@elevasis/core 0.1.0

package/dist/organization-model/index.js

@@ -0,0 +1,403 @@
+import { z } from 'zod';
+
+// src/organization-model/schema.ts
+var ModelIdSchema = z.string().trim().min(1).max(100).regex(/^[a-z0-9]+(?:[-._][a-z0-9]+)*$/, "IDs must be lowercase and use -, _, or . separators");
+var LabelSchema = z.string().trim().min(1).max(120);
+var DescriptionSchema = z.string().trim().min(1).max(2e3);
+var ColorTokenSchema = z.string().trim().min(1).max(50);
+var IconNameSchema = z.string().trim().min(1).max(80);
+var PathSchema = z.string().trim().startsWith("/").max(300);
+var ReferenceIdsSchema = z.array(ModelIdSchema).default([]);
+var DisplayMetadataSchema = z.object({
+  label: LabelSchema,
+  description: DescriptionSchema.optional(),
+  color: ColorTokenSchema.optional(),
+  icon: IconNameSchema.optional()
+});
+var SemanticDomainSchema = DisplayMetadataSchema.extend({
+  id: ModelIdSchema,
+  entityIds: ReferenceIdsSchema,
+  surfaceIds: ReferenceIdsSchema,
+  resourceIds: ReferenceIdsSchema,
+  capabilityIds: ReferenceIdsSchema
+});
+var ResourceMappingSchema = DisplayMetadataSchema.extend({
+  id: ModelIdSchema,
+  resourceId: z.string().trim().min(1).max(255),
+  resourceType: z.enum(["workflow", "agent", "trigger", "integration", "external", "human_checkpoint"]),
+  domainIds: ReferenceIdsSchema,
+  entityIds: ReferenceIdsSchema,
+  surfaceIds: ReferenceIdsSchema,
+  capabilityIds: ReferenceIdsSchema
+});
+
+// src/organization-model/domains/branding.ts
+var OrganizationModelBrandingSchema = z.object({
+  organizationName: LabelSchema,
+  productName: LabelSchema,
+  shortName: z.string().trim().min(1).max(40),
+  description: DescriptionSchema.optional(),
+  logos: z.object({
+    light: z.string().trim().min(1).max(2048).optional(),
+    dark: z.string().trim().min(1).max(2048).optional()
+  }).default({})
+});
+var DEFAULT_ORGANIZATION_MODEL_BRANDING = {
+  organizationName: "Default Organization",
+  productName: "Elevasis",
+  shortName: "Elevasis",
+  logos: {}
+};
+var CrmStageSemanticClassSchema = z.enum(["open", "active", "nurturing", "closed_won", "closed_lost"]);
+var CrmStageSchema = DisplayMetadataSchema.extend({
+  id: ModelIdSchema,
+  order: z.number().int().min(0),
+  semanticClass: CrmStageSemanticClassSchema,
+  surfaceIds: ReferenceIdsSchema,
+  resourceIds: ReferenceIdsSchema
+});
+var CrmPipelineSchema = z.object({
+  id: ModelIdSchema,
+  label: z.string().trim().min(1).max(120),
+  description: DescriptionSchema.optional(),
+  entityId: ModelIdSchema,
+  stages: z.array(CrmStageSchema).min(1)
+});
+var OrganizationModelCrmSchema = z.object({
+  entityId: ModelIdSchema,
+  defaultPipelineId: ModelIdSchema,
+  pipelines: z.array(CrmPipelineSchema).min(1)
+});
+var DEFAULT_ORGANIZATION_MODEL_CRM = {
+  entityId: "crm.deal",
+  defaultPipelineId: "default",
+  pipelines: [
+    {
+      id: "default",
+      label: "Default Pipeline",
+      entityId: "crm.deal",
+      stages: [
+        { id: "interested", label: "Interested", color: "blue", order: 1, semanticClass: "open", surfaceIds: ["crm.pipeline"], resourceIds: [] },
+        { id: "proposal", label: "Proposal", color: "yellow", order: 2, semanticClass: "active", surfaceIds: ["crm.pipeline"], resourceIds: [] },
+        { id: "closing", label: "Closing", color: "lime", order: 3, semanticClass: "active", surfaceIds: ["crm.pipeline"], resourceIds: [] },
+        { id: "closed_won", label: "Closed Won", color: "green", order: 4, semanticClass: "closed_won", surfaceIds: ["crm.pipeline"], resourceIds: [] },
+        { id: "closed_lost", label: "Closed Lost", color: "red", order: 5, semanticClass: "closed_lost", surfaceIds: ["crm.pipeline"], resourceIds: [] },
+        { id: "nurturing", label: "Nurturing", color: "grape", order: 6, semanticClass: "nurturing", surfaceIds: ["crm.pipeline"], resourceIds: [] }
+      ]
+    }
+  ]
+};
+var DeliveryStateSchema = DisplayMetadataSchema.extend({
+  id: ModelIdSchema,
+  order: z.number().int().min(0)
+});
+var OrganizationModelDeliverySchema = z.object({
+  projectEntityId: ModelIdSchema,
+  milestoneEntityId: ModelIdSchema,
+  taskEntityId: ModelIdSchema,
+  projectStatuses: z.array(DeliveryStateSchema).min(1),
+  milestoneStatuses: z.array(DeliveryStateSchema).min(1),
+  taskStatuses: z.array(DeliveryStateSchema).min(1)
+});
+var DEFAULT_ORGANIZATION_MODEL_DELIVERY = {
+  projectEntityId: "delivery.project",
+  milestoneEntityId: "delivery.milestone",
+  taskEntityId: "delivery.task",
+  projectStatuses: [
+    { id: "active", label: "Active", order: 1 },
+    { id: "on_track", label: "On Track", order: 2 },
+    { id: "at_risk", label: "At Risk", order: 3 },
+    { id: "blocked", label: "Blocked", order: 4 },
+    { id: "paused", label: "Paused", order: 5 },
+    { id: "completed", label: "Completed", order: 6 }
+  ],
+  milestoneStatuses: [
+    { id: "upcoming", label: "Upcoming", order: 1 },
+    { id: "in_progress", label: "In Progress", order: 2 },
+    { id: "blocked", label: "Blocked", order: 3 },
+    { id: "overdue", label: "Overdue", order: 4 },
+    { id: "completed", label: "Completed", order: 5 }
+  ],
+  taskStatuses: [
+    { id: "planned", label: "Planned", order: 1 },
+    { id: "in_progress", label: "In Progress", order: 2 },
+    { id: "blocked", label: "Blocked", order: 3 },
+    { id: "submitted", label: "Submitted", order: 4 },
+    { id: "approved", label: "Approved", order: 5 },
+    { id: "revision_requested", label: "Revision Requested", order: 6 },
+    { id: "rejected", label: "Rejected", order: 7 },
+    { id: "cancelled", label: "Cancelled", order: 8 },
+    { id: "completed", label: "Completed", order: 9 }
+  ]
+};
+var FeatureKeySchema = z.enum([
+  "acquisition",
+  "delivery",
+  "operations",
+  "monitoring",
+  "settings",
+  "seo",
+  "calibration"
+]);
+var OrganizationModelFeaturesSchema = z.object({
+  enabled: z.object({
+    acquisition: z.boolean().default(true),
+    delivery: z.boolean().default(true),
+    operations: z.boolean().default(true),
+    monitoring: z.boolean().default(true),
+    settings: z.boolean().default(true),
+    seo: z.boolean().default(false),
+    calibration: z.boolean().default(false)
+  }).default({
+    acquisition: true,
+    delivery: true,
+    operations: true,
+    monitoring: true,
+    settings: true,
+    seo: false,
+    calibration: false
+  }),
+  labels: z.object({
+    acquisition: z.string().trim().min(1).max(80).optional(),
+    delivery: z.string().trim().min(1).max(80).optional(),
+    operations: z.string().trim().min(1).max(80).optional(),
+    monitoring: z.string().trim().min(1).max(80).optional(),
+    settings: z.string().trim().min(1).max(80).optional(),
+    seo: z.string().trim().min(1).max(80).optional(),
+    calibration: z.string().trim().min(1).max(80).optional()
+  }).default({})
+});
+var DEFAULT_ORGANIZATION_MODEL_FEATURES = {
+  enabled: {
+    acquisition: true,
+    delivery: true,
+    operations: true,
+    monitoring: true,
+    settings: true,
+    seo: false,
+    calibration: false
+  },
+  labels: {}
+};
+var LeadGenLifecycleStageSchema = DisplayMetadataSchema.extend({
+  id: ModelIdSchema,
+  order: z.number().int().min(0)
+});
+var OrganizationModelLeadGenSchema = z.object({
+  listEntityId: ModelIdSchema,
+  companyEntityId: ModelIdSchema,
+  contactEntityId: ModelIdSchema,
+  description: DescriptionSchema.optional(),
+  companyStages: z.array(LeadGenLifecycleStageSchema).min(1),
+  contactStages: z.array(LeadGenLifecycleStageSchema).min(1)
+});
+var DEFAULT_ORGANIZATION_MODEL_LEAD_GEN = {
+  listEntityId: "leadgen.list",
+  companyEntityId: "leadgen.company",
+  contactEntityId: "leadgen.contact",
+  companyStages: [
+    { id: "populated", label: "Populated", order: 1 },
+    { id: "extracted", label: "Extracted", order: 2 },
+    { id: "qualified", label: "Qualified", order: 3 }
+  ],
+  contactStages: [
+    { id: "discovered", label: "Discovered", order: 1 },
+    { id: "verified", label: "Verified", order: 2 },
+    { id: "personalized", label: "Personalized", order: 3 },
+    { id: "uploaded", label: "Uploaded", order: 4 }
+  ]
+};
+var SurfaceTypeSchema = z.enum(["page", "dashboard", "graph", "detail", "list", "settings"]);
+var SurfaceDefinitionSchema = z.object({
+  id: ModelIdSchema,
+  label: LabelSchema,
+  path: PathSchema,
+  surfaceType: SurfaceTypeSchema,
+  description: DescriptionSchema.optional(),
+  icon: IconNameSchema.optional(),
+  featureKey: FeatureKeySchema.optional(),
+  domainIds: ReferenceIdsSchema,
+  entityIds: ReferenceIdsSchema,
+  resourceIds: ReferenceIdsSchema,
+  capabilityIds: ReferenceIdsSchema,
+  parentId: ModelIdSchema.optional()
+});
+var NavigationGroupSchema = z.object({
+  id: ModelIdSchema,
+  label: LabelSchema,
+  placement: z.enum(["primary", "secondary", "bottom"]),
+  surfaceIds: z.array(ModelIdSchema).default([])
+});
+var OrganizationModelNavigationSchema = z.object({
+  defaultSurfaceId: ModelIdSchema.optional(),
+  surfaces: z.array(SurfaceDefinitionSchema).default([]),
+  groups: z.array(NavigationGroupSchema).default([])
+});
+var DEFAULT_ORGANIZATION_MODEL_NAVIGATION = {
+  defaultSurfaceId: "crm.pipeline",
+  surfaces: [
+    {
+      id: "crm.pipeline",
+      label: "Pipeline",
+      path: "/crm/pipeline",
+      surfaceType: "graph",
+      featureKey: "acquisition",
+      domainIds: ["crm"],
+      entityIds: ["crm.deal"],
+      resourceIds: [],
+      capabilityIds: ["crm.pipeline.manage"]
+    },
+    {
+      id: "lead-gen.lists",
+      label: "Lists",
+      path: "/lead-gen/lists",
+      surfaceType: "list",
+      featureKey: "acquisition",
+      domainIds: ["lead-gen"],
+      entityIds: ["leadgen.list"],
+      resourceIds: [],
+      capabilityIds: ["leadgen.lists.manage"]
+    },
+    {
+      id: "projects.index",
+      label: "Projects",
+      path: "/projects",
+      surfaceType: "list",
+      featureKey: "delivery",
+      domainIds: ["delivery"],
+      entityIds: ["delivery.project"],
+      resourceIds: [],
+      capabilityIds: ["delivery.projects.view"]
+    },
+    {
+      id: "operations.organization-graph",
+      label: "Organization Graph",
+      path: "/operations/organization-graph",
+      surfaceType: "graph",
+      featureKey: "operations",
+      domainIds: ["operations"],
+      entityIds: [],
+      resourceIds: [],
+      capabilityIds: ["operations.organization-graph"]
+    },
+    {
+      id: "operations.command-view",
+      label: "Command View",
+      path: "/operations/command-view",
+      surfaceType: "graph",
+      featureKey: "operations",
+      domainIds: ["operations"],
+      entityIds: [],
+      resourceIds: [],
+      capabilityIds: ["operations.command-view"]
+    }
+  ],
+  groups: [
+    { id: "primary-workspace", label: "Workspace", placement: "primary", surfaceIds: ["crm.pipeline", "lead-gen.lists", "projects.index"] },
+    {
+      id: "primary-operations",
+      label: "Operations",
+      placement: "primary",
+      surfaceIds: ["operations.organization-graph", "operations.command-view"]
+    }
+  ]
+};
+
+// src/organization-model/schema.ts
+var OrganizationModelSchema = z.object({
+  version: z.literal(1).default(1),
+  domains: z.array(SemanticDomainSchema).default([]),
+  branding: OrganizationModelBrandingSchema,
+  features: OrganizationModelFeaturesSchema,
+  navigation: OrganizationModelNavigationSchema,
+  crm: OrganizationModelCrmSchema,
+  leadGen: OrganizationModelLeadGenSchema,
+  delivery: OrganizationModelDeliverySchema,
+  resourceMappings: z.array(ResourceMappingSchema).default([])
+});
+
+// src/organization-model/defaults.ts
+var DEFAULT_ORGANIZATION_MODEL = {
+  version: 1,
+  domains: [
+    {
+      id: "crm",
+      label: "CRM",
+      description: "Relationship pipeline and deal management",
+      color: "blue",
+      entityIds: ["crm.deal"],
+      surfaceIds: ["crm.pipeline"],
+      resourceIds: [],
+      capabilityIds: ["crm.pipeline.manage"]
+    },
+    {
+      id: "lead-gen",
+      label: "Lead Gen",
+      description: "Prospecting, qualification, and outreach preparation",
+      color: "cyan",
+      entityIds: ["leadgen.list", "leadgen.company", "leadgen.contact"],
+      surfaceIds: ["lead-gen.lists"],
+      resourceIds: [],
+      capabilityIds: ["leadgen.lists.manage"]
+    },
+    {
+      id: "delivery",
+      label: "Delivery",
+      description: "Projects, milestones, and client work execution",
+      color: "orange",
+      entityIds: ["delivery.project", "delivery.milestone", "delivery.task"],
+      surfaceIds: ["projects.index"],
+      resourceIds: [],
+      capabilityIds: ["delivery.projects.view"]
+    },
+    {
+      id: "operations",
+      label: "Operations",
+      description: "Operational resources, topology, and orchestration visibility",
+      color: "violet",
+      entityIds: [],
+      surfaceIds: ["operations.organization-graph", "operations.command-view"],
+      resourceIds: [],
+      capabilityIds: ["operations.organization-graph", "operations.command-view"]
+    }
+  ],
+  branding: DEFAULT_ORGANIZATION_MODEL_BRANDING,
+  features: DEFAULT_ORGANIZATION_MODEL_FEATURES,
+  navigation: DEFAULT_ORGANIZATION_MODEL_NAVIGATION,
+  crm: DEFAULT_ORGANIZATION_MODEL_CRM,
+  leadGen: DEFAULT_ORGANIZATION_MODEL_LEAD_GEN,
+  delivery: DEFAULT_ORGANIZATION_MODEL_DELIVERY,
+  resourceMappings: []
+};
+
+// src/organization-model/resolve.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function deepMerge(base, override) {
+  if (override === void 0) {
+    return base;
+  }
+  if (Array.isArray(base)) {
+    return override ?? base;
+  }
+  if (!isPlainObject(base) || !isPlainObject(override)) {
+    return override ?? base;
+  }
+  const result = { ...base };
+  for (const [key, value] of Object.entries(override)) {
+    if (value === void 0) continue;
+    const existing = result[key];
+    result[key] = isPlainObject(existing) && isPlainObject(value) ? deepMerge(existing, value) : value;
+  }
+  return result;
+}
+function defineOrganizationModel(model) {
+  return model;
+}
+function resolveOrganizationModel(override) {
+  const merged = deepMerge(DEFAULT_ORGANIZATION_MODEL, override);
+  return OrganizationModelSchema.parse(merged);
+}
+
+export { DEFAULT_ORGANIZATION_MODEL, OrganizationModelSchema, defineOrganizationModel, resolveOrganizationModel };

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@elevasis/core",
+  "version": "0.1.0",
+  "license": "MIT",
+  "description": "Minimal shared constants across Elevasis monorepo",
+  "sideEffects": false,
+  "files": [
+    "src",
+    "dist"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./organization-model": {
+      "types": "./dist/organization-model/index.d.ts",
+      "import": "./dist/organization-model/index.js"
+    }
+  },
+  "devDependencies": {
+    "@types/jsonwebtoken": "^9.0.7",
+    "@types/pdfmake": "^0.3.0",
+    "@types/react": "^19.2.2",
+    "rollup": "^4.59.0",
+    "rollup-plugin-dts": "^6.3.0",
+    "tsup": "^8.0.0",
+    "typescript": "5.9.2",
+    "@repo/eslint-config": "0.0.0",
+    "@repo/typescript-config": "0.0.0"
+  },
+  "dependencies": {
+    "@anthropic-ai/sdk": "^0.62.0",
+    "@google/genai": "^1.30.0",
+    "@googleapis/gmail": "^15.0.0",
+    "@googleapis/sheets": "^12.0.0",
+    "@sentry/node": "^8.55.0",
+    "@workos-inc/node": "^7.69.2",
+    "croner": "^10.0.1",
+    "date-fns-tz": "^3.2.0",
+    "google-auth-library": "^10.5.0",
+    "googleapis-common": "^8.0.0",
+    "jsonwebtoken": "^9.0.2",
+    "openai": "^6.0.1",
+    "pdfmake": "^0.2.18",
+    "react": "^19.2.0",
+    "stripe": "^20.2.0",
+    "zod": "^4.1.0"
+  },
+  "scripts": {
+    "build": "tsc --noEmit",
+    "build:publish": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && pnpm exec tsup && pnpm exec rollup -c rollup.dts.config.mjs && node -e \"require('fs').rmSync('dist/_dts',{recursive:true,force:true})\"",
+    "lint": "eslint src --max-warnings 0",
+    "check-types": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest watch",
+    "clean": "rm -rf dist"
+  }
+}

package/src/README.md

@@ -0,0 +1,34 @@
+# @elevasis/core
+
+Published browser-safe shared contracts for the Elevasis platform.
+
+This package is the source of truth for shared types, schemas, and contract helpers that are safe to consume from apps and other packages. In this repo the source package is named `@repo/core`, but these docs describe the published `@elevasis/core` surface.
+
+## Import Rules
+
+- Use `@elevasis/core` for browser-safe shared types and schemas.
+- Use `@elevasis/core/server` only for Node.js-only helpers and services.
+- Use `@elevasis/core/test-utils` for test fixtures and mocks.
+- Prefer the narrowest published subpath that matches the work you are doing.
+
+## Published Surface Groups
+
+- `platform` - shared constants, utilities, registry, SSE, and API types.
+- `auth` - multi-tenancy types for organizations, users, memberships, invitations, and credentials.
+- `execution` - workflow, agent, scheduler, calibration, and execution-interface contracts.
+- `commands` - command queue types and schemas.
+- `deployments` - deployment response types.
+- `operations` - sessions, notifications, observability, activities, triggers, and debug logs.
+- `business` - acquisition and SEO contracts, plus the PDF surface under its own subpaths.
+- `organization-model` - the semantic contract layer for CRM, lead gen, delivery, features, branding, and navigation.
+- `supabase` - generated database types and helpers.
+- `forms` - shared form schemas and form-facing types.
+- `integrations` - OAuth and credential contracts.
+- `projects` - project management request and response schemas.
+- `content` - published content metadata types.
+
+## When To Read Deeper
+
+- For the organization model contract, start with [organization-model/README.md](./organization-model/README.md).
+- For test utilities, read [test-utils/README.md](./test-utils/README.md).
+- For credentials, read [auth/multi-tenancy/credentials/README.md](./auth/multi-tenancy/credentials/README.md) if you are working in source. The runtime helpers are server-only.

package/src/__tests__/observability-exports.test.ts

@@ -0,0 +1,36 @@
+import { describe, it, expect } from 'vitest'
+
+describe('Observability Exports', () => {
+  it('exports error tracking types from main package', async () => {
+    // Test that types can be imported from the main package
+    const {
+      ErrorRecordSchema,
+      ErrorDetailFullSchema,
+      ErrorDistributionSchema,
+      ErrorTrendSchema
+    } = await import('../index')
+
+    expect(ErrorRecordSchema).toBeDefined()
+    expect(ErrorDetailFullSchema).toBeDefined()
+    expect(ErrorDistributionSchema).toBeDefined()
+    expect(ErrorTrendSchema).toBeDefined()
+  })
+
+  it('schemas validate correctly when imported from main package', async () => {
+    const { ErrorRecordSchema } = await import('../index')
+
+    const validRecord = {
+      id: '123e4567-e89b-12d3-a456-426614174000',
+      timestamp: '2024-01-15T10:30:00Z',
+      errorType: 'ValidationError',
+      message: 'Test error',
+      executionId: '223e4567-e89b-12d3-a456-426614174000',
+      resourceId: 'workflow-123',
+      resourceName: 'Test Workflow',
+      severity: 'warning' as const
+    }
+
+    const result = ErrorRecordSchema.safeParse(validRecord)
+    expect(result.success).toBe(true)
+  })
+})

package/src/__tests__/publish.test.ts

@@ -0,0 +1,18 @@
+import { readFileSync } from 'node:fs'
+import path from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+const packageJsonPath = path.resolve(__dirname, '../../package.json')
+const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8')) as {
+  publishConfig?: {
+    name?: string
+    exports?: Record<string, unknown>
+  }
+}
+
+describe('core publish surface', () => {
+  it('publishes the curated @elevasis/core organization-model wrapper', () => {
+    expect(packageJson.publishConfig?.name).toBe('@elevasis/core')
+    expect(Object.keys(packageJson.publishConfig?.exports ?? {})).toEqual(['.', './organization-model'])
+  })
+})

package/src/__tests__/template-foundations-compatibility.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from 'vitest'
+import {
+  getOrganizationSurface,
+  homeLabel,
+  organizationModel as foundationOrganizationModel,
+  quickAccessSurfaceIds
+} from '../../../../external/_template/foundations/config/organization-model'
+import { resolveOrganizationModel } from '../published'
+
+describe('template foundations compatibility', () => {
+  it('adapts the foundations organization model onto the published core contract while preserving UI helpers', () => {
+    const resolved = resolveOrganizationModel(foundationOrganizationModel)
+
+    expect(foundationOrganizationModel.navigation.homeLabel).toBe(homeLabel)
+    expect(foundationOrganizationModel.navigation.quickAccessSurfaceIds).toEqual(quickAccessSurfaceIds)
+    expect(resolved.branding.organizationName).toBe(foundationOrganizationModel.branding.organizationName)
+    expect(resolved.branding.productName).toBe(foundationOrganizationModel.branding.productName)
+    expect(resolved.navigation.defaultSurfaceId).toBe('operations')
+    expect(resolved.navigation.surfaces.map((surface) => surface.id)).toEqual(
+      foundationOrganizationModel.navigation.surfaces.map((surface) => surface.id)
+    )
+    expect(resolved.features.enabled.acquisition).toBe(true)
+    expect(resolved.features.enabled.calibration).toBe(false)
+    expect(getOrganizationSurface('operations')).toMatchObject({
+      id: 'operations',
+      label: 'Operations',
+      path: '/operations',
+      surfaceType: 'graph',
+      featureKey: 'operations'
+    })
+    expect(resolved.crm.pipelines.length).toBeGreaterThan(0)
+    expect(resolved.delivery.projectStatuses.length).toBeGreaterThan(0)
+  })
+})

package/src/auth/index.ts

@@ -0,0 +1,8 @@
+/**
+ * Auth group barrel - browser-safe exports
+ *
+ * Identity and multi-tenancy types
+ */
+
+// Multi-tenancy types (browser-safe only)
+export * from './multi-tenancy/index'

package/src/auth/multi-tenancy/credentials/README.md

@@ -0,0 +1,38 @@
+# Credentials Module
+
+Organization credentials management with AES-256-GCM encryption.
+
+## Import Patterns
+
+### Server/Backend (API)
+```typescript
+// Import server-side functions (uses Node.js crypto and process.env)
+import {
+  prepareCredentialForInsert,
+  decryptCredentialValue,
+  encryptCredential,
+  decryptCredential,
+  type CreateCredentialParams
+} from '@elevasis/core/server'
+```
+
+### Browser/Frontend
+
+Credential encryption helpers are server-only. Browser code should not import this module or its helper types directly.
+
+## Architecture
+
+- **`index.ts`**: Type-only re-exports for internal source usage
+- **`server.ts`**: Server-only exports (encryption functions, service helpers)
+- **`encryption.ts`**: AES-256-GCM encryption/decryption (Node.js only)
+- **`service.ts`**: Helper functions for credential operations (Node.js only)
+
+## Published Surface Note
+
+This directory is source-adjacent. Published app code should import credential helpers from `@elevasis/core/server`, while browser-safe code should treat credentials as an internal server concern.
+
+## Why the Split?
+
+The encryption module uses Node.js `crypto` and `process.env`, which don't exist in the browser.
+By separating server-only exports into `@elevasis/core/server`, we prevent these Node.js dependencies
+from being bundled into the browser application.