@openagentpack/sdk 0.3.1 → 0.4.0

package/dist/index.js

@@ -58,10 +58,10 @@ var BaseApiClient = class {
     if (this.isConflict(res.status, body)) throw new ConflictError(res.status, body, this.errorPrefix);
     throw new ApiError(res.status, body, this.errorPrefix);
   }
-  async post(path, body) {
+  async post(path, body, options) {
     const res = await resolveFetch()(`${this.baseUrl}${path}`, {
       method: "POST",
-      headers: this.headers(),
+      headers: { ...this.headers(), ...options?.headers },
       body: JSON.stringify(body)
     });
     await this.throwIfError(res);
@@ -395,6 +395,24 @@ function skillNameFromFiles(files) {
   return match?.[1]?.replace(/^["']|["']$/g, "") || void 0;
 }
 
+// src/internal/providers/deployment-conflict.ts
+var DeploymentCreateConflictError = class extends ConflictError {
+  constructor(conflict, preparedFiles) {
+    super(conflict.statusCode, conflict.responseBody, "Deployment create");
+    this.preparedFiles = preparedFiles;
+    this.name = conflict.name;
+    this.message = conflict.message;
+    this.stack = conflict.stack;
+  }
+  preparedFiles;
+};
+function preserveDeploymentFilesOnConflict(error, preparedFiles) {
+  if (error instanceof ConflictError && preparedFiles.size > 0) {
+    throw new DeploymentCreateConflictError(error, preparedFiles);
+  }
+  throw error;
+}
+
 // src/internal/providers/memory-api.ts
 function query(path, values) {
   const params = new URLSearchParams();
@@ -1736,11 +1754,15 @@ var ClaudeAdapter = class _ClaudeAdapter {
   async createDeployment(name, decl, refs, basePath) {
     const uploaded = await this.uploadDeploymentFiles(decl, basePath);
     const body = mapDeployment(name, decl, refs, this.projectName, uploaded);
-    const res = await this.client.post("/deployments", body);
-    return toRemoteResource(res);
+    try {
+      const res = await this.client.post("/deployments", body);
+      return toRemoteResource(res);
+    } catch (error) {
+      preserveDeploymentFilesOnConflict(error, uploaded);
+    }
   }
-  async updateDeployment(id, name, decl, refs, basePath) {
-    const uploaded = await this.uploadDeploymentFiles(decl, basePath);
+  async updateDeployment(id, name, decl, refs, basePath, preparedFiles) {
+    const uploaded = preparedFiles ? new Map(preparedFiles) : await this.uploadDeploymentFiles(decl, basePath);
     const current = await this.client.get(`/deployments/${id}`);
     if (current.schedule && !decl.schedule) {
       throw new UserError(
@@ -2013,12 +2035,23 @@ function normalizeToolNameForQoder(name) {
 function normalizeToolNameFromQoder(name) {
   return name.replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase();
 }
+function normalizeEnvironmentPackages(value) {
+  if (!value || typeof value !== "object") return void 0;
+  const raw = value;
+  const packages = {};
+  for (const key of ["apt", "npm", "pip"]) {
+    if (Array.isArray(raw[key]) && raw[key].length > 0) packages[key] = raw[key];
+  }
+  return Object.keys(packages).length > 0 ? packages : void 0;
+}
 function mapEnvironment2(name, decl, projectName) {
   const envType = decl.config.type ?? "cloud";
   const config = { type: envType };
   if (decl.config.networking) config.networking = decl.config.networking;
   else if (envType === "cloud") config.networking = { type: "unrestricted" };
-  if (decl.config.packages) config.packages = decl.config.packages;
+  const packages = normalizeEnvironmentPackages(decl.config.packages);
+  if (packages) config.packages = packages;
+  if (decl.config.setup_script !== void 0) config.setup_script = decl.config.setup_script;
   return {
     name,
     description: decl.description ?? "",
@@ -2026,6 +2059,13 @@ function mapEnvironment2(name, decl, projectName) {
     metadata: injectMetadata(decl.metadata, projectName, name)
   };
 }
+function mapForwardEnvironment(name, decl, projectName) {
+  const body = mapEnvironment2(name, decl, projectName);
+  const config = { ...body.config };
+  delete config.networking;
+  body.config = config;
+  return body;
+}
 function mapVault(name, decl, projectName) {
   const body = { display_name: decl.display_name };
   if (projectName) body.metadata = injectMetadata(decl.metadata, projectName, name);
@@ -2099,7 +2139,8 @@ function envToDecl2(raw) {
     config: {
       type: config.type ?? "cloud",
       networking: config.networking,
-      packages: config.packages
+      packages: normalizeEnvironmentPackages(config.packages),
+      setup_script: config.setup_script
     },
     metadata: stripAgentsMetadata(raw.metadata)
   });
@@ -2339,9 +2380,12 @@ function mapForwardTemplate(name, decl, refs, projectName) {
     environment_id: refs.environment_id,
     vault_ids: refs.vault_ids
   };
+  body.files = Object.fromEntries((refs.file_ids ?? []).map((id) => [id, { enabled: true }]));
   if (refs.tunnel_id) body.tunnel_id = refs.tunnel_id;
   if (projectName) body.metadata = injectMetadata(decl.metadata, projectName, name);
   else body.metadata = decl.metadata ?? {};
+  if (decl.environment_variables) body.environment_variables = decl.environment_variables;
+  if (decl.managed_tool_config) body.managed_tool_config = decl.managed_tool_config;
   if (decl.tools) {
     body.tools = [
       {
@@ -2482,6 +2526,9 @@ function mapSession2(bindings) {
   if (bindings.tunnel_id) body.tunnel_id = bindings.tunnel_id;
   if (bindings.title) body.title = bindings.title;
   if (bindings.metadata) body.metadata = bindings.metadata;
+  if (bindings.environment_variables) {
+    body.environment_variables = Object.entries(bindings.environment_variables).map(([key, value]) => `${key}=${value}`).join(";");
+  }
   if (bindings.vault_ids.length) body.vault_ids = bindings.vault_ids;
   const resources = [];
   for (const id of bindings.memory_store_ids) resources.push({ type: "memory_store", memory_store_id: id });
@@ -2527,6 +2574,7 @@ var QoderAdapter = class _QoderAdapter {
   client;
   memoryApi;
   forwardClient;
+  forwardMemoryApi;
   projectName;
   forwardSessionIds = /* @__PURE__ */ new Set();
   constructor(apiKey, gateway, projectName, forwardGateway) {
@@ -2548,6 +2596,19 @@ var QoderAdapter = class _QoderAdapter {
       apiKey,
       gateway: forwardGateway ?? deriveForwardGateway(gateway)
     });
+    this.forwardMemoryApi = new ProviderMemoryApi(this.forwardClient, {
+      pathStyle: "relative",
+      cursorParam: "after_id",
+      updatePrecondition: "content_sha256",
+      prefixParam: "prefix",
+      versionsSegment: "versions",
+      storeMetadataMode: "merge_patch",
+      supportsView: false,
+      supportsMemoryMetadata: true,
+      supportsPathUpdate: false,
+      supportsDeletePrecondition: false,
+      supportsIncludeArchived: true
+    });
     this.projectName = projectName ?? "";
   }
   async validate() {
@@ -2562,7 +2623,7 @@ var QoderAdapter = class _QoderAdapter {
     file: "/files",
     deployment: "/deployments"
   };
-  async findResource(type, name, id) {
+  async findResource(type, name, id, mode) {
     if (type === "template") {
       const raw2 = await locateRemote(this.forwardClient, "/templates", name, id, (item) => item.status !== "archived");
       return raw2 ? toRemoteResource(raw2) : null;
@@ -2582,7 +2643,14 @@ var QoderAdapter = class _QoderAdapter {
       const raw2 = await locateRemote(this.forwardClient, "/channels", name, id, () => true);
       return raw2 ? toRemoteResource(raw2) : null;
     }
-    const raw = await locateRemote(this.client, _QoderAdapter.ENDPOINT_MAP[type], name, id, notArchived);
+    if (type === "environment" && id && mode === "auto") {
+      const managed = await locateRemote(this.client, "/environments", name, id, notArchived);
+      if (managed) return toRemoteResource(managed);
+      const forward = await locateRemote(this.forwardClient, "/environments", name, id, notArchived);
+      return forward ? toRemoteResource(forward) : null;
+    }
+    const client = mode === "forward" && (type === "environment" || type === "skill" || type === "vault" || type === "memory_store" || type === "file") ? this.forwardClient : this.client;
+    const raw = await locateRemote(client, _QoderAdapter.ENDPOINT_MAP[type], name, id, notArchived);
     return raw ? toRemoteResource(raw) : null;
   }
   async listAgents(filter) {
@@ -2691,14 +2759,10 @@ var QoderAdapter = class _QoderAdapter {
   }
   normalizeRemote(type, raw) {
     if (type === "environment") {
-      const config = raw.config ?? {};
+      const normalized = envToDecl2(raw);
       return compactDeep({
         description: raw.description,
-        config: {
-          type: config.type ?? "cloud",
-          networking: config.networking,
-          packages: config.packages
-        },
+        config: normalized.config,
         metadata: stripAgentsMetadata(raw.metadata)
       });
     }
@@ -2730,16 +2794,21 @@ var QoderAdapter = class _QoderAdapter {
     }
     if (type === "channel") {
       const channelConfig = raw.channel_config ?? {};
-      return compactDeep({
-        identity_id: raw.identity_id,
-        template_id: raw.template_id,
+      const mode = raw.identity_resolution?.mode ?? "fixed";
+      const normalized = {
+        identity_resolution: { mode },
         channel_type: raw.channel_type,
         name: raw.name,
         enabled: raw.enabled,
         channel_config: {
           response_options: channelConfig.response_options ?? {}
         }
-      });
+      };
+      if (mode === "fixed") {
+        normalized.identity_id = raw.identity_id;
+        normalized.template_id = raw.template_id;
+      }
+      return compactDeep(normalized);
     }
     return compactDeep({
       description: raw.description,
@@ -2750,17 +2819,29 @@ var QoderAdapter = class _QoderAdapter {
       metadata: stripAgentsMetadata(raw.metadata)
     });
   }
-  async createEnvironment(name, decl) {
-    const body = mapEnvironment2(name, decl, this.projectName);
-    const res = await this.client.post("/environments", body);
+  async createEnvironment(name, decl, mode = "managed") {
+    const body = mode === "forward" ? mapForwardEnvironment(name, decl, this.projectName) : mapEnvironment2(name, decl, this.projectName);
+    const res = await (mode === "forward" ? this.forwardClient : this.client).post("/environments", body);
     return toRemoteResource(res);
   }
-  async updateEnvironment(id, name, decl) {
-    const body = mapEnvironment2(name, decl, this.projectName);
-    const res = await this.client.put(`/environments/${id}`, body);
+  async updateEnvironment(id, name, decl, mode = "managed") {
+    const body = mode === "forward" ? mapForwardEnvironment(name, decl, this.projectName) : mapEnvironment2(name, decl, this.projectName);
+    const client = mode === "forward" ? this.forwardClient : this.client;
+    const current = await client.get(`/environments/${id}`);
+    const currentMetadata = current.metadata ?? {};
+    const metadata = { ...body.metadata ?? {} };
+    for (const key of Object.keys(currentMetadata)) {
+      if (!key.startsWith("agents.") && !(key in metadata)) metadata[key] = null;
+    }
+    body.metadata = metadata;
+    const res = await client.post(`/environments/${id}`, body);
     return toRemoteResource(res);
   }
-  async deleteEnvironment(id, cascade = false) {
+  async deleteEnvironment(id, cascade = false, mode = "managed") {
+    if (mode === "forward") {
+      await this.forwardClient.delete(`/environments/${id}`);
+      return;
+    }
     try {
       await this.client.delete(`/environments/${id}`);
       return;
@@ -2787,17 +2868,18 @@ var QoderAdapter = class _QoderAdapter {
       await this.client.post(`/environments/${id}/archive`, {});
     }
   }
-  async createVault(name, decl) {
+  async createVault(name, decl, mode = "managed") {
+    const client = mode === "forward" ? this.forwardClient : this.client;
     const body = mapVault(name, decl, this.projectName);
-    const res = await this.client.post("/vaults", body);
+    const res = await client.post("/vaults", body);
     const vaultId = res.id;
     for (const cred of decl.credentials ?? []) {
-      await this.client.post(`/vaults/${vaultId}/credentials`, mapCredential(cred));
+      await client.post(`/vaults/${vaultId}/credentials`, mapCredential(cred));
     }
     return toRemoteResource(res);
   }
-  async deleteVault(id) {
-    await this.client.delete(`/vaults/${id}`);
+  async deleteVault(id, mode = "managed") {
+    await (mode === "forward" ? this.forwardClient : this.client).delete(`/vaults/${id}`);
   }
   async exportResources(type) {
     return exportRemoteResources(this.client, type, {
@@ -2808,17 +2890,24 @@ var QoderAdapter = class _QoderAdapter {
       agentToDecl: agentToDecl2
     });
   }
-  async createSkill(name, decl, files) {
+  async createSkill(name, decl, files, mode = "managed") {
     const formData = await buildSkillFormData(name, decl, files);
-    const res = await this.client.postFormData("/skills", formData);
+    const res = await (mode === "forward" ? this.forwardClient : this.client).postFormData(
+      "/skills",
+      formData
+    );
     return toRemoteResource(res);
   }
-  async updateSkill(id, name, decl, files) {
-    await this.client.delete(`/skills/${id}`);
-    return this.createSkill(name, decl, files);
+  async updateSkill(id, name, decl, files, mode = "managed") {
+    const client = mode === "forward" ? this.forwardClient : this.client;
+    const packageName = skillNameFromFiles(files) ?? name;
+    const formData = await buildSkillFormData(packageName, decl, files, "files", false, true);
+    await client.postFormData(`/skills/${id}/versions`, formData);
+    const current = await client.get(`/skills/${id}`);
+    return toRemoteResource(current);
   }
-  async deleteSkill(id) {
-    await this.client.delete(`/skills/${id}`);
+  async deleteSkill(id, mode = "managed") {
+    await (mode === "forward" ? this.forwardClient : this.client).delete(`/skills/${id}`);
   }
   async createAgent(name, decl, refs) {
     const body = mapAgent2(name, decl, refs, void 0, this.projectName);
@@ -2835,21 +2924,89 @@ var QoderAdapter = class _QoderAdapter {
     await this.client.delete(`/agents/${id}`);
   }
   async createTemplate(name, decl, refs) {
-    await this.registerForwardVaults(refs.vault_ids);
     const body = mapForwardTemplate(name, decl, refs, this.projectName);
     const res = await this.forwardClient.post("/templates", body);
+    await this.reconcileForwardMemoryMounts(res.id, refs);
     return toRemoteResource(res);
   }
   async updateTemplate(id, name, decl, refs) {
-    await this.registerForwardVaults(refs.vault_ids);
     const body = mapForwardTemplate(name, decl, refs, this.projectName);
     if (!refs.tunnel_id) body.tunnel_id = null;
     const res = await this.forwardClient.post(`/templates/${id}`, body);
+    await this.reconcileForwardMemoryMounts(id, refs);
     return toRemoteResource(res);
   }
-  async archiveTemplate(id) {
+  async archiveTemplate(id, ownedMemoryStoreIds = []) {
+    const owned = new Set(ownedMemoryStoreIds);
+    if (owned.size > 0) {
+      for (const identity of await this.forwardClient.getAllPaged("/identities")) {
+        if (typeof identity.id !== "string") continue;
+        const path = `/identities/${identity.id}/templates/${id}/memory_stores`;
+        try {
+          const mounts = await this.forwardClient.get(path);
+          for (const mount of mounts.data ?? []) {
+            const storeId = mount.memory_store_id;
+            if (mount.system_managed !== true && typeof storeId === "string" && owned.has(storeId)) {
+              await this.forwardClient.delete(`${path}/${storeId}`);
+            }
+          }
+        } catch (error) {
+          if (!ApiError.isNotFound(error)) throw error;
+        }
+      }
+    }
     await this.forwardClient.post(`/templates/${id}/archive`, {});
   }
+  async reconcileForwardMemoryMounts(templateId, refs) {
+    if (refs.memory_store_ids === void 0) return;
+    const desired = new Set(refs.memory_store_ids ?? []);
+    if (!refs.identity_id) {
+      if (desired.size > 0) throw new UserError("Qoder Forward Memory Store mounts require an Identity.");
+      return;
+    }
+    const path = `/identities/${refs.identity_id}/templates/${templateId}/memory_stores`;
+    const current = await this.forwardClient.get(path);
+    const explicit = (current.data ?? []).filter((mount) => mount.system_managed !== true);
+    const owned = new Set(refs.owned_memory_store_ids ?? refs.memory_store_ids ?? []);
+    for (const mount of explicit) {
+      const storeId = mount.memory_store_id;
+      if (typeof storeId === "string" && owned.has(storeId) && !desired.has(storeId)) {
+        await this.forwardClient.delete(`${path}/${storeId}`);
+      }
+    }
+    const mounted = new Set(
+      explicit.map((mount) => mount.memory_store_id).filter((id) => typeof id === "string")
+    );
+    for (const memoryStoreId of desired) {
+      if (!mounted.has(memoryStoreId)) await this.forwardClient.post(path, { memory_store_id: memoryStoreId });
+    }
+  }
+  async reconcileDefaultMemoryStore(identityId, templateId, desired) {
+    const storeId = await this.findDefaultMemoryStoreId(identityId, templateId);
+    if (!storeId) return { status: "pending" };
+    const current = await this.forwardClient.get(`/memory_stores/${storeId}`);
+    const descriptionChanged = desired.description !== void 0 && current.description !== desired.description;
+    if (current.name === desired.name && !descriptionChanged) {
+      return { status: "unchanged", memory_store_id: storeId };
+    }
+    await this.forwardClient.post(`/memory_stores/${storeId}`, {
+      name: desired.name,
+      ...desired.description !== void 0 ? { description: desired.description } : {}
+    });
+    return { status: "updated", memory_store_id: storeId };
+  }
+  async findDefaultMemoryStoreId(identityId, templateId) {
+    const mounts = await this.forwardClient.get(
+      `/identities/${identityId}/templates/${templateId}/memory_stores`
+    );
+    const writableDefault = (mounts.data ?? []).find(
+      (mount) => mount.system_managed === true && mount.access === "read_write"
+    );
+    return typeof writableDefault?.memory_store_id === "string" ? writableDefault.memory_store_id : null;
+  }
+  async deleteDefaultMemoryStore(id) {
+    await this.client.delete(`/memory_stores/${id}`);
+  }
   async createIdentity(name, decl) {
     if (decl.identity_id) return { id: decl.identity_id, type: "identity" };
     const res = await this.forwardClient.post("/identities", {
@@ -2886,12 +3043,14 @@ var QoderAdapter = class _QoderAdapter {
   }
   async updateChannel(id, name, decl, refs) {
     const current = await this.forwardClient.get(`/channels/${id}`);
-    if (current.channel_type !== decl.type) {
+    const currentMode = current.identity_resolution?.mode ?? "fixed";
+    if (current.channel_type !== decl.type || currentMode !== (decl.mode ?? "fixed")) {
       await this.deleteChannel(id);
       return this.createChannel(name, decl, refs);
     }
     const body = this.mapChannel(name, decl, refs);
     delete body.channel_type;
+    delete body.identity_resolution;
     const res = await this.forwardClient.post(`/channels/${id}`, body);
     return toRemoteResource(res);
   }
@@ -2899,9 +3058,8 @@ var QoderAdapter = class _QoderAdapter {
     await this.forwardClient.delete(`/channels/${id}`);
   }
   mapChannel(name, decl, refs) {
-    return {
-      identity_id: refs.identity_id,
-      template_id: refs.agent_id,
+    const mode = decl.mode ?? "fixed";
+    const body = {
       channel_type: decl.type,
       name: decl.name ?? name,
       enabled: decl.enabled ?? true,
@@ -2914,22 +3072,27 @@ var QoderAdapter = class _QoderAdapter {
         }
       }
     };
-  }
-  async registerForwardVaults(vaultIds) {
-    for (const id of vaultIds) {
-      await this.forwardClient.post("/resources/registry", {
-        type: "vault",
-        resource: { id }
-      });
+    if (mode === "pairing") {
+      body.identity_resolution = { mode: "pairing" };
+    } else {
+      body.identity_id = refs.identity_id;
+      body.template_id = refs.agent_id;
     }
+    return body;
   }
-  async createMemoryStore(name, decl) {
+  async createMemoryStore(name, decl, mode = "managed") {
     const body = mapMemoryStore2(name, decl);
-    const res = await this.client.post("/memory_stores", body);
+    const client = mode === "forward" ? this.forwardClient : this.client;
+    const memoryApi = mode === "forward" ? this.forwardMemoryApi : this.memoryApi;
+    const res = await client.post(
+      "/memory_stores",
+      body,
+      mode === "forward" ? { headers: { "Idempotency-Key": crypto.randomUUID() } } : void 0
+    );
     const storeId = res.id;
     try {
       for (const entry of decl.entries ?? []) {
-        await this.memoryApi.createMemory(storeId, { content: entry.content, path: entry.key });
+        await memoryApi.createMemory(storeId, { content: entry.content, path: entry.key });
       }
     } catch (error) {
       await this.client.delete(`/memory_stores/${storeId}`).catch(() => void 0);
@@ -2937,7 +3100,7 @@ var QoderAdapter = class _QoderAdapter {
     }
     return toRemoteResource(res);
   }
-  async deleteMemoryStore(id) {
+  async deleteMemoryStore(id, _mode = "managed") {
     await this.client.delete(`/memory_stores/${id}`);
   }
   listMemoryStores(options) {
@@ -2946,23 +3109,23 @@ var QoderAdapter = class _QoderAdapter {
   getMemoryStore(id) {
     return this.memoryApi.getStore(id);
   }
-  updateMemoryStore(id, input) {
-    return this.memoryApi.updateStore(id, input);
+  updateMemoryStore(id, input, mode = "managed") {
+    return (mode === "forward" ? this.forwardMemoryApi : this.memoryApi).updateStore(id, input);
   }
   archiveMemoryStore(id) {
     return this.memoryApi.archiveStore(id);
   }
-  createMemory(storeId, input) {
-    return this.memoryApi.createMemory(storeId, input);
+  createMemory(storeId, input, mode = "managed") {
+    return (mode === "forward" ? this.forwardMemoryApi : this.memoryApi).createMemory(storeId, input);
   }
-  listMemories(storeId, options) {
-    return this.memoryApi.listMemories(storeId, options);
+  listMemories(storeId, options, mode = "managed") {
+    return (mode === "forward" ? this.forwardMemoryApi : this.memoryApi).listMemories(storeId, options);
   }
   getMemory(storeId, memoryId) {
     return this.memoryApi.getMemory(storeId, memoryId);
   }
-  updateMemory(storeId, memoryId, input) {
-    return this.memoryApi.updateMemory(storeId, memoryId, input);
+  updateMemory(storeId, memoryId, input, mode = "managed") {
+    return (mode === "forward" ? this.forwardMemoryApi : this.memoryApi).updateMemory(storeId, memoryId, input);
   }
   deleteMemory(storeId, memoryId, expected) {
     return this.memoryApi.deleteMemory(storeId, memoryId, expected);
@@ -2979,11 +3142,15 @@ var QoderAdapter = class _QoderAdapter {
   async createDeployment(name, decl, refs, basePath) {
     const uploaded = await this.uploadDeploymentFiles(decl, basePath);
     const body = mapDeployment2(name, decl, refs, this.projectName, uploaded);
-    const res = await this.client.post("/deployments", body);
-    return toRemoteResource(res);
+    try {
+      const res = await this.client.post("/deployments", body);
+      return toRemoteResource(res);
+    } catch (error) {
+      preserveDeploymentFilesOnConflict(error, uploaded);
+    }
   }
-  async updateDeployment(id, name, decl, refs, basePath) {
-    const uploaded = await this.uploadDeploymentFiles(decl, basePath);
+  async updateDeployment(id, name, decl, refs, basePath, preparedFiles) {
+    const uploaded = preparedFiles ? new Map(preparedFiles) : await this.uploadDeploymentFiles(decl, basePath);
     const current = await this.client.get(`/deployments/${id}`);
     if (current.schedule && !decl.schedule) {
       throw new UserError(
@@ -3091,6 +3258,9 @@ var QoderAdapter = class _QoderAdapter {
       };
       if (bindings.title) body2.title = bindings.title;
       if (bindings.metadata) body2.metadata = bindings.metadata;
+      if (bindings.environment_variables) {
+        body2.config = { environment_variables: bindings.environment_variables };
+      }
       if (bindings.files?.length) {
         body2.resources = bindings.files.map((file) => ({
           type: "file",
@@ -3244,30 +3414,42 @@ var QoderAdapter = class _QoderAdapter {
     return res.data;
   }
   // --- Files ---
-  async uploadFile(filePath, options) {
+  async uploadFile(filePath, options, mode = "managed") {
+    if (mode === "forward" && options?.purpose && !["user_upload", "session_resource"].includes(options.purpose)) {
+      throw new UserError(
+        `Qoder Forward File purpose must be 'user_upload' or 'session_resource', got '${options.purpose}'.`
+      );
+    }
     const resolved = resolve2(filePath);
     const content = readFileSync2(resolved);
     const fileName = options?.name ?? basename2(resolved);
-    return this.uploadFileContent(new Uint8Array(content), fileName, {
-      purpose: options?.purpose
-    });
+    const formData = buildFileFormData(new Uint8Array(content), fileName, { purpose: options?.purpose });
+    const res = await (mode === "forward" ? this.forwardClient : this.client).postFormData(
+      "/files",
+      formData
+    );
+    return toRestFileInfo(res);
   }
   async uploadFileContent(content, filename, options) {
-    const formData = new FormData();
-    const bytes = new Uint8Array(content);
-    formData.append(
-      "file",
-      options?.mimeType ? new File([bytes], filename, { type: options.mimeType }) : new File([bytes], filename)
-    );
-    if (filename) formData.append("name", filename);
-    if (options?.purpose) formData.append("purpose", options.purpose);
+    const formData = buildFileFormData(content, filename, options);
     const res = await this.client.postFormData("/files", formData);
     return toRestFileInfo(res);
   }
-  async deleteFile(id) {
-    await this.client.delete(`/files/${id}`);
+  async deleteFile(id, mode = "managed") {
+    await (mode === "forward" ? this.forwardClient : this.client).delete(`/files/${id}`);
   }
 };
+function buildFileFormData(content, filename, options) {
+  const formData = new FormData();
+  const bytes = new Uint8Array(content);
+  formData.append(
+    "file",
+    options?.mimeType ? new File([bytes], filename, { type: options.mimeType }) : new File([bytes], filename)
+  );
+  if (filename) formData.append("name", filename);
+  if (options?.purpose) formData.append("purpose", options.purpose);
+  return formData;
+}
 function toSessionInfo2(res) {
   return buildSessionInfo(res, (r) => r.memory_store_ids ?? []);
 }
@@ -3317,22 +3499,24 @@ function normalizeQoderMcpServers(value) {
     });
   });
 }
-async function buildSkillFormData(name, decl, files) {
+async function buildSkillFormData(name, decl, files, fileField = "file", includeCreateFields = true, prefixTopLevelDirectory = false) {
   const zip = new JSZip2();
   for (const f of files) {
-    zip.file(f.relativePath, f.content);
+    zip.file(prefixTopLevelDirectory ? `${name}/${f.relativePath}` : f.relativePath, f.content);
   }
   const zipContent = await zip.generateAsync({ type: "uint8array" });
   const formData = new FormData();
   formData.append(
-    "file",
+    fileField,
     new File([new Uint8Array(zipContent)], `${name}.zip`, {
       type: "application/zip"
     })
   );
-  formData.append("name", name);
-  formData.append("type", "custom");
-  if (decl.description) formData.append("description", decl.description);
+  if (includeCreateFields) {
+    formData.append("name", name);
+    formData.append("type", "custom");
+    if (decl.description) formData.append("description", decl.description);
+  }
   return formData;
 }
 
@@ -3581,7 +3765,9 @@ function mapAgent3(name, decl, refs, version, projectName, skillVersions) {
   }
   const BAILIAN_BUILTINS = /* @__PURE__ */ new Set(["bash", "read", "write", "edit", "glob", "grep", "download_file"]);
   if (decl.tools) {
-    const toolConfigs = resolveBuiltinTools(decl.tools, { supportedWireNames: BAILIAN_BUILTINS }).map((tool) => ({
+    const toolConfigs = resolveBuiltinTools(decl.tools, {
+      supportedWireNames: BAILIAN_BUILTINS
+    }).map((tool) => ({
       name: tool.wireName,
       enabled: true
     }));
@@ -3655,30 +3841,60 @@ function mapSession3(bindings) {
   if (bindings.memory_store_ids.length) body.memory_store_ids = bindings.memory_store_ids;
   return body;
 }
-function mapDeploymentToSession(decl, refs, fileIds) {
+function mapDeployment3(name, decl, refs, projectName, uploadedFiles) {
+  const agent = { id: refs.agent_id };
+  if (refs.agent_version !== void 0) agent.version = refs.agent_version;
   const body = {
-    agent: refs.agent_id,
-    environment_id: refs.environment_id
+    name,
+    agent,
+    environment_id: refs.environment_id,
+    initial_events: mapMessageEvents(decl.initial_events)
   };
-  if (decl.description) body.title = decl.description;
-  if (fileIds.length) {
-    const fileResources = (decl.resources ?? []).filter((r) => r.type === "file");
-    body.resources = fileIds.map((id, index) => {
-      const entry = { type: "file", file_id: id };
-      const mountPath = fileResources[index]?.mount_path;
-      if (mountPath) entry.mount_path = mountPath;
-      return entry;
-    });
+  if (decl.description) body.description = decl.description;
+  if (refs.vault_ids.length) body.vault_ids = refs.vault_ids;
+  const resources = mapDeploymentResources3(decl, uploadedFiles);
+  if (resources.length) body.resources = resources;
+  if (decl.schedule) {
+    body.schedule = {
+      type: "cron",
+      expression: decl.schedule.expression,
+      timezone: decl.schedule.timezone
+    };
+  }
+  if (projectName) {
+    body.metadata = injectMetadata(decl.metadata, projectName, name);
+  } else if (decl.metadata) {
+    body.metadata = decl.metadata;
   }
   return body;
 }
-function mapInitialEvents2(events) {
-  const input = events.filter((e) => e.type === "user.message" || e.type === "system.message").map((e) => ({
+function mapDeploymentUpdate3(name, decl, refs, projectName, uploadedFiles, existingMetadata) {
+  const body = mapDeployment3(name, decl, refs, projectName, uploadedFiles);
+  body.description = decl.description ?? "";
+  body.vault_ids = refs.vault_ids;
+  body.resources = mapDeploymentResources3(decl, uploadedFiles);
+  if (!decl.schedule) body.schedule = null;
+  if (!projectName && !decl.metadata && existingMetadata) body.metadata = existingMetadata;
+  return body;
+}
+function mapDeploymentResources3(decl, uploadedFiles) {
+  const resources = [];
+  for (const resource of decl.resources ?? []) {
+    if (resource.type !== "file") continue;
+    const fileId = resource.file_id ?? (resource.source ? uploadedFiles?.get(resource.source) : void 0);
+    if (!fileId) continue;
+    const entry = { type: "file", file_id: fileId };
+    if (resource.mount_path) entry.mount_path = resolveSandboxMountPath("bailian", resource.mount_path);
+    resources.push(entry);
+  }
+  return resources;
+}
+function mapMessageEvents(events) {
+  return events.filter((event) => event.type === "user.message" || event.type === "system.message").map((event) => ({
     role: "user",
     type: "message",
-    content: [{ type: "text", text: e.content }]
+    content: [{ type: "text", text: event.content }]
   }));
-  return { input };
 }
 function mapSendMessage3(text) {
   return {
@@ -3710,7 +3926,8 @@ var BailianAdapter = class _BailianAdapter {
     agent: "/agents",
     skill: "/skills",
     vault: "/vaults",
-    file: "/files"
+    file: "/files",
+    deployment: "/deployments"
   };
   async findResource(type, name, id) {
     const accept = type === "agent" ? (r) => !isArchivedAgent(r) : void 0;
@@ -3976,7 +4193,7 @@ var BailianAdapter = class _BailianAdapter {
   }
   async waitForFileReady(fileId) {
     const start = Date.now();
-    let delay2 = FILE_SCAN_BACKOFF.initial;
+    let delay3 = FILE_SCAN_BACKOFF.initial;
     let logged = false;
     while (true) {
       const detail = await this.client.get(`/files/${fileId}`);
@@ -3995,8 +4212,8 @@ var BailianAdapter = class _BailianAdapter {
         );
         return;
       }
-      await new Promise((r) => setTimeout(r, delay2));
-      delay2 = Math.min(delay2 * FILE_SCAN_BACKOFF.factor, FILE_SCAN_BACKOFF.max);
+      await new Promise((r) => setTimeout(r, delay3));
+      delay3 = Math.min(delay3 * FILE_SCAN_BACKOFF.factor, FILE_SCAN_BACKOFF.max);
     }
   }
   // --- Vault (Vaults API) ---
@@ -4055,46 +4272,93 @@ var BailianAdapter = class _BailianAdapter {
   async deleteCredential(vaultId, credentialId) {
     await this.client.delete(`/vaults/${vaultId}/credentials/${credentialId}`);
   }
-  // --- Deployment (emulated) ---
-  async createDeployment(_name, _decl, _refs, _basePath) {
-    return { id: null, type: "deployment" };
+  // --- Deployment ---
+  async createDeployment(name, decl, refs, basePath) {
+    const uploaded = await this.uploadDeploymentFiles(decl, basePath);
+    const body = mapDeployment3(name, decl, refs, this.projectName, uploaded);
+    try {
+      const res = await this.client.post("/deployments", body);
+      return toRemoteResource(res);
+    } catch (error) {
+      preserveDeploymentFilesOnConflict(error, uploaded);
+    }
   }
-  async updateDeployment(_id, _name, _decl, _refs, _basePath) {
-    return { id: null, type: "deployment" };
+  async updateDeployment(id, name, decl, refs, basePath, preparedFiles) {
+    if (!id) return this.createDeployment(name, decl, refs, basePath);
+    const current = await this.client.get(`/deployments/${id}`);
+    const uploaded = preparedFiles ? new Map(preparedFiles) : await this.uploadDeploymentFiles(decl, basePath);
+    const body = mapDeploymentUpdate3(
+      name,
+      decl,
+      refs,
+      this.projectName,
+      uploaded,
+      current.metadata
+    );
+    const res = await this.client.post(`/deployments/${id}`, body);
+    return toRemoteResource(res);
   }
-  async deleteDeployment(_id) {
+  async deleteDeployment(id) {
+    await this.client.post(`/deployments/${id}/archive`, {});
   }
   async runDeployment(ctx) {
-    const fileIds = [];
-    for (const r of ctx.decl.resources ?? []) {
-      if (r.type === "file") {
-        if (r.file_id) {
-          fileIds.push(r.file_id);
-        } else if (r.source) {
-          fileIds.push(await this.uploadSessionFile(r.source, ctx.basePath));
-        }
-      }
-    }
-    const body = mapDeploymentToSession(ctx.decl, ctx.refs, fileIds);
-    const sessionRes = await this.client.post("/sessions", body);
-    const sessionId = sessionRes.id;
-    const eventsBody = mapInitialEvents2(ctx.decl.initial_events);
-    const input = eventsBody.input;
-    if (input.length) {
-      await this.client.post(`/sessions/${sessionId}/events`, eventsBody);
+    if (!ctx.id) {
+      throw new UserError(`Deployment '${ctx.name}' has no remote id; run \`agents apply\` first.`);
     }
-    return { session_id: sessionId };
+    const res = await this.client.post(`/deployments/${ctx.id}/run`, {});
+    return {
+      run_id: res.id,
+      session_id: res.session_id ?? null,
+      error: res.error ?? void 0
+    };
   }
   async getDeployment(ctx) {
-    const plan = mapDeploymentToSession(ctx.decl, ctx.refs, []);
+    if (!ctx.id) {
+      throw new UserError(`Deployment '${ctx.name}' has no remote id; run \`agents apply\` first.`);
+    }
+    const res = await this.client.get(`/deployments/${ctx.id}`);
+    return toDeploymentInfo3(res);
+  }
+  async listDeployments(filter) {
+    const params = new URLSearchParams();
+    if (filter?.agent_id) params.set("agent_id", filter.agent_id);
+    if (filter?.status) params.set("status", filter.status);
+    if (filter?.include_archived) params.set("include_archived", "true");
+    if (filter?.limit) params.set("limit", String(filter.limit));
+    if (filter?.page) params.set("page", filter.page);
+    if (filter?.created_at_gte) params.set("created_at[gte]", filter.created_at_gte);
+    if (filter?.created_at_lte) params.set("created_at[lte]", filter.created_at_lte);
+    const query2 = params.toString();
+    const res = await this.client.get(`/deployments${query2 ? `?${query2}` : ""}`);
+    const nextPage = res.next_page ?? void 0;
     return {
-      id: ctx.id,
-      status: "emulated (local)",
-      schedule: ctx.decl.schedule,
-      attributes: { materialization_plan: plan }
+      deployments: (res.data ?? []).map(toDeploymentInfo3),
+      has_more: nextPage != null,
+      next_page: nextPage
     };
   }
-  async uploadSessionFile(source, basePath) {
+  async pauseDeployment(ctx) {
+    return this.setDeploymentPaused(ctx, true);
+  }
+  async unpauseDeployment(ctx) {
+    return this.setDeploymentPaused(ctx, false);
+  }
+  async setDeploymentPaused(ctx, paused) {
+    if (!ctx.id) throw new UserError(`Deployment '${ctx.name}' has no remote id; run \`agents apply\` first.`);
+    const action = paused ? "pause" : "unpause";
+    const res = await this.client.post(`/deployments/${ctx.id}/${action}`, {});
+    return toDeploymentInfo3(res);
+  }
+  async uploadDeploymentFiles(decl, basePath) {
+    const uploaded = /* @__PURE__ */ new Map();
+    for (const resource of decl.resources ?? []) {
+      if (resource.type === "file" && !resource.file_id && resource.source && !uploaded.has(resource.source)) {
+        uploaded.set(resource.source, await this.uploadDeploymentFile(resource.source, basePath));
+      }
+    }
+    return uploaded;
+  }
+  async uploadDeploymentFile(source, basePath) {
     const fullPath = resolve3(dirname3(basePath), source);
     const content = readFileSync3(fullPath);
     const formData = new FormData();
@@ -4190,10 +4454,23 @@ var BailianAdapter = class _BailianAdapter {
 function isArchivedAgent(raw) {
   return typeof raw.archived_at === "string" && raw.archived_at.trim().length > 0;
 }
-function toSessionInfo3(res) {
-  return buildSessionInfo(res, () => []);
-}
-function toBailianSkillInfo(res) {
+function toDeploymentInfo3(res) {
+  const schedule = res.schedule;
+  return {
+    id: res.id ?? null,
+    status: res.status ?? "unknown",
+    paused_reason: res.paused_reason ?? void 0,
+    schedule: schedule ? {
+      expression: schedule.expression,
+      timezone: schedule.timezone
+    } : void 0,
+    attributes: res
+  };
+}
+function toSessionInfo3(res) {
+  return buildSessionInfo(res, () => []);
+}
+function toBailianSkillInfo(res) {
   const rawSource = String(res.source ?? "").toLowerCase();
   const source = rawSource === "customer" ? "custom" : "official";
   return {
@@ -4286,9 +4563,8 @@ var BAILIAN_CAPABILITIES = {
     remediation: "deploy agents independently and orchestrate via MCP"
   },
   deployment: {
-    tier: "emulated",
-    reason: "no deployment primitive on Bailian; expanded into a session at run time",
-    remediation: "scheduling and outcome rubrics are not enforced server-side \u2014 use external cron/CI for always-on or scheduled runs"
+    tier: "native",
+    reason: "deployments API with cron schedules, manual runs, pause/unpause and archive"
   },
   session: { tier: "native", reason: "sessions API" },
   identity: { tier: "unsupported", reason: "no mapped Identity primitive on Bailian" },
@@ -4590,7 +4866,7 @@ function mapAgent4(name, decl, refs, version, projectName) {
   }
   return body;
 }
-function mapDeploymentToSession2(decl, refs, fileIds) {
+function mapDeploymentToSession(decl, refs, fileIds) {
   const body = {
     agent: refs.agent_id,
     environment_id: refs.environment_id
@@ -4953,7 +5229,7 @@ var ArkAdapter = class _ArkAdapter {
         }
       }
     }
-    const body = mapDeploymentToSession2(ctx.decl, ctx.refs, fileIds);
+    const body = mapDeploymentToSession(ctx.decl, ctx.refs, fileIds);
     const sessionRes = await this.client.post("/sessions", body);
     const sessionId = sessionRes.id;
     const events = ctx.decl.initial_events.filter((e) => e.type === "user.message" || e.type === "system.message").map((e) => ({
@@ -4966,7 +5242,7 @@ var ArkAdapter = class _ArkAdapter {
     return { session_id: sessionId };
   }
   async getDeployment(ctx) {
-    const plan = mapDeploymentToSession2(ctx.decl, ctx.refs, []);
+    const plan = mapDeploymentToSession(ctx.decl, ctx.refs, []);
     return {
       id: ctx.id,
       status: "emulated (local)",
@@ -5239,6 +5515,9 @@ var packagesSchema = z5.object({
   gem: z5.array(z5.string()).optional(),
   go: z5.array(z5.string()).optional()
 });
+var setupScriptSchema = z5.string().refine((value) => new TextEncoder().encode(value).byteLength <= 64 * 1024, {
+  message: "setup_script must not exceed 65536 UTF-8 bytes"
+});
 var environmentSchema = z5.object({
   name: z5.string().optional(),
   description: z5.string().optional(),
@@ -5248,7 +5527,8 @@ var environmentSchema = z5.object({
   config: z5.object({
     type: z5.enum(["cloud", "self_hosted"]),
     networking: networkingSchema.optional(),
-    packages: packagesSchema.optional()
+    packages: packagesSchema.optional(),
+    setup_script: setupScriptSchema.optional()
   }),
   metadata: z5.record(z5.string(), z5.string()).optional()
 });
@@ -5412,6 +5692,9 @@ var agentSkillRefSchema = z5.object({
 var agentDeliverySchema = z5.object({
   type: z5.enum(["managed", "forward"])
 });
+var managedToolConfigSchema = z5.object({
+  enabled_tools: z5.array(z5.string().min(1))
+});
 var sessionGithubRepoResourceSchema = z5.object({
   type: z5.literal("github_repository"),
   url: z5.string().url(),
@@ -5433,18 +5716,27 @@ var agentSchema = z5.object({
   mcp_servers: z5.array(mcpServerSchema).optional(),
   skills: z5.array(z5.union([z5.string(), agentSkillRefSchema])).optional(),
   vault: z5.string().optional(),
+  files: z5.array(z5.string()).optional(),
   memory_stores: z5.array(z5.string()).optional(),
+  default_memory_store: z5.object({
+    name: z5.string().trim().min(1).max(255),
+    description: z5.string().max(1024).optional(),
+    delete_on_destroy: z5.boolean().optional().default(false)
+  }).optional(),
   resources: z5.array(sessionGithubRepoResourceSchema).optional(),
   multiagent: multiagentSchema.optional(),
   metadata: z5.record(z5.string(), z5.string()).optional(),
+  environment_variables: z5.record(z5.string().min(1), z5.string()).optional(),
+  managed_tool_config: managedToolConfigSchema.optional(),
   delivery: z5.record(z5.string(), agentDeliverySchema).optional()
 });
 var channelSchema = z5.object({
   provider: z5.string().optional(),
-  agent: z5.string().min(1),
+  agent: z5.string().min(1).optional(),
   identity: z5.string().min(1).optional(),
   type: z5.string().min(1),
   name: z5.string().trim().min(1).optional(),
+  mode: z5.enum(["fixed", "pairing"]).optional().default("fixed"),
   enabled: z5.boolean().optional(),
   credentials: z5.record(z5.string(), coerceString).optional(),
   options: z5.record(z5.string(), z5.unknown()).optional()
@@ -5683,14 +5975,29 @@ async function computeResourceHash(address, config, basePath, state) {
   if (!decl) return "";
   if (address.type === "skill") {
     const skillDecl = decl;
+    const apiMode = resolveQoderApiMode(address.type, address.name, address.provider, config);
     if (basePath) {
       const fileHash = computeSkillContentHash(skillDecl.source, basePath);
-      return contentHash({ decl, fileHash });
+      return contentHash({ decl, fileHash, apiMode });
     }
+    return contentHash({ decl, apiMode });
+  }
+  if (address.type === "environment" || address.type === "vault" || address.type === "memory_store") {
+    return contentHash({ decl, apiMode: resolveQoderApiMode(address.type, address.name, address.provider, config) });
+  }
+  if (address.type === "file" && basePath) {
+    const fileDecl = decl;
+    const fileHash = computeLocalFileContentHash(fileDecl.source, basePath);
+    return contentHash({
+      decl,
+      fileHash,
+      apiMode: resolveQoderApiMode("file", address.name, address.provider, config)
+    });
   }
   if (address.type === "deployment") {
     const refs = resolveDeploymentReferenceIds(decl, config, address.provider, state);
-    if (refs) return contentHash({ decl, refs });
+    const sourceHashes = basePath ? computeDeploymentSourceHashes(decl, basePath) : void 0;
+    if (refs || sourceHashes) return contentHash({ decl, refs, sourceHashes });
   }
   if (address.type === "template") {
     const refs = resolveTemplateReferenceIds(decl, config, address.provider, state);
@@ -5707,7 +6014,28 @@ async function computeResourceHash(address, config, basePath, state) {
   }
   return contentHash(decl);
 }
+function resolveQoderApiMode(type, name, provider, config) {
+  if (provider !== "qoder") return void 0;
+  if (type === "environment" && config.environments?.[name]?.environment_id) return "auto";
+  for (const agent of Object.values(config.agents ?? {})) {
+    if (agent.provider && agent.provider !== provider) continue;
+    const referenced = type === "environment" ? agent.environment === name : type === "skill" ? agent.skills?.some(
+      (skill) => typeof skill === "string" ? skill === name : skill.type === "custom" && skill.skill_id === name
+    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.includes(name);
+    if (referenced && agent.delivery?.qoder?.type === "forward") return "forward";
+  }
+  return "managed";
+}
+function computeReplacementFingerprint(address, config) {
+  if (address.type !== "channel") return void 0;
+  const decl = config.channels?.[address.name];
+  if (!decl) return void 0;
+  return contentHash({ channel_type: decl.type, mode: decl.mode ?? "fixed", credentials: decl.credentials ?? {} });
+}
 function resolveChannelReferenceIds(decl, config, provider, state) {
+  if (decl.mode === "pairing" || !decl.agent) {
+    return { mode: "pairing" };
+  }
   const agent = config.agents?.[decl.agent];
   const agentType = agent?.delivery?.[provider]?.type === "forward" ? "template" : "agent";
   const identity = decl.identity ?? config.defaults?.identity;
@@ -5730,7 +6058,14 @@ function resolveTemplateReferenceIds(decl, config, provider, state) {
     environment_id: environment?.environment_id ?? (decl.environment ? state?.getResource({ type: "environment", name: decl.environment, provider })?.remote_id ?? void 0 : void 0),
     tunnel_id: tunnel?.tunnel_id,
     vault_ids: decl.vault ? [state?.getResource({ type: "vault", name: decl.vault, provider })?.remote_id ?? decl.vault] : [],
-    skill_ids: skillIds
+    skill_ids: skillIds,
+    memory_store_ids: (decl.memory_stores ?? []).map(
+      (memoryStore) => state?.getResource({ type: "memory_store", name: memoryStore, provider })?.remote_id ?? memoryStore
+    ),
+    file_ids: (decl.files ?? []).map(
+      (file) => state?.getResource({ type: "file", name: file, provider })?.remote_id ?? file
+    ),
+    identity_id: decl.memory_stores?.length && config.defaults?.identity ? state?.getResource({ type: "identity", name: config.defaults.identity, provider })?.remote_id : void 0
   };
 }
 function resolveDeploymentReferenceIds(decl, config, provider, state) {
@@ -5745,6 +6080,23 @@ function resolveDeploymentReferenceIds(decl, config, provider, state) {
 function getDeclaration(address, config) {
   return getResourceDeclaration(address, config);
 }
+function computeDeploymentSourceHashes(decl, basePath) {
+  const sources = [
+    ...new Set(
+      (decl.resources ?? []).flatMap(
+        (resource) => resource.type === "file" && !resource.file_id && resource.source ? [resource.source] : []
+      )
+    )
+  ];
+  if (sources.length === 0) return void 0;
+  return Object.fromEntries(sources.map((source) => [source, computeLocalFileContentHash(source, basePath)]));
+}
+function computeLocalFileContentHash(source, basePath) {
+  const fullPath = resolve9(dirname8(basePath), source);
+  const stat = statSync2(fullPath, { throwIfNoEntry: false });
+  if (!stat?.isFile()) return "";
+  return contentHash(readFileSync6(fullPath).toString("base64"));
+}
 function computeSkillContentHash(source, basePath) {
   const fullPath = resolve9(dirname8(basePath), source);
   const stat = statSync2(fullPath, { throwIfNoEntry: false });
@@ -5893,11 +6245,21 @@ function resolveTemplateRefs(agentName, config, provider, state) {
   const environment = config.environments?.[agent.environment];
   if (!environment) throw new UserError(`Environment '${agent.environment}' is not defined in config.`);
   const agentRefs = resolveAgentRefs(agentName, config, provider, state);
+  const memoryStoreIds = (agent.memory_stores ?? []).map(
+    (memoryStore) => requireRef(state, { type: "memory_store", name: memoryStore, provider })
+  );
+  const identityName = config.defaults?.identity;
   return {
     ...agentRefs,
     environment_id: environment.environment_id ?? requireRef(state, { type: "environment", name: agent.environment, provider }),
     ...agent.tunnel ? { tunnel_id: resolveTunnelIdFromConfig(config, agent.tunnel, provider) } : {},
-    vault_ids: agent.vault ? [requireRef(state, { type: "vault", name: agent.vault, provider })] : []
+    vault_ids: agent.vault ? [requireRef(state, { type: "vault", name: agent.vault, provider })] : [],
+    file_ids: (agent.files ?? []).map((file) => requireRef(state, { type: "file", name: file, provider })),
+    memory_store_ids: memoryStoreIds,
+    owned_memory_store_ids: state.listResources().filter(
+      (resource) => resource.address.provider === provider && resource.address.type === "memory_store" && resource.api_mode === "forward" && typeof resource.remote_id === "string"
+    ).map((resource) => resource.remote_id),
+    ...identityName ? { identity_id: requireRef(state, { type: "identity", name: identityName, provider }) } : {}
   };
 }
 function resolveDeploymentRefs(deploymentName, config, provider, state) {
@@ -5959,6 +6321,12 @@ function resolveDeploymentRefs(deploymentName, config, provider, state) {
 function resolveChannelRefs(channelName, config, provider, state) {
   const channel = config.channels?.[channelName];
   if (!channel) throw new UserError(`Channel '${channelName}' not found in config`);
+  if (channel.mode === "pairing") {
+    return {};
+  }
+  if (!channel.agent) {
+    throw new UserError(`Channel '${channelName}' is fixed mode and must declare agent`);
+  }
   const agent = config.agents?.[channel.agent];
   if (!agent) throw new UserError(`Channel '${channelName}' references unknown agent '${channel.agent}'`);
   const agentType = agent.delivery?.[provider]?.type === "forward" ? "template" : "agent";
@@ -6081,6 +6449,7 @@ async function executePlan(plan, ctx, options = {}) {
     await runWithConcurrency(level, concurrency, runAction);
     await ctx.state.save();
   }
+  await reconcileDefaultMemoryStores(ctx, new Set(plan.actions.map((action) => action.address.provider)));
   for (const action of deletions) {
     await runAction(action);
     await ctx.state.save();
@@ -6091,6 +6460,41 @@ async function executePlan(plan, ctx, options = {}) {
     partial: results.some((r) => r.status === "failed")
   };
 }
+async function reconcileDefaultMemoryStores(ctx, plannedProviders) {
+  const identityName = ctx.config.defaults?.identity;
+  for (const [agentName, agent] of Object.entries(ctx.config.agents ?? {})) {
+    const desired = agent.default_memory_store;
+    if (!desired || agent.delivery?.qoder?.type !== "forward") continue;
+    const providerName = "qoder";
+    if (agent.provider && agent.provider !== providerName || !plannedProviders.has(providerName)) continue;
+    const provider = ctx.providers.get(providerName);
+    if (!provider?.reconcileDefaultMemoryStore || !identityName) continue;
+    const identityId = ctx.state.getResource({
+      type: "identity",
+      name: identityName,
+      provider: providerName
+    })?.remote_id;
+    const templateId = ctx.state.getResource({ type: "template", name: agentName, provider: providerName })?.remote_id;
+    if (!identityId || !templateId) continue;
+    const result = await provider.reconcileDefaultMemoryStore(identityId, templateId, desired);
+    const resource = { type: "template", name: agentName, provider: providerName };
+    if (result.status === "pending") {
+      emitRuntimeFeedback(ctx.onFeedback, {
+        type: "provider_wait",
+        level: "warning",
+        resource,
+        message: `default memory store for template.${agentName} is pending \u2014 create the first Forward Session, then run apply again`
+      });
+    } else if (result.status === "updated") {
+      emitRuntimeFeedback(ctx.onFeedback, {
+        type: "resource_action_success",
+        level: "success",
+        resource,
+        message: `updated default memory store for template.${agentName} to "${desired.name}"`
+      });
+    }
+  }
+}
 async function runWithConcurrency(items, limit, worker) {
   if (items.length === 0) return;
   let cursor = 0;
@@ -6157,8 +6561,8 @@ async function executeAction(action, provider, ctx) {
       resource: action.address,
       message: `update ${action.address.type}.${action.address.name} (${action.address.provider}) \u2014 not found remotely, recreating`
     });
-    ctx.state.removeResource(action.address);
-    return executeActionInner({ ...action, action: "create" }, provider, ctx);
+    ctx.state.removeResource(action.previousAddress ?? action.address);
+    return executeActionInner({ ...action, action: "create", previousAddress: void 0 }, provider, ctx);
   }
 }
 async function executeActionInner(action, provider, ctx) {
@@ -6169,6 +6573,7 @@ async function executeActionInner(action, provider, ctx) {
     const existing = ctx.state.getResource(address);
     if (!existing) return false;
     const id = existing.remote_id;
+    const apiMode2 = existing.api_mode;
     if (type === "environment" || type === "identity") {
       const externalReference = type === "environment" ? ctx.config.environments?.[name]?.environment_id : ctx.config.identities?.[name]?.identity_id;
       if (existing.externally_managed || externalReference) {
@@ -6180,13 +6585,13 @@ async function executeActionInner(action, provider, ctx) {
       try {
         switch (type) {
           case "environment":
-            await provider.deleteEnvironment(id);
+            await provider.deleteEnvironment(id, false, apiMode2);
             break;
           case "vault":
-            await provider.deleteVault(id);
+            await provider.deleteVault(id, apiMode2);
             break;
           case "skill":
-            await provider.deleteSkill(id);
+            await provider.deleteSkill(id, apiMode2);
             break;
           case "agent":
             await provider.deleteAgent(id);
@@ -6194,17 +6599,17 @@ async function executeActionInner(action, provider, ctx) {
           case "template":
             if (!provider.archiveTemplate)
               throw new UserError(`Provider '${address.provider}' does not support templates`);
-            await provider.archiveTemplate(id);
+            await provider.archiveTemplate(id, ownedForwardMemoryStoreIds(ctx, address.provider));
             break;
           case "memory_store":
             if (!provider.deleteMemoryStore) throw memoryStoreUnsupported(address.provider);
-            await provider.deleteMemoryStore(id);
+            await provider.deleteMemoryStore(id, apiMode2);
             break;
           case "deployment":
             await provider.deleteDeployment(id);
             break;
           case "file":
-            await provider.deleteFile(id);
+            await provider.deleteFile(id, apiMode2);
             break;
           case "identity":
             if (!provider.deleteIdentity)
@@ -6231,7 +6636,11 @@ async function executeActionInner(action, provider, ctx) {
     return false;
   }
   const isUpdate = action.action === "update";
-  const existingId = isUpdate ? ctx.state.getResource(address)?.remote_id : void 0;
+  const priorAddress = action.previousAddress ?? address;
+  const existingId = isUpdate ? ctx.state.getResource(priorAddress)?.remote_id : void 0;
+  const apiMode = resolveResourceApiMode(type, name, address.provider, ctx.config);
+  const priorApiMode = ctx.state.getResource(priorAddress)?.api_mode ?? (address.provider === "qoder" ? "managed" : void 0);
+  const apiModeChanged = isUpdate && apiMode !== void 0 && priorApiMode !== apiMode;
   let result;
   switch (type) {
     case "environment": {
@@ -6246,6 +6655,17 @@ async function executeActionInner(action, provider, ctx) {
           resource: action.address,
           message: `${action.action} ${action.address.type}.${action.address.name} (${action.address.provider}) \u2014 external reference, no remote mutation`
         });
+      } else if (apiModeChanged) {
+        try {
+          result = await provider.createEnvironment(remoteName, decl, apiMode);
+        } catch (err) {
+          result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            mode: apiMode,
+            onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl, apiMode)
+          });
+          adopted = true;
+        }
+        if (existingId) await provider.deleteEnvironment(existingId, false, priorApiMode);
       } else if (isUpdate) {
         const prior = ctx.state.getResource(address);
         if (prior?.externally_managed) {
@@ -6253,13 +6673,14 @@ async function executeActionInner(action, provider, ctx) {
             `environment.${name} is recorded as an external reference (${prior.remote_id ?? "unknown id"}); refusing to modify it remotely. Restore 'environment_id' to keep it as a reference, or release it first with 'agents state rm environment.${name}' (then 'agents state import' to adopt it as a managed resource).`
           );
         }
-        result = await provider.updateEnvironment(existingId, remoteName, decl);
+        result = await provider.updateEnvironment(existingId, remoteName, decl, apiMode);
       } else {
         try {
-          result = await provider.createEnvironment(remoteName, decl);
+          result = await provider.createEnvironment(remoteName, decl, apiMode);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
-            onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl)
+            mode: apiMode,
+            onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl, apiMode)
           });
           adopted = true;
         }
@@ -6268,22 +6689,26 @@ async function executeActionInner(action, provider, ctx) {
     }
     case "vault": {
       const decl = ctx.config.vaults[name];
-      if (isUpdate) {
+      if (apiModeChanged) {
+        result = await provider.createVault(name, decl, apiMode);
+        if (existingId) await provider.deleteVault(existingId, priorApiMode).catch(() => void 0);
+      } else if (isUpdate) {
         try {
-          result = await provider.createVault(name, decl);
-          await provider.deleteVault(existingId);
+          result = await provider.createVault(name, decl, apiMode);
+          await provider.deleteVault(existingId, apiMode);
         } catch {
-          await provider.deleteVault(existingId);
-          result = await provider.createVault(name, decl);
+          await provider.deleteVault(existingId, apiMode);
+          result = await provider.createVault(name, decl, apiMode);
         }
       } else {
         try {
-          result = await provider.createVault(name, decl);
+          result = await provider.createVault(name, decl, apiMode);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            mode: apiMode,
             onExisting: async (existing) => {
-              await provider.deleteVault(existing.id);
-              return provider.createVault(name, decl);
+              await provider.deleteVault(existing.id, apiMode);
+              return provider.createVault(name, decl, apiMode);
             }
           });
           adopted = true;
@@ -6307,12 +6732,15 @@ async function executeActionInner(action, provider, ctx) {
       }
       const remoteName = decl.name ?? name;
       const files = await resolveSkillFiles(decl, ctx);
-      if (isUpdate) {
-        result = await provider.updateSkill(existingId, remoteName, decl, files);
+      if (apiModeChanged) {
+        result = await provider.createSkill(remoteName, decl, files, apiMode);
+        if (existingId) await provider.deleteSkill(existingId, priorApiMode).catch(() => void 0);
+      } else if (isUpdate) {
+        result = await provider.updateSkill(existingId, remoteName, decl, files, apiMode);
       } else {
         const manifestName = skillNameFromFiles(files);
         const searchNames = manifestName && manifestName !== remoteName ? [remoteName, manifestName] : [remoteName];
-        const existing = await findExistingByNames(provider, "skill", searchNames);
+        const existing = await findExistingByNames(provider, "skill", searchNames, apiMode);
         if (existing) {
           result = existing.resource;
           emitRuntimeFeedback(ctx.onFeedback, {
@@ -6324,9 +6752,10 @@ async function executeActionInner(action, provider, ctx) {
           adopted = true;
         } else {
           try {
-            result = await provider.createSkill(remoteName, decl, files);
+            result = await provider.createSkill(remoteName, decl, files, apiMode);
           } catch (err) {
             result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+              mode: apiMode,
               searchNames,
               onExisting: async (existing2) => existing2
             });
@@ -6345,15 +6774,19 @@ async function executeActionInner(action, provider, ctx) {
         throw memoryStoreUnsupported(address.provider);
       }
       const reconcile = async (storeId) => {
-        const store = await provider.updateMemoryStore(storeId, {
-          name,
-          description: decl.description,
-          metadata: decl.metadata ?? {}
-        });
+        const store = await provider.updateMemoryStore(
+          storeId,
+          {
+            name,
+            description: decl.description,
+            metadata: decl.metadata ?? {}
+          },
+          apiMode
+        );
         const current = /* @__PURE__ */ new Map();
         let cursor;
         do {
-          const page2 = await provider.listMemories(storeId, { limit: 100, cursor, view: "basic" });
+          const page2 = await provider.listMemories(storeId, { limit: 100, cursor, view: "basic" }, apiMode);
           for (const memory of page2.data) {
             if (memory.type === "memory") current.set(memory.path, memory);
           }
@@ -6363,24 +6796,33 @@ async function executeActionInner(action, provider, ctx) {
           const existing = current.get(entry.key.replace(/^\/+/, ""));
           if (existing) {
             if (existing.content_sha256 !== sha256(entry.content)) {
-              await provider.updateMemory(storeId, existing.id, {
-                content: entry.content,
-                expected_content_sha256: existing.content_sha256
-              });
+              await provider.updateMemory(
+                storeId,
+                existing.id,
+                {
+                  content: entry.content,
+                  expected_content_sha256: existing.content_sha256
+                },
+                apiMode
+              );
             }
           } else {
-            await provider.createMemory(storeId, { path: entry.key, content: entry.content });
+            await provider.createMemory(storeId, { path: entry.key, content: entry.content }, apiMode);
           }
         }
         return store;
       };
-      if (isUpdate) {
+      if (apiModeChanged) {
+        result = await createMemoryStore2(name, decl, apiMode);
+        if (existingId) await deleteMemoryStore2(existingId, priorApiMode).catch(() => void 0);
+      } else if (isUpdate) {
         result = await reconcile(existingId);
       } else {
         try {
-          result = await createMemoryStore2(name, decl);
+          result = await createMemoryStore2(name, decl, apiMode);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            mode: apiMode,
             onExisting: async (existing) => reconcile(existing.id)
           });
           adopted = true;
@@ -6489,16 +6931,36 @@ async function executeActionInner(action, provider, ctx) {
     case "deployment": {
       const decl = ctx.config.deployments[name];
       const refs = resolveDeploymentRefs(name, ctx.config, address.provider, ctx.state);
-      if (isUpdate) {
-        result = await provider.updateDeployment(existingId, name, decl, refs, ctx.configPath ?? "");
-      } else {
+      const hasLocalFileSources = decl.resources?.some(
+        (resource) => resource.type === "file" && !resource.file_id && Boolean(resource.source)
+      );
+      const materializeDeployment = async () => {
         try {
-          result = await provider.createDeployment(name, decl, refs, ctx.configPath ?? "");
+          return await provider.createDeployment(name, decl, refs, ctx.configPath ?? "");
         } catch (err) {
-          result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
-            onExisting: (existing) => provider.updateDeployment(existing.id, name, decl, refs, ctx.configPath ?? "")
+          const preparedFiles = err instanceof DeploymentCreateConflictError ? err.preparedFiles : void 0;
+          const existing = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            onExisting: (existing2) => provider.updateDeployment(existing2.id, name, decl, refs, ctx.configPath ?? "", preparedFiles)
           });
           adopted = true;
+          return existing;
+        }
+      };
+      if (isUpdate && existingId) {
+        result = await provider.updateDeployment(existingId, name, decl, refs, ctx.configPath ?? "");
+      } else {
+        const existing = hasLocalFileSources ? await findExistingByNames(provider, "deployment", [name]) : null;
+        if (existing) {
+          result = await provider.updateDeployment(existing.resource.id, name, decl, refs, ctx.configPath ?? "");
+          emitRuntimeFeedback(ctx.onFeedback, {
+            type: "resource_adopted",
+            level: "info",
+            resource: address,
+            message: `adopt deployment.${name} (${address.provider}) \u2014 already existed remotely as "${existing.name}"`
+          });
+          adopted = true;
+        } else {
+          result = await materializeDeployment();
         }
       }
       break;
@@ -6510,15 +6972,12 @@ async function executeActionInner(action, provider, ctx) {
         const oldId = ctx.state.getResource(address)?.remote_id;
         if (oldId) {
           try {
-            await provider.deleteFile(oldId);
+            await provider.deleteFile(oldId, priorApiMode);
           } catch {
           }
         }
       }
-      const info = await provider.uploadFile(filePath, {
-        name: decl.name,
-        purpose: decl.purpose
-      });
+      const info = await provider.uploadFile(filePath, { name: decl.name, purpose: decl.purpose }, apiMode);
       result = { id: info.id, type: "file" };
       break;
     }
@@ -6534,11 +6993,12 @@ async function executeActionInner(action, provider, ctx) {
     remoteHash = contentHash(remote.comparable);
     remoteSnapshot = remote.snapshot ?? remote.comparable;
   }
-  const priorResource = ctx.state.getResource(address);
+  const priorResource = ctx.state.getResource(priorAddress);
   ctx.state.setResource({
     address,
     remote_id: result.id,
     externally_managed: priorResource?.externally_managed || type === "environment" && ctx.config.environments?.[name]?.environment_id || type === "identity" && ctx.config.identities?.[name]?.identity_id ? true : void 0,
+    api_mode: apiMode,
     version: result.version,
     content_hash: hash,
     desired_hash: hash,
@@ -6546,14 +7006,44 @@ async function executeActionInner(action, provider, ctx) {
     desired_readiness_baseline: buildReadinessBaseline(getResourceDeclaration(address, ctx.config)),
     remote_hash: remoteHash,
     remote_snapshot: remoteSnapshot,
+    replacement_fingerprint: computeReplacementFingerprint(address, ctx.config),
     drift_paths: [],
     drift_status: remoteHash ? "in_sync" : void 0
   });
+  if (action.previousAddress) ctx.state.removeResource(action.previousAddress);
   return adopted;
 }
-async function findExistingByNames(provider, type, names) {
+function ownedForwardMemoryStoreIds(ctx, provider) {
+  return ctx.state.listResources().filter(
+    (resource) => resource.address.provider === provider && resource.address.type === "memory_store" && resource.api_mode === "forward" && typeof resource.remote_id === "string"
+  ).map((resource) => resource.remote_id);
+}
+function resolveResourceApiMode(type, name, provider, config) {
+  if (provider !== "qoder" || type !== "environment" && type !== "skill" && type !== "vault" && type !== "memory_store" && type !== "file") {
+    return void 0;
+  }
+  if (type === "environment" && config.environments?.[name]?.environment_id) return "auto";
+  let managed = false;
+  let forward = false;
+  for (const agent of Object.values(config.agents ?? {})) {
+    if (agent.provider && agent.provider !== provider) continue;
+    const referenced = type === "environment" ? agent.environment === name : type === "skill" ? agent.skills?.some(
+      (skill) => typeof skill === "string" ? skill === name : skill.type === "custom" && skill.skill_id === name
+    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.includes(name);
+    if (!referenced) continue;
+    if (agent.delivery?.qoder?.type === "forward") forward = true;
+    else managed = true;
+  }
+  if (managed && forward) {
+    throw new UserError(
+      `Qoder ${type}.${name} is referenced by both Managed and Forward agents; declare separate resources for each API domain.`
+    );
+  }
+  return forward ? "forward" : "managed";
+}
+async function findExistingByNames(provider, type, names, mode) {
   for (const candidate of names) {
-    const found = await provider.findResource(type, candidate);
+    const found = await provider.findResource(type, candidate, void 0, mode);
     if (found && found.id !== null) return { resource: found, name: candidate };
   }
   return null;
@@ -6561,7 +7051,7 @@ async function findExistingByNames(provider, type, names) {
 async function adoptOnConflict(err, address, provider, onFeedback, opts) {
   if (!(err instanceof ConflictError)) throw err;
   const candidates = opts.searchNames?.length ? opts.searchNames : [address.name];
-  const existing = await findExistingByNames(provider, address.type, candidates);
+  const existing = await findExistingByNames(provider, address.type, candidates, opts.mode);
   if (!existing) throw nameReservedError(err, address, candidates.join('" / "'));
   emitRuntimeFeedback(onFeedback, {
     type: "resource_adopted",
@@ -6573,6 +7063,11 @@ async function adoptOnConflict(err, address, provider, onFeedback, opts) {
 }
 function nameReservedError(err, address, searchName) {
   const detail = err instanceof ApiError ? err.message : String(err);
+  if (address.type === "channel" && err instanceof ApiError && err.responseBody.includes("CHANNEL_CREDENTIAL_CONFLICT")) {
+    return new UserError(
+      `${address.provider} rejected channel.${address.name} because its credentials are already used by another Channel. Keep the existing Channel address so it can be updated in place, remove the old Channel first, or use a different credential set. (${detail})`
+    );
+  }
   return new UserError(
     `${address.provider} reported ${address.type} "${searchName}" already exists, but it could not be found remotely to adopt. This usually means it was recently deleted and the provider still reserves the name. Wait for the provider to release the name, or use a different name for ${address.type}.${address.name}. (${detail})`
   );
@@ -6645,6 +7140,13 @@ function agentTargetsProvider(config, agentProvider, providerName) {
   return Object.hasOwn(config.providers, providerName);
 }
 
+// src/internal/core/agent-materialization.ts
+function resolveAgentMaterialization(provider, agent) {
+  const mode = agent.delivery?.[provider]?.type ?? "managed";
+  if (mode === "managed") return { resourceType: "agent", mode };
+  return { resourceType: "template", mode };
+}
+
 // src/internal/core/validate-config.ts
 function validateProjectConfig(config, options = {}) {
   const collector = new DiagnosticCollector();
@@ -6671,6 +7173,7 @@ function collectReferenceDiagnostics(config, diagnostics) {
   const skillNames = new Set(Object.keys(config.skills ?? {}));
   const vaultNames = new Set(Object.keys(config.vaults ?? {}));
   const memoryNames = new Set(Object.keys(config.memory_stores ?? {}));
+  const fileNames = new Set(Object.keys(config.files ?? {}));
   const agentNames = new Set(Object.keys(config.agents ?? {}));
   const identityNames = new Set(Object.keys(config.identities ?? {}));
   if (config.defaults?.identity && !identityNames.has(config.defaults.identity)) {
@@ -6698,6 +7201,11 @@ function collectReferenceDiagnostics(config, diagnostics) {
     if (agent.vault && !vaultNames.has(agent.vault)) {
       diagnostics.error("config.agent.vault.unknown", `agent.${name}: references unknown vault '${agent.vault}'`);
     }
+    for (const file of agent.files ?? []) {
+      if (!fileNames.has(file)) {
+        diagnostics.error("config.agent.file.unknown", `agent.${name}: references unknown file '${file}'`);
+      }
+    }
     for (const memory of agent.memory_stores ?? []) {
       if (!memoryNames.has(memory)) {
         diagnostics.error(
@@ -6729,7 +7237,10 @@ function collectReferenceDiagnostics(config, diagnostics) {
     }
   }
   for (const [name, channel] of Object.entries(config.channels ?? {})) {
-    if (!agentNames.has(channel.agent)) {
+    if (channel.mode === "pairing") continue;
+    if (!channel.agent) {
+      diagnostics.error("config.channel.agent.required", `channel.${name}: fixed-mode channels require agent`);
+    } else if (!agentNames.has(channel.agent)) {
       diagnostics.error("config.channel.agent.unknown", `channel.${name}: references unknown agent '${channel.agent}'`);
     }
     const identity = channel.identity ?? config.defaults?.identity;
@@ -6757,6 +7268,37 @@ function collectProviderCapabilities(config, providers, diagnostics) {
       continue;
     }
     const caps = def.capabilities;
+    for (const [name, environment] of Object.entries(config.environments ?? {})) {
+      if (environment.provider && environment.provider !== providerName) continue;
+      if (environment.environment_id) continue;
+      const address = { type: "environment", name, provider: providerName };
+      if (environment.config.setup_script !== void 0 && providerName !== "qoder") {
+        diagnostics.error(
+          `${providerName}.environment.setup_script.unsupported`,
+          `environment.${name}: provider '${providerName}' does not support setup_script; remove it or pin this environment to qoder.`,
+          address
+        );
+      }
+      if (providerName === "qoder") {
+        if (environment.config.type === "self_hosted" && (environment.config.networking !== void 0 || environment.config.packages !== void 0)) {
+          diagnostics.error(
+            "qoder.environment.self_hosted.config.unsupported",
+            `environment.${name}: Qoder self_hosted environments accept only config.type and config.setup_script; remove networking and packages.`,
+            address
+          );
+        }
+        const unsupported = ["cargo", "gem", "go"].filter(
+          (key) => (environment.config.packages?.[key]?.length ?? 0) > 0
+        );
+        if (unsupported.length > 0) {
+          diagnostics.error(
+            "qoder.environment.packages.unsupported",
+            `environment.${name}: Qoder accepts only apt, npm, and pip package declarations; remove ${unsupported.join(", ")} or install them from setup_script.`,
+            address
+          );
+        }
+      }
+    }
     for (const [name, identity] of Object.entries(config.identities ?? {})) {
       if (identity.provider && identity.provider !== providerName) continue;
       if (!isSupported(caps, "identity")) {
@@ -6778,29 +7320,31 @@ function collectProviderCapabilities(config, providers, diagnostics) {
         continue;
       }
       if (providerName === "qoder") {
-        const agent = config.agents?.[channel.agent];
-        if (agent?.provider && agent.provider !== providerName) {
-          diagnostics.error(
-            "config.channel.agent.provider_mismatch",
-            `channel.${name}: agent '${channel.agent}' is pinned to provider '${agent.provider}'.`,
-            { type: "channel", name, provider: providerName }
-          );
-        }
-        const identityName = channel.identity ?? config.defaults?.identity;
-        const identity = identityName ? config.identities?.[identityName] : void 0;
-        if (identity?.provider && identity.provider !== providerName) {
-          diagnostics.error(
-            "config.channel.identity.provider_mismatch",
-            `channel.${name}: identity '${identityName}' is pinned to provider '${identity.provider}'.`,
-            { type: "channel", name, provider: providerName }
-          );
-        }
-        if (agent && agent.delivery?.qoder?.type !== "forward") {
-          diagnostics.error(
-            "qoder.channel.forward_template.required",
-            `channel.${name}: Qoder Channels require agent '${channel.agent}' to use delivery.qoder.type: forward.`,
-            { type: "channel", name, provider: providerName }
-          );
+        if (channel.mode !== "pairing" && channel.agent) {
+          const agent = config.agents?.[channel.agent];
+          if (agent?.provider && agent.provider !== providerName) {
+            diagnostics.error(
+              "config.channel.agent.provider_mismatch",
+              `channel.${name}: agent '${channel.agent}' is pinned to provider '${agent.provider}'.`,
+              { type: "channel", name, provider: providerName }
+            );
+          }
+          const identityName = channel.identity ?? config.defaults?.identity;
+          const identity = identityName ? config.identities?.[identityName] : void 0;
+          if (identity?.provider && identity.provider !== providerName) {
+            diagnostics.error(
+              "config.channel.identity.provider_mismatch",
+              `channel.${name}: identity '${identityName}' is pinned to provider '${identity.provider}'.`,
+              { type: "channel", name, provider: providerName }
+            );
+          }
+          if (agent && agent.delivery?.qoder?.type !== "forward") {
+            diagnostics.error(
+              "qoder.channel.forward_template.required",
+              `channel.${name}: Qoder Channels require agent '${channel.agent}' to use delivery.qoder.type: forward.`,
+              { type: "channel", name, provider: providerName }
+            );
+          }
         }
         const requiredCredentials = {
           dingtalk: ["client_id", "client_secret"],
@@ -6831,6 +7375,46 @@ function collectProviderCapabilities(config, providers, diagnostics) {
         }
       }
     }
+    if (providerName === "qoder") {
+      const domains = /* @__PURE__ */ new Map();
+      for (const agent of Object.values(config.agents ?? {})) {
+        if (agent.provider && agent.provider !== providerName) continue;
+        const mode = agent.delivery?.qoder?.type === "forward" ? "forward" : "managed";
+        const refs = [
+          ...agent.environment && !config.environments?.[agent.environment]?.environment_id ? [`environment:${agent.environment}`] : [],
+          ...(agent.skills ?? []).flatMap(
+            (skill) => typeof skill === "string" ? [`skill:${skill}`] : skill.type === "custom" ? [`skill:${skill.skill_id}`] : []
+          ),
+          ...agent.vault ? [`vault:${agent.vault}`] : [],
+          ...(agent.memory_stores ?? []).map((store) => `memory_store:${store}`),
+          ...(agent.files ?? []).map((file) => `file:${file}`)
+        ];
+        for (const ref of refs) {
+          const modes = domains.get(ref) ?? /* @__PURE__ */ new Set();
+          modes.add(mode);
+          domains.set(ref, modes);
+        }
+      }
+      for (const [ref, modes] of domains) {
+        if (modes.size < 2) continue;
+        const [type, name] = ref.split(":");
+        diagnostics.error(
+          `qoder.${type}.delivery_domain.conflict`,
+          `${type}.${name}: referenced by both Managed and Forward agents; declare separate resources because Qoder uses different API domains.`,
+          { type, name, provider: providerName }
+        );
+      }
+    }
+    for (const [name, agent] of Object.entries(config.agents ?? {})) {
+      if (agent.provider && agent.provider !== providerName) continue;
+      if (agent.files?.length && (providerName !== "qoder" || agent.delivery?.qoder?.type !== "forward")) {
+        diagnostics.error(
+          "config.agent.files.unsupported",
+          `agent.${name}: files are supported only by Qoder Forward Templates.`,
+          { type: resolveAgentMaterialization(providerName, agent).resourceType, name, provider: providerName }
+        );
+      }
+    }
     for (const [name, agent] of Object.entries(config.agents ?? {})) {
       if (agent.provider && agent.provider !== providerName) continue;
       const delivery = agent.delivery?.[providerName]?.type ?? "managed";
@@ -6871,6 +7455,44 @@ function collectProviderCapabilities(config, providers, diagnostics) {
           address
         );
       }
+      if (delivery !== "forward" && agent.managed_tool_config) {
+        diagnostics.error(
+          `${providerName}.agent.managed_tool_config.forward_required`,
+          `agent.${name}: managed_tool_config applies to Forward Templates; set delivery.${providerName}.type: forward or remove it.`,
+          address
+        );
+      }
+      if (agent.default_memory_store) {
+        if (providerName !== "qoder" || delivery !== "forward") {
+          diagnostics.error(
+            `${providerName}.agent.default_memory_store.forward_required`,
+            `agent.${name}: default_memory_store is supported only by Qoder Forward delivery.`,
+            address
+          );
+        } else if (!config.defaults?.identity) {
+          diagnostics.error(
+            "qoder.template.default_memory_store.identity.required",
+            `agent.${name}: default_memory_store requires defaults.identity to select the owning Forward Identity.`,
+            { type: "template", name, provider: providerName }
+          );
+        } else {
+          const identity = config.identities?.[config.defaults.identity];
+          if (identity?.provider && identity.provider !== providerName) {
+            diagnostics.error(
+              "qoder.template.default_memory_store.identity.provider_mismatch",
+              `agent.${name}: defaults.identity '${config.defaults.identity}' is pinned to provider '${identity.provider}'.`,
+              { type: "template", name, provider: providerName }
+            );
+          }
+          if (agent.default_memory_store.delete_on_destroy && identity?.identity_id) {
+            diagnostics.error(
+              "qoder.template.default_memory_store.delete.external_identity",
+              `agent.${name}: delete_on_destroy requires an OpenCMA-managed Identity because an external Identity keeps the default Memory Store mounted.`,
+              { type: "template", name, provider: providerName }
+            );
+          }
+        }
+      }
       if (delivery === "forward" && !isSupported(caps, "template")) {
         diagnostics.error(
           `${providerName}.agent.delivery.forward.unsupported`,
@@ -6886,10 +7508,10 @@ function collectProviderCapabilities(config, providers, diagnostics) {
             { type: "template", name, provider: providerName }
           );
         }
-        if (agent.memory_stores?.length) {
+        if (agent.memory_stores?.length && !config.defaults?.identity) {
           diagnostics.error(
-            "qoder.template.memory_store.unsupported",
-            `agent.${name}: memory_stores are not yet supported by Qoder Forward Template delivery.`,
+            "qoder.template.memory_store.identity.required",
+            `agent.${name}: Forward memory_stores require defaults.identity for the Identity/Template mount.`,
             { type: "template", name, provider: providerName }
           );
         }
@@ -6923,6 +7545,68 @@ function collectProviderCapabilities(config, providers, diagnostics) {
         }
       }
     }
+    if (providerName === "bailian") {
+      for (const [name, deployment] of Object.entries(config.deployments ?? {})) {
+        if (deployment.provider && deployment.provider !== providerName) continue;
+        const addr = {
+          type: "deployment",
+          name,
+          provider: providerName
+        };
+        if (deployment.initial_events?.some((event) => event.type === "user.define_outcome")) {
+          diagnostics.warning(
+            `${providerName}.deployment.define_outcome_unsupported`,
+            "Outcome rubrics (user.define_outcome) are dropped from the Bailian deployment payload; the run executes without rubric grading.",
+            addr
+          );
+        }
+        if (!deployment.initial_events?.some((event) => event.type === "user.message" || event.type === "system.message")) {
+          diagnostics.error(
+            `${providerName}.deployment.initial_events.message_required`,
+            `deployment.${name}: Bailian requires at least one user.message or system.message initial event; user.define_outcome events are dropped.`,
+            addr
+          );
+        }
+        if (deployment.resources?.some((resource) => resource.type === "github_repository")) {
+          diagnostics.warning(
+            `${providerName}.deployment.github_repository_unsupported`,
+            "Bailian deployment resources accept files only; github_repository resources are dropped. Clone the repository inside the session instead.",
+            addr
+          );
+        }
+        const mountPrefix = providerMountPrefix(providerName);
+        const normalizedMountPaths = /* @__PURE__ */ new Set();
+        for (const resource of deployment.resources ?? []) {
+          if (resource.type !== "file") continue;
+          if (!resource.mount_path?.trim()) {
+            diagnostics.error(
+              `${providerName}.deployment.file.mount_path.required`,
+              `deployment.${name}: Bailian file resources require mount_path.`,
+              addr
+            );
+            continue;
+          }
+          if (mountPrefix && resource.mount_path.startsWith("/") && resource.mount_path !== mountPrefix && !resource.mount_path.startsWith(`${mountPrefix}/`)) {
+            diagnostics.error(
+              `${providerName}.deployment.file.mount_path.invalid`,
+              `deployment.${name}: Bailian file mount_path must start with '${mountPrefix}/'.`,
+              addr
+            );
+            continue;
+          }
+          const normalizedMountPath = resolveSandboxMountPath(providerName, resource.mount_path);
+          if (normalizedMountPaths.has(normalizedMountPath)) {
+            diagnostics.error(
+              `${providerName}.deployment.file.mount_path.duplicate`,
+              `deployment.${name}: Bailian file mount_path '${normalizedMountPath}' is duplicated after normalization.`,
+              addr
+            );
+          } else {
+            normalizedMountPaths.add(normalizedMountPath);
+          }
+        }
+      }
+    }
     if (providerName !== "qoder") {
       for (const [name, env] of Object.entries(config.environments ?? {})) {
         if (env.environment_id) continue;
@@ -6935,6 +7619,20 @@ function collectProviderCapabilities(config, providers, diagnostics) {
         }
       }
       for (const [name, agent] of Object.entries(config.agents ?? {})) {
+        if (agent.environment_variables && (!agent.provider || agent.provider === providerName)) {
+          diagnostics.error(
+            `${providerName}.agent.environment_variables.unsupported`,
+            `agent.${name}: environment_variables is supported only by Qoder; remove it or pin this agent to qoder.`,
+            { type: "agent", name, provider: providerName }
+          );
+        }
+        if (agent.managed_tool_config && (!agent.provider || agent.provider === providerName)) {
+          diagnostics.error(
+            `${providerName}.agent.managed_tool_config.unsupported`,
+            `agent.${name}: managed_tool_config is supported only by Qoder; remove it or pin this agent to qoder.`,
+            { type: "agent", name, provider: providerName }
+          );
+        }
         if (agent.tunnel && (!agent.provider || agent.provider === providerName)) {
           diagnostics.error(
             `${providerName}.agent.tunnel.unsupported`,
@@ -6995,7 +7693,11 @@ function collectProviderCapabilities(config, providers, diagnostics) {
     if (config.deployments && caps.deployment.tier === "emulated") {
       for (const [name, dep] of Object.entries(config.deployments)) {
         if (dep.provider && dep.provider !== providerName) continue;
-        const addr = { type: "deployment", name, provider: providerName };
+        const addr = {
+          type: "deployment",
+          name,
+          provider: providerName
+        };
         if (dep.schedule) {
           diagnostics.warning(
             `${providerName}.deployment.schedule_unsupported`,
@@ -7029,13 +7731,6 @@ function collectProviderCapabilities(config, providers, diagnostics) {
   }
 }
 
-// src/internal/core/agent-materialization.ts
-function resolveAgentMaterialization(provider, agent) {
-  const mode = agent.delivery?.[provider]?.type ?? "managed";
-  if (mode === "managed") return { resourceType: "agent", mode };
-  return { resourceType: "template", mode };
-}
-
 // src/internal/graph/dependency.ts
 function buildDependencyGraph(config, targetProviders) {
   const nodes = /* @__PURE__ */ new Map();
@@ -7103,6 +7798,13 @@ function buildDependencyGraph(config, targetProviders) {
         const materialization = resolveAgentMaterialization(provider, decl);
         const agentAddr = { type: materialization.resourceType, name, provider };
         addNode(agentAddr);
+        if ((decl.default_memory_store || decl.memory_stores?.length) && materialization.resourceType === "template") {
+          const identityName = config.defaults?.identity;
+          if (identityName) {
+            const identityAddr = { type: "identity", name: identityName, provider };
+            if (nodes.has(addressKey(identityAddr))) addEdge(agentAddr, identityAddr);
+          }
+        }
         if (decl.environment && config.environments?.[decl.environment]) {
           const envAddr = {
             type: "environment",
@@ -7129,6 +7831,12 @@ function buildDependencyGraph(config, targetProviders) {
             addEdge(agentAddr, vaultAddr);
           }
         }
+        if (decl.files) {
+          for (const fileName of decl.files) {
+            const fileAddr = { type: "file", name: fileName, provider };
+            if (nodes.has(addressKey(fileAddr))) addEdge(agentAddr, fileAddr);
+          }
+        }
         if (decl.memory_stores) {
           for (const msName of decl.memory_stores) {
             const msAddr = {
@@ -7193,6 +7901,7 @@ function buildDependencyGraph(config, targetProviders) {
         if (decl.provider && decl.provider !== provider) continue;
         const channelAddr = { type: "channel", name, provider };
         addNode(channelAddr);
+        if (decl.mode === "pairing" || !decl.agent) continue;
         const agentDecl = config.agents?.[decl.agent];
         const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
         const agentAddr = { type: agentType, name: decl.agent, provider };
@@ -7254,6 +7963,7 @@ async function buildPlan(config, state, options = {}) {
     const desiredHash = await computeResourceHash(address, config, options.configPath, hashStateLookup);
     const existing = stateIndex.get(key);
     const deps = getDependencies(address, graph);
+    const needsNativeDeploymentMaterialization = address.type === "deployment" && existing?.remote_id === null && getProvider(address.provider)?.capabilities.deployment.tier === "native";
     if (address.type === "environment" && existing) {
       const envDecl = config.environments?.[address.name];
       if (existing.externally_managed && envDecl && !envDecl.environment_id) {
@@ -7305,6 +8015,17 @@ async function buildPlan(config, state, options = {}) {
         after: { content_hash: desiredHash },
         dependencies: deps
       });
+    } else if (needsNativeDeploymentMaterialization) {
+      actions.push({
+        action: "update",
+        address,
+        driftKind: "none",
+        readinessImpact: "blocking",
+        reason: "Materialize legacy state as a native deployment",
+        before: { content_hash: existing.desired_hash ?? existing.content_hash },
+        after: { content_hash: desiredHash },
+        dependencies: deps
+      });
     } else if ((existing.desired_hash ?? existing.content_hash) !== desiredHash && existing.drift_status === "drifted") {
       const changedPaths = collectChangedPaths(address, config, existing, true);
       actions.push({
@@ -7377,8 +8098,62 @@ async function buildPlan(config, state, options = {}) {
       dependencies: replacement ? [replacement] : []
     });
   }
+  coalesceChannelRenames(actions, config, state);
   return { actions, diagnostics: diagnostics.getAll() };
 }
+function coalesceChannelRenames(actions, config, state) {
+  const creates = actions.filter((action) => action.action === "create" && action.address.type === "channel");
+  const deletes = actions.filter((action) => action.action === "delete" && action.address.type === "channel");
+  const stateByAddress = new Map(state.resources.map((resource) => [addressKey(resource.address), resource]));
+  const matchedDeletes = /* @__PURE__ */ new Set();
+  for (const create of creates) {
+    const desiredType = config.channels?.[create.address.name]?.type;
+    if (!desiredType) continue;
+    const desiredFingerprint = computeReplacementFingerprint(create.address, config);
+    const candidates = deletes.filter((deletion2) => {
+      if (matchedDeletes.has(deletion2) || deletion2.address.provider !== create.address.provider) return false;
+      const prior2 = stateByAddress.get(addressKey(deletion2.address));
+      const snapshot = prior2?.remote_snapshot;
+      if (snapshot?.channel_type !== desiredType) return false;
+      return !prior2?.replacement_fingerprint || prior2.replacement_fingerprint === desiredFingerprint;
+    });
+    if (candidates.length !== 1) continue;
+    const deletion = candidates[0];
+    const prior = stateByAddress.get(addressKey(deletion.address));
+    const competingCreates = creates.filter(
+      (candidate) => candidate !== create && candidate.address.provider === create.address.provider && config.channels?.[candidate.address.name]?.type === desiredType && (!prior?.replacement_fingerprint || computeReplacementFingerprint(candidate.address, config) === prior.replacement_fingerprint)
+    );
+    if (competingCreates.length > 0) continue;
+    create.action = "update";
+    create.previousAddress = deletion.address;
+    create.before = deletion.before;
+    create.driftKind = "local";
+    create.reason = `Channel key renamed from '${deletion.address.name}' (remote resource retained)`;
+    protectRenamedChannelDependencies(actions, stateByAddress, deletion, create);
+    matchedDeletes.add(deletion);
+  }
+  for (let index = actions.length - 1; index >= 0; index--) {
+    if (matchedDeletes.has(actions[index])) actions.splice(index, 1);
+  }
+}
+function protectRenamedChannelDependencies(actions, stateByAddress, deletion, replacement) {
+  const prior = stateByAddress.get(addressKey(deletion.address));
+  const snapshot = prior?.remote_snapshot;
+  const referencedIds = new Set(
+    [snapshot?.identity_id, snapshot?.template_id].filter((id) => typeof id === "string")
+  );
+  if (referencedIds.size === 0) return;
+  for (const action of actions) {
+    if (action.action !== "delete" || action.address.type !== "identity" && action.address.type !== "template" || action.address.provider !== replacement.address.provider) {
+      continue;
+    }
+    const dependency = stateByAddress.get(addressKey(action.address));
+    if (!dependency?.remote_id || !referencedIds.has(dependency.remote_id)) continue;
+    if (!action.dependencies.some((address) => addressKey(address) === addressKey(replacement.address))) {
+      action.dependencies.push(replacement.address);
+    }
+  }
+}
 function deliveryReplacementAddress(address, graph) {
   if (address.type !== "agent" && address.type !== "template") return void 0;
   const replacementType = address.type === "agent" ? "template" : "agent";
@@ -7467,7 +8242,7 @@ async function refreshState(state, providers, options = {}) {
         dirty = true;
         continue;
       }
-      const remote = await provider.findResource(res.address.type, res.address.name, res.remote_id);
+      const remote = await provider.findResource(res.address.type, res.address.name, res.remote_id, res.api_mode);
       if (!remote) {
         if (!options.quiet) {
           emitRuntimeFeedback(options.onFeedback, {
@@ -8025,12 +8800,61 @@ function planDestroyProjectContext(ctx) {
   const resources = [...ctx.state.listResources()].sort(
     (a, b) => (destroyOrder[a.address.type] ?? 99) - (destroyOrder[b.address.type] ?? 99)
   );
-  return { resources, executionContext: ctx };
+  const identityName = ctx.config.defaults?.identity;
+  const defaultMemoryStores = [];
+  for (const [agentName, agent] of Object.entries(ctx.config.agents ?? {})) {
+    if (!agent.default_memory_store || agent.delivery?.qoder?.type !== "forward") continue;
+    if (agent.provider && agent.provider !== "qoder") continue;
+    defaultMemoryStores.push({
+      agentName,
+      provider: "qoder",
+      identityId: identityName ? ctx.state.getResource({ type: "identity", name: identityName, provider: "qoder" })?.remote_id ?? null : null,
+      templateId: ctx.state.getResource({ type: "template", name: agentName, provider: "qoder" })?.remote_id ?? null,
+      deleteOnDestroy: agent.default_memory_store.delete_on_destroy ?? false
+    });
+  }
+  for (const pending of ctx.state.getStateFile().pending_default_memory_store_cleanups ?? []) {
+    const existing = defaultMemoryStores.find(
+      (item) => item.agentName === pending.agent_name && item.provider === pending.provider
+    );
+    if (existing) {
+      existing.memoryStoreId = pending.remote_id;
+      existing.deleteOnDestroy = true;
+    } else {
+      defaultMemoryStores.push({
+        agentName: pending.agent_name,
+        provider: pending.provider,
+        identityId: pending.identity_id ?? null,
+        templateId: pending.template_id ?? null,
+        deleteOnDestroy: true,
+        memoryStoreId: pending.remote_id
+      });
+    }
+  }
+  return { resources, defaultMemoryStores, executionContext: ctx };
 }
 async function destroyPlannedProjectResources(planned, options = {}) {
   const results = [];
-  let stateChanged = false;
+  const capturedDefaults = await captureDefaultMemoryStores(planned);
   const ctx = planned.executionContext;
+  if (capturedDefaults.some((item) => item.error)) {
+    const defaultMemoryStoreResults2 = capturedDefaults.map(preflightFailureResult);
+    for (const resource of planned.resources) {
+      const result = {
+        resource,
+        status: "blocked",
+        reason: "skipped",
+        error: "Destroy aborted because the default Memory Store preflight failed."
+      };
+      results.push(result);
+      options.onResourceResult?.(result);
+    }
+    return { ...planned, results, defaultMemoryStoreResults: defaultMemoryStoreResults2, destroyed: 0, partial: true };
+  }
+  if (await persistCapturedDefaultMemoryStores(ctx, capturedDefaults)) {
+    await ctx.state.save();
+  }
+  let stateChanged = false;
   for (const resource of planned.resources) {
     options.onResourceStart?.(resource);
     const result = await destroyOneResource(ctx, resource, options);
@@ -8041,14 +8865,171 @@ async function destroyPlannedProjectResources(planned, options = {}) {
   if (stateChanged) {
     await ctx.state.save();
   }
+  const defaultMemoryStoreResults = await finalizeDefaultMemoryStores(planned, capturedDefaults, options);
+  if (recordFailedDefaultMemoryStoreCleanups(ctx, defaultMemoryStoreResults)) {
+    await ctx.state.save();
+  }
+  if (clearCompletedDefaultMemoryStoreCleanups(ctx, defaultMemoryStoreResults)) {
+    await ctx.state.save();
+  }
   const destroyed = results.filter((result) => result.status === "success").length;
   return {
     ...planned,
     results,
+    defaultMemoryStoreResults,
     destroyed,
-    partial: destroyed !== planned.resources.length
+    partial: destroyed !== planned.resources.length || defaultMemoryStoreResults.some((result) => result.status === "failed")
   };
 }
+async function persistCapturedDefaultMemoryStores(ctx, captured) {
+  const state = ctx.state.getStateFile();
+  if (!state.pending_default_memory_store_cleanups) state.pending_default_memory_store_cleanups = [];
+  const pending = state.pending_default_memory_store_cleanups;
+  let changed = false;
+  for (const item of captured) {
+    if (!item.plan.deleteOnDestroy || !item.memoryStoreId) continue;
+    if (pending.some((entry) => entry.provider === item.plan.provider && entry.remote_id === item.memoryStoreId))
+      continue;
+    pending.push({
+      agent_name: item.plan.agentName,
+      provider: item.plan.provider,
+      remote_id: item.memoryStoreId,
+      ...item.plan.identityId ? { identity_id: item.plan.identityId } : {},
+      ...item.plan.templateId ? { template_id: item.plan.templateId } : {}
+    });
+    changed = true;
+  }
+  return changed;
+}
+function clearCompletedDefaultMemoryStoreCleanups(ctx, results) {
+  const state = ctx.state.getStateFile();
+  const completedIds = new Set(
+    results.filter((item) => item.status === "deleted" || item.status === "already_gone").map((item) => item.memoryStoreId).filter((id) => Boolean(id))
+  );
+  if (completedIds.size === 0 || !state.pending_default_memory_store_cleanups?.length) return false;
+  const remaining = state.pending_default_memory_store_cleanups.filter((item) => !completedIds.has(item.remote_id));
+  if (remaining.length === state.pending_default_memory_store_cleanups.length) return false;
+  state.pending_default_memory_store_cleanups = remaining;
+  return true;
+}
+function recordFailedDefaultMemoryStoreCleanups(ctx, results) {
+  const pending = ctx.state.getStateFile().pending_default_memory_store_cleanups;
+  if (!pending?.length) return false;
+  let changed = false;
+  for (const result of results) {
+    if (result.status !== "failed" || !result.memoryStoreId) continue;
+    const entry = pending.find((item) => item.remote_id === result.memoryStoreId);
+    if (entry && entry.last_error !== result.error) {
+      entry.last_error = result.error;
+      changed = true;
+    }
+  }
+  return changed;
+}
+function preflightFailureResult(item) {
+  if (!item.plan.deleteOnDestroy) return { ...item.plan, status: "retained" };
+  return {
+    ...item.plan,
+    status: "failed",
+    ...item.memoryStoreId ? { memoryStoreId: item.memoryStoreId } : {},
+    error: item.error ?? "Destroy aborted because another default Memory Store preflight failed."
+  };
+}
+async function captureDefaultMemoryStores(planned) {
+  return Promise.all(
+    planned.defaultMemoryStores.map(async (item) => {
+      if (!item.deleteOnDestroy) return { plan: item };
+      if (item.memoryStoreId) return { plan: item, memoryStoreId: item.memoryStoreId };
+      if (!item.identityId || !item.templateId) {
+        return { plan: item, error: "Cannot resolve the Identity and Template before destroy." };
+      }
+      try {
+        const provider = getRuntimeProvider(planned.executionContext, item.provider);
+        if (!provider.findDefaultMemoryStoreId || !provider.deleteDefaultMemoryStore) {
+          return { plan: item, error: `Provider '${item.provider}' cannot delete a default memory store.` };
+        }
+        const memoryStoreId = await provider.findDefaultMemoryStoreId(item.identityId, item.templateId);
+        return { plan: item, ...memoryStoreId ? { memoryStoreId } : {} };
+      } catch (error) {
+        return { plan: item, error: error instanceof Error ? error.message : String(error) };
+      }
+    })
+  );
+}
+async function finalizeDefaultMemoryStores(planned, captured, options) {
+  const output = [];
+  for (const item of captured) {
+    if (!item.plan.deleteOnDestroy) {
+      output.push({ ...item.plan, status: "retained" });
+      continue;
+    }
+    if (item.error) {
+      output.push({ ...item.plan, status: "failed", error: item.error });
+      continue;
+    }
+    if (!item.memoryStoreId) {
+      output.push({ ...item.plan, status: "already_gone" });
+      continue;
+    }
+    try {
+      const provider = getRuntimeProvider(planned.executionContext, item.plan.provider);
+      await deleteDefaultMemoryStoreWithArchiveFallback(
+        provider,
+        item.memoryStoreId,
+        options.defaultMemoryStoreRetryDelaysMs ?? [1e3, 2e3, 4e3, 8e3]
+      );
+      output.push({ ...item.plan, status: "deleted", memoryStoreId: item.memoryStoreId });
+    } catch (error) {
+      if (ApiError.isNotFound(error)) {
+        output.push({ ...item.plan, status: "already_gone", memoryStoreId: item.memoryStoreId });
+      } else {
+        output.push({
+          ...item.plan,
+          status: "failed",
+          memoryStoreId: item.memoryStoreId,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+  }
+  return output;
+}
+async function deleteDefaultMemoryStoreWithArchiveFallback(provider, memoryStoreId, retryDelaysMs) {
+  try {
+    await retryDefaultMemoryStoreOperation(() => provider.deleteDefaultMemoryStore(memoryStoreId), retryDelaysMs);
+  } catch (error) {
+    if (isAlreadyArchivedConflict(error) && provider.deleteMemoryStore) {
+      await retryDefaultMemoryStoreOperation(() => provider.deleteMemoryStore(memoryStoreId), retryDelaysMs);
+      return;
+    }
+    if (!isStillMountedConflict(error) || !provider.archiveMemoryStore || !provider.deleteMemoryStore) throw error;
+    await retryDefaultMemoryStoreOperation(() => provider.archiveMemoryStore(memoryStoreId), retryDelaysMs);
+    await retryDefaultMemoryStoreOperation(() => provider.deleteMemoryStore(memoryStoreId), retryDelaysMs);
+  }
+}
+async function retryDefaultMemoryStoreOperation(operation, delaysMs) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await operation();
+      return;
+    } catch (error) {
+      if (!isRetryableDefaultMemoryStoreError(error) || attempt >= delaysMs.length) throw error;
+      await delay(delaysMs[attempt]);
+    }
+  }
+}
+function isRetryableDefaultMemoryStoreError(error) {
+  return error instanceof ApiError && (isStillMountedConflict(error) || isAlreadyArchivedConflict(error) || error.statusCode === 429 || [500, 502, 503].includes(error.statusCode));
+}
+function isStillMountedConflict(error) {
+  return error instanceof ApiError && error.statusCode === 409 && error.responseBody.includes("still mounted");
+}
+function isAlreadyArchivedConflict(error) {
+  return error instanceof ApiError && error.statusCode === 409 && error.responseBody.toLowerCase().includes("already archived");
+}
+function delay(ms) {
+  return new Promise((resolve13) => setTimeout(resolve13, ms));
+}
 async function destroyOneResource(ctx, resource, options) {
   if (isExternalReference(ctx, resource)) {
     ctx.state.removeResource(resource.address);
@@ -8069,8 +9050,18 @@ async function destroyOneResource(ctx, resource, options) {
     ctx.state.removeResource(resource.address);
     return successResult(resource, "destroyed");
   }
+  const apiMode = resource.api_mode === "auto" ? void 0 : resource.api_mode;
   try {
-    await deleteRemoteResource(provider, resource.address.type, resource.remote_id, options.cascade);
+    await deleteRemoteResource(
+      provider,
+      resource.address.type,
+      resource.remote_id,
+      options.cascade,
+      apiMode,
+      ctx.state.listResources().filter(
+        (candidate) => candidate.address.provider === resource.address.provider && candidate.address.type === "memory_store" && candidate.api_mode === "forward" && typeof candidate.remote_id === "string"
+      ).map((candidate) => candidate.remote_id)
+    );
     ctx.state.removeResource(resource.address);
     emitRuntimeFeedback(options.onFeedback, {
       type: "resource_action_success",
@@ -8099,7 +9090,7 @@ async function destroyOneResource(ctx, resource, options) {
       };
       if (await options.onCascadeRequired?.(blocked)) {
         try {
-          await provider.deleteEnvironment(resource.remote_id, true);
+          await provider.deleteEnvironment(resource.remote_id, true, apiMode);
           ctx.state.removeResource(resource.address);
           return {
             ...successResult(resource, "destroyed"),
@@ -8135,29 +9126,29 @@ function failureResult(resource, error) {
     error: error instanceof Error ? error.message : String(error)
   };
 }
-async function deleteRemoteResource(provider, type, id, cascade) {
+async function deleteRemoteResource(provider, type, id, cascade, mode, ownedMemoryStoreIds = []) {
   switch (type) {
     case "agent":
       await provider.deleteAgent(id);
       return;
     case "template":
       if (!provider.archiveTemplate) throw new UserError(`Provider does not support templates`);
-      await provider.archiveTemplate(id);
+      await provider.archiveTemplate(id, ownedMemoryStoreIds);
       return;
     case "skill":
-      await provider.deleteSkill(id);
+      await provider.deleteSkill(id, mode);
       return;
     case "memory_store":
       if (!provider.deleteMemoryStore) {
         throw new UserError(`Provider does not support memory stores`);
       }
-      await provider.deleteMemoryStore(id);
+      await provider.deleteMemoryStore(id, mode);
       return;
     case "vault":
-      await provider.deleteVault(id);
+      await provider.deleteVault(id, mode);
       return;
     case "environment":
-      await provider.deleteEnvironment(id, cascade);
+      await provider.deleteEnvironment(id, cascade, mode);
       return;
     case "deployment":
       await provider.deleteDeployment(id);
@@ -8171,7 +9162,7 @@ async function deleteRemoteResource(provider, type, id, cascade) {
       await provider.deleteChannel(id);
       return;
     case "file":
-      await provider.deleteFile(id);
+      await provider.deleteFile(id, mode);
       return;
   }
 }
@@ -8374,6 +9365,10 @@ function buildSessionBindings(agentName, config, provider, state, options = {})
     throw new UserError(`Agent '${agentName}' not found in config. Available agents: ${available || "(none)"}`);
   }
   const sessionResources = options.resources ?? agent.resources;
+  const environmentVariables = options.environmentVariables ?? agent.environment_variables;
+  if (environmentVariables && provider !== "qoder") {
+    throw new UserError("Session environment variables are supported only by Qoder.");
+  }
   const providerFeatures = getProvider(provider)?.features;
   for (const resource of sessionResources ?? []) {
     if (!providerFeatures?.session_resources.includes(resource.type)) {
@@ -8402,7 +9397,8 @@ function buildSessionBindings(agentName, config, provider, state, options = {})
       identity_id: identityId,
       files: (options.files ?? []).map((file) => ({ file_id: file.fileId, mount_path: file.mountPath })),
       title: options.title,
-      metadata: options.metadata
+      metadata: options.metadata,
+      environment_variables: environmentVariables
     };
   }
   const agentId = requireRef(state, { type: "agent", name: agentName, provider });
@@ -8447,7 +9443,8 @@ function buildSessionBindings(agentName, config, provider, state, options = {})
     files: (options.files ?? []).map((f) => ({ file_id: f.fileId, mount_path: f.mountPath })),
     resources: sessionResources,
     title: options.title,
-    metadata: options.metadata
+    metadata: options.metadata,
+    environment_variables: environmentVariables
   };
 }
 function resolveTunnelId(agent, config, options, provider) {
@@ -8848,7 +9845,8 @@ async function createSessionForAgent(ctx, options = {}) {
     files: options.files,
     resources: options.resources,
     title: options.title,
-    metadata: options.metadata
+    metadata: options.metadata,
+    environmentVariables: options.environmentVariables
   });
   const session = await adapter2.createSession(bindings);
   return { agentName, provider, session };
@@ -8867,7 +9865,8 @@ async function startSessionRun(ctx, prompt, options = {}) {
     files: options.files,
     resources: options.resources,
     title: options.title,
-    metadata: options.metadata
+    metadata: options.metadata,
+    environmentVariables: options.environmentVariables
   });
   const session = await adapter2.createSession(bindings);
   return {
@@ -8928,7 +9927,7 @@ async function collectEventsUntilTerminal(adapter2, sessionId, options = {}) {
         terminalStatus = terminalEvent.status;
         break;
       }
-      await delay(currentIntervalMs);
+      await delay2(currentIntervalMs);
       currentIntervalMs = Math.min(currentIntervalMs * 2, maxPollIntervalMs);
     }
   } else {
@@ -8939,7 +9938,7 @@ async function collectEventsUntilTerminal(adapter2, sessionId, options = {}) {
         terminalStatus = session.status;
         break;
       }
-      await delay(currentIntervalMs);
+      await delay2(currentIntervalMs);
       currentIntervalMs = Math.min(currentIntervalMs * 2, maxPollIntervalMs);
     }
     result = await adapter2.listSessionEvents(sessionId, { limit: 100 });
@@ -9106,7 +10105,7 @@ async function* streamWithResume(adapter2, sessionId, message) {
       }
     }
     if (!reachedTerminal) {
-      await delay(reconnectIntervalMs);
+      await delay2(reconnectIntervalMs);
       reconnectIntervalMs = Math.min(reconnectIntervalMs * 2, DEFAULT_POLL_INTERVAL_MS);
     }
   }
@@ -9134,7 +10133,7 @@ function assertNotTimedOut(start, timeoutMs) {
     throw new UserError(`Session did not complete within the timeout (${Math.floor(timeoutMs / 1e3)} seconds).`);
   }
 }
-function delay(ms) {
+function delay2(ms) {
   return new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 
@@ -9320,6 +10319,7 @@ var StateManager = class _StateManager {
         address: r.address,
         remote_id: r.remote_id,
         externally_managed: r.externally_managed === true ? true : void 0,
+        api_mode: r.api_mode === "forward" ? "forward" : r.api_mode === "managed" ? "managed" : void 0,
         version: r.version,
         content_hash: r.content_hash ?? r.desired_hash ?? "",
         desired_hash: r.desired_hash ?? r.content_hash ?? "",
@@ -9327,10 +10327,15 @@ var StateManager = class _StateManager {
         desired_readiness_baseline: r.desired_readiness_baseline,
         remote_hash: r.remote_hash,
         remote_snapshot: r.remote_snapshot,
+        replacement_fingerprint: r.replacement_fingerprint,
         drift_paths: r.drift_paths,
         drift_status: r.drift_status
       }));
-      return new _StateManager({ resources }, path);
+      const pending = Array.isArray(data.pending_default_memory_store_cleanups) ? data.pending_default_memory_store_cleanups : void 0;
+      return new _StateManager(
+        { resources, ...pending ? { pending_default_memory_store_cleanups: pending } : {} },
+        path
+      );
     } catch (err) {
       if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
         return _StateManager.initialize(path);
@@ -9528,6 +10533,8 @@ var PlanReadinessImpactSchema = z6.enum(["none", "non_blocking", "blocking"]);
 var PlannedActionSchema = z6.object({
   action: ActionTypeSchema,
   address: ResourceAddressSchema,
+  /** Existing state address to retain when this action is an inferred logical rename. */
+  previousAddress: ResourceAddressSchema.optional(),
   reason: z6.string(),
   driftKind: DriftKindSchema.optional(),
   readinessImpact: PlanReadinessImpactSchema.optional(),