@openagentpack/sdk 0.3.1 → 0.4.0-beta-2472720-20260827

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   toSessionEvent
-} from "./chunk-GAAU67HX.js";
+} from "./chunk-6PDVAFLK.js";
 import {
   defaultFileUploadPurpose,
   enrichProviderFileInfo
@@ -58,10 +58,10 @@ var BaseApiClient = class {
     if (this.isConflict(res.status, body)) throw new ConflictError(res.status, body, this.errorPrefix);
     throw new ApiError(res.status, body, this.errorPrefix);
   }
-  async post(path, body) {
+  async post(path, body, options) {
     const res = await resolveFetch()(`${this.baseUrl}${path}`, {
       method: "POST",
-      headers: this.headers(),
+      headers: { ...this.headers(), ...options?.headers },
       body: JSON.stringify(body)
     });
     await this.throwIfError(res);
@@ -395,6 +395,24 @@ function skillNameFromFiles(files) {
   return match?.[1]?.replace(/^["']|["']$/g, "") || void 0;
 }
 
+// src/internal/providers/deployment-conflict.ts
+var DeploymentCreateConflictError = class extends ConflictError {
+  constructor(conflict, preparedFiles) {
+    super(conflict.statusCode, conflict.responseBody, "Deployment create");
+    this.preparedFiles = preparedFiles;
+    this.name = conflict.name;
+    this.message = conflict.message;
+    this.stack = conflict.stack;
+  }
+  preparedFiles;
+};
+function preserveDeploymentFilesOnConflict(error, preparedFiles) {
+  if (error instanceof ConflictError && preparedFiles.size > 0) {
+    throw new DeploymentCreateConflictError(error, preparedFiles);
+  }
+  throw error;
+}
+
 // src/internal/providers/memory-api.ts
 function query(path, values) {
   const params = new URLSearchParams();
@@ -610,6 +628,13 @@ async function listSessionEventsPaged(client, sessionId, options, toEvent, confi
   const params = new URLSearchParams();
   if (options?.limit) params.set("limit", String(options.limit));
   if (options?.order) params.set("order", options.order);
+  if (config?.forwardTypes !== false) {
+    for (const type of options?.types ?? []) params.append("types", type);
+  }
+  if (options?.created_at_gt) params.set("created_at[gt]", options.created_at_gt);
+  if (options?.created_at_gte) params.set("created_at[gte]", options.created_at_gte);
+  if (options?.created_at_lt) params.set("created_at[lt]", options.created_at_lt);
+  if (options?.created_at_lte) params.set("created_at[lte]", options.created_at_lte);
   const pageCursor = options?.page_token ?? options?.page;
   if (pageCursor) params.set("page", pageCursor);
   if (config?.forwardAfterId && options?.after_id) params.set("after_id", options.after_id);
@@ -776,7 +801,8 @@ function toCloudAgent(raw) {
     workspace_id: raw.workspace_id,
     created_at: raw.created_at,
     updated_at: raw.updated_at,
-    archived_at: raw.archived_at ?? null
+    archived_at: raw.archived_at ?? null,
+    attributes: raw
   };
 }
 function toCloudEnvironment(raw) {
@@ -792,7 +818,8 @@ function toCloudEnvironment(raw) {
     workspace_id: raw.workspace_id,
     created_at: raw.created_at,
     updated_at: raw.updated_at,
-    archived_at: raw.archived_at ?? null
+    archived_at: raw.archived_at ?? null,
+    attributes: raw
   };
 }
 function toCloudVault(raw) {
@@ -803,7 +830,8 @@ function toCloudVault(raw) {
     type: raw.type,
     created_at: raw.created_at ?? null,
     updated_at: raw.updated_at ?? null,
-    archived_at: raw.archived_at ?? null
+    archived_at: raw.archived_at ?? null,
+    attributes: raw
   };
 }
 function toRestFileInfo(res) {
@@ -815,7 +843,9 @@ function toRestFileInfo(res) {
     created_at: res.created_at,
     downloadable: res.downloadable,
     status: res.status,
-    purpose: res.purpose
+    purpose: res.purpose,
+    scope: res.scope,
+    attributes: res
   };
 }
 function toRestSkillInfo(res) {
@@ -828,7 +858,8 @@ function toRestSkillInfo(res) {
     status: "active",
     latest_version: res.latest_version,
     created_at: res.created_at,
-    updated_at: res.updated_at
+    updated_at: res.updated_at,
+    attributes: res
   };
 }
 
@@ -1220,7 +1251,7 @@ function mapAgent(name, decl, refs, version, projectName) {
     }
   }
   const body = {
-    name,
+    name: decl.name ?? name,
     model: modelValue,
     system: decl.instructions
   };
@@ -1736,11 +1767,15 @@ var ClaudeAdapter = class _ClaudeAdapter {
   async createDeployment(name, decl, refs, basePath) {
     const uploaded = await this.uploadDeploymentFiles(decl, basePath);
     const body = mapDeployment(name, decl, refs, this.projectName, uploaded);
-    const res = await this.client.post("/deployments", body);
-    return toRemoteResource(res);
+    try {
+      const res = await this.client.post("/deployments", body);
+      return toRemoteResource(res);
+    } catch (error) {
+      preserveDeploymentFilesOnConflict(error, uploaded);
+    }
   }
-  async updateDeployment(id, name, decl, refs, basePath) {
-    const uploaded = await this.uploadDeploymentFiles(decl, basePath);
+  async updateDeployment(id, name, decl, refs, basePath, preparedFiles) {
+    const uploaded = preparedFiles ? new Map(preparedFiles) : await this.uploadDeploymentFiles(decl, basePath);
     const current = await this.client.get(`/deployments/${id}`);
     if (current.schedule && !decl.schedule) {
       throw new UserError(
@@ -2013,12 +2048,23 @@ function normalizeToolNameForQoder(name) {
 function normalizeToolNameFromQoder(name) {
   return name.replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase();
 }
+function normalizeEnvironmentPackages(value) {
+  if (!value || typeof value !== "object") return void 0;
+  const raw = value;
+  const packages = {};
+  for (const key of ["apt", "npm", "pip"]) {
+    if (Array.isArray(raw[key]) && raw[key].length > 0) packages[key] = raw[key];
+  }
+  return Object.keys(packages).length > 0 ? packages : void 0;
+}
 function mapEnvironment2(name, decl, projectName) {
   const envType = decl.config.type ?? "cloud";
   const config = { type: envType };
   if (decl.config.networking) config.networking = decl.config.networking;
   else if (envType === "cloud") config.networking = { type: "unrestricted" };
-  if (decl.config.packages) config.packages = decl.config.packages;
+  const packages = normalizeEnvironmentPackages(decl.config.packages);
+  if (packages) config.packages = packages;
+  if (decl.config.setup_script !== void 0) config.setup_script = decl.config.setup_script;
   return {
     name,
     description: decl.description ?? "",
@@ -2026,6 +2072,13 @@ function mapEnvironment2(name, decl, projectName) {
     metadata: injectMetadata(decl.metadata, projectName, name)
   };
 }
+function mapForwardEnvironment(name, decl, projectName) {
+  const body = mapEnvironment2(name, decl, projectName);
+  const config = { ...body.config };
+  delete config.networking;
+  body.config = config;
+  return body;
+}
 function mapVault(name, decl, projectName) {
   const body = { display_name: decl.display_name };
   if (projectName) body.metadata = injectMetadata(decl.metadata, projectName, name);
@@ -2099,7 +2152,8 @@ function envToDecl2(raw) {
     config: {
       type: config.type ?? "cloud",
       networking: config.networking,
-      packages: config.packages
+      packages: normalizeEnvironmentPackages(config.packages),
+      setup_script: config.setup_script
     },
     metadata: stripAgentsMetadata(raw.metadata)
   });
@@ -2142,6 +2196,7 @@ function agentToDecl2(raw) {
     }));
   }
   return compactDeep({
+    name: raw.name,
     description: raw.description,
     model: raw.model,
     instructions: raw.system,
@@ -2266,7 +2321,7 @@ function mapAgent2(name, decl, refs, version, projectName) {
     model = typeof qoderModel === "string" ? qoderModel : qoderModel.id;
   }
   const body = {
-    name,
+    name: decl.name ?? name,
     model,
     system: decl.instructions
   };
@@ -2339,9 +2394,12 @@ function mapForwardTemplate(name, decl, refs, projectName) {
     environment_id: refs.environment_id,
     vault_ids: refs.vault_ids
   };
+  body.files = Object.fromEntries((refs.file_ids ?? []).map((id) => [id, { enabled: true }]));
   if (refs.tunnel_id) body.tunnel_id = refs.tunnel_id;
   if (projectName) body.metadata = injectMetadata(decl.metadata, projectName, name);
   else body.metadata = decl.metadata ?? {};
+  if (decl.environment_variables) body.environment_variables = decl.environment_variables;
+  if (decl.managed_tool_config) body.managed_tool_config = decl.managed_tool_config;
   if (decl.tools) {
     body.tools = [
       {
@@ -2482,6 +2540,9 @@ function mapSession2(bindings) {
   if (bindings.tunnel_id) body.tunnel_id = bindings.tunnel_id;
   if (bindings.title) body.title = bindings.title;
   if (bindings.metadata) body.metadata = bindings.metadata;
+  if (bindings.environment_variables) {
+    body.environment_variables = Object.entries(bindings.environment_variables).map(([key, value]) => `${key}=${value}`).join(";");
+  }
   if (bindings.vault_ids.length) body.vault_ids = bindings.vault_ids;
   const resources = [];
   for (const id of bindings.memory_store_ids) resources.push({ type: "memory_store", memory_store_id: id });
@@ -2527,6 +2588,7 @@ var QoderAdapter = class _QoderAdapter {
   client;
   memoryApi;
   forwardClient;
+  forwardMemoryApi;
   projectName;
   forwardSessionIds = /* @__PURE__ */ new Set();
   constructor(apiKey, gateway, projectName, forwardGateway) {
@@ -2548,6 +2610,19 @@ var QoderAdapter = class _QoderAdapter {
       apiKey,
       gateway: forwardGateway ?? deriveForwardGateway(gateway)
     });
+    this.forwardMemoryApi = new ProviderMemoryApi(this.forwardClient, {
+      pathStyle: "relative",
+      cursorParam: "after_id",
+      updatePrecondition: "content_sha256",
+      prefixParam: "prefix",
+      versionsSegment: "versions",
+      storeMetadataMode: "merge_patch",
+      supportsView: false,
+      supportsMemoryMetadata: true,
+      supportsPathUpdate: false,
+      supportsDeletePrecondition: false,
+      supportsIncludeArchived: true
+    });
     this.projectName = projectName ?? "";
   }
   async validate() {
@@ -2562,7 +2637,7 @@ var QoderAdapter = class _QoderAdapter {
     file: "/files",
     deployment: "/deployments"
   };
-  async findResource(type, name, id) {
+  async findResource(type, name, id, mode) {
     if (type === "template") {
       const raw2 = await locateRemote(this.forwardClient, "/templates", name, id, (item) => item.status !== "archived");
       return raw2 ? toRemoteResource(raw2) : null;
@@ -2582,7 +2657,14 @@ var QoderAdapter = class _QoderAdapter {
       const raw2 = await locateRemote(this.forwardClient, "/channels", name, id, () => true);
       return raw2 ? toRemoteResource(raw2) : null;
     }
-    const raw = await locateRemote(this.client, _QoderAdapter.ENDPOINT_MAP[type], name, id, notArchived);
+    if (type === "environment" && id && mode === "auto") {
+      const managed = await locateRemote(this.client, "/environments", name, id, notArchived);
+      if (managed) return toRemoteResource(managed);
+      const forward = await locateRemote(this.forwardClient, "/environments", name, id, notArchived);
+      return forward ? toRemoteResource(forward) : null;
+    }
+    const client = mode === "forward" && (type === "environment" || type === "skill" || type === "vault" || type === "memory_store" || type === "file") ? this.forwardClient : this.client;
+    const raw = await locateRemote(client, _QoderAdapter.ENDPOINT_MAP[type], name, id, notArchived);
     return raw ? toRemoteResource(raw) : null;
   }
   async listAgents(filter) {
@@ -2691,14 +2773,10 @@ var QoderAdapter = class _QoderAdapter {
   }
   normalizeRemote(type, raw) {
     if (type === "environment") {
-      const config = raw.config ?? {};
+      const normalized = envToDecl2(raw);
       return compactDeep({
         description: raw.description,
-        config: {
-          type: config.type ?? "cloud",
-          networking: config.networking,
-          packages: config.packages
-        },
+        config: normalized.config,
         metadata: stripAgentsMetadata(raw.metadata)
       });
     }
@@ -2730,18 +2808,24 @@ var QoderAdapter = class _QoderAdapter {
     }
     if (type === "channel") {
       const channelConfig = raw.channel_config ?? {};
-      return compactDeep({
-        identity_id: raw.identity_id,
-        template_id: raw.template_id,
+      const mode = raw.identity_resolution?.mode ?? "fixed";
+      const normalized = {
+        identity_resolution: { mode },
         channel_type: raw.channel_type,
         name: raw.name,
         enabled: raw.enabled,
         channel_config: {
           response_options: channelConfig.response_options ?? {}
         }
-      });
+      };
+      if (mode === "fixed") {
+        normalized.identity_id = raw.identity_id;
+        normalized.template_id = raw.template_id;
+      }
+      return compactDeep(normalized);
     }
     return compactDeep({
+      name: raw.name,
       description: raw.description,
       model: normalizeModel(raw.model),
       instructions: raw.system,
@@ -2750,17 +2834,41 @@ var QoderAdapter = class _QoderAdapter {
       metadata: stripAgentsMetadata(raw.metadata)
     });
   }
-  async createEnvironment(name, decl) {
-    const body = mapEnvironment2(name, decl, this.projectName);
-    const res = await this.client.post("/environments", body);
+  async createEnvironment(name, decl, mode = "managed") {
+    const body = mode === "forward" ? mapForwardEnvironment(name, decl, this.projectName) : mapEnvironment2(name, decl, this.projectName);
+    const res = await (mode === "forward" ? this.forwardClient : this.client).post("/environments", body);
     return toRemoteResource(res);
   }
-  async updateEnvironment(id, name, decl) {
-    const body = mapEnvironment2(name, decl, this.projectName);
-    const res = await this.client.put(`/environments/${id}`, body);
+  async updateEnvironment(id, name, decl, mode = "managed") {
+    const body = mode === "forward" ? mapForwardEnvironment(name, decl, this.projectName) : mapEnvironment2(name, decl, this.projectName);
+    const client = mode === "forward" ? this.forwardClient : this.client;
+    const current = await client.get(`/environments/${id}`);
+    const currentMetadata = current.metadata ?? {};
+    const metadata = { ...body.metadata ?? {} };
+    for (const key of Object.keys(currentMetadata)) {
+      if (!key.startsWith("agents.") && !(key in metadata)) metadata[key] = null;
+    }
+    body.metadata = metadata;
+    const res = await client.post(`/environments/${id}`, body);
     return toRemoteResource(res);
   }
-  async deleteEnvironment(id, cascade = false) {
+  async deleteEnvironment(id, cascade = false, mode = "managed") {
+    if (mode === "forward") {
+      try {
+        await this.forwardClient.delete(`/environments/${id}`);
+        return;
+      } catch (err) {
+        const isConflict = err instanceof ApiError && (err.statusCode === 409 || err.responseBody.includes("in use"));
+        if (!isConflict) throw err;
+        if (!cascade) {
+          throw new UserError(
+            `Environment ${id} is referenced by one or more Forward sessions. Use --cascade to archive the environment.`
+          );
+        }
+        await this.forwardClient.post(`/environments/${id}/archive`, {});
+        return;
+      }
+    }
     try {
       await this.client.delete(`/environments/${id}`);
       return;
@@ -2787,17 +2895,18 @@ var QoderAdapter = class _QoderAdapter {
       await this.client.post(`/environments/${id}/archive`, {});
     }
   }
-  async createVault(name, decl) {
+  async createVault(name, decl, mode = "managed") {
+    const client = mode === "forward" ? this.forwardClient : this.client;
     const body = mapVault(name, decl, this.projectName);
-    const res = await this.client.post("/vaults", body);
+    const res = await client.post("/vaults", body);
     const vaultId = res.id;
     for (const cred of decl.credentials ?? []) {
-      await this.client.post(`/vaults/${vaultId}/credentials`, mapCredential(cred));
+      await client.post(`/vaults/${vaultId}/credentials`, mapCredential(cred));
     }
     return toRemoteResource(res);
   }
-  async deleteVault(id) {
-    await this.client.delete(`/vaults/${id}`);
+  async deleteVault(id, mode = "managed") {
+    await (mode === "forward" ? this.forwardClient : this.client).delete(`/vaults/${id}`);
   }
   async exportResources(type) {
     return exportRemoteResources(this.client, type, {
@@ -2808,17 +2917,24 @@ var QoderAdapter = class _QoderAdapter {
       agentToDecl: agentToDecl2
     });
   }
-  async createSkill(name, decl, files) {
+  async createSkill(name, decl, files, mode = "managed") {
     const formData = await buildSkillFormData(name, decl, files);
-    const res = await this.client.postFormData("/skills", formData);
+    const res = await (mode === "forward" ? this.forwardClient : this.client).postFormData(
+      "/skills",
+      formData
+    );
     return toRemoteResource(res);
   }
-  async updateSkill(id, name, decl, files) {
-    await this.client.delete(`/skills/${id}`);
-    return this.createSkill(name, decl, files);
+  async updateSkill(id, name, decl, files, mode = "managed") {
+    const client = mode === "forward" ? this.forwardClient : this.client;
+    const packageName = skillNameFromFiles(files) ?? name;
+    const formData = await buildSkillFormData(packageName, decl, files, "files", false, true);
+    await client.postFormData(`/skills/${id}/versions`, formData);
+    const current = await client.get(`/skills/${id}`);
+    return toRemoteResource(current);
   }
-  async deleteSkill(id) {
-    await this.client.delete(`/skills/${id}`);
+  async deleteSkill(id, mode = "managed") {
+    await (mode === "forward" ? this.forwardClient : this.client).delete(`/skills/${id}`);
   }
   async createAgent(name, decl, refs) {
     const body = mapAgent2(name, decl, refs, void 0, this.projectName);
@@ -2835,21 +2951,89 @@ var QoderAdapter = class _QoderAdapter {
     await this.client.delete(`/agents/${id}`);
   }
   async createTemplate(name, decl, refs) {
-    await this.registerForwardVaults(refs.vault_ids);
     const body = mapForwardTemplate(name, decl, refs, this.projectName);
     const res = await this.forwardClient.post("/templates", body);
+    await this.reconcileForwardMemoryMounts(res.id, refs);
     return toRemoteResource(res);
   }
   async updateTemplate(id, name, decl, refs) {
-    await this.registerForwardVaults(refs.vault_ids);
     const body = mapForwardTemplate(name, decl, refs, this.projectName);
     if (!refs.tunnel_id) body.tunnel_id = null;
     const res = await this.forwardClient.post(`/templates/${id}`, body);
+    await this.reconcileForwardMemoryMounts(id, refs);
     return toRemoteResource(res);
   }
-  async archiveTemplate(id) {
+  async archiveTemplate(id, ownedMemoryStoreIds = []) {
+    const owned = new Set(ownedMemoryStoreIds);
+    if (owned.size > 0) {
+      for (const identity of await this.forwardClient.getAllPaged("/identities")) {
+        if (typeof identity.id !== "string") continue;
+        const path = `/identities/${identity.id}/templates/${id}/memory_stores`;
+        try {
+          const mounts = await this.forwardClient.get(path);
+          for (const mount of mounts.data ?? []) {
+            const storeId = mount.memory_store_id;
+            if (mount.system_managed !== true && typeof storeId === "string" && owned.has(storeId)) {
+              await this.forwardClient.delete(`${path}/${storeId}`);
+            }
+          }
+        } catch (error) {
+          if (!ApiError.isNotFound(error)) throw error;
+        }
+      }
+    }
     await this.forwardClient.post(`/templates/${id}/archive`, {});
   }
+  async reconcileForwardMemoryMounts(templateId, refs) {
+    if (refs.memory_store_ids === void 0) return;
+    const desired = new Set(refs.memory_store_ids ?? []);
+    if (!refs.identity_id) {
+      if (desired.size > 0) throw new UserError("Qoder Forward Memory Store mounts require an Identity.");
+      return;
+    }
+    const path = `/identities/${refs.identity_id}/templates/${templateId}/memory_stores`;
+    const current = await this.forwardClient.get(path);
+    const explicit = (current.data ?? []).filter((mount) => mount.system_managed !== true);
+    const owned = new Set(refs.owned_memory_store_ids ?? refs.memory_store_ids ?? []);
+    for (const mount of explicit) {
+      const storeId = mount.memory_store_id;
+      if (typeof storeId === "string" && owned.has(storeId) && !desired.has(storeId)) {
+        await this.forwardClient.delete(`${path}/${storeId}`);
+      }
+    }
+    const mounted = new Set(
+      explicit.map((mount) => mount.memory_store_id).filter((id) => typeof id === "string")
+    );
+    for (const memoryStoreId of desired) {
+      if (!mounted.has(memoryStoreId)) await this.forwardClient.post(path, { memory_store_id: memoryStoreId });
+    }
+  }
+  async reconcileDefaultMemoryStore(identityId, templateId, desired) {
+    const storeId = await this.findDefaultMemoryStoreId(identityId, templateId);
+    if (!storeId) return { status: "pending" };
+    const current = await this.forwardClient.get(`/memory_stores/${storeId}`);
+    const descriptionChanged = desired.description !== void 0 && current.description !== desired.description;
+    if (current.name === desired.name && !descriptionChanged) {
+      return { status: "unchanged", memory_store_id: storeId };
+    }
+    await this.forwardClient.post(`/memory_stores/${storeId}`, {
+      name: desired.name,
+      ...desired.description !== void 0 ? { description: desired.description } : {}
+    });
+    return { status: "updated", memory_store_id: storeId };
+  }
+  async findDefaultMemoryStoreId(identityId, templateId) {
+    const mounts = await this.forwardClient.get(
+      `/identities/${identityId}/templates/${templateId}/memory_stores`
+    );
+    const writableDefault = (mounts.data ?? []).find(
+      (mount) => mount.system_managed === true && mount.access === "read_write"
+    );
+    return typeof writableDefault?.memory_store_id === "string" ? writableDefault.memory_store_id : null;
+  }
+  async deleteDefaultMemoryStore(id) {
+    await this.client.delete(`/memory_stores/${id}`);
+  }
   async createIdentity(name, decl) {
     if (decl.identity_id) return { id: decl.identity_id, type: "identity" };
     const res = await this.forwardClient.post("/identities", {
@@ -2886,12 +3070,14 @@ var QoderAdapter = class _QoderAdapter {
   }
   async updateChannel(id, name, decl, refs) {
     const current = await this.forwardClient.get(`/channels/${id}`);
-    if (current.channel_type !== decl.type) {
+    const currentMode = current.identity_resolution?.mode ?? "fixed";
+    if (current.channel_type !== decl.type || currentMode !== (decl.mode ?? "fixed")) {
       await this.deleteChannel(id);
       return this.createChannel(name, decl, refs);
     }
     const body = this.mapChannel(name, decl, refs);
     delete body.channel_type;
+    delete body.identity_resolution;
     const res = await this.forwardClient.post(`/channels/${id}`, body);
     return toRemoteResource(res);
   }
@@ -2899,9 +3085,8 @@ var QoderAdapter = class _QoderAdapter {
     await this.forwardClient.delete(`/channels/${id}`);
   }
   mapChannel(name, decl, refs) {
-    return {
-      identity_id: refs.identity_id,
-      template_id: refs.agent_id,
+    const mode = decl.mode ?? "fixed";
+    const body = {
       channel_type: decl.type,
       name: decl.name ?? name,
       enabled: decl.enabled ?? true,
@@ -2914,22 +3099,27 @@ var QoderAdapter = class _QoderAdapter {
         }
       }
     };
-  }
-  async registerForwardVaults(vaultIds) {
-    for (const id of vaultIds) {
-      await this.forwardClient.post("/resources/registry", {
-        type: "vault",
-        resource: { id }
-      });
+    if (mode === "pairing") {
+      body.identity_resolution = { mode: "pairing" };
+    } else {
+      body.identity_id = refs.identity_id;
+      body.template_id = refs.agent_id;
     }
+    return body;
   }
-  async createMemoryStore(name, decl) {
+  async createMemoryStore(name, decl, mode = "managed") {
     const body = mapMemoryStore2(name, decl);
-    const res = await this.client.post("/memory_stores", body);
+    const client = mode === "forward" ? this.forwardClient : this.client;
+    const memoryApi = mode === "forward" ? this.forwardMemoryApi : this.memoryApi;
+    const res = await client.post(
+      "/memory_stores",
+      body,
+      mode === "forward" ? { headers: { "Idempotency-Key": crypto.randomUUID() } } : void 0
+    );
     const storeId = res.id;
     try {
       for (const entry of decl.entries ?? []) {
-        await this.memoryApi.createMemory(storeId, { content: entry.content, path: entry.key });
+        await memoryApi.createMemory(storeId, { content: entry.content, path: entry.key });
       }
     } catch (error) {
       await this.client.delete(`/memory_stores/${storeId}`).catch(() => void 0);
@@ -2937,7 +3127,7 @@ var QoderAdapter = class _QoderAdapter {
     }
     return toRemoteResource(res);
   }
-  async deleteMemoryStore(id) {
+  async deleteMemoryStore(id, _mode = "managed") {
     await this.client.delete(`/memory_stores/${id}`);
   }
   listMemoryStores(options) {
@@ -2946,23 +3136,23 @@ var QoderAdapter = class _QoderAdapter {
   getMemoryStore(id) {
     return this.memoryApi.getStore(id);
   }
-  updateMemoryStore(id, input) {
-    return this.memoryApi.updateStore(id, input);
+  updateMemoryStore(id, input, mode = "managed") {
+    return (mode === "forward" ? this.forwardMemoryApi : this.memoryApi).updateStore(id, input);
   }
   archiveMemoryStore(id) {
     return this.memoryApi.archiveStore(id);
   }
-  createMemory(storeId, input) {
-    return this.memoryApi.createMemory(storeId, input);
+  createMemory(storeId, input, mode = "managed") {
+    return (mode === "forward" ? this.forwardMemoryApi : this.memoryApi).createMemory(storeId, input);
   }
-  listMemories(storeId, options) {
-    return this.memoryApi.listMemories(storeId, options);
+  listMemories(storeId, options, mode = "managed") {
+    return (mode === "forward" ? this.forwardMemoryApi : this.memoryApi).listMemories(storeId, options);
   }
   getMemory(storeId, memoryId) {
     return this.memoryApi.getMemory(storeId, memoryId);
   }
-  updateMemory(storeId, memoryId, input) {
-    return this.memoryApi.updateMemory(storeId, memoryId, input);
+  updateMemory(storeId, memoryId, input, mode = "managed") {
+    return (mode === "forward" ? this.forwardMemoryApi : this.memoryApi).updateMemory(storeId, memoryId, input);
   }
   deleteMemory(storeId, memoryId, expected) {
     return this.memoryApi.deleteMemory(storeId, memoryId, expected);
@@ -2979,11 +3169,15 @@ var QoderAdapter = class _QoderAdapter {
   async createDeployment(name, decl, refs, basePath) {
     const uploaded = await this.uploadDeploymentFiles(decl, basePath);
     const body = mapDeployment2(name, decl, refs, this.projectName, uploaded);
-    const res = await this.client.post("/deployments", body);
-    return toRemoteResource(res);
+    try {
+      const res = await this.client.post("/deployments", body);
+      return toRemoteResource(res);
+    } catch (error) {
+      preserveDeploymentFilesOnConflict(error, uploaded);
+    }
   }
-  async updateDeployment(id, name, decl, refs, basePath) {
-    const uploaded = await this.uploadDeploymentFiles(decl, basePath);
+  async updateDeployment(id, name, decl, refs, basePath, preparedFiles) {
+    const uploaded = preparedFiles ? new Map(preparedFiles) : await this.uploadDeploymentFiles(decl, basePath);
     const current = await this.client.get(`/deployments/${id}`);
     if (current.schedule && !decl.schedule) {
       throw new UserError(
@@ -3091,6 +3285,9 @@ var QoderAdapter = class _QoderAdapter {
       };
       if (bindings.title) body2.title = bindings.title;
       if (bindings.metadata) body2.metadata = bindings.metadata;
+      if (bindings.environment_variables) {
+        body2.config = { environment_variables: bindings.environment_variables };
+      }
       if (bindings.files?.length) {
         body2.resources = bindings.files.map((file) => ({
           type: "file",
@@ -3244,30 +3441,42 @@ var QoderAdapter = class _QoderAdapter {
     return res.data;
   }
   // --- Files ---
-  async uploadFile(filePath, options) {
+  async uploadFile(filePath, options, mode = "managed") {
+    if (mode === "forward" && options?.purpose && !["user_upload", "session_resource"].includes(options.purpose)) {
+      throw new UserError(
+        `Qoder Forward File purpose must be 'user_upload' or 'session_resource', got '${options.purpose}'.`
+      );
+    }
     const resolved = resolve2(filePath);
     const content = readFileSync2(resolved);
     const fileName = options?.name ?? basename2(resolved);
-    return this.uploadFileContent(new Uint8Array(content), fileName, {
-      purpose: options?.purpose
-    });
+    const formData = buildFileFormData(new Uint8Array(content), fileName, { purpose: options?.purpose });
+    const res = await (mode === "forward" ? this.forwardClient : this.client).postFormData(
+      "/files",
+      formData
+    );
+    return toRestFileInfo(res);
   }
   async uploadFileContent(content, filename, options) {
-    const formData = new FormData();
-    const bytes = new Uint8Array(content);
-    formData.append(
-      "file",
-      options?.mimeType ? new File([bytes], filename, { type: options.mimeType }) : new File([bytes], filename)
-    );
-    if (filename) formData.append("name", filename);
-    if (options?.purpose) formData.append("purpose", options.purpose);
+    const formData = buildFileFormData(content, filename, options);
     const res = await this.client.postFormData("/files", formData);
     return toRestFileInfo(res);
   }
-  async deleteFile(id) {
-    await this.client.delete(`/files/${id}`);
+  async deleteFile(id, mode = "managed") {
+    await (mode === "forward" ? this.forwardClient : this.client).delete(`/files/${id}`);
   }
 };
+function buildFileFormData(content, filename, options) {
+  const formData = new FormData();
+  const bytes = new Uint8Array(content);
+  formData.append(
+    "file",
+    options?.mimeType ? new File([bytes], filename, { type: options.mimeType }) : new File([bytes], filename)
+  );
+  if (filename) formData.append("name", filename);
+  if (options?.purpose) formData.append("purpose", options.purpose);
+  return formData;
+}
 function toSessionInfo2(res) {
   return buildSessionInfo(res, (r) => r.memory_store_ids ?? []);
 }
@@ -3317,22 +3526,24 @@ function normalizeQoderMcpServers(value) {
     });
   });
 }
-async function buildSkillFormData(name, decl, files) {
+async function buildSkillFormData(name, decl, files, fileField = "file", includeCreateFields = true, prefixTopLevelDirectory = false) {
   const zip = new JSZip2();
   for (const f of files) {
-    zip.file(f.relativePath, f.content);
+    zip.file(prefixTopLevelDirectory ? `${name}/${f.relativePath}` : f.relativePath, f.content);
   }
   const zipContent = await zip.generateAsync({ type: "uint8array" });
   const formData = new FormData();
   formData.append(
-    "file",
+    fileField,
     new File([new Uint8Array(zipContent)], `${name}.zip`, {
       type: "application/zip"
     })
   );
-  formData.append("name", name);
-  formData.append("type", "custom");
-  if (decl.description) formData.append("description", decl.description);
+  if (includeCreateFields) {
+    formData.append("name", name);
+    formData.append("type", "custom");
+    if (decl.description) formData.append("description", decl.description);
+  }
   return formData;
 }
 
@@ -3447,7 +3658,7 @@ function mapVault2(name, decl, projectName) {
 }
 function mapCredential2(cred) {
   if (cred.type === "environment_variable") {
-    return {
+    const body2 = {
       auth: {
         type: "environment_variable",
         secret_name: cred.secret_name,
@@ -3456,8 +3667,10 @@ function mapCredential2(cred) {
       },
       display_name: cred.name
     };
+    if (cred.metadata) body2.metadata = cred.metadata;
+    return body2;
   }
-  return {
+  const body = {
     auth: {
       type: cred.type,
       token: cred.access_token,
@@ -3465,6 +3678,8 @@ function mapCredential2(cred) {
     },
     display_name: cred.name
   };
+  if (cred.metadata) body.metadata = cred.metadata;
+  return body;
 }
 function credToDecl3(raw, vaultName) {
   const auth = raw.auth ?? {};
@@ -3474,6 +3689,7 @@ function credToDecl3(raw, vaultName) {
     return {
       name,
       type: "static_bearer",
+      metadata: stripAgentsMetadata(raw.metadata),
       mcp_server_url: auth.mcp_server_url ?? "",
       access_token: placeholder
     };
@@ -3482,6 +3698,7 @@ function credToDecl3(raw, vaultName) {
   return {
     name,
     type: "environment_variable",
+    metadata: stripAgentsMetadata(raw.metadata),
     secret_name: auth.secret_name ?? name,
     secret_value: placeholder,
     networking: networking ?? { type: "unrestricted" }
@@ -3549,6 +3766,7 @@ function agentToDecl3(raw) {
   const model = raw.model;
   const modelValue = typeof model === "object" && model ? model.id : model;
   return compactDeep({
+    name: raw.name,
     description: raw.description,
     model: modelValue,
     instructions: raw.system,
@@ -3568,7 +3786,7 @@ function mapAgent3(name, decl, refs, version, projectName, skillVersions) {
     modelId = typeof bailianModel === "string" ? bailianModel : bailianModel.id;
   }
   const body = {
-    name,
+    name: decl.name ?? name,
     model: { id: modelId },
     system: decl.instructions
   };
@@ -3581,7 +3799,9 @@ function mapAgent3(name, decl, refs, version, projectName, skillVersions) {
   }
   const BAILIAN_BUILTINS = /* @__PURE__ */ new Set(["bash", "read", "write", "edit", "glob", "grep", "download_file"]);
   if (decl.tools) {
-    const toolConfigs = resolveBuiltinTools(decl.tools, { supportedWireNames: BAILIAN_BUILTINS }).map((tool) => ({
+    const toolConfigs = resolveBuiltinTools(decl.tools, {
+      supportedWireNames: BAILIAN_BUILTINS
+    }).map((tool) => ({
       name: tool.wireName,
       enabled: true
     }));
@@ -3655,30 +3875,60 @@ function mapSession3(bindings) {
   if (bindings.memory_store_ids.length) body.memory_store_ids = bindings.memory_store_ids;
   return body;
 }
-function mapDeploymentToSession(decl, refs, fileIds) {
+function mapDeployment3(name, decl, refs, projectName, uploadedFiles) {
+  const agent = { id: refs.agent_id };
+  if (refs.agent_version !== void 0) agent.version = refs.agent_version;
   const body = {
-    agent: refs.agent_id,
-    environment_id: refs.environment_id
+    name: decl.name ?? name,
+    agent,
+    environment_id: refs.environment_id,
+    initial_events: mapMessageEvents(decl.initial_events)
   };
-  if (decl.description) body.title = decl.description;
-  if (fileIds.length) {
-    const fileResources = (decl.resources ?? []).filter((r) => r.type === "file");
-    body.resources = fileIds.map((id, index) => {
-      const entry = { type: "file", file_id: id };
-      const mountPath = fileResources[index]?.mount_path;
-      if (mountPath) entry.mount_path = mountPath;
-      return entry;
-    });
+  if (decl.description) body.description = decl.description;
+  if (refs.vault_ids.length) body.vault_ids = refs.vault_ids;
+  const resources = mapDeploymentResources3(decl, uploadedFiles);
+  if (resources.length) body.resources = resources;
+  if (decl.schedule) {
+    body.schedule = {
+      type: "cron",
+      expression: decl.schedule.expression,
+      timezone: decl.schedule.timezone
+    };
+  }
+  if (projectName) {
+    body.metadata = injectMetadata(decl.metadata, projectName, name);
+  } else if (decl.metadata) {
+    body.metadata = decl.metadata;
   }
   return body;
 }
-function mapInitialEvents2(events) {
-  const input = events.filter((e) => e.type === "user.message" || e.type === "system.message").map((e) => ({
+function mapDeploymentUpdate3(name, decl, refs, projectName, uploadedFiles, existingMetadata) {
+  const body = mapDeployment3(name, decl, refs, projectName, uploadedFiles);
+  body.description = decl.description ?? "";
+  body.vault_ids = refs.vault_ids;
+  body.resources = mapDeploymentResources3(decl, uploadedFiles);
+  if (!decl.schedule) body.schedule = null;
+  if (!projectName && !decl.metadata && existingMetadata) body.metadata = existingMetadata;
+  return body;
+}
+function mapDeploymentResources3(decl, uploadedFiles) {
+  const resources = [];
+  for (const resource of decl.resources ?? []) {
+    if (resource.type !== "file") continue;
+    const fileId = resource.file_id ?? (resource.source ? uploadedFiles?.get(resource.source) : void 0);
+    if (!fileId) continue;
+    const entry = { type: "file", file_id: fileId };
+    if (resource.mount_path) entry.mount_path = resolveSandboxMountPath("bailian", resource.mount_path);
+    resources.push(entry);
+  }
+  return resources;
+}
+function mapMessageEvents(events) {
+  return events.filter((event) => event.type === "user.message" || event.type === "system.message").map((event) => ({
     role: "user",
     type: "message",
-    content: [{ type: "text", text: e.content }]
+    content: [{ type: "text", text: event.content }]
   }));
-  return { input };
 }
 function mapSendMessage3(text) {
   return {
@@ -3710,7 +3960,8 @@ var BailianAdapter = class _BailianAdapter {
     agent: "/agents",
     skill: "/skills",
     vault: "/vaults",
-    file: "/files"
+    file: "/files",
+    deployment: "/deployments"
   };
   async findResource(type, name, id) {
     const accept = type === "agent" ? (r) => !isArchivedAgent(r) : void 0;
@@ -3766,6 +4017,7 @@ var BailianAdapter = class _BailianAdapter {
       });
     }
     return compactDeep({
+      name: raw.name,
       description: raw.description,
       model: normalizeBailianModel(raw.model),
       instructions: raw.system,
@@ -3797,6 +4049,18 @@ var BailianAdapter = class _BailianAdapter {
   async deleteEnvironment(id) {
     await this.client.delete(`/environments/${id}`);
   }
+  async listEnvironmentResources(options) {
+    const params = cursorParams(options);
+    if (options?.include_archived !== void 0) {
+      params.set("include_archived", String(options.include_archived));
+    }
+    const res = await this.client.get(withQuery("/environments", params));
+    return cursorPage(res, toCloudEnvironment);
+  }
+  async getRemoteEnvironment(id) {
+    const res = await this.client.get(`/environments/${id}`);
+    return toCloudEnvironment(res);
+  }
   // --- Agent ---
   async createAgent(name, decl, refs) {
     const skillVersions = await this.fetchSkillVersions(refs);
@@ -3845,6 +4109,25 @@ var BailianAdapter = class _BailianAdapter {
   async deleteAgent(id) {
     await this.client.post(`/agents/${id}/archive`, {});
   }
+  async listAgentResources(options) {
+    const params = cursorParams(options);
+    if (options?.include_archived !== void 0) {
+      params.set("include_archived", String(options.include_archived));
+    }
+    const res = await this.client.get(withQuery("/agents", params));
+    return cursorPage(res, toCloudAgent);
+  }
+  async getRemoteAgent(id, version) {
+    const params = new URLSearchParams();
+    if (version !== void 0) params.set("version", String(version));
+    const res = await this.client.get(withQuery(`/agents/${id}`, params));
+    return toCloudAgent(res);
+  }
+  async listAgentVersions(id, options) {
+    const params = cursorParams(options);
+    const res = await this.client.get(withQuery(`/agents/${id}/versions`, params));
+    return cursorPage(res, toCloudAgent);
+  }
   // --- Skill (2-step: Files API → Skills API) ---
   async createSkill(name, decl, files) {
     const fileId = await this.uploadSkillZip(name, decl, files);
@@ -3943,10 +4226,31 @@ var BailianAdapter = class _BailianAdapter {
     const all = await this.client.getAllPaged(path);
     return all.map(toBailianSkillInfo);
   }
+  async listSkillResources(options) {
+    const params = cursorParams(options);
+    if (options?.source === "official") params.set("source", "official");
+    if (options?.source === "custom") params.set("source", "customer");
+    const res = await this.client.get(withQuery("/skills", params));
+    return cursorPage(res, toBailianSkillInfo);
+  }
   async getSkillInfo(id) {
     const res = await this.client.get(`/skills/${id}`);
     return toBailianSkillInfo(res);
   }
+  async listSkillVersions(id, options) {
+    const params = cursorParams(options);
+    const res = await this.client.get(withQuery(`/skills/${id}/versions`, params));
+    return cursorPage(res, toSkillVersionInfo);
+  }
+  async getSkillVersion(id, version) {
+    const res = await this.client.get(`/skills/${id}/versions/${encodeURIComponent(version)}`);
+    return toSkillVersionInfo(res);
+  }
+  async getSkillDownloadInfo(id, version) {
+    return await this.client.get(
+      `/skills/${id}/versions/${encodeURIComponent(version)}/content`
+    );
+  }
   // Non-blocking create: file already uploaded → POST /skills with retry for residual OSS
   // replication lag (postSkillWithRetry covers SKILL_FILE_NOT_FOUND for a few seconds), and return
   // the initial status WITHOUT waiting for the security scan. Callers MUST ensure the file has
@@ -3976,7 +4280,7 @@ var BailianAdapter = class _BailianAdapter {
   }
   async waitForFileReady(fileId) {
     const start = Date.now();
-    let delay2 = FILE_SCAN_BACKOFF.initial;
+    let delay3 = FILE_SCAN_BACKOFF.initial;
     let logged = false;
     while (true) {
       const detail = await this.client.get(`/files/${fileId}`);
@@ -3995,8 +4299,8 @@ var BailianAdapter = class _BailianAdapter {
         );
         return;
       }
-      await new Promise((r) => setTimeout(r, delay2));
-      delay2 = Math.min(delay2 * FILE_SCAN_BACKOFF.factor, FILE_SCAN_BACKOFF.max);
+      await new Promise((r) => setTimeout(r, delay3));
+      delay3 = Math.min(delay3 * FILE_SCAN_BACKOFF.factor, FILE_SCAN_BACKOFF.max);
     }
   }
   // --- Vault (Vaults API) ---
@@ -4018,6 +4322,18 @@ var BailianAdapter = class _BailianAdapter {
     const all = await this.client.getAllPaged("/vaults");
     return all.map(toCloudVault);
   }
+  async listVaultResources(options) {
+    const params = cursorParams(options);
+    if (options?.include_archived !== void 0) {
+      params.set("include_archived", String(options.include_archived));
+    }
+    const res = await this.client.get(withQuery("/vaults", params));
+    return cursorPage(res, toCloudVault);
+  }
+  async getRemoteVault(id) {
+    const res = await this.client.get(`/vaults/${id}`);
+    return toCloudVault(res);
+  }
   async getVault(id) {
     return await this.client.get(`/vaults/${id}`);
   }
@@ -4039,7 +4355,21 @@ var BailianAdapter = class _BailianAdapter {
   }
   async listCredentials(vaultId) {
     const all = await this.client.getAllPaged(`/vaults/${vaultId}/credentials`);
-    return all.map(toRemoteResource);
+    return all.map((raw) => {
+      const auth = raw.auth ?? {};
+      const networking = auth.networking;
+      const metadata = raw.metadata;
+      return {
+        id: raw.id,
+        display_name: raw.display_name ?? raw.id,
+        auth_type: auth.type ?? "",
+        secret_name: auth.secret_name,
+        networking_type: networking?.type,
+        metadata: metadata ? Object.fromEntries(
+          Object.entries(metadata).filter((entry) => typeof entry[1] === "string")
+        ) : void 0
+      };
+    });
   }
   async getCredential(vaultId, credentialId) {
     return await this.client.get(`/vaults/${vaultId}/credentials/${credentialId}`);
@@ -4055,46 +4385,116 @@ var BailianAdapter = class _BailianAdapter {
   async deleteCredential(vaultId, credentialId) {
     await this.client.delete(`/vaults/${vaultId}/credentials/${credentialId}`);
   }
-  // --- Deployment (emulated) ---
-  async createDeployment(_name, _decl, _refs, _basePath) {
-    return { id: null, type: "deployment" };
+  // --- Deployment ---
+  async createDeployment(name, decl, refs, basePath) {
+    const uploaded = await this.uploadDeploymentFiles(decl, basePath);
+    const body = mapDeployment3(name, decl, refs, this.projectName, uploaded);
+    try {
+      const res = await this.client.post("/deployments", body);
+      return toRemoteResource(res);
+    } catch (error) {
+      preserveDeploymentFilesOnConflict(error, uploaded);
+    }
   }
-  async updateDeployment(_id, _name, _decl, _refs, _basePath) {
-    return { id: null, type: "deployment" };
+  async updateDeployment(id, name, decl, refs, basePath, preparedFiles) {
+    if (!id) return this.createDeployment(name, decl, refs, basePath);
+    const current = await this.client.get(`/deployments/${id}`);
+    const uploaded = preparedFiles ? new Map(preparedFiles) : await this.uploadDeploymentFiles(decl, basePath);
+    const body = mapDeploymentUpdate3(
+      name,
+      decl,
+      refs,
+      this.projectName,
+      uploaded,
+      current.metadata
+    );
+    const res = await this.client.post(`/deployments/${id}`, body);
+    return toRemoteResource(res);
   }
-  async deleteDeployment(_id) {
+  async deleteDeployment(id) {
+    await this.client.post(`/deployments/${id}/archive`, {});
   }
   async runDeployment(ctx) {
-    const fileIds = [];
-    for (const r of ctx.decl.resources ?? []) {
-      if (r.type === "file") {
-        if (r.file_id) {
-          fileIds.push(r.file_id);
-        } else if (r.source) {
-          fileIds.push(await this.uploadSessionFile(r.source, ctx.basePath));
-        }
-      }
-    }
-    const body = mapDeploymentToSession(ctx.decl, ctx.refs, fileIds);
-    const sessionRes = await this.client.post("/sessions", body);
-    const sessionId = sessionRes.id;
-    const eventsBody = mapInitialEvents2(ctx.decl.initial_events);
-    const input = eventsBody.input;
-    if (input.length) {
-      await this.client.post(`/sessions/${sessionId}/events`, eventsBody);
+    if (!ctx.id) {
+      throw new UserError(`Deployment '${ctx.name}' has no remote id; run \`agents apply\` first.`);
     }
-    return { session_id: sessionId };
+    const res = await this.client.post(`/deployments/${ctx.id}/run`, {});
+    return toDeploymentRunResult(res);
   }
   async getDeployment(ctx) {
-    const plan = mapDeploymentToSession(ctx.decl, ctx.refs, []);
-    return {
-      id: ctx.id,
-      status: "emulated (local)",
-      schedule: ctx.decl.schedule,
-      attributes: { materialization_plan: plan }
-    };
-  }
-  async uploadSessionFile(source, basePath) {
+    if (!ctx.id) {
+      throw new UserError(`Deployment '${ctx.name}' has no remote id; run \`agents apply\` first.`);
+    }
+    const res = await this.client.get(`/deployments/${ctx.id}`);
+    return toDeploymentInfo3(res);
+  }
+  async listDeployments(filter) {
+    const params = new URLSearchParams();
+    if (filter?.agent_id) params.set("agent_id", filter.agent_id);
+    if (filter?.keyword) params.set("keyword", filter.keyword);
+    if (filter?.status) params.set("status", filter.status);
+    if (filter?.include_archived) params.set("include_archived", "true");
+    if (filter?.limit) params.set("limit", String(filter.limit));
+    if (filter?.page) params.set("page", filter.page);
+    if (filter?.created_at_gte) params.set("created_at[gte]", filter.created_at_gte);
+    if (filter?.created_at_lte) params.set("created_at[lte]", filter.created_at_lte);
+    const query2 = params.toString();
+    const res = await this.client.get(`/deployments${query2 ? `?${query2}` : ""}`);
+    const nextPage = res.next_page ?? void 0;
+    return {
+      deployments: (res.data ?? []).map(toDeploymentInfo3),
+      has_more: nextPage != null,
+      next_page: nextPage
+    };
+  }
+  async getDeploymentById(id) {
+    const res = await this.client.get(`/deployments/${id}`);
+    return toDeploymentInfo3(res);
+  }
+  async runDeploymentById(id) {
+    const res = await this.client.post(`/deployments/${id}/run`, {});
+    return toDeploymentRunResult(res);
+  }
+  async pauseDeploymentById(id) {
+    const res = await this.client.post(`/deployments/${id}/pause`, {});
+    return toDeploymentInfo3(res);
+  }
+  async unpauseDeploymentById(id) {
+    const res = await this.client.post(`/deployments/${id}/unpause`, {});
+    return toDeploymentInfo3(res);
+  }
+  async listDeploymentRuns(deploymentId, options) {
+    const res = await this.client.get(
+      withQuery(`/deployments/${deploymentId}/runs`, cursorParams(options))
+    );
+    return cursorPage(res, toDeploymentRunInfo);
+  }
+  async getDeploymentRun(runId) {
+    const res = await this.client.get(`/deployment_runs/${runId}`);
+    return toDeploymentRunInfo(res);
+  }
+  async pauseDeployment(ctx) {
+    return this.setDeploymentPaused(ctx, true);
+  }
+  async unpauseDeployment(ctx) {
+    return this.setDeploymentPaused(ctx, false);
+  }
+  async setDeploymentPaused(ctx, paused) {
+    if (!ctx.id) throw new UserError(`Deployment '${ctx.name}' has no remote id; run \`agents apply\` first.`);
+    const action = paused ? "pause" : "unpause";
+    const res = await this.client.post(`/deployments/${ctx.id}/${action}`, {});
+    return toDeploymentInfo3(res);
+  }
+  async uploadDeploymentFiles(decl, basePath) {
+    const uploaded = /* @__PURE__ */ new Map();
+    for (const resource of decl.resources ?? []) {
+      if (resource.type === "file" && !resource.file_id && resource.source && !uploaded.has(resource.source)) {
+        uploaded.set(resource.source, await this.uploadDeploymentFile(resource.source, basePath));
+      }
+    }
+    return uploaded;
+  }
+  async uploadDeploymentFile(source, basePath) {
     const fullPath = resolve3(dirname3(basePath), source);
     const content = readFileSync3(fullPath);
     const formData = new FormData();
@@ -4127,6 +4527,9 @@ var BailianAdapter = class _BailianAdapter {
   async listSessions(filter) {
     const params = new URLSearchParams();
     if (filter?.agent_id) params.set("agent_id", filter.agent_id);
+    for (const status of filter?.statuses ?? []) params.append("statuses[]", status);
+    if (filter?.created_at_gte) params.set("created_at[gte]", filter.created_at_gte);
+    if (filter?.created_at_lte) params.set("created_at[lte]", filter.created_at_lte);
     if (filter?.limit) params.set("limit", String(filter.limit));
     if (filter?.page) params.set("page", filter.page);
     const qs = params.toString();
@@ -4143,6 +4546,15 @@ var BailianAdapter = class _BailianAdapter {
     const res = await this.client.get(`/sessions/${id}`);
     return toSessionInfo3(res);
   }
+  async updateSession(id, input) {
+    const res = await this.client.post(`/sessions/${id}`, input);
+    if (!res.agent || !res.environment_id) return this.getSession(id);
+    return toSessionInfo3(res);
+  }
+  async archiveSession(id) {
+    const res = await this.client.post(`/sessions/${id}/archive`, {});
+    return toSessionInfo3(res);
+  }
   async deleteSession(id) {
     await this.client.delete(`/sessions/${id}`);
   }
@@ -4151,13 +4563,20 @@ var BailianAdapter = class _BailianAdapter {
     const res = await this.client.post(`/sessions/${sessionId}/events`, body);
     return extractCreatedEventId(res);
   }
+  async sendSessionEvents(sessionId, events) {
+    const res = await this.client.post(`/sessions/${sessionId}/events`, { input: events });
+    return {
+      event_ids: extractCreatedEventIds(res),
+      attributes: res
+    };
+  }
   async *streamSessionEvents(sessionId, _options) {
     for await (const raw of this.client.sse(`/sessions/${sessionId}/events/stream`)) {
       yield toSessionEvent(raw);
     }
   }
   async listSessionEvents(sessionId, options) {
-    return listSessionEventsPaged(this.client, sessionId, options, toSessionEvent);
+    return listSessionEventsPaged(this.client, sessionId, options, toSessionEvent, { forwardTypes: false });
   }
   // --- Files ---
   async uploadFile(filePath, options) {
@@ -4183,6 +4602,15 @@ var BailianAdapter = class _BailianAdapter {
     const all = await this.client.getAllPaged("/files");
     return all.map(toRestFileInfo);
   }
+  async listFileResources(options) {
+    const params = cursorParams(options);
+    if (options?.scope_id) params.set("scope_id", options.scope_id);
+    const res = await this.client.get(withQuery("/files", params));
+    return cursorPage(res, toRestFileInfo);
+  }
+  async downloadFileContent(id) {
+    return new Uint8Array(await this.client.getBuffer(`/files/${id}/content`));
+  }
   async deleteFile(id) {
     await this.client.delete(`/files/${id}`);
   }
@@ -4190,6 +4618,19 @@ var BailianAdapter = class _BailianAdapter {
 function isArchivedAgent(raw) {
   return typeof raw.archived_at === "string" && raw.archived_at.trim().length > 0;
 }
+function toDeploymentInfo3(res) {
+  const schedule = res.schedule;
+  return {
+    id: res.id ?? null,
+    status: res.status ?? "unknown",
+    paused_reason: res.paused_reason ?? void 0,
+    schedule: schedule ? {
+      expression: schedule.expression,
+      timezone: schedule.timezone
+    } : void 0,
+    attributes: res
+  };
+}
 function toSessionInfo3(res) {
   return buildSessionInfo(res, () => []);
 }
@@ -4204,9 +4645,77 @@ function toBailianSkillInfo(res) {
     status: skillStatusFromString(res.status),
     latest_version: res.latest_version,
     created_at: res.created_at,
-    updated_at: res.updated_at
+    updated_at: res.updated_at,
+    attributes: res
+  };
+}
+function cursorParams(options) {
+  const params = new URLSearchParams();
+  if (options?.limit !== void 0) params.set("limit", String(options.limit));
+  if (options?.page) params.set("page", options.page);
+  return params;
+}
+function withQuery(path, params) {
+  const query2 = params.toString();
+  return query2 ? `${path}?${query2}` : path;
+}
+function cursorPage(res, mapper) {
+  const nextPage = res.next_page ?? void 0;
+  return {
+    data: (res.data ?? []).map(mapper),
+    has_more: res.has_more ?? nextPage !== void 0,
+    next_page: nextPage
+  };
+}
+function toSkillVersionInfo(res) {
+  return {
+    id: res.id,
+    skill_id: res.skill_id ?? "",
+    type: res.type ?? "skill_version",
+    name: res.name,
+    description: res.description,
+    version: res.version ?? "",
+    status: res.status,
+    created_at: res.created_at,
+    updated_at: res.updated_at,
+    additional_properties: res.additional_properties,
+    attributes: res
+  };
+}
+function toDeploymentRunResult(res) {
+  return {
+    run_id: res.id,
+    session_id: res.session_id ?? null,
+    error: res.error ?? void 0
+  };
+}
+function toDeploymentRunInfo(res) {
+  return {
+    id: res.id ?? "",
+    deployment_id: res.deployment_id,
+    session_id: res.session_id ?? void 0,
+    status: res.status,
+    error: res.error ?? void 0,
+    created_at: res.created_at,
+    updated_at: res.updated_at,
+    attributes: res
   };
 }
+function extractCreatedEventIds(res) {
+  const ids = /* @__PURE__ */ new Set();
+  const topLevel = extractCreatedEventId(res);
+  if (topLevel) ids.add(topLevel);
+  for (const key of ["data", "events"]) {
+    const items = res[key];
+    if (!Array.isArray(items)) continue;
+    for (const item of items) {
+      if (!item || typeof item !== "object") continue;
+      const id = item.id;
+      if (typeof id === "string") ids.add(id);
+    }
+  }
+  return Array.from(ids);
+}
 function normalizeBailianModel(value) {
   if (value && typeof value === "object" && "id" in value) {
     return value.id;
@@ -4286,9 +4795,8 @@ var BAILIAN_CAPABILITIES = {
     remediation: "deploy agents independently and orchestrate via MCP"
   },
   deployment: {
-    tier: "emulated",
-    reason: "no deployment primitive on Bailian; expanded into a session at run time",
-    remediation: "scheduling and outcome rubrics are not enforced server-side \u2014 use external cron/CI for always-on or scheduled runs"
+    tier: "native",
+    reason: "deployments API with cron schedules, manual runs, pause/unpause and archive"
   },
   session: { tier: "native", reason: "sessions API" },
   identity: { tier: "unsupported", reason: "no mapped Identity primitive on Bailian" },
@@ -4533,7 +5041,7 @@ function mapAgent4(name, decl, refs, version, projectName) {
   if (!arkModel) throw new UserError(`No Ark model specified for agent '${name}'`);
   const modelValue = typeof arkModel === "string" ? { id: arkModel } : { id: arkModel.id };
   const body = {
-    name,
+    name: decl.name ?? name,
     model: modelValue,
     system: decl.instructions
   };
@@ -4590,7 +5098,7 @@ function mapAgent4(name, decl, refs, version, projectName) {
   }
   return body;
 }
-function mapDeploymentToSession2(decl, refs, fileIds) {
+function mapDeploymentToSession(decl, refs, fileIds) {
   const body = {
     agent: refs.agent_id,
     environment_id: refs.environment_id
@@ -4953,7 +5461,7 @@ var ArkAdapter = class _ArkAdapter {
         }
       }
     }
-    const body = mapDeploymentToSession2(ctx.decl, ctx.refs, fileIds);
+    const body = mapDeploymentToSession(ctx.decl, ctx.refs, fileIds);
     const sessionRes = await this.client.post("/sessions", body);
     const sessionId = sessionRes.id;
     const events = ctx.decl.initial_events.filter((e) => e.type === "user.message" || e.type === "system.message").map((e) => ({
@@ -4966,7 +5474,7 @@ var ArkAdapter = class _ArkAdapter {
     return { session_id: sessionId };
   }
   async getDeployment(ctx) {
-    const plan = mapDeploymentToSession2(ctx.decl, ctx.refs, []);
+    const plan = mapDeploymentToSession(ctx.decl, ctx.refs, []);
     return {
       id: ctx.id,
       status: "emulated (local)",
@@ -5239,6 +5747,9 @@ var packagesSchema = z5.object({
   gem: z5.array(z5.string()).optional(),
   go: z5.array(z5.string()).optional()
 });
+var setupScriptSchema = z5.string().refine((value) => new TextEncoder().encode(value).byteLength <= 64 * 1024, {
+  message: "setup_script must not exceed 65536 UTF-8 bytes"
+});
 var environmentSchema = z5.object({
   name: z5.string().optional(),
   description: z5.string().optional(),
@@ -5248,7 +5759,8 @@ var environmentSchema = z5.object({
   config: z5.object({
     type: z5.enum(["cloud", "self_hosted"]),
     networking: networkingSchema.optional(),
-    packages: packagesSchema.optional()
+    packages: packagesSchema.optional(),
+    setup_script: setupScriptSchema.optional()
   }),
   metadata: z5.record(z5.string(), z5.string()).optional()
 });
@@ -5263,6 +5775,7 @@ var coerceString = z5.union([z5.string(), z5.number()]).transform(String);
 var staticBearerCredentialSchema = z5.object({
   name: z5.string(),
   type: z5.literal("static_bearer"),
+  metadata: z5.record(z5.string(), z5.string()).optional(),
   mcp_server_url: z5.string(),
   access_token: coerceString,
   protocol: z5.enum(["sse", "streamable_http"]).optional()
@@ -5270,6 +5783,7 @@ var staticBearerCredentialSchema = z5.object({
 var environmentVariableCredentialSchema = z5.object({
   name: z5.string(),
   type: z5.literal("environment_variable"),
+  metadata: z5.record(z5.string(), z5.string()).optional(),
   secret_name: z5.string(),
   secret_value: coerceString,
   networking: z5.object({ type: z5.enum(["unrestricted", "limited"]) }).optional()
@@ -5412,6 +5926,9 @@ var agentSkillRefSchema = z5.object({
 var agentDeliverySchema = z5.object({
   type: z5.enum(["managed", "forward"])
 });
+var managedToolConfigSchema = z5.object({
+  enabled_tools: z5.array(z5.string().min(1))
+});
 var sessionGithubRepoResourceSchema = z5.object({
   type: z5.literal("github_repository"),
   url: z5.string().url(),
@@ -5433,18 +5950,27 @@ var agentSchema = z5.object({
   mcp_servers: z5.array(mcpServerSchema).optional(),
   skills: z5.array(z5.union([z5.string(), agentSkillRefSchema])).optional(),
   vault: z5.string().optional(),
+  files: z5.array(z5.string()).optional(),
   memory_stores: z5.array(z5.string()).optional(),
+  default_memory_store: z5.object({
+    name: z5.string().trim().min(1).max(255),
+    description: z5.string().max(1024).optional(),
+    delete_on_destroy: z5.boolean().optional().default(false)
+  }).optional(),
   resources: z5.array(sessionGithubRepoResourceSchema).optional(),
   multiagent: multiagentSchema.optional(),
   metadata: z5.record(z5.string(), z5.string()).optional(),
+  environment_variables: z5.record(z5.string().min(1), z5.string()).optional(),
+  managed_tool_config: managedToolConfigSchema.optional(),
   delivery: z5.record(z5.string(), agentDeliverySchema).optional()
 });
 var channelSchema = z5.object({
   provider: z5.string().optional(),
-  agent: z5.string().min(1),
+  agent: z5.string().min(1).optional(),
   identity: z5.string().min(1).optional(),
   type: z5.string().min(1),
   name: z5.string().trim().min(1).optional(),
+  mode: z5.enum(["fixed", "pairing"]).optional().default("fixed"),
   enabled: z5.boolean().optional(),
   credentials: z5.record(z5.string(), coerceString).optional(),
   options: z5.record(z5.string(), z5.unknown()).optional()
@@ -5491,6 +6017,7 @@ var scheduleSchema = z5.object({
   timezone: z5.string()
 });
 var deploymentSchema = z5.object({
+  name: z5.string().optional(),
   agent: z5.string(),
   agent_version: z5.number().int().optional(),
   environment: z5.string().optional(),
@@ -5683,14 +6210,29 @@ async function computeResourceHash(address, config, basePath, state) {
   if (!decl) return "";
   if (address.type === "skill") {
     const skillDecl = decl;
+    const apiMode = resolveQoderApiMode(address.type, address.name, address.provider, config);
     if (basePath) {
       const fileHash = computeSkillContentHash(skillDecl.source, basePath);
-      return contentHash({ decl, fileHash });
+      return contentHash({ decl, fileHash, apiMode });
     }
+    return contentHash({ decl, apiMode });
+  }
+  if (address.type === "environment" || address.type === "vault" || address.type === "memory_store") {
+    return contentHash({ decl, apiMode: resolveQoderApiMode(address.type, address.name, address.provider, config) });
+  }
+  if (address.type === "file" && basePath) {
+    const fileDecl = decl;
+    const fileHash = computeLocalFileContentHash(fileDecl.source, basePath);
+    return contentHash({
+      decl,
+      fileHash,
+      apiMode: resolveQoderApiMode("file", address.name, address.provider, config)
+    });
   }
   if (address.type === "deployment") {
     const refs = resolveDeploymentReferenceIds(decl, config, address.provider, state);
-    if (refs) return contentHash({ decl, refs });
+    const sourceHashes = basePath ? computeDeploymentSourceHashes(decl, basePath) : void 0;
+    if (refs || sourceHashes) return contentHash({ decl, refs, sourceHashes });
   }
   if (address.type === "template") {
     const refs = resolveTemplateReferenceIds(decl, config, address.provider, state);
@@ -5707,7 +6249,28 @@ async function computeResourceHash(address, config, basePath, state) {
   }
   return contentHash(decl);
 }
+function resolveQoderApiMode(type, name, provider, config) {
+  if (provider !== "qoder") return void 0;
+  if (type === "environment" && config.environments?.[name]?.environment_id) return "auto";
+  for (const agent of Object.values(config.agents ?? {})) {
+    if (agent.provider && agent.provider !== provider) continue;
+    const referenced = type === "environment" ? agent.environment === name : type === "skill" ? agent.skills?.some(
+      (skill) => typeof skill === "string" ? skill === name : skill.type === "custom" && skill.skill_id === name
+    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.includes(name);
+    if (referenced && agent.delivery?.qoder?.type === "forward") return "forward";
+  }
+  return "managed";
+}
+function computeReplacementFingerprint(address, config) {
+  if (address.type !== "channel") return void 0;
+  const decl = config.channels?.[address.name];
+  if (!decl) return void 0;
+  return contentHash({ channel_type: decl.type, mode: decl.mode ?? "fixed", credentials: decl.credentials ?? {} });
+}
 function resolveChannelReferenceIds(decl, config, provider, state) {
+  if (decl.mode === "pairing" || !decl.agent) {
+    return { mode: "pairing" };
+  }
   const agent = config.agents?.[decl.agent];
   const agentType = agent?.delivery?.[provider]?.type === "forward" ? "template" : "agent";
   const identity = decl.identity ?? config.defaults?.identity;
@@ -5730,7 +6293,14 @@ function resolveTemplateReferenceIds(decl, config, provider, state) {
     environment_id: environment?.environment_id ?? (decl.environment ? state?.getResource({ type: "environment", name: decl.environment, provider })?.remote_id ?? void 0 : void 0),
     tunnel_id: tunnel?.tunnel_id,
     vault_ids: decl.vault ? [state?.getResource({ type: "vault", name: decl.vault, provider })?.remote_id ?? decl.vault] : [],
-    skill_ids: skillIds
+    skill_ids: skillIds,
+    memory_store_ids: (decl.memory_stores ?? []).map(
+      (memoryStore) => state?.getResource({ type: "memory_store", name: memoryStore, provider })?.remote_id ?? memoryStore
+    ),
+    file_ids: (decl.files ?? []).map(
+      (file) => state?.getResource({ type: "file", name: file, provider })?.remote_id ?? file
+    ),
+    identity_id: decl.memory_stores?.length && config.defaults?.identity ? state?.getResource({ type: "identity", name: config.defaults.identity, provider })?.remote_id : void 0
   };
 }
 function resolveDeploymentReferenceIds(decl, config, provider, state) {
@@ -5745,6 +6315,23 @@ function resolveDeploymentReferenceIds(decl, config, provider, state) {
 function getDeclaration(address, config) {
   return getResourceDeclaration(address, config);
 }
+function computeDeploymentSourceHashes(decl, basePath) {
+  const sources = [
+    ...new Set(
+      (decl.resources ?? []).flatMap(
+        (resource) => resource.type === "file" && !resource.file_id && resource.source ? [resource.source] : []
+      )
+    )
+  ];
+  if (sources.length === 0) return void 0;
+  return Object.fromEntries(sources.map((source) => [source, computeLocalFileContentHash(source, basePath)]));
+}
+function computeLocalFileContentHash(source, basePath) {
+  const fullPath = resolve9(dirname8(basePath), source);
+  const stat = statSync2(fullPath, { throwIfNoEntry: false });
+  if (!stat?.isFile()) return "";
+  return contentHash(readFileSync6(fullPath).toString("base64"));
+}
 function computeSkillContentHash(source, basePath) {
   const fullPath = resolve9(dirname8(basePath), source);
   const stat = statSync2(fullPath, { throwIfNoEntry: false });
@@ -5893,11 +6480,21 @@ function resolveTemplateRefs(agentName, config, provider, state) {
   const environment = config.environments?.[agent.environment];
   if (!environment) throw new UserError(`Environment '${agent.environment}' is not defined in config.`);
   const agentRefs = resolveAgentRefs(agentName, config, provider, state);
+  const memoryStoreIds = (agent.memory_stores ?? []).map(
+    (memoryStore) => requireRef(state, { type: "memory_store", name: memoryStore, provider })
+  );
+  const identityName = config.defaults?.identity;
   return {
     ...agentRefs,
     environment_id: environment.environment_id ?? requireRef(state, { type: "environment", name: agent.environment, provider }),
     ...agent.tunnel ? { tunnel_id: resolveTunnelIdFromConfig(config, agent.tunnel, provider) } : {},
-    vault_ids: agent.vault ? [requireRef(state, { type: "vault", name: agent.vault, provider })] : []
+    vault_ids: agent.vault ? [requireRef(state, { type: "vault", name: agent.vault, provider })] : [],
+    file_ids: (agent.files ?? []).map((file) => requireRef(state, { type: "file", name: file, provider })),
+    memory_store_ids: memoryStoreIds,
+    owned_memory_store_ids: state.listResources().filter(
+      (resource) => resource.address.provider === provider && resource.address.type === "memory_store" && resource.api_mode === "forward" && typeof resource.remote_id === "string"
+    ).map((resource) => resource.remote_id),
+    ...identityName ? { identity_id: requireRef(state, { type: "identity", name: identityName, provider }) } : {}
   };
 }
 function resolveDeploymentRefs(deploymentName, config, provider, state) {
@@ -5959,6 +6556,12 @@ function resolveDeploymentRefs(deploymentName, config, provider, state) {
 function resolveChannelRefs(channelName, config, provider, state) {
   const channel = config.channels?.[channelName];
   if (!channel) throw new UserError(`Channel '${channelName}' not found in config`);
+  if (channel.mode === "pairing") {
+    return {};
+  }
+  if (!channel.agent) {
+    throw new UserError(`Channel '${channelName}' is fixed mode and must declare agent`);
+  }
   const agent = config.agents?.[channel.agent];
   if (!agent) throw new UserError(`Channel '${channelName}' references unknown agent '${channel.agent}'`);
   const agentType = agent.delivery?.[provider]?.type === "forward" ? "template" : "agent";
@@ -5982,8 +6585,61 @@ function resolveTunnelIdFromConfig(config, tunnelName, provider) {
 }
 
 // src/internal/executor/skill-resolver.ts
+import { dirname as dirname9 } from "path";
+
+// src/internal/core/skill-source.ts
 import { readFileSync as readFileSync7, statSync as statSync3 } from "fs";
-import { dirname as dirname9, resolve as resolve10 } from "path";
+import { basename as basename6, resolve as resolve10 } from "path";
+import { parse } from "yaml";
+async function inspectSkillSource(source, options = {}) {
+  if (/^https?:\/\//i.test(source)) {
+    throw new UserError("Skill source inspection only accepts a local directory, zip, or SKILL.md file.");
+  }
+  const sourcePath = resolve10(options.basePath ?? process.cwd(), source);
+  const sourceStat = statSync3(sourcePath, { throwIfNoEntry: false });
+  if (!sourceStat) throw new UserError(`Skill source not found: ${source}`);
+  let files;
+  if (sourceStat.isDirectory()) {
+    files = collectFiles(sourcePath, "");
+  } else if (sourceStat.isFile() && sourcePath.toLowerCase().endsWith(".zip")) {
+    files = await extractSkillZipFiles(readFileSync7(sourcePath));
+  } else if (sourceStat.isFile() && basename6(sourcePath).toLowerCase() === "skill.md") {
+    files = [{ relativePath: "SKILL.md", content: readFileSync7(sourcePath) }];
+  } else {
+    throw new UserError("Skill source must be a directory, .zip archive, or SKILL.md file.");
+  }
+  const normalizedFiles = normalizeSkillRoot(files);
+  const manifest = normalizedFiles.find((file) => file.relativePath === "SKILL.md");
+  const name = parseSkillManifestName(manifest.content);
+  return { name, sourcePath, files: normalizedFiles };
+}
+function normalizeSkillRoot(files) {
+  if (files.some((file) => file.relativePath === "SKILL.md")) return files;
+  const manifests = files.filter((file) => file.relativePath.endsWith("/SKILL.md"));
+  if (manifests.length === 0) throw new UserError("Skill source does not contain SKILL.md.");
+  if (manifests.length > 1) {
+    throw new UserError("Skill source contains multiple SKILL.md files and has no unambiguous root.");
+  }
+  const prefix = manifests[0].relativePath.slice(0, -"SKILL.md".length);
+  return files.filter((file) => file.relativePath.startsWith(prefix)).map((file) => ({ ...file, relativePath: file.relativePath.slice(prefix.length) }));
+}
+function parseSkillManifestName(content) {
+  const text = content.toString("utf8");
+  const frontmatter = text.match(/^---\s*\r?\n([\s\S]*?)\r?\n---(?:\s*\r?\n|$)/);
+  if (!frontmatter) throw new UserError("SKILL.md must start with YAML frontmatter containing a name.");
+  let manifest;
+  try {
+    manifest = parse(frontmatter[1]);
+  } catch (error) {
+    throw new UserError(`Invalid SKILL.md frontmatter: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const rawName = manifest && typeof manifest === "object" ? manifest.name : void 0;
+  const name = typeof rawName === "string" ? rawName.trim() : "";
+  if (!name) throw new UserError("SKILL.md frontmatter must contain a non-empty name.");
+  return name;
+}
+
+// src/internal/executor/skill-resolver.ts
 async function resolveSkillFiles(decl, ctx) {
   if (/^https?:\/\//i.test(decl.source)) {
     const res = await resolveFetch()(decl.source);
@@ -5991,19 +6647,7 @@ async function resolveSkillFiles(decl, ctx) {
     return extractSkillZipFiles(Buffer.from(await res.arrayBuffer()));
   }
   if (!ctx.configPath) return [];
-  const sourcePath = resolve10(dirname9(ctx.configPath), decl.source);
-  const stat = statSync3(sourcePath, { throwIfNoEntry: false });
-  if (stat?.isDirectory()) {
-    return collectFiles(sourcePath, "");
-  }
-  if (stat?.isFile()) {
-    if (sourcePath.endsWith(".zip")) {
-      return extractSkillZipFiles(readFileSync7(sourcePath));
-    }
-    const content = readFileSync7(sourcePath);
-    return [{ relativePath: "SKILL.md", content }];
-  }
-  return [];
+  return (await inspectSkillSource(decl.source, { basePath: dirname9(ctx.configPath) })).files;
 }
 
 // src/internal/executor/executor.ts
@@ -6081,6 +6725,7 @@ async function executePlan(plan, ctx, options = {}) {
     await runWithConcurrency(level, concurrency, runAction);
     await ctx.state.save();
   }
+  await reconcileDefaultMemoryStores(ctx, new Set(plan.actions.map((action) => action.address.provider)));
   for (const action of deletions) {
     await runAction(action);
     await ctx.state.save();
@@ -6091,6 +6736,41 @@ async function executePlan(plan, ctx, options = {}) {
     partial: results.some((r) => r.status === "failed")
   };
 }
+async function reconcileDefaultMemoryStores(ctx, plannedProviders) {
+  const identityName = ctx.config.defaults?.identity;
+  for (const [agentName, agent] of Object.entries(ctx.config.agents ?? {})) {
+    const desired = agent.default_memory_store;
+    if (!desired || agent.delivery?.qoder?.type !== "forward") continue;
+    const providerName = "qoder";
+    if (agent.provider && agent.provider !== providerName || !plannedProviders.has(providerName)) continue;
+    const provider = ctx.providers.get(providerName);
+    if (!provider?.reconcileDefaultMemoryStore || !identityName) continue;
+    const identityId = ctx.state.getResource({
+      type: "identity",
+      name: identityName,
+      provider: providerName
+    })?.remote_id;
+    const templateId = ctx.state.getResource({ type: "template", name: agentName, provider: providerName })?.remote_id;
+    if (!identityId || !templateId) continue;
+    const result = await provider.reconcileDefaultMemoryStore(identityId, templateId, desired);
+    const resource = { type: "template", name: agentName, provider: providerName };
+    if (result.status === "pending") {
+      emitRuntimeFeedback(ctx.onFeedback, {
+        type: "provider_wait",
+        level: "warning",
+        resource,
+        message: `default memory store for template.${agentName} is pending \u2014 create the first Forward Session, then run apply again`
+      });
+    } else if (result.status === "updated") {
+      emitRuntimeFeedback(ctx.onFeedback, {
+        type: "resource_action_success",
+        level: "success",
+        resource,
+        message: `updated default memory store for template.${agentName} to "${desired.name}"`
+      });
+    }
+  }
+}
 async function runWithConcurrency(items, limit, worker) {
   if (items.length === 0) return;
   let cursor = 0;
@@ -6157,8 +6837,8 @@ async function executeAction(action, provider, ctx) {
       resource: action.address,
       message: `update ${action.address.type}.${action.address.name} (${action.address.provider}) \u2014 not found remotely, recreating`
     });
-    ctx.state.removeResource(action.address);
-    return executeActionInner({ ...action, action: "create" }, provider, ctx);
+    ctx.state.removeResource(action.previousAddress ?? action.address);
+    return executeActionInner({ ...action, action: "create", previousAddress: void 0 }, provider, ctx);
   }
 }
 async function executeActionInner(action, provider, ctx) {
@@ -6169,6 +6849,7 @@ async function executeActionInner(action, provider, ctx) {
     const existing = ctx.state.getResource(address);
     if (!existing) return false;
     const id = existing.remote_id;
+    const apiMode2 = existing.api_mode;
     if (type === "environment" || type === "identity") {
       const externalReference = type === "environment" ? ctx.config.environments?.[name]?.environment_id : ctx.config.identities?.[name]?.identity_id;
       if (existing.externally_managed || externalReference) {
@@ -6180,13 +6861,13 @@ async function executeActionInner(action, provider, ctx) {
       try {
         switch (type) {
           case "environment":
-            await provider.deleteEnvironment(id);
+            await provider.deleteEnvironment(id, false, apiMode2);
             break;
           case "vault":
-            await provider.deleteVault(id);
+            await provider.deleteVault(id, apiMode2);
             break;
           case "skill":
-            await provider.deleteSkill(id);
+            await provider.deleteSkill(id, apiMode2);
             break;
           case "agent":
             await provider.deleteAgent(id);
@@ -6194,17 +6875,17 @@ async function executeActionInner(action, provider, ctx) {
           case "template":
             if (!provider.archiveTemplate)
               throw new UserError(`Provider '${address.provider}' does not support templates`);
-            await provider.archiveTemplate(id);
+            await provider.archiveTemplate(id, ownedForwardMemoryStoreIds(ctx, address.provider));
             break;
           case "memory_store":
             if (!provider.deleteMemoryStore) throw memoryStoreUnsupported(address.provider);
-            await provider.deleteMemoryStore(id);
+            await provider.deleteMemoryStore(id, apiMode2);
             break;
           case "deployment":
             await provider.deleteDeployment(id);
             break;
           case "file":
-            await provider.deleteFile(id);
+            await provider.deleteFile(id, apiMode2);
             break;
           case "identity":
             if (!provider.deleteIdentity)
@@ -6231,7 +6912,11 @@ async function executeActionInner(action, provider, ctx) {
     return false;
   }
   const isUpdate = action.action === "update";
-  const existingId = isUpdate ? ctx.state.getResource(address)?.remote_id : void 0;
+  const priorAddress = action.previousAddress ?? address;
+  const existingId = isUpdate ? ctx.state.getResource(priorAddress)?.remote_id : void 0;
+  const apiMode = resolveResourceApiMode(type, name, address.provider, ctx.config);
+  const priorApiMode = ctx.state.getResource(priorAddress)?.api_mode ?? (address.provider === "qoder" ? "managed" : void 0);
+  const apiModeChanged = isUpdate && apiMode !== void 0 && priorApiMode !== apiMode;
   let result;
   switch (type) {
     case "environment": {
@@ -6246,6 +6931,17 @@ async function executeActionInner(action, provider, ctx) {
           resource: action.address,
           message: `${action.action} ${action.address.type}.${action.address.name} (${action.address.provider}) \u2014 external reference, no remote mutation`
         });
+      } else if (apiModeChanged) {
+        try {
+          result = await provider.createEnvironment(remoteName, decl, apiMode);
+        } catch (err) {
+          result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            mode: apiMode,
+            onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl, apiMode)
+          });
+          adopted = true;
+        }
+        if (existingId) await provider.deleteEnvironment(existingId, false, priorApiMode);
       } else if (isUpdate) {
         const prior = ctx.state.getResource(address);
         if (prior?.externally_managed) {
@@ -6253,13 +6949,14 @@ async function executeActionInner(action, provider, ctx) {
             `environment.${name} is recorded as an external reference (${prior.remote_id ?? "unknown id"}); refusing to modify it remotely. Restore 'environment_id' to keep it as a reference, or release it first with 'agents state rm environment.${name}' (then 'agents state import' to adopt it as a managed resource).`
           );
         }
-        result = await provider.updateEnvironment(existingId, remoteName, decl);
+        result = await provider.updateEnvironment(existingId, remoteName, decl, apiMode);
       } else {
         try {
-          result = await provider.createEnvironment(remoteName, decl);
+          result = await provider.createEnvironment(remoteName, decl, apiMode);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
-            onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl)
+            mode: apiMode,
+            onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl, apiMode)
           });
           adopted = true;
         }
@@ -6268,22 +6965,26 @@ async function executeActionInner(action, provider, ctx) {
     }
     case "vault": {
       const decl = ctx.config.vaults[name];
-      if (isUpdate) {
+      if (apiModeChanged) {
+        result = await provider.createVault(name, decl, apiMode);
+        if (existingId) await provider.deleteVault(existingId, priorApiMode).catch(() => void 0);
+      } else if (isUpdate) {
         try {
-          result = await provider.createVault(name, decl);
-          await provider.deleteVault(existingId);
+          result = await provider.createVault(name, decl, apiMode);
+          await provider.deleteVault(existingId, apiMode);
         } catch {
-          await provider.deleteVault(existingId);
-          result = await provider.createVault(name, decl);
+          await provider.deleteVault(existingId, apiMode);
+          result = await provider.createVault(name, decl, apiMode);
         }
       } else {
         try {
-          result = await provider.createVault(name, decl);
+          result = await provider.createVault(name, decl, apiMode);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            mode: apiMode,
             onExisting: async (existing) => {
-              await provider.deleteVault(existing.id);
-              return provider.createVault(name, decl);
+              await provider.deleteVault(existing.id, apiMode);
+              return provider.createVault(name, decl, apiMode);
             }
           });
           adopted = true;
@@ -6307,12 +7008,15 @@ async function executeActionInner(action, provider, ctx) {
       }
       const remoteName = decl.name ?? name;
       const files = await resolveSkillFiles(decl, ctx);
-      if (isUpdate) {
-        result = await provider.updateSkill(existingId, remoteName, decl, files);
+      if (apiModeChanged) {
+        result = await provider.createSkill(remoteName, decl, files, apiMode);
+        if (existingId) await provider.deleteSkill(existingId, priorApiMode).catch(() => void 0);
+      } else if (isUpdate) {
+        result = await provider.updateSkill(existingId, remoteName, decl, files, apiMode);
       } else {
         const manifestName = skillNameFromFiles(files);
         const searchNames = manifestName && manifestName !== remoteName ? [remoteName, manifestName] : [remoteName];
-        const existing = await findExistingByNames(provider, "skill", searchNames);
+        const existing = await findExistingByNames(provider, "skill", searchNames, apiMode);
         if (existing) {
           result = existing.resource;
           emitRuntimeFeedback(ctx.onFeedback, {
@@ -6324,9 +7028,10 @@ async function executeActionInner(action, provider, ctx) {
           adopted = true;
         } else {
           try {
-            result = await provider.createSkill(remoteName, decl, files);
+            result = await provider.createSkill(remoteName, decl, files, apiMode);
           } catch (err) {
             result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+              mode: apiMode,
               searchNames,
               onExisting: async (existing2) => existing2
             });
@@ -6345,15 +7050,19 @@ async function executeActionInner(action, provider, ctx) {
         throw memoryStoreUnsupported(address.provider);
       }
       const reconcile = async (storeId) => {
-        const store = await provider.updateMemoryStore(storeId, {
-          name,
-          description: decl.description,
-          metadata: decl.metadata ?? {}
-        });
+        const store = await provider.updateMemoryStore(
+          storeId,
+          {
+            name,
+            description: decl.description,
+            metadata: decl.metadata ?? {}
+          },
+          apiMode
+        );
         const current = /* @__PURE__ */ new Map();
         let cursor;
         do {
-          const page2 = await provider.listMemories(storeId, { limit: 100, cursor, view: "basic" });
+          const page2 = await provider.listMemories(storeId, { limit: 100, cursor, view: "basic" }, apiMode);
           for (const memory of page2.data) {
             if (memory.type === "memory") current.set(memory.path, memory);
           }
@@ -6363,24 +7072,33 @@ async function executeActionInner(action, provider, ctx) {
           const existing = current.get(entry.key.replace(/^\/+/, ""));
           if (existing) {
             if (existing.content_sha256 !== sha256(entry.content)) {
-              await provider.updateMemory(storeId, existing.id, {
-                content: entry.content,
-                expected_content_sha256: existing.content_sha256
-              });
+              await provider.updateMemory(
+                storeId,
+                existing.id,
+                {
+                  content: entry.content,
+                  expected_content_sha256: existing.content_sha256
+                },
+                apiMode
+              );
             }
           } else {
-            await provider.createMemory(storeId, { path: entry.key, content: entry.content });
+            await provider.createMemory(storeId, { path: entry.key, content: entry.content }, apiMode);
           }
         }
         return store;
       };
-      if (isUpdate) {
+      if (apiModeChanged) {
+        result = await createMemoryStore2(name, decl, apiMode);
+        if (existingId) await deleteMemoryStore2(existingId, priorApiMode).catch(() => void 0);
+      } else if (isUpdate) {
         result = await reconcile(existingId);
       } else {
         try {
-          result = await createMemoryStore2(name, decl);
+          result = await createMemoryStore2(name, decl, apiMode);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            mode: apiMode,
             onExisting: async (existing) => reconcile(existing.id)
           });
           adopted = true;
@@ -6489,16 +7207,36 @@ async function executeActionInner(action, provider, ctx) {
     case "deployment": {
       const decl = ctx.config.deployments[name];
       const refs = resolveDeploymentRefs(name, ctx.config, address.provider, ctx.state);
-      if (isUpdate) {
-        result = await provider.updateDeployment(existingId, name, decl, refs, ctx.configPath ?? "");
-      } else {
+      const hasLocalFileSources = decl.resources?.some(
+        (resource) => resource.type === "file" && !resource.file_id && Boolean(resource.source)
+      );
+      const materializeDeployment = async () => {
         try {
-          result = await provider.createDeployment(name, decl, refs, ctx.configPath ?? "");
+          return await provider.createDeployment(name, decl, refs, ctx.configPath ?? "");
         } catch (err) {
-          result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
-            onExisting: (existing) => provider.updateDeployment(existing.id, name, decl, refs, ctx.configPath ?? "")
+          const preparedFiles = err instanceof DeploymentCreateConflictError ? err.preparedFiles : void 0;
+          const existing = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            onExisting: (existing2) => provider.updateDeployment(existing2.id, name, decl, refs, ctx.configPath ?? "", preparedFiles)
+          });
+          adopted = true;
+          return existing;
+        }
+      };
+      if (isUpdate && existingId) {
+        result = await provider.updateDeployment(existingId, name, decl, refs, ctx.configPath ?? "");
+      } else {
+        const existing = hasLocalFileSources ? await findExistingByNames(provider, "deployment", [name]) : null;
+        if (existing) {
+          result = await provider.updateDeployment(existing.resource.id, name, decl, refs, ctx.configPath ?? "");
+          emitRuntimeFeedback(ctx.onFeedback, {
+            type: "resource_adopted",
+            level: "info",
+            resource: address,
+            message: `adopt deployment.${name} (${address.provider}) \u2014 already existed remotely as "${existing.name}"`
           });
           adopted = true;
+        } else {
+          result = await materializeDeployment();
         }
       }
       break;
@@ -6510,15 +7248,12 @@ async function executeActionInner(action, provider, ctx) {
         const oldId = ctx.state.getResource(address)?.remote_id;
         if (oldId) {
           try {
-            await provider.deleteFile(oldId);
+            await provider.deleteFile(oldId, priorApiMode);
           } catch {
           }
         }
       }
-      const info = await provider.uploadFile(filePath, {
-        name: decl.name,
-        purpose: decl.purpose
-      });
+      const info = await provider.uploadFile(filePath, { name: decl.name, purpose: decl.purpose }, apiMode);
       result = { id: info.id, type: "file" };
       break;
     }
@@ -6534,11 +7269,12 @@ async function executeActionInner(action, provider, ctx) {
     remoteHash = contentHash(remote.comparable);
     remoteSnapshot = remote.snapshot ?? remote.comparable;
   }
-  const priorResource = ctx.state.getResource(address);
+  const priorResource = ctx.state.getResource(priorAddress);
   ctx.state.setResource({
     address,
     remote_id: result.id,
     externally_managed: priorResource?.externally_managed || type === "environment" && ctx.config.environments?.[name]?.environment_id || type === "identity" && ctx.config.identities?.[name]?.identity_id ? true : void 0,
+    api_mode: apiMode,
     version: result.version,
     content_hash: hash,
     desired_hash: hash,
@@ -6546,14 +7282,44 @@ async function executeActionInner(action, provider, ctx) {
     desired_readiness_baseline: buildReadinessBaseline(getResourceDeclaration(address, ctx.config)),
     remote_hash: remoteHash,
     remote_snapshot: remoteSnapshot,
+    replacement_fingerprint: computeReplacementFingerprint(address, ctx.config),
     drift_paths: [],
     drift_status: remoteHash ? "in_sync" : void 0
   });
+  if (action.previousAddress) ctx.state.removeResource(action.previousAddress);
   return adopted;
 }
-async function findExistingByNames(provider, type, names) {
+function ownedForwardMemoryStoreIds(ctx, provider) {
+  return ctx.state.listResources().filter(
+    (resource) => resource.address.provider === provider && resource.address.type === "memory_store" && resource.api_mode === "forward" && typeof resource.remote_id === "string"
+  ).map((resource) => resource.remote_id);
+}
+function resolveResourceApiMode(type, name, provider, config) {
+  if (provider !== "qoder" || type !== "environment" && type !== "skill" && type !== "vault" && type !== "memory_store" && type !== "file") {
+    return void 0;
+  }
+  if (type === "environment" && config.environments?.[name]?.environment_id) return "auto";
+  let managed = false;
+  let forward = false;
+  for (const agent of Object.values(config.agents ?? {})) {
+    if (agent.provider && agent.provider !== provider) continue;
+    const referenced = type === "environment" ? agent.environment === name : type === "skill" ? agent.skills?.some(
+      (skill) => typeof skill === "string" ? skill === name : skill.type === "custom" && skill.skill_id === name
+    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.includes(name);
+    if (!referenced) continue;
+    if (agent.delivery?.qoder?.type === "forward") forward = true;
+    else managed = true;
+  }
+  if (managed && forward) {
+    throw new UserError(
+      `Qoder ${type}.${name} is referenced by both Managed and Forward agents; declare separate resources for each API domain.`
+    );
+  }
+  return forward ? "forward" : "managed";
+}
+async function findExistingByNames(provider, type, names, mode) {
   for (const candidate of names) {
-    const found = await provider.findResource(type, candidate);
+    const found = await provider.findResource(type, candidate, void 0, mode);
     if (found && found.id !== null) return { resource: found, name: candidate };
   }
   return null;
@@ -6561,7 +7327,7 @@ async function findExistingByNames(provider, type, names) {
 async function adoptOnConflict(err, address, provider, onFeedback, opts) {
   if (!(err instanceof ConflictError)) throw err;
   const candidates = opts.searchNames?.length ? opts.searchNames : [address.name];
-  const existing = await findExistingByNames(provider, address.type, candidates);
+  const existing = await findExistingByNames(provider, address.type, candidates, opts.mode);
   if (!existing) throw nameReservedError(err, address, candidates.join('" / "'));
   emitRuntimeFeedback(onFeedback, {
     type: "resource_adopted",
@@ -6573,68 +7339,303 @@ async function adoptOnConflict(err, address, provider, onFeedback, opts) {
 }
 function nameReservedError(err, address, searchName) {
   const detail = err instanceof ApiError ? err.message : String(err);
+  if (address.type === "channel" && err instanceof ApiError && err.responseBody.includes("CHANNEL_CREDENTIAL_CONFLICT")) {
+    return new UserError(
+      `${address.provider} rejected channel.${address.name} because its credentials are already used by another Channel. Keep the existing Channel address so it can be updated in place, remove the old Channel first, or use a different credential set. (${detail})`
+    );
+  }
   return new UserError(
     `${address.provider} reported ${address.type} "${searchName}" already exists, but it could not be found remotely to adopt. This usually means it was recently deleted and the provider still reserves the name. Wait for the provider to release the name, or use a different name for ${address.type}.${address.name}. (${detail})`
   );
 }
 
-// src/internal/diagnostics/diagnostics.ts
-var DiagnosticCollector = class {
-  items = [];
-  error(code, message, resource) {
-    this.items.push({ severity: "error", code, message, resource });
-  }
-  warning(code, message, resource) {
-    this.items.push({ severity: "warning", code, message, resource });
-  }
-  info(code, message, resource) {
-    this.items.push({ severity: "info", code, message, resource });
-  }
-  hasErrors() {
-    return this.items.some((d) => d.severity === "error");
-  }
-  getAll() {
-    return [...this.items];
-  }
-  format() {
-    if (this.items.length === 0) return "";
-    const lines = [];
-    for (const d of this.items) {
-      const icon = severityIcon(d.severity);
-      const addr = d.resource ? ` ${d.resource.type}.${d.resource.name} (${d.resource.provider})` : "";
-      lines.push(`${icon} ${d.code}`);
-      if (addr) lines.push(`  Resource:${addr}`);
-      lines.push(`  ${d.message}`);
-      lines.push("");
-    }
-    return lines.join("\n");
-  }
-};
-function severityIcon(s) {
-  switch (s) {
-    case "error":
-      return "\u2717";
-    case "warning":
-      return "\u26A0";
-    case "info":
-      return "\u2139";
-  }
+// src/internal/core/agent-materialization.ts
+function resolveAgentMaterialization(provider, agent) {
+  const mode = agent.delivery?.[provider]?.type ?? "managed";
+  if (mode === "managed") return { resourceType: "agent", mode };
+  return { resourceType: "template", mode };
 }
 
-// src/internal/validation/bailian.ts
-function findMissingBailianMcpToolConfigs(config, providerName = "bailian") {
-  if (providerName !== "bailian") return [];
-  const missing = [];
-  for (const [agentName, agent] of Object.entries(config.agents ?? {})) {
-    if (!agentTargetsProvider(config, agent.provider, providerName)) continue;
-    const configuredToolServers = new Set((agent.tools?.mcp ?? []).map((tool) => tool.mcp_server_name));
-    for (const server of agent.mcp_servers ?? []) {
-      if (!configuredToolServers.has(server.name)) {
-        missing.push({ agentName, serverName: server.name });
-      }
+// src/internal/graph/dependency.ts
+function collectDependencyClosure(graph, roots) {
+  const selected = /* @__PURE__ */ new Map();
+  function visit(address) {
+    const key = addressKey(address);
+    if (selected.has(key)) return;
+    selected.set(key, graph.nodes.get(key) ?? address);
+    for (const dependencyKey of graph.edges.get(key) ?? []) {
+      const dependency = graph.nodes.get(dependencyKey);
+      if (dependency) visit(dependency);
     }
   }
-  return missing;
+  for (const root of roots) visit(root);
+  return [...selected.values()];
+}
+function buildDependencyGraph(config, targetProviders) {
+  const nodes = /* @__PURE__ */ new Map();
+  const edges = /* @__PURE__ */ new Map();
+  function addNode(addr) {
+    const key = addressKey(addr);
+    nodes.set(key, addr);
+    if (!edges.has(key)) edges.set(key, /* @__PURE__ */ new Set());
+  }
+  function addEdge(from, to) {
+    const fromKey = addressKey(from);
+    const toKey = addressKey(to);
+    edges.get(fromKey)?.add(toKey);
+  }
+  for (const provider of targetProviders) {
+    const def = getProvider(provider);
+    const caps = def?.capabilities;
+    if (config.environments) {
+      for (const name of Object.keys(config.environments)) {
+        const decl = config.environments[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "environment", name, provider });
+      }
+    }
+    if (config.memory_stores) {
+      for (const name of Object.keys(config.memory_stores)) {
+        const decl = config.memory_stores[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        if (!isSupported(caps, "memory_store")) continue;
+        addNode({ type: "memory_store", name, provider });
+      }
+    }
+    if (config.vaults) {
+      for (const name of Object.keys(config.vaults)) {
+        const decl = config.vaults[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "vault", name, provider });
+      }
+    }
+    if (config.skills) {
+      for (const name of Object.keys(config.skills)) {
+        const decl = config.skills[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "skill", name, provider });
+      }
+    }
+    if (config.files) {
+      for (const name of Object.keys(config.files)) {
+        const decl = config.files[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "file", name, provider });
+      }
+    }
+    if (config.identities && isSupported(caps, "identity")) {
+      for (const name of Object.keys(config.identities)) {
+        const decl = config.identities[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "identity", name, provider });
+      }
+    }
+    if (config.agents) {
+      for (const name of Object.keys(config.agents)) {
+        const decl = config.agents[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const materialization = resolveAgentMaterialization(provider, decl);
+        const agentAddr = { type: materialization.resourceType, name, provider };
+        addNode(agentAddr);
+        if ((decl.default_memory_store || decl.memory_stores?.length) && materialization.resourceType === "template") {
+          const identityName = config.defaults?.identity;
+          if (identityName) {
+            const identityAddr = { type: "identity", name: identityName, provider };
+            if (nodes.has(addressKey(identityAddr))) addEdge(agentAddr, identityAddr);
+          }
+        }
+        if (decl.environment && config.environments?.[decl.environment]) {
+          const envAddr = {
+            type: "environment",
+            name: decl.environment,
+            provider
+          };
+          if (nodes.has(addressKey(envAddr))) {
+            addEdge(agentAddr, envAddr);
+          }
+        }
+        if (decl.skills) {
+          for (const skillRef of decl.skills) {
+            if (typeof skillRef !== "string") continue;
+            const skillName = skillRef;
+            const skillAddr = { type: "skill", name: skillName, provider };
+            if (nodes.has(addressKey(skillAddr))) {
+              addEdge(agentAddr, skillAddr);
+            }
+          }
+        }
+        if (decl.vault) {
+          const vaultAddr = { type: "vault", name: decl.vault, provider };
+          if (nodes.has(addressKey(vaultAddr))) {
+            addEdge(agentAddr, vaultAddr);
+          }
+        }
+        if (decl.files) {
+          for (const fileName of decl.files) {
+            const fileAddr = { type: "file", name: fileName, provider };
+            if (nodes.has(addressKey(fileAddr))) addEdge(agentAddr, fileAddr);
+          }
+        }
+        if (decl.memory_stores) {
+          for (const msName of decl.memory_stores) {
+            const msAddr = {
+              type: "memory_store",
+              name: msName,
+              provider
+            };
+            if (nodes.has(addressKey(msAddr))) {
+              addEdge(agentAddr, msAddr);
+            }
+          }
+        }
+        if (decl.multiagent && isSupported(caps, "multiagent")) {
+          for (const subName of decl.multiagent.agents) {
+            const subDecl = config.agents[subName];
+            const subType = subDecl ? resolveAgentMaterialization(provider, subDecl).resourceType : "agent";
+            const subAddr = { type: subType, name: subName, provider };
+            addEdge(agentAddr, subAddr);
+          }
+        }
+      }
+    }
+    if (config.deployments) {
+      for (const name of Object.keys(config.deployments)) {
+        const decl = config.deployments[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const depAddr = { type: "deployment", name, provider };
+        addNode(depAddr);
+        const agentDecl = config.agents?.[decl.agent];
+        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
+        const agentAddr = { type: agentType, name: decl.agent, provider };
+        if (nodes.has(addressKey(agentAddr))) addEdge(depAddr, agentAddr);
+        if (decl.environment) {
+          const envAddr = { type: "environment", name: decl.environment, provider };
+          if (nodes.has(addressKey(envAddr))) addEdge(depAddr, envAddr);
+        }
+        if (decl.vaults) {
+          for (const vName of decl.vaults) {
+            const vAddr = { type: "vault", name: vName, provider };
+            if (nodes.has(addressKey(vAddr))) addEdge(depAddr, vAddr);
+          }
+        }
+        if (decl.memory_stores) {
+          for (const msName of decl.memory_stores) {
+            const msAddr = { type: "memory_store", name: msName, provider };
+            if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
+          }
+        }
+        if (decl.resources) {
+          for (const r of decl.resources) {
+            if (r.type === "memory_store") {
+              const msAddr = { type: "memory_store", name: r.memory_store, provider };
+              if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
+            }
+          }
+        }
+      }
+    }
+    if (config.channels && isSupported(caps, "channel")) {
+      for (const name of Object.keys(config.channels)) {
+        const decl = config.channels[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const channelAddr = { type: "channel", name, provider };
+        addNode(channelAddr);
+        if (decl.mode === "pairing" || !decl.agent) continue;
+        const agentDecl = config.agents?.[decl.agent];
+        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
+        const agentAddr = { type: agentType, name: decl.agent, provider };
+        if (nodes.has(addressKey(agentAddr))) addEdge(channelAddr, agentAddr);
+        const identityName = decl.identity ?? config.defaults?.identity;
+        if (identityName) {
+          const identityAddr = { type: "identity", name: identityName, provider };
+          if (nodes.has(addressKey(identityAddr))) addEdge(channelAddr, identityAddr);
+        }
+      }
+    }
+  }
+  return { nodes, edges };
+}
+function topologicalSort(graph) {
+  const visited = /* @__PURE__ */ new Set();
+  const sorted = [];
+  const visiting = /* @__PURE__ */ new Set();
+  function visit(key) {
+    if (visited.has(key)) return;
+    if (visiting.has(key)) {
+      throw new UserError(`Circular dependency detected involving: ${key}`);
+    }
+    visiting.add(key);
+    const deps = graph.edges.get(key) ?? /* @__PURE__ */ new Set();
+    for (const dep of deps) {
+      visit(dep);
+    }
+    visiting.delete(key);
+    visited.add(key);
+    sorted.push(graph.nodes.get(key));
+  }
+  for (const key of graph.nodes.keys()) {
+    visit(key);
+  }
+  return sorted;
+}
+
+// src/internal/diagnostics/diagnostics.ts
+var DiagnosticCollector = class {
+  items = [];
+  error(code, message, resource) {
+    this.items.push({ severity: "error", code, message, resource });
+  }
+  warning(code, message, resource) {
+    this.items.push({ severity: "warning", code, message, resource });
+  }
+  info(code, message, resource) {
+    this.items.push({ severity: "info", code, message, resource });
+  }
+  hasErrors() {
+    return this.items.some((d) => d.severity === "error");
+  }
+  getAll() {
+    return [...this.items];
+  }
+  format() {
+    if (this.items.length === 0) return "";
+    const lines = [];
+    for (const d of this.items) {
+      const icon = severityIcon(d.severity);
+      const addr = d.resource ? ` ${d.resource.type}.${d.resource.name} (${d.resource.provider})` : "";
+      lines.push(`${icon} ${d.code}`);
+      if (addr) lines.push(`  Resource:${addr}`);
+      lines.push(`  ${d.message}`);
+      lines.push("");
+    }
+    return lines.join("\n");
+  }
+};
+function severityIcon(s) {
+  switch (s) {
+    case "error":
+      return "\u2717";
+    case "warning":
+      return "\u26A0";
+    case "info":
+      return "\u2139";
+  }
+}
+
+// src/internal/validation/bailian.ts
+function findMissingBailianMcpToolConfigs(config, providerName = "bailian") {
+  if (providerName !== "bailian") return [];
+  const missing = [];
+  for (const [agentName, agent] of Object.entries(config.agents ?? {})) {
+    if (!agentTargetsProvider(config, agent.provider, providerName)) continue;
+    const configuredToolServers = new Set((agent.tools?.mcp ?? []).map((tool) => tool.mcp_server_name));
+    for (const server of agent.mcp_servers ?? []) {
+      if (!configuredToolServers.has(server.name)) {
+        missing.push({ agentName, serverName: server.name });
+      }
+    }
+  }
+  return missing;
 }
 function agentTargetsProvider(config, agentProvider, providerName) {
   if (agentProvider) return agentProvider === providerName;
@@ -6671,6 +7672,7 @@ function collectReferenceDiagnostics(config, diagnostics) {
   const skillNames = new Set(Object.keys(config.skills ?? {}));
   const vaultNames = new Set(Object.keys(config.vaults ?? {}));
   const memoryNames = new Set(Object.keys(config.memory_stores ?? {}));
+  const fileNames = new Set(Object.keys(config.files ?? {}));
   const agentNames = new Set(Object.keys(config.agents ?? {}));
   const identityNames = new Set(Object.keys(config.identities ?? {}));
   if (config.defaults?.identity && !identityNames.has(config.defaults.identity)) {
@@ -6698,6 +7700,11 @@ function collectReferenceDiagnostics(config, diagnostics) {
     if (agent.vault && !vaultNames.has(agent.vault)) {
       diagnostics.error("config.agent.vault.unknown", `agent.${name}: references unknown vault '${agent.vault}'`);
     }
+    for (const file of agent.files ?? []) {
+      if (!fileNames.has(file)) {
+        diagnostics.error("config.agent.file.unknown", `agent.${name}: references unknown file '${file}'`);
+      }
+    }
     for (const memory of agent.memory_stores ?? []) {
       if (!memoryNames.has(memory)) {
         diagnostics.error(
@@ -6729,7 +7736,10 @@ function collectReferenceDiagnostics(config, diagnostics) {
     }
   }
   for (const [name, channel] of Object.entries(config.channels ?? {})) {
-    if (!agentNames.has(channel.agent)) {
+    if (channel.mode === "pairing") continue;
+    if (!channel.agent) {
+      diagnostics.error("config.channel.agent.required", `channel.${name}: fixed-mode channels require agent`);
+    } else if (!agentNames.has(channel.agent)) {
       diagnostics.error("config.channel.agent.unknown", `channel.${name}: references unknown agent '${channel.agent}'`);
     }
     const identity = channel.identity ?? config.defaults?.identity;
@@ -6757,6 +7767,37 @@ function collectProviderCapabilities(config, providers, diagnostics) {
       continue;
     }
     const caps = def.capabilities;
+    for (const [name, environment] of Object.entries(config.environments ?? {})) {
+      if (environment.provider && environment.provider !== providerName) continue;
+      if (environment.environment_id) continue;
+      const address = { type: "environment", name, provider: providerName };
+      if (environment.config.setup_script !== void 0 && providerName !== "qoder") {
+        diagnostics.error(
+          `${providerName}.environment.setup_script.unsupported`,
+          `environment.${name}: provider '${providerName}' does not support setup_script; remove it or pin this environment to qoder.`,
+          address
+        );
+      }
+      if (providerName === "qoder") {
+        if (environment.config.type === "self_hosted" && (environment.config.networking !== void 0 || environment.config.packages !== void 0)) {
+          diagnostics.error(
+            "qoder.environment.self_hosted.config.unsupported",
+            `environment.${name}: Qoder self_hosted environments accept only config.type and config.setup_script; remove networking and packages.`,
+            address
+          );
+        }
+        const unsupported = ["cargo", "gem", "go"].filter(
+          (key) => (environment.config.packages?.[key]?.length ?? 0) > 0
+        );
+        if (unsupported.length > 0) {
+          diagnostics.error(
+            "qoder.environment.packages.unsupported",
+            `environment.${name}: Qoder accepts only apt, npm, and pip package declarations; remove ${unsupported.join(", ")} or install them from setup_script.`,
+            address
+          );
+        }
+      }
+    }
     for (const [name, identity] of Object.entries(config.identities ?? {})) {
       if (identity.provider && identity.provider !== providerName) continue;
       if (!isSupported(caps, "identity")) {
@@ -6778,29 +7819,31 @@ function collectProviderCapabilities(config, providers, diagnostics) {
         continue;
       }
       if (providerName === "qoder") {
-        const agent = config.agents?.[channel.agent];
-        if (agent?.provider && agent.provider !== providerName) {
-          diagnostics.error(
-            "config.channel.agent.provider_mismatch",
-            `channel.${name}: agent '${channel.agent}' is pinned to provider '${agent.provider}'.`,
-            { type: "channel", name, provider: providerName }
-          );
-        }
-        const identityName = channel.identity ?? config.defaults?.identity;
-        const identity = identityName ? config.identities?.[identityName] : void 0;
-        if (identity?.provider && identity.provider !== providerName) {
-          diagnostics.error(
-            "config.channel.identity.provider_mismatch",
-            `channel.${name}: identity '${identityName}' is pinned to provider '${identity.provider}'.`,
-            { type: "channel", name, provider: providerName }
-          );
-        }
-        if (agent && agent.delivery?.qoder?.type !== "forward") {
-          diagnostics.error(
-            "qoder.channel.forward_template.required",
-            `channel.${name}: Qoder Channels require agent '${channel.agent}' to use delivery.qoder.type: forward.`,
-            { type: "channel", name, provider: providerName }
-          );
+        if (channel.mode !== "pairing" && channel.agent) {
+          const agent = config.agents?.[channel.agent];
+          if (agent?.provider && agent.provider !== providerName) {
+            diagnostics.error(
+              "config.channel.agent.provider_mismatch",
+              `channel.${name}: agent '${channel.agent}' is pinned to provider '${agent.provider}'.`,
+              { type: "channel", name, provider: providerName }
+            );
+          }
+          const identityName = channel.identity ?? config.defaults?.identity;
+          const identity = identityName ? config.identities?.[identityName] : void 0;
+          if (identity?.provider && identity.provider !== providerName) {
+            diagnostics.error(
+              "config.channel.identity.provider_mismatch",
+              `channel.${name}: identity '${identityName}' is pinned to provider '${identity.provider}'.`,
+              { type: "channel", name, provider: providerName }
+            );
+          }
+          if (agent && agent.delivery?.qoder?.type !== "forward") {
+            diagnostics.error(
+              "qoder.channel.forward_template.required",
+              `channel.${name}: Qoder Channels require agent '${channel.agent}' to use delivery.qoder.type: forward.`,
+              { type: "channel", name, provider: providerName }
+            );
+          }
         }
         const requiredCredentials = {
           dingtalk: ["client_id", "client_secret"],
@@ -6831,6 +7874,46 @@ function collectProviderCapabilities(config, providers, diagnostics) {
         }
       }
     }
+    if (providerName === "qoder") {
+      const domains = /* @__PURE__ */ new Map();
+      for (const agent of Object.values(config.agents ?? {})) {
+        if (agent.provider && agent.provider !== providerName) continue;
+        const mode = agent.delivery?.qoder?.type === "forward" ? "forward" : "managed";
+        const refs = [
+          ...agent.environment && !config.environments?.[agent.environment]?.environment_id ? [`environment:${agent.environment}`] : [],
+          ...(agent.skills ?? []).flatMap(
+            (skill) => typeof skill === "string" ? [`skill:${skill}`] : skill.type === "custom" ? [`skill:${skill.skill_id}`] : []
+          ),
+          ...agent.vault ? [`vault:${agent.vault}`] : [],
+          ...(agent.memory_stores ?? []).map((store) => `memory_store:${store}`),
+          ...(agent.files ?? []).map((file) => `file:${file}`)
+        ];
+        for (const ref of refs) {
+          const modes = domains.get(ref) ?? /* @__PURE__ */ new Set();
+          modes.add(mode);
+          domains.set(ref, modes);
+        }
+      }
+      for (const [ref, modes] of domains) {
+        if (modes.size < 2) continue;
+        const [type, name] = ref.split(":");
+        diagnostics.error(
+          `qoder.${type}.delivery_domain.conflict`,
+          `${type}.${name}: referenced by both Managed and Forward agents; declare separate resources because Qoder uses different API domains.`,
+          { type, name, provider: providerName }
+        );
+      }
+    }
+    for (const [name, agent] of Object.entries(config.agents ?? {})) {
+      if (agent.provider && agent.provider !== providerName) continue;
+      if (agent.files?.length && (providerName !== "qoder" || agent.delivery?.qoder?.type !== "forward")) {
+        diagnostics.error(
+          "config.agent.files.unsupported",
+          `agent.${name}: files are supported only by Qoder Forward Templates.`,
+          { type: resolveAgentMaterialization(providerName, agent).resourceType, name, provider: providerName }
+        );
+      }
+    }
     for (const [name, agent] of Object.entries(config.agents ?? {})) {
       if (agent.provider && agent.provider !== providerName) continue;
       const delivery = agent.delivery?.[providerName]?.type ?? "managed";
@@ -6871,6 +7954,44 @@ function collectProviderCapabilities(config, providers, diagnostics) {
           address
         );
       }
+      if (delivery !== "forward" && agent.managed_tool_config) {
+        diagnostics.error(
+          `${providerName}.agent.managed_tool_config.forward_required`,
+          `agent.${name}: managed_tool_config applies to Forward Templates; set delivery.${providerName}.type: forward or remove it.`,
+          address
+        );
+      }
+      if (agent.default_memory_store) {
+        if (providerName !== "qoder" || delivery !== "forward") {
+          diagnostics.error(
+            `${providerName}.agent.default_memory_store.forward_required`,
+            `agent.${name}: default_memory_store is supported only by Qoder Forward delivery.`,
+            address
+          );
+        } else if (!config.defaults?.identity) {
+          diagnostics.error(
+            "qoder.template.default_memory_store.identity.required",
+            `agent.${name}: default_memory_store requires defaults.identity to select the owning Forward Identity.`,
+            { type: "template", name, provider: providerName }
+          );
+        } else {
+          const identity = config.identities?.[config.defaults.identity];
+          if (identity?.provider && identity.provider !== providerName) {
+            diagnostics.error(
+              "qoder.template.default_memory_store.identity.provider_mismatch",
+              `agent.${name}: defaults.identity '${config.defaults.identity}' is pinned to provider '${identity.provider}'.`,
+              { type: "template", name, provider: providerName }
+            );
+          }
+          if (agent.default_memory_store.delete_on_destroy && identity?.identity_id) {
+            diagnostics.error(
+              "qoder.template.default_memory_store.delete.external_identity",
+              `agent.${name}: delete_on_destroy requires an OpenCMA-managed Identity because an external Identity keeps the default Memory Store mounted.`,
+              { type: "template", name, provider: providerName }
+            );
+          }
+        }
+      }
       if (delivery === "forward" && !isSupported(caps, "template")) {
         diagnostics.error(
           `${providerName}.agent.delivery.forward.unsupported`,
@@ -6886,10 +8007,10 @@ function collectProviderCapabilities(config, providers, diagnostics) {
             { type: "template", name, provider: providerName }
           );
         }
-        if (agent.memory_stores?.length) {
+        if (agent.memory_stores?.length && !config.defaults?.identity) {
           diagnostics.error(
-            "qoder.template.memory_store.unsupported",
-            `agent.${name}: memory_stores are not yet supported by Qoder Forward Template delivery.`,
+            "qoder.template.memory_store.identity.required",
+            `agent.${name}: Forward memory_stores require defaults.identity for the Identity/Template mount.`,
             { type: "template", name, provider: providerName }
           );
         }
@@ -6923,6 +8044,68 @@ function collectProviderCapabilities(config, providers, diagnostics) {
         }
       }
     }
+    if (providerName === "bailian") {
+      for (const [name, deployment] of Object.entries(config.deployments ?? {})) {
+        if (deployment.provider && deployment.provider !== providerName) continue;
+        const addr = {
+          type: "deployment",
+          name,
+          provider: providerName
+        };
+        if (deployment.initial_events?.some((event) => event.type === "user.define_outcome")) {
+          diagnostics.warning(
+            `${providerName}.deployment.define_outcome_unsupported`,
+            "Outcome rubrics (user.define_outcome) are dropped from the Bailian deployment payload; the run executes without rubric grading.",
+            addr
+          );
+        }
+        if (!deployment.initial_events?.some((event) => event.type === "user.message" || event.type === "system.message")) {
+          diagnostics.error(
+            `${providerName}.deployment.initial_events.message_required`,
+            `deployment.${name}: Bailian requires at least one user.message or system.message initial event; user.define_outcome events are dropped.`,
+            addr
+          );
+        }
+        if (deployment.resources?.some((resource) => resource.type === "github_repository")) {
+          diagnostics.warning(
+            `${providerName}.deployment.github_repository_unsupported`,
+            "Bailian deployment resources accept files only; github_repository resources are dropped. Clone the repository inside the session instead.",
+            addr
+          );
+        }
+        const mountPrefix = providerMountPrefix(providerName);
+        const normalizedMountPaths = /* @__PURE__ */ new Set();
+        for (const resource of deployment.resources ?? []) {
+          if (resource.type !== "file") continue;
+          if (!resource.mount_path?.trim()) {
+            diagnostics.error(
+              `${providerName}.deployment.file.mount_path.required`,
+              `deployment.${name}: Bailian file resources require mount_path.`,
+              addr
+            );
+            continue;
+          }
+          if (mountPrefix && resource.mount_path.startsWith("/") && resource.mount_path !== mountPrefix && !resource.mount_path.startsWith(`${mountPrefix}/`)) {
+            diagnostics.error(
+              `${providerName}.deployment.file.mount_path.invalid`,
+              `deployment.${name}: Bailian file mount_path must start with '${mountPrefix}/'.`,
+              addr
+            );
+            continue;
+          }
+          const normalizedMountPath = resolveSandboxMountPath(providerName, resource.mount_path);
+          if (normalizedMountPaths.has(normalizedMountPath)) {
+            diagnostics.error(
+              `${providerName}.deployment.file.mount_path.duplicate`,
+              `deployment.${name}: Bailian file mount_path '${normalizedMountPath}' is duplicated after normalization.`,
+              addr
+            );
+          } else {
+            normalizedMountPaths.add(normalizedMountPath);
+          }
+        }
+      }
+    }
     if (providerName !== "qoder") {
       for (const [name, env] of Object.entries(config.environments ?? {})) {
         if (env.environment_id) continue;
@@ -6935,6 +8118,20 @@ function collectProviderCapabilities(config, providers, diagnostics) {
         }
       }
       for (const [name, agent] of Object.entries(config.agents ?? {})) {
+        if (agent.environment_variables && (!agent.provider || agent.provider === providerName)) {
+          diagnostics.error(
+            `${providerName}.agent.environment_variables.unsupported`,
+            `agent.${name}: environment_variables is supported only by Qoder; remove it or pin this agent to qoder.`,
+            { type: "agent", name, provider: providerName }
+          );
+        }
+        if (agent.managed_tool_config && (!agent.provider || agent.provider === providerName)) {
+          diagnostics.error(
+            `${providerName}.agent.managed_tool_config.unsupported`,
+            `agent.${name}: managed_tool_config is supported only by Qoder; remove it or pin this agent to qoder.`,
+            { type: "agent", name, provider: providerName }
+          );
+        }
         if (agent.tunnel && (!agent.provider || agent.provider === providerName)) {
           diagnostics.error(
             `${providerName}.agent.tunnel.unsupported`,
@@ -6995,7 +8192,11 @@ function collectProviderCapabilities(config, providers, diagnostics) {
     if (config.deployments && caps.deployment.tier === "emulated") {
       for (const [name, dep] of Object.entries(config.deployments)) {
         if (dep.provider && dep.provider !== providerName) continue;
-        const addr = { type: "deployment", name, provider: providerName };
+        const addr = {
+          type: "deployment",
+          name,
+          provider: providerName
+        };
         if (dep.schedule) {
           diagnostics.warning(
             `${providerName}.deployment.schedule_unsupported`,
@@ -7014,238 +8215,39 @@ function collectProviderCapabilities(config, providers, diagnostics) {
           diagnostics.warning(
             `${providerName}.deployment.github_repository_unsupported`,
             "github_repository resources are not provisioned on this provider; clone the repository inside the session instead.",
-            addr
-          );
-        }
-        if (dep.resources?.some((r) => r.type === "memory_store" && (r.access === "read_only" || r.instructions))) {
-          diagnostics.warning(
-            `${providerName}.deployment.memory_store_options_unsupported`,
-            "Per-resource memory_store access/instructions are not honored on this provider; the store is attached with default access.",
-            addr
-          );
-        }
-      }
-    }
-  }
-}
-
-// src/internal/core/agent-materialization.ts
-function resolveAgentMaterialization(provider, agent) {
-  const mode = agent.delivery?.[provider]?.type ?? "managed";
-  if (mode === "managed") return { resourceType: "agent", mode };
-  return { resourceType: "template", mode };
-}
-
-// src/internal/graph/dependency.ts
-function buildDependencyGraph(config, targetProviders) {
-  const nodes = /* @__PURE__ */ new Map();
-  const edges = /* @__PURE__ */ new Map();
-  function addNode(addr) {
-    const key = addressKey(addr);
-    nodes.set(key, addr);
-    if (!edges.has(key)) edges.set(key, /* @__PURE__ */ new Set());
-  }
-  function addEdge(from, to) {
-    const fromKey = addressKey(from);
-    const toKey = addressKey(to);
-    edges.get(fromKey)?.add(toKey);
-  }
-  for (const provider of targetProviders) {
-    const def = getProvider(provider);
-    const caps = def?.capabilities;
-    if (config.environments) {
-      for (const name of Object.keys(config.environments)) {
-        const decl = config.environments[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "environment", name, provider });
-      }
-    }
-    if (config.memory_stores) {
-      for (const name of Object.keys(config.memory_stores)) {
-        const decl = config.memory_stores[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        if (!isSupported(caps, "memory_store")) continue;
-        addNode({ type: "memory_store", name, provider });
-      }
-    }
-    if (config.vaults) {
-      for (const name of Object.keys(config.vaults)) {
-        const decl = config.vaults[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "vault", name, provider });
-      }
-    }
-    if (config.skills) {
-      for (const name of Object.keys(config.skills)) {
-        const decl = config.skills[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "skill", name, provider });
-      }
-    }
-    if (config.files) {
-      for (const name of Object.keys(config.files)) {
-        const decl = config.files[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "file", name, provider });
-      }
-    }
-    if (config.identities && isSupported(caps, "identity")) {
-      for (const name of Object.keys(config.identities)) {
-        const decl = config.identities[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "identity", name, provider });
-      }
-    }
-    if (config.agents) {
-      for (const name of Object.keys(config.agents)) {
-        const decl = config.agents[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        const materialization = resolveAgentMaterialization(provider, decl);
-        const agentAddr = { type: materialization.resourceType, name, provider };
-        addNode(agentAddr);
-        if (decl.environment && config.environments?.[decl.environment]) {
-          const envAddr = {
-            type: "environment",
-            name: decl.environment,
-            provider
-          };
-          if (nodes.has(addressKey(envAddr))) {
-            addEdge(agentAddr, envAddr);
-          }
-        }
-        if (decl.skills) {
-          for (const skillRef of decl.skills) {
-            if (typeof skillRef !== "string") continue;
-            const skillName = skillRef;
-            const skillAddr = { type: "skill", name: skillName, provider };
-            if (nodes.has(addressKey(skillAddr))) {
-              addEdge(agentAddr, skillAddr);
-            }
-          }
-        }
-        if (decl.vault) {
-          const vaultAddr = { type: "vault", name: decl.vault, provider };
-          if (nodes.has(addressKey(vaultAddr))) {
-            addEdge(agentAddr, vaultAddr);
-          }
-        }
-        if (decl.memory_stores) {
-          for (const msName of decl.memory_stores) {
-            const msAddr = {
-              type: "memory_store",
-              name: msName,
-              provider
-            };
-            if (nodes.has(addressKey(msAddr))) {
-              addEdge(agentAddr, msAddr);
-            }
-          }
-        }
-        if (decl.multiagent && isSupported(caps, "multiagent")) {
-          for (const subName of decl.multiagent.agents) {
-            const subDecl = config.agents[subName];
-            const subType = subDecl ? resolveAgentMaterialization(provider, subDecl).resourceType : "agent";
-            const subAddr = { type: subType, name: subName, provider };
-            addEdge(agentAddr, subAddr);
-          }
-        }
-      }
-    }
-    if (config.deployments) {
-      for (const name of Object.keys(config.deployments)) {
-        const decl = config.deployments[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        const depAddr = { type: "deployment", name, provider };
-        addNode(depAddr);
-        const agentDecl = config.agents?.[decl.agent];
-        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
-        const agentAddr = { type: agentType, name: decl.agent, provider };
-        if (nodes.has(addressKey(agentAddr))) addEdge(depAddr, agentAddr);
-        if (decl.environment) {
-          const envAddr = { type: "environment", name: decl.environment, provider };
-          if (nodes.has(addressKey(envAddr))) addEdge(depAddr, envAddr);
-        }
-        if (decl.vaults) {
-          for (const vName of decl.vaults) {
-            const vAddr = { type: "vault", name: vName, provider };
-            if (nodes.has(addressKey(vAddr))) addEdge(depAddr, vAddr);
-          }
-        }
-        if (decl.memory_stores) {
-          for (const msName of decl.memory_stores) {
-            const msAddr = { type: "memory_store", name: msName, provider };
-            if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
-          }
-        }
-        if (decl.resources) {
-          for (const r of decl.resources) {
-            if (r.type === "memory_store") {
-              const msAddr = { type: "memory_store", name: r.memory_store, provider };
-              if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
-            }
-          }
+            addr
+          );
         }
-      }
-    }
-    if (config.channels && isSupported(caps, "channel")) {
-      for (const name of Object.keys(config.channels)) {
-        const decl = config.channels[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        const channelAddr = { type: "channel", name, provider };
-        addNode(channelAddr);
-        const agentDecl = config.agents?.[decl.agent];
-        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
-        const agentAddr = { type: agentType, name: decl.agent, provider };
-        if (nodes.has(addressKey(agentAddr))) addEdge(channelAddr, agentAddr);
-        const identityName = decl.identity ?? config.defaults?.identity;
-        if (identityName) {
-          const identityAddr = { type: "identity", name: identityName, provider };
-          if (nodes.has(addressKey(identityAddr))) addEdge(channelAddr, identityAddr);
+        if (dep.resources?.some((r) => r.type === "memory_store" && (r.access === "read_only" || r.instructions))) {
+          diagnostics.warning(
+            `${providerName}.deployment.memory_store_options_unsupported`,
+            "Per-resource memory_store access/instructions are not honored on this provider; the store is attached with default access.",
+            addr
+          );
         }
       }
     }
   }
-  return { nodes, edges };
-}
-function topologicalSort(graph) {
-  const visited = /* @__PURE__ */ new Set();
-  const sorted = [];
-  const visiting = /* @__PURE__ */ new Set();
-  function visit(key) {
-    if (visited.has(key)) return;
-    if (visiting.has(key)) {
-      throw new UserError(`Circular dependency detected involving: ${key}`);
-    }
-    visiting.add(key);
-    const deps = graph.edges.get(key) ?? /* @__PURE__ */ new Set();
-    for (const dep of deps) {
-      visit(dep);
-    }
-    visiting.delete(key);
-    visited.add(key);
-    sorted.push(graph.nodes.get(key));
-  }
-  for (const key of graph.nodes.keys()) {
-    visit(key);
-  }
-  return sorted;
 }
 
 // src/internal/planner/planner.ts
 async function buildPlan(config, state, options = {}) {
+  const scopedConfig = options.resourceAddresses ? selectProjectConfig(config, options.resourceAddresses) : config;
+  const resourceKeys = options.resourceAddresses ? new Set(options.resourceAddresses.map(addressKey)) : void 0;
+  const scopedState = resourceKeys ? { ...state, resources: state.resources.filter((resource) => resourceKeys.has(addressKey(resource.address))) } : state;
   const diagnostics = new DiagnosticCollector();
   const actions = [];
-  const targetProviders = options.providers ?? resolveTargetProviders(config);
-  collectReferenceDiagnostics(config, diagnostics);
-  collectProviderCapabilities(config, targetProviders, diagnostics);
-  const graph = buildDependencyGraph(config, targetProviders);
+  const targetProviders = options.providers ?? resolveTargetProviders(scopedConfig);
+  collectReferenceDiagnostics(scopedConfig, diagnostics);
+  collectProviderCapabilities(scopedConfig, targetProviders, diagnostics);
+  const graph = buildDependencyGraph(scopedConfig, targetProviders);
   const sorted = topologicalSort(graph);
   const stateIndex = /* @__PURE__ */ new Map();
-  for (const res of state.resources) {
+  for (const res of scopedState.resources) {
     stateIndex.set(addressKey(res.address), res);
   }
   const remoteIdLookup = /* @__PURE__ */ new Map();
-  for (const res of state.resources) {
+  for (const res of scopedState.resources) {
     remoteIdLookup.set(addressKey(res.address), res);
   }
   const hashStateLookup = { getResource: (addr) => remoteIdLookup.get(addressKey(addr)) };
@@ -7254,6 +8256,7 @@ async function buildPlan(config, state, options = {}) {
     const desiredHash = await computeResourceHash(address, config, options.configPath, hashStateLookup);
     const existing = stateIndex.get(key);
     const deps = getDependencies(address, graph);
+    const needsNativeDeploymentMaterialization = address.type === "deployment" && existing?.remote_id === null && getProvider(address.provider)?.capabilities.deployment.tier === "native";
     if (address.type === "environment" && existing) {
       const envDecl = config.environments?.[address.name];
       if (existing.externally_managed && envDecl && !envDecl.environment_id) {
@@ -7305,6 +8308,17 @@ async function buildPlan(config, state, options = {}) {
         after: { content_hash: desiredHash },
         dependencies: deps
       });
+    } else if (needsNativeDeploymentMaterialization) {
+      actions.push({
+        action: "update",
+        address,
+        driftKind: "none",
+        readinessImpact: "blocking",
+        reason: "Materialize legacy state as a native deployment",
+        before: { content_hash: existing.desired_hash ?? existing.content_hash },
+        after: { content_hash: desiredHash },
+        dependencies: deps
+      });
     } else if ((existing.desired_hash ?? existing.content_hash) !== desiredHash && existing.drift_status === "drifted") {
       const changedPaths = collectChangedPaths(address, config, existing, true);
       actions.push({
@@ -7377,8 +8391,106 @@ async function buildPlan(config, state, options = {}) {
       dependencies: replacement ? [replacement] : []
     });
   }
+  coalesceChannelRenames(actions, scopedConfig, scopedState);
   return { actions, diagnostics: diagnostics.getAll() };
 }
+function selectProjectConfig(config, addresses) {
+  const providers = new Set(addresses.map((address) => address.provider));
+  const namesByType = /* @__PURE__ */ new Map();
+  for (const address of addresses) {
+    const names = namesByType.get(address.type) ?? /* @__PURE__ */ new Set();
+    names.add(address.name);
+    namesByType.set(address.type, names);
+  }
+  const pick = (record, names) => {
+    if (!record || !names?.size) return void 0;
+    const selected = Object.fromEntries(Object.entries(record).filter(([name]) => names.has(name)));
+    return Object.keys(selected).length > 0 ? selected : void 0;
+  };
+  const agentNames = /* @__PURE__ */ new Set([...namesByType.get("agent") ?? [], ...namesByType.get("template") ?? []]);
+  const selectedAgents = pick(config.agents, agentNames);
+  const tunnelNames = /* @__PURE__ */ new Set();
+  for (const agent of Object.values(selectedAgents ?? {})) {
+    if (agent.tunnel) tunnelNames.add(agent.tunnel);
+  }
+  for (const deployment of Object.values(pick(config.deployments, namesByType.get("deployment")) ?? {})) {
+    if (deployment.tunnel) tunnelNames.add(deployment.tunnel);
+  }
+  const identityNames = namesByType.get("identity");
+  const selectedProviders = Object.fromEntries(
+    Object.entries(config.providers).filter(([providerName]) => providers.has(providerName))
+  );
+  const defaultProvider = providers.size === 1 ? [...providers][0] : config.defaults?.provider;
+  const defaultIdentity = config.defaults?.identity && identityNames?.has(config.defaults.identity) ? config.defaults.identity : void 0;
+  return {
+    ...config,
+    providers: selectedProviders,
+    defaults: defaultProvider || defaultIdentity ? { provider: defaultProvider, identity: defaultIdentity } : void 0,
+    environments: pick(config.environments, namesByType.get("environment")),
+    tunnels: pick(config.tunnels, tunnelNames),
+    vaults: pick(config.vaults, namesByType.get("vault")),
+    memory_stores: pick(config.memory_stores, namesByType.get("memory_store")),
+    skills: pick(config.skills, namesByType.get("skill")),
+    files: pick(config.files, namesByType.get("file")),
+    identities: pick(config.identities, identityNames),
+    agents: selectedAgents,
+    channels: pick(config.channels, namesByType.get("channel")),
+    deployments: pick(config.deployments, namesByType.get("deployment"))
+  };
+}
+function coalesceChannelRenames(actions, config, state) {
+  const creates = actions.filter((action) => action.action === "create" && action.address.type === "channel");
+  const deletes = actions.filter((action) => action.action === "delete" && action.address.type === "channel");
+  const stateByAddress = new Map(state.resources.map((resource) => [addressKey(resource.address), resource]));
+  const matchedDeletes = /* @__PURE__ */ new Set();
+  for (const create of creates) {
+    const desiredType = config.channels?.[create.address.name]?.type;
+    if (!desiredType) continue;
+    const desiredFingerprint = computeReplacementFingerprint(create.address, config);
+    const candidates = deletes.filter((deletion2) => {
+      if (matchedDeletes.has(deletion2) || deletion2.address.provider !== create.address.provider) return false;
+      const prior2 = stateByAddress.get(addressKey(deletion2.address));
+      const snapshot = prior2?.remote_snapshot;
+      if (snapshot?.channel_type !== desiredType) return false;
+      return !prior2?.replacement_fingerprint || prior2.replacement_fingerprint === desiredFingerprint;
+    });
+    if (candidates.length !== 1) continue;
+    const deletion = candidates[0];
+    const prior = stateByAddress.get(addressKey(deletion.address));
+    const competingCreates = creates.filter(
+      (candidate) => candidate !== create && candidate.address.provider === create.address.provider && config.channels?.[candidate.address.name]?.type === desiredType && (!prior?.replacement_fingerprint || computeReplacementFingerprint(candidate.address, config) === prior.replacement_fingerprint)
+    );
+    if (competingCreates.length > 0) continue;
+    create.action = "update";
+    create.previousAddress = deletion.address;
+    create.before = deletion.before;
+    create.driftKind = "local";
+    create.reason = `Channel key renamed from '${deletion.address.name}' (remote resource retained)`;
+    protectRenamedChannelDependencies(actions, stateByAddress, deletion, create);
+    matchedDeletes.add(deletion);
+  }
+  for (let index = actions.length - 1; index >= 0; index--) {
+    if (matchedDeletes.has(actions[index])) actions.splice(index, 1);
+  }
+}
+function protectRenamedChannelDependencies(actions, stateByAddress, deletion, replacement) {
+  const prior = stateByAddress.get(addressKey(deletion.address));
+  const snapshot = prior?.remote_snapshot;
+  const referencedIds = new Set(
+    [snapshot?.identity_id, snapshot?.template_id].filter((id) => typeof id === "string")
+  );
+  if (referencedIds.size === 0) return;
+  for (const action of actions) {
+    if (action.action !== "delete" || action.address.type !== "identity" && action.address.type !== "template" || action.address.provider !== replacement.address.provider) {
+      continue;
+    }
+    const dependency = stateByAddress.get(addressKey(action.address));
+    if (!dependency?.remote_id || !referencedIds.has(dependency.remote_id)) continue;
+    if (!action.dependencies.some((address) => addressKey(address) === addressKey(replacement.address))) {
+      action.dependencies.push(replacement.address);
+    }
+  }
+}
 function deliveryReplacementAddress(address, graph) {
   if (address.type !== "agent" && address.type !== "template") return void 0;
   const replacementType = address.type === "agent" ? "template" : "agent";
@@ -7405,6 +8517,9 @@ async function refreshState(state, providers, options = {}) {
   const errors = [];
   let dirty = false;
   for (const res of resources) {
+    if (options.resourceKeys && !options.resourceKeys.has(addressKey(res.address))) {
+      continue;
+    }
     if (options.targetProviders && !options.targetProviders.includes(res.address.provider)) {
       continue;
     }
@@ -7467,7 +8582,7 @@ async function refreshState(state, providers, options = {}) {
         dirty = true;
         continue;
       }
-      const remote = await provider.findResource(res.address.type, res.address.name, res.remote_id);
+      const remote = await provider.findResource(res.address.type, res.address.name, res.remote_id, res.api_mode);
       if (!remote) {
         if (!options.quiet) {
           emitRuntimeFeedback(options.onFeedback, {
@@ -7518,12 +8633,19 @@ async function refreshState(state, providers, options = {}) {
 }
 
 // src/internal/core/resource-runtime.ts
+async function planProjectWithStateBackend(input, options = {}) {
+  return readProjectRuntime(input, (ctx) => planProjectContext(ctx, options));
+}
 async function syncProjectResourcesWithStateBackend(input, options = {}) {
   return writeProjectRuntime(input, async (ctx) => {
     const planned = await planProjectContext(ctx, options);
     if (options.refreshOnly) {
       return { planned };
     }
+    if (options.mode === "create-only") {
+      const errorDiagnostic = planned.plan.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+      if (errorDiagnostic) throw new UserError(errorDiagnostic.message);
+    }
     return {
       planned,
       execution: await executePlannedProject(planned, {
@@ -7591,25 +8713,98 @@ async function importResource(ctx, address, remoteId, options = {}) {
   return resource;
 }
 async function planProjectContext(ctx, options = {}) {
-  const targetProviders = resolveTargetProviders2(options.provider);
+  if (options.mode === "create-only" && !options.scope) {
+    throw new UserError("Resource create-only mode requires an explicit resource scope.");
+  }
+  let targetProviders = resolveTargetProviders2(options.provider);
+  if (!targetProviders && options.scope) {
+    targetProviders = [...new Set(options.scope.roots.map((root) => root.provider))];
+  }
+  const selectedAddresses = options.scope ? resolvePlanScope(ctx, targetProviders ?? [], options.scope) : void 0;
+  const resourceKeys = selectedAddresses ? new Set(selectedAddresses.map(addressKey)) : void 0;
   const refreshResult = options.refresh !== false && ctx.state.listResources().length > 0 ? await refreshState(ctx.state, ctx.providers, {
     targetProviders,
+    resourceKeys,
     config: ctx.config,
     quiet: options.quiet ?? true,
     onFeedback: options.onFeedback
   }) : void 0;
-  const plan = await buildPlan(ctx.config, ctx.state.getStateFile(), {
+  let plan = await buildPlan(ctx.config, ctx.state.getStateFile(), {
     providers: targetProviders,
-    configPath: ctx.configPath
+    configPath: ctx.configPath,
+    resourceAddresses: selectedAddresses
   });
+  if (options.mode === "create-only" && options.scope) {
+    plan = enforceCreateOnlyPlan(plan, options.scope, toResourceRefreshResult(refreshResult));
+  }
   return {
     executionContext: ctx,
     plan,
     refreshResult: toResourceRefreshResult(refreshResult),
     targetProviders,
-    destructiveActions: selectDestructive(plan.actions)
+    destructiveActions: selectDestructive(plan.actions),
+    selectedAddresses,
+    mode: options.mode
+  };
+}
+function enforceCreateOnlyPlan(plan, scope, refreshResult) {
+  const reasons = [];
+  const rootKeys = new Set(scope.roots.map(addressKey));
+  const refreshError = refreshResult?.errors[0];
+  if (refreshError) {
+    reasons.push(
+      `Cannot verify scoped dependencies because refresh failed for ${addressKey(refreshError.resource.address)}: ${refreshError.error}`
+    );
+  }
+  for (const root of scope.roots) {
+    const rootKey = addressKey(root);
+    const rootAction = plan.actions.find((action) => addressKey(action.address) === rootKey);
+    if (!rootAction) {
+      reasons.push(`Scoped plan did not contain target resource ${rootKey}.`);
+    } else if (rootAction.action !== "create") {
+      reasons.push(`Target resource ${rootKey} must be new, but the scoped plan requires '${rootAction.action}'.`);
+    }
+  }
+  const dependencyChanges = plan.actions.filter(
+    (action) => !rootKeys.has(addressKey(action.address)) && action.action !== "no-op"
+  );
+  if (dependencyChanges.length > 0) {
+    const labels = dependencyChanges.map((action) => `${addressKey(action.address)} (${action.action})`).join(", ");
+    reasons.push(`Create-only requires every scoped dependency to be up-to-date. Reconcile first: ${labels}.`);
+  }
+  if (reasons.length === 0) return plan;
+  return {
+    ...plan,
+    diagnostics: [
+      ...plan.diagnostics,
+      {
+        severity: "error",
+        code: "resource.create_only.blocked",
+        message: reasons.join(" "),
+        resource: scope.roots[0]
+      }
+    ]
   };
 }
+function resolvePlanScope(ctx, targetProviders, scope) {
+  if (scope.roots.length === 0) {
+    throw new UserError("Resource plan scope requires at least one root address.");
+  }
+  for (const root of scope.roots) {
+    if (!targetProviders.includes(root.provider)) {
+      throw new UserError(
+        `Scoped resource ${addressKey(root)} is outside the selected provider set: ${targetProviders.join(", ")}.`
+      );
+    }
+  }
+  const graph = buildDependencyGraph(ctx.config, targetProviders);
+  for (const root of scope.roots) {
+    if (!graph.nodes.has(addressKey(root))) {
+      throw new UserError(`Scoped resource ${addressKey(root)} is not declared in the project config.`);
+    }
+  }
+  return scope.includeDependencies === false ? [...scope.roots] : collectDependencyClosure(graph, scope.roots);
+}
 async function executePlannedProject(planned, options = {}) {
   const decision = await decideDestructive(planned.destructiveActions, {
     policy: options.policy,
@@ -7653,13 +8848,6 @@ async function decideDestructive(destructiveActions, options = {}) {
       return "blocked";
   }
 }
-function replaceResourcePlan(planned, plan) {
-  return {
-    ...planned,
-    plan,
-    destructiveActions: selectDestructive(plan.actions)
-  };
-}
 function toResourceRefreshResult(result) {
   if (!result) return void 0;
   return {
@@ -8008,6 +9196,354 @@ function buildDeploymentContext(ctx, name, provider) {
   };
 }
 
+// src/internal/core/managed-api-runtime.ts
+function resolveAdapter(ctx, provider) {
+  if (provider) return getRuntimeProvider(ctx, provider);
+  const configured = Array.from(ctx.providers.keys());
+  if (configured.length === 1) return getRuntimeProvider(ctx, configured[0]);
+  throw new UserError("Multiple providers configured. Use --provider to specify one.");
+}
+function requiredMethod(value, provider, operation) {
+  if (value) return value;
+  throw new UserError(`Provider '${provider}' does not support ${operation}.`);
+}
+async function listRemoteAgents(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listAgentResources, adapter2.name, "agent listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteAgent(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getRemoteAgent, adapter2.name, "agent lookup");
+  return method2.call(adapter2, id, options.version);
+}
+async function listRemoteAgentVersions(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listAgentVersions, adapter2.name, "agent version listing");
+  return method2.call(adapter2, id, options);
+}
+async function listRemoteEnvironments(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listEnvironmentResources, adapter2.name, "environment listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteEnvironment(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getRemoteEnvironment, adapter2.name, "environment lookup");
+  return method2.call(adapter2, id);
+}
+async function listRemoteVaults(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listVaultResources, adapter2.name, "vault listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteVault(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getRemoteVault, adapter2.name, "vault lookup");
+  return method2.call(adapter2, id);
+}
+async function listRemoteSkills(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listSkillResources, adapter2.name, "skill listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteSkill(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getSkillInfo, adapter2.name, "skill lookup");
+  return method2.call(adapter2, id);
+}
+async function listRemoteSkillVersions(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listSkillVersions, adapter2.name, "skill version listing");
+  return method2.call(adapter2, id, options);
+}
+async function getRemoteSkillVersion(ctx, id, version, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getSkillVersion, adapter2.name, "skill version lookup");
+  return method2.call(adapter2, id, version);
+}
+async function getRemoteSkillDownloadInfo(ctx, id, version, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getSkillDownloadInfo, adapter2.name, "skill version download");
+  return method2.call(adapter2, id, version);
+}
+async function downloadRemoteSkill(ctx, id, version, options = {}) {
+  const info = await getRemoteSkillDownloadInfo(ctx, id, version, options);
+  const response = await resolveFetch()(info.file_url, { method: "GET" });
+  if (!response.ok) {
+    throw new ApiError(response.status, await response.text(), "Skill download failed");
+  }
+  return new Uint8Array(await response.arrayBuffer());
+}
+async function listRemoteFiles(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listFileResources, adapter2.name, "file listing");
+  return method2.call(adapter2, options);
+}
+async function downloadRemoteFile(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.downloadFileContent, adapter2.name, "file content download");
+  return method2.call(adapter2, id);
+}
+async function updateRemoteSession(ctx, id, input, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.updateSession, adapter2.name, "session update");
+  return method2.call(adapter2, id, input);
+}
+async function archiveRemoteSession(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.archiveSession, adapter2.name, "session archive");
+  return method2.call(adapter2, id);
+}
+async function sendRemoteSessionEvents(ctx, id, events, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.sendSessionEvents, adapter2.name, "generic session event sending");
+  return method2.call(adapter2, id, events);
+}
+async function listRemoteDeployments(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listDeployments, adapter2.name, "deployment listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteDeployment(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getDeploymentById, adapter2.name, "deployment lookup");
+  return method2.call(adapter2, id);
+}
+async function runRemoteDeployment(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.runDeploymentById, adapter2.name, "deployment run");
+  return method2.call(adapter2, id);
+}
+async function setRemoteDeploymentPaused(ctx, id, paused, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = paused ? adapter2.pauseDeploymentById : adapter2.unpauseDeploymentById;
+  return requiredMethod(method2, adapter2.name, `${paused ? "pausing" : "unpausing"} deployments`).call(adapter2, id);
+}
+async function listRemoteDeploymentRuns(ctx, deploymentId, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listDeploymentRuns, adapter2.name, "deployment run listing");
+  return method2.call(adapter2, deploymentId, options);
+}
+async function getRemoteDeploymentRun(ctx, runId, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getDeploymentRun, adapter2.name, "deployment run lookup");
+  return method2.call(adapter2, runId);
+}
+var API_KEY = { supported: true, auth: "api_key" };
+var CLIENT_SEARCH = {
+  supported: true,
+  auth: "api_key",
+  reason: "Client-side filtering over the corresponding list API."
+};
+var UNSUPPORTED_MODEL = {
+  supported: false,
+  auth: null,
+  reason: "The public Managed Agents API does not expose a model catalog endpoint."
+};
+var UNSUPPORTED_THREAD = {
+  supported: false,
+  auth: null,
+  reason: "Managed Agents exposes child-thread ids and lifecycle events through Session Events, but no independent Thread resource API."
+};
+var UNSUPPORTED_OAUTH = {
+  supported: false,
+  auth: null,
+  reason: "The public Managed Agents data plane does not expose MCP OAuth login."
+};
+var BAILIAN_OPERATIONS = {
+  "agent.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "agent.list": API_KEY,
+  "agent.get": API_KEY,
+  "agent.search": CLIENT_SEARCH,
+  "agent.versions": API_KEY,
+  "environment.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "environment.list": API_KEY,
+  "environment.get": API_KEY,
+  "environment.search": CLIENT_SEARCH,
+  "skill.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "skill.list": API_KEY,
+  "skill.get": API_KEY,
+  "skill.search": CLIENT_SEARCH,
+  "skill.versions": API_KEY,
+  "skill.download": API_KEY,
+  "vault.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "vault.credential.create": { ...API_KEY, reason: "YAML declaration plus scoped Vault transaction." },
+  "vault.list": API_KEY,
+  "vault.get": API_KEY,
+  "vault.search": CLIENT_SEARCH,
+  "deployment.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "deployment.list": API_KEY,
+  "deployment.get": API_KEY,
+  "deployment.search": { ...API_KEY, reason: "Maps to the server-side keyword parameter." },
+  "deployment.runs.list": API_KEY,
+  "deployment.runs.get": API_KEY,
+  "deployment.run": API_KEY,
+  "deployment.pause": API_KEY,
+  "deployment.unpause": API_KEY,
+  "session.create": API_KEY,
+  "session.list": API_KEY,
+  "session.get": API_KEY,
+  "session.search": CLIENT_SEARCH,
+  "session.update": API_KEY,
+  "session.archive": API_KEY,
+  "session.delete": API_KEY,
+  "session.run": { ...API_KEY, reason: "Client composition of session create and event send/stream." },
+  "session.event.send": API_KEY,
+  "session.event.list": API_KEY,
+  "session.event.stream": API_KEY,
+  "session.debug": { ...API_KEY, reason: "Client-side aggregation of supported read APIs." },
+  "session.export": { ...API_KEY, reason: "Client-side export of supported read APIs." },
+  "file.upload": API_KEY,
+  "file.list": API_KEY,
+  "file.get": API_KEY,
+  "file.search": CLIENT_SEARCH,
+  "file.download": API_KEY,
+  "file.delete": API_KEY,
+  "model.list": UNSUPPORTED_MODEL,
+  "model.search": UNSUPPORTED_MODEL,
+  "session_thread.list": UNSUPPORTED_THREAD,
+  "session_thread.get": UNSUPPORTED_THREAD,
+  "session_thread.archive": UNSUPPORTED_THREAD,
+  "session_thread.events": UNSUPPORTED_THREAD,
+  "mcp.oauth_login": UNSUPPORTED_OAUTH
+};
+function getManagedAgentProviderCapabilities(provider) {
+  if (provider === "bailian") {
+    return { provider, operations: { ...BAILIAN_OPERATIONS } };
+  }
+  return {
+    provider,
+    operations: {
+      "managed_agent.api": {
+        supported: false,
+        auth: null,
+        reason: "The operation-level API command surface is currently implemented for Bailian only."
+      }
+    }
+  };
+}
+
+// src/internal/core/vault-credential-runtime.ts
+async function planVaultCredentialCreate(ctx, vaultName, credentialName, options = {}) {
+  const prepared = await prepareVaultCredentialCreate(ctx, vaultName, credentialName, options);
+  return {
+    provider: prepared.provider,
+    vault: vaultName,
+    vaultRemoteId: prepared.vaultState.remote_id,
+    credential: credentialName,
+    remoteChecked: prepared.remoteChecked,
+    reuseRemote: Boolean(prepared.remoteCredential),
+    remoteCredentialId: prepared.remoteCredential?.id
+  };
+}
+async function planVaultCredentialCreateWithStateBackend(input, vaultName, credentialName, options = {}) {
+  return readProjectRuntime(input, (ctx) => planVaultCredentialCreate(ctx, vaultName, credentialName, options));
+}
+async function createVaultCredential(ctx, vaultName, credentialName, options = {}) {
+  if (options.checkRemote === false) {
+    throw new UserError("Vault Credential create requires the remote duplicate check.");
+  }
+  const prepared = await prepareVaultCredentialCreate(ctx, vaultName, credentialName, options);
+  const remote = prepared.remoteCredential ?? await prepared.adapter.createCredential(prepared.vaultState.remote_id, prepared.credential);
+  if (!remote.id) throw new UserError("Credential create returned no remote id.");
+  const address = { type: "vault", name: vaultName, provider: prepared.provider };
+  const desiredHash = await computeResourceHash(address, ctx.config, ctx.configPath, ctx.state);
+  ctx.state.setResource({
+    ...prepared.vaultState,
+    content_hash: desiredHash,
+    desired_hash: desiredHash,
+    drift_paths: [],
+    drift_status: "unchecked"
+  });
+  await ctx.state.save();
+  return {
+    provider: prepared.provider,
+    vault: vaultName,
+    vaultRemoteId: prepared.vaultState.remote_id,
+    credential: credentialName,
+    remoteChecked: prepared.remoteChecked,
+    credentialId: remote.id,
+    reuseRemote: Boolean(prepared.remoteCredential),
+    remoteCredentialId: prepared.remoteCredential?.id,
+    adopted: Boolean(prepared.remoteCredential)
+  };
+}
+async function createVaultCredentialWithStateBackend(input, vaultName, credentialName, options = {}) {
+  return writeProjectRuntime(input, (ctx) => createVaultCredential(ctx, vaultName, credentialName, options));
+}
+async function prepareVaultCredentialCreate(ctx, vaultName, credentialName, options) {
+  const vault = ctx.config.vaults?.[vaultName];
+  if (!vault) throw new UserError(`Vault '${vaultName}' is not declared in the project config.`);
+  const provider = resolveVaultProvider(ctx, vault.provider, options.provider);
+  const credential = vault.credentials.at(-1);
+  if (!credential || credential.name !== credentialName) {
+    throw new UserError(`Credential '${credentialName}' must be the final newly appended entry in vault.${vaultName}.`);
+  }
+  if (vault.credentials.slice(0, -1).some((entry) => entry.name === credentialName)) {
+    throw new UserError(`Vault '${vaultName}' already declares a credential named '${credentialName}'.`);
+  }
+  const address = { type: "vault", name: vaultName, provider };
+  const priorConfig = structuredClone(ctx.config);
+  priorConfig.vaults[vaultName] = {
+    ...priorConfig.vaults[vaultName],
+    credentials: priorConfig.vaults[vaultName].credentials.slice(0, -1)
+  };
+  const priorPlan = await planProjectContext(
+    { ...ctx, config: priorConfig },
+    {
+      provider,
+      scope: { roots: [address] },
+      refresh: options.refresh,
+      quiet: options.quiet ?? true
+    }
+  );
+  const refreshError = priorPlan.refreshResult?.errors[0];
+  if (refreshError) {
+    throw new UserError(`Cannot verify vault.${vaultName} because refresh failed: ${refreshError.error}`);
+  }
+  const errorDiagnostic = priorPlan.plan.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+  if (errorDiagnostic) throw new UserError(errorDiagnostic.message);
+  const vaultAction = priorPlan.plan.actions.find(
+    (action) => action.address.type === "vault" && action.address.name === vaultName
+  );
+  if (vaultAction?.action !== "no-op") {
+    throw new UserError(
+      `vault.${vaultName} must be tracked and up-to-date before adding a credential; current action is '${vaultAction?.action ?? "missing"}'.`
+    );
+  }
+  const vaultState = ctx.state.getResource(address);
+  if (!vaultState?.remote_id) throw new UserError(`vault.${vaultName} has no tracked remote id.`);
+  const adapter2 = getRuntimeProvider(ctx, provider);
+  if (!adapter2.createCredential || !adapter2.listCredentials) {
+    throw new UserError(`Provider '${provider}' does not support scoped Vault Credential create.`);
+  }
+  const remoteChecked = options.checkRemote !== false;
+  const sameName = remoteChecked ? (await adapter2.listCredentials(vaultState.remote_id)).filter(
+    (remoteCredential) => remoteCredential.display_name === credentialName
+  ) : [];
+  const exact = sameName.find((remoteCredential) => credentialMatches(remoteCredential, credential));
+  if (sameName.length > 0 && !exact) {
+    throw new UserError(`Vault '${vaultName}' already has a different remote credential named '${credentialName}'.`);
+  }
+  return { provider, credential, vaultState, adapter: adapter2, remoteChecked, remoteCredential: exact };
+}
+function resolveVaultProvider(ctx, declaredProvider, requestedProvider) {
+  if (requestedProvider && declaredProvider && requestedProvider !== declaredProvider) {
+    throw new UserError(
+      `Vault provider '${declaredProvider}' does not match requested provider '${requestedProvider}'.`
+    );
+  }
+  const provider = requestedProvider ?? declaredProvider ?? ctx.config.defaults?.provider;
+  if (provider && provider !== "all") return provider;
+  const configured = [...ctx.providers.keys()];
+  if (configured.length === 1) return configured[0];
+  throw new UserError("Cannot infer one provider for Vault Credential create.");
+}
+function credentialMatches(remote, desired) {
+  return remote.auth_type === desired.type && remote.secret_name === desired.secret_name && (remote.networking_type ?? "unrestricted") === (desired.networking?.type ?? "unrestricted");
+}
+
 // src/internal/core/destroy-runtime.ts
 var destroyOrder = {
   deployment: 0,
@@ -8025,12 +9561,64 @@ function planDestroyProjectContext(ctx) {
   const resources = [...ctx.state.listResources()].sort(
     (a, b) => (destroyOrder[a.address.type] ?? 99) - (destroyOrder[b.address.type] ?? 99)
   );
-  return { resources, executionContext: ctx };
+  const identityName = ctx.config.defaults?.identity;
+  const defaultMemoryStores = [];
+  for (const [agentName, agent] of Object.entries(ctx.config.agents ?? {})) {
+    if (!agent.default_memory_store || agent.delivery?.qoder?.type !== "forward") continue;
+    if (agent.provider && agent.provider !== "qoder") continue;
+    const identityId = identityName ? ctx.state.getResource({ type: "identity", name: identityName, provider: "qoder" })?.remote_id ?? null : null;
+    const templateId = ctx.state.getResource({ type: "template", name: agentName, provider: "qoder" })?.remote_id ?? null;
+    if (!identityId && !templateId) continue;
+    defaultMemoryStores.push({
+      agentName,
+      provider: "qoder",
+      identityId,
+      templateId,
+      deleteOnDestroy: agent.default_memory_store.delete_on_destroy ?? false
+    });
+  }
+  for (const pending of ctx.state.getStateFile().pending_default_memory_store_cleanups ?? []) {
+    const existing = defaultMemoryStores.find(
+      (item) => item.agentName === pending.agent_name && item.provider === pending.provider
+    );
+    if (existing) {
+      existing.memoryStoreId = pending.remote_id;
+      existing.deleteOnDestroy = true;
+    } else {
+      defaultMemoryStores.push({
+        agentName: pending.agent_name,
+        provider: pending.provider,
+        identityId: pending.identity_id ?? null,
+        templateId: pending.template_id ?? null,
+        deleteOnDestroy: true,
+        memoryStoreId: pending.remote_id
+      });
+    }
+  }
+  return { resources, defaultMemoryStores, executionContext: ctx };
 }
 async function destroyPlannedProjectResources(planned, options = {}) {
   const results = [];
-  let stateChanged = false;
+  const capturedDefaults = await captureDefaultMemoryStores(planned);
   const ctx = planned.executionContext;
+  if (capturedDefaults.some((item) => item.error)) {
+    const defaultMemoryStoreResults2 = capturedDefaults.map(preflightFailureResult);
+    for (const resource of planned.resources) {
+      const result = {
+        resource,
+        status: "blocked",
+        reason: "skipped",
+        error: "Destroy aborted because the default Memory Store preflight failed."
+      };
+      results.push(result);
+      options.onResourceResult?.(result);
+    }
+    return { ...planned, results, defaultMemoryStoreResults: defaultMemoryStoreResults2, destroyed: 0, partial: true };
+  }
+  if (await persistCapturedDefaultMemoryStores(ctx, capturedDefaults)) {
+    await ctx.state.save();
+  }
+  let stateChanged = false;
   for (const resource of planned.resources) {
     options.onResourceStart?.(resource);
     const result = await destroyOneResource(ctx, resource, options);
@@ -8041,14 +9629,171 @@ async function destroyPlannedProjectResources(planned, options = {}) {
   if (stateChanged) {
     await ctx.state.save();
   }
+  const defaultMemoryStoreResults = await finalizeDefaultMemoryStores(planned, capturedDefaults, options);
+  if (recordFailedDefaultMemoryStoreCleanups(ctx, defaultMemoryStoreResults)) {
+    await ctx.state.save();
+  }
+  if (clearCompletedDefaultMemoryStoreCleanups(ctx, defaultMemoryStoreResults)) {
+    await ctx.state.save();
+  }
   const destroyed = results.filter((result) => result.status === "success").length;
   return {
     ...planned,
     results,
+    defaultMemoryStoreResults,
     destroyed,
-    partial: destroyed !== planned.resources.length
+    partial: destroyed !== planned.resources.length || defaultMemoryStoreResults.some((result) => result.status === "failed")
+  };
+}
+async function persistCapturedDefaultMemoryStores(ctx, captured) {
+  const state = ctx.state.getStateFile();
+  if (!state.pending_default_memory_store_cleanups) state.pending_default_memory_store_cleanups = [];
+  const pending = state.pending_default_memory_store_cleanups;
+  let changed = false;
+  for (const item of captured) {
+    if (!item.plan.deleteOnDestroy || !item.memoryStoreId) continue;
+    if (pending.some((entry) => entry.provider === item.plan.provider && entry.remote_id === item.memoryStoreId))
+      continue;
+    pending.push({
+      agent_name: item.plan.agentName,
+      provider: item.plan.provider,
+      remote_id: item.memoryStoreId,
+      ...item.plan.identityId ? { identity_id: item.plan.identityId } : {},
+      ...item.plan.templateId ? { template_id: item.plan.templateId } : {}
+    });
+    changed = true;
+  }
+  return changed;
+}
+function clearCompletedDefaultMemoryStoreCleanups(ctx, results) {
+  const state = ctx.state.getStateFile();
+  const completedIds = new Set(
+    results.filter((item) => item.status === "deleted" || item.status === "already_gone").map((item) => item.memoryStoreId).filter((id) => Boolean(id))
+  );
+  if (completedIds.size === 0 || !state.pending_default_memory_store_cleanups?.length) return false;
+  const remaining = state.pending_default_memory_store_cleanups.filter((item) => !completedIds.has(item.remote_id));
+  if (remaining.length === state.pending_default_memory_store_cleanups.length) return false;
+  state.pending_default_memory_store_cleanups = remaining;
+  return true;
+}
+function recordFailedDefaultMemoryStoreCleanups(ctx, results) {
+  const pending = ctx.state.getStateFile().pending_default_memory_store_cleanups;
+  if (!pending?.length) return false;
+  let changed = false;
+  for (const result of results) {
+    if (result.status !== "failed" || !result.memoryStoreId) continue;
+    const entry = pending.find((item) => item.remote_id === result.memoryStoreId);
+    if (entry && entry.last_error !== result.error) {
+      entry.last_error = result.error;
+      changed = true;
+    }
+  }
+  return changed;
+}
+function preflightFailureResult(item) {
+  if (!item.plan.deleteOnDestroy) return { ...item.plan, status: "retained" };
+  return {
+    ...item.plan,
+    status: "failed",
+    ...item.memoryStoreId ? { memoryStoreId: item.memoryStoreId } : {},
+    error: item.error ?? "Destroy aborted because another default Memory Store preflight failed."
   };
 }
+async function captureDefaultMemoryStores(planned) {
+  return Promise.all(
+    planned.defaultMemoryStores.map(async (item) => {
+      if (!item.deleteOnDestroy) return { plan: item };
+      if (item.memoryStoreId) return { plan: item, memoryStoreId: item.memoryStoreId };
+      if (!item.identityId || !item.templateId) {
+        return { plan: item, error: "Cannot resolve the Identity and Template before destroy." };
+      }
+      try {
+        const provider = getRuntimeProvider(planned.executionContext, item.provider);
+        if (!provider.findDefaultMemoryStoreId || !provider.deleteDefaultMemoryStore) {
+          return { plan: item, error: `Provider '${item.provider}' cannot delete a default memory store.` };
+        }
+        const memoryStoreId = await provider.findDefaultMemoryStoreId(item.identityId, item.templateId);
+        return { plan: item, ...memoryStoreId ? { memoryStoreId } : {} };
+      } catch (error) {
+        return { plan: item, error: error instanceof Error ? error.message : String(error) };
+      }
+    })
+  );
+}
+async function finalizeDefaultMemoryStores(planned, captured, options) {
+  const output = [];
+  for (const item of captured) {
+    if (!item.plan.deleteOnDestroy) {
+      output.push({ ...item.plan, status: "retained" });
+      continue;
+    }
+    if (item.error) {
+      output.push({ ...item.plan, status: "failed", error: item.error });
+      continue;
+    }
+    if (!item.memoryStoreId) {
+      output.push({ ...item.plan, status: "already_gone" });
+      continue;
+    }
+    try {
+      const provider = getRuntimeProvider(planned.executionContext, item.plan.provider);
+      await deleteDefaultMemoryStoreWithArchiveFallback(
+        provider,
+        item.memoryStoreId,
+        options.defaultMemoryStoreRetryDelaysMs ?? [1e3, 2e3, 4e3, 8e3]
+      );
+      output.push({ ...item.plan, status: "deleted", memoryStoreId: item.memoryStoreId });
+    } catch (error) {
+      if (ApiError.isNotFound(error)) {
+        output.push({ ...item.plan, status: "already_gone", memoryStoreId: item.memoryStoreId });
+      } else {
+        output.push({
+          ...item.plan,
+          status: "failed",
+          memoryStoreId: item.memoryStoreId,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+  }
+  return output;
+}
+async function deleteDefaultMemoryStoreWithArchiveFallback(provider, memoryStoreId, retryDelaysMs) {
+  try {
+    await retryDefaultMemoryStoreOperation(() => provider.deleteDefaultMemoryStore(memoryStoreId), retryDelaysMs);
+  } catch (error) {
+    if (isAlreadyArchivedConflict(error) && provider.deleteMemoryStore) {
+      await retryDefaultMemoryStoreOperation(() => provider.deleteMemoryStore(memoryStoreId), retryDelaysMs);
+      return;
+    }
+    if (!isStillMountedConflict(error) || !provider.archiveMemoryStore || !provider.deleteMemoryStore) throw error;
+    await retryDefaultMemoryStoreOperation(() => provider.archiveMemoryStore(memoryStoreId), retryDelaysMs);
+    await retryDefaultMemoryStoreOperation(() => provider.deleteMemoryStore(memoryStoreId), retryDelaysMs);
+  }
+}
+async function retryDefaultMemoryStoreOperation(operation, delaysMs) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await operation();
+      return;
+    } catch (error) {
+      if (!isRetryableDefaultMemoryStoreError(error) || attempt >= delaysMs.length) throw error;
+      await delay(delaysMs[attempt]);
+    }
+  }
+}
+function isRetryableDefaultMemoryStoreError(error) {
+  return error instanceof ApiError && (isStillMountedConflict(error) || isAlreadyArchivedConflict(error) || error.statusCode === 429 || [500, 502, 503].includes(error.statusCode));
+}
+function isStillMountedConflict(error) {
+  return error instanceof ApiError && error.statusCode === 409 && error.responseBody.includes("still mounted");
+}
+function isAlreadyArchivedConflict(error) {
+  return error instanceof ApiError && error.statusCode === 409 && error.responseBody.toLowerCase().includes("already archived");
+}
+function delay(ms) {
+  return new Promise((resolve13) => setTimeout(resolve13, ms));
+}
 async function destroyOneResource(ctx, resource, options) {
   if (isExternalReference(ctx, resource)) {
     ctx.state.removeResource(resource.address);
@@ -8069,8 +9814,18 @@ async function destroyOneResource(ctx, resource, options) {
     ctx.state.removeResource(resource.address);
     return successResult(resource, "destroyed");
   }
+  const apiMode = resource.api_mode === "auto" ? void 0 : resource.api_mode;
   try {
-    await deleteRemoteResource(provider, resource.address.type, resource.remote_id, options.cascade);
+    await deleteRemoteResource(
+      provider,
+      resource.address.type,
+      resource.remote_id,
+      options.cascade,
+      apiMode,
+      ctx.state.listResources().filter(
+        (candidate) => candidate.address.provider === resource.address.provider && candidate.address.type === "memory_store" && candidate.api_mode === "forward" && typeof candidate.remote_id === "string"
+      ).map((candidate) => candidate.remote_id)
+    );
     ctx.state.removeResource(resource.address);
     emitRuntimeFeedback(options.onFeedback, {
       type: "resource_action_success",
@@ -8099,7 +9854,7 @@ async function destroyOneResource(ctx, resource, options) {
       };
       if (await options.onCascadeRequired?.(blocked)) {
         try {
-          await provider.deleteEnvironment(resource.remote_id, true);
+          await provider.deleteEnvironment(resource.remote_id, true, apiMode);
           ctx.state.removeResource(resource.address);
           return {
             ...successResult(resource, "destroyed"),
@@ -8135,29 +9890,29 @@ function failureResult(resource, error) {
     error: error instanceof Error ? error.message : String(error)
   };
 }
-async function deleteRemoteResource(provider, type, id, cascade) {
+async function deleteRemoteResource(provider, type, id, cascade, mode, ownedMemoryStoreIds = []) {
   switch (type) {
     case "agent":
       await provider.deleteAgent(id);
       return;
     case "template":
       if (!provider.archiveTemplate) throw new UserError(`Provider does not support templates`);
-      await provider.archiveTemplate(id);
+      await provider.archiveTemplate(id, ownedMemoryStoreIds);
       return;
     case "skill":
-      await provider.deleteSkill(id);
+      await provider.deleteSkill(id, mode);
       return;
     case "memory_store":
       if (!provider.deleteMemoryStore) {
         throw new UserError(`Provider does not support memory stores`);
       }
-      await provider.deleteMemoryStore(id);
+      await provider.deleteMemoryStore(id, mode);
       return;
     case "vault":
-      await provider.deleteVault(id);
+      await provider.deleteVault(id, mode);
       return;
     case "environment":
-      await provider.deleteEnvironment(id, cascade);
+      await provider.deleteEnvironment(id, cascade, mode);
       return;
     case "deployment":
       await provider.deleteDeployment(id);
@@ -8171,7 +9926,7 @@ async function deleteRemoteResource(provider, type, id, cascade) {
       await provider.deleteChannel(id);
       return;
     case "file":
-      await provider.deleteFile(id);
+      await provider.deleteFile(id, mode);
       return;
   }
 }
@@ -8331,6 +10086,7 @@ function buildAgentDecl(base, input) {
   });
   const agent = {
     ...base ?? {},
+    name: input.name ?? base?.name,
     description: input.description ?? base?.description,
     model,
     instructions: input.instructions ?? base?.instructions ?? "",
@@ -8374,6 +10130,10 @@ function buildSessionBindings(agentName, config, provider, state, options = {})
     throw new UserError(`Agent '${agentName}' not found in config. Available agents: ${available || "(none)"}`);
   }
   const sessionResources = options.resources ?? agent.resources;
+  const environmentVariables = options.environmentVariables ?? agent.environment_variables;
+  if (environmentVariables && provider !== "qoder") {
+    throw new UserError("Session environment variables are supported only by Qoder.");
+  }
   const providerFeatures = getProvider(provider)?.features;
   for (const resource of sessionResources ?? []) {
     if (!providerFeatures?.session_resources.includes(resource.type)) {
@@ -8402,7 +10162,8 @@ function buildSessionBindings(agentName, config, provider, state, options = {})
       identity_id: identityId,
       files: (options.files ?? []).map((file) => ({ file_id: file.fileId, mount_path: file.mountPath })),
       title: options.title,
-      metadata: options.metadata
+      metadata: options.metadata,
+      environment_variables: environmentVariables
     };
   }
   const agentId = requireRef(state, { type: "agent", name: agentName, provider });
@@ -8447,7 +10208,8 @@ function buildSessionBindings(agentName, config, provider, state, options = {})
     files: (options.files ?? []).map((f) => ({ file_id: f.fileId, mount_path: f.mountPath })),
     resources: sessionResources,
     title: options.title,
-    metadata: options.metadata
+    metadata: options.metadata,
+    environment_variables: environmentVariables
   };
 }
 function resolveTunnelId(agent, config, options, provider) {
@@ -8561,28 +10323,36 @@ async function listAgentsWithReadiness(ctx, options = {}) {
 }
 async function planAgentResources(ctx, agentId, options = {}) {
   const agent = getAgent(ctx, agentId);
+  const rootAddress = collectAgentAddresses(ctx.config, agent.agentName, agent.provider)[0];
   const planned = await planProjectContext(ctx, {
     provider: agent.provider,
+    scope: { roots: [rootAddress] },
+    mode: options.mode,
     refresh: options.refresh,
     quiet: options.quiet ?? true
   });
-  const actions = filterAgentActions(ctx, agent, planned.plan);
+  const actions = planned.plan.actions;
+  const diagnostics = planned.plan.diagnostics;
   return {
     agentId,
     provider: agent.provider,
     actions,
-    diagnostics: filterAgentDiagnostics(ctx, agent, planned.plan),
+    diagnostics,
     destructiveActions: selectDestructive(actions),
     planned
   };
 }
+async function planAgentResourcesWithStateBackend(input, agentId, options = {}) {
+  return readProjectRuntime(input, (ctx) => planAgentResources(ctx, agentId, options));
+}
 async function syncAgentResources(ctx, agentId, options = {}) {
   return runAgentSync(ctx, agentId, options);
 }
 async function runAgentSync(ctx, agentId, options) {
   const fullPlan = await planAgentResources(ctx, agentId, {
     refresh: options.refresh,
-    quiet: options.quiet
+    quiet: options.quiet,
+    mode: options.mode
   });
   const actions = fullPlan.actions;
   const destructiveActions = fullPlan.destructiveActions;
@@ -8616,11 +10386,7 @@ async function runAgentSync(ctx, agentId, options) {
     };
   }
   try {
-    const scopedPlan = {
-      diagnostics: fullPlan.diagnostics,
-      actions: scopePlanActions(fullPlan.planned.plan, actions)
-    };
-    const execution = await executePlannedProject(replaceResourcePlan(fullPlan.planned, scopedPlan), {
+    const execution = await executePlannedProject(fullPlan.planned, {
       policy: "force"
     });
     const results = toAgentSyncResults(execution);
@@ -8724,29 +10490,6 @@ function getAgentReadinessFromPlan(ctx, agentId, plan) {
     plannedActions: relevantActions
   };
 }
-function filterAgentActions(ctx, agent, plan) {
-  const relevantKeys = agentAddressKeys(ctx, agent);
-  return plan.actions.filter(
-    (action) => relevantKeys.has(addressKey(action.address)) || action.dependencies.some((dependency) => relevantKeys.has(addressKey(dependency)))
-  );
-}
-function filterAgentDiagnostics(ctx, agent, plan) {
-  const relevantKeys = agentAddressKeys(ctx, agent);
-  return plan.diagnostics.filter(
-    (diagnostic) => !diagnostic.resource || relevantKeys.has(addressKey(diagnostic.resource))
-  );
-}
-function agentAddressKeys(ctx, agent) {
-  return new Set(collectAgentAddresses(ctx.config, agent.agentName, agent.provider).map(addressKey));
-}
-function scopePlanActions(fullPlan, agentActions) {
-  const allowedKeys = new Set(agentActions.filter((action) => action.action !== "no-op").map(actionKey));
-  return fullPlan.actions.filter((action) => action.action === "no-op" || allowedKeys.has(actionKey(action)));
-}
-function actionKey(action) {
-  const address = action.address;
-  return `${action.action}:${address.provider}:${address.type}:${address.name}`;
-}
 function isNonBlockingAgentDrift(action) {
   if (action.action === "no-op") return true;
   return action.readinessImpact === "non_blocking";
@@ -8758,33 +10501,13 @@ function collectAgentAddresses(config, agentName, provider) {
   }
   const resolvedProvider = provider ?? resolveSessionProvider(agentName, config, void 0);
   const materialization = resolveAgentMaterialization(resolvedProvider, agent);
-  const addresses = [
-    { type: materialization.resourceType, name: agentName, provider: resolvedProvider }
-  ];
-  if (agent.environment) {
-    addresses.push({
-      type: "environment",
-      name: agent.environment,
-      provider: resolvedProvider
-    });
-  }
-  if (agent.vault) {
-    addresses.push({ type: "vault", name: agent.vault, provider: resolvedProvider });
-  }
-  for (const name of agent.memory_stores ?? []) {
-    addresses.push({ type: "memory_store", name, provider: resolvedProvider });
-  }
-  for (const skill of agent.skills ?? []) {
-    if (typeof skill === "string") {
-      addresses.push({ type: "skill", name: skill, provider: resolvedProvider });
-    }
-  }
-  for (const subAgent of agent.multiagent?.agents ?? []) {
-    const subDecl = config.agents?.[subAgent];
-    const subType = subDecl ? resolveAgentMaterialization(resolvedProvider, subDecl).resourceType : "agent";
-    addresses.push({ type: subType, name: subAgent, provider: resolvedProvider });
-  }
-  return addresses;
+  const rootAddress = {
+    type: materialization.resourceType,
+    name: agentName,
+    provider: resolvedProvider
+  };
+  const graph = buildDependencyGraph(config, [resolvedProvider]);
+  return collectDependencyClosure(graph, [rootAddress]);
 }
 function toAgentDefinition(config, agentName, agent) {
   return {
@@ -8848,7 +10571,8 @@ async function createSessionForAgent(ctx, options = {}) {
     files: options.files,
     resources: options.resources,
     title: options.title,
-    metadata: options.metadata
+    metadata: options.metadata,
+    environmentVariables: options.environmentVariables
   });
   const session = await adapter2.createSession(bindings);
   return { agentName, provider, session };
@@ -8867,7 +10591,8 @@ async function startSessionRun(ctx, prompt, options = {}) {
     files: options.files,
     resources: options.resources,
     title: options.title,
-    metadata: options.metadata
+    metadata: options.metadata,
+    environmentVariables: options.environmentVariables
   });
   const session = await adapter2.createSession(bindings);
   return {
@@ -8928,7 +10653,7 @@ async function collectEventsUntilTerminal(adapter2, sessionId, options = {}) {
         terminalStatus = terminalEvent.status;
         break;
       }
-      await delay(currentIntervalMs);
+      await delay2(currentIntervalMs);
       currentIntervalMs = Math.min(currentIntervalMs * 2, maxPollIntervalMs);
     }
   } else {
@@ -8939,7 +10664,7 @@ async function collectEventsUntilTerminal(adapter2, sessionId, options = {}) {
         terminalStatus = session.status;
         break;
       }
-      await delay(currentIntervalMs);
+      await delay2(currentIntervalMs);
       currentIntervalMs = Math.min(currentIntervalMs * 2, maxPollIntervalMs);
     }
     result = await adapter2.listSessionEvents(sessionId, { limit: 100 });
@@ -9009,12 +10734,20 @@ async function listSessionEvents(ctx, sessionId, options = {}) {
   const listOptions = {};
   if (options.limit !== void 0) listOptions.limit = options.limit;
   if (options.order !== void 0) listOptions.order = options.order;
+  if (options.types !== void 0) listOptions.types = options.types;
+  if (options.created_at_gt !== void 0) listOptions.created_at_gt = options.created_at_gt;
+  if (options.created_at_gte !== void 0) listOptions.created_at_gte = options.created_at_gte;
+  if (options.created_at_lt !== void 0) listOptions.created_at_lt = options.created_at_lt;
+  if (options.created_at_lte !== void 0) listOptions.created_at_lte = options.created_at_lte;
   const pageToken = options.page_token ?? options.page;
   if (pageToken !== void 0) listOptions.page_token = pageToken;
-  return resolveDirectAdapter(ctx, options.provider).listSessionEvents(
+  const result = await resolveDirectAdapter(ctx, options.provider).listSessionEvents(
     sessionId,
     Object.keys(listOptions).length > 0 ? listOptions : void 0
   );
+  if (!options.types || options.types.length === 0) return result;
+  const allowedTypes = new Set(options.types);
+  return { ...result, events: result.events.filter((event) => allowedTypes.has(event.raw_type)) };
 }
 async function uploadFile(ctx, content, filename, options = {}) {
   const adapter2 = resolveDirectAdapter(ctx, options.provider);
@@ -9064,12 +10797,89 @@ async function deleteSkill(ctx, id, options = {}) {
   await resolveDirectAdapter(ctx, options.provider).deleteSkill(id);
 }
 function streamSessionEvents(ctx, sessionId, options = {}) {
+  const adapter2 = resolveDirectAdapter(ctx, options.provider);
+  if (options.after_id && !adapter2.eventResume) {
+    return replaySessionEventsByPolling(adapter2, sessionId, options.after_id);
+  }
   const streamOptions = {};
   if (options.after_id !== void 0) streamOptions.after_id = options.after_id;
-  return resolveDirectAdapter(ctx, options.provider).streamSessionEvents(
-    sessionId,
-    Object.keys(streamOptions).length > 0 ? streamOptions : void 0
-  );
+  return adapter2.streamSessionEvents(sessionId, Object.keys(streamOptions).length > 0 ? streamOptions : void 0);
+}
+async function* replaySessionEventsByPolling(adapter2, sessionId, afterId) {
+  const history = await listAllSessionEventHistory(adapter2, sessionId);
+  const markerIndex = history.findIndex((event) => event.id === afterId);
+  if (markerIndex < 0) {
+    throw new UserError(`Session event '${afterId}' was not found; list session events and choose a valid event id.`);
+  }
+  const knownEventKeys = new Set(history.slice(0, markerIndex + 1).map(sessionEventKey));
+  for (const event of history.slice(markerIndex + 1)) {
+    const eventKey = sessionEventKey(event);
+    if (knownEventKeys.has(eventKey)) continue;
+    knownEventKeys.add(eventKey);
+    yield event;
+    if (event.type === "status" && isTerminalSessionStatus(event.status)) return;
+  }
+  while (true) {
+    const newEvents = await listNewSessionEvents(adapter2, sessionId, knownEventKeys);
+    for (const event of newEvents) {
+      const eventKey = sessionEventKey(event);
+      if (knownEventKeys.has(eventKey)) continue;
+      knownEventKeys.add(eventKey);
+      yield event;
+      if (event.type === "status" && isTerminalSessionStatus(event.status)) return;
+    }
+    const session = await adapter2.getSession(sessionId);
+    if (isTerminalSessionStatus(session.status)) return;
+    await delay2(DEFAULT_POLL_INTERVAL_MS);
+  }
+}
+async function listAllSessionEventHistory(adapter2, sessionId) {
+  const events = [];
+  const seenPageTokens = /* @__PURE__ */ new Set();
+  let pageToken;
+  while (true) {
+    const result = await adapter2.listSessionEvents(sessionId, {
+      limit: 100,
+      order: "asc",
+      ...pageToken ? { page_token: pageToken } : {}
+    });
+    events.push(...result.events);
+    if (!result.next_page) return events;
+    if (seenPageTokens.has(result.next_page)) {
+      throw new UserError("Session event pagination returned a repeated cursor.");
+    }
+    seenPageTokens.add(result.next_page);
+    pageToken = result.next_page;
+  }
+}
+async function listNewSessionEvents(adapter2, sessionId, knownEventKeys) {
+  const descendingEvents = [];
+  const seenPageTokens = /* @__PURE__ */ new Set();
+  let pageToken;
+  while (true) {
+    const result = await adapter2.listSessionEvents(sessionId, {
+      limit: 100,
+      order: "desc",
+      ...pageToken ? { page_token: pageToken } : {}
+    });
+    let reachedKnownEvent = false;
+    for (const event of result.events) {
+      if (knownEventKeys.has(sessionEventKey(event))) {
+        reachedKnownEvent = true;
+        break;
+      }
+      descendingEvents.push(event);
+    }
+    if (reachedKnownEvent || !result.next_page) return descendingEvents.reverse();
+    if (seenPageTokens.has(result.next_page)) {
+      throw new UserError("Session event pagination returned a repeated cursor.");
+    }
+    seenPageTokens.add(result.next_page);
+    pageToken = result.next_page;
+  }
+}
+function sessionEventKey(event) {
+  return event.id ?? `raw:${event.raw_type}:${JSON.stringify(event.raw)}`;
 }
 function resolveDirectAdapter(ctx, overrideProvider) {
   if (overrideProvider) return getRuntimeProvider(ctx, overrideProvider);
@@ -9106,7 +10916,7 @@ async function* streamWithResume(adapter2, sessionId, message) {
       }
     }
     if (!reachedTerminal) {
-      await delay(reconnectIntervalMs);
+      await delay2(reconnectIntervalMs);
       reconnectIntervalMs = Math.min(reconnectIntervalMs * 2, DEFAULT_POLL_INTERVAL_MS);
     }
   }
@@ -9134,7 +10944,7 @@ function assertNotTimedOut(start, timeoutMs) {
     throw new UserError(`Session did not complete within the timeout (${Math.floor(timeoutMs / 1e3)} seconds).`);
   }
 }
-function delay(ms) {
+function delay2(ms) {
   return new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 
@@ -9320,6 +11130,7 @@ var StateManager = class _StateManager {
         address: r.address,
         remote_id: r.remote_id,
         externally_managed: r.externally_managed === true ? true : void 0,
+        api_mode: r.api_mode === "forward" ? "forward" : r.api_mode === "managed" ? "managed" : void 0,
         version: r.version,
         content_hash: r.content_hash ?? r.desired_hash ?? "",
         desired_hash: r.desired_hash ?? r.content_hash ?? "",
@@ -9327,10 +11138,15 @@ var StateManager = class _StateManager {
         desired_readiness_baseline: r.desired_readiness_baseline,
         remote_hash: r.remote_hash,
         remote_snapshot: r.remote_snapshot,
+        replacement_fingerprint: r.replacement_fingerprint,
         drift_paths: r.drift_paths,
         drift_status: r.drift_status
       }));
-      return new _StateManager({ resources }, path);
+      const pending = Array.isArray(data.pending_default_memory_store_cleanups) ? data.pending_default_memory_store_cleanups : void 0;
+      return new _StateManager(
+        { resources, ...pending ? { pending_default_memory_store_cleanups: pending } : {} },
+        path
+      );
     } catch (err) {
       if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
         return _StateManager.initialize(path);
@@ -9528,6 +11344,8 @@ var PlanReadinessImpactSchema = z6.enum(["none", "non_blocking", "blocking"]);
 var PlannedActionSchema = z6.object({
   action: ActionTypeSchema,
   address: ResourceAddressSchema,
+  /** Existing state address to retain when this action is an inferred logical rename. */
+  previousAddress: ResourceAddressSchema.optional(),
   reason: z6.string(),
   driftKind: DriftKindSchema.optional(),
   readinessImpact: PlanReadinessImpactSchema.optional(),
@@ -9593,7 +11411,8 @@ var CloudAgentSchema = z6.object({
   workspace_id: z6.string().optional(),
   created_at: z6.string().optional(),
   updated_at: z6.string().optional(),
-  archived_at: z6.string().nullish()
+  archived_at: z6.string().nullish(),
+  attributes: z6.record(z6.string(), z6.unknown()).optional()
 });
 var ListCloudAgentsResponseSchema = z6.object({
   agents: z6.array(CloudAgentSchema)
@@ -9610,7 +11429,8 @@ var CloudEnvironmentSchema = z6.object({
   workspace_id: z6.string().optional(),
   created_at: z6.string().optional(),
   updated_at: z6.string().optional(),
-  archived_at: z6.string().nullish()
+  archived_at: z6.string().nullish(),
+  attributes: z6.record(z6.string(), z6.unknown()).optional()
 });
 var ListCloudEnvironmentsResponseSchema = z6.object({
   environments: z6.array(CloudEnvironmentSchema)
@@ -9622,7 +11442,8 @@ var CloudVaultSchema = z6.object({
   type: z6.string().optional(),
   created_at: z6.string().nullish(),
   updated_at: z6.string().nullish(),
-  archived_at: z6.string().nullish()
+  archived_at: z6.string().nullish(),
+  attributes: z6.record(z6.string(), z6.unknown()).optional()
 });
 var ListCloudVaultsResponseSchema = z6.object({
   vaults: z6.array(CloudVaultSchema)
@@ -9802,6 +11623,7 @@ export {
   applyProviderConfigToEnv,
   archiveCloudAgent,
   archiveMemoryStore,
+  archiveRemoteSession,
   areRuntimeCredentialsReady,
   batchCreateMemories,
   bootstrapRuntimeCredentials,
@@ -9815,6 +11637,8 @@ export {
   createProjectRuntime,
   createSessionForAgent,
   createSkillFromFileId,
+  createVaultCredential,
+  createVaultCredentialWithStateBackend,
   decideDestructive,
   deleteCloudEnvironment,
   deleteCloudVault,
@@ -9824,6 +11648,8 @@ export {
   deleteSession,
   deleteSkill,
   destroyPlannedProjectResources,
+  downloadRemoteFile,
+  downloadRemoteSkill,
   executePlannedProject,
   extractSkillZipFiles,
   getAgent,
@@ -9831,13 +11657,23 @@ export {
   getDeploymentRuntimeProviderForContext,
   getFileDownloadUrl,
   getFileInfo,
+  getManagedAgentProviderCapabilities,
   getMemory,
   getMemoryProviderCapabilities,
   getMemoryStore,
   getMemoryVersion,
+  getRemoteAgent,
+  getRemoteDeployment,
+  getRemoteDeploymentRun,
+  getRemoteEnvironment,
+  getRemoteSkill,
+  getRemoteSkillDownloadInfo,
+  getRemoteSkillVersion,
+  getRemoteVault,
   getSession,
   getSkillInfo,
   importResource,
+  inspectSkillSource,
   isTerminalSessionStatus,
   listAgentsWithReadiness,
   listCloudAgents,
@@ -9850,7 +11686,16 @@ export {
   listMemoryVersions,
   listProviderModelsForContext,
   listProviderNames,
+  listRemoteAgentVersions,
+  listRemoteAgents,
+  listRemoteDeploymentRuns,
+  listRemoteDeployments,
   listRemoteDeploymentsForContext,
+  listRemoteEnvironments,
+  listRemoteFiles,
+  listRemoteSkillVersions,
+  listRemoteSkills,
+  listRemoteVaults,
   listSessionEvents,
   listSessionSummaries,
   listSkills,
@@ -9860,8 +11705,13 @@ export {
   migrateConfig,
   parseStateAddress,
   pauseDeploymentForContext,
+  planAgentResources,
+  planAgentResourcesWithStateBackend,
   planDestroyProjectContext,
   planProjectContext,
+  planProjectWithStateBackend,
+  planVaultCredentialCreate,
+  planVaultCredentialCreateWithStateBackend,
   prepareInitialSessionPrompt,
   preparePromptForProvider,
   prependFileHint,
@@ -9877,9 +11727,12 @@ export {
   resolveSyncProvider,
   rewriteFileMentions,
   runDeploymentForContext,
+  runRemoteDeployment,
+  sendRemoteSessionEvents,
   sendSessionMessagePolling,
   sendSessionMessageStreaming,
   setDefaultFetch,
+  setRemoteDeploymentPaused,
   startSessionRun,
   startSessionRunPolling,
   streamSessionEvents,
@@ -9889,6 +11742,7 @@ export {
   syncProviderResourcesFromEnv,
   updateMemory,
   updateMemoryStore,
+  updateRemoteSession,
   uploadFile,
   validateProjectConfig,
   writeProjectRuntime