@elevasis/sdk 1.50.0 → 1.51.0

package/dist/{chunk-MGZZ4HL4.js → chunk-HIVK54X6.js}

@@ -1,4 +1,4 @@
-import { ProcessingStageStatusSchema, ListBuilderStageKeySchema, zodToJsonSchema, LLMResponseParseError, errorToString, getErrorDetails, ExecutionError2, validateEntryPoint, validateTerminalSteps, validateStepReferences, logWorkflowStart, detectCycle, WorkflowStepError, logStepStart, validateTerminalOutput, logStepSuccess, determineNextStep, logStepFailure, logExecutionPath, logWorkflowSuccess, logWorkflowFailure, estimateTokens, validateTokenConfiguration, truncationCharBudget, buildIterationResponseSchema } from './chunk-YJDXRHNP.js';
+import { ProcessingStageStatusSchema, ListBuilderStageKeySchema, zodToJsonSchema, LLMResponseParseError, errorToString, getErrorDetails, ExecutionError2, validateEntryPoint, validateTerminalSteps, validateStepReferences, logWorkflowStart, detectCycle, WorkflowStepError, logStepStart, validateTerminalOutput, logStepSuccess, determineNextStep, logStepFailure, logExecutionPath, logWorkflowSuccess, logWorkflowFailure, estimateTokens, truncationCharBudget, buildIterationResponseSchema } from './chunk-NNRXVYNC.js';
 import { workerData, parentPort } from 'worker_threads';
 import { z, ZodError } from 'zod';
 import { createHmac } from 'crypto';
@@ -585,7 +585,6 @@ function withSynthesizedMessage(nextActions, message) {
   return [{ type: "message", text }, ...nextActions];
 }
 async function callLLMForAgentIteration(adapter, request) {
-  validateTokenConfiguration(request.model, request.constraints.maxOutputTokens);
   const messages = buildAgentMessages(
     request.systemPrompt,
     request.memory,
@@ -648,7 +647,6 @@ async function callLLMForAgentIteration(adapter, request) {
   }
 }
 async function callLLMForAgentCompletion(adapter, request) {
-  validateTokenConfiguration(request.model, request.constraints.maxOutputTokens);
   const messages = buildAgentMessages(
     request.systemPrompt,
     request.memory,
@@ -2549,7 +2547,7 @@ function handleToolResult(msg) {
     const code = msg.code ?? "unknown_error";
     pending.reject(new PlatformToolError(msg.error, code, RETRYABLE_CODES.has(code)));
   } else {
-    pending.resolve(msg.result);
+    pending.resolve(msg.result, msg.usage);
   }
 }
 function handleCredentialResult(msg) {
@@ -2566,6 +2564,45 @@ function handleCredentialResult(msg) {
     });
   }
 }
+async function sendToolCall(options) {
+  if (!parentPort) {
+    throw new PlatformToolError("platform.call() can only be used inside a worker thread", "service_unavailable", false);
+  }
+  const id = `tc_${++callCounter}_${Date.now()}`;
+  const message = {
+    type: "tool-call",
+    id,
+    tool: options.tool,
+    method: options.method,
+    params: options.params ?? {},
+    credential: options.credential
+  };
+  return new Promise((resolve, reject) => {
+    const timeoutMs = 18e5;
+    const timeoutLabel = "1800s";
+    const timer = setTimeout(() => {
+      pendingCalls.delete(id);
+      reject(
+        new PlatformToolError(
+          `Platform tool call timed out after ${timeoutLabel}: ${options.tool}.${options.method}`,
+          "timeout_error",
+          true
+        )
+      );
+    }, timeoutMs);
+    pendingCalls.set(id, {
+      resolve: (value, usage) => {
+        clearTimeout(timer);
+        resolve({ result: value, usage });
+      },
+      reject: (error) => {
+        clearTimeout(timer);
+        reject(error);
+      }
+    });
+    parentPort.postMessage(message);
+  });
+}
 var platform = {
   /**
    * Call a platform tool from the worker thread.
@@ -2578,47 +2615,24 @@ var platform = {
    * @throws PlatformToolError on failure (with code and retryable fields)
    */
   async call(options) {
-    if (!parentPort) {
-      throw new PlatformToolError(
-        "platform.call() can only be used inside a worker thread",
-        "service_unavailable",
-        false
-      );
-    }
-    const id = `tc_${++callCounter}_${Date.now()}`;
-    const message = {
-      type: "tool-call",
-      id,
-      tool: options.tool,
-      method: options.method,
-      params: options.params ?? {},
-      credential: options.credential
-    };
-    return new Promise((resolve, reject) => {
-      const timeoutMs = 18e5;
-      const timeoutLabel = "1800s";
-      const timer = setTimeout(() => {
-        pendingCalls.delete(id);
-        reject(
-          new PlatformToolError(
-            `Platform tool call timed out after ${timeoutLabel}: ${options.tool}.${options.method}`,
-            "timeout_error",
-            true
-          )
-        );
-      }, timeoutMs);
-      pendingCalls.set(id, {
-        resolve: (value) => {
-          clearTimeout(timer);
-          resolve(value);
-        },
-        reject: (error) => {
-          clearTimeout(timer);
-          reject(error);
-        }
-      });
-      parentPort.postMessage(message);
-    });
+    const { result } = await sendToolCall(options);
+    return result;
+  },
+  /**
+   * Call a platform tool and also surface any `usage` (token/cost) metadata the parent attached
+   * to the response -- e.g. the `llm` tool's real provider usage from the API-side
+   * `dispatchToolCall` in `tool-dispatcher.ts`. Bare `result` is unchanged from `call()`; `usage` is `undefined` whenever the
+   * parent's response didn't carry one, exactly like today's `call()` behavior for that result.
+   *
+   * @param options.tool - Tool name (e.g., 'llm')
+   * @param options.method - Method name (e.g., 'generate')
+   * @param options.params - Method parameters
+   * @param options.credential - Credential name (required for integration tools)
+   * @returns Promise resolving to `{ result, usage }`
+   * @throws PlatformToolError on failure (with code and retryable fields)
+   */
+  async callWithUsage(options) {
+    return sendToolCall(options);
   },
   /**
    * Request raw credential access from the platform.
@@ -2673,7 +2687,7 @@ var PostMessageLLMAdapter = class {
     this.model = model;
   }
   async generate(request) {
-    const result = await platform.call({
+    const { result, usage } = await platform.callWithUsage({
       tool: "llm",
       method: "generate",
       params: {
@@ -2689,7 +2703,17 @@ var PostMessageLLMAdapter = class {
         maxOutputTokens: request.maxOutputTokens
       }
     });
-    return { output: result };
+    return {
+      output: result,
+      ...usage && {
+        usage: {
+          inputTokens: usage.inputTokens,
+          outputTokens: usage.outputTokens,
+          totalTokens: usage.inputTokens + usage.outputTokens
+        }
+      },
+      ...usage?.cost !== void 0 && { cost: usage.cost }
+    };
   }
 };
 function createPostMessageAdapterFactory() {

package/dist/{chunk-YJDXRHNP.js → chunk-NNRXVYNC.js}

@@ -7898,4 +7898,4 @@ function defineWorkflowConfig(resourceId, descriptors, actionRegistry = []) {
 }
 var ListBuilderStageKeySchema = z.string().min(1);
 
-export { ActivityEventSchema, BuildPlanSnapshotStepSchema, ContractRefResolutionError, CrmStageKeySchema, CrmStateKeySchema, EmailSchema, ExecutionError, ExecutionError2, LLMResponseParseError, ListBuilderStageKeySchema, ProcessingStageStatusSchema, ProspectingBuildTemplateSchema, RegistryValidationError, ResourceRegistry, StepType, ToolingError, WorkflowStepError, bindResourceDescriptor, buildIterationResponseSchema, compileBusinessOntologyValidationIndex, concurrentPool, createLeadGenStageValidators, defineContract, defineResource, defineResourceOntology, defineResources, defineStep, defineTopology, defineTopologyRelationship, defineWorkflow, defineWorkflowConfig, deriveActions, detectCycle, determineNextStep, diagnosticOutput, errorToString, estimateTokens, getErrorDetails, integrationInput, isBuiltInReadinessProfile, isZodType, logExecutionPath, logStepFailure, logStepStart, logStepSuccess, logWorkflowFailure, logWorkflowStart, logWorkflowSuccess, lookupReadinessProfile, parseTopologyNodeRef, registerReadinessProfile, resolveContractRef, runDiagnostic, splitName, topologyRef, topologyRelationship, truncationCharBudget, validateDeclaredSystemInterfaceReadiness, validateDeploymentSpec, validateEntryPoint, validateRelationships, validateResourceGovernance, validateStepReferences, validateTerminalOutput, validateTerminalSteps, validateTokenConfiguration, zodToJsonSchema };
+export { ActivityEventSchema, BuildPlanSnapshotStepSchema, ContractRefResolutionError, CrmStageKeySchema, CrmStateKeySchema, EmailSchema, ExecutionError, ExecutionError2, LLMResponseParseError, ListBuilderStageKeySchema, ProcessingStageStatusSchema, ProspectingBuildTemplateSchema, RegistryValidationError, ResourceRegistry, StepType, ToolingError, WorkflowStepError, bindResourceDescriptor, buildIterationResponseSchema, compileBusinessOntologyValidationIndex, concurrentPool, createLeadGenStageValidators, defineContract, defineResource, defineResourceOntology, defineResources, defineStep, defineTopology, defineTopologyRelationship, defineWorkflow, defineWorkflowConfig, deriveActions, detectCycle, determineNextStep, diagnosticOutput, errorToString, estimateTokens, getErrorDetails, integrationInput, isBuiltInReadinessProfile, isZodType, logExecutionPath, logStepFailure, logStepStart, logStepSuccess, logWorkflowFailure, logWorkflowStart, logWorkflowSuccess, lookupReadinessProfile, parseTopologyNodeRef, registerReadinessProfile, resolveContractRef, runDiagnostic, splitName, topologyRef, topologyRelationship, truncationCharBudget, validateDeclaredSystemInterfaceReadiness, validateDeploymentSpec, validateEntryPoint, validateRelationships, validateResourceGovernance, validateStepReferences, validateTerminalOutput, validateTerminalSteps, zodToJsonSchema };

package/dist/cli.cjs

@@ -49298,7 +49298,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@elevasis/sdk",
-      version: "1.50.0",
+      version: "1.51.0",
       description: "SDK for building Elevasis organization resources",
       type: "module",
       bin: {
@@ -52022,9 +52022,10 @@ Credentials (${data.credentials.length}):
 // src/cli/commands/creds/creds-create.ts
 init_source();
 init_ora();
+init_src();
 init_api_client();
 var CREDENTIAL_NAME_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-var VALID_TYPES = ["api-key", "webhook-secret"];
+var VALID_TYPES = CredentialTypeSchema.options.filter((type) => type !== "oauth");
 async function createCreds(apiUrl, name, type, valueJson) {
   if (!name || name.length < 1 || name.length > 100) {
     throw new Error("Credential name must be 1-100 characters");
@@ -52044,6 +52045,8 @@ Note: OAuth credentials must be created through the Command Center UI`
   if (!valueJson) {
     throw new Error(
       `Credential value is required. Provide it with --value '{"apiKey":"sk-..."}'
+For a secret you do not want in shell history, write it to a file and pass
+--value @json:tmp/credential.json instead.
 Value must be a valid JSON object.`
     );
   }
@@ -52063,11 +52066,7 @@ Example: --value '{"apiKey":"sk-abc123"}'`
     throw new Error("Credential value must not be empty");
   }
   const spinner = ora("Creating credential...").start();
-  const result = await apiPost(
-    "/api/external/credentials",
-    { name, type, value },
-    apiUrl
-  );
+  const result = await apiPost("/api/external/credentials", { name, type, value }, apiUrl);
   spinner.stop();
   console.log(source_default.green(`
 Credential created successfully!`));
@@ -52101,10 +52100,8 @@ Example: --value '{"apiKey":"sk-new-key"}'`
   const credential = data.credentials.find((c) => c.name === name);
   if (!credential) {
     spinner.stop();
-    throw new Error(
-      `Credential '${name}' not found.
-Run "elevasis-sdk creds list" to see available credentials.`
-    );
+    throw new Error(`Credential '${name}' not found.
+Run "elevasis-sdk creds list" to see available credentials.`);
   }
   await apiPatch(`/api/external/credentials/${credential.id}`, { value }, apiUrl);
   spinner.stop();
@@ -52199,21 +52196,31 @@ Credential '${name}' deleted successfully.`));
 // src/cli/commands/creds/creds.ts
 function registerCredsCommand(program3) {
   const creds = program3.command("creds").description("Manage organization credentials");
-  creds.command("list").description("List all credentials (metadata only, no secrets)").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API URL").option("--json", "Output as JSON").action(wrapAction("creds list", async (options) => {
-    await listCreds(resolveApiUrl(options.apiUrl, options.prod), options.json);
-  }));
-  creds.command("create").description("Create a new credential").requiredOption("--name <name>", "Credential name (lowercase, digits, hyphens)").requiredOption("--type <type>", "Credential type (api-key, webhook-secret)").option("--value <json>", "Credential value as JSON string").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API URL").action(wrapAction("creds create", async (options) => {
-    await createCreds(resolveApiUrl(options.apiUrl, options.prod), options.name, options.type, options.value);
-  }));
-  creds.command("update <name>").description("Update a credential value").requiredOption("--value <json>", "New credential value as JSON string").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API URL").action(wrapAction("creds update", async (name, options) => {
-    await updateCreds(resolveApiUrl(options.apiUrl, options.prod), name, options.value);
-  }));
-  creds.command("rename <name>").description("Rename a credential").requiredOption("--to <newName>", "New credential name").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API URL").action(wrapAction("creds rename", async (name, options) => {
-    await renameCreds(resolveApiUrl(options.apiUrl, options.prod), name, options.to);
-  }));
-  creds.command("delete <name>").description("Delete a credential").option("--force", "Skip confirmation prompt").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API URL").action(wrapAction("creds delete", async (name, options) => {
-    await deleteCreds(resolveApiUrl(options.apiUrl, options.prod), name, options.force);
-  }));
+  creds.command("list").description("List all credentials (metadata only, no secrets)").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API URL").option("--json", "Output as JSON").action(
+    wrapAction("creds list", async (options) => {
+      await listCreds(resolveApiUrl(options.apiUrl, options.prod), options.json);
+    })
+  );
+  creds.command("create").description("Create a new credential").requiredOption("--name <name>", "Credential name (lowercase, digits, hyphens)").requiredOption("--type <type>", "Credential type (api-key, webhook-secret, api-key-secret, clickup, instagram)").option("--value <json>", "Credential value as JSON string (or @json:<path> to read it from a file)").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API URL").action(
+    wrapAction("creds create", async (options) => {
+      await createCreds(resolveApiUrl(options.apiUrl, options.prod), options.name, options.type, options.value);
+    })
+  );
+  creds.command("update <name>").description("Update a credential value").requiredOption("--value <json>", "New credential value as JSON string (or @json:<path> to read it from a file)").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API URL").action(
+    wrapAction("creds update", async (name, options) => {
+      await updateCreds(resolveApiUrl(options.apiUrl, options.prod), name, options.value);
+    })
+  );
+  creds.command("rename <name>").description("Rename a credential").requiredOption("--to <newName>", "New credential name").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API URL").action(
+    wrapAction("creds rename", async (name, options) => {
+      await renameCreds(resolveApiUrl(options.apiUrl, options.prod), name, options.to);
+    })
+  );
+  creds.command("delete <name>").description("Delete a credential").option("--force", "Skip confirmation prompt").option("--prod", "Target production (overrides NODE_ENV=development)").option("--api-url <url>", "API URL").action(
+    wrapAction("creds delete", async (name, options) => {
+      await deleteCreds(resolveApiUrl(options.apiUrl, options.prod), name, options.force);
+    })
+  );
 }
 
 // src/cli/commands/error/error.ts

package/dist/index.js

@@ -1,2 +1,2 @@
-export { ActivityEventSchema, BuildPlanSnapshotStepSchema, ProspectingBuildTemplateSchema as BuildTemplateSchema, ContractRefResolutionError, CrmStageKeySchema, CrmStateKeySchema, EmailSchema, ExecutionError, ListBuilderStageKeySchema, ProcessingStageStatusSchema, RegistryValidationError, ResourceRegistry, StepType, ToolingError, bindResourceDescriptor, compileBusinessOntologyValidationIndex, concurrentPool, createLeadGenStageValidators, defineContract, defineResource, defineResourceOntology, defineResources, defineStep, defineTopology, defineTopologyRelationship, defineWorkflow, defineWorkflowConfig, deriveActions, diagnosticOutput, integrationInput, isBuiltInReadinessProfile, isZodType, lookupReadinessProfile, parseTopologyNodeRef, registerReadinessProfile, resolveContractRef, runDiagnostic, splitName, topologyRef, topologyRelationship, validateDeclaredSystemInterfaceReadiness, validateResourceGovernance } from './chunk-YJDXRHNP.js';
+export { ActivityEventSchema, BuildPlanSnapshotStepSchema, ProspectingBuildTemplateSchema as BuildTemplateSchema, ContractRefResolutionError, CrmStageKeySchema, CrmStateKeySchema, EmailSchema, ExecutionError, ListBuilderStageKeySchema, ProcessingStageStatusSchema, RegistryValidationError, ResourceRegistry, StepType, ToolingError, bindResourceDescriptor, compileBusinessOntologyValidationIndex, concurrentPool, createLeadGenStageValidators, defineContract, defineResource, defineResourceOntology, defineResources, defineStep, defineTopology, defineTopologyRelationship, defineWorkflow, defineWorkflowConfig, deriveActions, diagnosticOutput, integrationInput, isBuiltInReadinessProfile, isZodType, lookupReadinessProfile, parseTopologyNodeRef, registerReadinessProfile, resolveContractRef, runDiagnostic, splitName, topologyRef, topologyRelationship, validateDeclaredSystemInterfaceReadiness, validateResourceGovernance } from './chunk-NNRXVYNC.js';
 export { projectDeploymentSpec, projectTopologyRelationships, toSdkResourceDescriptor, withPlatformAgentResourceDescriptor, withPlatformAgentResourceDescriptors, withPlatformIntegrationResourceDescriptor, withPlatformIntegrationResourceDescriptors, withPlatformResourceDescriptor, withPlatformResourceDescriptors } from './chunk-VYWGWJRW.js';

package/dist/test-utils/index.js

@@ -1,5 +1,5 @@
-import { executeWorkflow } from '../chunk-MGZZ4HL4.js';
-import { validateDeploymentSpec, validateRelationships } from '../chunk-YJDXRHNP.js';
+import { executeWorkflow } from '../chunk-HIVK54X6.js';
+import { validateDeploymentSpec, validateRelationships } from '../chunk-NNRXVYNC.js';
 import '../chunk-VYWGWJRW.js';
 import { vi } from 'vitest';
 

package/dist/worker/index.d.ts

@@ -1,6 +1,20 @@
 import { AttioToolMap, ApifyToolMap, ClickUpToolMap, DropboxToolMap, GmailToolMap, GoogleSheetsToolMap, InstagramToolMap, InstantlyToolMap, MillionVerifierToolMap, AnymailfinderToolMap, TombaToolMap, ResendToolMap, SignatureApiToolMap, StripeToolMap, SchedulerToolMap, LLMGenerateRequest, LLMModel, LLMGenerateResponse, StorageToolMap, NotificationSDKInput, NotificationToolMap, LeadToolMap, ProjectsToolMap, CrmToolMap, ListToolMap, ArtifactsToolMap, ContentToolMap, PdfToolMap, ApprovalToolMap, ExecutionToolMap, EmailToolMap, WorkflowDefinition, WorkflowConfig, ListBuilderStep, LeadGenStageValidators, ResourceStatus, DeploymentSpec } from '@elevasis/sdk';
 import { z } from 'zod';
 
+/**
+ * Platform Tool Proxy (Worker Side)
+ *
+ * Provides platform.call() for external developers to invoke platform tools
+ * from within worker threads. Communicates with the parent process via
+ * postMessage() -- the parent dispatches to the real service layer.
+ */
+/** Token usage metadata returned for tool calls with cost accounting. */
+interface TokenUsage {
+    inputTokens: number;
+    outputTokens: number;
+    cost?: number;
+    model?: string;
+}
 /** Resolved credential returned by platform.getCredential() */
 interface PlatformCredential {
     provider: string;
@@ -34,6 +48,28 @@ declare const platform: {
         params?: unknown;
         credential?: string;
     }): Promise<unknown>;
+    /**
+     * Call a platform tool and also surface any `usage` (token/cost) metadata the parent attached
+     * to the response -- e.g. the `llm` tool's real provider usage from the API-side
+     * `dispatchToolCall` in `tool-dispatcher.ts`. Bare `result` is unchanged from `call()`; `usage` is `undefined` whenever the
+     * parent's response didn't carry one, exactly like today's `call()` behavior for that result.
+     *
+     * @param options.tool - Tool name (e.g., 'llm')
+     * @param options.method - Method name (e.g., 'generate')
+     * @param options.params - Method parameters
+     * @param options.credential - Credential name (required for integration tools)
+     * @returns Promise resolving to `{ result, usage }`
+     * @throws PlatformToolError on failure (with code and retryable fields)
+     */
+    callWithUsage(options: {
+        tool: string;
+        method: string;
+        params?: unknown;
+        credential?: string;
+    }): Promise<{
+        result: unknown;
+        usage?: TokenUsage;
+    }>;
     /**
      * Request raw credential access from the platform.
      *

package/dist/worker/index.js

@@ -1,3 +1,3 @@
-export { ListBuilderResultSchema, ListBuilderResultsSchema, PlatformToolError, acqDb, approval, artifacts, classifyPlatformToolError, content, createAdapter, createAnymailfinderAdapter, createApifyAdapter, createAttioAdapter, createCaptionGenerationWorkflow, createCaptureInstagramMetricsWorkflow, createClickUpAdapter, createDropboxAdapter, createGmailAdapter, createGoogleSheetsAdapter, createImageAnalysisWorkflow, createInstagramAdapter, createInstantlyAdapter, createMillionVerifierAdapter, createPublishInstagramWorkflow, createResendAdapter, createSignatureApiAdapter, createStripeAdapter, createTombaAdapter, crm, email, executeWorkflow, execution, generateHmacToken, list, listBuilderWorkflow, llm, notifications, pdf, platform, projects, scheduler, startWorker, storage, toContentMetrics } from '../chunk-MGZZ4HL4.js';
-import '../chunk-YJDXRHNP.js';
+export { ListBuilderResultSchema, ListBuilderResultsSchema, PlatformToolError, acqDb, approval, artifacts, classifyPlatformToolError, content, createAdapter, createAnymailfinderAdapter, createApifyAdapter, createAttioAdapter, createCaptionGenerationWorkflow, createCaptureInstagramMetricsWorkflow, createClickUpAdapter, createDropboxAdapter, createGmailAdapter, createGoogleSheetsAdapter, createImageAnalysisWorkflow, createInstagramAdapter, createInstantlyAdapter, createMillionVerifierAdapter, createPublishInstagramWorkflow, createResendAdapter, createSignatureApiAdapter, createStripeAdapter, createTombaAdapter, crm, email, executeWorkflow, execution, generateHmacToken, list, listBuilderWorkflow, llm, notifications, pdf, platform, projects, scheduler, startWorker, storage, toContentMetrics } from '../chunk-HIVK54X6.js';
+import '../chunk-NNRXVYNC.js';
 import '../chunk-VYWGWJRW.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elevasis/sdk",
-  "version": "1.50.0",
+  "version": "1.51.0",
   "description": "SDK for building Elevasis organization resources",
   "type": "module",
   "bin": {
@@ -63,7 +63,7 @@
     "typescript": "5.9.2",
     "vitest": "^3.2.4",
     "zod": "^4.1.0",
-    "@repo/core": "0.65.0",
+    "@repo/core": "0.67.0",
     "@repo/eslint-config": "0.0.0",
     "@repo/typescript-config": "0.0.0"
   },

package/reference/packages/core/src/organization-model/readiness/README.md

@@ -31,10 +31,29 @@ import {
   type ReadinessProfileValidator,
   type ReadinessOntologyIndex,
   type ReadinessInterfaceMarkerResolver,
-  type SystemInterfaceMarker
+  type SystemInterfaceMarker,
+  // What to do about a failure, shared by the API's 503 message and the UI alert
+  resolveReadinessRemedy,
+  describeReadinessFailure,
+  isResolutionIssue,
+  REDEPLOY_REMEDY,
+  RESOLUTION_ISSUE_CODES,
+  type ResolutionIssueCode
 } from '@elevasis/core/organization-model/readiness'
 ```
 
+## Remedies live here, not at each consumer
+
+`remedies.ts` maps a readiness issue to the one sentence telling an operator what to do about it,
+keyed exhaustively over the family union so a new family cannot be added without deciding its answer.
+Both consumers read it: `createInterfaceReadinessApiError` builds the 503's message from
+`describeReadinessFailure`, and `@repo/ui`'s `SystemReadinessAlert` renders `resolveReadinessRemedy`.
+
+It keys on the issue's `code` before its `family` because the two can disagree.
+`MODEL_PARSE_FAILED` arrives under `SYSTEM_INTERFACE_INVALID`, whose family-level answer is "fix your
+declaration" — and the declaration is fine; the stored snapshot is what could not be read. Keying on
+family alone is exactly the bug this module was extracted to prevent.
+
 This subpath exists so the extension point can be reached without pulling in the rest of `@elevasis/core`. It points at the same module workspace consumers import, deliberately — the two surfaces cannot drift apart.
 
 ## Layering constraint

package/reference/sdk/cli.mdx

@@ -520,7 +520,7 @@ Manage credentials for your organization. Credentials store API keys and secrets
 
 ```
 elevasis-sdk creds list
-elevasis-sdk creds create --name <name> --type <type> [--value <json>]
+elevasis-sdk creds create --name <name> --type <type> --value <json>
 elevasis-sdk creds update <name> --value <json>
 elevasis-sdk creds rename <name> --to <newName>
 elevasis-sdk creds delete <name> [--force]
@@ -539,20 +539,33 @@ elevasis-sdk creds delete <name> [--force]
 | Flag              | Description                                                                     |
 | ----------------- | ------------------------------------------------------------------------------- |
 | `--name <name>`   | Credential name: lowercase letters, digits, and hyphens only (create: required) |
-| `--type <type>`   | Credential type: `api-key` or `webhook-secret` (create: required)               |
+| `--type <type>`   | Credential type (create: required). See the table below                         |
 | `--value <json>`  | Credential value as a JSON string (create and update: required)                 |
 | `--to <newName>`  | New name (rename: required)                                                     |
 | `--force`         | Skip confirmation prompt (delete)                                               |
 | `--prod`          | Target production (overrides `NODE_ENV=development`)                            |
 | `--api-url <url>` | Override the API base URL                                                       |
 
-OAuth credentials cannot be created through the CLI -- they require the Command Center's browser OAuth flow. See [Command Center](deployment/command-center.mdx#credentials).
+**Keep long-lived secrets out of `--value`.** A value passed literally survives in shell history and in the transcript of whatever ran the command. Write the JSON to a file and pass `--value @json:tmp/credential.json` instead -- the `@json:` prefix works on any flag of any `elevasis-sdk` command, resolves relative paths against the project root, and expands inside the CLI process, so the secret never appears in the invocation. Delete the file afterwards.
+
+**Credential types.** The accepted values are the platform's own `CredentialTypeSchema`, minus `oauth`:
+
+| Type             | Shape                                              |
+| ---------------- | -------------------------------------------------- |
+| `api-key`        | Single-field API key                               |
+| `api-key-secret` | Key and secret pair                                |
+| `webhook-secret` | Webhook signing secret                             |
+| `clickup`        | ClickUp personal token                             |
+| `instagram`      | `{ accessToken, igUserId }` for Content Publishing |
+
+OAuth credentials cannot be created through the CLI -- they need a `provider`, which the external create route does not accept, and they require the Command Center's browser OAuth flow. See [Command Center](deployment/command-center.mdx#credentials).
 
 **Examples:**
 
 ```bash
 elevasis-sdk creds list
 elevasis-sdk creds create --name openai-key --type api-key --value '{"key":"sk-proj-***"}'
+elevasis-sdk creds create --name my-instagram --type instagram --value @json:tmp/ig.json --prod
 elevasis-sdk creds update openai-key --value '{"key":"sk-proj-new"}'
 elevasis-sdk creds rename openai-key --to openai-prod-key
 elevasis-sdk creds delete openai-prod-key --force