@elevasis/sdk 0.5.0 → 0.5.2

package/dist/cli.cjs

@@ -27004,7 +27004,7 @@ var chalkStderr = createChalk({ level: stderrColor ? stderrColor.level : 0 });
 var source_default = chalk;
 
 // src/cli/commands/check.ts
-var import_path = require("path");
+var import_path2 = require("path");
 
 // ../../node_modules/.pnpm/ora@7.0.1/node_modules/ora/index.js
 var import_node_process6 = __toESM(require("node:process"), 1);
@@ -27516,7 +27516,7 @@ function ora(options2) {
 }
 
 // src/cli/commands/check.ts
-var import_jiti = require("jiti");
+var import_jiti2 = require("jiti");
 
 // ../../node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -43685,59 +43685,11 @@ function wrapAction(commandName, fn) {
   };
 }
 
-// src/cli/commands/check.ts
-var import_meta = {};
-function registerCheckCommand(program3) {
-  program3.command("check").description("Validate project resources against the ResourceRegistry\n  Example: elevasis check --entry ./src/index.ts").option("--entry <path>", "Path to entry file (default: ./src/index.ts)").action(wrapAction("check", async (options2) => {
-    const entryPath = options2.entry ?? "./src/index.ts";
-    const spinner = ora("Validating resources...").start();
-    try {
-      const jiti = (0, import_jiti.createJiti)(import_meta.url);
-      const entryModule = await jiti.import((0, import_path.resolve)(entryPath));
-      const org = entryModule.default;
-      if (!org) {
-        spinner.fail("Invalid entry: no default export found");
-        console.error(source_default.gray(`  Entry file: ${(0, import_path.resolve)(entryPath)}`));
-        console.error(source_default.gray("  Expected: export default { workflows: [...], agents: [...] }"));
-        throw new Error("Invalid entry");
-      }
-      new ResourceRegistry({ _check: org });
-      const workflowCount = org.workflows?.length ?? 0;
-      const agentCount = org.agents?.length ?? 0;
-      const totalCount = workflowCount + agentCount;
-      spinner.succeed(
-        source_default.green("Validation passed") + source_default.gray(` (${totalCount} resource${totalCount !== 1 ? "s" : ""}, 0 errors)`)
-      );
-      if (workflowCount > 0) {
-        console.log(source_default.gray(`  Workflows: ${workflowCount}`));
-      }
-      if (agentCount > 0) {
-        console.log(source_default.gray(`  Agents:    ${agentCount}`));
-      }
-    } catch (error46) {
-      if (error46 instanceof RegistryValidationError) {
-        spinner.fail(source_default.red("Validation failed"));
-        console.error("");
-        console.error(source_default.red(`  ERROR  ${error46.message}`));
-        if (error46.resourceId) {
-          console.error(source_default.gray(`  Resource: ${error46.resourceId}`));
-        }
-        if (error46.field) {
-          console.error(source_default.gray(`  Field: ${error46.field}`));
-        }
-        console.error("");
-        console.error(source_default.gray("  1 error. Fix the issue and run again."));
-      }
-      throw error46;
-    }
-  }));
-}
-
 // src/cli/commands/deploy.ts
-var import_path2 = require("path");
+var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_gray_matter = __toESM(require_gray_matter(), 1);
-var import_jiti2 = require("jiti");
+var import_jiti = require("jiti");
 var esbuild = __toESM(require("esbuild"), 1);
 
 // src/cli/config.ts
@@ -43769,6 +43721,9 @@ async function apiGet(endpoint, apiUrl = resolveApiUrl()) {
   });
   if (!response.ok) {
     const errorText = await response.text();
+    if (response.status === 401) {
+      throw new Error(`401 Unauthorized: Invalid or missing ELEVASIS_API_KEY. Check your .env file.`);
+    }
     throw new Error(`API request failed (${response.status}): ${errorText}`);
   }
   if (response.status === 204) {
@@ -43830,7 +43785,7 @@ async function apiDelete(endpoint, apiUrl = resolveApiUrl()) {
 // package.json
 var package_default = {
   name: "@elevasis/sdk",
-  version: "0.5.0",
+  version: "0.5.2",
   description: "SDK for building Elevasis organization resources",
   "comment:bin": "IMPORTANT: This package shares the 'elevasis' binary name with @repo/cli. They never conflict because @elevasis/sdk must NEVER be added as a dependency of any workspace package (apps/*, packages/*, organizations/*). Workspace projects use @repo/cli for the 'elevasis' binary. External developers (outside the workspace) get this SDK's binary via npm install.",
   type: "module",
@@ -43897,9 +43852,9 @@ var package_default = {
 var SDK_VERSION = package_default.version;
 
 // src/cli/commands/deploy.ts
-var import_meta2 = {};
+var import_meta = {};
 async function scanDocumentation() {
-  const docsDir = (0, import_path2.resolve)("docs");
+  const docsDir = (0, import_path.resolve)("docs");
   const files = [];
   let totalSize = 0;
   async function scan(dir, relPrefix) {
@@ -43910,7 +43865,7 @@ async function scanDocumentation() {
       return;
     }
     for (const entry of entries) {
-      const fullPath = (0, import_path2.resolve)(dir, entry.name);
+      const fullPath = (0, import_path.resolve)(dir, entry.name);
       const relPath = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         await scan(fullPath, relPath);
@@ -43949,16 +43904,61 @@ function escapeMdx(text) {
   if (!text) return "";
   return text.replace(/\|/g, "\\|").replace(/\{/g, "\\{").replace(/\}/g, "\\}");
 }
+async function generateResourceMap(org) {
+  const workflows = org.workflows ?? [];
+  const agents = org.agents ?? [];
+  const lines = [
+    "---",
+    "title: Resource Map",
+    "description: Auto-generated resource inventory (updated on each deploy)",
+    "order: 998",
+    "---",
+    "",
+    "# Resource Map",
+    "",
+    "> Auto-generated by `elevasis deploy`. Do not edit manually.",
+    ""
+  ];
+  if (workflows.length > 0) {
+    lines.push(
+      "## Workflows",
+      "",
+      "| Resource ID | Name | Version | Status | Description |",
+      "| --- | --- | --- | --- | --- |"
+    );
+    for (const w of workflows) {
+      const desc = escapeMdx(w.config.description);
+      lines.push(`| \`${w.config.resourceId}\` | ${escapeMdx(w.config.name)} | ${w.config.version} | ${w.config.status} | ${desc} |`);
+    }
+    lines.push("");
+  }
+  if (agents.length > 0) {
+    lines.push(
+      "## Agents",
+      "",
+      "| Resource ID | Name | Version | Status | Description |",
+      "| --- | --- | --- | --- | --- |"
+    );
+    for (const a of agents) {
+      const desc = escapeMdx(a.config.description);
+      lines.push(`| \`${a.config.resourceId}\` | ${escapeMdx(a.config.name)} | ${a.config.version} | ${a.config.status} | ${desc} |`);
+    }
+    lines.push("");
+  }
+  lines.push(`**Total:** ${workflows.length + agents.length} resources (${workflows.length} workflows, ${agents.length} agents)`, "");
+  await (0, import_promises.mkdir)((0, import_path.resolve)("docs"), { recursive: true });
+  await (0, import_promises.writeFile)((0, import_path.resolve)("docs/resource-map.mdx"), lines.join("\n"), "utf-8");
+}
 async function generateProjectMap(org) {
   const workflows = org.workflows ?? [];
   const agents = org.agents ?? [];
   let templateVersion = "unknown";
   try {
-    const jiti = (0, import_jiti2.createJiti)(import_meta2.url);
-    const cfg = await jiti.import((0, import_path2.resolve)("elevasis.config.ts"));
+    const jiti = (0, import_jiti.createJiti)(import_meta.url);
+    const cfg = await jiti.import((0, import_path.resolve)("elevasis.config.ts"));
     const cfgObj = cfg.default ?? cfg;
-    if (cfgObj && typeof cfgObj.templateVersion === "string") {
-      templateVersion = cfgObj.templateVersion;
+    if (cfgObj?.templateVersion != null) {
+      templateVersion = String(cfgObj.templateVersion);
     }
   } catch {
   }
@@ -43993,7 +43993,7 @@ async function generateProjectMap(org) {
     "| --- | --- | --- | --- |"
   );
   try {
-    const srcEntries = await (0, import_promises.readdir)((0, import_path2.resolve)("src"), { withFileTypes: true });
+    const srcEntries = await (0, import_promises.readdir)((0, import_path.resolve)("src"), { withFileTypes: true });
     const domainDirs = srcEntries.filter((e) => e.isDirectory());
     if (domainDirs.length === 0) {
       lines.push("| (none) | src/ | 0 | \u2014 |");
@@ -44023,34 +44023,17 @@ async function generateProjectMap(org) {
     lines.push("| (src/ not found) | \u2014 | 0 | \u2014 |");
   }
   lines.push("");
-  lines.push("## Resources", "");
-  if (workflows.length > 0) {
-    lines.push(
-      "### Workflows",
-      "",
-      "| Resource ID | Name | Version | Status | Description |",
-      "| --- | --- | --- | --- | --- |"
-    );
-    for (const w of workflows) {
-      const desc = escapeMdx(w.config.description);
-      lines.push(`| \`${w.config.resourceId}\` | ${escapeMdx(w.config.name)} | ${w.config.version} | ${w.config.status} | ${desc} |`);
-    }
-    lines.push("");
-  }
-  if (agents.length > 0) {
-    lines.push(
-      "### Agents",
-      "",
-      "| Resource ID | Name | Version | Status | Description |",
-      "| --- | --- | --- | --- | --- |"
-    );
-    for (const a of agents) {
-      const desc = escapeMdx(a.config.description);
-      lines.push(`| \`${a.config.resourceId}\` | ${escapeMdx(a.config.name)} | ${a.config.version} | ${a.config.status} | ${desc} |`);
-    }
-    lines.push("");
-  }
-  lines.push(`**Total:** ${workflows.length + agents.length} resources (${workflows.length} workflows, ${agents.length} agents)`, "");
+  lines.push(
+    "## Resources",
+    "",
+    "| Type | Count |",
+    "| --- | --- |",
+    `| Workflows | ${workflows.length} |`,
+    `| Agents | ${agents.length} |`,
+    "",
+    `Full inventory (names, versions, descriptions): \`docs/resource-map.mdx\``,
+    ""
+  );
   lines.push(
     "## Documentation Index",
     "",
@@ -44071,10 +44054,10 @@ async function generateProjectMap(org) {
       for (const entry of entries) {
         const relPath = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
         if (entry.isDirectory()) {
-          await scanDocsDir((0, import_path2.resolve)(dir, entry.name), relPath);
-        } else if (entry.isFile() && entry.name.endsWith(".mdx") && relPath !== "project-map.mdx") {
+          await scanDocsDir((0, import_path.resolve)(dir, entry.name), relPath);
+        } else if (entry.isFile() && entry.name.endsWith(".mdx") && relPath !== "project-map.mdx" && relPath !== "resource-map.mdx") {
           try {
-            const raw = await (0, import_promises.readFile)((0, import_path2.resolve)(dir, entry.name), "utf-8");
+            const raw = await (0, import_promises.readFile)((0, import_path.resolve)(dir, entry.name), "utf-8");
             const fmMatch = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
             let title = relPath;
             let description = "";
@@ -44094,7 +44077,7 @@ async function generateProjectMap(org) {
         }
       }
     }
-    await scanDocsDir((0, import_path2.resolve)("docs"), "");
+    await scanDocsDir((0, import_path.resolve)("docs"), "");
     docEntries.sort((a, b) => {
       if (a.order !== b.order) return a.order - b.order;
       return a.title.localeCompare(b.title);
@@ -44112,7 +44095,7 @@ async function generateProjectMap(org) {
   lines.push("");
   lines.push("## SDK Reference", "");
   try {
-    const navPath = (0, import_path2.resolve)("node_modules/@elevasis/sdk/reference/_navigation.md");
+    const navPath = (0, import_path.resolve)("node_modules/@elevasis/sdk/reference/_navigation.md");
     const navContent = await (0, import_promises.readFile)(navPath, "utf-8");
     const navLines = navContent.split(/\r?\n/);
     const categories = [];
@@ -44155,7 +44138,7 @@ async function generateProjectMap(org) {
   }
   lines.push("## Command and Rules System", "", "### Commands", "");
   try {
-    const cmdEntries = await (0, import_promises.readdir)((0, import_path2.resolve)(".claude/commands"), { withFileTypes: true });
+    const cmdEntries = await (0, import_promises.readdir)((0, import_path.resolve)(".claude/commands"), { withFileTypes: true });
     const cmdFiles = cmdEntries.filter((e) => e.isFile() && e.name.endsWith(".md"));
     if (cmdFiles.length === 0) {
       lines.push("No commands found.", "");
@@ -44168,7 +44151,7 @@ async function generateProjectMap(org) {
         const cmdName = f.name.replace(/\.md$/, "");
         let purpose = "";
         try {
-          const raw = await (0, import_promises.readFile)((0, import_path2.resolve)(".claude/commands", f.name), "utf-8");
+          const raw = await (0, import_promises.readFile)((0, import_path.resolve)(".claude/commands", f.name), "utf-8");
           const goalMatch = raw.match(/\*\*Goal:\*\*\s*(.+)/);
           if (goalMatch) {
             purpose = goalMatch[1].trim();
@@ -44187,7 +44170,7 @@ async function generateProjectMap(org) {
   }
   lines.push("### Rules (auto-injected)", "");
   try {
-    const ruleEntries = await (0, import_promises.readdir)((0, import_path2.resolve)(".claude/rules"), { withFileTypes: true });
+    const ruleEntries = await (0, import_promises.readdir)((0, import_path.resolve)(".claude/rules"), { withFileTypes: true });
     const ruleFiles = ruleEntries.filter((e) => e.isFile() && e.name.endsWith(".md"));
     if (ruleFiles.length === 0) {
       lines.push("No rules found.", "");
@@ -44200,7 +44183,7 @@ async function generateProjectMap(org) {
         const ruleName = f.name.replace(/\.md$/, "").replace(/-/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
         let scope = "";
         try {
-          const raw = await (0, import_promises.readFile)((0, import_path2.resolve)(".claude/rules", f.name), "utf-8");
+          const raw = await (0, import_promises.readFile)((0, import_path.resolve)(".claude/rules", f.name), "utf-8");
           const fmMatch = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
           if (fmMatch) {
             const descMatch = fmMatch[1].match(/^description:\s*(.+)$/m);
@@ -44221,7 +44204,7 @@ async function generateProjectMap(org) {
   }
   lines.push("### Skills", "");
   try {
-    const skillEntries = await (0, import_promises.readdir)((0, import_path2.resolve)(".claude/skills"), { withFileTypes: true });
+    const skillEntries = await (0, import_promises.readdir)((0, import_path.resolve)(".claude/skills"), { withFileTypes: true });
     const skillDirs = skillEntries.filter((e) => e.isDirectory());
     if (skillDirs.length === 0) {
       lines.push("No skills found.", "");
@@ -44231,7 +44214,7 @@ async function generateProjectMap(org) {
         "| --- | --- | --- |"
       );
       for (const d of skillDirs) {
-        const skillFile = (0, import_path2.resolve)(".claude/skills", d.name, "SKILL.md");
+        const skillFile = (0, import_path.resolve)(".claude/skills", d.name, "SKILL.md");
         let trigger = "";
         try {
           const raw = await (0, import_promises.readFile)(skillFile, "utf-8");
@@ -44264,7 +44247,7 @@ async function generateProjectMap(org) {
         return;
       }
       for (const entry of entries) {
-        const fullPath = (0, import_path2.resolve)(dir, entry.name);
+        const fullPath = (0, import_path.resolve)(dir, entry.name);
         const relPath = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
         if (entry.isDirectory()) {
           await scanMemory(fullPath, relPath);
@@ -44281,7 +44264,7 @@ async function generateProjectMap(org) {
         }
       }
     }
-    await scanMemory((0, import_path2.resolve)(".claude/memory"), "");
+    await scanMemory((0, import_path.resolve)(".claude/memory"), "");
     if (memoryFiles.length === 0) {
       lines.push("No memory files found.", "");
     } else {
@@ -44301,7 +44284,7 @@ async function generateProjectMap(org) {
   let apiKeySet = "no";
   let nodeEnv = "not set";
   try {
-    const envContent = await (0, import_promises.readFile)((0, import_path2.resolve)(".env"), "utf-8");
+    const envContent = await (0, import_promises.readFile)((0, import_path.resolve)(".env"), "utf-8");
     const apiKeyMatch = envContent.match(/^ELEVASIS_API_KEY=(.+)$/m);
     if (apiKeyMatch && apiKeyMatch[1].trim()) apiKeySet = "yes";
     const nodeEnvMatch = envContent.match(/^NODE_ENV=(.+)$/m);
@@ -44317,8 +44300,8 @@ async function generateProjectMap(org) {
     `| Node Env | .env | ${nodeEnv} |`,
     ""
   );
-  await (0, import_promises.mkdir)((0, import_path2.resolve)("docs"), { recursive: true });
-  await (0, import_promises.writeFile)((0, import_path2.resolve)("docs/project-map.mdx"), lines.join("\n"), "utf-8");
+  await (0, import_promises.mkdir)((0, import_path.resolve)("docs"), { recursive: true });
+  await (0, import_promises.writeFile)((0, import_path.resolve)("docs/project-map.mdx"), lines.join("\n"), "utf-8");
 }
 function registerDeployCommand(program3) {
   program3.command("deploy").description("Validate, bundle, upload, and deploy project resources\n  Example: elevasis deploy --api-url http://localhost:5170").option("--api-url <url>", "API URL").option("--entry <path>", "Path to entry file (default: ./src/index.ts)").action(wrapAction("deploy", async (options2) => {
@@ -44336,18 +44319,25 @@ function registerDeployCommand(program3) {
       );
     } catch (error46) {
       authSpinner.fail(source_default.red("Authentication failed"));
-      console.error(source_default.gray("  Check your ELEVASIS_API_KEY and API URL."));
+      const errMsg = error46 instanceof Error ? error46.message : String(error46);
+      if (errMsg.includes("401") || errMsg.toLowerCase().includes("unauthorized")) {
+        console.error(source_default.red("  Invalid API key."));
+        console.error(source_default.gray("  Your ELEVASIS_API_KEY was rejected by the server."));
+        console.error(source_default.gray("  Check your .env file and verify the key in the Elevasis dashboard."));
+      } else {
+        console.error(source_default.gray("  Check your ELEVASIS_API_KEY and API URL."));
+      }
       throw error46;
     }
     const validateSpinner = ora("Validating...").start();
     let org;
     try {
-      const jiti = (0, import_jiti2.createJiti)(import_meta2.url);
-      const entryModule = await jiti.import((0, import_path2.resolve)(entryPath));
+      const jiti = (0, import_jiti.createJiti)(import_meta.url);
+      const entryModule = await jiti.import((0, import_path.resolve)(entryPath));
       org = entryModule.default;
       if (!org) {
         validateSpinner.fail("Invalid entry: no default export found");
-        console.error(source_default.gray(`  Entry file: ${(0, import_path2.resolve)(entryPath)}`));
+        console.error(source_default.gray(`  Entry file: ${(0, import_path.resolve)(entryPath)}`));
         throw new Error("Invalid entry: no default export found");
       }
       new ResourceRegistry({ [orgName]: org });
@@ -44381,9 +44371,10 @@ function registerDeployCommand(program3) {
       }
       throw error46;
     }
+    await generateResourceMap(org);
     await generateProjectMap(org);
     try {
-      await (0, import_promises.unlink)((0, import_path2.resolve)("docs/resource-map.mdx"));
+      await (0, import_promises.unlink)((0, import_path.resolve)("docs/resource-map.mdx"));
     } catch {
     }
     const documentation = await scanDocumentation();
@@ -44459,8 +44450,8 @@ function registerDeployCommand(program3) {
       console.log("");
     }
     const bundleSpinner = ora("Bundling...").start();
-    const wrapperPath = (0, import_path2.resolve)("__elevasis_worker.ts");
-    const bundleOutfile = (0, import_path2.resolve)("dist/bundle.js");
+    const wrapperPath = (0, import_path.resolve)("__elevasis_worker.ts");
+    const bundleOutfile = (0, import_path.resolve)("dist/bundle.js");
     try {
       const entryImport = entryPath.replace(/\.ts$/, ".js");
       const wrapperContent = `import org from ${JSON.stringify(entryImport)}
@@ -44468,7 +44459,7 @@ import { startWorker } from '@elevasis/sdk/worker'
 startWorker(org)
 `;
       await (0, import_promises.writeFile)(wrapperPath, wrapperContent, "utf-8");
-      await (0, import_promises.mkdir)((0, import_path2.resolve)("dist"), { recursive: true });
+      await (0, import_promises.mkdir)((0, import_path.resolve)("dist"), { recursive: true });
       await esbuild.build({
         entryPoints: [wrapperPath],
         bundle: true,
@@ -44557,27 +44548,225 @@ startWorker(org)
   }));
 }
 
+// src/cli/commands/check.ts
+var import_meta2 = {};
+function registerCheckCommand(program3) {
+  program3.command("check").description("Validate project resources against the ResourceRegistry\n  Example: elevasis check --entry ./src/index.ts").option("--entry <path>", "Path to entry file (default: ./src/index.ts)").action(wrapAction("check", async (options2) => {
+    const entryPath = options2.entry ?? "./src/index.ts";
+    const spinner = ora("Validating resources...").start();
+    try {
+      const jiti = (0, import_jiti2.createJiti)(import_meta2.url);
+      const entryModule = await jiti.import((0, import_path2.resolve)(entryPath));
+      const org = entryModule.default;
+      if (!org) {
+        spinner.fail("Invalid entry: no default export found");
+        console.error(source_default.gray(`  Entry file: ${(0, import_path2.resolve)(entryPath)}`));
+        console.error(source_default.gray("  Expected: export default { workflows: [...], agents: [...] }"));
+        throw new Error("Invalid entry");
+      }
+      new ResourceRegistry({ _check: org });
+      const workflowCount = org.workflows?.length ?? 0;
+      const agentCount = org.agents?.length ?? 0;
+      const totalCount = workflowCount + agentCount;
+      spinner.succeed(
+        source_default.green("Validation passed") + source_default.gray(` (${totalCount} resource${totalCount !== 1 ? "s" : ""}, 0 errors)`)
+      );
+      if (workflowCount > 0) {
+        console.log(source_default.gray(`  Workflows: ${workflowCount}`));
+      }
+      if (agentCount > 0) {
+        console.log(source_default.gray(`  Agents:    ${agentCount}`));
+      }
+      const triggerCount = org.triggers?.length ?? 0;
+      const integrationCount = org.integrations?.length ?? 0;
+      const checkpointCount = org.humanCheckpoints?.length ?? 0;
+      if (triggerCount > 0) console.log(source_default.gray(`  Triggers:      ${triggerCount}`));
+      if (integrationCount > 0) console.log(source_default.gray(`  Integrations:  ${integrationCount}`));
+      if (checkpointCount > 0) console.log(source_default.gray(`  Checkpoints:   ${checkpointCount}`));
+      const relationshipCount = org.relationships ? Object.keys(org.relationships).length : 0;
+      if (relationshipCount > 0) {
+        console.log(source_default.gray(`  Relationships: ${relationshipCount}`));
+      }
+      const documentation = await scanDocumentation();
+      if (documentation) {
+        console.log(source_default.gray(`  Docs:          ${documentation.length} file${documentation.length !== 1 ? "s" : ""}`));
+      }
+      const schemaWarnings = [];
+      for (const w of org.workflows ?? []) {
+        if (w.contract.inputSchema) {
+          try {
+            external_exports.toJSONSchema(w.contract.inputSchema);
+          } catch {
+            schemaWarnings.push(`${w.config.resourceId}: inputSchema could not be serialized`);
+          }
+        }
+        if (w.contract.outputSchema) {
+          try {
+            external_exports.toJSONSchema(w.contract.outputSchema);
+          } catch {
+            schemaWarnings.push(`${w.config.resourceId}: outputSchema could not be serialized`);
+          }
+        }
+      }
+      for (const a of org.agents ?? []) {
+        if (a.contract.inputSchema) {
+          try {
+            external_exports.toJSONSchema(a.contract.inputSchema);
+          } catch {
+            schemaWarnings.push(`${a.config.resourceId}: inputSchema could not be serialized`);
+          }
+        }
+        if (a.contract.outputSchema) {
+          try {
+            external_exports.toJSONSchema(a.contract.outputSchema);
+          } catch {
+            schemaWarnings.push(`${a.config.resourceId}: outputSchema could not be serialized`);
+          }
+        }
+      }
+      if (schemaWarnings.length > 0) {
+        console.log("");
+        for (const warning of schemaWarnings) {
+          console.log(source_default.yellow(`  warn  ${warning}`));
+        }
+        console.log(source_default.gray("  Schemas will be unavailable on the platform for these resources."));
+      }
+    } catch (error46) {
+      if (error46 instanceof RegistryValidationError) {
+        spinner.fail(source_default.red("Validation failed"));
+        console.error("");
+        console.error(source_default.red(`  ERROR  ${error46.message}`));
+        if (error46.resourceId) {
+          console.error(source_default.gray(`  Resource: ${error46.resourceId}`));
+        }
+        if (error46.field) {
+          console.error(source_default.gray(`  Field: ${error46.field}`));
+        }
+        console.error("");
+        console.error(source_default.gray("  1 error. Fix the issue and run again."));
+      }
+      throw error46;
+    }
+  }));
+}
+
 // src/cli/commands/exec.ts
+var POLL_INTERVAL_MS = 3e3;
+async function pollForCompletion(resourceId, executionId, apiUrl) {
+  const pollSpinner = ora("Waiting for completion...").start();
+  const startTime = Date.now();
+  const cleanup = () => {
+    pollSpinner.stop();
+    console.log();
+    console.log(source_default.yellow("Polling stopped. Execution continues on server."));
+    console.log(source_default.gray("  Execution ID:"), source_default.cyan(executionId));
+    console.log(source_default.dim("  Check status manually or re-run with --async"));
+    process.exit(0);
+  };
+  process.on("SIGINT", cleanup);
+  while (true) {
+    await new Promise((resolve6) => setTimeout(resolve6, POLL_INTERVAL_MS));
+    const elapsed = Math.round((Date.now() - startTime) / 1e3);
+    pollSpinner.text = `Waiting for completion... (${elapsed}s)`;
+    try {
+      const detail = await apiGet(
+        `/api/external/executions/${resourceId}/${executionId}`,
+        apiUrl
+      );
+      if (detail.status === "completed" || detail.status === "failed") {
+        process.removeListener("SIGINT", cleanup);
+        if (detail.status === "completed") {
+          pollSpinner.succeed(source_default.green(`Execution completed (${elapsed}s)`));
+          console.log(source_default.gray("  Execution ID:"), source_default.cyan(executionId));
+          console.log("");
+          console.log(source_default.green("  Output:"));
+          console.log(JSON.stringify(detail.result, null, 2));
+        } else {
+          pollSpinner.fail(source_default.red(`Execution failed (${elapsed}s)`));
+          console.log(source_default.gray("  Execution ID:"), source_default.cyan(executionId));
+          console.log(source_default.red("  Error:"), detail.error || "Unknown error");
+        }
+        if (detail.startTime && detail.endTime) {
+          console.log("");
+          console.log(source_default.gray("  Duration:"), `${detail.endTime - detail.startTime}ms`);
+        }
+        return;
+      }
+    } catch {
+      process.removeListener("SIGINT", cleanup);
+      pollSpinner.warn("Lost connection while polling");
+      console.log();
+      console.log(source_default.yellow("Could not reach server. Execution may still be running."));
+      console.log(source_default.gray("  Execution ID:"), source_default.cyan(executionId));
+      console.log(source_default.dim("  Check status manually or re-run with --async"));
+      return;
+    }
+  }
+}
 function registerExecCommand(program3) {
   program3.command("exec <resourceId>").description(`Execute a deployed resource
-  Example: elevasis exec my-workflow -i '{"key":"value"}'`).option("-i, --input <json>", "Input data as JSON string").option("--api-url <url>", "API URL").action(wrapAction("exec", async (resourceId, options2) => {
+  Example: elevasis exec my-workflow -i '{"key":"value"}'`).option("-i, --input <json>", "Input data as JSON string").option("--async", "Execute asynchronously with polling").option("--api-url <url>", "API URL").action(wrapAction("exec", async (resourceId, options2) => {
     const input = options2.input ? JSON.parse(options2.input) : {};
     const apiUrl = resolveApiUrl(options2.apiUrl);
-    const spinner = ora(`Executing ${resourceId}...`).start();
-    const result = await apiPost(
-      "/api/external/execute",
-      { resourceId, input },
-      apiUrl
-    );
-    if (result.success) {
-      spinner.succeed(source_default.green("Execution complete"));
-      console.log(source_default.gray("  Execution ID:"), source_default.cyan(result.executionId));
+    if (options2.async) {
+      const asyncSpinner = ora(`Starting async execution of ${resourceId}...`).start();
+      const asyncResult = await apiPost(
+        "/api/external/execute-async",
+        { resourceId, input },
+        apiUrl
+      );
+      asyncSpinner.succeed(source_default.green("Execution started"));
+      console.log(source_default.gray("  Execution ID:"), source_default.cyan(asyncResult.executionId));
       console.log("");
-      console.log(source_default.green("  Output:"));
-      console.log(JSON.stringify(result.data, null, 2));
-    } else {
+      await pollForCompletion(resourceId, asyncResult.executionId, apiUrl);
+      return;
+    }
+    const spinner = ora(`Executing ${resourceId}...`).start();
+    try {
+      const result = await apiPost(
+        "/api/external/execute",
+        { resourceId, input },
+        apiUrl
+      );
+      if (result.success) {
+        spinner.succeed(source_default.green("Execution complete"));
+        console.log(source_default.gray("  Execution ID:"), source_default.cyan(result.executionId));
+        console.log("");
+        console.log(source_default.green("  Output:"));
+        console.log(JSON.stringify(result.data, null, 2));
+      } else {
+        spinner.fail(source_default.red("Execution failed"));
+        console.log(source_default.gray("  Execution ID:"), source_default.cyan(result.executionId));
+      }
+    } catch (error46) {
+      const message = error46 instanceof Error ? error46.message : String(error46);
+      const isConnectionFailure = message.includes("fetch failed") || message.includes("ECONNRESET") || message.includes("socket hang up") || message.includes("network");
+      if (isConnectionFailure) {
+        spinner.warn("Connection lost -- execution may still be running");
+        console.log();
+        try {
+          const recoverSpinner = ora("Recovering execution...").start();
+          const listResult = await apiGet(
+            `/api/external/executions/${resourceId}?limit=1`,
+            apiUrl
+          );
+          const running = listResult.executions.find((e) => e.status === "running");
+          if (running) {
+            recoverSpinner.succeed(`Found running execution: ${running.id}`);
+            console.log();
+            await pollForCompletion(resourceId, running.id, apiUrl);
+          } else {
+            recoverSpinner.info("No running execution found -- it may have already completed");
+            console.log(source_default.dim("  Check status manually or re-run with --async"));
+          }
+        } catch {
+          console.log(source_default.yellow("Could not recover. The execution may still be running on the server."));
+          console.log(source_default.dim("  Check status manually or re-run with --async"));
+        }
+        process.exit(0);
+      }
       spinner.fail(source_default.red("Execution failed"));
-      console.log(source_default.gray("  Execution ID:"), source_default.cyan(result.executionId));
+      throw error46;
     }
   }));
 }
@@ -44889,7 +45078,7 @@ var import_path3 = require("path");
 var import_promises2 = require("fs/promises");
 
 // src/cli/commands/templates/core/workspace.ts
-var TEMPLATE_VERSION = 14;
+var TEMPLATE_VERSION = 21;
 function configTemplate() {
   return `import type { ElevasConfig } from '@elevasis/sdk'
 
@@ -45041,7 +45230,157 @@ elevasis exec echo --input '{"message": "hello"}'
 
 // src/cli/commands/templates/core/claude.ts
 function claudeSettingsTemplate() {
-  return JSON.stringify({ autoCompact: false }, null, 2) + "\n";
+  return JSON.stringify({
+    autoCompact: false,
+    hooks: {
+      PreToolUse: [
+        {
+          matcher: "Write|Edit|MultiEdit|Bash",
+          hooks: [
+            {
+              type: "command",
+              command: "node .claude/hooks/enforce-sdk-boundary.mjs"
+            }
+          ]
+        }
+      ]
+    }
+  }, null, 2) + "\n";
+}
+function claudeSdkBoundaryHookTemplate() {
+  return String.raw`#!/usr/bin/env node
+// enforce-sdk-boundary.mjs
+// Blocks gh CLI, destructive git operations, and file writes outside the project root.
+// Allows git add, commit, push, pull, fetch -- used by /meta deploy.
+
+import { resolve, normalize } from "node:path";
+import { appendFileSync, mkdirSync } from "node:fs";
+
+const LOG_DIR = (process.env.CLAUDE_PROJECT_DIR ?? process.cwd()) + "/.claude/logs";
+const LOG_FILE = LOG_DIR + "/boundary-hook.log";
+
+function log(msg) {
+  try {
+    mkdirSync(LOG_DIR, { recursive: true });
+    appendFileSync(LOG_FILE, "[" + new Date().toISOString() + "] " + msg + "\n");
+  } catch {}
+}
+
+function deny(reason) {
+  log("DENY -- " + reason);
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: reason,
+      },
+    })
+  );
+}
+
+try {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  const input = JSON.parse(Buffer.concat(chunks).toString());
+
+  const projectDir = normalize(process.env.CLAUDE_PROJECT_DIR ?? process.cwd());
+  const sep = process.platform === "win32" ? "\\" : "/";
+  const prefix = projectDir.endsWith("\\") || projectDir.endsWith("/") ? projectDir : projectDir + sep;
+
+  function isOutside(filePath) {
+    const target = normalize(resolve(filePath));
+    return !target.startsWith(prefix) && target !== projectDir;
+  }
+
+  if (input.tool_name === "Bash") {
+    const cmd = input.tool_input?.command ?? "";
+
+    // GitHub CLI -- blocked (affects shared remote state, user-initiated only)
+    if (/\bgh\b/.test(cmd)) {
+      deny(
+        "BLOCKED: GitHub CLI (gh) command detected.\n" +
+        "WHY: GitHub CLI operations affect shared remote state (PRs, issues, releases). These must be user-initiated.\n" +
+        "INSTEAD: Ask the user to run this gh command manually."
+      );
+      process.exit(0);
+    }
+
+    // Destructive git -- blocked
+    if (/(?<!-)\bgit\s+reset\b/.test(cmd) && /--hard/.test(cmd)) {
+      deny(
+        "BLOCKED: git reset --hard detected.\n" +
+        "WHY: Hard resets destroy uncommitted work and cannot be undone. This must be user-initiated.\n" +
+        "INSTEAD: Ask the user to run this git command manually."
+      );
+      process.exit(0);
+    }
+
+    if (/(?<!-)\bgit\s+clean\b/.test(cmd) && /-[a-zA-Z]*f/.test(cmd)) {
+      deny(
+        "BLOCKED: git clean -f detected.\n" +
+        "WHY: Force-cleaning the working tree permanently removes untracked files. This must be user-initiated.\n" +
+        "INSTEAD: Ask the user to run this git command manually."
+      );
+      process.exit(0);
+    }
+
+    if (/(?<!-)\bgit\s+(rebase|merge)\b/.test(cmd)) {
+      deny(
+        "BLOCKED: git rebase/merge detected.\n" +
+        "WHY: Rebase and merge rewrite history or combine branches in ways that require user judgment.\n" +
+        "INSTEAD: Ask the user to run this git command manually."
+      );
+      process.exit(0);
+    }
+
+    // Path-scoped blocks -- destructive commands or redirects outside project root
+    const winPaths = cmd.match(/(?<![A-Za-z])[A-Za-z]:[/\\][^\s"'|;&)]+/g) || [];
+    const unixPaths = cmd.match(/(?<=\s|^|"|')\/[^\s"'|;&)]+/g) || [];
+    const allPaths = [...winPaths, ...unixPaths]
+      .map((p) => p.trim())
+      .filter((p) => !p.startsWith("/dev/"));
+
+    const outsidePaths = allPaths.filter((p) => isOutside(p));
+
+    if (outsidePaths.length > 0) {
+      const hasDestructiveCmd = /(?<![-])\b(rm|rmdir|del|unlink|mv|cp|touch|mkdir|chmod|chown|truncate|tee|dd|install)\b/.test(cmd);
+      const hasInPlaceEdit = /\bsed\b.*\s-i/.test(cmd);
+      const hasRedirect = />{1,2}\s*[^\s&>]/.test(cmd);
+
+      const hasTempPath = outsidePaths.some(
+        (p) => /[/\\]tmp[/\\]/i.test(p) || /[/\\]Temp[/\\]/i.test(p)
+      );
+
+      if (hasDestructiveCmd || hasInPlaceEdit || hasRedirect) {
+        const instead = hasTempPath
+          ? "INSTEAD: Use pipes instead of temp files: cmd 2>&1 | grep pattern  not  cmd > /tmp/out.txt. All file writes must target paths inside the project."
+          : "INSTEAD: Only files within the project directory may be modified. Ask the user to run this command manually if external paths are needed.";
+
+        deny(
+          "BLOCKED: destructive command references path(s) outside the project: " + outsidePaths.join(", ") + ".\n" +
+          "WHY: File modifications outside the project boundary are not allowed.\n" +
+          instead
+        );
+      }
+    }
+  } else {
+    // Write, Edit, MultiEdit: check file_path
+    const filePath = input.tool_input?.file_path;
+    if (filePath && isOutside(filePath)) {
+      deny(
+        "BLOCKED: " + filePath + " is outside the project.\n" +
+        "WHY: [" + (input.tool_name ?? "Unknown") + "] file operations outside the project boundary are not allowed.\n" +
+        "INSTEAD: Only files within the project directory may be modified."
+      );
+    }
+  }
+} catch (err) {
+  log("ERROR: " + err.message + "\n" + err.stack);
+}
+
+process.exit(0);
+`;
 }
 function claudeMdTemplate(ctx = {}) {
   return `<!-- initialized: false -->
@@ -45063,8 +45402,10 @@ At the start of every session:
 3. Check installed \`@elevasis/sdk\` template version against \`templateVersion\`
    in \`elevasis.config.ts\`. If newer, notify and suggest \`/meta update\`.
 4. If \`.claude/memory/\` does not exist, suggest \`/meta init\`.
-5. If user TypeScript level is beginner (from skills.md) and
+5. If user Platform Navigation level is none (from skills.md) and
    \`.claude/memory/tutorial-progress.md\` does not exist, suggest \`/tutorial\`.
+   If tutorial-progress.md exists and Phase is not complete, mention that the
+   tutorial has more to explore.
 
 Do this silently. Do not narrate the steps to the user.
 
@@ -45092,8 +45433,10 @@ proactivity -- to their assessed levels.
 | Interaction guidance | \`reference/developer/interaction-guidance.mdx\` | Unsure how to adapt for a skill combination |
 | Error history | \`.claude/memory/errors/index.md\` | Debugging errors, checking past fixes |
 | Command View model | \`reference/deployment/command-view.mdx\` | Deploying or building resources that invoke other resources |
+| Command Center UI reference | \`reference/deployment/command-center-ui.mdx\` | User asks about post-deployment UI or Command Center navigation |
 | SDK error reference | \`reference/troubleshooting/common-errors.mdx\` | Unknown error not in workspace memory |
 | Project map | \`docs/project-map.mdx\` | Session start, project orientation |
+| Resource inventory | \`docs/resource-map.mdx\` | Finding a specific resource by name or ID |
 | Project priorities | \`docs/priorities.mdx\` | Deciding what to work on next |
 | User profile and skills | \`.claude/memory/profile/skills.md\` | Session start (mandatory) |
 | Cross-session memory | \`.claude/memory/index.md\` | Session start, recalling past context |${ctx.hasUI ? `
@@ -45108,6 +45451,7 @@ SDK patterns (imports, source structure, platform tools) are auto-loaded from
 \`.claude/rules/workspace-patterns.md\`.
 
 - Documentation goes in \`docs/\` as \`.mdx\` files
+- Resources are not visible in the Command Center until deployed. Always deploy before directing users to verify in the UI.
 
 ### Error Handling
 
@@ -45136,10 +45480,10 @@ based on what you find.
 
 - Match vocabulary to the user's level. Avoid jargon for beginners;
   be precise for experts. Define technical terms in parentheses the first time.
-- Show complete, working files for users below intermediate programming.
-  Never show code fragments they can't place.
+- Provide step-by-step UI navigation for users with Platform Navigation below comfortable.
+  Reference exact page names and paths until they are oriented.
 - Explain "why" before "how" for users new to automation.
-- For users comfortable with code, focus on SDK-specific patterns.
+- For users comfortable with the platform, focus on SDK-specific patterns and advanced operations.
 - Leverage domain expertise -- if the user knows sales but not code,
   ask for business process descriptions and translate.
 - When growth is observed, note it in the skills.md Growth Log.
@@ -45152,9 +45496,8 @@ For detailed per-dimension adaptation rules, read
 | Command | Purpose |
 | --- | --- |
 | \`/meta\` | Project lifecycle: init, status, fix, deploy, health |
-| \`/docs\` | Documentation lifecycle: create, review, verify |
 | \`/work\` | Task tracking: create, save, resume, complete |
-| \`/tutorial\` | Progressive learning path |
+| \`/tutorial\` | Progressive learning path (7 core lessons + 9 modules) |
 
 ## Skills
 
@@ -45200,122 +45543,539 @@ Do not store in \`.claude/memory/\`:
 - If an error pattern recurs 3+ times, promote to Rules above
 `;
 }
-function claudeDocsCommandTemplate() {
-  return `# /docs command
+function claudeTutorialCommandTemplate() {
+  return `# /tutorial command
 
-You are a documentation assistant for this Elevasis workspace.
+You are a tutorial guide for this Elevasis workspace.
 
 ## Context
 
-Read the project's CLAUDE.md and all files in docs/ to understand the project.
-Read src/index.ts and the domain directories (src/operations/, src/example/, etc.) to understand the resource definitions.
+Read \`.claude/memory/profile/skills.md\` first. The \`automation\` skill level
+controls which docs you load and which lesson variant you deliver.
 
-## Operations
+**automation: none**
+- Load from \`reference/concepts/index.mdx\`: Glossary, What is a Workflow,
+  Platform Tools Overview only. Skip Zod, Execution Model, Design Decisions.
+- Load \`reference/deployment/command-center-ui.mdx\` for UI-first teaching.
+- Do NOT load \`reference/resources/patterns.mdx\` or
+  \`reference/platform-tools/adapters.mdx\` during core lessons.
 
-**No arguments (default):** Review existing docs/ files and suggest improvements.
-Identify undocumented resources, missing descriptions, and structural gaps.
+**automation: low-code**
+- Load all sections of \`reference/concepts/index.mdx\`.
+- Load \`reference/resources/patterns.mdx\` with Zapier/Make mapping in mind.
+- Load \`reference/platform-tools/adapters.mdx\` on-demand (when tools are used).
 
-**\`create <page-name>\`:** Create a new documentation page in docs/.
-Use the frontmatter schema (title, description, order).
-Populate with content based on the resource definitions in src/.
+**automation: custom**
+- Load all docs listed per-lesson and per-module as specified below.
 
-**\`review\`:** Review all docs/ files for accuracy against the actual resource
-definitions. Flag mismatches between documented schemas and code.
+Read \`.claude/memory/tutorial-progress.md\` to check current lesson progress.
 
-**\`verify [path]\`:** Cross-reference documentation with the codebase.
-Read the specified doc (or all docs if no path), compare claims against actual
-code (resource IDs, schema fields, platform tools used), and report
-discrepancies. Useful before \`/meta deploy\` to ensure docs are accurate.
-`;
-}
-function claudeTutorialCommandTemplate() {
-  return `# /tutorial command
+## Invocation
 
-You are a tutorial guide for this Elevasis workspace.
+\`/tutorial\` -- ALWAYS shows the main menu first. Never silently auto-resumes without giving the user a choice. See ## Menu section for the exact menu format.
 
-## Context
+## Menu
 
-Read \`.claude/memory/profile/skills.md\` to adapt lesson pacing and vocabulary.
-Read \`.claude/memory/tutorial-progress.md\` to check current lesson progress.
-Read \`reference/concepts/index.mdx\` for teaching vocabulary and concept definitions.
+When \`/tutorial\` is invoked:
 
-## Invocation
+1. Read \`.claude/memory/tutorial-progress.md\` (if it exists)
+2. Display the appropriate menu:
+
+**No progress (first time):**
+
+\`\`\`
+Welcome to the Elevasis Tutorial!
+==================================
+
+What would you like to learn?
+
+1. Orchestration Concepts (Core Path)
+   Build workflows step-by-step: data schemas, platform tools,
+   multi-step flows, decision points, and production deployment.
+   7 lessons -- estimated 2-3 hours total.
+
+2. Examples & Advanced Modules
+   Hands-on deep-dives: human-in-the-loop, scheduling,
+   notifications, integrations, LLM, agents, and more.
+   9 standalone modules -- pick any order.
+
+3. Meta-Framework
+   Learn the Claude Code context system: /meta, /work,
+   rules, memory, and how to customize your workspace.
+   5 lessons -- estimated 1-2 hours total.
+
+Pick a number to start, or say "status" to see your progress.
+\`\`\`
 
-- \`/tutorial\` -- Resume from current lesson. If no progress exists, start Lesson 1.
-- \`/tutorial start\` -- Reset progress and begin from Lesson 1.
-- \`/tutorial <number>\` -- Jump to a specific lesson (1-7).
+**With existing progress:**
+
+Show active tracks at the top, then offer resume options alongside new choices. Example:
+
+\`\`\`
+Progress: Core Path (Lesson 4/7) | Meta-Framework (MF2/5)
+
+1. Resume Orchestration Concepts (Lesson 4)
+2. Orchestration Concepts (Core Path -- start over)
+3. Examples & Advanced Modules
+4. Resume Meta-Framework (MF2)
+5. Meta-Framework (start over)
+6. Show full status
+
+Pick a number, or describe what you'd like to learn.
+\`\`\`
+
+After user picks:
+- Orchestration Concepts: Resume or start core lesson flow
+- Examples & Advanced Modules: Show module menu (see ## Module Menu)
+- Meta-Framework: Resume or start MF1 (see ## Meta-Framework Track)
+- "status": Display Phase, current position, completion counts
+
+## Progress Logic
+
+1. Read \`.claude/memory/tutorial-progress.md\`
+2. Show the menu (## Menu section) with progress summary if progress exists
+3. After user picks a track:
+   - **Orchestration Concepts**: If Completed Lessons < 7 -> start/resume at Current Lesson; if 7 complete -> note completion, offer module menu or repeat
+   - **Examples & Advanced Modules**: Show module menu (## Module Menu section)
+   - **Meta-Framework**: If Current MF Lesson is set -> resume at that lesson; otherwise start MF1
+4. Track completion: mark the track done in progress file when all lessons/modules complete
+5. If all three tracks complete -> set Phase to \`complete\`, congratulate, suggest exploring docs/ or /work
 
 ## Lesson Flow
 
 Each lesson follows this flow:
 1. Announce lesson title and what they'll learn (1-2 sentences)
-2. Explain the concept (read concepts page, adapt to skill level)
-3. Guide user to build or modify something (show complete code for beginners)
-4. Verify it works (run CLI command, check output)
+2. Explain the concept (read docs per skill level, adapt to user)
+3. Guide user to build or modify something (agent writes all code for automation: none)
+4. Verify it works (Execution Runner is primary for none; CLI + UI are equal for others)
 5. Celebrate success, record observations in \`.claude/memory/tutorial-progress.md\`
 6. Ask: "Ready for the next lesson, or want to practice more?"
 
 ## Lessons
 
 **Lesson 1: Welcome & Orientation**
+
+When automation is none:
+Skip the file tour. Start with what Elevasis does for their business -- use analogies
+from \`reference/developer/interaction-guidance.mdx\` (recipe, assembly line, kitchen
+appliance). Explain deployment plainly: "You write the recipe here, then deploy it so
+it's live." Deploy the starter echo workflow (\`elevasis check\` + \`elevasis deploy\`),
+THEN tour the Command Center so the user sees populated pages, not empty ones. Tour:
+Command View (echo node), Execution Runner (run echo from form), Execution Logs (result).
+Observation focus: automation value understanding, Command Center comfort.
+
+When automation is low-code or custom:
 Tour project files: src/index.ts (registry), src/example/echo.ts (starter
 workflow), src/operations/platform-status.ts (platform API example),
 elevasis.config.ts, .env, docs/. Explain the execution model.
-Verify: run \`elevasis resources\`. Observation focus: cloud deployment model.
+Verify: run \`elevasis resources\`. Then open the Command Center and tour the
+main pages: Command View (resource graph), Execution Runner, Execution Logs.
+Point out the echo workflow node in Command View.
+Observation focus: cloud deployment model, UI navigation comfort.
 
 **Lesson 2: Your First Custom Workflow**
+
+When automation is none:
+Frame the workflow as "a recipe." Use plain language: "settings" not "config",
+"what data it needs" not "contract", "instructions" not "steps", "where it starts"
+not "entryPoint." Agent writes all code changes. Execution Runner form is PRIMARY
+verification -- show user how to fill the form and run it. CLI is secondary:
+"here's the power user way." Observation focus: recipe-to-result connection, form comfort.
+
+When automation is low-code or custom:
 Modify the echo workflow. Walk through each part: config, contract, steps,
 entryPoint. Deploy: \`elevasis check\` then \`elevasis deploy\`. Test with
-\`elevasis exec echo --input '{"message":"hello"}'\`.
-Observation focus: TypeScript syntax comfort.
+\`elevasis exec echo --input '{"message":"hello"}'\`. Then open the Execution
+Runner in the Command Center, find the echo workflow, fill out the form, and
+run it from the UI. Compare the result to the CLI output.
+Observation focus: deployment-to-execution loop, TypeScript syntax comfort.
 
 **Lesson 3: Understanding Data (Schemas)**
+
+When automation is none:
+Frame as "What information does your automation need?" Each piece becomes a form
+field. Describe types in plain English: text, number, yes/no, a choice from a list.
+NO Zod, no z.string(), no z.infer(), no code shown. Agent reads identity.md goals
+and writes the workflow schema. User fills the form in Execution Runner to verify.
+Observation focus: data-to-form connection, required vs optional understanding.
+
+When automation is low-code:
+"Field mapping like Zapier, but with validation." Show Zod types briefly. Demonstrate
+how \`.describe()\` sets the form field label. Build schema based on identity.md goals.
+After deploy, open Execution Runner and point out each field.
+Observation focus: schema-to-form connection, optional fields, types.
+
+When automation is custom:
 Explain schemas in plain English (concepts page). Show common Zod types.
 Explain \`z.infer\`. Build a new workflow with real-world input schema based
-on the user's goals (read .claude/memory/profile/identity.md).
-Observation focus: optional fields, types, suggesting own fields.
+on the user's goals (read .claude/memory/profile/identity.md). After deploy,
+open the Execution Runner and show how each Zod field becomes a form control.
+Point out how \`.describe()\` sets the field label.
+Observation focus: schema-to-form connection, optional fields, types.
 
 **Lesson 4: Using Platform Tools**
+
+When automation is none:
+Frame as "Connecting your automation to a service you already use." Pick ONE
+service from identity.md tools. Agent makes the code edit -- no adapter or
+singleton explanation, no imports shown. Guide credential creation step-by-step
+via Command Center UI (Settings > Credentials). Show where the connection appears
+in Command View after deploy.
+Observation focus: service-connection concept, credential comfort.
+
+When automation is low-code or custom:
 Explain platform tools (concepts page). Browse available tools via
 reference/platform-tools/index.mdx. Pick a tool based on user's goals.
 Build: add a tool step using typed adapters (preferred) or platform.call().
 Show adapter pattern: \`const attio = createAttioAdapter('cred')\`.
 Show singleton pattern: \`import { scheduler, llm } from '@elevasis/sdk/worker'\`.
-Explain credential setup. See reference/platform-tools/adapters.mdx for full API.
-Observation focus: credential model, async/await.
+Guide credential creation: for API keys, use the \`creds\` skill or Settings >
+Credentials in the Command Center. For OAuth credentials, the UI is required.
+If using the approval tool, note that pending requests surface in Command Queue.
+See reference/platform-tools/adapters.mdx for full API.
+Observation focus: credential setup (CLI + UI), async/await.
 
 **Lesson 5: Multi-Step Workflows**
+
+When automation is none:
+Frame as "Step 1 passes its result to Step 2, like a relay race." Command View is
+PRIMARY teaching tool -- show the visual graph before explaining code. Agent builds
+the 2-step workflow. User verifies in Command View (see the two nodes + arrow) and
+Execution Runner (see output flow). Code is secondary.
+Observation focus: relay-race concept, visual graph comprehension.
+
+When automation is low-code or custom:
 Chain steps with StepType.LINEAR. Build a 2-step workflow. Explain data
-flow between steps. Deploy and test.
-Observation focus: data flow reasoning.
+flow between steps. Deploy and test. Then open the Command View and show the
+relationship edges between resources. Explain how declared relationships map
+to the visual graph.
+Observation focus: data flow reasoning, relationship visualization.
 
 **Lesson 6: Decision Points**
+
+When automation is none:
+Frame as "If the customer is VIP, do this -- otherwise, do that." No StepType.CONDITIONAL
+jargon -- focus on the concept, not the implementation. Agent adds the condition.
+User tests both paths via Execution Runner, then opens Execution Logs to see which
+path ran. Guide log navigation step-by-step.
+Observation focus: branching concept understanding, log navigation.
+
+When automation is low-code or custom:
 Conditional routing with StepType.CONDITIONAL. Add a condition to the
-multi-step workflow from Lesson 5. Test both paths.
-Observation focus: branching logic reasoning.
+multi-step workflow from Lesson 5. Test both paths. After testing, open
+Execution Logs in the Command Center, filter by the resource, and show how
+each path appears in the log detail (step trace, input/output).
+Observation focus: branching logic reasoning, execution log interpretation.
 
 **Lesson 7: Going to Production**
-Change status from dev to production. Show monitoring: elevasis executions,
-elevasis execution. Cover error handling: try/catch, ExecutionError,
-PlatformToolError. Suggest next steps based on goals.
-Observation focus: readiness for independent development.
+
+When automation is none:
+Frame as "draft vs live" not "dev vs production." Error handling: "when something
+goes wrong with your data" / "when a connected service fails" -- no type names.
+Task Scheduler and Knowledge Base stay as-is (UI-friendly already). Open Deployments
+page to show version is active.
+Observation focus: draft/live concept, readiness for independent Command Center use.
+
+When automation is low-code or custom:
+Change status from dev to production. Cover error handling: try/catch,
+ExecutionError, PlatformToolError. Create a schedule in Task Scheduler (use
+Recurring type for a cron schedule). If docs/ has pages, show Knowledge Base.
+Open Deployments page to confirm the latest version is active. Show CLI
+monitoring: elevasis executions, elevasis execution. Suggest next steps.
+Observation focus: readiness for independent operation (CLI + UI).
+
+## Module Menu
+
+Fixed module order: hitl, schedules, notifications, integrations, workflows,
+composition, llm, agents, error-handling.
+
+Show the next 2-3 uncompleted modules from the list. Format:
+
+"Core path complete! Here are your next modules:"
+1. <Title> -- <one-line description>
+2. <Title> -- <one-line description>
+3. <Title> -- <one-line description>
+"Pick a number to start, or say 'show more' to see additional modules."
+
+If all 9 modules are complete -> set Phase to \`complete\`, congratulate.
+
+## Module Flow
+
+Each module follows this flow:
+1. Announce module title and what they'll build (1-2 sentences)
+2. Read the listed SDK reference docs for teaching context
+3. Guide user to build a resource exercising the module's concepts
+4. Verify it works (CLI + Command Center where applicable)
+5. Record observations in \`.claude/memory/tutorial-progress.md\`
+6. Return to module menu (show next uncompleted modules)
+
+## Modules
+
+**Module: hitl -- Human-in-the-Loop**
+Read: \`reference/deployment/command-center-ui.mdx\` (Command Queue section).
+Build: Add an approval gate using \`approval.requestApproval()\`. Test full lifecycle:
+trigger, see pending in Command Queue, approve/reject, observe resume.
+Key concepts: approval adapter, pending state, Command Queue UI, resume on decision.
+Verify: Trigger workflow, open Command Queue, approve, confirm completion.
+
+**Module: schedules -- Task Scheduling**
+Read: \`reference/deployment/command-center-ui.mdx\` (Task Scheduler section).
+Build: Create all three schedule types (Recurring cron, Relative delay, Absolute
+datetime). Use \`scheduler\` adapter for in-workflow scheduling.
+Key concepts: schedule types, cron syntax, scheduler adapter, Task Scheduler UI.
+Verify: Create each type in Task Scheduler, confirm scheduled execution in Execution Logs.
+
+**Module: notifications -- Notification System**
+Read: \`reference/platform-tools/adapters.mdx\` (notifications, email singletons).
+Build: Add notification and email steps to a workflow. Send alerts on completion.
+Key concepts: notifications singleton, email singleton, alert patterns.
+Verify: Run workflow, check notification in Command Center, confirm email received.
+
+**Module: integrations -- Real-World Integrations**
+Read: \`reference/platform-tools/index.mdx\`, \`reference/platform-tools/adapters.mdx\`,
+\`reference/security/credentials.mdx\`.
+Build: Pick a real integration adapter based on user's goals (read \`identity.md\`).
+Set up credential (OAuth via UI, API key via CLI). Build end-to-end integration workflow.
+Key concepts: adapter pattern, credential scoping, error handling for external calls.
+Verify: Run workflow with real credential, confirm external service call, test error
+handling with invalid credential.
+
+**Module: workflows -- Advanced Workflows**
+Read: \`reference/resources/patterns.mdx\` (execution store, logging, organizing).
+Build: Refactor an existing workflow to use \`context.store\` for cross-step data,
+\`context.logger\` for structured logging, and organize into a domain directory.
+Add advanced schema patterns (nested objects, arrays, optional fields).
+Key concepts: context.store, context.logger, domain organization, schema depth.
+Verify: Run workflow, confirm store values in step output, check logs in Execution Logs.
+
+**Module: composition -- Resource Composition**
+Read: \`reference/deployment/command-view.mdx\`, \`reference/resources/patterns.mdx\`.
+Build: Create two workflows where the first triggers the second using
+\`execution.trigger()\`. Declare the relationship.
+Key concepts: execution.trigger, relationship declarations, Command View graph edges.
+Verify: Deploy, see relationship edge in Command View, trigger parent and confirm
+child executes.
+
+**Module: llm -- LLM Integration**
+Read: \`reference/platform-tools/adapters.mdx\` (llm singleton).
+Build: Create a workflow step using \`llm.generate()\` with structured output.
+Experiment with model selection and temperature.
+Key concepts: llm singleton, structured output, model selection, temperature.
+Verify: Run workflow, compare outputs with different settings, confirm structured output.
+
+**Module: agents -- AI Agents**
+Read: \`reference/framework/agent.mdx\`.
+Build: Create an agent definition with tools. Configure LLM tool calling.
+Compare agent vs workflow for a task.
+Key concepts: agent definition, tool registration, LLM tool calling, execution trace.
+Verify: Run agent with \`elevasis exec\`, review tool call trace in Execution Logs.
+
+**Module: error-handling -- Error Handling Mastery**
+Read: \`reference/resources/patterns.mdx\` (error handling),
+\`reference/troubleshooting/common-errors.mdx\`.
+Build: Create a workflow demonstrating all three error types. Add try/catch,
+\`context.logger\`, and error recovery.
+Key concepts: ExecutionError, PlatformToolError, ToolingError, recovery patterns.
+Verify: Trigger each error type, confirm messages in Execution Logs with correct
+categorization.
+
+## Meta-Framework Track
+
+The Meta-Framework track teaches you how the Claude Code workspace works -- the commands,
+rules, memory system, and customization model. It is independent of the core path and
+can be taken in any order.
+
+**MF1: The Agent Framework -- How This Workspace Works**
+
+When automation is none:
+"This workspace comes with a built-in assistant that knows your project, your tools,
+and your goals. Let me show you how it's set up." Open CLAUDE.md and explain in
+plain terms: it's the agent's instruction sheet. Point out the commands in the
+Commands table. Show /meta, /tutorial, /work. Explain the creds skill as
+"the assistant automatically helps when you mention API keys." Tour the memory folder
+at a high level -- "this is where the agent stores what it learns about your project."
+Verify: Ask the user a question about their business goal and show how the agent
+references their profile in the answer.
+Observation focus: agent-as-assistant concept, CLAUDE.md as instruction sheet.
+
+When automation is low-code:
+Read CLAUDE.md and walk through each section. Explain: what the agent reads on
+session start, how the navigation table works, what the Skills section means.
+Explain the four commands briefly. Show that the agent has memory: open
+\`.claude/memory/profile/skills.md\` and show their own profile -- "every session,
+the agent reads this and adapts." Explain the initialized flag.
+Verify: Run /meta to see project status.
+Observation focus: memory system concept, session initialization flow.
+
+When automation is custom:
+Read CLAUDE.md in full. Explain the session initialization sequence: CLAUDE.md ->
+navigation table -> memory files -> context loading. Walk through: Commands section
+(4 commands + creds skill), Rules section (auto-loaded based on file paths), Skills
+section (auto-triggered by content patterns). Point out the initialized flag and
+explain how /meta init set it.
+Verify: Run /meta to see project status; observe which fields it reports.
+Observation focus: initialization model, command-vs-rule-vs-skill distinction.
+
+**MF2: The /meta Command -- Project Lifecycle**
+
+When automation is none:
+"Think of /meta as your project dashboard -- it shows what's healthy and what needs
+attention." Run /meta (no arguments) and narrate the output in plain language: what
+each field means. Explain /meta fix as "the agent tidies up and applies updates."
+Explain /meta deploy as "the agent publishes your changes in one step." Briefly note
+/meta health shows what happened when something goes wrong.
+Verify: Run /meta (no arguments). Narrate the output together.
+Observation focus: project lifecycle concept, dashboard reading.
+
+When automation is low-code:
+Show all /meta operations with their purpose. Map to familiar concepts: /meta fix is
+like "repair this Zap" in Zapier; /meta deploy is a one-command publish pipeline.
+Walk through the /meta (no-args) output: template version (SDK template your workspace
+uses), SDK version (installed package), profile summary, drift check.
+Verify: Run /meta and interpret each field together.
+Observation focus: deploy pipeline understanding, version tracking.
+
+When automation is custom:
+Read \`.claude/commands/meta.md\`. Walk through each operation: init (first-run setup
+with assessment), (no-args) (status dashboard), fix (drift repair + SDK upgrade +
+rules health), deploy (7-step pipeline: check, typecheck, docs, git, deploy,
+project-map, verify), health (runtime diagnostics). Explain the merge strategy for
+CLAUDE.md and commands. Note the template access model: templates read from
+@elevasis/sdk/templates subpath.
+Verify: Run /meta to see project status. Identify what a version mismatch looks like.
+Observation focus: full lifecycle coverage, pipeline internals.
+
+**MF3: /work -- Task Lifecycle**
+
+When automation is none:
+"You can ask the assistant to track work across conversations. When you start something
+complex, use /work create to save your place. Next session, /work resume picks up where
+you left off." Walk through the concept without deep command details. Show docs/ -- explain
+it's where project notes live.
+Verify: Create a task with \`/work create "practice task"\`, then run /work to see it listed.
+Observation focus: persistence concept, cross-session continuity.
+
+When automation is low-code:
+Show /work operations: create (task doc with frontmatter + sections), save (updates
+Progress + Resume Context), resume (loads context for next session).
+Explain how task docs persist: they're workspace files, not memory -- they survive
+session compaction.
+Verify: Create a task with \`/work create "practice task"\`, run /work save, inspect the file.
+Observation focus: task tracking workflow, doc creation pattern.
+
+When automation is custom:
+Read \`.claude/commands/work.md\`. Full coverage:
+/work create (kebab-case filename, frontmatter with status, Objective/Plan/Progress/
+Resume Context sections), /work save (Progress + Resume Context update), /work resume
+(multiple-task disambiguation), /work complete (moves to final location).
+Explain how Resume Context serves as the session handoff artifact.
+Verify: Create a task doc, save progress, inspect the generated file structure.
+Observation focus: task doc anatomy, resume context as handoff pattern.
+
+**MF4: Rules, Memory, and Customization**
+
+When automation is none:
+"The assistant has a set of reminders specific to your project. Over time, when it
+makes the same mistake 3 times, you can tell it to always remember that rule -- it
+lives in a file so the rule sticks across conversations."
+Show \`.claude/rules/workspace-patterns.md\` without technical detail. Explain: "This
+is where YOUR project's rules go. The other rule files are updated automatically by
+SDK releases."
+Verify: Open \`.claude/rules/workspace-patterns.md\` and read the current content together.
+Observation focus: customization concept, owned vs managed files.
+
+When automation is low-code:
+Show the \`.claude/rules/\` directory. Explain the two types: sdk-patterns.md (MANAGED --
+updated by elevasis update) and workspace-patterns.md (INIT_ONLY -- yours to edit).
+Explain path-scoping briefly: "These rules only activate when the agent is working on
+certain file types." Show an example rule with WRONG/RIGHT pattern. Explain error
+promotion: if something goes wrong 3+ times, add it here.
+Verify: Read \`.claude/rules/workspace-patterns.md\`. Note the "When to Add a Rule" section.
+Observation focus: two-tier ownership model, rule format.
+
+When automation is custom:
+Read \`.claude/rules/sdk-patterns.md\` and \`.claude/rules/workspace-patterns.md\`.
+Explain MANAGED vs INIT_ONLY lifecycle. Show rule frontmatter structure (paths: for
+auto-loading by the agent). Explain the memory system layout: \`.claude/memory/\`
+(index.md root, profile/ subdirectory, errors/ for promoted issues,
+tutorial-progress.md). Explain error promotion: 3+ recurrences -> rule in
+workspace-patterns.md. Walk through how to add a new rule.
+Verify: Read \`.claude/rules/workspace-patterns.md\`. Add a sample rule entry together.
+Observation focus: MANAGED vs INIT_ONLY lifecycle, rule authoring, memory layout.
+
+**MF5: Advanced -- Template Lifecycle and Extending**
+
+When automation is none:
+"When Elevasis SDK releases updates, the assistant can apply them to your workspace
+automatically. You don't have to redo your customizations." Explain /meta fix as
+the command that applies updates. Skip technical file classification details.
+Show \`docs/project-map.mdx\` briefly: "This is an auto-generated map of everything
+in your project -- the agent uses it for navigation."
+Verify: Run /meta fix (or explain what it would do). Check \`docs/project-map.mdx\`.
+Next steps: point to reference docs in docs/, encourage using /work for new tasks.
+Observation focus: update model concept, project map as navigation aid.
+
+When automation is low-code:
+Explain MANAGED (auto-updated by elevasis update) vs INIT_ONLY (set once, yours).
+Show how /meta fix applies SDK updates with conflict handling: "If a file changed,
+it shows you both versions and lets you decide."
+Show \`docs/project-map.mdx\` and explain what it contains: resources, commands,
+rules, memory index. Note that deploy auto-regenerates it.
+Verify: Read \`elevasis.config.ts\` templateVersion. Compare to the running SDK version from /meta.
+Observation focus: update workflow, project map freshness.
+
+When automation is custom:
+Read \`elevasis.config.ts\` for the current templateVersion. Read \`docs/project-map.mdx\`.
+Explain the full template lifecycle: init (writes all files with classification),
+update (applies MANAGED changes, flags conflicts, preserves INIT_ONLY), fix (detects
+drift, offers SDK upgrade, runs full repair). Explain conflict handling: read current
+file, read template from @elevasis/sdk/templates, merge preserving customizations.
+Explain the project map: auto-generated by deploy, contains resource inventory,
+command list, rule list, memory index.
+Next steps: explore reference docs, use /work for complex tasks, build custom rules.
+Verify: Compare elevasis.config.ts templateVersion with output of /meta. Identify any drift.
+Observation focus: full template lifecycle, conflict resolution pattern.
 
 ## Adaptation Rules
 
-- If user is intermediate/advanced (from skills.md), condense explanations
-- If user struggles, slow down with more plain-English explanation
-- If user is fast, acknowledge and offer to skip ahead
+**automation: none**
+Use the non-technical variant for each lesson. Agent writes all code -- user
+never types code. User verifies visually (Execution Runner, Command View, Logs).
+Avoid all jargon; use analogies. Execution Runner is the primary verification tool.
+Always deploy before directing the user to the Command Center.
+
+**automation: low-code**
+Map concepts to Zapier/Make equivalents. Show code with plain-English explanations.
+Execution Runner and CLI are equal verification tools. Show Zod types with labels.
+
+**automation: custom**
+Full technical content. Code-first. CLI and UI are equal. Condense explanations
+for intermediate/advanced users.
+
+**General rules (all levels)**
+- If user is fast, acknowledge and offer to skip ahead within a lesson
 - After each lesson, update \`.claude/memory/tutorial-progress.md\`
 - If user demonstrates a level change, promote to skills.md Growth Log
+- After completing a module, return to the module menu
+- Adapt module depth to skill level as with lessons
 
 ## Progress Format
 
 Store in \`.claude/memory/tutorial-progress.md\`:
-- Current Lesson number
+- Phase (core | modules | meta-framework | complete)
+- Current Lesson number (during core phase)
+- Current Module (module id during modules phase)
+- Current MF Lesson (MF1-MF5, during meta-framework phase)
 - Started and Last Session dates
 - Completed Lessons table (lesson, title, completed, duration)
-- Capability Observations table (lesson, observation)
+- Completed Modules table (module, title, completed, duration)
+- Completed MF Lessons table (lesson, title, completed, notes)
+- Capability Observations table (lesson/module, observation) -- prefix L# for lessons, M:<id> for modules, MF# for meta-framework lessons
 - Assessment Notes (bullet points)
+
+Backward-compatible: missing Phase is inferred from lesson count;
+missing Completed Modules is treated as empty;
+missing Completed MF Lessons is treated as empty.
 `;
 }
 function claudeMetaCommandTemplate() {
@@ -45340,10 +46100,17 @@ by the \`<!-- initialized: false -->\` flag in CLAUDE.md, or run manually.
    Run \`pnpm install\`. Wait for completion. Report any errors.
 
 2. **Setup environment**
-   Check if \`.env\` has \`ELEVASIS_API_KEY\` set.
-   If not, ask the user for their API key and write it to \`.env\`.
-   Validate the key works: run \`elevasis resources\` (should return empty list,
-   not an auth error).
+   Read \`.env\`. It should contain only a single line: \`ELEVASIS_API_KEY=\`.
+   If \`ELEVASIS_API_KEY\` is empty or missing, ask the user: "What is your
+   Elevasis API key?" When the user provides it, write \`.env\` with exactly:
+   \`\`\`
+   ELEVASIS_API_KEY=<value they provided>
+   \`\`\`
+   No other keys (no \`NODE_ENV\`, no extras). The \`.env\` file must contain
+   only \`ELEVASIS_API_KEY\`.
+   Validate the key works: run \`elevasis resources\` (should return an empty
+   list, not an auth error). If auth fails, tell the user their key appears
+   invalid and ask them to check it in the Elevasis dashboard.
 
 3. **Competency Assessment**
    Ask these questions to build the user's profile:
@@ -45353,16 +46120,11 @@ by the \`<!-- initialized: false -->\` flag in CLAUDE.md, or run manually.
    - "What do you want to automate with Elevasis?"
    - "Which tools does your team already use?" (email, CRM, spreadsheets, etc.)
 
-   Competency (2-3 questions with conditional skipping):
-   - "Have you written code before? If so, what kind?"
-     No code -> programming: none, skip next question
-     HTML/CSS/Excel -> programming: minimal, skip next question
-     Scripts/websites -> programming: intermediate, ask next question
-     Production apps -> programming: advanced, ask next question
-   - (Only if scripts+) "Have you used TypeScript or a typed language?"
-     No -> typescript: none
-     Read it / used typed language -> typescript: exposure
-     Written TypeScript projects -> typescript: proficient
+   Competency (2 questions):
+   - "Have you used the Elevasis Command Center before?"
+     Never used it -> platformNavigation: none
+     Explored it / know the main sections -> platformNavigation: oriented
+     Use it regularly -> platformNavigation: comfortable
    - "Have you used automation tools? (Zapier, Make, cron jobs, scripts)"
      No -> automation: none
      Zapier/Make flows -> automation: low-code
@@ -45390,8 +46152,8 @@ by the \`<!-- initialized: false -->\` flag in CLAUDE.md, or run manually.
 6. **Report**
    Summary of what was set up. Suggest next steps based on goals.
 
-   If the user's TypeScript level is beginner or automation level is new,
-   suggest /tutorial start: "I recommend starting with /tutorial -- it walks
+   If the user's Platform Navigation level is none or automation level is none,
+   suggest /tutorial: "I recommend starting with /tutorial -- it walks
    you through building workflows step by step, at your own pace."
 
 7. **Update flag**
@@ -45421,8 +46183,19 @@ Detect and repair all drift. Optionally upgrades the SDK first.
 1. **Missing managed files:** Regenerate from templates
 2. **Gitignore drift:** Append missing entries
 3. **CLAUDE.md sections:** Add missing sections in correct position
-4. **Memory structure:** Verify index consistency
-5. **Doc cross-references:** Scan for broken links
+4. **Memory structure:** Create base structure if missing, then verify index consistency.
+   If \`.claude/memory/\` does not exist or is empty:
+   - Create \`memory/index.md\` (root index with placeholder entries)
+   - Create \`memory/errors/index.md\` (error category summary, empty tables)
+   - Create \`memory/errors/deploy.md\`, \`memory/errors/runtime.md\`, \`memory/errors/typescript.md\`
+   If memory exists, verify: every file referenced in an index exists; every file
+   without an index entry gets one added; broken references are removed.
+5. **Documentation verification:** For each file in docs/:
+   a. Cross-reference claims against src/ code (resource IDs, schema fields, platform tools used)
+   b. Verify file path references point to real files
+   c. Flag mismatches between documented schemas and actual resource definitions
+   d. Check for undocumented resources (resources in src/ without docs coverage)
+   e. Report discrepancies with suggested fixes
 6. **Settings consistency:** Verify expected fields
 7. **Rules health:** Scan \`memory/errors/\` -- flag any entry that has recurred
    3+ times and is not yet in \`.claude/rules/workspace-patterns.md\`.
@@ -45477,47 +46250,164 @@ The agent reads current templates from the installed SDK:
 function claudeWorkCommandTemplate() {
   return `# /work command
 
-You are a task tracking assistant for this Elevasis workspace.
+You are a task tracking assistant for this Elevasis workspace. \`/work\` is the primary command for managing all work and projects.
 
 ## Context
 
 Read \`docs/priorities.mdx\` if it exists for current priorities.
-Scan \`docs/in-progress/\` for task documents with \`status\` frontmatter.
+Scan \`docs/in-progress/\` recursively for \`.mdx\` files with \`status\` frontmatter.
+
+## Directory Structure
+
+Task docs live in \`docs/in-progress/\`. Organize intelligently:
+
+- **Small standalone tasks**: \`docs/in-progress/<slug>.mdx\`
+- **Multi-file tasks**: \`docs/in-progress/<slug>/index.mdx\` (+ supporting docs)
+- **Related tasks**: group under the same directory
+
+When scanning, treat \`index.mdx\` as the primary task doc for a directory.
+
+## Status Values
+
+Enforce exactly three values in frontmatter: \`planned\`, \`in-progress\`, \`complete\`.
 
 ## Operations
 
-**No arguments (default):** Show all tasks from \`docs/in-progress/\` with status
-from frontmatter, cross-referenced with \`docs/priorities.mdx\`.
-Display as a status table sorted by status (in-progress first).
-
-**\`create <description>\`:** Create a task doc in \`docs/in-progress/<name>.mdx\`:
-1. Derive a kebab-case filename from the description
-2. Create the file with frontmatter (\`status: in-progress\`)
-3. Add sections: Objective, Plan, Progress, Resume Context
-4. Update \`docs/priorities.mdx\` with the new task
-5. Report what was created
-
-**\`save\`:** Update the current task doc's Progress and Resume Context sections:
-1. Identify the current task from conversation context
-2. Update Progress section (completed steps, files changed, decisions)
-3. Update Resume Context section with:
-   - Current State (date, what was done, what's next)
-   - Files Modified (table of changed files)
-   - Key docs to read on resume (file paths)
-   - To continue (copy-pasteable prompt)
-4. Set \`status\` appropriately
-
-**\`resume [name]\`:** Resume in-progress work:
-1. If name given, find matching doc in \`docs/in-progress/\`
-2. If no name, scan for docs with \`status: in-progress\`, ask if multiple
-3. Parse Resume Context section
-4. Present: "Resuming [task]. Last completed: [step]. Next: [step]."
-
-**\`complete [name]\`:** Mark task complete:
-1. Find the task doc
-2. Set \`status: complete\` in frontmatter
-3. Move from \`docs/in-progress/\` to final \`docs/\` location
-4. Update \`docs/priorities.mdx\`
+### No arguments (default) -- List and Pick
+
+1. Scan \`docs/in-progress/\` recursively for \`.mdx\` files with \`status\` frontmatter
+2. For directories, read \`index.mdx\` as the primary task doc
+3. Display a numbered list sorted by status (\`in-progress\` first, then \`planned\`, then \`complete\`):
+
+\`\`\`
+Active Tasks
+============
+
+1. [in-progress] SDK Adapter Migration
+   Last saved: 2026-03-02 | Step 3/5: Building factory adapters
+
+2. [planned] Email Template System
+   Created: 2026-03-01 | Not started
+
+3. [complete] CRM Integration
+   Completed: 2026-03-03
+
+Pick a task by number or name to resume, or say:
+- "create" to start new work
+- "complete <name>" to finish a task
+\`\`\`
+
+4. Cross-reference with \`docs/priorities.mdx\` if it exists
+5. When the user picks a number or describes a task in natural language, auto-invoke the **resume** flow on that task
+6. If no tasks found, suggest \`/work create\`
+
+### \`create [description]\`
+
+Guided task creation with interview:
+
+1. If no description given, ask: "What are you trying to accomplish?"
+2. Ask 2-3 focused questions:
+   - "What does success look like?" (acceptance criteria)
+   - "Is this related to any existing work?" (scan \`docs/in-progress/\` and \`docs/\` for related topics)
+   - "Do we need to investigate anything first, or is the path clear?" (suggest investigation if needed)
+3. Determine directory placement:
+   - Scan \`docs/in-progress/\` for existing directories related to the topic
+   - If related to existing directory, create as a file within it
+   - If new concept that may grow, create \`docs/in-progress/<slug>/index.mdx\`
+   - If small/standalone, create \`docs/in-progress/<slug>.mdx\`
+4. Create the doc with \`status: planned\` and structured sections:
+
+\`\`\`yaml
+---
+title: {Task Title}
+description: {Concise description}
+status: planned
+---
+\`\`\`
+
+Sections: Objective (what and why), Plan (numbered steps), Progress (per-step tracking with PENDING markers), Resume Context (current state, key docs, "To continue" prompt).
+
+5. Update \`docs/priorities.mdx\` if it exists
+6. Report what was created with location and step count
+
+### \`save\`
+
+Update the current task doc's Progress and Resume Context:
+
+1. Identify the current task from conversation context (which in-progress doc was loaded/discussed)
+2. If not working on a tracked task, list available docs and ask which to save to, or offer to create a new one
+3. Update Progress section:
+   - Mark completed steps as \`COMPLETE\` with: what was done, key decisions, files changed
+   - Mark current step as \`IN PROGRESS\` with current state
+   - Leave future steps as \`PENDING\`
+4. Update Resume Context section with:
+   - Current State ({today's date}): summary of accomplishments and next steps
+   - Files Modified: table of file paths and descriptions of changes
+   - Key docs to read on resume: file paths with why they matter
+   - To continue: copy-pasteable prompt for the next session
+5. Set \`status\` appropriately (\`in-progress\` if ongoing, \`complete\` if all steps done)
+6. Report: task title, status, completed steps count, last step, and the resume command
+
+### \`resume [name-or-number]\`
+
+Resume in-progress work. Designed for non-technical users who may not know file paths.
+
+**Resolution order:**
+1. If a number is given (e.g., \`/work resume 2\`), map to the numbered list from the default list operation
+2. If a name/keyword is given, substring match against task titles and filenames in \`docs/in-progress/\`
+3. If no argument, scan for \`status: in-progress\` docs -- if one found, use it; if multiple, list and ask
+4. If multiple matches, list them and ask which to resume
+
+**Resume flow:**
+1. Read the target task doc
+2. Parse the Resume Context section
+3. Load key docs listed in "Key docs to read on resume" in parallel
+4. Quick verify: check that referenced files exist (Glob), report warnings for missing files
+5. Present resume summary:
+
+\`\`\`
+Resuming: {task title}
+========================
+
+Last completed: Step {N}: {title}
+Next: Step {M}: {title}
+
+Key context loaded:
+- {doc 1}
+- {doc 2}
+
+Ready to continue. {Copy of "To continue" prompt}
+\`\`\`
+
+### \`complete [name]\`
+
+Mark task complete, clean up, and move to permanent docs:
+
+1. Resolve target (same as resume: number, name, or scan for \`status: complete\`)
+2. **Validate readiness:** Check that all plan steps are marked COMPLETE. If not, warn and ask for confirmation.
+3. **Clean up the doc:**
+   - Strip \`## Resume Context\` section entirely (header through next \`##\` or EOF)
+   - Strip progress markers: \`COMPLETE\`, \`IN PROGRESS\`, \`PENDING\` from step headings
+   - Remove steps still marked PENDING entirely (header + body) -- they were never done
+   - Remove \`status\` from frontmatter (keep \`title\` and \`description\`)
+   - Target 200-400 lines; flag if result exceeds 500 lines
+4. **Determine destination:**
+   - Scan \`docs/\` (excluding \`docs/in-progress/\`) for existing directories related to this work
+   - If a related directory exists, propose merging into it
+   - If no related directory, propose \`docs/<slug>/\` or \`docs/<slug>.mdx\`
+   - Present the proposed destination and ask user to confirm
+5. **Move the doc(s):**
+   - Single file: move from \`docs/in-progress/\` to destination
+   - Directory: move entire directory
+6. **Verify and report:**
+   - Confirm destination exists, source removed
+   - Check no leftover \`status:\` or \`## Resume Context\` in moved files
+   - Update \`docs/priorities.mdx\` if it exists
+   - Report: task title, cleanup stats (lines before/after), destination path
+
+## Completion Suggestions
+
+When the agent observes that all plan steps for a task are marked COMPLETE and the user seems to be moving on, proactively suggest: "All steps for '{task}' are complete. Run \`/work complete\` to finalize it."
 `;
 }
 function claudeCredsSkillTemplate() {
@@ -45758,24 +46648,54 @@ description: Project map conventions -- auto-generated, do not edit, maintained
 
 # Project Map
 
-- \`docs/project-map.mdx\` is fully auto-generated by \`elevasis deploy\`
-- Do not edit manually -- changes are overwritten on next deploy
+- \`docs/project-map.mdx\` and \`docs/resource-map.mdx\` are fully auto-generated by \`elevasis deploy\`
+- Do not edit either file manually -- changes are overwritten on next deploy
 - \`/meta fix\` step 8 checks for drift and patches the map
 - If a new command, rule, skill, or memory file is added, run \`/meta fix\` or \`elevasis deploy\` to update
 `;
 }
 function claudeTaskTrackingRuleTemplate() {
   return `---
-description: In-progress task conventions -- /work command, doc format, status values
+description: In-progress task conventions -- /work command, doc format, status values, auto-save behavior
 ---
 
 # Task Tracking
 
-- Task docs managed via \`/work\` command (create, save, resume, complete)
-- Frontmatter \`status\`: \`planned\`, \`in-progress\`, \`blocked\`, \`complete\`
+## Status Values
+
+Exactly three values for frontmatter \`status\`: \`planned\`, \`in-progress\`, \`complete\`.
+
+## Doc Format
+
+- Frontmatter: \`title\`, \`description\`, \`status\`
 - Sections: Objective, Plan, Progress, Resume Context
-- Update Progress section only on step transitions, not every action
-- When context is heavy, suggest \`/work save\`
+- Progress subsections use markers: \`### Step N: Title -- PENDING\`, \`-- IN PROGRESS\`, \`-- COMPLETE\`
+
+## Auto-Update Behavior
+
+- When working on a tracked task, update the Progress section when a plan step transitions:
+  - PENDING -> IN PROGRESS (starting work on a step)
+  - IN PROGRESS -> COMPLETE (finishing a step)
+- Do NOT update on every action -- only on step transitions
+
+## Save Suggestions
+
+Proactively suggest \`/work save\` when:
+- The conversation context is getting heavy (many tool calls, large file reads)
+- The user appears to be wrapping up (thanks, goodbye, switching topics)
+- Significant progress has been made (2+ steps completed without saving)
+- Before a \`/clear\` or context reset
+
+## Completion Suggestions
+
+When all plan steps are marked COMPLETE, suggest \`/work complete\` to finalize the task.
+
+## Directory Conventions
+
+- \`docs/in-progress/\` for all active task docs
+- Small tasks: \`<slug>.mdx\` directly in \`docs/in-progress/\`
+- Multi-file tasks: \`<slug>/index.mdx\` with supporting docs alongside
+- Completed tasks move OUT of \`docs/in-progress/\` to \`docs/<relevant-dir>/\`
 `;
 }
 
@@ -45951,7 +46871,7 @@ function getManagedTemplates(ctx = {}) {
     ".gitignore": () => gitignoreTemplate(ctx),
     "CLAUDE.md": () => claudeMdTemplate(ctx),
     ".claude/settings.json": claudeSettingsTemplate,
-    ".claude/commands/docs.md": claudeDocsCommandTemplate,
+    ".claude/hooks/enforce-sdk-boundary.mjs": claudeSdkBoundaryHookTemplate,
     ".claude/commands/tutorial.md": claudeTutorialCommandTemplate,
     ".claude/commands/meta.md": claudeMetaCommandTemplate,
     ".claude/commands/work.md": claudeWorkCommandTemplate,
@@ -46157,7 +47077,7 @@ var MANAGED_FILES = [
   ".gitignore",
   "CLAUDE.md",
   ".claude/settings.json",
-  ".claude/commands/docs.md",
+  ".claude/hooks/enforce-sdk-boundary.mjs",
   ".claude/commands/tutorial.md",
   ".claude/commands/meta.md",
   ".claude/commands/work.md",
@@ -46196,6 +47116,7 @@ function registerInitCommand(program3) {
     await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, "src/example"), { recursive: true });
     await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, "src/shared"), { recursive: true });
     await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, "docs/in-progress"), { recursive: true });
+    await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, ".claude/hooks"), { recursive: true });
     await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, ".claude/commands"), { recursive: true });
     await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, ".claude/skills/creds"), { recursive: true });
     await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, ".claude/rules"), { recursive: true });
@@ -46221,7 +47142,7 @@ function registerInitCommand(program3) {
       "docs/in-progress/.gitkeep": "",
       "CLAUDE.md": claudeMdTemplate({ hasUI: options2.ui }),
       ".claude/settings.json": claudeSettingsTemplate(),
-      ".claude/commands/docs.md": claudeDocsCommandTemplate(),
+      ".claude/hooks/enforce-sdk-boundary.mjs": claudeSdkBoundaryHookTemplate(),
       ".claude/commands/tutorial.md": claudeTutorialCommandTemplate(),
       ".claude/commands/meta.md": claudeMetaCommandTemplate(),
       ".claude/commands/work.md": claudeWorkCommandTemplate(),
@@ -46266,6 +47187,79 @@ function toSlug(name) {
 // src/cli/commands/update.ts
 var import_path4 = require("path");
 var import_promises3 = require("fs/promises");
+var SDK_OWNED_SECTIONS = [
+  "Session Initialization",
+  "Identity",
+  "Navigation",
+  "Interaction Guidance",
+  "Commands",
+  "Skills",
+  "Maintaining Memory"
+];
+function parseSections(md) {
+  const lines = md.split("\n");
+  const sections = [];
+  let currentHeading = "";
+  let currentLines = [];
+  for (const line of lines) {
+    if (line.startsWith("## ")) {
+      if (currentLines.length > 0 || currentHeading === "") {
+        sections.push({ heading: currentHeading, content: currentLines.join("\n") });
+      }
+      currentHeading = line;
+      currentLines = [line];
+    } else {
+      currentLines.push(line);
+    }
+  }
+  if (currentLines.length > 0 || currentHeading !== "") {
+    sections.push({ heading: currentHeading, content: currentLines.join("\n") });
+  }
+  return sections;
+}
+function mergeSections(existing, template, sdkOwned) {
+  const existingSections = parseSections(existing);
+  const templateSections = parseSections(template);
+  const updated = [];
+  const preserved = [];
+  const templateMap = /* @__PURE__ */ new Map();
+  for (const section of templateSections) {
+    templateMap.set(section.heading, section);
+  }
+  const sdkOwnedSet = new Set(sdkOwned.map((s) => `## ${s}`));
+  const resultSections = [];
+  const processedHeadings = /* @__PURE__ */ new Set();
+  for (const section of existingSections) {
+    processedHeadings.add(section.heading);
+    if (section.heading === "") {
+      resultSections.push(section);
+      continue;
+    }
+    if (sdkOwnedSet.has(section.heading)) {
+      const templateSection = templateMap.get(section.heading);
+      if (templateSection) {
+        resultSections.push(templateSection);
+        updated.push(section.heading.replace("## ", ""));
+      } else {
+        updated.push(section.heading.replace("## ", "") + " (removed)");
+      }
+    } else {
+      resultSections.push(section);
+      preserved.push(section.heading.replace("## ", ""));
+    }
+  }
+  for (const section of templateSections) {
+    if (section.heading !== "" && !processedHeadings.has(section.heading)) {
+      resultSections.push(section);
+      updated.push(section.heading.replace("## ", "") + " (new)");
+    }
+  }
+  return {
+    merged: resultSections.map((s) => s.content).join("\n"),
+    updated,
+    preserved
+  };
+}
 function registerUpdateCommand(program3) {
   program3.command("update").description("Update project scaffold to latest template version").option("--ui", "Add a Vite + React UI app in ui/").action(wrapAction("update", async (options2 = {}) => {
     const cwd = process.cwd();
@@ -46297,6 +47291,8 @@ function registerUpdateCommand(program3) {
     const added = [];
     const flagged = [];
     const appendedGitignore = [];
+    const mergedUpdated = [];
+    const mergedPreserved = [];
     const uiAffectedFiles = /* @__PURE__ */ new Set([".gitignore", "CLAUDE.md"]);
     const filesToProcess = upToDate ? MANAGED_FILES.filter((f) => uiAffectedFiles.has(f)) : MANAGED_FILES;
     for (const file2 of filesToProcess) {
@@ -46352,6 +47348,25 @@ function registerUpdateCommand(program3) {
         }
         continue;
       }
+      if (file2 === "CLAUDE.md") {
+        let existingContent = null;
+        try {
+          await (0, import_promises3.access)(filePath);
+          existingContent = await (0, import_promises3.readFile)(filePath, "utf-8");
+        } catch {
+        }
+        if (existingContent !== null) {
+          const { merged, updated: sectionUpdated, preserved: sectionPreserved } = mergeSections(existingContent, templateContent, SDK_OWNED_SECTIONS);
+          await (0, import_promises3.writeFile)(filePath, merged, "utf-8");
+          mergedUpdated.push(...sectionUpdated);
+          mergedPreserved.push(...sectionPreserved);
+        } else {
+          await (0, import_promises3.mkdir)((0, import_path4.dirname)(filePath), { recursive: true });
+          await (0, import_promises3.writeFile)(filePath, templateContent, "utf-8");
+          added.push(file2);
+        }
+        continue;
+      }
       let exists = false;
       try {
         await (0, import_promises3.access)(filePath);
@@ -46425,6 +47440,16 @@ function registerUpdateCommand(program3) {
       console.log(source_default.gray("  Run /meta update in Claude Code to merge flagged files."));
       console.log(source_default.gray("  Or run /meta fix to verify and repair the full framework."));
     }
+    if (mergedUpdated.length > 0 || mergedPreserved.length > 0) {
+      console.log("");
+      console.log("  CLAUDE.md sections:");
+      for (const section of mergedUpdated) {
+        console.log(source_default.green(`    updated: ${section}`));
+      }
+      for (const section of mergedPreserved) {
+        console.log(source_default.gray(`    preserved: ${section}`));
+      }
+    }
     if (uiAdded.length > 0) {
       console.log("");
       console.log("  UI scaffold added:");