@elevasis/sdk 1.48.0 → 1.49.0

package/dist/worker/index.js

@@ -2749,6 +2749,12 @@ function buildReasoningRequest(iterationContext) {
     capabilities
   };
 }
+
+// ../core/src/execution/engine/llm/types.ts
+function extractMessageText(content2) {
+  if (typeof content2 === "string") return content2;
+  return content2.filter((part) => part.type === "text").map((part) => part.text).join("\n");
+}
 var ToolCallActionSchema = z.object({
   type: z.literal("tool-call"),
   id: z.string().optional(),
@@ -2818,6 +2824,19 @@ var GPT5ConfigSchema = z.object({
   topP: z.number().min(0).max(1).optional(),
   modelOptions: GPT5OptionsSchema.optional()
 });
+var GPT56OptionsSchema = z.object({
+  reasoning_effort: z.enum(["none", "low", "medium", "high", "xhigh", "max"]).optional(),
+  verbosity: z.enum(["low", "medium", "high"]).optional()
+});
+var GPT56ConfigSchema = z.object({
+  model: z.enum(["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"]),
+  provider: z.enum(["openai"]),
+  apiKey: z.string(),
+  temperature: z.literal(1).optional(),
+  maxOutputTokens: z.number().min(4e3).optional(),
+  topP: z.number().min(0).max(1).optional(),
+  modelOptions: GPT56OptionsSchema.optional()
+});
 var MockConfigSchema = z.object({
   model: z.enum(["mock"]),
   provider: z.enum(["mock"]),
@@ -2870,9 +2889,12 @@ var AnthropicConfigSchema = z.discriminatedUnion("model", [
   AnthropicClaude5ConfigSchema,
   AnthropicStandardConfigSchema
 ]);
+var GPT56_CACHE_READ_RATE_MULTIPLIER = 0.1;
+var CACHE_CREATION_RATE_MULTIPLIER = 1.25;
 var MODEL_INFO = {
   // OpenAI GPT-5 (Reasoning Models)
   "gpt-5": {
+    provider: "openai",
     inputCostPer1M: 125,
     // $1.25 per 1M tokens
     outputCostPer1M: 1e3,
@@ -2886,6 +2908,7 @@ var MODEL_INFO = {
     configSchema: GPT5ConfigSchema
   },
   "gpt-5.4-mini": {
+    provider: "openai",
     inputCostPer1M: 75,
     // $0.75 per 1M tokens
     outputCostPer1M: 450,
@@ -2899,6 +2922,7 @@ var MODEL_INFO = {
     configSchema: GPT5ConfigSchema
   },
   "gpt-5.4-nano": {
+    provider: "openai",
     inputCostPer1M: 20,
     // $0.20 per 1M tokens
     outputCostPer1M: 125,
@@ -2910,8 +2934,60 @@ var MODEL_INFO = {
     category: "standard",
     configSchema: GPT5ConfigSchema
   },
+  // OpenAI GPT-5.6 family (GA 2026-07-09). All three tiers share 1.05M context, 128K max output,
+  // image input, tool use, structured outputs, and prompt caching -- they differ in reasoning depth
+  // and price, not capability. The bare `gpt-5.6` alias is deliberately unregistered; see OpenAIModel.
+  "gpt-5.6-sol": {
+    provider: "openai",
+    inputCostPer1M: 500,
+    // $5.00 per 1M tokens
+    outputCostPer1M: 3e3,
+    // $30.00 per 1M tokens
+    minTokens: 4e3,
+    recommendedTokens: 8e3,
+    maxTokens: 105e4,
+    // 1.05M context window
+    maxOutputTokens: 128e3,
+    category: "reasoning",
+    configSchema: GPT56ConfigSchema,
+    cacheReadRateMultiplier: GPT56_CACHE_READ_RATE_MULTIPLIER,
+    cacheCreationRateMultiplier: CACHE_CREATION_RATE_MULTIPLIER
+  },
+  "gpt-5.6-terra": {
+    provider: "openai",
+    inputCostPer1M: 250,
+    // $2.50 per 1M tokens
+    outputCostPer1M: 1500,
+    // $15.00 per 1M tokens
+    minTokens: 4e3,
+    recommendedTokens: 8e3,
+    maxTokens: 105e4,
+    // 1.05M context window
+    maxOutputTokens: 128e3,
+    category: "standard",
+    configSchema: GPT56ConfigSchema,
+    cacheReadRateMultiplier: GPT56_CACHE_READ_RATE_MULTIPLIER,
+    cacheCreationRateMultiplier: CACHE_CREATION_RATE_MULTIPLIER
+  },
+  "gpt-5.6-luna": {
+    provider: "openai",
+    inputCostPer1M: 100,
+    // $1.00 per 1M tokens
+    outputCostPer1M: 600,
+    // $6.00 per 1M tokens
+    minTokens: 4e3,
+    recommendedTokens: 8e3,
+    maxTokens: 105e4,
+    // 1.05M context window
+    maxOutputTokens: 128e3,
+    category: "standard",
+    configSchema: GPT56ConfigSchema,
+    cacheReadRateMultiplier: GPT56_CACHE_READ_RATE_MULTIPLIER,
+    cacheCreationRateMultiplier: CACHE_CREATION_RATE_MULTIPLIER
+  },
   // Mock model for testing
   mock: {
+    provider: "mock",
     inputCostPer1M: 0,
     // Free for tests
     outputCostPer1M: 0,
@@ -2925,6 +3001,7 @@ var MODEL_INFO = {
   },
   // OpenRouter Models (via openrouter.ai)
   "openrouter/z-ai/glm-5": {
+    provider: "openrouter",
     inputCostPer1M: 72,
     // $0.72 per 1M tokens
     outputCostPer1M: 230,
@@ -2938,6 +3015,7 @@ var MODEL_INFO = {
   },
   // Anthropic Claude Models (direct SDK access via @anthropic-ai/sdk)
   "claude-opus-5": {
+    provider: "anthropic",
     inputCostPer1M: 500,
     // $5.00 per 1M tokens
     outputCostPer1M: 2500,
@@ -2951,6 +3029,7 @@ var MODEL_INFO = {
     configSchema: AnthropicConfigSchema
   },
   "claude-sonnet-5": {
+    provider: "anthropic",
     // List pricing. An introductory rate of $2.00/$10.00 runs through 2026-08-31; encoding the
     // temporary rate would make historical cost analytics wrong once it lapses.
     inputCostPer1M: 300,
@@ -2966,6 +3045,7 @@ var MODEL_INFO = {
     configSchema: AnthropicConfigSchema
   },
   "claude-haiku-4-5-20251001": {
+    provider: "anthropic",
     inputCostPer1M: 100,
     // $1.00 per 1M tokens
     outputCostPer1M: 500,
@@ -2979,6 +3059,7 @@ var MODEL_INFO = {
     configSchema: AnthropicConfigSchema
   },
   "claude-haiku-4-5": {
+    provider: "anthropic",
     inputCostPer1M: 100,
     // $1.00 per 1M tokens
     outputCostPer1M: 500,
@@ -2998,7 +3079,7 @@ function getModelInfo(model) {
     return MODEL_INFO[model];
   }
   for (const knownModel of MODEL_KEYS_BY_SPECIFICITY) {
-    if (model.startsWith(knownModel)) {
+    if (model.startsWith(`${knownModel}-`)) {
       return MODEL_INFO[knownModel];
     }
   }
@@ -3349,7 +3430,9 @@ async function callLLMForAgentIteration(adapter, request) {
     message: request.capabilities.message,
     memoryOps: request.capabilities.memoryOps,
     historyTurns: request.conversationHistory?.length ?? 0,
-    messages: messages.map((m) => ({ role: m.role, ...preview(m.content) }))
+    // `preview` reads text; `extractMessageText` is the identity function for the plain-string case
+    // this always was, and drops image parts (nothing to preview) rather than stringify them.
+    messages: messages.map((m) => ({ role: m.role, ...preview(extractMessageText(m.content)) }))
   });
   let acceptedOutput;
   const response = await adapter.generate({
@@ -3372,7 +3455,10 @@ async function callLLMForAgentIteration(adapter, request) {
       // Same text the real request was billed for -- `estimateTokens`'s bias is a property of the
       // heuristic itself, not of which text it measures, so this is what calibrates the correction
       // `MemoryManager` applies to its own (much smaller) slice of the same request.
-      estimatedRequestTokens: estimateTokens(messages.map((m) => m.content).join(""))
+      // Same text-only reasoning as the `preview` call above -- an image part contributes no text
+      // tokens to this estimate (the real request's image token cost is a separate, provider-billed
+      // line item this heuristic was never calibrated against).
+      estimatedRequestTokens: estimateTokens(messages.map((m) => extractMessageText(m.content)).join(""))
     };
   } catch (error) {
     flowLog("agent.iteration.validationFailed", {
@@ -3410,7 +3496,7 @@ async function callLLMForAgentCompletion(adapter, request) {
   return {
     output: response.output,
     usage: response.usage,
-    estimatedRequestTokens: estimateTokens(messages.map((m) => m.content).join(""))
+    estimatedRequestTokens: estimateTokens(messages.map((m) => extractMessageText(m.content)).join(""))
   };
 }
 
@@ -6537,10 +6623,17 @@ function createClickUpAdapter(credential) {
 // src/worker/adapters/dropbox.ts
 var METHODS4 = [
   "uploadFile",
-  "createFolder"
+  "createFolder",
+  "listFolder",
+  "getMetadata",
+  "getTemporaryLink",
+  "createSharedLink",
+  "download",
+  "getThumbnail",
+  "getThumbnailBatch"
 ];
 function createDropboxAdapter(credential) {
-  return createAdapter("dropbox", METHODS4, credential);
+  return createAdapter("dropbox", [...METHODS4], credential);
 }
 
 // src/worker/adapters/gmail.ts
@@ -6826,6 +6919,10 @@ var METHODS14 = [
   "getItem",
   "listItems",
   "updateItem",
+  "addItemSourceAsset",
+  "removeItemSourceAsset",
+  "reorderItemSourceAssets",
+  "updateItemSourceAsset",
   "createAttempt",
   "listAttempts",
   "updateAttempt",
@@ -6833,6 +6930,8 @@ var METHODS14 = [
   "getSourceAsset",
   "listSourceAssets",
   "updateSourceAsset",
+  "getDistribution",
+  "listDistributions",
   "createDistribution",
   "updateDistribution"
 ];
@@ -7241,6 +7340,16 @@ function startWorker(org) {
           // real tier rather than silently passing on an absent one.
           systemPrompt: a.config.systemPrompt,
           securityLevel: a.config.securityLevel,
+          // Wave 2b / Decision 2: redacted model config (no `apiKey`) so the platform can re-run
+          // `validateAgentGrammar` and the token-floor check against what the org actually deployed
+          // instead of only ever seeing the platform's own placeholder stub config. `apiKey` is
+          // deliberately excluded -- this manifest crosses into apps/api's process and is logged.
+          modelConfig: a.modelConfig ? {
+            model: a.modelConfig.model,
+            provider: a.modelConfig.provider,
+            temperature: a.modelConfig.temperature,
+            maxOutputTokens: a.modelConfig.maxOutputTokens
+          } : void 0,
           status: a.config.status,
           description: a.config.description,
           version: a.config.version,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elevasis/sdk",
-  "version": "1.48.0",
+  "version": "1.49.0",
   "description": "SDK for building Elevasis organization resources",
   "type": "module",
   "bin": {
@@ -55,9 +55,9 @@
     "tsup": "^8.0.0",
     "typescript": "5.9.2",
     "zod": "^4.1.0",
-    "@repo/core": "0.63.0",
-    "@repo/typescript-config": "0.0.0",
-    "@repo/eslint-config": "0.0.0"
+    "@repo/core": "0.64.0",
+    "@repo/eslint-config": "0.0.0",
+    "@repo/typescript-config": "0.0.0"
   },
   "scripts": {
     "lint": "eslint src --max-warnings 0",

package/reference/_navigation.md

@@ -162,7 +162,7 @@ Package entries indexed: 64.
 | --- | --- | --- | --- |
 | Theme | `packages/ui/src/theme/README.md` | Published theme entry for downstream applications. | (not specified) |
 | Graph | `packages/ui/src/graph/README.md` | Published graph helper and visualization entry. | (not specified) |
-| Theme Presets | `packages/ui/src/theme/presets/README.md` | Re-exports the canonical THEME_PRESETS tuple, ThemePresetName union, and ThemePresetEnum Zod enum from @repo/core. Single source of truth for preset names across UI, schemas, and Zustand state. | (not specified) |
+| Theme Presets | `packages/ui/src/theme/presets/README.md` | Published THEME_PRESETS tuple, ThemePresetName union, and ThemePresetEnum Zod enum, defined locally and kept manually aligned with the canonical list in packages/core/src/auth/multi-tenancy/theme-presets.ts. | (not specified) |
 | Knowledge | `packages/ui/src/knowledge/README.md` | Published knowledge browser primitives: Browser, Tree, NodeList, NodeView, SearchBar, MDX provider, and the generated KNOWLEDGE_BODIES map. | (not specified) |
 
 ---
@@ -281,7 +281,7 @@ Docs-site pages indexed: 38.
 
 | Page | Location | Description |
 | --- | --- | --- |
-| CLI Management Commands | `sdk/cli-management.mdx` | elevasis-sdk management commands -- project, note, acquisition, client, agent, session, queue, schedule, om, ui, skill, and content subcommand families |
+| CLI Management Commands | `sdk/cli-management.mdx` | elevasis-sdk management commands -- project, note, acquisition, client, agent, session, queue, schedule, om, ui, skill, content, and grant subcommand families |
 | CLI Reference | `sdk/cli.mdx` | Core elevasis-sdk CLI commands -- validate, deploy, execute, inspect resources, manage credentials, rename, and enumerate the command catalog |
 | Concepts Reference | `sdk/concepts.mdx` | Plain-English explanations of Elevasis SDK concepts -- glossary, workflow analogies, Zod schemas, execution model, platform tools, and design decisions |
 | When to Reach for the define* Builders | `sdk/define-builders.mdx` | defineWorkflow, defineStep, defineContract, defineResource, and defineTopology exist for two different reasons -- this page teaches which reason applies before you pick a builder over a plain object literal. |
@@ -295,7 +295,7 @@ Docs-site pages indexed: 38.
 | Tutorial System | `sdk/framework/tutorial-system.mdx` | The /tutorial skill in the external project scaffold -- two-track onboarding (vibe-coder and technical), gate question, track persistence, and escape hatch |
 | Getting Started | `sdk/getting-started.mdx` | Set up your Elevasis SDK project and run your first deployment |
 | Human-in-the-Loop (HITL) Workflows | `sdk/human-in-the-loop.mdx` | How a workflow step opens an approval task, how it reaches the command queue, and how selecting an action resumes work -- the story that connects the approval adapter, checkpoint metadata, and the queue CLI. |
-| Elevasis SDK | `sdk/index.mdx` | Build and deploy workflows, agents, and resources with the Elevasis SDK |
+| @elevasis/sdk | `sdk/index.mdx` | Build and deploy workflows, agents, and resources with the Elevasis SDK |
 | Integration Adapters | `sdk/platform-tools/adapters-integration.mdx` | Auto-generated table of all 13 integration (credential-bound) adapters exported from @elevasis/sdk/worker, derived from static analysis of the adapter source files. |
 | Platform Adapters | `sdk/platform-tools/adapters-platform.mdx` | Auto-generated table of all 14 platform (singleton, no credential) adapters exported from @elevasis/sdk/worker, derived from static analysis of the adapter source files. |
 | Platform Tools | `sdk/platform-tools/index.mdx` | Access 25 adapters (13 integration + 12 platform) from your SDK workflows -- typed adapters, credential security model, and working code examples |
@@ -309,7 +309,7 @@ Docs-site pages indexed: 38.
 | Template: Email Sender | `sdk/templates/email-sender.mdx` | Transactional email via Resend with template support -- send styled emails to one or multiple recipients |
 | Templates | `sdk/templates/index.mdx` | Ready-to-use workflow templates for common automation patterns -- web scraping, data enrichment, email sending, lead scoring, PDF generation, text classification, and recurring jobs |
 | Template: Lead Scorer | `sdk/templates/lead-scorer.mdx` | LLM-based lead scoring with Supabase storage -- receive a lead, score it with an LLM, store the result |
-| Template: PDF Generator | `sdk/templates/pdf-generator.mdx` | PDF generation from structured data with platform storage upload -- render a PDF from a template and upload to platform storage |
+| Template: PDF Generator | `sdk/templates/pdf-generator.mdx` | PDF generation from structured data with platform storage upload -- render a PDF from typed content blocks and upload to platform storage |
 | Template: Recurring Job | `sdk/templates/recurring-job.mdx` | Scheduler-triggered periodic workflow -- run a task on a schedule (daily, weekly, hourly, or custom cron) |
 | Template: Text Classifier | `sdk/templates/text-classifier.mdx` | Multi-label text classification with structured output -- classify text into predefined categories using an LLM with JSON output |
 | Template: Web Scraper | `sdk/templates/web-scraper.mdx` | Apify-based web scraper that stores results in Supabase -- fetch structured data from any website via Apify actors |

package/reference/_reference-manifest.json

@@ -875,7 +875,7 @@
       "subpath": "./theme/presets",
       "kind": "subpath",
       "title": "Theme Presets",
-      "description": "Re-exports the canonical THEME_PRESETS tuple, ThemePresetName union, and ThemePresetEnum Zod enum from @repo/core. Single source of truth for preset names across UI, schemas, and Zustand state.",
+      "description": "Published THEME_PRESETS tuple, ThemePresetName union, and ThemePresetEnum Zod enum, defined locally and kept manually aligned with the canonical list in packages/core/src/auth/multi-tenancy/theme-presets.ts.",
       "group": "Visual",
       "order": 2,
       "sourcePath": "packages/ui/src/theme/presets/index.ts",

package/reference/core/index.mdx

@@ -15,11 +15,13 @@ The default export and most subpaths are browser-safe. No Node.js-specific runti
 
 ## Published Subpaths
 
-`@elevasis/core` ships six published subpaths:
+`@elevasis/core` ships eight published subpaths:
 
 - **`.`** (default) -- base schemas, shared utilities, and the root contract surface. Browser-safe.
 - **`./auth`** -- auth contract types: session shapes, membership, role definitions, and WorkOS integration contracts.
 - **`./organization-model`** -- the organization model (OM) schema: system definitions, resource metadata, and the org-model graph types used by the platform's AI routing layer.
+- **`./organization-model/readiness`** -- readiness profiles and the system-interface readiness contract used to gate a System's API surface.
+- **`./content`** -- content pipeline schemas: items, distributions, pipeline step contracts, and review-gate types.
 - **`./entities`** -- entity schemas: typed definitions for leads, clients, deals, contacts, and other CRM-adjacent records.
 - **`./knowledge`** -- knowledge graph schemas: document types, embedding metadata, and retrieval contract types.
 - **`./test-utils`** -- Zod-based test fixtures and factory helpers. Not for production use.
@@ -36,7 +38,7 @@ import { parsePath, bySystem } from "@elevasis/core/knowledge";
 
 The default export and all named subpaths above are browser-safe -- they contain only Zod schemas, TypeScript types, and pure utility functions. There are no Node.js-specific APIs, filesystem access, or server-side dependencies in the published surface.
 
-The broader workspace `exports` (~40 paths in `packages/core`) are internal to the monorepo and not part of the published surface. Only the six subpaths listed above are available to tenant projects.
+The broader workspace `exports` (~40 paths in `packages/core`) are internal to the monorepo and not part of the published surface. Only the eight subpaths listed above are available to tenant projects.
 
 ## When To Use @elevasis/core Directly
 
@@ -53,6 +55,6 @@ Most tenant projects install `@elevasis/sdk`, which includes `@elevasis/core` as
 
 For advanced use cases -- writing custom validators, extending the org model, or building a server that enforces the same contracts the platform uses -- import from `@elevasis/core` subpaths directly rather than going through the SDK layer.
 
-## Export Catalog
+## Documentation
 
-See [Export Catalog](exports.mdx) for a generated table of all published subpath exports derived from the reference manifest.
+- [Export Catalog](exports.mdx) - Generated table of all published subpath exports derived from the reference manifest

package/reference/index.mdx

@@ -31,9 +31,9 @@ You do not need all three packages. A pure automation project needs only `@eleva
 
 ## Packages
 
-### @elevasis/sdk (v1.45.0)
+### @elevasis/sdk (v1.48.0)
 
-The primary developer package. Provides the TypeScript API for defining workflows and agents, the `elevasis-sdk` CLI for validation and deployment, and typed worker adapters for 25 platform and integration tools.
+The primary developer package. Provides the TypeScript API for defining workflows and agents, the `elevasis-sdk` CLI for validation and deployment, and typed worker adapters for 27 platform and integration tools.
 
 **Install:** `pnpm add @elevasis/sdk`
 
@@ -41,17 +41,17 @@ The primary developer package. Provides the TypeScript API for defining workflow
 
 See [@elevasis/sdk](sdk/index.mdx) for the full group overview, getting started guide, CLI reference, adapter catalog, and more.
 
-### @elevasis/core (v0.60.0)
+### @elevasis/core (v0.63.0)
 
 The shared contract layer. Exports Zod schemas and TypeScript types that are shared between the SDK, the UI, and the platform API. Useful when you need the typed contracts (organization model, entities, knowledge, auth) in a package that does not pull in the full SDK runtime.
 
 **Install:** `pnpm add @elevasis/core`
 
-**Published subpaths:** `.` (default), `./auth`, `./test-utils`, `./organization-model`, `./entities`, `./knowledge`
+**Published subpaths:** `.` (default), `./auth`, `./test-utils`, `./organization-model`, `./organization-model/readiness`, `./content`, `./entities`, `./knowledge`
 
 See [@elevasis/core](core/index.mdx) for subpath details, browser/server split, and when to use it.
 
-### @elevasis/ui (v2.68.0)
+### @elevasis/ui (v2.72.0)
 
 The shared React feature-shell. Provides `ElevasisCoreProvider` / `ElevasisSystemsProvider` and manifest-backed feature modules that a host UI embeds. Many peer dependencies are optional -- pull only what the features you use require.
 
@@ -61,6 +61,12 @@ The shared React feature-shell. Provides `ElevasisCoreProvider` / `ElevasisSyste
 
 See [@elevasis/ui](ui/index.mdx) for the provider model, feature modules, peer dependency details, and when to use it.
 
+## Documentation
+
+- [@elevasis/sdk](sdk/index.mdx) - Runtime, resource definitions, CLI, worker adapters, deployment, and framework
+- [@elevasis/core](core/index.mdx) - Shared Zod schemas, organization model, knowledge graph, and auth contracts
+- [@elevasis/ui](ui/index.mdx) - React feature-shell, provider model, and manifest-backed feature modules
+
 ## Authoring Note
 
 These pages have a dual surface. At SDK build time, `packages/sdk/scripts/copy-reference-docs.mjs` copies every `apps/docs/content/docs/sdk/**.mdx` into `packages/sdk/reference/`, which ships inside the npm package (`files: ["reference/"]`). The `external/_template/CLAUDE.md` points tenant-project agents at `operations/node_modules/@elevasis/sdk/reference/` as their primary reference bundle. Drift in these docs does not just affect the public site -- it actively misleads every agent building a tenant project.

package/reference/packages/core/src/README.md

@@ -1,44 +1,46 @@
-# @elevasis/core
-
-Published browser-safe shared contracts for the Elevasis platform.
-
-This package is the source of truth for shared types, schemas, and contract helpers that are safe to consume from apps and other packages. In this repo the source package is named `@repo/core`, but these docs describe the published `@elevasis/core` surface.
-
-## Import Rules
-
-- Use `@elevasis/core` (root export) for browser-safe shared types and schemas.
-- Use `@elevasis/core/organization-model` for the semantic contract layer.
-- Use `@elevasis/core/entities` for the published base entity contracts.
-- Use `@elevasis/core/test-utils` for shared test fixtures, mocks, and test helpers.
-- Paths like `@elevasis/core/server` and `@elevasis/core/platform` are internal monorepo paths (`@repo/core/...`) and are NOT available to external consumers.
-
-## Published Surface Groups
-
-The published `@elevasis/core` npm package exposes these subpaths:
-
-- `.` (`@elevasis/core`) - browser-safe shared types, schemas, and constants.
-- `./organization-model` (`@elevasis/core/organization-model`) - the semantic contract layer for CRM, lead gen, delivery, features, branding, and navigation.
-- `./entities` (`@elevasis/core/entities`) - published base entity contracts generic over project metadata extensions.
-- `./test-utils` (`@elevasis/core/test-utils`) - test fixtures, mocks, and helpers for downstream automated tests.
-
-Within the monorepo, the internal `@repo/core` package exposes additional subpaths for use by `apps/` and other packages:
-
-- `@repo/core/server` - Node.js-only helpers and services.
-- `@repo/core/platform` - shared constants, utilities, registry, SSE, and API types.
-- `@repo/core/auth` - multi-tenancy types for organizations, users, memberships, invitations, and credentials.
-- `@repo/core/execution` - workflow, agent, scheduler, and execution-interface contracts.
-- `@repo/core/commands` - command queue types and schemas.
-- `@repo/core/operations` - sessions, notifications, observability, activities, triggers, and debug logs.
-- `@repo/core/supabase` - generated database types and helpers.
-- `@repo/core/integrations/...` - OAuth and credential contracts.
-- `@repo/core/projects/api-schemas` - project management request and response schemas.
-- `@repo/core/content` - published content metadata types.
-- `@repo/core/test-utils` - source of the published test fixtures and mocks surface.
-
-Other `@repo/core/*` subpaths remain monorepo-only unless they are explicitly listed above in the published `@elevasis/core` surface.
-
-## When To Read Deeper
-
-- For the organization model contract, start with [organization-model/README.md](./organization-model/README.md).
-- For test utilities, read [test-utils/README.md](./test-utils/README.md).
-- For credentials, read [auth/multi-tenancy/credentials/README.md](./auth/multi-tenancy/credentials/README.md) if you are working in source. The runtime helpers are server-only.
+# @elevasis/core
+
+Published browser-safe shared contracts for the Elevasis platform.
+
+This package is the source of truth for shared types, schemas, and contract helpers that are safe to consume from apps and other packages. In this repo the source package is named `@repo/core`, but these docs describe the published `@elevasis/core` surface.
+
+## Import Rules
+
+- Use `@elevasis/core` (root export) for browser-safe shared types and schemas.
+- Use `@elevasis/core/organization-model` for the semantic contract layer, and `@elevasis/core/organization-model/readiness` for readiness profile and contract types.
+- Use `@elevasis/core/auth` for multi-tenancy types, `@elevasis/core/content` for content metadata types, and `@elevasis/core/entities` for the published base entity contracts.
+- Use `@elevasis/core/knowledge` for the published knowledge contracts.
+- Use `@elevasis/core/test-utils` for shared test fixtures, mocks, and test helpers.
+- Paths like `@elevasis/core/server`, `@elevasis/core/platform`, and `@elevasis/core/supabase` are internal monorepo paths (`@repo/core/...`) and are NOT available to external consumers.
+
+## Published Surface Groups
+
+The published `@elevasis/core` npm package exposes these subpaths (the authoritative list is `publishConfig.exports` in `packages/core/package.json`):
+
+- `.` (`@elevasis/core`) - browser-safe shared types, schemas, and constants.
+- `./auth` (`@elevasis/core/auth`) - multi-tenancy types for organizations, users, memberships, invitations, and credentials.
+- `./content` (`@elevasis/core/content`) - published content metadata types.
+- `./entities` (`@elevasis/core/entities`) - published base entity contracts generic over project metadata extensions.
+- `./knowledge` (`@elevasis/core/knowledge`) - published knowledge graph contracts.
+- `./organization-model` (`@elevasis/core/organization-model`) - the semantic contract layer for CRM, lead gen, delivery, features, branding, and navigation.
+- `./organization-model/readiness` (`@elevasis/core/organization-model/readiness`) - readiness profile and contract types for the organization model.
+- `./test-utils` (`@elevasis/core/test-utils`) - test fixtures, mocks, and helpers for downstream automated tests.
+
+Within the monorepo, the internal `@repo/core` package exposes additional subpaths that are NOT published, for use by `apps/` and other packages:
+
+- `@repo/core/server` - Node.js-only helpers and services.
+- `@repo/core/platform` - shared constants, utilities, registry, SSE, and API types.
+- `@repo/core/execution` - workflow, agent, scheduler, and execution-interface contracts.
+- `@repo/core/commands` - command queue types and schemas.
+- `@repo/core/operations` - sessions, notifications, observability, activities, triggers, and debug logs.
+- `@repo/core/supabase` - generated database types and helpers.
+- `@repo/core/integrations/...` - OAuth and credential contracts.
+- `@repo/core/projects/api-schemas` - project management request and response schemas.
+
+Other `@repo/core/*` subpaths remain monorepo-only unless they are explicitly listed above in the published `@elevasis/core` surface.
+
+## When To Read Deeper
+
+- For the organization model contract, start with [organization-model/README.md](./organization-model/README.md).
+- For test utilities, read [test-utils/README.md](./test-utils/README.md).
+- For credentials, read [auth/multi-tenancy/credentials/README.md](./auth/multi-tenancy/credentials/README.md) if you are working in source. The runtime helpers are server-only.

package/reference/packages/core/src/content/README.md

@@ -6,18 +6,19 @@ The helpers live here rather than in `@repo/ui` because they have three consumer
 
 ## Surface
 
-| Export                                                                                                                                         | Purpose                                                                                                                                                                                         |
-| ---------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `ContentItemResponseSchema`, `CreateContentItemRequestSchema`, `UpdateContentItemRequestSchema`                                                | `content_items` transport shape. `processingState` is intentionally absent from create/update — factory-write-only.                                                                             |
-| `ContentProcessingStateSchema`                                                                                                                 | `{ stepKey: { status, data? } }`, keyed by `ContentStepKeySchema` — a content-specific key, not lead-gen's `LeadGenStageKeySchema`.                                                             |
-| `ContentPayloadEnvelopeSchema`                                                                                                                 | The producer's immutable emission stored in `payload`. Never edited — `body` is the human's canonical text.                                                                                     |
-| `ReviewContentItemRequestSchema`                                                                                                               | Approve, or reject with a required `rejectReason`. Writes `reviewed_at` / `reviewed_by`.                                                                                                        |
-| `ContentItemAttemptResponseSchema`, `CreateContentItemAttemptRequestSchema`                                                                    | `content_item_attempts` transport shape. No `attemptNumber` field on create — the API service assigns it inside the write. `stepKey` is producer-supplied and nullable.                         |
-| `ContentDistributionResponseSchema`, `CreateContentDistributionRequestSchema`, `UpdateContentDistributionRequestSchema`                        | `content_distributions` transport shape, including the manual-publish fields (`publishMethod`, `platformPostId`, `platformUrl`).                                                                |
-| `PlatformContent`, `YouTubeContent`, `LinkedInContent`, `InstagramContent`, `XContent`, `AnyPlatformContent`, `PlatformContentMap`, `Platform` | Typed interfaces for platform-specific content stored in `content_distributions.platform_content`.                                                                                              |
-| `isOpenContentReviewGate`, `getOpenContentReviewGates`                                                                                         | The one predicate deciding whether a `processing_state` entry is an open, unreviewed `queued` gate. Consumed by the `/queue` handler, `reviewItem`'s `stepKey` validation, and the review page. |
-| `deriveContentBoard`, `ContentBoard`, `ContentBoardCard`, `ContentBoardColumn`, `ContentBoardGate`                                             | Placement: `(items, pipeline, now)` to columns, gates, waiting counts, plus the `done` and `unplaced` buckets. Pure. Consumed by the Command Center board and `elevasis-sdk content:board`.     |
-| `getContentItemIdentity`                                                                                                                       | Names an item for display when `title` cannot — first non-blank line of `body`, then the first string payload field, then `title`, then `'Untitled'`.                                           |
+| Export                                                                                                                                                                                            | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `ContentItemResponseSchema`, `CreateContentItemRequestSchema`, `UpdateContentItemRequestSchema`                                                                                                   | `content_items` transport shape. `processingState` is intentionally absent from create/update — factory-write-only.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `ContentProcessingStateSchema`                                                                                                                                                                    | `{ stepKey: { status, data? } }`, keyed by `ContentStepKeySchema` — a content-specific key, not lead-gen's `LeadGenStageKeySchema`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `ContentPayloadEnvelopeSchema`                                                                                                                                                                    | The producer's immutable emission stored in `payload`. Never edited — `body` is the human's canonical text.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `ReviewContentItemRequestSchema`                                                                                                                                                                  | Approve, or reject with a required `rejectReason`. Writes `reviewed_at` / `reviewed_by`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `ContentItemAttemptResponseSchema`, `CreateContentItemAttemptRequestSchema`                                                                                                                       | `content_item_attempts` transport shape. No `attemptNumber` field on create — the API service assigns it inside the write. `stepKey` is producer-supplied and nullable.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `ContentDistributionResponseSchema`, `CreateContentDistributionRequestSchema`, `UpdateContentDistributionRequestSchema`                                                                           | `content_distributions` transport shape, including the manual-publish fields (`publishMethod`, `platformPostId`, `platformUrl`).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `ContentItemSourceAssetResponseSchema`, `ContentItemSourceAssetInputSchema`, `UpdateContentItemSourceAssetRequestSchema`, `ReorderContentItemSourceAssetsRequestSchema`, `ContentAssetCropSchema` | `content_item_source_assets` transport shape — an item's ordered source assets, `position` 0 is the cover. `crop` is per-MEMBERSHIP normalized fractions, because the same photo crops differently in different items. The initial set rides `CreateContentItemRequestSchema.sourceAssets`; every later mutation is its own method, and `UpdateContentItemRequestSchema` deliberately never touches membership. `derivativePath` / `derivativeCrop` / `derivativeRenderedAt` carry the rendered crop: a stored JPEG in the `content-derivatives` bucket, so the cropped image exists as a file rather than only as CSS. Stale is derived — the two crops differ — never stored as a flag. |
+| `PlatformContent`, `YouTubeContent`, `LinkedInContent`, `InstagramContent`, `XContent`, `AnyPlatformContent`, `PlatformContentMap`, `Platform`                                                    | Typed interfaces for platform-specific content stored in `content_distributions.platform_content`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `isOpenContentReviewGate`, `getOpenContentReviewGates`                                                                                                                                            | The one predicate deciding whether a `processing_state` entry is an open, unreviewed `queued` gate. Consumed by the `/queue` handler, `reviewItem`'s `stepKey` validation, and the review page.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `deriveContentBoard`, `ContentBoard`, `ContentBoardCard`, `ContentBoardColumn`, `ContentBoardGate`                                                                                                | Placement: `(items, pipeline, now)` to columns, gates, waiting counts, plus the `done` and `unplaced` buckets. Pure. Consumed by the Command Center board and `elevasis-sdk content:board`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `getContentItemIdentity`                                                                                                                                                                          | Names an item for display when `title` cannot — first non-blank line of `body`, then the first string payload field, then `title`, then `'Untitled'`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 
 ## Step catalog reconciliation
 

package/reference/rules/ui.md

@@ -295,7 +295,7 @@ For CRM deal action buttons, read `operations/node_modules/@elevasis/sdk/referen
 
 ## Topbar Actions
 
-`navigation.topbar` is the organization-model region for topbar action items. Topbar actions are a **distinct node type**, not navigation surfaces: they trigger behavior (open a modal, open docs) rather than route somewhere, so they have no `path` and no nesting, and the `surfaceType` enum (`page | dashboard | list | detail | graph | settings`) does not apply to them. Like sidebar surfaces, they are toggled and reordered through `/org-os manage`.
+`navigation.topbar` is the organization-model region for topbar action items. Topbar actions are a **distinct node type**, not navigation surfaces: they trigger behavior (open a modal, open docs) rather than route somewhere, so they have no `path` and no nesting, and the `surfaceType` enum (`page | dashboard | list | detail | graph | settings`) does not apply to them. Like sidebar surfaces, they are toggled and reordered by editing the navigation config below -- topbar actions carry an `enabled` flag, and ordering follows authored order.
 
 Author them in `core/config/organization-model/navigation.ts`, keyed by action id:
 

package/reference/rules/vibe-intents.md

@@ -33,7 +33,7 @@ The user wants to record something new -- a task, a note, a piece of information
 | "Track this conversation as a deal note"            | Explicit "track" with a described artifact   |
 | "Note for myself: the client prefers morning calls" | "Note for myself" = personal note to persist |
 
-**Agent action:** draft the capture in plain language, confirm with the user, then execute via `elevasis-sdk project:*` commands for project records, `elevasis-sdk note:create` for personal user notes (the Command Center right panel), or `elevasis-sdk schedule:create` for recurring automation. Disambiguate note scope: a note tied to a deal/task/project is `project:note:create` (a `project:*` record); a standalone personal note is `note:create`. Use repetition vocabulary ("every", "daily", "weekly", "monthly") for schedules; one-shot future reminders stay project tasks with due dates. Never write without confirmation.
+**Agent action:** draft the capture in plain language, confirm with the user, then execute via `elevasis-sdk project:*` commands for project records, `elevasis-sdk note:create` for personal user notes (the Command Center right panel), `elevasis-sdk schedule:create` for recurring automation, or `elevasis-sdk content:source-asset:create` for a new content source asset (a reusable input the content pipeline draws from -- a brand doc, a reference file, raw material). Disambiguate note scope: a note tied to a deal/task/project is `project:note:create` (a `project:*` record); a standalone personal note is `note:create`. Use repetition vocabulary ("every", "daily", "weekly", "monthly") for schedules; one-shot future reminders stay project tasks with due dates. Never write without confirmation.
 
 ### 2. Query
 
@@ -51,7 +51,7 @@ The user wants to know something about current state -- task priorities, what is
 | "What systems are enabled for this project?" | Static-model query about Systems config              |
 | "What's waiting on review?"                  | Runtime-entity query about content review-gate state |
 
-**Agent action:** read the relevant source and narrate the answer in plain language. Use org model or `project:*` for project state, `elevasis-sdk queue:list --status pending --pretty` and `queue:status --pretty` for HITL queue state, `elevasis-sdk schedule:list --status active --pretty` for upcoming recurring automation, and `elevasis-sdk content:queue --pretty` (open review gates), `content:list --pretty` (item overview), `content:board <pipelineId> --pretty` (pipeline state), or `content:get <itemId> --pretty` (one item's attempt/distribution history) for the content platform. No writes.
+**Agent action:** read the relevant source and narrate the answer in plain language. Use org model or `project:*` for project state, `elevasis-sdk queue:list --status pending --pretty` and `queue:status --pretty` for HITL queue state, `elevasis-sdk schedule:list --status active --pretty` for upcoming recurring automation, and for the content platform: `elevasis-sdk content:queue --pretty` (open review gates), `content:list --pretty` (item overview), `content:board <pipelineId> --pretty` (pipeline state), `content:get <itemId> --pretty` (one item's attempt/distribution history), `content:source-assets --pretty` (list available source assets), or `content:source-asset <id> --pretty` (one source asset's detail). No writes.
 
 ### 3. Describe