoff_types[t3.invocation_handoff];
-    const resultHandoff = dsl.handoff_types[t3.result_handoff];
-    return {
-      id: taskId,
-      description: t3.description,
-      target_agent: t3.target_agent,
-      workflow: t3.workflow,
-      input_artifacts: t3.input_artifacts,
-      invocation_handoff: t3.invocation_handoff,
-      invocation_payload_keys: invocationHandoff ? extractSchemaFieldNames(invocationHandoff.schema) : [],
-      result_handoff: t3.result_handoff,
-      result_payload_keys: resultHandoff ? extractSchemaFieldNames(resultHandoff.schema) : []
-    };
-  });
-}
-function buildPerAgentContext(dsl, agent) {
-  const agentId = agent.id;
-  const receivableTasks = Object.entries(dsl.tasks).filter(([, t3]) => t3.target_agent === agentId).map(([id, t3]) => ({ ...t3, id }));
-  const delegatableTasks = buildDelegatableTasks(dsl, agentId);
-  const artifactIds = /* @__PURE__ */ new Set([
-    ...agent.can_read_artifacts,
-    ...agent.can_write_artifacts
-  ]);
-  const relatedArtifacts = {};
-  for (const [id, art] of Object.entries(dsl.artifacts)) {
-    if (artifactIds.has(id)) relatedArtifacts[id] = art;
-  }
-  const toolIdSet = new Set(agent.can_execute_tools);
-  const relatedTools = {};
-  for (const [id, tool] of Object.entries(dsl.tools)) {
-    if (toolIdSet.has(id)) relatedTools[id] = tool;
-  }
-  const handoffKinds = /* @__PURE__ */ new Set([
-    ...agent.can_return_handoffs,
-    ...receivableTasks.map((t3) => t3.invocation_handoff),
-    ...receivableTasks.map((t3) => t3.result_handoff),
-    ...delegatableTasks.map((t3) => t3.invocation_handoff),
-    ...delegatableTasks.map((t3) => t3.result_handoff)
-  ]);
-  const relatedHandoffTypes = {};
-  for (const [kind, ht] of Object.entries(dsl.handoff_types)) {
-    if (handoffKinds.has(kind)) relatedHandoffTypes[kind] = ht;
-  }
-  const rawReceivableTasks = receivableTasks.map(({ id: _id, ...rest }) => rest);
-  const mergedBehavior = mergeBehavioralSpec(agent, rawReceivableTasks);
-  const relatedGuardrails = resolveEffectiveGuardrails(dsl, "agents", agentId);
-  const relatedValidations = resolveEntityValidations(dsl, "agents", agentId);
-  return {
-    agent,
-    tasks: receivableTasks,
-    receivableTasks,
-    delegatableTasks,
-    relatedArtifacts,
-    relatedTools,
-    relatedHandoffTypes,
-    mergedBehavior,
-    relatedGuardrails,
-    relatedValidations,
-    dsl
-  };
-}
+};
+var ruleset_default = ruleset;
 
-// src/renderer/sequence-diagram.ts
-function hashToColor(s2, saturation, lightness) {
-  let hash = 0;
-  for (const ch of s2) hash = (hash << 5) - hash + ch.charCodeAt(0) | 0;
-  const h2 = (hash % 360 + 360) % 360;
-  const c2 = (1 - Math.abs(2 * lightness - 1)) * saturation;
-  const x3 = c2 * (1 - Math.abs(h2 / 60 % 2 - 1));
-  const m2 = lightness - c2 / 2;
-  let r3 = 0, g2 = 0, b3 = 0;
-  if (h2 < 60) {
-    r3 = c2;
-    g2 = x3;
-  } else if (h2 < 120) {
-    r3 = x3;
-    g2 = c2;
-  } else if (h2 < 180) {
-    g2 = c2;
-    b3 = x3;
-  } else if (h2 < 240) {
-    g2 = x3;
-    b3 = c2;
-  } else if (h2 < 300) {
-    r3 = x3;
-    b3 = c2;
-  } else {
-    r3 = c2;
-    b3 = x3;
+// src/linter/spectral-lint.ts
+var severityMap = {
+  0: "error",
+  1: "warning",
+  2: "info",
+  3: "info"
+};
+var spectralInstance = null;
+function getSpectral() {
+  if (!spectralInstance) {
+    spectralInstance = new import_spectral_core7.Spectral();
+    spectralInstance.setRuleset(ruleset_default);
   }
-  return `rgb(${Math.round((r3 + m2) * 255)},${Math.round((g2 + m2) * 255)},${Math.round((b3 + m2) * 255)})`;
-}
-function sanitizeAlias(id) {
-  return id.replace(/[^a-zA-Z0-9_]/g, "_");
+  return spectralInstance;
 }
-function agentAlias(id, agent) {
-  const words = agent.role_name.split(/\s+/);
-  if (words.length === 1) return sanitizeAlias(words[0].slice(0, 4));
-  return sanitizeAlias(words.map((w2) => w2[0]).join(""));
+async function spectralLint(dslObject) {
+  const spectral = getSpectral();
+  const results = await spectral.run(dslObject);
+  return results.map((r3) => ({
+    ruleId: r3.code,
+    severity: severityMap[r3.severity] ?? "info",
+    path: r3.path.join("."),
+    message: r3.message
+  }));
 }
-function collectReferencedIds(workflow, dsl, relatedTasks) {
-  const agents = /* @__PURE__ */ new Set();
-  const auditAgents = /* @__PURE__ */ new Set();
-  const tools = /* @__PURE__ */ new Set();
-  const artifacts = /* @__PURE__ */ new Set();
-  const taskMap = /* @__PURE__ */ new Map();
-  for (const t3 of relatedTasks) taskMap.set(t3.id, t3);
-  function collectTaskIds(task) {
-    addAgent(task.target_agent);
-    for (const es of task.execution_steps ?? []) {
-      collectExecutionStepIds(es, tools, artifacts);
-    }
-  }
-  function collectRetryIds(retry) {
-    const fixTask = taskMap.get(retry.fix_task);
-    if (fixTask) collectTaskIds(fixTask);
-    if (retry.revalidate_task) {
-      const revalTask = taskMap.get(retry.revalidate_task);
-      if (revalTask) addAgent(revalTask.target_agent);
-    }
-  }
-  for (const step of workflow.steps) {
-    if (step.type === "delegate") {
-      addAgent(step.from_agent);
-      const task = taskMap.get(step.task);
-      if (task) collectTaskIds(task);
-      if (step.retry) collectRetryIds(step.retry);
-    } else if (step.type === "gate") {
-    } else if (step.type === "handoff") {
-      if (step.from_agent) addAgent(step.from_agent);
-      if (step.task) {
-        const task = taskMap.get(step.task);
-        if (task) collectTaskIds(task);
+
+// src/cli/commands/lint.ts
+var DIR_DEFAULT3 = "agent-contracts.yaml";
+var lintCommand = new Command3("lint").description("Run semantic lint rules on resolved DSL").argument("[dir]", "Path to agent-contracts.yaml", DIR_DEFAULT3).option("-c, --config <path>", "Path to agent-contracts.config.yaml").option("--team <id>", "Limit to one team (multi-team config only)").option("--format <format>", "Output format (text|json)", "text").option("--quiet", "Suppress output on success", false).option("--strict", "Treat warnings as errors", false).action(
+  async (dir, opts) => {
+    try {
+      const config = await loadConfig(opts.config);
+      if (config !== null && isMultiTeamConfig(config)) {
+        const teamEntries = getTeamEntries(config, opts.team);
+        let hasErrors = false;
+        let allClean = true;
+        for (const [teamId, teamConfig] of teamEntries) {
+          if (!opts.quiet) process.stdout.write(`
+--- Team: ${teamId} ---
+`);
+          const resolved2 = await resolve4(teamConfig.dsl);
+          const data2 = teamConfig.vars ? substituteVars(resolved2.data, teamConfig.vars) : resolved2.data;
+          const schemaResult2 = validateSchema(data2);
+          const schemaWarnings2 = schemaResult2.diagnostics.filter(
+            (d2) => d2.severity === "warning"
+          );
+          if (!schemaResult2.success) {
+            const output = formatDiagnostics(schemaResult2.diagnostics, {
+              format: opts.format,
+              quiet: opts.quiet
+            });
+            if (output) process.stderr.write(output + "\n");
+            hasErrors = true;
+            allClean = false;
+            continue;
+          }
+          const tsDiagnostics2 = lint(schemaResult2.data);
+          const spectralDiagnostics2 = await spectralLint(
+            schemaResult2.data
+          );
+          const diagnostics2 = [
+            ...tsDiagnostics2,
+            ...spectralDiagnostics2,
+            ...schemaWarnings2
+          ];
+          if (diagnostics2.length > 0) {
+            allClean = false;
+            const output = formatDiagnostics(diagnostics2, {
+              format: opts.format,
+              quiet: opts.quiet
+            });
+            if (output) process.stderr.write(output + "\n");
+            const teamHasErrors = diagnostics2.some((d2) => d2.severity === "error");
+            const teamHasWarnings = diagnostics2.some((d2) => d2.severity === "warning");
+            if (teamHasErrors || opts.strict && teamHasWarnings) {
+              hasErrors = true;
+            }
+          }
+        }
+        if (hasErrors) process.exit(1);
+        if (!opts.quiet && allClean) {
+          process.stdout.write("Lint passed.\n");
+        }
+        return;
       }
-      if (step.retry) collectRetryIds(step.retry);
-    } else if (step.type === "validation") {
-      const val = dsl.validations[step.validation];
-      if (val) {
-        if (val.executor_type === "agent") addAgent(val.executor);
-        else tools.add(val.executor);
-        artifacts.add(val.target_artifact);
+      const dslPath = resolveDslPath(dir, DIR_DEFAULT3, config);
+      const resolved = await resolve4(dslPath);
+      const data = config?.vars ? substituteVars(resolved.data, config.vars) : resolved.data;
+      const schemaResult = validateSchema(data);
+      const schemaWarnings = schemaResult.diagnostics.filter(
+        (d2) => d2.severity === "warning"
+      );
+      if (!schemaResult.success) {
+        const output = formatDiagnostics(schemaResult.diagnostics, {
+          format: opts.format,
+          quiet: opts.quiet
+        });
+        if (output) process.stderr.write(output + "\n");
+        process.exit(1);
+      }
+      const tsDiagnostics = lint(schemaResult.data);
+      const spectralDiagnostics = await spectralLint(schemaResult.data);
+      const diagnostics = [...tsDiagnostics, ...spectralDiagnostics, ...schemaWarnings];
+      if (diagnostics.length > 0) {
+        const output = formatDiagnostics(diagnostics, {
+          format: opts.format,
+          quiet: opts.quiet
+        });
+        if (output) process.stderr.write(output + "\n");
+        const hasErrors = diagnostics.some((d2) => d2.severity === "error");
+        const hasWarnings = diagnostics.some((d2) => d2.severity === "warning");
+        if (hasErrors || opts.strict && hasWarnings) {
+          process.exit(1);
+        }
+      }
+      if (!opts.quiet && diagnostics.length === 0) {
+        process.stdout.write("Lint passed.\n");
       }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`Error: ${msg}
+`);
+      process.exit(1);
     }
   }
-  function addAgent(agentId) {
-    const agent = dsl.agents[agentId];
-    if (agent?.mode === "read-only") {
-      auditAgents.add(agentId);
-    } else {
-      agents.add(agentId);
+);
+
+// src/cli/commands/render.ts
+import { Command as Command5 } from "commander";
+
+// src/cli/commands/generate.ts
+import { Command as Command4 } from "commander";
+
+// src/guardrail-generator/generator.ts
+import { readFile as readFile5, writeFile as writeFile2, mkdir as mkdir2, chmod, unlink as unlink2, copyFile } from "fs/promises";
+import { resolve as resolve6, dirname as dirname6 } from "path";
+import Handlebars2 from "handlebars";
+import YAML from "yaml";
+
+// src/guardrail-generator/resolve-checks.ts
+function resolveChecks(dsl, binding, policy) {
+  const resolved = [];
+  const diagnostics = [];
+  const guardrailImpl = binding.guardrail_impl ?? {};
+  for (const [guardrailId, impl] of Object.entries(guardrailImpl)) {
+    const guardrail = dsl.guardrails[guardrailId];
+    if (!guardrail) {
+      diagnostics.push({
+        path: `binding.${binding.software}.guardrail_impl.${guardrailId}`,
+        message: `Binding "${binding.software}" implements guardrail "${guardrailId}" which is not defined in the DSL`,
+        severity: "error"
+      });
+      continue;
+    }
+    const policyRule = policy.rules.find((r3) => r3.guardrail === guardrailId);
+    if (!policyRule) {
+      diagnostics.push({
+        path: `binding.${binding.software}.guardrail_impl.${guardrailId}`,
+        message: `Guardrail "${guardrailId}" has no policy rule in the active policy \u2014 skipping`,
+        severity: "info"
+      });
+      continue;
+    }
+    for (const check of impl.checks) {
+      resolved.push({
+        guardrail_id: guardrailId,
+        guardrail,
+        policy_rule: policyRule,
+        check
+      });
     }
   }
-  return { agents, auditAgents, tools, artifacts };
+  return { resolved, diagnostics };
 }
-function collectExecutionStepIds(es, tools, artifacts) {
-  if (es.uses_tool) tools.add(es.uses_tool);
-  if (es.produces_artifact) artifacts.add(es.produces_artifact);
-  if (es.reads_artifact) artifacts.add(es.reads_artifact);
+
+// src/guardrail-generator/resolve-paths.ts
+function resolveBindingTargetPath(target, paths, bindingSoftware) {
+  const diagnostics = [];
+  const resolved = target.replace(/\{(\w+)\}/g, (match, varName) => {
+    const value = paths[varName];
+    if (value === void 0) {
+      diagnostics.push({
+        path: `binding.${bindingSoftware}.outputs`,
+        message: `Path variable "${varName}" used in target "${target}" but not defined in config.paths`,
+        severity: "error"
+      });
+      return match;
+    }
+    return value;
+  });
+  return { resolved, diagnostics };
 }
-function buildParticipants(ids, externals, dsl) {
-  const participants = [];
-  const usedAliases = /* @__PURE__ */ new Set();
-  function uniqueAlias(preferred) {
-    let alias = preferred;
-    let i3 = 2;
-    while (usedAliases.has(alias)) {
-      alias = `${preferred}${i3}`;
-      i3++;
+
+// src/renderer/renderer.ts
+import { readFile as readFile4, writeFile, mkdir, unlink } from "fs/promises";
+import { dirname as dirname5 } from "path";
+import Handlebars from "handlebars";
+
+// src/renderer/context.ts
+function buildSystemContext(dsl, options) {
+  const ctx = { system: dsl.system, dsl };
+  if (options?.loadedBindings && options.loadedBindings.length > 0) {
+    ctx.bindings = options.loadedBindings.map((lb) => lb.binding);
+    const policyName = options.activeGuardrailPolicy;
+    const policy = policyName ? dsl.guardrail_policies[policyName] : void 0;
+    if (policy) {
+      ctx.guardrailEnforcement = buildGuardrailEnforcement(dsl, policy, options.loadedBindings);
     }
-    usedAliases.add(alias);
-    return alias;
-  }
-  for (const ep of externals) {
-    const alias = uniqueAlias(sanitizeAlias(ep.id));
-    participants.push({ id: ep.id, alias, label: ep.label, group: "external" });
-  }
-  for (const id of ids.agents) {
-    const agent = dsl.agents[id];
-    if (!agent) continue;
-    const alias = uniqueAlias(agentAlias(id, agent));
-    participants.push({ id, alias, label: agent.role_name, group: "agents" });
-  }
-  for (const id of ids.auditAgents) {
-    const agent = dsl.agents[id];
-    if (!agent) continue;
-    const alias = uniqueAlias(agentAlias(id, agent));
-    participants.push({ id, alias, label: agent.role_name, group: "audit" });
-  }
-  for (const id of ids.tools) {
-    const tool = dsl.tools[id];
-    if (!tool) continue;
-    const alias = uniqueAlias(sanitizeAlias(id));
-    participants.push({ id, alias, label: id, group: "toolchain" });
-  }
-  for (const id of ids.artifacts) {
-    const art = dsl.artifacts[id];
-    if (!art) continue;
-    const alias = uniqueAlias(sanitizeAlias(id));
-    participants.push({ id, alias, label: id, group: "artifacts" });
   }
-  return participants;
-}
-function participantAlias(participants, id) {
-  const p2 = participants.find((pp) => pp.id === id);
-  return p2 ? p2.alias : sanitizeAlias(id);
+  return ctx;
 }
-function emitParticipants(participants, externals, lines, indent) {
-  const groups = {
-    external: [],
-    agents: [],
-    audit: [],
-    toolchain: [],
-    artifacts: []
-  };
-  for (const p2 of participants) groups[p2.group].push(p2);
-  const externalMap = /* @__PURE__ */ new Map();
-  for (const ep of externals) externalMap.set(ep.id, ep);
-  if (groups.external.length > 0) {
-    lines.push(`${indent}box rgb(255,245,230) External`);
-    for (const p2 of groups.external) {
-      const ep = externalMap.get(p2.id);
-      const keyword = ep?.kind === "actor" ? "actor" : "participant";
-      if (p2.alias === p2.label) {
-        lines.push(`${indent}${keyword} ${p2.alias}`);
-      } else {
-        lines.push(`${indent}${keyword} ${p2.alias} as ${p2.label}`);
+function buildGuardrailEnforcement(dsl, policy, loadedBindings) {
+  const entries = [];
+  const bindingTriggers = /* @__PURE__ */ new Map();
+  for (const lb of loadedBindings) {
+    const impl = lb.binding.guardrail_impl ?? {};
+    for (const [guardrailId, gi] of Object.entries(impl)) {
+      for (const check of gi.checks) {
+        if (check.matcher) {
+          bindingTriggers.set(guardrailId, check.matcher.type);
+        }
       }
     }
-    lines.push(`${indent}end`);
   }
-  const groupConfig = [
-    { key: "agents", label: "Agents", color: "rgb(200,220,255)" },
-    { key: "audit", label: "Audit", color: "rgb(255,220,220)" },
-    { key: "toolchain", label: "Toolchain", color: "rgb(220,255,220)" },
-    { key: "artifacts", label: "Artifacts", color: "rgb(255,230,210)" }
-  ];
-  for (const { key, label, color } of groupConfig) {
-    const members = groups[key];
-    if (members.length === 0) continue;
-    lines.push(`${indent}box ${color} ${label}`);
-    for (const p2 of members) {
-      if (p2.alias === p2.label) {
-        lines.push(`${indent}participant ${p2.alias}`);
-      } else {
-        lines.push(`${indent}participant ${p2.alias} as ${p2.label}`);
-      }
+  for (const rule of policy.rules) {
+    const guardrail = dsl.guardrails[rule.guardrail];
+    if (!guardrail) continue;
+    const scope = guardrail.scope ?? {};
+    entries.push({
+      guardrail_id: rule.guardrail,
+      description: guardrail.description,
+      severity: rule.severity,
+      action: rule.action,
+      scoped_agents: scope.agents ?? [],
+      scoped_tasks: scope.tasks ?? [],
+      scoped_workflows: scope.workflows ?? [],
+      scoped_tools: scope.tools ?? [],
+      scoped_artifacts: scope.artifacts ?? [],
+      allow_override: rule.allow_override,
+      override_requires: rule.override_requires ?? [],
+      trigger: bindingTriggers.get(rule.guardrail) ?? null,
+      escalation: rule.escalation ? { target: rule.escalation.target, condition: rule.escalation.condition } : null
+    });
+  }
+  return entries;
+}
+function resolveEffectiveGuardrails(dsl, entityType, entityId) {
+  const entityDef = dsl[entityType][entityId];
+  const entitySide = new Set(entityDef?.guardrails ?? []);
+  const scopeSide = /* @__PURE__ */ new Set();
+  for (const [guardrailId, guardrail] of Object.entries(dsl.guardrails)) {
+    const scopeIds = guardrail.scope[entityType];
+    if (scopeIds?.includes(entityId)) {
+      scopeSide.add(guardrailId);
     }
-    lines.push(`${indent}end`);
   }
-}
-function emitHandoffStep(step, participants, dsl, relatedTasks, lines, indent) {
-  const taskMap = /* @__PURE__ */ new Map();
-  for (const t3 of relatedTasks) taskMap.set(t3.id, t3);
-  if (!step.task) {
-    if (step.from_agent) {
-      const fromAlias2 = participantAlias(participants, step.from_agent);
-      lines.push(`${indent}${fromAlias2}->>${fromAlias2}: ${step.handoff_kind}`);
+  const allIds = /* @__PURE__ */ new Set([...entitySide, ...scopeSide]);
+  const activePolicyRules = /* @__PURE__ */ new Map();
+  for (const policy of Object.values(dsl.guardrail_policies)) {
+    for (const rule of policy.rules) {
+      if (!activePolicyRules.has(rule.guardrail)) {
+        activePolicyRules.set(rule.guardrail, {
+          severity: rule.severity,
+          action: rule.action
+        });
+      }
     }
-    return;
-  }
-  const task = taskMap.get(step.task);
-  if (!task) return;
-  const fromAlias = step.from_agent ? participantAlias(participants, step.from_agent) : null;
-  const targetAlias = participantAlias(participants, task.target_agent);
-  if (fromAlias) {
-    lines.push(`${indent}${fromAlias}->>${targetAlias}: delegate ${step.task}`);
-  }
-  for (const es of task.execution_steps ?? []) {
-    emitExecutionStep(es, targetAlias, participants, lines, indent);
   }
-  if (fromAlias) {
-    lines.push(`${indent}${targetAlias}-->>${fromAlias}: ${task.result_handoff}`);
+  const entries = [];
+  for (const id of allIds) {
+    const guardrail = dsl.guardrails[id];
+    if (!guardrail) continue;
+    const fromEntity = entitySide.has(id);
+    const fromScope = scopeSide.has(id);
+    const source = fromEntity && fromScope ? "both" : fromEntity ? "entity" : "scope";
+    const policyInfo = activePolicyRules.get(id);
+    entries.push({
+      guardrail_id: id,
+      description: guardrail.description,
+      rationale: guardrail.rationale,
+      tags: guardrail.tags,
+      source,
+      severity: policyInfo?.severity,
+      action: policyInfo?.action
+    });
   }
+  return entries;
 }
-function emitExecutionStep(es, agentAlias2, participants, lines, indent) {
-  if (es.reads_artifact) {
-    const artAlias = participantAlias(participants, es.reads_artifact);
-    lines.push(`${indent}${agentAlias2}->>${artAlias}: [R] ${es.action}`);
-  }
-  if (es.produces_artifact) {
-    const artAlias = participantAlias(participants, es.produces_artifact);
-    lines.push(`${indent}${agentAlias2}->>${artAlias}: [W] ${es.action}`);
+function validationToEntityEntry(validationId, validation) {
+  return {
+    validation_id: validationId,
+    kind: validation.kind,
+    target_artifact: validation.target_artifact,
+    executor_type: validation.executor_type,
+    blocking: validation.blocking,
+    produces_evidence: validation.produces_evidence
+  };
+}
+function resolveEntityValidations(dsl, entityType, entityId) {
+  if (entityType === "agents") {
+    const agent = dsl.agents[entityId];
+    if (!agent) return [];
+    const entries2 = [];
+    for (const vid of agent.can_perform_validations ?? []) {
+      const v2 = dsl.validations[vid];
+      if (v2) entries2.push(validationToEntityEntry(vid, v2));
+    }
+    return entries2;
   }
-  if (es.uses_tool) {
-    const toolAlias = participantAlias(participants, es.uses_tool);
-    lines.push(`${indent}${agentAlias2}->>${toolAlias}: ${es.action}`);
+  if (entityType === "tasks") {
+    const task = dsl.tasks[entityId];
+    if (!task) return [];
+    const entries2 = [];
+    for (const vid of task.validations ?? []) {
+      const v2 = dsl.validations[vid];
+      if (v2) entries2.push(validationToEntityEntry(vid, v2));
+    }
+    return entries2;
   }
-  if (!es.reads_artifact && !es.produces_artifact && !es.uses_tool) {
-    lines.push(`${indent}${agentAlias2}->>${agentAlias2}: ${es.action}`);
+  const entries = [];
+  for (const [vid, v2] of Object.entries(dsl.validations)) {
+    if (v2.executor_type === "tool" && v2.executor === entityId) {
+      entries.push(validationToEntityEntry(vid, v2));
+    }
   }
+  entries.sort((a3, b3) => a3.validation_id.localeCompare(b3.validation_id));
+  return entries;
 }
-function emitValidationStep(step, participants, dsl, lastFromAgent, lines, indent) {
-  const val = dsl.validations[step.validation];
-  if (!val) return;
-  const executorAlias = participantAlias(participants, val.executor);
-  const artifactAlias = participantAlias(participants, val.target_artifact);
-  const fromAlias = lastFromAgent ? participantAlias(participants, lastFromAgent) : null;
-  if (fromAlias && fromAlias !== executorAlias) {
-    lines.push(`${indent}${fromAlias}->>${executorAlias}: ${step.validation}`);
+function buildTaskContext(dsl, taskId) {
+  const taskDef = dsl.tasks[taskId];
+  const task = { ...taskDef, id: taskId };
+  const agentDef = dsl.agents[taskDef.target_agent];
+  const targetAgent = agentDef ? { ...agentDef, id: taskDef.target_agent } : null;
+  const relatedGuardrails = resolveEffectiveGuardrails(dsl, "tasks", taskId);
+  const relatedValidations = resolveEntityValidations(dsl, "tasks", taskId);
+  return { task, targetAgent, relatedGuardrails, relatedValidations, dsl };
+}
+function buildArtifactContext(dsl, artifactId) {
+  const artifactDef = dsl.artifacts[artifactId];
+  const artifact = { ...artifactDef, id: artifactId };
+  const relatedTools = {};
+  for (const [id, tool] of Object.entries(dsl.tools)) {
+    if (tool.input_artifacts.includes(artifactId) || tool.output_artifacts.includes(artifactId)) {
+      relatedTools[id] = tool;
+    }
   }
-  lines.push(`${indent}${executorAlias}->>${artifactAlias}: [R] ${val.target_artifact}`);
-  if (fromAlias && fromAlias !== executorAlias) {
-    lines.push(`${indent}${executorAlias}-->>${fromAlias}: results`);
+  const relatedValidations = {};
+  for (const [id, val] of Object.entries(dsl.validations)) {
+    if (val.target_artifact === artifactId) {
+      relatedValidations[id] = val;
+    }
   }
-}
-function emitDecisionStep(step, participants, lastFromAgent, lines, indent) {
-  const branches = Object.entries(step.branches);
-  if (branches.length === 0) return;
-  const agentAl = lastFromAgent ? participantAlias(participants, lastFromAgent) : null;
-  for (let i3 = 0; i3 < branches.length; i3++) {
-    const [key, values] = branches[i3];
-    if (i3 === 0) {
-      lines.push(`${indent}alt ${key}`);
-    } else {
-      lines.push(`${indent}else ${key}`);
+  const pickAgents = (ids) => {
+    const result = {};
+    for (const id of ids) {
+      if (dsl.agents[id]) result[id] = dsl.agents[id];
     }
-    if (agentAl) {
-      lines.push(`${indent}    Note over ${agentAl}: ${values.join(", ")}`);
+    return result;
+  };
+  const producerAgents = pickAgents(artifactDef.producers);
+  const consumerAgents = pickAgents(artifactDef.consumers);
+  const editorAgents = pickAgents(artifactDef.editors);
+  const createdInWorkflows = [];
+  for (const [_taskId, task] of Object.entries(dsl.tasks)) {
+    if (createdInWorkflows.includes(task.workflow)) continue;
+    const targetAgent = dsl.agents[task.target_agent];
+    if (targetAgent?.can_write_artifacts.includes(artifactId)) {
+      createdInWorkflows.push(task.workflow);
+      continue;
+    }
+    const steps = task.execution_steps ?? [];
+    for (const step of steps) {
+      if (step["produces_artifact"] === artifactId) {
+        createdInWorkflows.push(task.workflow);
+        break;
+      }
     }
   }
-  lines.push(`${indent}end`);
+  const relatedGuardrails = resolveEffectiveGuardrails(dsl, "artifacts", artifactId);
+  return {
+    artifact,
+    relatedTools,
+    relatedValidations,
+    producerAgents,
+    consumerAgents,
+    editorAgents,
+    createdInWorkflows,
+    relatedGuardrails,
+    dsl
+  };
 }
-function emitDelegateStep(step, participants, dsl, relatedTasks, lines, indent) {
-  const taskMap = /* @__PURE__ */ new Map();
-  for (const t3 of relatedTasks) taskMap.set(t3.id, t3);
-  const task = taskMap.get(step.task);
-  if (!task) return;
-  const fromAlias = participantAlias(participants, step.from_agent);
-  const targetAlias = participantAlias(participants, task.target_agent);
-  lines.push(`${indent}${fromAlias}->>${targetAlias}: delegate ${step.task}`);
-  for (const es of task.execution_steps ?? []) {
-    emitExecutionStep(es, targetAlias, participants, lines, indent);
+function buildToolContext(dsl, toolId) {
+  const toolDef = dsl.tools[toolId];
+  const tool = { ...toolDef, id: toolId };
+  const invokableAgents = {};
+  for (const agentId of toolDef.invokable_by) {
+    if (dsl.agents[agentId]) invokableAgents[agentId] = dsl.agents[agentId];
   }
-  lines.push(`${indent}${targetAlias}-->>${fromAlias}: ${task.result_handoff}`);
+  const pickArtifacts = (ids) => {
+    const result = {};
+    for (const id of ids) {
+      if (dsl.artifacts[id]) result[id] = dsl.artifacts[id];
+    }
+    return result;
+  };
+  const relatedGuardrails = resolveEffectiveGuardrails(dsl, "tools", toolId);
+  const relatedValidations = resolveEntityValidations(dsl, "tools", toolId);
+  return {
+    tool,
+    invokableAgents,
+    inputArtifactDetails: pickArtifacts(toolDef.input_artifacts),
+    outputArtifactDetails: pickArtifacts(toolDef.output_artifacts),
+    relatedGuardrails,
+    relatedValidations,
+    dsl
+  };
 }
-function emitGateStep(step, participants, lastFromAgent, lines, indent) {
-  if (lastFromAgent) {
-    const agentAl = participantAlias(participants, lastFromAgent);
-    lines.push(`${indent}${agentAl}->>${agentAl}: ${step.gate_kind}`);
-  }
+function buildValidationContext(dsl, validationId) {
+  const validationDef = dsl.validations[validationId];
+  const validation = { ...validationDef, id: validationId };
+  return { validation, dsl };
 }
-function emitRetryBlock(fromAgent, retry, participants, relatedTasks, lines, indent) {
-  const taskMap = /* @__PURE__ */ new Map();
-  for (const t3 of relatedTasks) taskMap.set(t3.id, t3);
-  lines.push(`${indent}opt ${retry.condition}`);
-  const innerIndent = indent + "    ";
-  const fixTask = taskMap.get(retry.fix_task);
-  if (fixTask) {
-    const fromAlias = fromAgent ? participantAlias(participants, fromAgent) : null;
-    const targetAlias = participantAlias(participants, fixTask.target_agent);
-    if (fromAlias) {
-      lines.push(`${innerIndent}${fromAlias}->>${targetAlias}: fix ${retry.fix_task}`);
-    }
-    for (const es of fixTask.execution_steps ?? []) {
-      emitExecutionStep(es, targetAlias, participants, lines, innerIndent);
-    }
-    if (fromAlias) {
-      lines.push(`${innerIndent}${targetAlias}-->>${fromAlias}: ${fixTask.result_handoff}`);
+function buildHandoffTypeContext(dsl, handoffTypeId) {
+  const htDef = dsl.handoff_types[handoffTypeId];
+  const handoff_type = { ...htDef, id: handoffTypeId };
+  const relatedTasks = Object.entries(dsl.tasks).filter(
+    ([, t3]) => t3.invocation_handoff === handoffTypeId || t3.result_handoff === handoffTypeId
+  ).map(([id, t3]) => ({ ...t3, id }));
+  return { handoff_type, relatedTasks, dsl };
+}
+function buildWorkflowContext(dsl, workflowId) {
+  const wfDef = dsl.workflow[workflowId];
+  const workflow = { ...wfDef, id: workflowId };
+  const stepReferencedTaskIds = /* @__PURE__ */ new Set();
+  for (const step of wfDef.steps) {
+    if (step.type === "delegate") {
+      stepReferencedTaskIds.add(step.task);
+      if (step.retry) {
+        stepReferencedTaskIds.add(step.retry.fix_task);
+        if (step.retry.revalidate_task) stepReferencedTaskIds.add(step.retry.revalidate_task);
+      }
+    } else if (step.type === "handoff" && step.task) {
+      stepReferencedTaskIds.add(step.task);
+      if (step.retry) {
+        stepReferencedTaskIds.add(step.retry.fix_task);
+        if (step.retry.revalidate_task) stepReferencedTaskIds.add(step.retry.revalidate_task);
+      }
     }
   }
-  if (retry.revalidate_task) {
-    const revalTask = taskMap.get(retry.revalidate_task);
-    if (revalTask) {
-      const fromAlias = fromAgent ? participantAlias(participants, fromAgent) : null;
-      const revalAlias = participantAlias(participants, revalTask.target_agent);
-      if (fromAlias) {
-        lines.push(`${innerIndent}${fromAlias}->>${revalAlias}: revalidate ${retry.revalidate_task}`);
-        lines.push(`${innerIndent}${revalAlias}-->>${fromAlias}: ${revalTask.result_handoff}`);
-      }
+  const relatedTasks = Object.entries(dsl.tasks).filter(([id, t3]) => t3.workflow === workflowId || stepReferencedTaskIds.has(id)).map(([id, t3]) => ({ ...t3, id }));
+  const agentIds = /* @__PURE__ */ new Set();
+  for (const task of relatedTasks) {
+    agentIds.add(task.target_agent);
+    for (const fromAgent of task.allowed_from_agents) {
+      agentIds.add(fromAgent);
     }
   }
-  lines.push(`${indent}end`);
-}
-function groupSteps(steps) {
-  const result = [];
-  let currentGroup = null;
-  for (let i3 = 0; i3 < steps.length; i3++) {
-    const step = steps[i3];
-    const group = "group" in step ? step.group : void 0;
-    if (group) {
-      if (currentGroup && currentGroup.group === group) {
-        currentGroup.steps.push({ step, index: i3 });
-      } else {
-        if (currentGroup) result.push(currentGroup);
-        currentGroup = { group, steps: [{ step, index: i3 }] };
-      }
-    } else {
-      if (currentGroup) {
-        result.push(currentGroup);
-        currentGroup = null;
+  for (const step of wfDef.steps) {
+    if (step.type === "delegate") {
+      agentIds.add(step.from_agent);
+    } else if (step.type === "handoff" && step.from_agent) {
+      agentIds.add(step.from_agent);
+    }
+    if (step.type === "validation") {
+      const val = dsl.validations[step.validation];
+      if (val?.executor_type === "agent" && val.executor) {
+        agentIds.add(val.executor);
       }
-      result.push({ group: null, steps: [{ step, index: i3 }] });
     }
   }
-  if (currentGroup) result.push(currentGroup);
-  return result;
-}
-function generateSequenceDiagram(workflow, relatedTasks, dsl) {
-  const ids = collectReferencedIds(workflow, dsl, relatedTasks);
-  const externals = workflow.external_participants ?? [];
-  const participants = buildParticipants(ids, externals, dsl);
-  const lines = [];
-  const indent = "    ";
-  lines.push("sequenceDiagram");
-  emitParticipants(participants, externals, lines, indent);
-  lines.push("");
-  lines.push(`${indent}rect ${hashToColor(workflow.id, 0.15, 0.95)}`);
-  const firstP = participants[0];
-  const lastP = participants[participants.length - 1];
-  if (firstP && lastP) {
-    const noteLabel = workflow.description ? `${workflow.id} \u2014 ${workflow.description}` : workflow.id;
-    lines.push(`${indent}Note over ${firstP.alias},${lastP.alias}: ${noteLabel}`);
+  const relatedAgents = {};
+  for (const id of agentIds) {
+    if (dsl.agents[id]) relatedAgents[id] = dsl.agents[id];
   }
-  if (workflow.trigger && externals.some((ep) => ep.kind === "actor")) {
-    const actor = externals.find((ep) => ep.kind === "actor");
-    const actorAlias = participantAlias(participants, actor.id);
-    const firstAgent = participants.find((p2) => p2.group === "agents" || p2.group === "audit");
-    if (firstAgent) {
-      lines.push(`${indent}${actorAlias}->>${firstAgent.alias}: ${workflow.trigger}`);
+  const toolIds = /* @__PURE__ */ new Set();
+  for (const id of agentIds) {
+    const agent = dsl.agents[id];
+    if (agent) {
+      for (const toolId of agent.can_execute_tools) {
+        toolIds.add(toolId);
+      }
     }
   }
-  let lastFromAgent;
-  const grouped = groupSteps(workflow.steps);
-  for (const g2 of grouped) {
-    if (g2.group && g2.steps.length > 1) {
-      lines.push("");
-      lines.push(`${indent}par ${g2.group}`);
-      const parIndent = indent + "    ";
-      for (let i3 = 0; i3 < g2.steps.length; i3++) {
-        const { step } = g2.steps[i3];
-        if (i3 > 0) lines.push(`${indent}and`);
-        emitStep(step, participants, dsl, relatedTasks, lines, parIndent, lastFromAgent, (a3) => {
-          lastFromAgent = a3;
-        });
-      }
-      lines.push(`${indent}end`);
-    } else {
-      for (const { step } of g2.steps) {
-        lines.push("");
-        emitStep(step, participants, dsl, relatedTasks, lines, indent, lastFromAgent, (a3) => {
-          lastFromAgent = a3;
-        });
-      }
+  for (const task of relatedTasks) {
+    for (const step of task.execution_steps ?? []) {
+      if (step.uses_tool) toolIds.add(step.uses_tool);
     }
   }
-  lines.push("");
-  lines.push(`${indent}end`);
-  return lines.join("\n");
-}
-function emitStep(step, participants, dsl, relatedTasks, lines, indent, lastFromAgent, setLastFromAgent) {
-  if (step.type === "delegate") {
-    setLastFromAgent(step.from_agent);
-    emitDelegateStep(step, participants, dsl, relatedTasks, lines, indent);
-    if (step.retry) {
-      emitRetryBlock(step.from_agent, step.retry, participants, relatedTasks, lines, indent);
+  const relatedTools = {};
+  for (const id of toolIds) {
+    if (dsl.tools[id]) relatedTools[id] = dsl.tools[id];
+  }
+  const artifactIds = /* @__PURE__ */ new Set();
+  for (const task of relatedTasks) {
+    for (const artId of task.input_artifacts) artifactIds.add(artId);
+    for (const step of task.execution_steps ?? []) {
+      if (step.produces_artifact) artifactIds.add(step.produces_artifact);
+      if (step.reads_artifact) artifactIds.add(step.reads_artifact);
     }
-  } else if (step.type === "gate") {
-    emitGateStep(step, participants, lastFromAgent, lines, indent);
-  } else if (step.type === "handoff") {
-    if (step.from_agent) setLastFromAgent(step.from_agent);
-    emitHandoffStep(step, participants, dsl, relatedTasks, lines, indent);
-    if (step.retry) {
-      emitRetryBlock(step.from_agent, step.retry, participants, relatedTasks, lines, indent);
+  }
+  for (const id of agentIds) {
+    const agent = dsl.agents[id];
+    if (agent) {
+      for (const artId of agent.can_read_artifacts) artifactIds.add(artId);
+      for (const artId of agent.can_write_artifacts) artifactIds.add(artId);
     }
-  } else if (step.type === "validation") {
-    emitValidationStep(step, participants, dsl, lastFromAgent, lines, indent);
-  } else if (step.type === "decision") {
-    emitDecisionStep(step, participants, lastFromAgent, lines, indent);
   }
-}
-
-// src/renderer/overview-flowchart.ts
-function collectPhaseOps(dsl, wfId) {
-  const ctx = buildWorkflowContext(dsl, wfId);
-  const wf = dsl.workflow[wfId];
-  const agentOps = /* @__PURE__ */ new Map();
-  const artifactOps = /* @__PURE__ */ new Map();
-  const toolOps = /* @__PURE__ */ new Map();
-  function addOp(map, id, op) {
-    if (!map.has(id)) map.set(id, /* @__PURE__ */ new Set());
-    map.get(id).add(op);
+  const relatedArtifacts = {};
+  for (const id of artifactIds) {
+    if (dsl.artifacts[id]) relatedArtifacts[id] = dsl.artifacts[id];
   }
-  const taskMap = new Map(ctx.relatedTasks.map((t3) => [t3.id, t3]));
-  function collectTaskOps(task) {
-    addOp(agentOps, task.target_agent, "execute");
-    for (const es of task.execution_steps ?? []) {
-      if (es.reads_artifact) addOp(artifactOps, es.reads_artifact, "R");
-      if (es.produces_artifact) addOp(artifactOps, es.produces_artifact, "W");
-      if (es.uses_tool) {
-        const tool = dsl.tools[es.uses_tool];
-        if (tool) {
-          const cats = tool.commands.map((c2) => c2.category).filter((v2, i3, a3) => a3.indexOf(v2) === i3);
-          for (const cat of cats) addOp(toolOps, es.uses_tool, cat);
-          if (cats.length === 0) addOp(toolOps, es.uses_tool, "\u2713");
-        } else {
-          addOp(toolOps, es.uses_tool, "\u2713");
-        }
-      }
+  const validationIds = /* @__PURE__ */ new Set();
+  for (const step of wfDef.steps) {
+    if (step.type === "validation") {
+      validationIds.add(step.validation);
     }
   }
-  for (const step of wf.steps) {
-    if (step.type === "delegate") {
-      addOp(agentOps, step.from_agent, "delegate");
-      const task = taskMap.get(step.task);
-      if (task) collectTaskOps(task);
-    } else if (step.type === "gate") {
-    } else if (step.type === "handoff") {
-      if (step.from_agent) addOp(agentOps, step.from_agent, "delegate");
-      if (step.task) {
-        const task = taskMap.get(step.task);
-        if (task) collectTaskOps(task);
-      }
-    } else if (step.type === "validation") {
-      const val = dsl.validations[step.validation];
-      if (val) {
-        if (val.executor_type === "agent") {
-          addOp(agentOps, val.executor, "validate");
-        } else {
-          addOp(toolOps, val.executor, "verification");
-        }
-        addOp(artifactOps, val.target_artifact, "V");
-      }
+  for (const task of relatedTasks) {
+    for (const valId of task.validations ?? []) {
+      validationIds.add(valId);
     }
   }
-  return { agentOps, artifactOps, toolOps };
+  const relatedValidations = {};
+  for (const id of validationIds) {
+    if (dsl.validations[id]) relatedValidations[id] = dsl.validations[id];
+  }
+  return {
+    workflow,
+    relatedAgents,
+    relatedTasks,
+    relatedTools,
+    relatedArtifacts,
+    relatedValidations,
+    dsl
+  };
 }
-function formatOps(ops) {
-  if (!ops || ops.size === 0) return "\u2014";
-  return [...ops].join(", ");
+function buildPolicyContext(dsl, policyId) {
+  const policyDef = dsl.policies[policyId];
+  const policy = { ...policyDef, id: policyId };
+  return { policy, dsl };
 }
-function buildTable(header, rows) {
-  const lines = [];
-  lines.push("| " + header.join(" | ") + " |");
-  lines.push("|" + header.map(() => "---").join("|") + "|");
-  for (const row of rows) {
-    lines.push("| " + row.join(" | ") + " |");
+function buildGuardrailContext(dsl, guardrailId) {
+  const guardrailDef = dsl.guardrails[guardrailId];
+  const guardrail = { ...guardrailDef, id: guardrailId };
+  return { guardrail, dsl };
+}
+function buildGuardrailPolicyContext(dsl, policyId) {
+  const policyDef = dsl.guardrail_policies[policyId];
+  const guardrail_policy = { ...policyDef, id: policyId };
+  return { guardrail_policy, dsl };
+}
+function mergeRules(agentRules, taskRules) {
+  const result = [...agentRules];
+  const existingIds = new Set(result.map((r3) => r3["id"]));
+  for (const rule of taskRules) {
+    const id = rule["id"];
+    if (existingIds.has(id)) {
+      const idx = result.findIndex((r3) => r3["id"] === id);
+      result[idx] = rule;
+    } else {
+      result.push(rule);
+    }
   }
-  return lines.join("\n");
+  return result;
 }
-function generateOverviewFlowchart(dsl) {
-  const workflowOrder = dsl.system.default_workflow_order ?? Object.keys(dsl.workflow);
-  const phases = workflowOrder.filter((id) => dsl.workflow[id]);
-  const phaseData = /* @__PURE__ */ new Map();
-  for (const wfId of phases) {
-    phaseData.set(wfId, collectPhaseOps(dsl, wfId));
+function mergeBehavioralSpec(agent, tasks) {
+  let responsibilities = agent.responsibilities ?? [];
+  let constraints = agent.constraints ?? [];
+  let rules = agent.rules ?? [];
+  let antiPatterns = agent.anti_patterns ?? [];
+  let escalation = agent.escalation_criteria ?? [];
+  let executionSteps = [];
+  let completionCriteria = [];
+  for (const task of tasks) {
+    responsibilities = [...responsibilities, ...task.responsibilities ?? []];
+    constraints = [...constraints, ...task.constraints ?? []];
+    rules = mergeRules(rules, task.rules ?? []);
+    antiPatterns = [...antiPatterns, ...task.anti_patterns ?? []];
+    escalation = [...escalation, ...task.escalation_criteria ?? []];
+    executionSteps = [...executionSteps, ...task.execution_steps ?? []];
+    completionCriteria = [...completionCriteria, ...task.completion_criteria ?? []];
   }
-  const allAgentIds = /* @__PURE__ */ new Set();
-  const allArtifactIds = /* @__PURE__ */ new Set();
-  const allToolIds = /* @__PURE__ */ new Set();
-  for (const ops of phaseData.values()) {
-    for (const id of ops.agentOps.keys()) allAgentIds.add(id);
-    for (const id of ops.artifactOps.keys()) allArtifactIds.add(id);
-    for (const id of ops.toolOps.keys()) allToolIds.add(id);
+  return {
+    responsibilities,
+    constraints,
+    rules,
+    anti_patterns: antiPatterns,
+    escalation_criteria: escalation,
+    execution_steps: executionSteps,
+    completion_criteria: completionCriteria
+  };
+}
+function extractSchemaFieldNames(schema) {
+  const effective = resolveAllOf(schema);
+  const props = effective["properties"];
+  if (props && typeof props === "object") {
+    return Object.keys(props);
   }
-  const sections = [];
-  if (allAgentIds.size > 0) {
-    const header = ["Agent", ...phases];
-    const rows = [];
-    for (const agentId of allAgentIds) {
-      const agent = dsl.agents[agentId];
-      const label = agent ? agent.role_name : agentId;
-      const row = [label];
-      for (const wfId of phases) {
-        row.push(formatOps(phaseData.get(wfId).agentOps.get(agentId)));
-      }
-      rows.push(row);
-    }
-    sections.push("#### Agent \xD7 Phase\n\n" + buildTable(header, rows));
+  return Object.keys(schema);
+}
+function buildDelegatableTasks(dsl, agentId) {
+  return Object.entries(dsl.tasks).filter(([, t3]) => t3.allowed_from_agents.includes(agentId)).map(([taskId, t3]) => {
+    const invocationHandoff = dsl.handoff_types[t3.invocation_handoff];
+    const resultHandoff = dsl.handoff_types[t3.result_handoff];
+    return {
+      id: taskId,
+      description: t3.description,
+      target_agent: t3.target_agent,
+      workflow: t3.workflow,
+      input_artifacts: t3.input_artifacts,
+      invocation_handoff: t3.invocation_handoff,
+      invocation_payload_keys: invocationHandoff ? extractSchemaFieldNames(invocationHandoff.schema) : [],
+      result_handoff: t3.result_handoff,
+      result_payload_keys: resultHandoff ? extractSchemaFieldNames(resultHandoff.schema) : []
+    };
+  });
+}
+function buildPerAgentContext(dsl, agent) {
+  const agentId = agent.id;
+  const receivableTasks = Object.entries(dsl.tasks).filter(([, t3]) => t3.target_agent === agentId).map(([id, t3]) => ({ ...t3, id }));
+  const delegatableTasks = buildDelegatableTasks(dsl, agentId);
+  const artifactIds = /* @__PURE__ */ new Set([
+    ...agent.can_read_artifacts,
+    ...agent.can_write_artifacts
+  ]);
+  const relatedArtifacts = {};
+  for (const [id, art] of Object.entries(dsl.artifacts)) {
+    if (artifactIds.has(id)) relatedArtifacts[id] = art;
   }
-  if (allArtifactIds.size > 0) {
-    const header = ["Artifact", ...phases];
-    const rows = [];
-    for (const artId of allArtifactIds) {
-      const row = [artId];
-      for (const wfId of phases) {
-        row.push(formatOps(phaseData.get(wfId).artifactOps.get(artId)));
-      }
-      rows.push(row);
-    }
-    sections.push("#### Artifact \xD7 Phase\n\n" + buildTable(header, rows));
+  const toolIdSet = new Set(agent.can_execute_tools);
+  const relatedTools = {};
+  for (const [id, tool] of Object.entries(dsl.tools)) {
+    if (toolIdSet.has(id)) relatedTools[id] = tool;
   }
-  if (allToolIds.size > 0) {
-    const header = ["Tool", ...phases];
-    const rows = [];
-    for (const toolId of allToolIds) {
-      const row = [toolId];
-      for (const wfId of phases) {
-        row.push(formatOps(phaseData.get(wfId).toolOps.get(toolId)));
-      }
-      rows.push(row);
-    }
-    sections.push("#### Tool \xD7 Phase\n\n" + buildTable(header, rows));
+  const handoffKinds = /* @__PURE__ */ new Set([
+    ...agent.can_return_handoffs,
+    ...receivableTasks.map((t3) => t3.invocation_handoff),
+    ...receivableTasks.map((t3) => t3.result_handoff),
+    ...delegatableTasks.map((t3) => t3.invocation_handoff),
+    ...delegatableTasks.map((t3) => t3.result_handoff)
+  ]);
+  const relatedHandoffTypes = {};
+  for (const [kind, ht] of Object.entries(dsl.handoff_types)) {
+    if (handoffKinds.has(kind)) relatedHandoffTypes[kind] = ht;
   }
-  return sections.join("\n\n");
+  const rawReceivableTasks = receivableTasks.map(({ id: _id, ...rest }) => rest);
+  const mergedBehavior = mergeBehavioralSpec(agent, rawReceivableTasks);
+  const relatedGuardrails = resolveEffectiveGuardrails(dsl, "agents", agentId);
+  const relatedValidations = resolveEntityValidations(dsl, "agents", agentId);
+  return {
+    agent,
+    tasks: receivableTasks,
+    receivableTasks,
+    delegatableTasks,
+    relatedArtifacts,
+    relatedTools,
+    relatedHandoffTypes,
+    mergedBehavior,
+    relatedGuardrails,
+    relatedValidations,
+    dsl
+  };
 }
 
-// src/renderer/renderer.ts
-Handlebars.registerHelper("eq", (a3, b3) => a3 === b3);
-Handlebars.registerHelper("notEmpty", (obj) => {
-  if (!obj || typeof obj !== "object") return false;
-  return Object.keys(obj).length > 0;
-});
-Handlebars.registerHelper("inc", (val) => val + 1);
-Handlebars.registerHelper(
-  "lookupPayloadFields",
-  (schema) => {
-    const effective = resolveAllOf(schema ?? {});
-    const props = effective["properties"];
-    if (!props) return [];
-    const requiredSet = new Set(
-      effective["required"] ?? []
-    );
-    return Object.entries(props).map(([name, sub]) => {
-      const enumVals = sub["enum"];
-      return {
-        name,
-        type: sub["type"] ?? "any",
-        required: requiredSet.has(name),
-        enum: enumVals ? enumVals.join(" | ") : void 0
-      };
-    });
-  }
-);
-function toYamlLines(obj, indent) {
-  const pad = "  ".repeat(indent);
-  if (obj === null || obj === void 0) return [`${pad}null`];
-  if (typeof obj === "boolean" || typeof obj === "number")
-    return [`${pad}${obj}`];
-  if (typeof obj === "string") {
-    if (obj.includes("\n")) {
-      const lines = [`${pad}|`];
-      for (const line of obj.split("\n")) {
-        lines.push(line === "" ? "" : `${pad}  ${line}`);
-      }
-      return lines;
-    }
-    return [`${pad}${JSON.stringify(obj)}`];
-  }
-  if (Array.isArray(obj)) {
-    const lines = [];
-    for (const item of obj) {
-      if (typeof item === "object" && item !== null && !Array.isArray(item)) {
-        const entries = Object.entries(item);
-        if (entries.length > 0) {
-          const [firstKey, firstVal] = entries[0];
-          const firstValLines = toYamlLines(firstVal, 0);
-          if (firstValLines.length === 1 && !firstValLines[0].includes("\n")) {
-            lines.push(`${pad}- ${firstKey}: ${firstValLines[0].trim()}`);
-          } else {
-            lines.push(`${pad}- ${firstKey}:`);
-            lines.push(...toYamlLines(firstVal, indent + 2));
-          }
-          for (let i3 = 1; i3 < entries.length; i3++) {
-            const [k2, v2] = entries[i3];
-            const vLines = toYamlLines(v2, indent + 2);
-            if (vLines.length === 1) {
-              lines.push(`${pad}  ${k2}: ${vLines[0].trim()}`);
-            } else {
-              lines.push(`${pad}  ${k2}:`);
-              lines.push(...vLines);
-            }
-          }
-        } else {
-          lines.push(`${pad}- {}`);
-        }
-      } else {
-        const valLines = toYamlLines(item, 0);
-        lines.push(`${pad}- ${valLines[0].trim()}`);
-      }
-    }
-    return lines;
-  }
-  if (typeof obj === "object") {
-    const lines = [];
-    for (const [key, value] of Object.entries(
-      obj
-    )) {
-      const valLines = toYamlLines(value, indent + 1);
-      if (valLines.length === 1 && !valLines[0].includes("|")) {
-        lines.push(`${pad}${key}: ${valLines[0].trim()}`);
-      } else {
-        lines.push(`${pad}${key}:`);
-        lines.push(...valLines);
-      }
-    }
-    return lines;
+// src/renderer/sequence-diagram.ts
+function hashToColor(s2, saturation, lightness) {
+  let hash = 0;
+  for (const ch of s2) hash = (hash << 5) - hash + ch.charCodeAt(0) | 0;
+  const h2 = (hash % 360 + 360) % 360;
+  const c2 = (1 - Math.abs(2 * lightness - 1)) * saturation;
+  const x3 = c2 * (1 - Math.abs(h2 / 60 % 2 - 1));
+  const m2 = lightness - c2 / 2;
+  let r3 = 0, g2 = 0, b3 = 0;
+  if (h2 < 60) {
+    r3 = c2;
+    g2 = x3;
+  } else if (h2 < 120) {
+    r3 = x3;
+    g2 = c2;
+  } else if (h2 < 180) {
+    g2 = c2;
+    b3 = x3;
+  } else if (h2 < 240) {
+    g2 = x3;
+    b3 = c2;
+  } else if (h2 < 300) {
+    r3 = x3;
+    b3 = c2;
+  } else {
+    r3 = c2;
+    b3 = x3;
   }
-  return [`${pad}${String(obj)}`];
+  return `rgb(${Math.round((r3 + m2) * 255)},${Math.round((g2 + m2) * 255)},${Math.round((b3 + m2) * 255)})`;
 }
-Handlebars.registerHelper("yamlBlock", (obj) => {
-  return toYamlLines(obj, 0).join("\n");
-});
-Handlebars.registerHelper(
-  "join",
-  (arr, separator) => {
-    if (!Array.isArray(arr)) return "";
-    const sep = typeof separator === "string" ? separator : ", ";
-    return arr.join(sep);
-  }
-);
-Handlebars.registerHelper("contains", (arr, value) => {
-  if (!Array.isArray(arr)) return false;
-  return arr.includes(value);
-});
-Handlebars.registerHelper(
-  "groupBy",
-  (arr, key) => {
-    if (!Array.isArray(arr)) return {};
-    const result = {};
-    for (const item of arr) {
-      const k2 = String(
-        item?.[key] ?? "undefined"
-      );
-      (result[k2] ??= []).push(item);
+function sanitizeAlias(id) {
+  return id.replace(/[^a-zA-Z0-9_]/g, "_");
+}
+function agentAlias(id, agent) {
+  const words = agent.role_name.split(/\s+/);
+  if (words.length === 1) return sanitizeAlias(words[0].slice(0, 4));
+  return sanitizeAlias(words.map((w2) => w2[0]).join(""));
+}
+function collectReferencedIds(workflow, dsl, relatedTasks) {
+  const agents = /* @__PURE__ */ new Set();
+  const auditAgents = /* @__PURE__ */ new Set();
+  const tools = /* @__PURE__ */ new Set();
+  const artifacts = /* @__PURE__ */ new Set();
+  const taskMap = /* @__PURE__ */ new Map();
+  for (const t3 of relatedTasks) taskMap.set(t3.id, t3);
+  function collectTaskIds(task) {
+    addAgent(task.target_agent);
+    for (const es of task.execution_steps ?? []) {
+      collectExecutionStepIds(es, tools, artifacts);
     }
-    return result;
-  }
-);
-Handlebars.registerHelper(
-  "keys",
-  (obj) => {
-    if (!obj || typeof obj !== "object") return [];
-    return Object.keys(obj);
   }
-);
-Handlebars.registerHelper(
-  "values",
-  (obj) => {
-    if (!obj || typeof obj !== "object") return [];
-    return Object.values(obj);
+  function collectRetryIds(retry) {
+    const fixTask = taskMap.get(retry.fix_task);
+    if (fixTask) collectTaskIds(fixTask);
+    if (retry.revalidate_task) {
+      const revalTask = taskMap.get(retry.revalidate_task);
+      if (revalTask) addAgent(revalTask.target_agent);
+    }
   }
-);
-Handlebars.registerHelper(
-  "filterByField",
-  (arr, field, value) => {
-    if (!Array.isArray(arr)) return [];
-    return arr.filter(
-      (item) => item?.[field] === value
-    );
+  for (const step of workflow.steps) {
+    if (step.type === "delegate") {
+      addAgent(step.from_agent);
+      const task = taskMap.get(step.task);
+      if (task) collectTaskIds(task);
+      if (step.retry) collectRetryIds(step.retry);
+    } else if (step.type === "gate") {
+    } else if (step.type === "handoff") {
+      if (step.from_agent) addAgent(step.from_agent);
+      if (step.task) {
+        const task = taskMap.get(step.task);
+        if (task) collectTaskIds(task);
+      }
+      if (step.retry) collectRetryIds(step.retry);
+    } else if (step.type === "validation") {
+      const val = dsl.validations[step.validation];
+      if (val) {
+        if (val.executor_type === "agent") addAgent(val.executor);
+        else tools.add(val.executor);
+        artifacts.add(val.target_artifact);
+      }
+    }
   }
-);
-Handlebars.registerHelper("not", (value) => !value);
-Handlebars.registerHelper("or", (...args) => {
-  const _options = args.pop();
-  return args.some((a3) => !!a3);
-});
-Handlebars.registerHelper("coalesce", (...args) => {
-  const _options = args.pop();
-  return args.find((a3) => a3 != null && a3 !== false && a3 !== "");
-});
-Handlebars.registerHelper("and", (...args) => {
-  const _options = args.pop();
-  return args.every((a3) => !!a3);
-});
-Handlebars.registerHelper("gt", (a3, b3) => a3 > b3);
-Handlebars.registerHelper("gte", (a3, b3) => a3 >= b3);
-Handlebars.registerHelper("lt", (a3, b3) => a3 < b3);
-Handlebars.registerHelper("size", (obj) => {
-  if (Array.isArray(obj)) return obj.length;
-  if (obj && typeof obj === "object") return Object.keys(obj).length;
-  return 0;
-});
-Handlebars.registerHelper(
-  "sequenceDiagram",
-  function(...args) {
-    const opts = args[args.length - 1];
-    const positionalArgs = args.slice(0, -1);
-    if (typeof positionalArgs[0] === "string" && positionalArgs[1]) {
-      const workflowId = positionalArgs[0];
-      const dsl2 = positionalArgs[1];
-      if (!dsl2.workflow[workflowId]) return "";
-      const ctx = buildWorkflowContext(dsl2, workflowId);
-      return generateSequenceDiagram(
-        ctx.workflow,
-        ctx.relatedTasks,
-        dsl2
-      );
+  function addAgent(agentId) {
+    const agent = dsl.agents[agentId];
+    if (agent?.mode === "read-only") {
+      auditAgents.add(agentId);
+    } else {
+      agents.add(agentId);
     }
-    const workflow = this["workflow"];
-    const relatedTasks = this["relatedTasks"];
-    const dsl = opts?.hash?.["dsl"] ?? this["dsl"];
-    if (!workflow || !dsl) return "";
-    return generateSequenceDiagram(workflow, relatedTasks ?? [], dsl);
   }
-);
-Handlebars.registerHelper(
-  "overviewFlowchart",
-  function(...args) {
-    const positionalArgs = args.slice(0, -1);
-    if (positionalArgs[0] && typeof positionalArgs[0] === "object") {
-      return generateOverviewFlowchart(positionalArgs[0]);
+  return { agents, auditAgents, tools, artifacts };
+}
+function collectExecutionStepIds(es, tools, artifacts) {
+  if (es.uses_tool) tools.add(es.uses_tool);
+  if (es.produces_artifact) artifacts.add(es.produces_artifact);
+  if (es.reads_artifact) artifacts.add(es.reads_artifact);
+}
+function buildParticipants(ids, externals, dsl) {
+  const participants = [];
+  const usedAliases = /* @__PURE__ */ new Set();
+  function uniqueAlias(preferred) {
+    let alias = preferred;
+    let i3 = 2;
+    while (usedAliases.has(alias)) {
+      alias = `${preferred}${i3}`;
+      i3++;
     }
-    const dsl = this["dsl"];
-    if (!dsl) return "";
-    return generateOverviewFlowchart(dsl);
+    usedAliases.add(alias);
+    return alias;
   }
-);
-Handlebars.registerHelper(
-  "guardrailCoverageMatrix",
-  function() {
-    const enforcement = this["guardrailEnforcement"];
-    if (!enforcement || enforcement.length === 0) return "";
-    const header = "| Guardrail | Severity | Action | Agents | Tasks | Workflows | Tools | Artifacts | Trigger | Override | Escalation |";
-    const divider = "|-----------|----------|--------|--------|-------|-----------|-------|-----------|---------|----------|------------|";
-    const rows = enforcement.map((e3) => {
-      const agents = e3["scoped_agents"]?.join(", ") || "\u2014";
-      const tasks = e3["scoped_tasks"]?.join(", ") || "\u2014";
-      const workflows = e3["scoped_workflows"]?.join(", ") || "\u2014";
-      const tools = e3["scoped_tools"]?.join(", ") || "\u2014";
-      const artifacts = e3["scoped_artifacts"]?.join(", ") || "\u2014";
-      const trigger = e3["trigger"] || "\u2014";
-      const override = e3["allow_override"] ? "yes" : "no";
-      const esc = e3["escalation"];
-      const escalation = esc ? esc["target"] : "\u2014";
-      return `| ${e3["guardrail_id"]} | ${e3["severity"]} | ${e3["action"]} | ${agents} | ${tasks} | ${workflows} | ${tools} | ${artifacts} | ${trigger} | ${override} | ${escalation} |`;
-    });
-    return [header, divider, ...rows].join("\n");
+  for (const ep of externals) {
+    const alias = uniqueAlias(sanitizeAlias(ep.id));
+    participants.push({ id: ep.id, alias, label: ep.label, group: "external" });
   }
-);
-Handlebars.registerHelper(
-  "taskGuardrailMatrix",
-  function() {
-    const dsl = this["dsl"];
-    const enforcement = this["guardrailEnforcement"];
-    if (!dsl || !enforcement || enforcement.length === 0) return "";
-    const taskIds = Object.keys(dsl.tasks);
-    if (taskIds.length === 0) return "";
-    const guardrailIds = enforcement.map((e3) => e3["guardrail_id"]);
-    const header = `| Task | ${guardrailIds.join(" | ")} |`;
-    const divider = `|------|${guardrailIds.map(() => "------").join("|")}|`;
-    const rows = taskIds.map((taskId) => {
-      const cells = enforcement.map((e3) => {
-        const scopedTasks = e3["scoped_tasks"];
-        if (scopedTasks.length > 0 && !scopedTasks.includes(taskId)) return "n/a";
-        return e3["action"];
-      });
-      return `| ${taskId} | ${cells.join(" | ")} |`;
-    });
-    return [header, divider, ...rows].join("\n");
+  for (const id of ids.agents) {
+    const agent = dsl.agents[id];
+    if (!agent) continue;
+    const alias = uniqueAlias(agentAlias(id, agent));
+    participants.push({ id, alias, label: agent.role_name, group: "agents" });
   }
-);
-function getDslSection(dsl, context) {
-  const sectionMap = {
-    agent: dsl.agents,
-    task: dsl.tasks,
-    artifact: dsl.artifacts,
-    tool: dsl.tools,
-    validation: dsl.validations,
-    handoff_type: dsl.handoff_types,
-    workflow: dsl.workflow,
-    policy: dsl.policies,
-    guardrail: dsl.guardrails,
-    guardrail_policy: dsl.guardrail_policies
-  };
-  return sectionMap[context] ?? {};
-}
-function filterIds(allIds, include, exclude) {
-  if (include) return allIds.filter((id) => include.includes(id));
-  if (exclude) return allIds.filter((id) => !exclude.includes(id));
-  return allIds;
+  for (const id of ids.auditAgents) {
+    const agent = dsl.agents[id];
+    if (!agent) continue;
+    const alias = uniqueAlias(agentAlias(id, agent));
+    participants.push({ id, alias, label: agent.role_name, group: "audit" });
+  }
+  for (const id of ids.tools) {
+    const tool = dsl.tools[id];
+    if (!tool) continue;
+    const alias = uniqueAlias(sanitizeAlias(id));
+    participants.push({ id, alias, label: id, group: "toolchain" });
+  }
+  for (const id of ids.artifacts) {
+    const art = dsl.artifacts[id];
+    if (!art) continue;
+    const alias = uniqueAlias(sanitizeAlias(id));
+    participants.push({ id, alias, label: id, group: "artifacts" });
+  }
+  return participants;
 }
-function expandOutputPath(pattern, context, entityId) {
-  return pattern.replace(new RegExp(`\\{${context}\\.id\\}`, "g"), entityId);
+function participantAlias(participants, id) {
+  const p2 = participants.find((pp) => pp.id === id);
+  return p2 ? p2.alias : sanitizeAlias(id);
 }
-function buildEntityContext(dsl, context, entityId) {
-  switch (context) {
-    case "agent": {
-      const agentDef = dsl.agents[entityId];
-      const agentWithId = { ...agentDef, id: entityId };
-      return buildPerAgentContext(dsl, agentWithId);
+function emitParticipants(participants, externals, lines, indent) {
+  const groups = {
+    external: [],
+    agents: [],
+    audit: [],
+    toolchain: [],
+    artifacts: []
+  };
+  for (const p2 of participants) groups[p2.group].push(p2);
+  const externalMap = /* @__PURE__ */ new Map();
+  for (const ep of externals) externalMap.set(ep.id, ep);
+  if (groups.external.length > 0) {
+    lines.push(`${indent}box rgb(255,245,230) External`);
+    for (const p2 of groups.external) {
+      const ep = externalMap.get(p2.id);
+      const keyword = ep?.kind === "actor" ? "actor" : "participant";
+      if (p2.alias === p2.label) {
+        lines.push(`${indent}${keyword} ${p2.alias}`);
+      } else {
+        lines.push(`${indent}${keyword} ${p2.alias} as ${p2.label}`);
+      }
     }
-    case "task":
-      return buildTaskContext(dsl, entityId);
-    case "artifact":
-      return buildArtifactContext(dsl, entityId);
-    case "tool":
-      return buildToolContext(dsl, entityId);
-    case "validation":
-      return buildValidationContext(dsl, entityId);
-    case "handoff_type":
-      return buildHandoffTypeContext(dsl, entityId);
-    case "workflow":
-      return buildWorkflowContext(dsl, entityId);
-    case "policy":
-      return buildPolicyContext(dsl, entityId);
-    case "guardrail":
-      return buildGuardrailContext(dsl, entityId);
-    case "guardrail_policy":
-      return buildGuardrailPolicyContext(dsl, entityId);
-    case "system":
-      return buildSystemContext(dsl);
+    lines.push(`${indent}end`);
+  }
+  const groupConfig = [
+    { key: "agents", label: "Agents", color: "rgb(200,220,255)" },
+    { key: "audit", label: "Audit", color: "rgb(255,220,220)" },
+    { key: "toolchain", label: "Toolchain", color: "rgb(220,255,220)" },
+    { key: "artifacts", label: "Artifacts", color: "rgb(255,230,210)" }
+  ];
+  for (const { key, label, color } of groupConfig) {
+    const members = groups[key];
+    if (members.length === 0) continue;
+    lines.push(`${indent}box ${color} ${label}`);
+    for (const p2 of members) {
+      if (p2.alias === p2.label) {
+        lines.push(`${indent}participant ${p2.alias}`);
+      } else {
+        lines.push(`${indent}participant ${p2.alias} as ${p2.label}`);
+      }
+    }
+    lines.push(`${indent}end`);
   }
 }
-async function loadTemplate(templatePath) {
-  return readFile4(templatePath, "utf8");
+function emitHandoffStep(step, participants, dsl, relatedTasks, lines, indent) {
+  const taskMap = /* @__PURE__ */ new Map();
+  for (const t3 of relatedTasks) taskMap.set(t3.id, t3);
+  if (!step.task) {
+    if (step.from_agent) {
+      const fromAlias2 = participantAlias(participants, step.from_agent);
+      lines.push(`${indent}${fromAlias2}->>${fromAlias2}: ${step.handoff_kind}`);
+    }
+    return;
+  }
+  const task = taskMap.get(step.task);
+  if (!task) return;
+  const fromAlias = step.from_agent ? participantAlias(participants, step.from_agent) : null;
+  const targetAlias = participantAlias(participants, task.target_agent);
+  if (fromAlias) {
+    lines.push(`${indent}${fromAlias}->>${targetAlias}: delegate ${step.task}`);
+  }
+  for (const es of task.execution_steps ?? []) {
+    emitExecutionStep(es, targetAlias, participants, lines, indent);
+  }
+  if (fromAlias) {
+    lines.push(`${indent}${targetAlias}-->>${fromAlias}: ${task.result_handoff}`);
+  }
 }
-function isEffectivelyEmpty(output) {
-  return output.trim().length === 0;
+function emitExecutionStep(es, agentAlias2, participants, lines, indent) {
+  if (es.reads_artifact) {
+    const artAlias = participantAlias(participants, es.reads_artifact);
+    lines.push(`${indent}${agentAlias2}->>${artAlias}: [R] ${es.action}`);
+  }
+  if (es.produces_artifact) {
+    const artAlias = participantAlias(participants, es.produces_artifact);
+    lines.push(`${indent}${agentAlias2}->>${artAlias}: [W] ${es.action}`);
+  }
+  if (es.uses_tool) {
+    const toolAlias = participantAlias(participants, es.uses_tool);
+    lines.push(`${indent}${agentAlias2}->>${toolAlias}: ${es.action}`);
+  }
+  if (!es.reads_artifact && !es.produces_artifact && !es.uses_tool) {
+    lines.push(`${indent}${agentAlias2}->>${agentAlias2}: ${es.action}`);
+  }
 }
-async function removeIfExists(filePath) {
-  try {
-    await unlink(filePath);
-  } catch {
+function emitValidationStep(step, participants, dsl, lastFromAgent, lines, indent) {
+  const val = dsl.validations[step.validation];
+  if (!val) return;
+  const executorAlias = participantAlias(participants, val.executor);
+  const artifactAlias = participantAlias(participants, val.target_artifact);
+  const fromAlias = lastFromAgent ? participantAlias(participants, lastFromAgent) : null;
+  if (fromAlias && fromAlias !== executorAlias) {
+    lines.push(`${indent}${fromAlias}->>${executorAlias}: ${step.validation}`);
+  }
+  lines.push(`${indent}${executorAlias}->>${artifactAlias}: [R] ${val.target_artifact}`);
+  if (fromAlias && fromAlias !== executorAlias) {
+    lines.push(`${indent}${executorAlias}-->>${fromAlias}: results`);
   }
 }
-async function renderFromConfig(dsl, renderTargets, options) {
-  const outputFiles = [];
-  for (const target of renderTargets) {
-    const templateContent = await loadTemplate(target.template);
-    const compiled = Handlebars.compile(templateContent, { noEscape: false });
-    if (target.context === "system") {
-      const ctx = buildSystemContext(dsl, options);
-      const output = compiled(ctx);
-      if (target.skip_empty && isEffectivelyEmpty(output)) {
-        await removeIfExists(target.output);
-        continue;
-      }
-      await mkdir(dirname5(target.output), { recursive: true });
-      await writeFile(target.output, output, "utf8");
-      outputFiles.push(target.output);
+function emitDecisionStep(step, participants, lastFromAgent, lines, indent) {
+  const branches = Object.entries(step.branches);
+  if (branches.length === 0) return;
+  const agentAl = lastFromAgent ? participantAlias(participants, lastFromAgent) : null;
+  for (let i3 = 0; i3 < branches.length; i3++) {
+    const [key, values] = branches[i3];
+    if (i3 === 0) {
+      lines.push(`${indent}alt ${key}`);
     } else {
-      const section = getDslSection(dsl, target.context);
-      const allIds = Object.keys(section);
-      const ids = filterIds(allIds, target.include, target.exclude);
-      for (const entityId of ids) {
-        const ctx = buildEntityContext(dsl, target.context, entityId);
-        const output = compiled(ctx);
-        const outputPath = expandOutputPath(target.output, target.context, entityId);
-        if (target.skip_empty && isEffectivelyEmpty(output)) {
-          await removeIfExists(outputPath);
-          continue;
-        }
-        await mkdir(dirname5(outputPath), { recursive: true });
-        await writeFile(outputPath, output, "utf8");
-        outputFiles.push(outputPath);
-      }
+      lines.push(`${indent}else ${key}`);
+    }
+    if (agentAl) {
+      lines.push(`${indent}    Note over ${agentAl}: ${values.join(", ")}`);
     }
   }
-  return outputFiles;
+  lines.push(`${indent}end`);
 }
-async function fileExists2(filePath) {
-  try {
-    await readFile4(filePath);
-    return true;
-  } catch {
-    return false;
+function emitDelegateStep(step, participants, dsl, relatedTasks, lines, indent) {
+  const taskMap = /* @__PURE__ */ new Map();
+  for (const t3 of relatedTasks) taskMap.set(t3.id, t3);
+  const task = taskMap.get(step.task);
+  if (!task) return;
+  const fromAlias = participantAlias(participants, step.from_agent);
+  const targetAlias = participantAlias(participants, task.target_agent);
+  lines.push(`${indent}${fromAlias}->>${targetAlias}: delegate ${step.task}`);
+  for (const es of task.execution_steps ?? []) {
+    emitExecutionStep(es, targetAlias, participants, lines, indent);
   }
+  lines.push(`${indent}${targetAlias}-->>${fromAlias}: ${task.result_handoff}`);
 }
-function checkExpectedVsExisting(expected, outputPath, skipEmpty, diffs) {
-  if (skipEmpty && isEffectivelyEmpty(expected)) {
-    return fileExists2(outputPath).then((exists) => {
-      if (exists) diffs.push(outputPath);
-    });
+function emitGateStep(step, participants, lastFromAgent, lines, indent) {
+  if (lastFromAgent) {
+    const agentAl = participantAlias(participants, lastFromAgent);
+    lines.push(`${indent}${agentAl}->>${agentAl}: ${step.gate_kind}`);
   }
-  return readFile4(outputPath, "utf8").then((existing) => {
-    if (existing !== expected) diffs.push(outputPath);
-  }).catch(() => {
-    diffs.push(outputPath);
-  });
 }
-async function checkDriftFromConfig(dsl, renderTargets, options) {
-  const diffs = [];
-  for (const target of renderTargets) {
-    const templateContent = await loadTemplate(target.template);
-    const compiled = Handlebars.compile(templateContent, { noEscape: false });
-    if (target.context === "system") {
-      const ctx = buildSystemContext(dsl, options);
-      const expected = compiled(ctx);
-      await checkExpectedVsExisting(expected, target.output, target.skip_empty, diffs);
-    } else {
-      const section = getDslSection(dsl, target.context);
-      const allIds = Object.keys(section);
-      const ids = filterIds(allIds, target.include, target.exclude);
-      for (const entityId of ids) {
-        const ctx = buildEntityContext(dsl, target.context, entityId);
-        const expected = compiled(ctx);
-        const outputPath = expandOutputPath(target.output, target.context, entityId);
-        await checkExpectedVsExisting(expected, outputPath, target.skip_empty, diffs);
+function emitRetryBlock(fromAgent, retry, participants, relatedTasks, lines, indent) {
+  const taskMap = /* @__PURE__ */ new Map();
+  for (const t3 of relatedTasks) taskMap.set(t3.id, t3);
+  lines.push(`${indent}opt ${retry.condition}`);
+  const innerIndent = indent + "    ";
+  const fixTask = taskMap.get(retry.fix_task);
+  if (fixTask) {
+    const fromAlias = fromAgent ? participantAlias(participants, fromAgent) : null;
+    const targetAlias = participantAlias(participants, fixTask.target_agent);
+    if (fromAlias) {
+      lines.push(`${innerIndent}${fromAlias}->>${targetAlias}: fix ${retry.fix_task}`);
+    }
+    for (const es of fixTask.execution_steps ?? []) {
+      emitExecutionStep(es, targetAlias, participants, lines, innerIndent);
+    }
+    if (fromAlias) {
+      lines.push(`${innerIndent}${targetAlias}-->>${fromAlias}: ${fixTask.result_handoff}`);
+    }
+  }
+  if (retry.revalidate_task) {
+    const revalTask = taskMap.get(retry.revalidate_task);
+    if (revalTask) {
+      const fromAlias = fromAgent ? participantAlias(participants, fromAgent) : null;
+      const revalAlias = participantAlias(participants, revalTask.target_agent);
+      if (fromAlias) {
+        lines.push(`${innerIndent}${fromAlias}->>${revalAlias}: revalidate ${retry.revalidate_task}`);
+        lines.push(`${innerIndent}${revalAlias}-->>${fromAlias}: ${revalTask.result_handoff}`);
       }
     }
   }
-  return { hasDrift: diffs.length > 0, diffs };
+  lines.push(`${indent}end`);
 }
-
-// src/cli/commands/render.ts
-var renderCommand = new Command4("render").description("Render resolved DSL with Handlebars templates (requires config)").option("-c, --config <path>", "Path to agent-contracts.config.yaml").option("--team <id>", "Limit to one team (multi-team config only)").option("--check", "Check for drift without writing files", false).option("--quiet", "Suppress output on success", false).action(
-  async (opts) => {
-    try {
-      const config = await loadConfig(opts.config);
-      if (!config) {
-        process.stderr.write(
-          "Error: agent-contracts.config.yaml not found. Use --config to specify path.\n"
-        );
-        process.exit(1);
-      }
-      if (isMultiTeamConfig(config)) {
-        const teamEntries = getTeamEntries(config, opts.team);
-        for (const [teamId, teamConfig] of teamEntries) {
-          if (!opts.quiet) process.stdout.write(`
---- Team: ${teamId} ---
-`);
-          const resolved2 = await resolve4(teamConfig.dsl);
-          const data2 = teamConfig.vars ? substituteVars(resolved2.data, teamConfig.vars) : resolved2.data;
-          const schemaResult2 = validateSchema(data2);
-          if (!schemaResult2.success) {
-            process.stderr.write(
-              `Schema validation failed for team ${teamId}. Run 'agent-contracts validate' for details.
-`
-            );
-            process.exit(1);
-          }
-          let renderOptions2;
-          if (teamConfig.bindings.length > 0) {
-            const loadedBindings = await loadBindings(teamConfig.bindings);
-            renderOptions2 = {
-              loadedBindings,
-              activeGuardrailPolicy: teamConfig.activeGuardrailPolicy
-            };
-          }
-          if (opts.check) {
-            const drift = await checkDriftFromConfig(
-              schemaResult2.data,
-              config.renders,
-              renderOptions2
-            );
-            if (drift.hasDrift) {
-              process.stderr.write(
-                `Drift detected for team ${teamId} in the following files:
-`
-              );
-              for (const f2 of drift.diffs) {
-                process.stderr.write(`  ${f2}
-`);
-              }
-              process.exit(1);
-            }
-            if (!opts.quiet) {
-              process.stdout.write("No drift detected.\n");
-            }
-          } else {
-            const files = await renderFromConfig(
-              schemaResult2.data,
-              config.renders,
-              renderOptions2
-            );
-            if (!opts.quiet) {
-              process.stdout.write(`Rendered ${files.length} file(s):
-`);
-              for (const f2 of files) {
-                process.stdout.write(`  ${f2}
-`);
-              }
-            }
-          }
-        }
-        return;
-      }
-      const resolved = await resolve4(config.dsl);
-      const data = config.vars ? substituteVars(resolved.data, config.vars) : resolved.data;
-      const schemaResult = validateSchema(data);
-      if (!schemaResult.success) {
-        process.stderr.write(
-          "Schema validation failed. Run 'agent-contracts validate' for details.\n"
-        );
-        process.exit(1);
-      }
-      let renderOptions;
-      if (config.bindings.length > 0) {
-        const loadedBindings = await loadBindings(config.bindings);
-        renderOptions = {
-          loadedBindings,
-          activeGuardrailPolicy: config.activeGuardrailPolicy
-        };
-      }
-      if (opts.check) {
-        const drift = await checkDriftFromConfig(
-          schemaResult.data,
-          config.renders,
-          renderOptions
-        );
-        if (drift.hasDrift) {
-          process.stderr.write("Drift detected in the following files:\n");
-          for (const f2 of drift.diffs) {
-            process.stderr.write(`  ${f2}
-`);
-          }
-          process.exit(1);
-        }
-        if (!opts.quiet) {
-          process.stdout.write("No drift detected.\n");
-        }
+function groupSteps(steps) {
+  const result = [];
+  let currentGroup = null;
+  for (let i3 = 0; i3 < steps.length; i3++) {
+    const step = steps[i3];
+    const group = "group" in step ? step.group : void 0;
+    if (group) {
+      if (currentGroup && currentGroup.group === group) {
+        currentGroup.steps.push({ step, index: i3 });
       } else {
-        const files = await renderFromConfig(
-          schemaResult.data,
-          config.renders,
-          renderOptions
-        );
-        if (!opts.quiet) {
-          process.stdout.write(`Rendered ${files.length} file(s):
-`);
-          for (const f2 of files) {
-            process.stdout.write(`  ${f2}
-`);
-          }
-        }
+        if (currentGroup) result.push(currentGroup);
+        currentGroup = { group, steps: [{ step, index: i3 }] };
       }
-    } catch (err) {
-      if (err instanceof ConfigLoadError) {
-        process.stderr.write(`Config error: ${err.message}
-`);
-        process.exit(1);
+    } else {
+      if (currentGroup) {
+        result.push(currentGroup);
+        currentGroup = null;
       }
-      const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(`Error: ${msg}
-`);
-      process.exit(1);
+      result.push({ group: null, steps: [{ step, index: i3 }] });
     }
   }
-);
-
-// src/cli/commands/check.ts
-import { existsSync, readFileSync } from "fs";
-import { join as join3 } from "path";
-import { Command as Command5 } from "commander";
-import { parse as parseYaml4, stringify as stringify3 } from "yaml";
-import { access as access2 } from "fs/promises";
-import { resolve as pathResolve, dirname as dirname6 } from "path";
-
-// src/interface-generator/generator.ts
-import { stringify as stringify2 } from "yaml";
-function buildInterfaceDocument(dsl, generatedAt) {
-  const ti = dsl.team_interface;
-  const doc = {
-    team_id: dsl.system.id,
-    team_name: dsl.system.name,
-    version: ti.version,
-    generated_at: generatedAt
-  };
-  if (ti.description !== void 0) {
-    doc.description = ti.description;
+  if (currentGroup) result.push(currentGroup);
+  return result;
+}
+function generateSequenceDiagram(workflow, relatedTasks, dsl) {
+  const ids = collectReferencedIds(workflow, dsl, relatedTasks);
+  const externals = workflow.external_participants ?? [];
+  const participants = buildParticipants(ids, externals, dsl);
+  const lines = [];
+  const indent = "    ";
+  lines.push("sequenceDiagram");
+  emitParticipants(participants, externals, lines, indent);
+  lines.push("");
+  lines.push(`${indent}rect ${hashToColor(workflow.id, 0.15, 0.95)}`);
+  const firstP = participants[0];
+  const lastP = participants[participants.length - 1];
+  if (firstP && lastP) {
+    const noteLabel = workflow.description ? `${workflow.id} \u2014 ${workflow.description}` : workflow.id;
+    lines.push(`${indent}Note over ${firstP.alias},${lastP.alias}: ${noteLabel}`);
   }
-  if (ti.accepts?.workflows && Object.keys(ti.accepts.workflows).length > 0) {
-    doc.accepts = { workflows: { ...ti.accepts.workflows } };
+  if (workflow.trigger && externals.some((ep) => ep.kind === "actor")) {
+    const actor = externals.find((ep) => ep.kind === "actor");
+    const actorAlias = participantAlias(participants, actor.id);
+    const firstAgent = participants.find((p2) => p2.group === "agents" || p2.group === "audit");
+    if (firstAgent) {
+      lines.push(`${indent}${actorAlias}->>${firstAgent.alias}: ${workflow.trigger}`);
+    }
   }
-  const handoffKeys = /* @__PURE__ */ new Set();
-  if (ti.accepts?.workflows) {
-    for (const spec of Object.values(ti.accepts.workflows)) {
-      handoffKeys.add(spec.input_handoff);
-      handoffKeys.add(spec.output_handoff);
+  let lastFromAgent;
+  const grouped = groupSteps(workflow.steps);
+  for (const g2 of grouped) {
+    if (g2.group && g2.steps.length > 1) {
+      lines.push("");
+      lines.push(`${indent}par ${g2.group}`);
+      const parIndent = indent + "    ";
+      for (let i3 = 0; i3 < g2.steps.length; i3++) {
+        const { step } = g2.steps[i3];
+        if (i3 > 0) lines.push(`${indent}and`);
+        emitStep(step, participants, dsl, relatedTasks, lines, parIndent, lastFromAgent, (a3) => {
+          lastFromAgent = a3;
+        });
+      }
+      lines.push(`${indent}end`);
+    } else {
+      for (const { step } of g2.steps) {
+        lines.push("");
+        emitStep(step, participants, dsl, relatedTasks, lines, indent, lastFromAgent, (a3) => {
+          lastFromAgent = a3;
+        });
+      }
     }
   }
-  const handoff_types = {};
-  for (const k2 of [...handoffKeys].sort()) {
-    const ht = dsl.handoff_types[k2];
-    if (ht) {
-      const entry = {
-        version: ht.version,
-        schema: ht.schema
-      };
-      if (ht.description !== void 0) {
-        entry.description = ht.description;
+  lines.push("");
+  lines.push(`${indent}end`);
+  return lines.join("\n");
+}
+function emitStep(step, participants, dsl, relatedTasks, lines, indent, lastFromAgent, setLastFromAgent) {
+  if (step.type === "delegate") {
+    setLastFromAgent(step.from_agent);
+    emitDelegateStep(step, participants, dsl, relatedTasks, lines, indent);
+    if (step.retry) {
+      emitRetryBlock(step.from_agent, step.retry, participants, relatedTasks, lines, indent);
+    }
+  } else if (step.type === "gate") {
+    emitGateStep(step, participants, lastFromAgent, lines, indent);
+  } else if (step.type === "handoff") {
+    if (step.from_agent) setLastFromAgent(step.from_agent);
+    emitHandoffStep(step, participants, dsl, relatedTasks, lines, indent);
+    if (step.retry) {
+      emitRetryBlock(step.from_agent, step.retry, participants, relatedTasks, lines, indent);
+    }
+  } else if (step.type === "validation") {
+    emitValidationStep(step, participants, dsl, lastFromAgent, lines, indent);
+  } else if (step.type === "decision") {
+    emitDecisionStep(step, participants, lastFromAgent, lines, indent);
+  }
+}
+
+// src/renderer/overview-flowchart.ts
+function collectPhaseOps(dsl, wfId) {
+  const ctx = buildWorkflowContext(dsl, wfId);
+  const wf = dsl.workflow[wfId];
+  const agentOps = /* @__PURE__ */ new Map();
+  const artifactOps = /* @__PURE__ */ new Map();
+  const toolOps = /* @__PURE__ */ new Map();
+  function addOp(map, id, op) {
+    if (!map.has(id)) map.set(id, /* @__PURE__ */ new Set());
+    map.get(id).add(op);
+  }
+  const taskMap = new Map(ctx.relatedTasks.map((t3) => [t3.id, t3]));
+  function collectTaskOps(task) {
+    addOp(agentOps, task.target_agent, "execute");
+    for (const es of task.execution_steps ?? []) {
+      if (es.reads_artifact) addOp(artifactOps, es.reads_artifact, "R");
+      if (es.produces_artifact) addOp(artifactOps, es.produces_artifact, "W");
+      if (es.uses_tool) {
+        const tool = dsl.tools[es.uses_tool];
+        if (tool) {
+          const cats = tool.commands.map((c2) => c2.category).filter((v2, i3, a3) => a3.indexOf(v2) === i3);
+          for (const cat of cats) addOp(toolOps, es.uses_tool, cat);
+          if (cats.length === 0) addOp(toolOps, es.uses_tool, "\u2713");
+        } else {
+          addOp(toolOps, es.uses_tool, "\u2713");
+        }
       }
-      handoff_types[k2] = entry;
     }
   }
-  if (Object.keys(handoff_types).length > 0) {
-    doc.handoff_types = handoff_types;
-  }
-  const artifactsOut = {};
-  if (ti.exposes?.artifacts) {
-    for (const key of [...ti.exposes.artifacts].sort()) {
-      const art = dsl.artifacts[key];
-      if (art) {
-        const entry = {
-          type: art.type,
-          states: art.states
-        };
-        if (art.description !== void 0) {
-          entry.description = art.description;
+  for (const step of wf.steps) {
+    if (step.type === "delegate") {
+      addOp(agentOps, step.from_agent, "delegate");
+      const task = taskMap.get(step.task);
+      if (task) collectTaskOps(task);
+    } else if (step.type === "gate") {
+    } else if (step.type === "handoff") {
+      if (step.from_agent) addOp(agentOps, step.from_agent, "delegate");
+      if (step.task) {
+        const task = taskMap.get(step.task);
+        if (task) collectTaskOps(task);
+      }
+    } else if (step.type === "validation") {
+      const val = dsl.validations[step.validation];
+      if (val) {
+        if (val.executor_type === "agent") {
+          addOp(agentOps, val.executor, "validate");
+        } else {
+          addOp(toolOps, val.executor, "verification");
         }
-        artifactsOut[key] = entry;
+        addOp(artifactOps, val.target_artifact, "V");
       }
     }
   }
-  if (Object.keys(artifactsOut).length > 0) {
-    doc.exposes = { artifacts: artifactsOut };
-  }
-  if (ti.constraints !== void 0 && ti.constraints.length > 0) {
-    doc.constraints = ti.constraints;
-  }
-  return doc;
+  return { agentOps, artifactOps, toolOps };
 }
-function generateInterface(options) {
-  if (!options.dsl.team_interface) {
-    throw new Error("DSL has no team_interface section");
+function formatOps(ops) {
+  if (!ops || ops.size === 0) return "\u2014";
+  return [...ops].join(", ");
+}
+function buildTable(header, rows) {
+  const lines = [];
+  lines.push("| " + header.join(" | ") + " |");
+  lines.push("|" + header.map(() => "---").join("|") + "|");
+  for (const row of rows) {
+    lines.push("| " + row.join(" | ") + " |");
   }
-  const doc = buildInterfaceDocument(options.dsl, (/* @__PURE__ */ new Date()).toISOString());
-  const content = options.format === "json" ? `${JSON.stringify(doc, null, 2)}
-` : `${stringify2(doc, { sortMapEntries: true })}
-`;
-  const outputPath = options.output ?? "team-interface.yaml";
-  return { outputPath, content };
+  return lines.join("\n");
 }
-
-// src/cli/commands/check.ts
-var checkCommand = new Command5("check").description("Run full pipeline: resolve \u2192 validate \u2192 lint \u2192 render --check").option("-c, --config <path>", "Path to agent-contracts.config.yaml").option("--team <id>", "Limit to one team (multi-team config only)").option("--format <format>", "Output format (text|json)", "text").option("--quiet", "Suppress output on success", false).option("--strict", "Treat warnings as errors", false).action(
-  async (opts) => {
-    let hasErrors = false;
-    try {
-      const config = await loadConfig(opts.config);
-      if (!config) {
-        process.stderr.write(
-          "Error: agent-contracts.config.yaml not found. Use --config to specify path.\n"
-        );
-        process.exit(1);
-      }
-      if (isMultiTeamConfig(config)) {
-        const teamEntries = getTeamEntries(config, opts.team);
-        for (const [teamId, teamConfig] of teamEntries) {
-          if (!opts.quiet) process.stderr.write(`
---- Team: ${teamId} ---
-`);
-          const resolved2 = await resolve4(teamConfig.dsl);
-          const data2 = teamConfig.vars ? substituteVars(resolved2.data, teamConfig.vars) : resolved2.data;
-          const schemaResult2 = validateSchema(data2);
-          const schemaWarnings2 = schemaResult2.diagnostics.filter(
-            (d2) => d2.severity === "warning"
-          );
-          if (!schemaResult2.success) {
-            const output = formatDiagnostics(schemaResult2.diagnostics, {
-              format: opts.format,
-              quiet: opts.quiet
-            });
-            if (output) process.stderr.write(output + "\n");
-            hasErrors = true;
-            continue;
-          }
-          const refDiags2 = checkReferences(schemaResult2.data);
-          const handoffDiags2 = validateHandoffSchemas(schemaResult2.data);
-          const allRefDiags2 = [...refDiags2, ...handoffDiags2, ...schemaWarnings2];
-          if (allRefDiags2.length > 0) {
-            const output = formatDiagnostics(allRefDiags2, {
-              format: opts.format,
-              quiet: opts.quiet
-            });
-            if (output) process.stderr.write(output + "\n");
-            hasErrors = true;
-          }
-          const tsLintDiags2 = lint(schemaResult2.data);
-          const spectralDiags2 = await spectralLint(
-            schemaResult2.data
-          );
-          const lintDiags2 = [...tsLintDiags2, ...spectralDiags2];
-          if (lintDiags2.length > 0) {
-            const output = formatDiagnostics(lintDiags2, {
-              format: opts.format,
-              quiet: opts.quiet
-            });
-            if (output) process.stderr.write(output + "\n");
-            if (lintDiags2.some((d2) => d2.severity === "error")) {
-              hasErrors = true;
-            }
-            if (opts.strict && lintDiags2.some((d2) => d2.severity === "warning")) {
-              hasErrors = true;
-            }
-          }
-          let renderOptions2;
-          if (teamConfig.bindings.length > 0) {
-            const loadedBindings = await loadBindings(teamConfig.bindings);
-            renderOptions2 = {
-              loadedBindings,
-              activeGuardrailPolicy: teamConfig.activeGuardrailPolicy
-            };
-          }
-          const drift2 = await checkDriftFromConfig(
-            schemaResult2.data,
-            config.renders,
-            renderOptions2
-          );
-          if (drift2.hasDrift) {
-            process.stderr.write(`Drift detected for team ${teamId} in:
-`);
-            for (const f2 of drift2.diffs) {
-              process.stderr.write(`  ${f2}
-`);
-            }
-            hasErrors = true;
-          }
-        }
-        if (!hasErrors) {
-          for (const [teamId, teamConfig] of teamEntries) {
-            const resolved2 = await resolve4(teamConfig.dsl);
-            const data2 = teamConfig.vars ? substituteVars(resolved2.data, teamConfig.vars) : resolved2.data;
-            const schemaResult2 = validateSchema(data2);
-            if (!schemaResult2.success || !schemaResult2.data) continue;
-            const dsl = schemaResult2.data;
-            const imports = dsl.imports;
-            if (!imports) continue;
-            for (const [importName, importDef] of Object.entries(imports)) {
-              const interfacePathRel = importDef?.interface;
-              if (typeof interfacePathRel !== "string") continue;
-              const interfacePath = pathResolve(
-                dirname6(teamConfig.dsl),
-                interfacePathRel
-              );
-              try {
-                await access2(interfacePath);
-              } catch {
-                process.stderr.write(
-                  `Cross-team error: Team "${teamId}" imports "${importName}" but interface file not found: ${interfacePath}
-`
-                );
-                hasErrors = true;
-              }
-            }
-          }
-        }
-        if (hasErrors) process.exit(1);
-        if (!opts.quiet) process.stdout.write("All checks passed.\n");
-        return;
-      }
-      const resolved = await resolve4(config.dsl);
-      const data = config.vars ? substituteVars(resolved.data, config.vars) : resolved.data;
-      const schemaResult = validateSchema(data);
-      const schemaWarnings = schemaResult.diagnostics.filter(
-        (d2) => d2.severity === "warning"
-      );
-      if (!schemaResult.success) {
-        const output = formatDiagnostics(schemaResult.diagnostics, {
-          format: opts.format,
-          quiet: opts.quiet
-        });
-        if (output) process.stderr.write(output + "\n");
-        process.exit(1);
-      }
-      const refDiags = checkReferences(schemaResult.data);
-      const handoffDiags = validateHandoffSchemas(schemaResult.data);
-      const allRefDiags = [...refDiags, ...handoffDiags, ...schemaWarnings];
-      if (allRefDiags.length > 0) {
-        const output = formatDiagnostics(allRefDiags, {
-          format: opts.format,
-          quiet: opts.quiet
-        });
-        if (output) process.stderr.write(output + "\n");
-        hasErrors = true;
-      }
-      const tsLintDiags = lint(schemaResult.data);
-      const spectralDiags = await spectralLint(schemaResult.data);
-      const lintDiags = [...tsLintDiags, ...spectralDiags];
-      if (lintDiags.length > 0) {
-        const output = formatDiagnostics(lintDiags, {
-          format: opts.format,
-          quiet: opts.quiet
-        });
-        if (output) process.stderr.write(output + "\n");
-        if (lintDiags.some((d2) => d2.severity === "error")) {
-          hasErrors = true;
-        }
-        if (opts.strict && lintDiags.some((d2) => d2.severity === "warning")) {
-          hasErrors = true;
-        }
+function generateOverviewFlowchart(dsl) {
+  const workflowOrder = dsl.system.default_workflow_order ?? Object.keys(dsl.workflow);
+  const phases = workflowOrder.filter((id) => dsl.workflow[id]);
+  const phaseData = /* @__PURE__ */ new Map();
+  for (const wfId of phases) {
+    phaseData.set(wfId, collectPhaseOps(dsl, wfId));
+  }
+  const allAgentIds = /* @__PURE__ */ new Set();
+  const allArtifactIds = /* @__PURE__ */ new Set();
+  const allToolIds = /* @__PURE__ */ new Set();
+  for (const ops of phaseData.values()) {
+    for (const id of ops.agentOps.keys()) allAgentIds.add(id);
+    for (const id of ops.artifactOps.keys()) allArtifactIds.add(id);
+    for (const id of ops.toolOps.keys()) allToolIds.add(id);
+  }
+  const sections = [];
+  if (allAgentIds.size > 0) {
+    const header = ["Agent", ...phases];
+    const rows = [];
+    for (const agentId of allAgentIds) {
+      const agent = dsl.agents[agentId];
+      const label = agent ? agent.role_name : agentId;
+      const row = [label];
+      for (const wfId of phases) {
+        row.push(formatOps(phaseData.get(wfId).agentOps.get(agentId)));
       }
-      let renderOptions;
-      if (config.bindings.length > 0) {
-        const loadedBindings = await loadBindings(config.bindings);
-        renderOptions = {
-          loadedBindings,
-          activeGuardrailPolicy: config.activeGuardrailPolicy
-        };
+      rows.push(row);
+    }
+    sections.push("#### Agent \xD7 Phase\n\n" + buildTable(header, rows));
+  }
+  if (allArtifactIds.size > 0) {
+    const header = ["Artifact", ...phases];
+    const rows = [];
+    for (const artId of allArtifactIds) {
+      const row = [artId];
+      for (const wfId of phases) {
+        row.push(formatOps(phaseData.get(wfId).artifactOps.get(artId)));
       }
-      const drift = await checkDriftFromConfig(
-        schemaResult.data,
-        config.renders,
-        renderOptions
-      );
-      if (drift.hasDrift) {
-        process.stderr.write("Drift detected in:\n");
-        for (const f2 of drift.diffs) {
-          process.stderr.write(`  ${f2}
-`);
-        }
-        hasErrors = true;
+      rows.push(row);
+    }
+    sections.push("#### Artifact \xD7 Phase\n\n" + buildTable(header, rows));
+  }
+  if (allToolIds.size > 0) {
+    const header = ["Tool", ...phases];
+    const rows = [];
+    for (const toolId of allToolIds) {
+      const row = [toolId];
+      for (const wfId of phases) {
+        row.push(formatOps(phaseData.get(wfId).toolOps.get(toolId)));
       }
-      if (schemaResult.data.team_interface) {
-        const interfacePath = join3(config.configDir, "team-interface.yaml");
-        if (existsSync(interfacePath)) {
-          const result = generateInterface({
-            dsl: schemaResult.data,
-            dryRun: true,
-            format: "yaml"
-          });
-          const existing = readFileSync(interfacePath, "utf8");
-          const normalize = (raw) => {
-            try {
-              const parsed = parseYaml4(raw);
-              if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-                const { generated_at: _t, ...rest } = parsed;
-                return `${stringify3(rest, { sortMapEntries: true })}
-`;
-              }
-            } catch {
+      rows.push(row);
+    }
+    sections.push("#### Tool \xD7 Phase\n\n" + buildTable(header, rows));
+  }
+  return sections.join("\n\n");
+}
+
+// src/renderer/renderer.ts
+Handlebars.registerHelper("eq", (a3, b3) => a3 === b3);
+Handlebars.registerHelper("notEmpty", (obj) => {
+  if (!obj || typeof obj !== "object") return false;
+  return Object.keys(obj).length > 0;
+});
+Handlebars.registerHelper("inc", (val) => val + 1);
+Handlebars.registerHelper(
+  "lookupPayloadFields",
+  (schema) => {
+    const effective = resolveAllOf(schema ?? {});
+    const props = effective["properties"];
+    if (!props) return [];
+    const requiredSet = new Set(
+      effective["required"] ?? []
+    );
+    return Object.entries(props).map(([name, sub]) => {
+      const enumVals = sub["enum"];
+      return {
+        name,
+        type: sub["type"] ?? "any",
+        required: requiredSet.has(name),
+        enum: enumVals ? enumVals.join(" | ") : void 0
+      };
+    });
+  }
+);
+function toYamlLines(obj, indent) {
+  const pad = "  ".repeat(indent);
+  if (obj === null || obj === void 0) return [`${pad}null`];
+  if (typeof obj === "boolean" || typeof obj === "number")
+    return [`${pad}${obj}`];
+  if (typeof obj === "string") {
+    if (obj.includes("\n")) {
+      const lines = [`${pad}|`];
+      for (const line of obj.split("\n")) {
+        lines.push(line === "" ? "" : `${pad}  ${line}`);
+      }
+      return lines;
+    }
+    return [`${pad}${JSON.stringify(obj)}`];
+  }
+  if (Array.isArray(obj)) {
+    const lines = [];
+    for (const item of obj) {
+      if (typeof item === "object" && item !== null && !Array.isArray(item)) {
+        const entries = Object.entries(item);
+        if (entries.length > 0) {
+          const [firstKey, firstVal] = entries[0];
+          const firstValLines = toYamlLines(firstVal, 0);
+          if (firstValLines.length === 1 && !firstValLines[0].includes("\n")) {
+            lines.push(`${pad}- ${firstKey}: ${firstValLines[0].trim()}`);
+          } else {
+            lines.push(`${pad}- ${firstKey}:`);
+            lines.push(...toYamlLines(firstVal, indent + 2));
+          }
+          for (let i3 = 1; i3 < entries.length; i3++) {
+            const [k2, v2] = entries[i3];
+            const vLines = toYamlLines(v2, indent + 2);
+            if (vLines.length === 1) {
+              lines.push(`${pad}  ${k2}: ${vLines[0].trim()}`);
+            } else {
+              lines.push(`${pad}  ${k2}:`);
+              lines.push(...vLines);
             }
-            return raw.trim();
-          };
-          if (normalize(existing) !== normalize(result.content)) {
-            process.stderr.write("Drift detected in team-interface.yaml\n");
-            hasErrors = true;
           }
+        } else {
+          lines.push(`${pad}- {}`);
         }
+      } else {
+        const valLines = toYamlLines(item, 0);
+        lines.push(`${pad}- ${valLines[0].trim()}`);
       }
-      if (hasErrors) {
-        process.exit(1);
-      }
-      if (!opts.quiet) {
-        process.stdout.write("All checks passed.\n");
-      }
-    } catch (err) {
-      if (err instanceof ConfigLoadError) {
-        process.stderr.write(`Config error: ${err.message}
-`);
-        process.exit(1);
+    }
+    return lines;
+  }
+  if (typeof obj === "object") {
+    const lines = [];
+    for (const [key, value] of Object.entries(
+      obj
+    )) {
+      const valLines = toYamlLines(value, indent + 1);
+      if (valLines.length === 1 && !valLines[0].includes("|")) {
+        lines.push(`${pad}${key}: ${valLines[0].trim()}`);
+      } else {
+        lines.push(`${pad}${key}:`);
+        lines.push(...valLines);
       }
-      const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(`Error: ${msg}
-`);
-      process.exit(1);
     }
+    return lines;
+  }
+  return [`${pad}${String(obj)}`];
+}
+Handlebars.registerHelper("yamlBlock", (obj) => {
+  return toYamlLines(obj, 0).join("\n");
+});
+Handlebars.registerHelper(
+  "join",
+  (arr, separator) => {
+    if (!Array.isArray(arr)) return "";
+    const sep = typeof separator === "string" ? separator : ", ";
+    return arr.join(sep);
+  }
+);
+Handlebars.registerHelper("contains", (arr, value) => {
+  if (!Array.isArray(arr)) return false;
+  return arr.includes(value);
+});
+Handlebars.registerHelper(
+  "groupBy",
+  (arr, key) => {
+    if (!Array.isArray(arr)) return {};
+    const result = {};
+    for (const item of arr) {
+      const k2 = String(
+        item?.[key] ?? "undefined"
+      );
+      (result[k2] ??= []).push(item);
+    }
+    return result;
+  }
+);
+Handlebars.registerHelper(
+  "keys",
+  (obj) => {
+    if (!obj || typeof obj !== "object") return [];
+    return Object.keys(obj);
+  }
+);
+Handlebars.registerHelper(
+  "values",
+  (obj) => {
+    if (!obj || typeof obj !== "object") return [];
+    return Object.values(obj);
+  }
+);
+Handlebars.registerHelper(
+  "filterByField",
+  (arr, field, value) => {
+    if (!Array.isArray(arr)) return [];
+    return arr.filter(
+      (item) => item?.[field] === value
+    );
+  }
+);
+Handlebars.registerHelper("not", (value) => !value);
+Handlebars.registerHelper("or", (...args) => {
+  const _options = args.pop();
+  return args.some((a3) => !!a3);
+});
+Handlebars.registerHelper("coalesce", (...args) => {
+  const _options = args.pop();
+  return args.find((a3) => a3 != null && a3 !== false && a3 !== "");
+});
+Handlebars.registerHelper("and", (...args) => {
+  const _options = args.pop();
+  return args.every((a3) => !!a3);
+});
+Handlebars.registerHelper("gt", (a3, b3) => a3 > b3);
+Handlebars.registerHelper("gte", (a3, b3) => a3 >= b3);
+Handlebars.registerHelper("lt", (a3, b3) => a3 < b3);
+Handlebars.registerHelper("size", (obj) => {
+  if (Array.isArray(obj)) return obj.length;
+  if (obj && typeof obj === "object") return Object.keys(obj).length;
+  return 0;
+});
+Handlebars.registerHelper(
+  "sequenceDiagram",
+  function(...args) {
+    const opts = args[args.length - 1];
+    const positionalArgs = args.slice(0, -1);
+    if (typeof positionalArgs[0] === "string" && positionalArgs[1]) {
+      const workflowId = positionalArgs[0];
+      const dsl2 = positionalArgs[1];
+      if (!dsl2.workflow[workflowId]) return "";
+      const ctx = buildWorkflowContext(dsl2, workflowId);
+      return generateSequenceDiagram(
+        ctx.workflow,
+        ctx.relatedTasks,
+        dsl2
+      );
+    }
+    const workflow = this["workflow"];
+    const relatedTasks = this["relatedTasks"];
+    const dsl = opts?.hash?.["dsl"] ?? this["dsl"];
+    if (!workflow || !dsl) return "";
+    return generateSequenceDiagram(workflow, relatedTasks ?? [], dsl);
   }
 );
-
-// src/cli/commands/generate-guardrails.ts
-import { Command as Command6 } from "commander";
-
-// src/guardrail-generator/generator.ts
-import { readFile as readFile5, writeFile as writeFile2, mkdir as mkdir2, chmod, unlink as unlink2, copyFile } from "fs/promises";
-import { resolve as resolve6, dirname as dirname7 } from "path";
-import Handlebars2 from "handlebars";
-import YAML from "yaml";
-
-// src/guardrail-generator/resolve-checks.ts
-function resolveChecks(dsl, binding, policy) {
-  const resolved = [];
-  const diagnostics = [];
-  const guardrailImpl = binding.guardrail_impl ?? {};
-  for (const [guardrailId, impl] of Object.entries(guardrailImpl)) {
-    const guardrail = dsl.guardrails[guardrailId];
-    if (!guardrail) {
-      diagnostics.push({
-        path: `binding.${binding.software}.guardrail_impl.${guardrailId}`,
-        message: `Binding "${binding.software}" implements guardrail "${guardrailId}" which is not defined in the DSL`,
-        severity: "error"
-      });
-      continue;
-    }
-    const policyRule = policy.rules.find((r3) => r3.guardrail === guardrailId);
-    if (!policyRule) {
-      diagnostics.push({
-        path: `binding.${binding.software}.guardrail_impl.${guardrailId}`,
-        message: `Guardrail "${guardrailId}" has no policy rule in the active policy \u2014 skipping`,
-        severity: "info"
-      });
-      continue;
+Handlebars.registerHelper(
+  "overviewFlowchart",
+  function(...args) {
+    const positionalArgs = args.slice(0, -1);
+    if (positionalArgs[0] && typeof positionalArgs[0] === "object") {
+      return generateOverviewFlowchart(positionalArgs[0]);
     }
-    for (const check of impl.checks) {
-      resolved.push({
-        guardrail_id: guardrailId,
-        guardrail,
-        policy_rule: policyRule,
-        check
+    const dsl = this["dsl"];
+    if (!dsl) return "";
+    return generateOverviewFlowchart(dsl);
+  }
+);
+Handlebars.registerHelper(
+  "guardrailCoverageMatrix",
+  function() {
+    const enforcement = this["guardrailEnforcement"];
+    if (!enforcement || enforcement.length === 0) return "";
+    const header = "| Guardrail | Severity | Action | Agents | Tasks | Workflows | Tools | Artifacts | Trigger | Override | Escalation |";
+    const divider = "|-----------|----------|--------|--------|-------|-----------|-------|-----------|---------|----------|------------|";
+    const rows = enforcement.map((e3) => {
+      const agents = e3["scoped_agents"]?.join(", ") || "\u2014";
+      const tasks = e3["scoped_tasks"]?.join(", ") || "\u2014";
+      const workflows = e3["scoped_workflows"]?.join(", ") || "\u2014";
+      const tools = e3["scoped_tools"]?.join(", ") || "\u2014";
+      const artifacts = e3["scoped_artifacts"]?.join(", ") || "\u2014";
+      const trigger = e3["trigger"] || "\u2014";
+      const override = e3["allow_override"] ? "yes" : "no";
+      const esc = e3["escalation"];
+      const escalation = esc ? esc["target"] : "\u2014";
+      return `| ${e3["guardrail_id"]} | ${e3["severity"]} | ${e3["action"]} | ${agents} | ${tasks} | ${workflows} | ${tools} | ${artifacts} | ${trigger} | ${override} | ${escalation} |`;
+    });
+    return [header, divider, ...rows].join("\n");
+  }
+);
+Handlebars.registerHelper(
+  "taskGuardrailMatrix",
+  function() {
+    const dsl = this["dsl"];
+    const enforcement = this["guardrailEnforcement"];
+    if (!dsl || !enforcement || enforcement.length === 0) return "";
+    const taskIds = Object.keys(dsl.tasks);
+    if (taskIds.length === 0) return "";
+    const guardrailIds = enforcement.map((e3) => e3["guardrail_id"]);
+    const header = `| Task | ${guardrailIds.join(" | ")} |`;
+    const divider = `|------|${guardrailIds.map(() => "------").join("|")}|`;
+    const rows = taskIds.map((taskId) => {
+      const cells = enforcement.map((e3) => {
+        const scopedTasks = e3["scoped_tasks"];
+        if (scopedTasks.length > 0 && !scopedTasks.includes(taskId)) return "n/a";
+        return e3["action"];
       });
+      return `| ${taskId} | ${cells.join(" | ")} |`;
+    });
+    return [header, divider, ...rows].join("\n");
+  }
+);
+function getDslSection(dsl, context) {
+  const sectionMap = {
+    agent: dsl.agents,
+    task: dsl.tasks,
+    artifact: dsl.artifacts,
+    tool: dsl.tools,
+    validation: dsl.validations,
+    handoff_type: dsl.handoff_types,
+    workflow: dsl.workflow,
+    policy: dsl.policies,
+    guardrail: dsl.guardrails,
+    guardrail_policy: dsl.guardrail_policies
+  };
+  return sectionMap[context] ?? {};
+}
+function filterIds(allIds, include, exclude) {
+  if (include) return allIds.filter((id) => include.includes(id));
+  if (exclude) return allIds.filter((id) => !exclude.includes(id));
+  return allIds;
+}
+function expandOutputPath(pattern, context, entityId) {
+  return pattern.replace(new RegExp(`\\{${context}\\.id\\}`, "g"), entityId);
+}
+function buildEntityContext(dsl, context, entityId) {
+  switch (context) {
+    case "agent": {
+      const agentDef = dsl.agents[entityId];
+      const agentWithId = { ...agentDef, id: entityId };
+      return buildPerAgentContext(dsl, agentWithId);
     }
+    case "task":
+      return buildTaskContext(dsl, entityId);
+    case "artifact":
+      return buildArtifactContext(dsl, entityId);
+    case "tool":
+      return buildToolContext(dsl, entityId);
+    case "validation":
+      return buildValidationContext(dsl, entityId);
+    case "handoff_type":
+      return buildHandoffTypeContext(dsl, entityId);
+    case "workflow":
+      return buildWorkflowContext(dsl, entityId);
+    case "policy":
+      return buildPolicyContext(dsl, entityId);
+    case "guardrail":
+      return buildGuardrailContext(dsl, entityId);
+    case "guardrail_policy":
+      return buildGuardrailPolicyContext(dsl, entityId);
+    case "system":
+      return buildSystemContext(dsl);
   }
-  return { resolved, diagnostics };
 }
-
-// src/guardrail-generator/resolve-paths.ts
-function resolveBindingTargetPath(target, paths, bindingSoftware) {
-  const diagnostics = [];
-  const resolved = target.replace(/\{(\w+)\}/g, (match, varName) => {
-    const value = paths[varName];
-    if (value === void 0) {
-      diagnostics.push({
-        path: `binding.${bindingSoftware}.outputs`,
-        message: `Path variable "${varName}" used in target "${target}" but not defined in config.paths`,
-        severity: "error"
-      });
-      return match;
+async function loadTemplate(templatePath) {
+  return readFile4(templatePath, "utf8");
+}
+function isEffectivelyEmpty(output) {
+  return output.trim().length === 0;
+}
+async function removeIfExists(filePath) {
+  try {
+    await unlink(filePath);
+  } catch {
+  }
+}
+async function renderFromConfig(dsl, renderTargets, options) {
+  const outputFiles = [];
+  for (const target of renderTargets) {
+    const templateContent = await loadTemplate(target.template);
+    const compiled = Handlebars.compile(templateContent, { noEscape: false });
+    if (target.context === "system") {
+      const ctx = buildSystemContext(dsl, options);
+      const output = compiled(ctx);
+      if (target.skip_empty && isEffectivelyEmpty(output)) {
+        await removeIfExists(target.output);
+        continue;
+      }
+      await mkdir(dirname5(target.output), { recursive: true });
+      await writeFile(target.output, output, "utf8");
+      outputFiles.push(target.output);
+    } else {
+      const section = getDslSection(dsl, target.context);
+      const allIds = Object.keys(section);
+      const ids = filterIds(allIds, target.include, target.exclude);
+      for (const entityId of ids) {
+        const ctx = buildEntityContext(dsl, target.context, entityId);
+        const output = compiled(ctx);
+        const outputPath = expandOutputPath(target.output, target.context, entityId);
+        if (target.skip_empty && isEffectivelyEmpty(output)) {
+          await removeIfExists(outputPath);
+          continue;
+        }
+        await mkdir(dirname5(outputPath), { recursive: true });
+        await writeFile(outputPath, output, "utf8");
+        outputFiles.push(outputPath);
+      }
     }
-    return value;
+  }
+  return outputFiles;
+}
+async function fileExists2(filePath) {
+  try {
+    await readFile4(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function checkExpectedVsExisting(expected, outputPath, skipEmpty, diffs) {
+  if (skipEmpty && isEffectivelyEmpty(expected)) {
+    return fileExists2(outputPath).then((exists) => {
+      if (exists) diffs.push(outputPath);
+    });
+  }
+  return readFile4(outputPath, "utf8").then((existing) => {
+    if (existing !== expected) diffs.push(outputPath);
+  }).catch(() => {
+    diffs.push(outputPath);
   });
-  return { resolved, diagnostics };
+}
+async function checkDriftFromConfig(dsl, renderTargets, options) {
+  const diffs = [];
+  for (const target of renderTargets) {
+    const templateContent = await loadTemplate(target.template);
+    const compiled = Handlebars.compile(templateContent, { noEscape: false });
+    if (target.context === "system") {
+      const ctx = buildSystemContext(dsl, options);
+      const expected = compiled(ctx);
+      await checkExpectedVsExisting(expected, target.output, target.skip_empty, diffs);
+    } else {
+      const section = getDslSection(dsl, target.context);
+      const allIds = Object.keys(section);
+      const ids = filterIds(allIds, target.include, target.exclude);
+      for (const entityId of ids) {
+        const ctx = buildEntityContext(dsl, target.context, entityId);
+        const expected = compiled(ctx);
+        const outputPath = expandOutputPath(target.output, target.context, entityId);
+        await checkExpectedVsExisting(expected, outputPath, target.skip_empty, diffs);
+      }
+    }
+  }
+  return { hasDrift: diffs.length > 0, diffs };
 }
 
 // src/guardrail-generator/generator.ts
@@ -55058,7 +54893,7 @@ async function generateGuardrails(options) {
         const sourcePath = resolve6(config.configDir, outputDef.source);
         if (!dryRun) {
           try {
-            await mkdir2(dirname7(targetPath), { recursive: true });
+            await mkdir2(dirname6(targetPath), { recursive: true });
             await copyFile(sourcePath, targetPath);
             if (outputDef.executable) {
               await chmod(targetPath, 493);
@@ -55142,7 +54977,7 @@ async function generateGuardrails(options) {
           }
           const output = isPatch && !dryRun ? await applyPatch(groupTarget, rendered, outputDef) : rendered;
           if (!dryRun) {
-            await mkdir2(dirname7(groupTarget), { recursive: true });
+            await mkdir2(dirname6(groupTarget), { recursive: true });
             await writeFile2(groupTarget, output, "utf8");
             if (outputDef.executable) {
               await chmod(groupTarget, 493);
@@ -55163,7 +54998,7 @@ async function generateGuardrails(options) {
         } else {
           const output = isPatch && !dryRun ? await applyPatch(targetPath, rendered, outputDef) : rendered;
           if (!dryRun) {
-            await mkdir2(dirname7(targetPath), { recursive: true });
+            await mkdir2(dirname6(targetPath), { recursive: true });
             await writeFile2(targetPath, output, "utf8");
             if (outputDef.executable) {
               await chmod(targetPath, 493);
@@ -55216,7 +55051,7 @@ async function generateGuardrails(options) {
           continue;
         }
         if (!dryRun) {
-          await mkdir2(dirname7(outputPath), { recursive: true });
+          await mkdir2(dirname6(outputPath), { recursive: true });
           await writeFile2(outputPath, rendered, "utf8");
           if (renderTarget.executable) {
             await chmod(outputPath, 493);
@@ -55246,7 +55081,7 @@ async function generateGuardrails(options) {
             continue;
           }
           if (!dryRun) {
-            await mkdir2(dirname7(outputPath), { recursive: true });
+            await mkdir2(dirname6(outputPath), { recursive: true });
             await writeFile2(outputPath, rendered, "utf8");
             if (renderTarget.executable) {
               await chmod(outputPath, 493);
@@ -55269,6 +55104,84 @@ function resolveBindingRenderOutputPath(output, paths) {
 // src/cli/commands/generate-interface.ts
 import { writeFileSync } from "fs";
 import { resolve as resolve7 } from "path";
+
+// src/interface-generator/generator.ts
+import { stringify as stringify2 } from "yaml";
+function buildInterfaceDocument(dsl, generatedAt) {
+  const ti = dsl.team_interface;
+  const doc = {
+    team_id: dsl.system.id,
+    team_name: dsl.system.name,
+    version: ti.version,
+    generated_at: generatedAt
+  };
+  if (ti.description !== void 0) {
+    doc.description = ti.description;
+  }
+  if (ti.accepts?.workflows && Object.keys(ti.accepts.workflows).length > 0) {
+    doc.accepts = { workflows: { ...ti.accepts.workflows } };
+  }
+  const handoffKeys = /* @__PURE__ */ new Set();
+  if (ti.accepts?.workflows) {
+    for (const spec of Object.values(ti.accepts.workflows)) {
+      handoffKeys.add(spec.input_handoff);
+      handoffKeys.add(spec.output_handoff);
+    }
+  }
+  const handoff_types = {};
+  for (const k2 of [...handoffKeys].sort()) {
+    const ht = dsl.handoff_types[k2];
+    if (ht) {
+      const entry = {
+        version: ht.version,
+        schema: ht.schema
+      };
+      if (ht.description !== void 0) {
+        entry.description = ht.description;
+      }
+      handoff_types[k2] = entry;
+    }
+  }
+  if (Object.keys(handoff_types).length > 0) {
+    doc.handoff_types = handoff_types;
+  }
+  const artifactsOut = {};
+  if (ti.exposes?.artifacts) {
+    for (const key of [...ti.exposes.artifacts].sort()) {
+      const art = dsl.artifacts[key];
+      if (art) {
+        const entry = {
+          type: art.type,
+          states: art.states
+        };
+        if (art.description !== void 0) {
+          entry.description = art.description;
+        }
+        artifactsOut[key] = entry;
+      }
+    }
+  }
+  if (Object.keys(artifactsOut).length > 0) {
+    doc.exposes = { artifacts: artifactsOut };
+  }
+  if (ti.constraints !== void 0 && ti.constraints.length > 0) {
+    doc.constraints = ti.constraints;
+  }
+  return doc;
+}
+function generateInterface(options) {
+  if (!options.dsl.team_interface) {
+    throw new Error("DSL has no team_interface section");
+  }
+  const doc = buildInterfaceDocument(options.dsl, (/* @__PURE__ */ new Date()).toISOString());
+  const content = options.format === "json" ? `${JSON.stringify(doc, null, 2)}
+` : `${stringify2(doc, { sortMapEntries: true })}
+`;
+  const outputPath = options.output ?? "team-interface.yaml";
+  return { outputPath, content };
+}
+
+// src/cli/commands/generate-interface.ts
 function runGenerateInterfaceCli(opts) {
   if (!opts.dsl.team_interface) {
     process.stderr.write("Error: DSL has no team_interface section.\n");
@@ -55285,44 +55198,351 @@ function runGenerateInterfaceCli(opts) {
     process.stdout.write(result.content);
     return;
   }
-  writeFileSync(result.outputPath, result.content, "utf8");
-  if (!opts.quiet) {
-    process.stdout.write(`Wrote ${result.outputPath}
+  writeFileSync(result.outputPath, result.content, "utf8");
+  if (!opts.quiet) {
+    process.stdout.write(`Wrote ${result.outputPath}
+`);
+  }
+}
+
+// src/cli/commands/generate.ts
+var VALID_TYPES = ["templates", "guardrails", "interface"];
+function resolvedConfigForTeam(workspace, teamConfig) {
+  return {
+    dsl: "",
+    vars: teamConfig.vars,
+    renders: workspace.renders,
+    configDir: workspace.configDir,
+    bindings: teamConfig.bindings,
+    activeGuardrailPolicy: teamConfig.activeGuardrailPolicy,
+    paths: teamConfig.paths
+  };
+}
+async function runGenerate(type, opts) {
+  if (type !== void 0 && !VALID_TYPES.includes(type)) {
+    process.stderr.write(`Unknown generate type: ${type}
+`);
+    process.exit(1);
+  }
+  if (opts.format !== "yaml" && opts.format !== "json") {
+    process.stderr.write(
+      `Invalid --format: expected yaml or json, got ${opts.format}
+`
+    );
+    process.exit(1);
+  }
+  const normalizedType = type;
+  const targets = {
+    templates: normalizedType === void 0 || normalizedType === "templates",
+    guardrails: normalizedType === void 0 || normalizedType === "guardrails",
+    interface: normalizedType === void 0 || normalizedType === "interface"
+  };
+  try {
+    const config = await loadConfig(opts.config);
+    if (!config) {
+      process.stderr.write(
+        "Error: agent-contracts.config.yaml not found. Use --config to specify path.\n"
+      );
+      process.exit(1);
+    }
+    if (isMultiTeamConfig(config)) {
+      await runMultiTeam(config, targets, normalizedType, opts);
+      return;
+    }
+    await runSingleTeam(config, targets, normalizedType, opts);
+  } catch (err) {
+    if (err instanceof ConfigLoadError) {
+      process.stderr.write(`Config error: ${err.message}
+`);
+      process.exit(1);
+    }
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`Error: ${msg}
+`);
+    process.exit(1);
+  }
+}
+async function runMultiTeam(config, targets, normalizedType, opts) {
+  const teamEntries = getTeamEntries(config, opts.team);
+  let exitWithError = false;
+  for (const [teamId, teamConfig] of teamEntries) {
+    if (!opts.quiet) process.stdout.write(`
+--- Team: ${teamId} ---
+`);
+    const resolved = await resolve4(teamConfig.dsl);
+    const data = teamConfig.vars ? substituteVars(resolved.data, teamConfig.vars) : resolved.data;
+    const schemaResult = validateSchema(data);
+    if (!schemaResult.success) {
+      process.stderr.write(
+        `Schema validation failed for team ${teamId}. Run 'agent-contracts validate' for details.
+`
+      );
+      exitWithError = true;
+      continue;
+    }
+    if (targets.templates) {
+      let renderOptions;
+      if (teamConfig.bindings.length > 0) {
+        const loadedBindings = await loadBindings(teamConfig.bindings);
+        renderOptions = {
+          loadedBindings,
+          activeGuardrailPolicy: teamConfig.activeGuardrailPolicy
+        };
+      }
+      if (opts.check) {
+        const drift = await checkDriftFromConfig(
+          schemaResult.data,
+          config.renders,
+          renderOptions
+        );
+        if (drift.hasDrift) {
+          process.stderr.write(
+            `Drift detected for team ${teamId} in the following files:
+`
+          );
+          for (const f2 of drift.diffs) {
+            process.stderr.write(`  ${f2}
+`);
+          }
+          exitWithError = true;
+        } else if (!opts.quiet) {
+          process.stdout.write("No drift detected.\n");
+        }
+      } else {
+        const files = await renderFromConfig(
+          schemaResult.data,
+          config.renders,
+          renderOptions
+        );
+        if (!opts.quiet) {
+          process.stdout.write(`Rendered ${files.length} file(s):
+`);
+          for (const f2 of files) {
+            process.stdout.write(`  ${f2}
+`);
+          }
+        }
+      }
+    }
+    if (targets.interface) {
+      if (schemaResult.data.team_interface) {
+        runGenerateInterfaceCli({
+          dsl: schemaResult.data,
+          output: teamConfig.interfaceOutput ?? opts.output,
+          dryRun: opts.dryRun,
+          format: opts.format,
+          quiet: opts.quiet
+        });
+      } else if (normalizedType === "interface") {
+        process.stderr.write("Error: DSL has no team_interface section.\n");
+        exitWithError = true;
+      }
+    }
+    if (targets.guardrails) {
+      const loadedBindings = await loadBindings(teamConfig.bindings);
+      const result = await generateGuardrails({
+        dsl: schemaResult.data,
+        config: resolvedConfigForTeam(config, teamConfig),
+        loadedBindings,
+        filterBindings: opts.binding,
+        dryRun: opts.dryRun
+      });
+      const errors = result.diagnostics.filter((d2) => d2.severity === "error");
+      const warnings = result.diagnostics.filter((d2) => d2.severity === "warning");
+      const infos = result.diagnostics.filter((d2) => d2.severity === "info");
+      if (errors.length > 0) {
+        process.stderr.write(`Errors (team ${teamId}):
+`);
+        for (const d2 of errors) {
+          process.stderr.write(`  error [${d2.path}] ${d2.message}
+`);
+        }
+        exitWithError = true;
+      }
+      if (warnings.length > 0 && !opts.quiet) {
+        process.stderr.write(`Warnings (team ${teamId}):
+`);
+        for (const d2 of warnings) {
+          process.stderr.write(`  warning [${d2.path}] ${d2.message}
+`);
+        }
+      }
+      if (infos.length > 0 && !opts.quiet) {
+        for (const d2 of infos) {
+          process.stderr.write(`  info [${d2.path}] ${d2.message}
+`);
+        }
+      }
+      if (!opts.quiet) {
+        const action = opts.dryRun ? "Would generate" : "Generated";
+        process.stdout.write(
+          `${action} ${result.outputFiles.length} file(s):
+`
+        );
+        for (const f2 of result.outputFiles) {
+          process.stdout.write(`  ${f2}
+`);
+        }
+      }
+    }
+  }
+  if (exitWithError) process.exit(1);
+}
+async function runSingleTeam(config, targets, normalizedType, opts) {
+  const resolved = await resolve4(config.dsl);
+  const data = config.vars ? substituteVars(resolved.data, config.vars) : resolved.data;
+  const schemaResult = validateSchema(data);
+  if (!schemaResult.success) {
+    process.stderr.write(
+      "Schema validation failed. Run 'agent-contracts validate' for details.\n"
+    );
+    process.exit(1);
+  }
+  let exitWithError = false;
+  if (targets.templates) {
+    let renderOptions;
+    if (config.bindings.length > 0) {
+      const loadedBindings = await loadBindings(config.bindings);
+      renderOptions = {
+        loadedBindings,
+        activeGuardrailPolicy: config.activeGuardrailPolicy
+      };
+    }
+    if (opts.check) {
+      const drift = await checkDriftFromConfig(
+        schemaResult.data,
+        config.renders,
+        renderOptions
+      );
+      if (drift.hasDrift) {
+        process.stderr.write("Drift detected in the following files:\n");
+        for (const f2 of drift.diffs) {
+          process.stderr.write(`  ${f2}
+`);
+        }
+        exitWithError = true;
+      } else if (!opts.quiet) {
+        process.stdout.write("No drift detected.\n");
+      }
+    } else {
+      const files = await renderFromConfig(
+        schemaResult.data,
+        config.renders,
+        renderOptions
+      );
+      if (!opts.quiet) {
+        process.stdout.write(`Rendered ${files.length} file(s):
+`);
+        for (const f2 of files) {
+          process.stdout.write(`  ${f2}
+`);
+        }
+      }
+    }
+  }
+  if (targets.interface) {
+    if (schemaResult.data.team_interface) {
+      runGenerateInterfaceCli({
+        dsl: schemaResult.data,
+        output: opts.output,
+        dryRun: opts.dryRun,
+        format: opts.format,
+        quiet: opts.quiet
+      });
+    } else if (normalizedType === "interface") {
+      process.stderr.write("Error: DSL has no team_interface section.\n");
+      process.exit(1);
+    }
+  }
+  if (targets.guardrails) {
+    const loadedBindings = await loadBindings(config.bindings);
+    const result = await generateGuardrails({
+      dsl: schemaResult.data,
+      config,
+      loadedBindings,
+      filterBindings: opts.binding,
+      dryRun: opts.dryRun
+    });
+    const errors = result.diagnostics.filter((d2) => d2.severity === "error");
+    const warnings = result.diagnostics.filter((d2) => d2.severity === "warning");
+    const infos = result.diagnostics.filter((d2) => d2.severity === "info");
+    if (errors.length > 0) {
+      process.stderr.write("Errors:\n");
+      for (const d2 of errors) {
+        process.stderr.write(`  error [${d2.path}] ${d2.message}
+`);
+      }
+      exitWithError = true;
+    }
+    if (warnings.length > 0 && !opts.quiet) {
+      process.stderr.write("Warnings:\n");
+      for (const d2 of warnings) {
+        process.stderr.write(`  warning [${d2.path}] ${d2.message}
+`);
+      }
+    }
+    if (infos.length > 0 && !opts.quiet) {
+      for (const d2 of infos) {
+        process.stderr.write(`  info [${d2.path}] ${d2.message}
+`);
+      }
+    }
+    if (!opts.quiet) {
+      const action = opts.dryRun ? "Would generate" : "Generated";
+      process.stdout.write(
+        `${action} ${result.outputFiles.length} file(s):
+`
+      );
+      for (const f2 of result.outputFiles) {
+        process.stdout.write(`  ${f2}
 `);
+      }
+    }
   }
+  if (exitWithError) process.exit(1);
 }
-
-// src/cli/commands/generate-guardrails.ts
-function resolvedConfigForTeam(workspace, teamConfig) {
-  return {
-    dsl: "",
-    vars: teamConfig.vars,
-    renders: workspace.renders,
-    configDir: workspace.configDir,
-    bindings: teamConfig.bindings,
-    activeGuardrailPolicy: teamConfig.activeGuardrailPolicy,
-    paths: teamConfig.paths
-  };
-}
-var generateGuardrailsCommand = new Command6("generate").description("Generate guardrail runtime artifacts from DSL, policies, and bindings").argument("[type]", "Type of artifacts to generate (guardrails|interface)", "guardrails").option("-c, --config <path>", "Path to agent-contracts.config.yaml").option("--team <id>", "Limit to one team (multi-team config only)").option("--binding <name...>", "Filter to specific software binding(s)").option(
+var generateCommand = new Command4("generate").description("Generate artifacts from DSL \u2014 templates, guardrails, and/or interface").argument(
+  "[type]",
+  "Type of artifacts to generate (templates|guardrails|interface). Omit to run all."
+).option("-c, --config <path>", "Path to agent-contracts.config.yaml").option("--team <id>", "Limit to one team (multi-team config only)").option(
+  "--check",
+  "Check for template drift without writing files (templates only)",
+  false
+).option("--binding <name...>", "Filter to specific software binding(s) (guardrails only)").option(
   "-o, --output <path>",
-  "Output path for generated team interface (interface type only)"
+  "Output path for generated team interface (interface only)"
 ).option(
   "--format <format>",
   "Output format for team interface: yaml or json",
   "yaml"
-).option("--dry-run", "Print what would be generated without writing files", false).option("--quiet", "Suppress output on success", false).action(
-  async (type, opts) => {
-    if (type !== "guardrails" && type !== "interface") {
-      process.stderr.write(`Unknown generate type: ${type}
-`);
-      process.exit(1);
-    }
-    if (type === "interface" && opts.format !== "yaml" && opts.format !== "json") {
-      process.stderr.write(`Invalid --format: expected yaml or json, got ${opts.format}
-`);
-      process.exit(1);
-    }
+).option("--dry-run", "Print what would be generated without writing files", false).option("--quiet", "Suppress output on success", false).action(runGenerate);
+
+// src/cli/commands/render.ts
+var renderCommand = new Command5("render").description("(deprecated) Alias for 'generate templates'. Use 'generate templates' instead.").option("-c, --config <path>", "Path to agent-contracts.config.yaml").option("--team <id>", "Limit to one team (multi-team config only)").option("--check", "Check for template drift without writing files", false).option("--quiet", "Suppress output on success", false).action(
+  async (opts) => {
+    process.stderr.write(
+      "Warning: 'render' is deprecated. Use 'agent-contracts generate templates' instead.\n"
+    );
+    await runGenerate("templates", {
+      ...opts,
+      binding: void 0,
+      output: void 0,
+      format: "yaml",
+      dryRun: false
+    });
+  }
+);
+
+// src/cli/commands/check.ts
+import { existsSync, readFileSync } from "fs";
+import { join as join3 } from "path";
+import { Command as Command6 } from "commander";
+import { parse as parseYaml4, stringify as stringify3 } from "yaml";
+import { access as access2 } from "fs/promises";
+import { resolve as pathResolve, dirname as dirname7 } from "path";
+var checkCommand = new Command6("check").description("Run full pipeline: resolve \u2192 validate \u2192 lint \u2192 render --check").option("-c, --config <path>", "Path to agent-contracts.config.yaml").option("--team <id>", "Limit to one team (multi-team config only)").option("--format <format>", "Output format (text|json)", "text").option("--quiet", "Suppress output on success", false).option("--strict", "Treat warnings as errors", false).action(
+  async (opts) => {
+    let hasErrors = false;
     try {
       const config = await loadConfig(opts.config);
       if (!config) {
@@ -55333,144 +55553,203 @@ var generateGuardrailsCommand = new Command6("generate").description("Generate g
       }
       if (isMultiTeamConfig(config)) {
         const teamEntries = getTeamEntries(config, opts.team);
-        let exitWithError = false;
         for (const [teamId, teamConfig] of teamEntries) {
-          if (!opts.quiet) process.stdout.write(`
+          if (!opts.quiet) process.stderr.write(`
 --- Team: ${teamId} ---
 `);
           const resolved2 = await resolve4(teamConfig.dsl);
           const data2 = teamConfig.vars ? substituteVars(resolved2.data, teamConfig.vars) : resolved2.data;
           const schemaResult2 = validateSchema(data2);
+          const schemaWarnings2 = schemaResult2.diagnostics.filter(
+            (d2) => d2.severity === "warning"
+          );
           if (!schemaResult2.success) {
-            process.stderr.write(
-              `Schema validation failed for team ${teamId}. Run 'agent-contracts validate' for details.
-`
-            );
-            exitWithError = true;
+            const output = formatDiagnostics(schemaResult2.diagnostics, {
+              format: opts.format,
+              quiet: opts.quiet
+            });
+            if (output) process.stderr.write(output + "\n");
+            hasErrors = true;
             continue;
           }
-          if (type === "interface") {
-            runGenerateInterfaceCli({
-              dsl: schemaResult2.data,
-              output: teamConfig.interfaceOutput ?? opts.output,
-              dryRun: opts.dryRun,
+          const refDiags2 = checkReferences(schemaResult2.data);
+          const handoffDiags2 = validateHandoffSchemas(schemaResult2.data);
+          const allRefDiags2 = [...refDiags2, ...handoffDiags2, ...schemaWarnings2];
+          if (allRefDiags2.length > 0) {
+            const output = formatDiagnostics(allRefDiags2, {
               format: opts.format,
               quiet: opts.quiet
             });
-            continue;
+            if (output) process.stderr.write(output + "\n");
+            hasErrors = true;
           }
-          const loadedBindings2 = await loadBindings(teamConfig.bindings);
-          const result2 = await generateGuardrails({
-            dsl: schemaResult2.data,
-            config: resolvedConfigForTeam(config, teamConfig),
-            loadedBindings: loadedBindings2,
-            filterBindings: opts.binding,
-            dryRun: opts.dryRun
-          });
-          const errors2 = result2.diagnostics.filter((d2) => d2.severity === "error");
-          const warnings2 = result2.diagnostics.filter((d2) => d2.severity === "warning");
-          const infos2 = result2.diagnostics.filter((d2) => d2.severity === "info");
-          if (errors2.length > 0) {
-            process.stderr.write(`Errors (team ${teamId}):
-`);
-            for (const d2 of errors2) {
-              process.stderr.write(`  error [${d2.path}] ${d2.message}
-`);
+          const tsLintDiags2 = lint(schemaResult2.data);
+          const spectralDiags2 = await spectralLint(
+            schemaResult2.data
+          );
+          const lintDiags2 = [...tsLintDiags2, ...spectralDiags2];
+          if (lintDiags2.length > 0) {
+            const output = formatDiagnostics(lintDiags2, {
+              format: opts.format,
+              quiet: opts.quiet
+            });
+            if (output) process.stderr.write(output + "\n");
+            if (lintDiags2.some((d2) => d2.severity === "error")) {
+              hasErrors = true;
             }
-            exitWithError = true;
-          }
-          if (warnings2.length > 0 && !opts.quiet) {
-            process.stderr.write(`Warnings (team ${teamId}):
-`);
-            for (const d2 of warnings2) {
-              process.stderr.write(`  warning [${d2.path}] ${d2.message}
-`);
+            if (opts.strict && lintDiags2.some((d2) => d2.severity === "warning")) {
+              hasErrors = true;
             }
           }
-          if (infos2.length > 0 && !opts.quiet) {
-            for (const d2 of infos2) {
-              process.stderr.write(`  info [${d2.path}] ${d2.message}
+          let renderOptions2;
+          if (teamConfig.bindings.length > 0) {
+            const loadedBindings = await loadBindings(teamConfig.bindings);
+            renderOptions2 = {
+              loadedBindings,
+              activeGuardrailPolicy: teamConfig.activeGuardrailPolicy
+            };
+          }
+          const drift2 = await checkDriftFromConfig(
+            schemaResult2.data,
+            config.renders,
+            renderOptions2
+          );
+          if (drift2.hasDrift) {
+            process.stderr.write(`Drift detected for team ${teamId} in:
+`);
+            for (const f2 of drift2.diffs) {
+              process.stderr.write(`  ${f2}
 `);
             }
+            hasErrors = true;
           }
-          if (!opts.quiet) {
-            const action = opts.dryRun ? "Would generate" : "Generated";
-            process.stdout.write(
-              `${action} ${result2.outputFiles.length} file(s):
+        }
+        if (!hasErrors) {
+          for (const [teamId, teamConfig] of teamEntries) {
+            const resolved2 = await resolve4(teamConfig.dsl);
+            const data2 = teamConfig.vars ? substituteVars(resolved2.data, teamConfig.vars) : resolved2.data;
+            const schemaResult2 = validateSchema(data2);
+            if (!schemaResult2.success || !schemaResult2.data) continue;
+            const dsl = schemaResult2.data;
+            const imports = dsl.imports;
+            if (!imports) continue;
+            for (const [importName, importDef] of Object.entries(imports)) {
+              const interfacePathRel = importDef?.interface;
+              if (typeof interfacePathRel !== "string") continue;
+              const interfacePath = pathResolve(
+                dirname7(teamConfig.dsl),
+                interfacePathRel
+              );
+              try {
+                await access2(interfacePath);
+              } catch {
+                process.stderr.write(
+                  `Cross-team error: Team "${teamId}" imports "${importName}" but interface file not found: ${interfacePath}
 `
-            );
-            for (const f2 of result2.outputFiles) {
-              process.stdout.write(`  ${f2}
-`);
+                );
+                hasErrors = true;
+              }
             }
           }
         }
-        if (exitWithError) process.exit(1);
+        if (hasErrors) process.exit(1);
+        if (!opts.quiet) process.stdout.write("All checks passed.\n");
         return;
       }
       const resolved = await resolve4(config.dsl);
       const data = config.vars ? substituteVars(resolved.data, config.vars) : resolved.data;
       const schemaResult = validateSchema(data);
+      const schemaWarnings = schemaResult.diagnostics.filter(
+        (d2) => d2.severity === "warning"
+      );
       if (!schemaResult.success) {
-        process.stderr.write(
-          "Schema validation failed. Run 'agent-contracts validate' for details.\n"
-        );
+        const output = formatDiagnostics(schemaResult.diagnostics, {
+          format: opts.format,
+          quiet: opts.quiet
+        });
+        if (output) process.stderr.write(output + "\n");
         process.exit(1);
       }
-      if (type === "interface") {
-        runGenerateInterfaceCli({
-          dsl: schemaResult.data,
-          output: opts.output,
-          dryRun: opts.dryRun,
+      const refDiags = checkReferences(schemaResult.data);
+      const handoffDiags = validateHandoffSchemas(schemaResult.data);
+      const allRefDiags = [...refDiags, ...handoffDiags, ...schemaWarnings];
+      if (allRefDiags.length > 0) {
+        const output = formatDiagnostics(allRefDiags, {
           format: opts.format,
           quiet: opts.quiet
         });
-        return;
+        if (output) process.stderr.write(output + "\n");
+        hasErrors = true;
       }
-      const loadedBindings = await loadBindings(config.bindings);
-      const result = await generateGuardrails({
-        dsl: schemaResult.data,
-        config,
-        loadedBindings,
-        filterBindings: opts.binding,
-        dryRun: opts.dryRun
-      });
-      const errors = result.diagnostics.filter((d2) => d2.severity === "error");
-      const warnings = result.diagnostics.filter((d2) => d2.severity === "warning");
-      const infos = result.diagnostics.filter((d2) => d2.severity === "info");
-      if (errors.length > 0) {
-        process.stderr.write("Errors:\n");
-        for (const d2 of errors) {
-          process.stderr.write(`  error [${d2.path}] ${d2.message}
-`);
+      const tsLintDiags = lint(schemaResult.data);
+      const spectralDiags = await spectralLint(schemaResult.data);
+      const lintDiags = [...tsLintDiags, ...spectralDiags];
+      if (lintDiags.length > 0) {
+        const output = formatDiagnostics(lintDiags, {
+          format: opts.format,
+          quiet: opts.quiet
+        });
+        if (output) process.stderr.write(output + "\n");
+        if (lintDiags.some((d2) => d2.severity === "error")) {
+          hasErrors = true;
+        }
+        if (opts.strict && lintDiags.some((d2) => d2.severity === "warning")) {
+          hasErrors = true;
         }
       }
-      if (warnings.length > 0 && !opts.quiet) {
-        process.stderr.write("Warnings:\n");
-        for (const d2 of warnings) {
-          process.stderr.write(`  warning [${d2.path}] ${d2.message}
+      let renderOptions;
+      if (config.bindings.length > 0) {
+        const loadedBindings = await loadBindings(config.bindings);
+        renderOptions = {
+          loadedBindings,
+          activeGuardrailPolicy: config.activeGuardrailPolicy
+        };
+      }
+      const drift = await checkDriftFromConfig(
+        schemaResult.data,
+        config.renders,
+        renderOptions
+      );
+      if (drift.hasDrift) {
+        process.stderr.write("Drift detected in:\n");
+        for (const f2 of drift.diffs) {
+          process.stderr.write(`  ${f2}
 `);
         }
+        hasErrors = true;
       }
-      if (infos.length > 0 && !opts.quiet) {
-        for (const d2 of infos) {
-          process.stderr.write(`  info [${d2.path}] ${d2.message}
-`);
+      if (schemaResult.data.team_interface) {
+        const interfacePath = join3(config.configDir, "team-interface.yaml");
+        if (existsSync(interfacePath)) {
+          const result = generateInterface({
+            dsl: schemaResult.data,
+            dryRun: true,
+            format: "yaml"
+          });
+          const existing = readFileSync(interfacePath, "utf8");
+          const normalize = (raw) => {
+            try {
+              const parsed = parseYaml4(raw);
+              if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                const { generated_at: _t, ...rest } = parsed;
+                return `${stringify3(rest, { sortMapEntries: true })}
+`;
+              }
+            } catch {
+            }
+            return raw.trim();
+          };
+          if (normalize(existing) !== normalize(result.content)) {
+            process.stderr.write("Drift detected in team-interface.yaml\n");
+            hasErrors = true;
+          }
         }
       }
-      if (errors.length > 0) {
+      if (hasErrors) {
         process.exit(1);
       }
       if (!opts.quiet) {
-        const action = opts.dryRun ? "Would generate" : "Generated";
-        process.stdout.write(
-          `${action} ${result.outputFiles.length} file(s):
-`
-        );
-        for (const f2 of result.outputFiles) {
-          process.stdout.write(`  ${f2}
-`);
-        }
+        process.stdout.write("All checks passed.\n");
       }
     } catch (err) {
       if (err instanceof ConfigLoadError) {
@@ -56809,7 +57088,7 @@ program.addCommand(validateCommand);
 program.addCommand(lintCommand);
 program.addCommand(renderCommand);
 program.addCommand(checkCommand);
-program.addCommand(generateGuardrailsCommand);
+program.addCommand(generateCommand);
 program.addCommand(scoreCommand);
 program.addCommand(auditCommand);
 program.parse();