@elevasis/sdk 0.4.0 → 0.4.1

package/dist/cli.cjs

@@ -39750,11 +39750,12 @@ var ResourceRegistry = class {
    */
   serializedCache;
   /**
-   * Runtime-registered organizations (external deployments)
-   * Tracks which orgs were added at runtime vs. static startup.
-   * Used to guard against unregistering static orgs and to store remote config.
+   * Per-resource remote configuration (external deployments)
+   * Key: "orgName/resourceId", Value: RemoteOrgConfig for that resource.
+   * Tracks which individual resources were added at runtime via deploy pipeline.
+   * Static and remote resources coexist in the same org.
    */
-  runtimeOrgs = /* @__PURE__ */ new Map();
+  remoteResources = /* @__PURE__ */ new Map();
   /**
    * Validates registry on construction
    * - Checks for duplicate resourceIds within organizations
@@ -39857,67 +39858,125 @@ var ResourceRegistry = class {
   // Runtime Organization Registration (External Deployments)
   // ============================================================================
   /**
-   * Register an external organization at runtime
+   * Register external resources at runtime
    *
    * Called during deploy pipeline when an external developer deploys their bundle.
-   * Adds the org's stub definitions to the registry and stores remote config
-   * for worker thread execution branching.
+   * Merges the incoming stub definitions into the org's registry and stores
+   * per-resource remote config for worker thread execution branching.
    *
-   * - If orgName conflicts with a static (startup) org, throws an error
-   * - If orgName is already runtime-registered (redeploy), unregisters first
+   * Static and remote resources coexist in the same org. If the org already
+   * has static resources, the incoming remote resources are merged alongside them.
+   * If redeploying (some resources already registered as remote for this org),
+   * the previous remote resources are unregistered first.
    *
    * @param orgName - Organization name (used as registry key)
    * @param org - Stub resource definitions (workflows/agents with placeholder handlers)
    * @param remote - Remote configuration (bundle path, deployment ID, env vars)
-   * @throws Error if orgName conflicts with a static organization
+   * @throws Error if incoming resourceId conflicts with a static resource
+   * @throws Error if incoming deployment contains duplicate resourceIds
    */
   registerOrganization(orgName, org, remote) {
-    if (this.registry[orgName] && !this.runtimeOrgs.has(orgName)) {
-      throw new Error(`Organization '${orgName}' conflicts with a static organization`);
+    const incomingWorkflowIds = (org.workflows ?? []).map((w) => w.config.resourceId);
+    const incomingAgentIds = (org.agents ?? []).map((a) => a.config.resourceId);
+    const incomingIds = [...incomingWorkflowIds, ...incomingAgentIds];
+    const seen = /* @__PURE__ */ new Set();
+    for (const id of incomingIds) {
+      if (seen.has(id)) {
+        throw new Error(
+          `Duplicate resource ID '${id}' in deployment. Each resource must have a unique ID.`
+        );
+      }
+      seen.add(id);
     }
-    if (this.runtimeOrgs.has(orgName)) {
+    if (this.isRemote(orgName)) {
       this.unregisterOrganization(orgName);
     }
-    this.registry[orgName] = org;
-    this.runtimeOrgs.set(orgName, remote);
-    this.serializedCache.set(orgName, serializeOrganization(org));
+    const existingOrg = this.registry[orgName];
+    if (existingOrg) {
+      const staticWorkflowIds = new Set((existingOrg.workflows ?? []).map((w) => w.config.resourceId));
+      const staticAgentIds = new Set((existingOrg.agents ?? []).map((a) => a.config.resourceId));
+      for (const id of incomingIds) {
+        if (staticWorkflowIds.has(id) || staticAgentIds.has(id)) {
+          throw new Error(
+            `Resource '${id}' already exists in '${orgName}' as an internal resource. External deployments cannot override internal resources.`
+          );
+        }
+      }
+    }
+    if (existingOrg) {
+      existingOrg.workflows = [...existingOrg.workflows ?? [], ...org.workflows ?? []];
+      existingOrg.agents = [...existingOrg.agents ?? [], ...org.agents ?? []];
+    } else {
+      this.registry[orgName] = org;
+    }
+    for (const id of incomingIds) {
+      this.remoteResources.set(`${orgName}/${id}`, remote);
+    }
+    this.serializedCache.set(orgName, serializeOrganization(this.registry[orgName]));
   }
   /**
-   * Unregister a runtime-registered organization
+   * Unregister runtime-registered resources for an organization
    *
-   * Only removes organizations that were registered at runtime (via registerOrganization).
-   * Static organizations loaded at startup are protected and cannot be unregistered.
-   * No-op if the org is not runtime-registered.
+   * Removes only resources that were registered at runtime (via registerOrganization).
+   * Static resources loaded at startup are preserved. If the org still has static
+   * resources after removal, the serialization cache is rebuilt. If no resources
+   * remain, the org is fully removed from the registry.
+   * No-op if the org has no remote resources.
    *
-   * @param orgName - Organization name to unregister
+   * @param orgName - Organization name to unregister remote resources from
    */
   unregisterOrganization(orgName) {
-    if (!this.runtimeOrgs.has(orgName)) return;
-    delete this.registry[orgName];
-    this.runtimeOrgs.delete(orgName);
-    this.serializedCache.delete(orgName);
+    const prefix = `${orgName}/`;
+    const remoteIds = /* @__PURE__ */ new Set();
+    for (const key of this.remoteResources.keys()) {
+      if (key.startsWith(prefix)) {
+        remoteIds.add(key.slice(prefix.length));
+        this.remoteResources.delete(key);
+      }
+    }
+    if (remoteIds.size === 0) return;
+    const orgResources = this.registry[orgName];
+    if (!orgResources) return;
+    orgResources.workflows = (orgResources.workflows ?? []).filter(
+      (w) => !remoteIds.has(w.config.resourceId)
+    );
+    orgResources.agents = (orgResources.agents ?? []).filter(
+      (a) => !remoteIds.has(a.config.resourceId)
+    );
+    const remaining = (orgResources.workflows?.length ?? 0) + (orgResources.agents?.length ?? 0) + (orgResources.triggers?.length ?? 0) + (orgResources.integrations?.length ?? 0) + (orgResources.externalResources?.length ?? 0) + (orgResources.humanCheckpoints?.length ?? 0);
+    if (remaining > 0) {
+      this.serializedCache.set(orgName, serializeOrganization(orgResources));
+    } else {
+      delete this.registry[orgName];
+      this.serializedCache.delete(orgName);
+    }
   }
   /**
-   * Get remote configuration for an organization
+   * Get remote configuration for a specific resource
    *
-   * Returns the RemoteOrgConfig if the org was registered at runtime,
-   * or null if it's a static org or doesn't exist.
+   * Returns the RemoteOrgConfig if the resource was registered at runtime,
+   * or null if it's a static resource or doesn't exist.
    * Used by the execution coordinator to branch between local and worker execution.
    *
    * @param orgName - Organization name
+   * @param resourceId - Resource ID
    * @returns Remote config or null
    */
-  getRemoteConfig(orgName) {
-    return this.runtimeOrgs.get(orgName) ?? null;
+  getRemoteConfig(orgName, resourceId) {
+    return this.remoteResources.get(`${orgName}/${resourceId}`) ?? null;
   }
   /**
-   * Check if an organization is a remote (externally deployed) organization
+   * Check if an organization has any remote (externally deployed) resources
    *
    * @param orgName - Organization name
-   * @returns true if the org was registered at runtime
+   * @returns true if the org has at least one runtime-registered resource
    */
   isRemote(orgName) {
-    return this.runtimeOrgs.has(orgName);
+    const prefix = `${orgName}/`;
+    for (const key of this.remoteResources.keys()) {
+      if (key.startsWith(prefix)) return true;
+    }
+    return false;
   }
   // ============================================================================
   // Resource Manifest Accessors
@@ -40116,20 +40175,11 @@ function wrapAction(commandName, fn) {
 // src/cli/commands/check.ts
 var import_meta = {};
 function registerCheckCommand(program3) {
-  program3.command("check").description("Validate project resources against the ResourceRegistry\n  Example: elevasis check --config ./elevasis.config.ts --entry ./src/index.ts").option("--config <path>", "Path to elevasis.config.ts (default: ./elevasis.config.ts)").option("--entry <path>", "Path to entry file (default: ./src/index.ts)").action(wrapAction("check", async (options) => {
-    const configPath = options.config ?? "./elevasis.config.ts";
+  program3.command("check").description("Validate project resources against the ResourceRegistry\n  Example: elevasis check --entry ./src/index.ts").option("--entry <path>", "Path to entry file (default: ./src/index.ts)").action(wrapAction("check", async (options) => {
     const entryPath = options.entry ?? "./src/index.ts";
     const spinner = ora("Validating resources...").start();
     try {
       const jiti = (0, import_jiti.createJiti)(import_meta.url);
-      const configModule = await jiti.import((0, import_path.resolve)(configPath));
-      const config3 = configModule.default;
-      if (!config3?.organization) {
-        spinner.fail('Invalid config: missing "organization" field');
-        console.error(source_default.gray(`  Config file: ${(0, import_path.resolve)(configPath)}`));
-        console.error(source_default.gray('  Expected: export default { organization: "your-org-name" }'));
-        throw new Error("Invalid config");
-      }
       const entryModule = await jiti.import((0, import_path.resolve)(entryPath));
       const org = entryModule.default;
       if (!org) {
@@ -40138,7 +40188,7 @@ function registerCheckCommand(program3) {
         console.error(source_default.gray("  Expected: export default { workflows: [...], agents: [...] }"));
         throw new Error("Invalid entry");
       }
-      new ResourceRegistry({ [config3.organization]: org });
+      new ResourceRegistry({ _check: org });
       const workflowCount = org.workflows?.length ?? 0;
       const agentCount = org.agents?.length ?? 0;
       const totalCount = workflowCount + agentCount;
@@ -40189,27 +40239,73 @@ function resolveEnvironment() {
   return process.env.NODE_ENV === "development" ? "development" : "production";
 }
 
+// src/cli/api-client.ts
+function getApiKey() {
+  const key = process.env.ELEVASIS_API_KEY;
+  if (!key) {
+    throw new Error(
+      "ELEVASIS_API_KEY environment variable is required.\nSet it in your .env file: ELEVASIS_API_KEY=sk_..."
+    );
+  }
+  return key;
+}
+async function apiGet(endpoint, apiUrl = resolveApiUrl()) {
+  const response = await fetch(`${apiUrl}${endpoint}`, {
+    headers: { Authorization: `Bearer ${getApiKey()}` }
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`API request failed (${response.status}): ${errorText}`);
+  }
+  if (response.status === 204) {
+    return {};
+  }
+  return response.json();
+}
+async function apiPost(endpoint, body, apiUrl = resolveApiUrl()) {
+  const response = await fetch(`${apiUrl}${endpoint}`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${getApiKey()}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`API request failed (${response.status}): ${errorText}`);
+  }
+  if (response.status === 204) {
+    return {};
+  }
+  return response.json();
+}
+
 // src/cli/commands/deploy.ts
 var import_meta2 = {};
 function registerDeployCommand(program3) {
-  program3.command("deploy").description("Validate, bundle, upload, and deploy project resources\n  Example: elevasis deploy --api-url http://localhost:5170").option("--api-url <url>", "API URL").option("--config <path>", "Path to elevasis.config.ts (default: ./elevasis.config.ts)").option("--entry <path>", "Path to entry file (default: ./src/index.ts)").action(wrapAction("deploy", async (options) => {
+  program3.command("deploy").description("Validate, bundle, upload, and deploy project resources\n  Example: elevasis deploy --api-url http://localhost:5170").option("--api-url <url>", "API URL").option("--entry <path>", "Path to entry file (default: ./src/index.ts)").action(wrapAction("deploy", async (options) => {
     const startTime = Date.now();
     const apiUrl = resolveApiUrl(options.apiUrl);
     const env2 = resolveEnvironment();
-    const configPath = options.config ?? "./elevasis.config.ts";
     const entryPath = options.entry ?? "./src/index.ts";
+    const authSpinner = ora("Authenticating...").start();
+    let orgName;
+    try {
+      const me = await apiGet("/api/external/me", apiUrl);
+      orgName = me.organizationName;
+      authSpinner.succeed(
+        source_default.green("Authenticating...") + source_default.white("          done") + source_default.gray(` (${orgName})`)
+      );
+    } catch (error46) {
+      authSpinner.fail(source_default.red("Authentication failed"));
+      console.error(source_default.gray("  Check your ELEVASIS_API_KEY and API URL."));
+      throw error46;
+    }
     const validateSpinner = ora("Validating...").start();
-    let config3;
     let org;
     try {
       const jiti = (0, import_jiti2.createJiti)(import_meta2.url);
-      const configModule = await jiti.import((0, import_path2.resolve)(configPath));
-      config3 = configModule.default;
-      if (!config3?.organization) {
-        validateSpinner.fail('Invalid config: missing "organization" field');
-        console.error(source_default.gray(`  Config file: ${(0, import_path2.resolve)(configPath)}`));
-        throw new Error('Invalid config: missing "organization" field');
-      }
       const entryModule = await jiti.import((0, import_path2.resolve)(entryPath));
       org = entryModule.default;
       if (!org) {
@@ -40217,7 +40313,7 @@ function registerDeployCommand(program3) {
         console.error(source_default.gray(`  Entry file: ${(0, import_path2.resolve)(entryPath)}`));
         throw new Error("Invalid entry: no default export found");
       }
-      new ResourceRegistry({ [config3.organization]: org });
+      new ResourceRegistry({ [orgName]: org });
       const workflowCount = org.workflows?.length ?? 0;
       const agentCount = org.agents?.length ?? 0;
       const totalCount = workflowCount + agentCount;
@@ -40225,7 +40321,7 @@ function registerDeployCommand(program3) {
         source_default.green("Validating...") + source_default.white("              done") + source_default.gray(` (${totalCount} resource${totalCount !== 1 ? "s" : ""}, 0 errors)`)
       );
       console.log("");
-      console.log(source_default.gray(`  Org:    ${config3.organization}`));
+      console.log(source_default.gray(`  Org:    ${orgName}`));
       console.log(source_default.gray(`  Target: ${apiUrl} (${env2})`));
       console.log("");
       for (const w of org.workflows ?? []) {
@@ -40401,48 +40497,6 @@ startWorker(org)
   }));
 }
 
-// src/cli/api-client.ts
-function getApiKey() {
-  const key = process.env.ELEVASIS_API_KEY;
-  if (!key) {
-    throw new Error(
-      "ELEVASIS_API_KEY environment variable is required.\nSet it in your .env file: ELEVASIS_API_KEY=sk_..."
-    );
-  }
-  return key;
-}
-async function apiGet(endpoint, apiUrl = resolveApiUrl()) {
-  const response = await fetch(`${apiUrl}${endpoint}`, {
-    headers: { Authorization: `Bearer ${getApiKey()}` }
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(`API request failed (${response.status}): ${errorText}`);
-  }
-  if (response.status === 204) {
-    return {};
-  }
-  return response.json();
-}
-async function apiPost(endpoint, body, apiUrl = resolveApiUrl()) {
-  const response = await fetch(`${apiUrl}${endpoint}`, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${getApiKey()}`,
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(body)
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(`API request failed (${response.status}): ${errorText}`);
-  }
-  if (response.status === 204) {
-    return {};
-  }
-  return response.json();
-}
-
 // src/cli/commands/exec.ts
 function registerExecCommand(program3) {
   program3.command("exec <resourceId>").description(`Execute a deployed resource
@@ -40775,7 +40829,7 @@ var import_path3 = require("path");
 var import_promises2 = require("fs/promises");
 
 // src/cli/version.ts
-var SDK_VERSION = "0.4.0";
+var SDK_VERSION = "0.4.1";
 
 // src/cli/commands/init.ts
 var SCAFFOLD_FILES = [
@@ -40812,7 +40866,7 @@ function registerInitCommand(program3) {
     }
     await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, "src"), { recursive: true });
     const files = {
-      "elevasis.config.ts": configTemplate(orgSlug),
+      "elevasis.config.ts": configTemplate(),
       "package.json": packageJsonTemplate(orgSlug),
       "pnpm-workspace.yaml": pnpmWorkspaceTemplate(),
       "tsconfig.json": tsconfigTemplate(),
@@ -40840,12 +40894,10 @@ function toSlug(name) {
   const slug = name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^[^a-z]+/, "").replace(/-+/g, "-").replace(/-$/, "");
   return slug.length >= 3 ? slug : "my-project";
 }
-function configTemplate(organization) {
+function configTemplate() {
   return `import type { ElevasConfig } from '@elevasis/sdk'
 
-export default {
-  organization: '${organization}',
-} satisfies ElevasConfig
+export default {} satisfies ElevasConfig
 `;
 }
 function packageJsonTemplate(organization) {
@@ -40938,7 +40990,7 @@ elevasis executions <resourceId>
 
 ## Project Structure
 
-- \`elevasis.config.ts\` -- Organization config
+- \`elevasis.config.ts\` -- Project config (optional settings)
 - \`src/index.ts\` -- Resource definitions (workflows, agents)
 - \`.env\` -- API key and environment variables
 `;

package/dist/index.d.ts

@@ -1104,11 +1104,12 @@ declare class ResourceRegistry {
      */
     private serializedCache;
     /**
-     * Runtime-registered organizations (external deployments)
-     * Tracks which orgs were added at runtime vs. static startup.
-     * Used to guard against unregistering static orgs and to store remote config.
+     * Per-resource remote configuration (external deployments)
+     * Key: "orgName/resourceId", Value: RemoteOrgConfig for that resource.
+     * Tracks which individual resources were added at runtime via deploy pipeline.
+     * Static and remote resources coexist in the same org.
      */
-    private runtimeOrgs;
+    private remoteResources;
     constructor(registry: OrganizationRegistry);
     /**
      * Validates registry on construction
@@ -1145,47 +1146,53 @@ declare class ResourceRegistry {
      */
     listAllResources(): OrganizationRegistry;
     /**
-     * Register an external organization at runtime
+     * Register external resources at runtime
      *
      * Called during deploy pipeline when an external developer deploys their bundle.
-     * Adds the org's stub definitions to the registry and stores remote config
-     * for worker thread execution branching.
+     * Merges the incoming stub definitions into the org's registry and stores
+     * per-resource remote config for worker thread execution branching.
      *
-     * - If orgName conflicts with a static (startup) org, throws an error
-     * - If orgName is already runtime-registered (redeploy), unregisters first
+     * Static and remote resources coexist in the same org. If the org already
+     * has static resources, the incoming remote resources are merged alongside them.
+     * If redeploying (some resources already registered as remote for this org),
+     * the previous remote resources are unregistered first.
      *
      * @param orgName - Organization name (used as registry key)
      * @param org - Stub resource definitions (workflows/agents with placeholder handlers)
      * @param remote - Remote configuration (bundle path, deployment ID, env vars)
-     * @throws Error if orgName conflicts with a static organization
+     * @throws Error if incoming resourceId conflicts with a static resource
+     * @throws Error if incoming deployment contains duplicate resourceIds
      */
     registerOrganization(orgName: string, org: OrganizationResources, remote: RemoteOrgConfig): void;
     /**
-     * Unregister a runtime-registered organization
+     * Unregister runtime-registered resources for an organization
      *
-     * Only removes organizations that were registered at runtime (via registerOrganization).
-     * Static organizations loaded at startup are protected and cannot be unregistered.
-     * No-op if the org is not runtime-registered.
+     * Removes only resources that were registered at runtime (via registerOrganization).
+     * Static resources loaded at startup are preserved. If the org still has static
+     * resources after removal, the serialization cache is rebuilt. If no resources
+     * remain, the org is fully removed from the registry.
+     * No-op if the org has no remote resources.
      *
-     * @param orgName - Organization name to unregister
+     * @param orgName - Organization name to unregister remote resources from
      */
     unregisterOrganization(orgName: string): void;
     /**
-     * Get remote configuration for an organization
+     * Get remote configuration for a specific resource
      *
-     * Returns the RemoteOrgConfig if the org was registered at runtime,
-     * or null if it's a static org or doesn't exist.
+     * Returns the RemoteOrgConfig if the resource was registered at runtime,
+     * or null if it's a static resource or doesn't exist.
      * Used by the execution coordinator to branch between local and worker execution.
      *
      * @param orgName - Organization name
+     * @param resourceId - Resource ID
      * @returns Remote config or null
      */
-    getRemoteConfig(orgName: string): RemoteOrgConfig | null;
+    getRemoteConfig(orgName: string, resourceId: string): RemoteOrgConfig | null;
     /**
-     * Check if an organization is a remote (externally deployed) organization
+     * Check if an organization has any remote (externally deployed) resources
      *
      * @param orgName - Organization name
-     * @returns true if the org was registered at runtime
+     * @returns true if the org has at least one runtime-registered resource
      */
     isRemote(orgName: string): boolean;
     /**
@@ -1903,10 +1910,10 @@ declare class RegistryValidationError extends Error {
 
 /**
  * Project configuration for an external developer project.
- * Defined in elevas.config.ts at the project root.
+ * Defined in elevasis.config.ts at the project root.
+ * Organization is derived from the ELEVASIS_API_KEY -- not configured here.
  */
 interface ElevasConfig {
-    organization: string;
     defaultStatus?: ResourceStatus;
     dev?: {
         port?: number;

package/dist/index.js

@@ -3166,11 +3166,12 @@ var ResourceRegistry = class {
    */
   serializedCache;
   /**
-   * Runtime-registered organizations (external deployments)
-   * Tracks which orgs were added at runtime vs. static startup.
-   * Used to guard against unregistering static orgs and to store remote config.
+   * Per-resource remote configuration (external deployments)
+   * Key: "orgName/resourceId", Value: RemoteOrgConfig for that resource.
+   * Tracks which individual resources were added at runtime via deploy pipeline.
+   * Static and remote resources coexist in the same org.
    */
-  runtimeOrgs = /* @__PURE__ */ new Map();
+  remoteResources = /* @__PURE__ */ new Map();
   /**
    * Validates registry on construction
    * - Checks for duplicate resourceIds within organizations
@@ -3273,67 +3274,125 @@ var ResourceRegistry = class {
   // Runtime Organization Registration (External Deployments)
   // ============================================================================
   /**
-   * Register an external organization at runtime
+   * Register external resources at runtime
    *
    * Called during deploy pipeline when an external developer deploys their bundle.
-   * Adds the org's stub definitions to the registry and stores remote config
-   * for worker thread execution branching.
+   * Merges the incoming stub definitions into the org's registry and stores
+   * per-resource remote config for worker thread execution branching.
    *
-   * - If orgName conflicts with a static (startup) org, throws an error
-   * - If orgName is already runtime-registered (redeploy), unregisters first
+   * Static and remote resources coexist in the same org. If the org already
+   * has static resources, the incoming remote resources are merged alongside them.
+   * If redeploying (some resources already registered as remote for this org),
+   * the previous remote resources are unregistered first.
    *
    * @param orgName - Organization name (used as registry key)
    * @param org - Stub resource definitions (workflows/agents with placeholder handlers)
    * @param remote - Remote configuration (bundle path, deployment ID, env vars)
-   * @throws Error if orgName conflicts with a static organization
+   * @throws Error if incoming resourceId conflicts with a static resource
+   * @throws Error if incoming deployment contains duplicate resourceIds
    */
   registerOrganization(orgName, org, remote) {
-    if (this.registry[orgName] && !this.runtimeOrgs.has(orgName)) {
-      throw new Error(`Organization '${orgName}' conflicts with a static organization`);
+    const incomingWorkflowIds = (org.workflows ?? []).map((w) => w.config.resourceId);
+    const incomingAgentIds = (org.agents ?? []).map((a) => a.config.resourceId);
+    const incomingIds = [...incomingWorkflowIds, ...incomingAgentIds];
+    const seen = /* @__PURE__ */ new Set();
+    for (const id of incomingIds) {
+      if (seen.has(id)) {
+        throw new Error(
+          `Duplicate resource ID '${id}' in deployment. Each resource must have a unique ID.`
+        );
+      }
+      seen.add(id);
     }
-    if (this.runtimeOrgs.has(orgName)) {
+    if (this.isRemote(orgName)) {
       this.unregisterOrganization(orgName);
     }
-    this.registry[orgName] = org;
-    this.runtimeOrgs.set(orgName, remote);
-    this.serializedCache.set(orgName, serializeOrganization(org));
+    const existingOrg = this.registry[orgName];
+    if (existingOrg) {
+      const staticWorkflowIds = new Set((existingOrg.workflows ?? []).map((w) => w.config.resourceId));
+      const staticAgentIds = new Set((existingOrg.agents ?? []).map((a) => a.config.resourceId));
+      for (const id of incomingIds) {
+        if (staticWorkflowIds.has(id) || staticAgentIds.has(id)) {
+          throw new Error(
+            `Resource '${id}' already exists in '${orgName}' as an internal resource. External deployments cannot override internal resources.`
+          );
+        }
+      }
+    }
+    if (existingOrg) {
+      existingOrg.workflows = [...existingOrg.workflows ?? [], ...org.workflows ?? []];
+      existingOrg.agents = [...existingOrg.agents ?? [], ...org.agents ?? []];
+    } else {
+      this.registry[orgName] = org;
+    }
+    for (const id of incomingIds) {
+      this.remoteResources.set(`${orgName}/${id}`, remote);
+    }
+    this.serializedCache.set(orgName, serializeOrganization(this.registry[orgName]));
   }
   /**
-   * Unregister a runtime-registered organization
+   * Unregister runtime-registered resources for an organization
    *
-   * Only removes organizations that were registered at runtime (via registerOrganization).
-   * Static organizations loaded at startup are protected and cannot be unregistered.
-   * No-op if the org is not runtime-registered.
+   * Removes only resources that were registered at runtime (via registerOrganization).
+   * Static resources loaded at startup are preserved. If the org still has static
+   * resources after removal, the serialization cache is rebuilt. If no resources
+   * remain, the org is fully removed from the registry.
+   * No-op if the org has no remote resources.
    *
-   * @param orgName - Organization name to unregister
+   * @param orgName - Organization name to unregister remote resources from
    */
   unregisterOrganization(orgName) {
-    if (!this.runtimeOrgs.has(orgName)) return;
-    delete this.registry[orgName];
-    this.runtimeOrgs.delete(orgName);
-    this.serializedCache.delete(orgName);
+    const prefix = `${orgName}/`;
+    const remoteIds = /* @__PURE__ */ new Set();
+    for (const key of this.remoteResources.keys()) {
+      if (key.startsWith(prefix)) {
+        remoteIds.add(key.slice(prefix.length));
+        this.remoteResources.delete(key);
+      }
+    }
+    if (remoteIds.size === 0) return;
+    const orgResources = this.registry[orgName];
+    if (!orgResources) return;
+    orgResources.workflows = (orgResources.workflows ?? []).filter(
+      (w) => !remoteIds.has(w.config.resourceId)
+    );
+    orgResources.agents = (orgResources.agents ?? []).filter(
+      (a) => !remoteIds.has(a.config.resourceId)
+    );
+    const remaining = (orgResources.workflows?.length ?? 0) + (orgResources.agents?.length ?? 0) + (orgResources.triggers?.length ?? 0) + (orgResources.integrations?.length ?? 0) + (orgResources.externalResources?.length ?? 0) + (orgResources.humanCheckpoints?.length ?? 0);
+    if (remaining > 0) {
+      this.serializedCache.set(orgName, serializeOrganization(orgResources));
+    } else {
+      delete this.registry[orgName];
+      this.serializedCache.delete(orgName);
+    }
   }
   /**
-   * Get remote configuration for an organization
+   * Get remote configuration for a specific resource
    *
-   * Returns the RemoteOrgConfig if the org was registered at runtime,
-   * or null if it's a static org or doesn't exist.
+   * Returns the RemoteOrgConfig if the resource was registered at runtime,
+   * or null if it's a static resource or doesn't exist.
    * Used by the execution coordinator to branch between local and worker execution.
    *
    * @param orgName - Organization name
+   * @param resourceId - Resource ID
    * @returns Remote config or null
    */
-  getRemoteConfig(orgName) {
-    return this.runtimeOrgs.get(orgName) ?? null;
+  getRemoteConfig(orgName, resourceId) {
+    return this.remoteResources.get(`${orgName}/${resourceId}`) ?? null;
   }
   /**
-   * Check if an organization is a remote (externally deployed) organization
+   * Check if an organization has any remote (externally deployed) resources
    *
    * @param orgName - Organization name
-   * @returns true if the org was registered at runtime
+   * @returns true if the org has at least one runtime-registered resource
    */
   isRemote(orgName) {
-    return this.runtimeOrgs.has(orgName);
+    const prefix = `${orgName}/`;
+    for (const key of this.remoteResources.keys()) {
+      if (key.startsWith(prefix)) return true;
+    }
+    return false;
   }
   // ============================================================================
   // Resource Manifest Accessors

package/dist/worker/index.js

@@ -64,8 +64,12 @@ function startWorker(org) {
   const agents = new Map(
     (org.agents ?? []).map((a) => [a.config.resourceId, a])
   );
+  console.log(`[SDK-WORKER] Worker started with ${workflows.size} workflow(s), ${agents.size} agent(s)`);
   parentPort.on("message", async (msg) => {
     if (msg.type === "manifest") {
+      const workflowList = (org.workflows ?? []).map((w) => w.config.resourceId);
+      const agentList = (org.agents ?? []).map((a) => a.config.resourceId);
+      console.log(`[SDK-WORKER] Manifest requested: workflows=[${workflowList.join(", ")}], agents=[${agentList.join(", ")}]`);
       parentPort.postMessage({
         type: "manifest",
         workflows: (org.workflows ?? []).map((w) => ({
@@ -88,18 +92,24 @@ function startWorker(org) {
       return;
     }
     if (msg.type === "execute") {
-      const { resourceId, input } = msg;
+      const { resourceId, executionId, input } = msg;
+      console.log(`[SDK-WORKER] Execute request: resourceId=${resourceId}, executionId=${executionId}`);
       const workflow = workflows.get(resourceId);
       if (workflow) {
         try {
+          console.log(`[SDK-WORKER] Running workflow '${resourceId}' (${Object.keys(workflow.steps).length} steps)`);
+          const startTime = Date.now();
           const { output, logs } = await executeWorkflow(workflow, input);
+          console.log(`[SDK-WORKER] Workflow '${resourceId}' completed (${Date.now() - startTime}ms)`);
           parentPort.postMessage({ type: "result", status: "completed", output, logs });
         } catch (err) {
+          console.error(`[SDK-WORKER] Workflow '${resourceId}' failed: ${String(err)}`);
           parentPort.postMessage({ type: "result", status: "failed", error: String(err), logs: [] });
         }
         return;
       }
       if (agents.has(resourceId)) {
+        console.error(`[SDK-WORKER] Agent execution not supported: ${resourceId}`);
         parentPort.postMessage({
           type: "result",
           status: "failed",
@@ -108,6 +118,7 @@ function startWorker(org) {
         });
         return;
       }
+      console.error(`[SDK-WORKER] Resource not found: ${resourceId}`);
       parentPort.postMessage({
         type: "result",
         status: "failed",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elevasis/sdk",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "SDK for building Elevasis organization resources",
   "comment:bin": "IMPORTANT: This package shares the 'elevasis' binary name with @repo/cli. They never conflict because @elevasis/sdk must NEVER be added as a dependency of any workspace package (apps/*, packages/*, organizations/*). Workspace projects use @repo/cli for the 'elevasis' binary. External developers (outside the workspace) get this SDK's binary via npm install.",
   "type": "module",