@openagentpack/sdk 0.3.2 → 0.4.0-beta-2472720-20260827

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   toSessionEvent
-} from "./chunk-GAAU67HX.js";
+} from "./chunk-6PDVAFLK.js";
 import {
   defaultFileUploadPurpose,
   enrichProviderFileInfo
@@ -58,10 +58,10 @@ var BaseApiClient = class {
     if (this.isConflict(res.status, body)) throw new ConflictError(res.status, body, this.errorPrefix);
     throw new ApiError(res.status, body, this.errorPrefix);
   }
-  async post(path, body) {
+  async post(path, body, options) {
     const res = await resolveFetch()(`${this.baseUrl}${path}`, {
       method: "POST",
-      headers: this.headers(),
+      headers: { ...this.headers(), ...options?.headers },
       body: JSON.stringify(body)
     });
     await this.throwIfError(res);
@@ -628,6 +628,13 @@ async function listSessionEventsPaged(client, sessionId, options, toEvent, confi
   const params = new URLSearchParams();
   if (options?.limit) params.set("limit", String(options.limit));
   if (options?.order) params.set("order", options.order);
+  if (config?.forwardTypes !== false) {
+    for (const type of options?.types ?? []) params.append("types", type);
+  }
+  if (options?.created_at_gt) params.set("created_at[gt]", options.created_at_gt);
+  if (options?.created_at_gte) params.set("created_at[gte]", options.created_at_gte);
+  if (options?.created_at_lt) params.set("created_at[lt]", options.created_at_lt);
+  if (options?.created_at_lte) params.set("created_at[lte]", options.created_at_lte);
   const pageCursor = options?.page_token ?? options?.page;
   if (pageCursor) params.set("page", pageCursor);
   if (config?.forwardAfterId && options?.after_id) params.set("after_id", options.after_id);
@@ -794,7 +801,8 @@ function toCloudAgent(raw) {
     workspace_id: raw.workspace_id,
     created_at: raw.created_at,
     updated_at: raw.updated_at,
-    archived_at: raw.archived_at ?? null
+    archived_at: raw.archived_at ?? null,
+    attributes: raw
   };
 }
 function toCloudEnvironment(raw) {
@@ -810,7 +818,8 @@ function toCloudEnvironment(raw) {
     workspace_id: raw.workspace_id,
     created_at: raw.created_at,
     updated_at: raw.updated_at,
-    archived_at: raw.archived_at ?? null
+    archived_at: raw.archived_at ?? null,
+    attributes: raw
   };
 }
 function toCloudVault(raw) {
@@ -821,7 +830,8 @@ function toCloudVault(raw) {
     type: raw.type,
     created_at: raw.created_at ?? null,
     updated_at: raw.updated_at ?? null,
-    archived_at: raw.archived_at ?? null
+    archived_at: raw.archived_at ?? null,
+    attributes: raw
   };
 }
 function toRestFileInfo(res) {
@@ -833,7 +843,9 @@ function toRestFileInfo(res) {
     created_at: res.created_at,
     downloadable: res.downloadable,
     status: res.status,
-    purpose: res.purpose
+    purpose: res.purpose,
+    scope: res.scope,
+    attributes: res
   };
 }
 function toRestSkillInfo(res) {
@@ -846,7 +858,8 @@ function toRestSkillInfo(res) {
     status: "active",
     latest_version: res.latest_version,
     created_at: res.created_at,
-    updated_at: res.updated_at
+    updated_at: res.updated_at,
+    attributes: res
   };
 }
 
@@ -1238,7 +1251,7 @@ function mapAgent(name, decl, refs, version, projectName) {
     }
   }
   const body = {
-    name,
+    name: decl.name ?? name,
     model: modelValue,
     system: decl.instructions
   };
@@ -2059,6 +2072,13 @@ function mapEnvironment2(name, decl, projectName) {
     metadata: injectMetadata(decl.metadata, projectName, name)
   };
 }
+function mapForwardEnvironment(name, decl, projectName) {
+  const body = mapEnvironment2(name, decl, projectName);
+  const config = { ...body.config };
+  delete config.networking;
+  body.config = config;
+  return body;
+}
 function mapVault(name, decl, projectName) {
   const body = { display_name: decl.display_name };
   if (projectName) body.metadata = injectMetadata(decl.metadata, projectName, name);
@@ -2176,6 +2196,7 @@ function agentToDecl2(raw) {
     }));
   }
   return compactDeep({
+    name: raw.name,
     description: raw.description,
     model: raw.model,
     instructions: raw.system,
@@ -2300,7 +2321,7 @@ function mapAgent2(name, decl, refs, version, projectName) {
     model = typeof qoderModel === "string" ? qoderModel : qoderModel.id;
   }
   const body = {
-    name,
+    name: decl.name ?? name,
     model,
     system: decl.instructions
   };
@@ -2373,10 +2394,12 @@ function mapForwardTemplate(name, decl, refs, projectName) {
     environment_id: refs.environment_id,
     vault_ids: refs.vault_ids
   };
+  body.files = Object.fromEntries((refs.file_ids ?? []).map((id) => [id, { enabled: true }]));
   if (refs.tunnel_id) body.tunnel_id = refs.tunnel_id;
   if (projectName) body.metadata = injectMetadata(decl.metadata, projectName, name);
   else body.metadata = decl.metadata ?? {};
   if (decl.environment_variables) body.environment_variables = decl.environment_variables;
+  if (decl.managed_tool_config) body.managed_tool_config = decl.managed_tool_config;
   if (decl.tools) {
     body.tools = [
       {
@@ -2565,6 +2588,7 @@ var QoderAdapter = class _QoderAdapter {
   client;
   memoryApi;
   forwardClient;
+  forwardMemoryApi;
   projectName;
   forwardSessionIds = /* @__PURE__ */ new Set();
   constructor(apiKey, gateway, projectName, forwardGateway) {
@@ -2586,6 +2610,19 @@ var QoderAdapter = class _QoderAdapter {
       apiKey,
       gateway: forwardGateway ?? deriveForwardGateway(gateway)
     });
+    this.forwardMemoryApi = new ProviderMemoryApi(this.forwardClient, {
+      pathStyle: "relative",
+      cursorParam: "after_id",
+      updatePrecondition: "content_sha256",
+      prefixParam: "prefix",
+      versionsSegment: "versions",
+      storeMetadataMode: "merge_patch",
+      supportsView: false,
+      supportsMemoryMetadata: true,
+      supportsPathUpdate: false,
+      supportsDeletePrecondition: false,
+      supportsIncludeArchived: true
+    });
     this.projectName = projectName ?? "";
   }
   async validate() {
@@ -2600,7 +2637,7 @@ var QoderAdapter = class _QoderAdapter {
     file: "/files",
     deployment: "/deployments"
   };
-  async findResource(type, name, id) {
+  async findResource(type, name, id, mode) {
     if (type === "template") {
       const raw2 = await locateRemote(this.forwardClient, "/templates", name, id, (item) => item.status !== "archived");
       return raw2 ? toRemoteResource(raw2) : null;
@@ -2620,7 +2657,14 @@ var QoderAdapter = class _QoderAdapter {
       const raw2 = await locateRemote(this.forwardClient, "/channels", name, id, () => true);
       return raw2 ? toRemoteResource(raw2) : null;
     }
-    const raw = await locateRemote(this.client, _QoderAdapter.ENDPOINT_MAP[type], name, id, notArchived);
+    if (type === "environment" && id && mode === "auto") {
+      const managed = await locateRemote(this.client, "/environments", name, id, notArchived);
+      if (managed) return toRemoteResource(managed);
+      const forward = await locateRemote(this.forwardClient, "/environments", name, id, notArchived);
+      return forward ? toRemoteResource(forward) : null;
+    }
+    const client = mode === "forward" && (type === "environment" || type === "skill" || type === "vault" || type === "memory_store" || type === "file") ? this.forwardClient : this.client;
+    const raw = await locateRemote(client, _QoderAdapter.ENDPOINT_MAP[type], name, id, notArchived);
     return raw ? toRemoteResource(raw) : null;
   }
   async listAgents(filter) {
@@ -2764,18 +2808,24 @@ var QoderAdapter = class _QoderAdapter {
     }
     if (type === "channel") {
       const channelConfig = raw.channel_config ?? {};
-      return compactDeep({
-        identity_id: raw.identity_id,
-        template_id: raw.template_id,
+      const mode = raw.identity_resolution?.mode ?? "fixed";
+      const normalized = {
+        identity_resolution: { mode },
         channel_type: raw.channel_type,
         name: raw.name,
         enabled: raw.enabled,
         channel_config: {
           response_options: channelConfig.response_options ?? {}
         }
-      });
+      };
+      if (mode === "fixed") {
+        normalized.identity_id = raw.identity_id;
+        normalized.template_id = raw.template_id;
+      }
+      return compactDeep(normalized);
     }
     return compactDeep({
+      name: raw.name,
       description: raw.description,
       model: normalizeModel(raw.model),
       instructions: raw.system,
@@ -2784,24 +2834,41 @@ var QoderAdapter = class _QoderAdapter {
       metadata: stripAgentsMetadata(raw.metadata)
     });
   }
-  async createEnvironment(name, decl) {
-    const body = mapEnvironment2(name, decl, this.projectName);
-    const res = await this.client.post("/environments", body);
+  async createEnvironment(name, decl, mode = "managed") {
+    const body = mode === "forward" ? mapForwardEnvironment(name, decl, this.projectName) : mapEnvironment2(name, decl, this.projectName);
+    const res = await (mode === "forward" ? this.forwardClient : this.client).post("/environments", body);
     return toRemoteResource(res);
   }
-  async updateEnvironment(id, name, decl) {
-    const body = mapEnvironment2(name, decl, this.projectName);
-    const current = await this.client.get(`/environments/${id}`);
+  async updateEnvironment(id, name, decl, mode = "managed") {
+    const body = mode === "forward" ? mapForwardEnvironment(name, decl, this.projectName) : mapEnvironment2(name, decl, this.projectName);
+    const client = mode === "forward" ? this.forwardClient : this.client;
+    const current = await client.get(`/environments/${id}`);
     const currentMetadata = current.metadata ?? {};
     const metadata = { ...body.metadata ?? {} };
     for (const key of Object.keys(currentMetadata)) {
       if (!key.startsWith("agents.") && !(key in metadata)) metadata[key] = null;
     }
     body.metadata = metadata;
-    const res = await this.client.post(`/environments/${id}`, body);
+    const res = await client.post(`/environments/${id}`, body);
     return toRemoteResource(res);
   }
-  async deleteEnvironment(id, cascade = false) {
+  async deleteEnvironment(id, cascade = false, mode = "managed") {
+    if (mode === "forward") {
+      try {
+        await this.forwardClient.delete(`/environments/${id}`);
+        return;
+      } catch (err) {
+        const isConflict = err instanceof ApiError && (err.statusCode === 409 || err.responseBody.includes("in use"));
+        if (!isConflict) throw err;
+        if (!cascade) {
+          throw new UserError(
+            `Environment ${id} is referenced by one or more Forward sessions. Use --cascade to archive the environment.`
+          );
+        }
+        await this.forwardClient.post(`/environments/${id}/archive`, {});
+        return;
+      }
+    }
     try {
       await this.client.delete(`/environments/${id}`);
       return;
@@ -2828,17 +2895,18 @@ var QoderAdapter = class _QoderAdapter {
       await this.client.post(`/environments/${id}/archive`, {});
     }
   }
-  async createVault(name, decl) {
+  async createVault(name, decl, mode = "managed") {
+    const client = mode === "forward" ? this.forwardClient : this.client;
     const body = mapVault(name, decl, this.projectName);
-    const res = await this.client.post("/vaults", body);
+    const res = await client.post("/vaults", body);
     const vaultId = res.id;
     for (const cred of decl.credentials ?? []) {
-      await this.client.post(`/vaults/${vaultId}/credentials`, mapCredential(cred));
+      await client.post(`/vaults/${vaultId}/credentials`, mapCredential(cred));
     }
     return toRemoteResource(res);
   }
-  async deleteVault(id) {
-    await this.client.delete(`/vaults/${id}`);
+  async deleteVault(id, mode = "managed") {
+    await (mode === "forward" ? this.forwardClient : this.client).delete(`/vaults/${id}`);
   }
   async exportResources(type) {
     return exportRemoteResources(this.client, type, {
@@ -2849,17 +2917,24 @@ var QoderAdapter = class _QoderAdapter {
       agentToDecl: agentToDecl2
     });
   }
-  async createSkill(name, decl, files) {
+  async createSkill(name, decl, files, mode = "managed") {
     const formData = await buildSkillFormData(name, decl, files);
-    const res = await this.client.postFormData("/skills", formData);
+    const res = await (mode === "forward" ? this.forwardClient : this.client).postFormData(
+      "/skills",
+      formData
+    );
     return toRemoteResource(res);
   }
-  async updateSkill(id, name, decl, files) {
-    await this.client.delete(`/skills/${id}`);
-    return this.createSkill(name, decl, files);
+  async updateSkill(id, name, decl, files, mode = "managed") {
+    const client = mode === "forward" ? this.forwardClient : this.client;
+    const packageName = skillNameFromFiles(files) ?? name;
+    const formData = await buildSkillFormData(packageName, decl, files, "files", false, true);
+    await client.postFormData(`/skills/${id}/versions`, formData);
+    const current = await client.get(`/skills/${id}`);
+    return toRemoteResource(current);
   }
-  async deleteSkill(id) {
-    await this.client.delete(`/skills/${id}`);
+  async deleteSkill(id, mode = "managed") {
+    await (mode === "forward" ? this.forwardClient : this.client).delete(`/skills/${id}`);
   }
   async createAgent(name, decl, refs) {
     const body = mapAgent2(name, decl, refs, void 0, this.projectName);
@@ -2876,21 +2951,89 @@ var QoderAdapter = class _QoderAdapter {
     await this.client.delete(`/agents/${id}`);
   }
   async createTemplate(name, decl, refs) {
-    await this.registerForwardVaults(refs.vault_ids);
     const body = mapForwardTemplate(name, decl, refs, this.projectName);
     const res = await this.forwardClient.post("/templates", body);
+    await this.reconcileForwardMemoryMounts(res.id, refs);
     return toRemoteResource(res);
   }
   async updateTemplate(id, name, decl, refs) {
-    await this.registerForwardVaults(refs.vault_ids);
     const body = mapForwardTemplate(name, decl, refs, this.projectName);
     if (!refs.tunnel_id) body.tunnel_id = null;
     const res = await this.forwardClient.post(`/templates/${id}`, body);
+    await this.reconcileForwardMemoryMounts(id, refs);
     return toRemoteResource(res);
   }
-  async archiveTemplate(id) {
+  async archiveTemplate(id, ownedMemoryStoreIds = []) {
+    const owned = new Set(ownedMemoryStoreIds);
+    if (owned.size > 0) {
+      for (const identity of await this.forwardClient.getAllPaged("/identities")) {
+        if (typeof identity.id !== "string") continue;
+        const path = `/identities/${identity.id}/templates/${id}/memory_stores`;
+        try {
+          const mounts = await this.forwardClient.get(path);
+          for (const mount of mounts.data ?? []) {
+            const storeId = mount.memory_store_id;
+            if (mount.system_managed !== true && typeof storeId === "string" && owned.has(storeId)) {
+              await this.forwardClient.delete(`${path}/${storeId}`);
+            }
+          }
+        } catch (error) {
+          if (!ApiError.isNotFound(error)) throw error;
+        }
+      }
+    }
     await this.forwardClient.post(`/templates/${id}/archive`, {});
   }
+  async reconcileForwardMemoryMounts(templateId, refs) {
+    if (refs.memory_store_ids === void 0) return;
+    const desired = new Set(refs.memory_store_ids ?? []);
+    if (!refs.identity_id) {
+      if (desired.size > 0) throw new UserError("Qoder Forward Memory Store mounts require an Identity.");
+      return;
+    }
+    const path = `/identities/${refs.identity_id}/templates/${templateId}/memory_stores`;
+    const current = await this.forwardClient.get(path);
+    const explicit = (current.data ?? []).filter((mount) => mount.system_managed !== true);
+    const owned = new Set(refs.owned_memory_store_ids ?? refs.memory_store_ids ?? []);
+    for (const mount of explicit) {
+      const storeId = mount.memory_store_id;
+      if (typeof storeId === "string" && owned.has(storeId) && !desired.has(storeId)) {
+        await this.forwardClient.delete(`${path}/${storeId}`);
+      }
+    }
+    const mounted = new Set(
+      explicit.map((mount) => mount.memory_store_id).filter((id) => typeof id === "string")
+    );
+    for (const memoryStoreId of desired) {
+      if (!mounted.has(memoryStoreId)) await this.forwardClient.post(path, { memory_store_id: memoryStoreId });
+    }
+  }
+  async reconcileDefaultMemoryStore(identityId, templateId, desired) {
+    const storeId = await this.findDefaultMemoryStoreId(identityId, templateId);
+    if (!storeId) return { status: "pending" };
+    const current = await this.forwardClient.get(`/memory_stores/${storeId}`);
+    const descriptionChanged = desired.description !== void 0 && current.description !== desired.description;
+    if (current.name === desired.name && !descriptionChanged) {
+      return { status: "unchanged", memory_store_id: storeId };
+    }
+    await this.forwardClient.post(`/memory_stores/${storeId}`, {
+      name: desired.name,
+      ...desired.description !== void 0 ? { description: desired.description } : {}
+    });
+    return { status: "updated", memory_store_id: storeId };
+  }
+  async findDefaultMemoryStoreId(identityId, templateId) {
+    const mounts = await this.forwardClient.get(
+      `/identities/${identityId}/templates/${templateId}/memory_stores`
+    );
+    const writableDefault = (mounts.data ?? []).find(
+      (mount) => mount.system_managed === true && mount.access === "read_write"
+    );
+    return typeof writableDefault?.memory_store_id === "string" ? writableDefault.memory_store_id : null;
+  }
+  async deleteDefaultMemoryStore(id) {
+    await this.client.delete(`/memory_stores/${id}`);
+  }
   async createIdentity(name, decl) {
     if (decl.identity_id) return { id: decl.identity_id, type: "identity" };
     const res = await this.forwardClient.post("/identities", {
@@ -2927,12 +3070,14 @@ var QoderAdapter = class _QoderAdapter {
   }
   async updateChannel(id, name, decl, refs) {
     const current = await this.forwardClient.get(`/channels/${id}`);
-    if (current.channel_type !== decl.type) {
+    const currentMode = current.identity_resolution?.mode ?? "fixed";
+    if (current.channel_type !== decl.type || currentMode !== (decl.mode ?? "fixed")) {
       await this.deleteChannel(id);
       return this.createChannel(name, decl, refs);
     }
     const body = this.mapChannel(name, decl, refs);
     delete body.channel_type;
+    delete body.identity_resolution;
     const res = await this.forwardClient.post(`/channels/${id}`, body);
     return toRemoteResource(res);
   }
@@ -2940,9 +3085,8 @@ var QoderAdapter = class _QoderAdapter {
     await this.forwardClient.delete(`/channels/${id}`);
   }
   mapChannel(name, decl, refs) {
-    return {
-      identity_id: refs.identity_id,
-      template_id: refs.agent_id,
+    const mode = decl.mode ?? "fixed";
+    const body = {
       channel_type: decl.type,
       name: decl.name ?? name,
       enabled: decl.enabled ?? true,
@@ -2955,22 +3099,27 @@ var QoderAdapter = class _QoderAdapter {
         }
       }
     };
-  }
-  async registerForwardVaults(vaultIds) {
-    for (const id of vaultIds) {
-      await this.forwardClient.post("/resources/registry", {
-        type: "vault",
-        resource: { id }
-      });
+    if (mode === "pairing") {
+      body.identity_resolution = { mode: "pairing" };
+    } else {
+      body.identity_id = refs.identity_id;
+      body.template_id = refs.agent_id;
     }
+    return body;
   }
-  async createMemoryStore(name, decl) {
+  async createMemoryStore(name, decl, mode = "managed") {
     const body = mapMemoryStore2(name, decl);
-    const res = await this.client.post("/memory_stores", body);
+    const client = mode === "forward" ? this.forwardClient : this.client;
+    const memoryApi = mode === "forward" ? this.forwardMemoryApi : this.memoryApi;
+    const res = await client.post(
+      "/memory_stores",
+      body,
+      mode === "forward" ? { headers: { "Idempotency-Key": crypto.randomUUID() } } : void 0
+    );
     const storeId = res.id;
     try {
       for (const entry of decl.entries ?? []) {
-        await this.memoryApi.createMemory(storeId, { content: entry.content, path: entry.key });
+        await memoryApi.createMemory(storeId, { content: entry.content, path: entry.key });
       }
     } catch (error) {
       await this.client.delete(`/memory_stores/${storeId}`).catch(() => void 0);
@@ -2978,7 +3127,7 @@ var QoderAdapter = class _QoderAdapter {
     }
     return toRemoteResource(res);
   }
-  async deleteMemoryStore(id) {
+  async deleteMemoryStore(id, _mode = "managed") {
     await this.client.delete(`/memory_stores/${id}`);
   }
   listMemoryStores(options) {
@@ -2987,23 +3136,23 @@ var QoderAdapter = class _QoderAdapter {
   getMemoryStore(id) {
     return this.memoryApi.getStore(id);
   }
-  updateMemoryStore(id, input) {
-    return this.memoryApi.updateStore(id, input);
+  updateMemoryStore(id, input, mode = "managed") {
+    return (mode === "forward" ? this.forwardMemoryApi : this.memoryApi).updateStore(id, input);
   }
   archiveMemoryStore(id) {
     return this.memoryApi.archiveStore(id);
   }
-  createMemory(storeId, input) {
-    return this.memoryApi.createMemory(storeId, input);
+  createMemory(storeId, input, mode = "managed") {
+    return (mode === "forward" ? this.forwardMemoryApi : this.memoryApi).createMemory(storeId, input);
   }
-  listMemories(storeId, options) {
-    return this.memoryApi.listMemories(storeId, options);
+  listMemories(storeId, options, mode = "managed") {
+    return (mode === "forward" ? this.forwardMemoryApi : this.memoryApi).listMemories(storeId, options);
   }
   getMemory(storeId, memoryId) {
     return this.memoryApi.getMemory(storeId, memoryId);
   }
-  updateMemory(storeId, memoryId, input) {
-    return this.memoryApi.updateMemory(storeId, memoryId, input);
+  updateMemory(storeId, memoryId, input, mode = "managed") {
+    return (mode === "forward" ? this.forwardMemoryApi : this.memoryApi).updateMemory(storeId, memoryId, input);
   }
   deleteMemory(storeId, memoryId, expected) {
     return this.memoryApi.deleteMemory(storeId, memoryId, expected);
@@ -3292,30 +3441,42 @@ var QoderAdapter = class _QoderAdapter {
     return res.data;
   }
   // --- Files ---
-  async uploadFile(filePath, options) {
+  async uploadFile(filePath, options, mode = "managed") {
+    if (mode === "forward" && options?.purpose && !["user_upload", "session_resource"].includes(options.purpose)) {
+      throw new UserError(
+        `Qoder Forward File purpose must be 'user_upload' or 'session_resource', got '${options.purpose}'.`
+      );
+    }
     const resolved = resolve2(filePath);
     const content = readFileSync2(resolved);
     const fileName = options?.name ?? basename2(resolved);
-    return this.uploadFileContent(new Uint8Array(content), fileName, {
-      purpose: options?.purpose
-    });
+    const formData = buildFileFormData(new Uint8Array(content), fileName, { purpose: options?.purpose });
+    const res = await (mode === "forward" ? this.forwardClient : this.client).postFormData(
+      "/files",
+      formData
+    );
+    return toRestFileInfo(res);
   }
   async uploadFileContent(content, filename, options) {
-    const formData = new FormData();
-    const bytes = new Uint8Array(content);
-    formData.append(
-      "file",
-      options?.mimeType ? new File([bytes], filename, { type: options.mimeType }) : new File([bytes], filename)
-    );
-    if (filename) formData.append("name", filename);
-    if (options?.purpose) formData.append("purpose", options.purpose);
+    const formData = buildFileFormData(content, filename, options);
     const res = await this.client.postFormData("/files", formData);
     return toRestFileInfo(res);
   }
-  async deleteFile(id) {
-    await this.client.delete(`/files/${id}`);
+  async deleteFile(id, mode = "managed") {
+    await (mode === "forward" ? this.forwardClient : this.client).delete(`/files/${id}`);
   }
 };
+function buildFileFormData(content, filename, options) {
+  const formData = new FormData();
+  const bytes = new Uint8Array(content);
+  formData.append(
+    "file",
+    options?.mimeType ? new File([bytes], filename, { type: options.mimeType }) : new File([bytes], filename)
+  );
+  if (filename) formData.append("name", filename);
+  if (options?.purpose) formData.append("purpose", options.purpose);
+  return formData;
+}
 function toSessionInfo2(res) {
   return buildSessionInfo(res, (r) => r.memory_store_ids ?? []);
 }
@@ -3365,22 +3526,24 @@ function normalizeQoderMcpServers(value) {
     });
   });
 }
-async function buildSkillFormData(name, decl, files) {
+async function buildSkillFormData(name, decl, files, fileField = "file", includeCreateFields = true, prefixTopLevelDirectory = false) {
   const zip = new JSZip2();
   for (const f of files) {
-    zip.file(f.relativePath, f.content);
+    zip.file(prefixTopLevelDirectory ? `${name}/${f.relativePath}` : f.relativePath, f.content);
   }
   const zipContent = await zip.generateAsync({ type: "uint8array" });
   const formData = new FormData();
   formData.append(
-    "file",
+    fileField,
     new File([new Uint8Array(zipContent)], `${name}.zip`, {
       type: "application/zip"
     })
   );
-  formData.append("name", name);
-  formData.append("type", "custom");
-  if (decl.description) formData.append("description", decl.description);
+  if (includeCreateFields) {
+    formData.append("name", name);
+    formData.append("type", "custom");
+    if (decl.description) formData.append("description", decl.description);
+  }
   return formData;
 }
 
@@ -3495,7 +3658,7 @@ function mapVault2(name, decl, projectName) {
 }
 function mapCredential2(cred) {
   if (cred.type === "environment_variable") {
-    return {
+    const body2 = {
       auth: {
         type: "environment_variable",
         secret_name: cred.secret_name,
@@ -3504,8 +3667,10 @@ function mapCredential2(cred) {
       },
       display_name: cred.name
     };
+    if (cred.metadata) body2.metadata = cred.metadata;
+    return body2;
   }
-  return {
+  const body = {
     auth: {
       type: cred.type,
       token: cred.access_token,
@@ -3513,6 +3678,8 @@ function mapCredential2(cred) {
     },
     display_name: cred.name
   };
+  if (cred.metadata) body.metadata = cred.metadata;
+  return body;
 }
 function credToDecl3(raw, vaultName) {
   const auth = raw.auth ?? {};
@@ -3522,6 +3689,7 @@ function credToDecl3(raw, vaultName) {
     return {
       name,
       type: "static_bearer",
+      metadata: stripAgentsMetadata(raw.metadata),
       mcp_server_url: auth.mcp_server_url ?? "",
       access_token: placeholder
     };
@@ -3530,6 +3698,7 @@ function credToDecl3(raw, vaultName) {
   return {
     name,
     type: "environment_variable",
+    metadata: stripAgentsMetadata(raw.metadata),
     secret_name: auth.secret_name ?? name,
     secret_value: placeholder,
     networking: networking ?? { type: "unrestricted" }
@@ -3597,6 +3766,7 @@ function agentToDecl3(raw) {
   const model = raw.model;
   const modelValue = typeof model === "object" && model ? model.id : model;
   return compactDeep({
+    name: raw.name,
     description: raw.description,
     model: modelValue,
     instructions: raw.system,
@@ -3616,7 +3786,7 @@ function mapAgent3(name, decl, refs, version, projectName, skillVersions) {
     modelId = typeof bailianModel === "string" ? bailianModel : bailianModel.id;
   }
   const body = {
-    name,
+    name: decl.name ?? name,
     model: { id: modelId },
     system: decl.instructions
   };
@@ -3709,7 +3879,7 @@ function mapDeployment3(name, decl, refs, projectName, uploadedFiles) {
   const agent = { id: refs.agent_id };
   if (refs.agent_version !== void 0) agent.version = refs.agent_version;
   const body = {
-    name,
+    name: decl.name ?? name,
     agent,
     environment_id: refs.environment_id,
     initial_events: mapMessageEvents(decl.initial_events)
@@ -3847,6 +4017,7 @@ var BailianAdapter = class _BailianAdapter {
       });
     }
     return compactDeep({
+      name: raw.name,
       description: raw.description,
       model: normalizeBailianModel(raw.model),
       instructions: raw.system,
@@ -3878,6 +4049,18 @@ var BailianAdapter = class _BailianAdapter {
   async deleteEnvironment(id) {
     await this.client.delete(`/environments/${id}`);
   }
+  async listEnvironmentResources(options) {
+    const params = cursorParams(options);
+    if (options?.include_archived !== void 0) {
+      params.set("include_archived", String(options.include_archived));
+    }
+    const res = await this.client.get(withQuery("/environments", params));
+    return cursorPage(res, toCloudEnvironment);
+  }
+  async getRemoteEnvironment(id) {
+    const res = await this.client.get(`/environments/${id}`);
+    return toCloudEnvironment(res);
+  }
   // --- Agent ---
   async createAgent(name, decl, refs) {
     const skillVersions = await this.fetchSkillVersions(refs);
@@ -3926,6 +4109,25 @@ var BailianAdapter = class _BailianAdapter {
   async deleteAgent(id) {
     await this.client.post(`/agents/${id}/archive`, {});
   }
+  async listAgentResources(options) {
+    const params = cursorParams(options);
+    if (options?.include_archived !== void 0) {
+      params.set("include_archived", String(options.include_archived));
+    }
+    const res = await this.client.get(withQuery("/agents", params));
+    return cursorPage(res, toCloudAgent);
+  }
+  async getRemoteAgent(id, version) {
+    const params = new URLSearchParams();
+    if (version !== void 0) params.set("version", String(version));
+    const res = await this.client.get(withQuery(`/agents/${id}`, params));
+    return toCloudAgent(res);
+  }
+  async listAgentVersions(id, options) {
+    const params = cursorParams(options);
+    const res = await this.client.get(withQuery(`/agents/${id}/versions`, params));
+    return cursorPage(res, toCloudAgent);
+  }
   // --- Skill (2-step: Files API → Skills API) ---
   async createSkill(name, decl, files) {
     const fileId = await this.uploadSkillZip(name, decl, files);
@@ -4024,10 +4226,31 @@ var BailianAdapter = class _BailianAdapter {
     const all = await this.client.getAllPaged(path);
     return all.map(toBailianSkillInfo);
   }
+  async listSkillResources(options) {
+    const params = cursorParams(options);
+    if (options?.source === "official") params.set("source", "official");
+    if (options?.source === "custom") params.set("source", "customer");
+    const res = await this.client.get(withQuery("/skills", params));
+    return cursorPage(res, toBailianSkillInfo);
+  }
   async getSkillInfo(id) {
     const res = await this.client.get(`/skills/${id}`);
     return toBailianSkillInfo(res);
   }
+  async listSkillVersions(id, options) {
+    const params = cursorParams(options);
+    const res = await this.client.get(withQuery(`/skills/${id}/versions`, params));
+    return cursorPage(res, toSkillVersionInfo);
+  }
+  async getSkillVersion(id, version) {
+    const res = await this.client.get(`/skills/${id}/versions/${encodeURIComponent(version)}`);
+    return toSkillVersionInfo(res);
+  }
+  async getSkillDownloadInfo(id, version) {
+    return await this.client.get(
+      `/skills/${id}/versions/${encodeURIComponent(version)}/content`
+    );
+  }
   // Non-blocking create: file already uploaded → POST /skills with retry for residual OSS
   // replication lag (postSkillWithRetry covers SKILL_FILE_NOT_FOUND for a few seconds), and return
   // the initial status WITHOUT waiting for the security scan. Callers MUST ensure the file has
@@ -4057,7 +4280,7 @@ var BailianAdapter = class _BailianAdapter {
   }
   async waitForFileReady(fileId) {
     const start = Date.now();
-    let delay2 = FILE_SCAN_BACKOFF.initial;
+    let delay3 = FILE_SCAN_BACKOFF.initial;
     let logged = false;
     while (true) {
       const detail = await this.client.get(`/files/${fileId}`);
@@ -4076,8 +4299,8 @@ var BailianAdapter = class _BailianAdapter {
         );
         return;
       }
-      await new Promise((r) => setTimeout(r, delay2));
-      delay2 = Math.min(delay2 * FILE_SCAN_BACKOFF.factor, FILE_SCAN_BACKOFF.max);
+      await new Promise((r) => setTimeout(r, delay3));
+      delay3 = Math.min(delay3 * FILE_SCAN_BACKOFF.factor, FILE_SCAN_BACKOFF.max);
     }
   }
   // --- Vault (Vaults API) ---
@@ -4099,6 +4322,18 @@ var BailianAdapter = class _BailianAdapter {
     const all = await this.client.getAllPaged("/vaults");
     return all.map(toCloudVault);
   }
+  async listVaultResources(options) {
+    const params = cursorParams(options);
+    if (options?.include_archived !== void 0) {
+      params.set("include_archived", String(options.include_archived));
+    }
+    const res = await this.client.get(withQuery("/vaults", params));
+    return cursorPage(res, toCloudVault);
+  }
+  async getRemoteVault(id) {
+    const res = await this.client.get(`/vaults/${id}`);
+    return toCloudVault(res);
+  }
   async getVault(id) {
     return await this.client.get(`/vaults/${id}`);
   }
@@ -4120,7 +4355,21 @@ var BailianAdapter = class _BailianAdapter {
   }
   async listCredentials(vaultId) {
     const all = await this.client.getAllPaged(`/vaults/${vaultId}/credentials`);
-    return all.map(toRemoteResource);
+    return all.map((raw) => {
+      const auth = raw.auth ?? {};
+      const networking = auth.networking;
+      const metadata = raw.metadata;
+      return {
+        id: raw.id,
+        display_name: raw.display_name ?? raw.id,
+        auth_type: auth.type ?? "",
+        secret_name: auth.secret_name,
+        networking_type: networking?.type,
+        metadata: metadata ? Object.fromEntries(
+          Object.entries(metadata).filter((entry) => typeof entry[1] === "string")
+        ) : void 0
+      };
+    });
   }
   async getCredential(vaultId, credentialId) {
     return await this.client.get(`/vaults/${vaultId}/credentials/${credentialId}`);
@@ -4170,11 +4419,7 @@ var BailianAdapter = class _BailianAdapter {
       throw new UserError(`Deployment '${ctx.name}' has no remote id; run \`agents apply\` first.`);
     }
     const res = await this.client.post(`/deployments/${ctx.id}/run`, {});
-    return {
-      run_id: res.id,
-      session_id: res.session_id ?? null,
-      error: res.error ?? void 0
-    };
+    return toDeploymentRunResult(res);
   }
   async getDeployment(ctx) {
     if (!ctx.id) {
@@ -4186,6 +4431,7 @@ var BailianAdapter = class _BailianAdapter {
   async listDeployments(filter) {
     const params = new URLSearchParams();
     if (filter?.agent_id) params.set("agent_id", filter.agent_id);
+    if (filter?.keyword) params.set("keyword", filter.keyword);
     if (filter?.status) params.set("status", filter.status);
     if (filter?.include_archived) params.set("include_archived", "true");
     if (filter?.limit) params.set("limit", String(filter.limit));
@@ -4201,6 +4447,32 @@ var BailianAdapter = class _BailianAdapter {
       next_page: nextPage
     };
   }
+  async getDeploymentById(id) {
+    const res = await this.client.get(`/deployments/${id}`);
+    return toDeploymentInfo3(res);
+  }
+  async runDeploymentById(id) {
+    const res = await this.client.post(`/deployments/${id}/run`, {});
+    return toDeploymentRunResult(res);
+  }
+  async pauseDeploymentById(id) {
+    const res = await this.client.post(`/deployments/${id}/pause`, {});
+    return toDeploymentInfo3(res);
+  }
+  async unpauseDeploymentById(id) {
+    const res = await this.client.post(`/deployments/${id}/unpause`, {});
+    return toDeploymentInfo3(res);
+  }
+  async listDeploymentRuns(deploymentId, options) {
+    const res = await this.client.get(
+      withQuery(`/deployments/${deploymentId}/runs`, cursorParams(options))
+    );
+    return cursorPage(res, toDeploymentRunInfo);
+  }
+  async getDeploymentRun(runId) {
+    const res = await this.client.get(`/deployment_runs/${runId}`);
+    return toDeploymentRunInfo(res);
+  }
   async pauseDeployment(ctx) {
     return this.setDeploymentPaused(ctx, true);
   }
@@ -4255,6 +4527,9 @@ var BailianAdapter = class _BailianAdapter {
   async listSessions(filter) {
     const params = new URLSearchParams();
     if (filter?.agent_id) params.set("agent_id", filter.agent_id);
+    for (const status of filter?.statuses ?? []) params.append("statuses[]", status);
+    if (filter?.created_at_gte) params.set("created_at[gte]", filter.created_at_gte);
+    if (filter?.created_at_lte) params.set("created_at[lte]", filter.created_at_lte);
     if (filter?.limit) params.set("limit", String(filter.limit));
     if (filter?.page) params.set("page", filter.page);
     const qs = params.toString();
@@ -4271,6 +4546,15 @@ var BailianAdapter = class _BailianAdapter {
     const res = await this.client.get(`/sessions/${id}`);
     return toSessionInfo3(res);
   }
+  async updateSession(id, input) {
+    const res = await this.client.post(`/sessions/${id}`, input);
+    if (!res.agent || !res.environment_id) return this.getSession(id);
+    return toSessionInfo3(res);
+  }
+  async archiveSession(id) {
+    const res = await this.client.post(`/sessions/${id}/archive`, {});
+    return toSessionInfo3(res);
+  }
   async deleteSession(id) {
     await this.client.delete(`/sessions/${id}`);
   }
@@ -4279,13 +4563,20 @@ var BailianAdapter = class _BailianAdapter {
     const res = await this.client.post(`/sessions/${sessionId}/events`, body);
     return extractCreatedEventId(res);
   }
+  async sendSessionEvents(sessionId, events) {
+    const res = await this.client.post(`/sessions/${sessionId}/events`, { input: events });
+    return {
+      event_ids: extractCreatedEventIds(res),
+      attributes: res
+    };
+  }
   async *streamSessionEvents(sessionId, _options) {
     for await (const raw of this.client.sse(`/sessions/${sessionId}/events/stream`)) {
       yield toSessionEvent(raw);
     }
   }
   async listSessionEvents(sessionId, options) {
-    return listSessionEventsPaged(this.client, sessionId, options, toSessionEvent);
+    return listSessionEventsPaged(this.client, sessionId, options, toSessionEvent, { forwardTypes: false });
   }
   // --- Files ---
   async uploadFile(filePath, options) {
@@ -4311,6 +4602,15 @@ var BailianAdapter = class _BailianAdapter {
     const all = await this.client.getAllPaged("/files");
     return all.map(toRestFileInfo);
   }
+  async listFileResources(options) {
+    const params = cursorParams(options);
+    if (options?.scope_id) params.set("scope_id", options.scope_id);
+    const res = await this.client.get(withQuery("/files", params));
+    return cursorPage(res, toRestFileInfo);
+  }
+  async downloadFileContent(id) {
+    return new Uint8Array(await this.client.getBuffer(`/files/${id}/content`));
+  }
   async deleteFile(id) {
     await this.client.delete(`/files/${id}`);
   }
@@ -4345,9 +4645,77 @@ function toBailianSkillInfo(res) {
     status: skillStatusFromString(res.status),
     latest_version: res.latest_version,
     created_at: res.created_at,
-    updated_at: res.updated_at
+    updated_at: res.updated_at,
+    attributes: res
+  };
+}
+function cursorParams(options) {
+  const params = new URLSearchParams();
+  if (options?.limit !== void 0) params.set("limit", String(options.limit));
+  if (options?.page) params.set("page", options.page);
+  return params;
+}
+function withQuery(path, params) {
+  const query2 = params.toString();
+  return query2 ? `${path}?${query2}` : path;
+}
+function cursorPage(res, mapper) {
+  const nextPage = res.next_page ?? void 0;
+  return {
+    data: (res.data ?? []).map(mapper),
+    has_more: res.has_more ?? nextPage !== void 0,
+    next_page: nextPage
+  };
+}
+function toSkillVersionInfo(res) {
+  return {
+    id: res.id,
+    skill_id: res.skill_id ?? "",
+    type: res.type ?? "skill_version",
+    name: res.name,
+    description: res.description,
+    version: res.version ?? "",
+    status: res.status,
+    created_at: res.created_at,
+    updated_at: res.updated_at,
+    additional_properties: res.additional_properties,
+    attributes: res
+  };
+}
+function toDeploymentRunResult(res) {
+  return {
+    run_id: res.id,
+    session_id: res.session_id ?? null,
+    error: res.error ?? void 0
+  };
+}
+function toDeploymentRunInfo(res) {
+  return {
+    id: res.id ?? "",
+    deployment_id: res.deployment_id,
+    session_id: res.session_id ?? void 0,
+    status: res.status,
+    error: res.error ?? void 0,
+    created_at: res.created_at,
+    updated_at: res.updated_at,
+    attributes: res
   };
 }
+function extractCreatedEventIds(res) {
+  const ids = /* @__PURE__ */ new Set();
+  const topLevel = extractCreatedEventId(res);
+  if (topLevel) ids.add(topLevel);
+  for (const key of ["data", "events"]) {
+    const items = res[key];
+    if (!Array.isArray(items)) continue;
+    for (const item of items) {
+      if (!item || typeof item !== "object") continue;
+      const id = item.id;
+      if (typeof id === "string") ids.add(id);
+    }
+  }
+  return Array.from(ids);
+}
 function normalizeBailianModel(value) {
   if (value && typeof value === "object" && "id" in value) {
     return value.id;
@@ -4673,7 +5041,7 @@ function mapAgent4(name, decl, refs, version, projectName) {
   if (!arkModel) throw new UserError(`No Ark model specified for agent '${name}'`);
   const modelValue = typeof arkModel === "string" ? { id: arkModel } : { id: arkModel.id };
   const body = {
-    name,
+    name: decl.name ?? name,
     model: modelValue,
     system: decl.instructions
   };
@@ -5407,6 +5775,7 @@ var coerceString = z5.union([z5.string(), z5.number()]).transform(String);
 var staticBearerCredentialSchema = z5.object({
   name: z5.string(),
   type: z5.literal("static_bearer"),
+  metadata: z5.record(z5.string(), z5.string()).optional(),
   mcp_server_url: z5.string(),
   access_token: coerceString,
   protocol: z5.enum(["sse", "streamable_http"]).optional()
@@ -5414,6 +5783,7 @@ var staticBearerCredentialSchema = z5.object({
 var environmentVariableCredentialSchema = z5.object({
   name: z5.string(),
   type: z5.literal("environment_variable"),
+  metadata: z5.record(z5.string(), z5.string()).optional(),
   secret_name: z5.string(),
   secret_value: coerceString,
   networking: z5.object({ type: z5.enum(["unrestricted", "limited"]) }).optional()
@@ -5556,6 +5926,9 @@ var agentSkillRefSchema = z5.object({
 var agentDeliverySchema = z5.object({
   type: z5.enum(["managed", "forward"])
 });
+var managedToolConfigSchema = z5.object({
+  enabled_tools: z5.array(z5.string().min(1))
+});
 var sessionGithubRepoResourceSchema = z5.object({
   type: z5.literal("github_repository"),
   url: z5.string().url(),
@@ -5577,19 +5950,27 @@ var agentSchema = z5.object({
   mcp_servers: z5.array(mcpServerSchema).optional(),
   skills: z5.array(z5.union([z5.string(), agentSkillRefSchema])).optional(),
   vault: z5.string().optional(),
+  files: z5.array(z5.string()).optional(),
   memory_stores: z5.array(z5.string()).optional(),
+  default_memory_store: z5.object({
+    name: z5.string().trim().min(1).max(255),
+    description: z5.string().max(1024).optional(),
+    delete_on_destroy: z5.boolean().optional().default(false)
+  }).optional(),
   resources: z5.array(sessionGithubRepoResourceSchema).optional(),
   multiagent: multiagentSchema.optional(),
   metadata: z5.record(z5.string(), z5.string()).optional(),
   environment_variables: z5.record(z5.string().min(1), z5.string()).optional(),
+  managed_tool_config: managedToolConfigSchema.optional(),
   delivery: z5.record(z5.string(), agentDeliverySchema).optional()
 });
 var channelSchema = z5.object({
   provider: z5.string().optional(),
-  agent: z5.string().min(1),
+  agent: z5.string().min(1).optional(),
   identity: z5.string().min(1).optional(),
   type: z5.string().min(1),
   name: z5.string().trim().min(1).optional(),
+  mode: z5.enum(["fixed", "pairing"]).optional().default("fixed"),
   enabled: z5.boolean().optional(),
   credentials: z5.record(z5.string(), coerceString).optional(),
   options: z5.record(z5.string(), z5.unknown()).optional()
@@ -5636,6 +6017,7 @@ var scheduleSchema = z5.object({
   timezone: z5.string()
 });
 var deploymentSchema = z5.object({
+  name: z5.string().optional(),
   agent: z5.string(),
   agent_version: z5.number().int().optional(),
   environment: z5.string().optional(),
@@ -5828,15 +6210,24 @@ async function computeResourceHash(address, config, basePath, state) {
   if (!decl) return "";
   if (address.type === "skill") {
     const skillDecl = decl;
+    const apiMode = resolveQoderApiMode(address.type, address.name, address.provider, config);
     if (basePath) {
       const fileHash = computeSkillContentHash(skillDecl.source, basePath);
-      return contentHash({ decl, fileHash });
+      return contentHash({ decl, fileHash, apiMode });
     }
+    return contentHash({ decl, apiMode });
+  }
+  if (address.type === "environment" || address.type === "vault" || address.type === "memory_store") {
+    return contentHash({ decl, apiMode: resolveQoderApiMode(address.type, address.name, address.provider, config) });
   }
   if (address.type === "file" && basePath) {
     const fileDecl = decl;
     const fileHash = computeLocalFileContentHash(fileDecl.source, basePath);
-    return contentHash({ decl, fileHash });
+    return contentHash({
+      decl,
+      fileHash,
+      apiMode: resolveQoderApiMode("file", address.name, address.provider, config)
+    });
   }
   if (address.type === "deployment") {
     const refs = resolveDeploymentReferenceIds(decl, config, address.provider, state);
@@ -5858,13 +6249,28 @@ async function computeResourceHash(address, config, basePath, state) {
   }
   return contentHash(decl);
 }
+function resolveQoderApiMode(type, name, provider, config) {
+  if (provider !== "qoder") return void 0;
+  if (type === "environment" && config.environments?.[name]?.environment_id) return "auto";
+  for (const agent of Object.values(config.agents ?? {})) {
+    if (agent.provider && agent.provider !== provider) continue;
+    const referenced = type === "environment" ? agent.environment === name : type === "skill" ? agent.skills?.some(
+      (skill) => typeof skill === "string" ? skill === name : skill.type === "custom" && skill.skill_id === name
+    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.includes(name);
+    if (referenced && agent.delivery?.qoder?.type === "forward") return "forward";
+  }
+  return "managed";
+}
 function computeReplacementFingerprint(address, config) {
   if (address.type !== "channel") return void 0;
   const decl = config.channels?.[address.name];
   if (!decl) return void 0;
-  return contentHash({ channel_type: decl.type, credentials: decl.credentials ?? {} });
+  return contentHash({ channel_type: decl.type, mode: decl.mode ?? "fixed", credentials: decl.credentials ?? {} });
 }
 function resolveChannelReferenceIds(decl, config, provider, state) {
+  if (decl.mode === "pairing" || !decl.agent) {
+    return { mode: "pairing" };
+  }
   const agent = config.agents?.[decl.agent];
   const agentType = agent?.delivery?.[provider]?.type === "forward" ? "template" : "agent";
   const identity = decl.identity ?? config.defaults?.identity;
@@ -5887,7 +6293,14 @@ function resolveTemplateReferenceIds(decl, config, provider, state) {
     environment_id: environment?.environment_id ?? (decl.environment ? state?.getResource({ type: "environment", name: decl.environment, provider })?.remote_id ?? void 0 : void 0),
     tunnel_id: tunnel?.tunnel_id,
     vault_ids: decl.vault ? [state?.getResource({ type: "vault", name: decl.vault, provider })?.remote_id ?? decl.vault] : [],
-    skill_ids: skillIds
+    skill_ids: skillIds,
+    memory_store_ids: (decl.memory_stores ?? []).map(
+      (memoryStore) => state?.getResource({ type: "memory_store", name: memoryStore, provider })?.remote_id ?? memoryStore
+    ),
+    file_ids: (decl.files ?? []).map(
+      (file) => state?.getResource({ type: "file", name: file, provider })?.remote_id ?? file
+    ),
+    identity_id: decl.memory_stores?.length && config.defaults?.identity ? state?.getResource({ type: "identity", name: config.defaults.identity, provider })?.remote_id : void 0
   };
 }
 function resolveDeploymentReferenceIds(decl, config, provider, state) {
@@ -6067,11 +6480,21 @@ function resolveTemplateRefs(agentName, config, provider, state) {
   const environment = config.environments?.[agent.environment];
   if (!environment) throw new UserError(`Environment '${agent.environment}' is not defined in config.`);
   const agentRefs = resolveAgentRefs(agentName, config, provider, state);
+  const memoryStoreIds = (agent.memory_stores ?? []).map(
+    (memoryStore) => requireRef(state, { type: "memory_store", name: memoryStore, provider })
+  );
+  const identityName = config.defaults?.identity;
   return {
     ...agentRefs,
     environment_id: environment.environment_id ?? requireRef(state, { type: "environment", name: agent.environment, provider }),
     ...agent.tunnel ? { tunnel_id: resolveTunnelIdFromConfig(config, agent.tunnel, provider) } : {},
-    vault_ids: agent.vault ? [requireRef(state, { type: "vault", name: agent.vault, provider })] : []
+    vault_ids: agent.vault ? [requireRef(state, { type: "vault", name: agent.vault, provider })] : [],
+    file_ids: (agent.files ?? []).map((file) => requireRef(state, { type: "file", name: file, provider })),
+    memory_store_ids: memoryStoreIds,
+    owned_memory_store_ids: state.listResources().filter(
+      (resource) => resource.address.provider === provider && resource.address.type === "memory_store" && resource.api_mode === "forward" && typeof resource.remote_id === "string"
+    ).map((resource) => resource.remote_id),
+    ...identityName ? { identity_id: requireRef(state, { type: "identity", name: identityName, provider }) } : {}
   };
 }
 function resolveDeploymentRefs(deploymentName, config, provider, state) {
@@ -6133,6 +6556,12 @@ function resolveDeploymentRefs(deploymentName, config, provider, state) {
 function resolveChannelRefs(channelName, config, provider, state) {
   const channel = config.channels?.[channelName];
   if (!channel) throw new UserError(`Channel '${channelName}' not found in config`);
+  if (channel.mode === "pairing") {
+    return {};
+  }
+  if (!channel.agent) {
+    throw new UserError(`Channel '${channelName}' is fixed mode and must declare agent`);
+  }
   const agent = config.agents?.[channel.agent];
   if (!agent) throw new UserError(`Channel '${channelName}' references unknown agent '${channel.agent}'`);
   const agentType = agent.delivery?.[provider]?.type === "forward" ? "template" : "agent";
@@ -6156,8 +6585,61 @@ function resolveTunnelIdFromConfig(config, tunnelName, provider) {
 }
 
 // src/internal/executor/skill-resolver.ts
+import { dirname as dirname9 } from "path";
+
+// src/internal/core/skill-source.ts
 import { readFileSync as readFileSync7, statSync as statSync3 } from "fs";
-import { dirname as dirname9, resolve as resolve10 } from "path";
+import { basename as basename6, resolve as resolve10 } from "path";
+import { parse } from "yaml";
+async function inspectSkillSource(source, options = {}) {
+  if (/^https?:\/\//i.test(source)) {
+    throw new UserError("Skill source inspection only accepts a local directory, zip, or SKILL.md file.");
+  }
+  const sourcePath = resolve10(options.basePath ?? process.cwd(), source);
+  const sourceStat = statSync3(sourcePath, { throwIfNoEntry: false });
+  if (!sourceStat) throw new UserError(`Skill source not found: ${source}`);
+  let files;
+  if (sourceStat.isDirectory()) {
+    files = collectFiles(sourcePath, "");
+  } else if (sourceStat.isFile() && sourcePath.toLowerCase().endsWith(".zip")) {
+    files = await extractSkillZipFiles(readFileSync7(sourcePath));
+  } else if (sourceStat.isFile() && basename6(sourcePath).toLowerCase() === "skill.md") {
+    files = [{ relativePath: "SKILL.md", content: readFileSync7(sourcePath) }];
+  } else {
+    throw new UserError("Skill source must be a directory, .zip archive, or SKILL.md file.");
+  }
+  const normalizedFiles = normalizeSkillRoot(files);
+  const manifest = normalizedFiles.find((file) => file.relativePath === "SKILL.md");
+  const name = parseSkillManifestName(manifest.content);
+  return { name, sourcePath, files: normalizedFiles };
+}
+function normalizeSkillRoot(files) {
+  if (files.some((file) => file.relativePath === "SKILL.md")) return files;
+  const manifests = files.filter((file) => file.relativePath.endsWith("/SKILL.md"));
+  if (manifests.length === 0) throw new UserError("Skill source does not contain SKILL.md.");
+  if (manifests.length > 1) {
+    throw new UserError("Skill source contains multiple SKILL.md files and has no unambiguous root.");
+  }
+  const prefix = manifests[0].relativePath.slice(0, -"SKILL.md".length);
+  return files.filter((file) => file.relativePath.startsWith(prefix)).map((file) => ({ ...file, relativePath: file.relativePath.slice(prefix.length) }));
+}
+function parseSkillManifestName(content) {
+  const text = content.toString("utf8");
+  const frontmatter = text.match(/^---\s*\r?\n([\s\S]*?)\r?\n---(?:\s*\r?\n|$)/);
+  if (!frontmatter) throw new UserError("SKILL.md must start with YAML frontmatter containing a name.");
+  let manifest;
+  try {
+    manifest = parse(frontmatter[1]);
+  } catch (error) {
+    throw new UserError(`Invalid SKILL.md frontmatter: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const rawName = manifest && typeof manifest === "object" ? manifest.name : void 0;
+  const name = typeof rawName === "string" ? rawName.trim() : "";
+  if (!name) throw new UserError("SKILL.md frontmatter must contain a non-empty name.");
+  return name;
+}
+
+// src/internal/executor/skill-resolver.ts
 async function resolveSkillFiles(decl, ctx) {
   if (/^https?:\/\//i.test(decl.source)) {
     const res = await resolveFetch()(decl.source);
@@ -6165,19 +6647,7 @@ async function resolveSkillFiles(decl, ctx) {
     return extractSkillZipFiles(Buffer.from(await res.arrayBuffer()));
   }
   if (!ctx.configPath) return [];
-  const sourcePath = resolve10(dirname9(ctx.configPath), decl.source);
-  const stat = statSync3(sourcePath, { throwIfNoEntry: false });
-  if (stat?.isDirectory()) {
-    return collectFiles(sourcePath, "");
-  }
-  if (stat?.isFile()) {
-    if (sourcePath.endsWith(".zip")) {
-      return extractSkillZipFiles(readFileSync7(sourcePath));
-    }
-    const content = readFileSync7(sourcePath);
-    return [{ relativePath: "SKILL.md", content }];
-  }
-  return [];
+  return (await inspectSkillSource(decl.source, { basePath: dirname9(ctx.configPath) })).files;
 }
 
 // src/internal/executor/executor.ts
@@ -6255,6 +6725,7 @@ async function executePlan(plan, ctx, options = {}) {
     await runWithConcurrency(level, concurrency, runAction);
     await ctx.state.save();
   }
+  await reconcileDefaultMemoryStores(ctx, new Set(plan.actions.map((action) => action.address.provider)));
   for (const action of deletions) {
     await runAction(action);
     await ctx.state.save();
@@ -6265,6 +6736,41 @@ async function executePlan(plan, ctx, options = {}) {
     partial: results.some((r) => r.status === "failed")
   };
 }
+async function reconcileDefaultMemoryStores(ctx, plannedProviders) {
+  const identityName = ctx.config.defaults?.identity;
+  for (const [agentName, agent] of Object.entries(ctx.config.agents ?? {})) {
+    const desired = agent.default_memory_store;
+    if (!desired || agent.delivery?.qoder?.type !== "forward") continue;
+    const providerName = "qoder";
+    if (agent.provider && agent.provider !== providerName || !plannedProviders.has(providerName)) continue;
+    const provider = ctx.providers.get(providerName);
+    if (!provider?.reconcileDefaultMemoryStore || !identityName) continue;
+    const identityId = ctx.state.getResource({
+      type: "identity",
+      name: identityName,
+      provider: providerName
+    })?.remote_id;
+    const templateId = ctx.state.getResource({ type: "template", name: agentName, provider: providerName })?.remote_id;
+    if (!identityId || !templateId) continue;
+    const result = await provider.reconcileDefaultMemoryStore(identityId, templateId, desired);
+    const resource = { type: "template", name: agentName, provider: providerName };
+    if (result.status === "pending") {
+      emitRuntimeFeedback(ctx.onFeedback, {
+        type: "provider_wait",
+        level: "warning",
+        resource,
+        message: `default memory store for template.${agentName} is pending \u2014 create the first Forward Session, then run apply again`
+      });
+    } else if (result.status === "updated") {
+      emitRuntimeFeedback(ctx.onFeedback, {
+        type: "resource_action_success",
+        level: "success",
+        resource,
+        message: `updated default memory store for template.${agentName} to "${desired.name}"`
+      });
+    }
+  }
+}
 async function runWithConcurrency(items, limit, worker) {
   if (items.length === 0) return;
   let cursor = 0;
@@ -6343,6 +6849,7 @@ async function executeActionInner(action, provider, ctx) {
     const existing = ctx.state.getResource(address);
     if (!existing) return false;
     const id = existing.remote_id;
+    const apiMode2 = existing.api_mode;
     if (type === "environment" || type === "identity") {
       const externalReference = type === "environment" ? ctx.config.environments?.[name]?.environment_id : ctx.config.identities?.[name]?.identity_id;
       if (existing.externally_managed || externalReference) {
@@ -6354,13 +6861,13 @@ async function executeActionInner(action, provider, ctx) {
       try {
         switch (type) {
           case "environment":
-            await provider.deleteEnvironment(id);
+            await provider.deleteEnvironment(id, false, apiMode2);
             break;
           case "vault":
-            await provider.deleteVault(id);
+            await provider.deleteVault(id, apiMode2);
             break;
           case "skill":
-            await provider.deleteSkill(id);
+            await provider.deleteSkill(id, apiMode2);
             break;
           case "agent":
             await provider.deleteAgent(id);
@@ -6368,17 +6875,17 @@ async function executeActionInner(action, provider, ctx) {
           case "template":
             if (!provider.archiveTemplate)
               throw new UserError(`Provider '${address.provider}' does not support templates`);
-            await provider.archiveTemplate(id);
+            await provider.archiveTemplate(id, ownedForwardMemoryStoreIds(ctx, address.provider));
             break;
           case "memory_store":
             if (!provider.deleteMemoryStore) throw memoryStoreUnsupported(address.provider);
-            await provider.deleteMemoryStore(id);
+            await provider.deleteMemoryStore(id, apiMode2);
             break;
           case "deployment":
             await provider.deleteDeployment(id);
             break;
           case "file":
-            await provider.deleteFile(id);
+            await provider.deleteFile(id, apiMode2);
             break;
           case "identity":
             if (!provider.deleteIdentity)
@@ -6407,6 +6914,9 @@ async function executeActionInner(action, provider, ctx) {
   const isUpdate = action.action === "update";
   const priorAddress = action.previousAddress ?? address;
   const existingId = isUpdate ? ctx.state.getResource(priorAddress)?.remote_id : void 0;
+  const apiMode = resolveResourceApiMode(type, name, address.provider, ctx.config);
+  const priorApiMode = ctx.state.getResource(priorAddress)?.api_mode ?? (address.provider === "qoder" ? "managed" : void 0);
+  const apiModeChanged = isUpdate && apiMode !== void 0 && priorApiMode !== apiMode;
   let result;
   switch (type) {
     case "environment": {
@@ -6421,6 +6931,17 @@ async function executeActionInner(action, provider, ctx) {
           resource: action.address,
           message: `${action.action} ${action.address.type}.${action.address.name} (${action.address.provider}) \u2014 external reference, no remote mutation`
         });
+      } else if (apiModeChanged) {
+        try {
+          result = await provider.createEnvironment(remoteName, decl, apiMode);
+        } catch (err) {
+          result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            mode: apiMode,
+            onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl, apiMode)
+          });
+          adopted = true;
+        }
+        if (existingId) await provider.deleteEnvironment(existingId, false, priorApiMode);
       } else if (isUpdate) {
         const prior = ctx.state.getResource(address);
         if (prior?.externally_managed) {
@@ -6428,13 +6949,14 @@ async function executeActionInner(action, provider, ctx) {
             `environment.${name} is recorded as an external reference (${prior.remote_id ?? "unknown id"}); refusing to modify it remotely. Restore 'environment_id' to keep it as a reference, or release it first with 'agents state rm environment.${name}' (then 'agents state import' to adopt it as a managed resource).`
           );
         }
-        result = await provider.updateEnvironment(existingId, remoteName, decl);
+        result = await provider.updateEnvironment(existingId, remoteName, decl, apiMode);
       } else {
         try {
-          result = await provider.createEnvironment(remoteName, decl);
+          result = await provider.createEnvironment(remoteName, decl, apiMode);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
-            onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl)
+            mode: apiMode,
+            onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl, apiMode)
           });
           adopted = true;
         }
@@ -6443,22 +6965,26 @@ async function executeActionInner(action, provider, ctx) {
     }
     case "vault": {
       const decl = ctx.config.vaults[name];
-      if (isUpdate) {
+      if (apiModeChanged) {
+        result = await provider.createVault(name, decl, apiMode);
+        if (existingId) await provider.deleteVault(existingId, priorApiMode).catch(() => void 0);
+      } else if (isUpdate) {
         try {
-          result = await provider.createVault(name, decl);
-          await provider.deleteVault(existingId);
+          result = await provider.createVault(name, decl, apiMode);
+          await provider.deleteVault(existingId, apiMode);
         } catch {
-          await provider.deleteVault(existingId);
-          result = await provider.createVault(name, decl);
+          await provider.deleteVault(existingId, apiMode);
+          result = await provider.createVault(name, decl, apiMode);
         }
       } else {
         try {
-          result = await provider.createVault(name, decl);
+          result = await provider.createVault(name, decl, apiMode);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            mode: apiMode,
             onExisting: async (existing) => {
-              await provider.deleteVault(existing.id);
-              return provider.createVault(name, decl);
+              await provider.deleteVault(existing.id, apiMode);
+              return provider.createVault(name, decl, apiMode);
             }
           });
           adopted = true;
@@ -6482,12 +7008,15 @@ async function executeActionInner(action, provider, ctx) {
       }
       const remoteName = decl.name ?? name;
       const files = await resolveSkillFiles(decl, ctx);
-      if (isUpdate) {
-        result = await provider.updateSkill(existingId, remoteName, decl, files);
+      if (apiModeChanged) {
+        result = await provider.createSkill(remoteName, decl, files, apiMode);
+        if (existingId) await provider.deleteSkill(existingId, priorApiMode).catch(() => void 0);
+      } else if (isUpdate) {
+        result = await provider.updateSkill(existingId, remoteName, decl, files, apiMode);
       } else {
         const manifestName = skillNameFromFiles(files);
         const searchNames = manifestName && manifestName !== remoteName ? [remoteName, manifestName] : [remoteName];
-        const existing = await findExistingByNames(provider, "skill", searchNames);
+        const existing = await findExistingByNames(provider, "skill", searchNames, apiMode);
         if (existing) {
           result = existing.resource;
           emitRuntimeFeedback(ctx.onFeedback, {
@@ -6499,9 +7028,10 @@ async function executeActionInner(action, provider, ctx) {
           adopted = true;
         } else {
           try {
-            result = await provider.createSkill(remoteName, decl, files);
+            result = await provider.createSkill(remoteName, decl, files, apiMode);
           } catch (err) {
             result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+              mode: apiMode,
               searchNames,
               onExisting: async (existing2) => existing2
             });
@@ -6520,15 +7050,19 @@ async function executeActionInner(action, provider, ctx) {
         throw memoryStoreUnsupported(address.provider);
       }
       const reconcile = async (storeId) => {
-        const store = await provider.updateMemoryStore(storeId, {
-          name,
-          description: decl.description,
-          metadata: decl.metadata ?? {}
-        });
+        const store = await provider.updateMemoryStore(
+          storeId,
+          {
+            name,
+            description: decl.description,
+            metadata: decl.metadata ?? {}
+          },
+          apiMode
+        );
         const current = /* @__PURE__ */ new Map();
         let cursor;
         do {
-          const page2 = await provider.listMemories(storeId, { limit: 100, cursor, view: "basic" });
+          const page2 = await provider.listMemories(storeId, { limit: 100, cursor, view: "basic" }, apiMode);
           for (const memory of page2.data) {
             if (memory.type === "memory") current.set(memory.path, memory);
           }
@@ -6538,24 +7072,33 @@ async function executeActionInner(action, provider, ctx) {
           const existing = current.get(entry.key.replace(/^\/+/, ""));
           if (existing) {
             if (existing.content_sha256 !== sha256(entry.content)) {
-              await provider.updateMemory(storeId, existing.id, {
-                content: entry.content,
-                expected_content_sha256: existing.content_sha256
-              });
+              await provider.updateMemory(
+                storeId,
+                existing.id,
+                {
+                  content: entry.content,
+                  expected_content_sha256: existing.content_sha256
+                },
+                apiMode
+              );
             }
           } else {
-            await provider.createMemory(storeId, { path: entry.key, content: entry.content });
+            await provider.createMemory(storeId, { path: entry.key, content: entry.content }, apiMode);
           }
         }
         return store;
       };
-      if (isUpdate) {
+      if (apiModeChanged) {
+        result = await createMemoryStore2(name, decl, apiMode);
+        if (existingId) await deleteMemoryStore2(existingId, priorApiMode).catch(() => void 0);
+      } else if (isUpdate) {
         result = await reconcile(existingId);
       } else {
         try {
-          result = await createMemoryStore2(name, decl);
+          result = await createMemoryStore2(name, decl, apiMode);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            mode: apiMode,
             onExisting: async (existing) => reconcile(existing.id)
           });
           adopted = true;
@@ -6705,15 +7248,12 @@ async function executeActionInner(action, provider, ctx) {
         const oldId = ctx.state.getResource(address)?.remote_id;
         if (oldId) {
           try {
-            await provider.deleteFile(oldId);
+            await provider.deleteFile(oldId, priorApiMode);
           } catch {
           }
         }
       }
-      const info = await provider.uploadFile(filePath, {
-        name: decl.name,
-        purpose: decl.purpose
-      });
+      const info = await provider.uploadFile(filePath, { name: decl.name, purpose: decl.purpose }, apiMode);
       result = { id: info.id, type: "file" };
       break;
     }
@@ -6734,6 +7274,7 @@ async function executeActionInner(action, provider, ctx) {
     address,
     remote_id: result.id,
     externally_managed: priorResource?.externally_managed || type === "environment" && ctx.config.environments?.[name]?.environment_id || type === "identity" && ctx.config.identities?.[name]?.identity_id ? true : void 0,
+    api_mode: apiMode,
     version: result.version,
     content_hash: hash,
     desired_hash: hash,
@@ -6748,9 +7289,37 @@ async function executeActionInner(action, provider, ctx) {
   if (action.previousAddress) ctx.state.removeResource(action.previousAddress);
   return adopted;
 }
-async function findExistingByNames(provider, type, names) {
+function ownedForwardMemoryStoreIds(ctx, provider) {
+  return ctx.state.listResources().filter(
+    (resource) => resource.address.provider === provider && resource.address.type === "memory_store" && resource.api_mode === "forward" && typeof resource.remote_id === "string"
+  ).map((resource) => resource.remote_id);
+}
+function resolveResourceApiMode(type, name, provider, config) {
+  if (provider !== "qoder" || type !== "environment" && type !== "skill" && type !== "vault" && type !== "memory_store" && type !== "file") {
+    return void 0;
+  }
+  if (type === "environment" && config.environments?.[name]?.environment_id) return "auto";
+  let managed = false;
+  let forward = false;
+  for (const agent of Object.values(config.agents ?? {})) {
+    if (agent.provider && agent.provider !== provider) continue;
+    const referenced = type === "environment" ? agent.environment === name : type === "skill" ? agent.skills?.some(
+      (skill) => typeof skill === "string" ? skill === name : skill.type === "custom" && skill.skill_id === name
+    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.includes(name);
+    if (!referenced) continue;
+    if (agent.delivery?.qoder?.type === "forward") forward = true;
+    else managed = true;
+  }
+  if (managed && forward) {
+    throw new UserError(
+      `Qoder ${type}.${name} is referenced by both Managed and Forward agents; declare separate resources for each API domain.`
+    );
+  }
+  return forward ? "forward" : "managed";
+}
+async function findExistingByNames(provider, type, names, mode) {
   for (const candidate of names) {
-    const found = await provider.findResource(type, candidate);
+    const found = await provider.findResource(type, candidate, void 0, mode);
     if (found && found.id !== null) return { resource: found, name: candidate };
   }
   return null;
@@ -6758,7 +7327,7 @@ async function findExistingByNames(provider, type, names) {
 async function adoptOnConflict(err, address, provider, onFeedback, opts) {
   if (!(err instanceof ConflictError)) throw err;
   const candidates = opts.searchNames?.length ? opts.searchNames : [address.name];
-  const existing = await findExistingByNames(provider, address.type, candidates);
+  const existing = await findExistingByNames(provider, address.type, candidates, opts.mode);
   if (!existing) throw nameReservedError(err, address, candidates.join('" / "'));
   emitRuntimeFeedback(onFeedback, {
     type: "resource_adopted",
@@ -6780,6 +7349,236 @@ function nameReservedError(err, address, searchName) {
   );
 }
 
+// src/internal/core/agent-materialization.ts
+function resolveAgentMaterialization(provider, agent) {
+  const mode = agent.delivery?.[provider]?.type ?? "managed";
+  if (mode === "managed") return { resourceType: "agent", mode };
+  return { resourceType: "template", mode };
+}
+
+// src/internal/graph/dependency.ts
+function collectDependencyClosure(graph, roots) {
+  const selected = /* @__PURE__ */ new Map();
+  function visit(address) {
+    const key = addressKey(address);
+    if (selected.has(key)) return;
+    selected.set(key, graph.nodes.get(key) ?? address);
+    for (const dependencyKey of graph.edges.get(key) ?? []) {
+      const dependency = graph.nodes.get(dependencyKey);
+      if (dependency) visit(dependency);
+    }
+  }
+  for (const root of roots) visit(root);
+  return [...selected.values()];
+}
+function buildDependencyGraph(config, targetProviders) {
+  const nodes = /* @__PURE__ */ new Map();
+  const edges = /* @__PURE__ */ new Map();
+  function addNode(addr) {
+    const key = addressKey(addr);
+    nodes.set(key, addr);
+    if (!edges.has(key)) edges.set(key, /* @__PURE__ */ new Set());
+  }
+  function addEdge(from, to) {
+    const fromKey = addressKey(from);
+    const toKey = addressKey(to);
+    edges.get(fromKey)?.add(toKey);
+  }
+  for (const provider of targetProviders) {
+    const def = getProvider(provider);
+    const caps = def?.capabilities;
+    if (config.environments) {
+      for (const name of Object.keys(config.environments)) {
+        const decl = config.environments[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "environment", name, provider });
+      }
+    }
+    if (config.memory_stores) {
+      for (const name of Object.keys(config.memory_stores)) {
+        const decl = config.memory_stores[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        if (!isSupported(caps, "memory_store")) continue;
+        addNode({ type: "memory_store", name, provider });
+      }
+    }
+    if (config.vaults) {
+      for (const name of Object.keys(config.vaults)) {
+        const decl = config.vaults[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "vault", name, provider });
+      }
+    }
+    if (config.skills) {
+      for (const name of Object.keys(config.skills)) {
+        const decl = config.skills[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "skill", name, provider });
+      }
+    }
+    if (config.files) {
+      for (const name of Object.keys(config.files)) {
+        const decl = config.files[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "file", name, provider });
+      }
+    }
+    if (config.identities && isSupported(caps, "identity")) {
+      for (const name of Object.keys(config.identities)) {
+        const decl = config.identities[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "identity", name, provider });
+      }
+    }
+    if (config.agents) {
+      for (const name of Object.keys(config.agents)) {
+        const decl = config.agents[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const materialization = resolveAgentMaterialization(provider, decl);
+        const agentAddr = { type: materialization.resourceType, name, provider };
+        addNode(agentAddr);
+        if ((decl.default_memory_store || decl.memory_stores?.length) && materialization.resourceType === "template") {
+          const identityName = config.defaults?.identity;
+          if (identityName) {
+            const identityAddr = { type: "identity", name: identityName, provider };
+            if (nodes.has(addressKey(identityAddr))) addEdge(agentAddr, identityAddr);
+          }
+        }
+        if (decl.environment && config.environments?.[decl.environment]) {
+          const envAddr = {
+            type: "environment",
+            name: decl.environment,
+            provider
+          };
+          if (nodes.has(addressKey(envAddr))) {
+            addEdge(agentAddr, envAddr);
+          }
+        }
+        if (decl.skills) {
+          for (const skillRef of decl.skills) {
+            if (typeof skillRef !== "string") continue;
+            const skillName = skillRef;
+            const skillAddr = { type: "skill", name: skillName, provider };
+            if (nodes.has(addressKey(skillAddr))) {
+              addEdge(agentAddr, skillAddr);
+            }
+          }
+        }
+        if (decl.vault) {
+          const vaultAddr = { type: "vault", name: decl.vault, provider };
+          if (nodes.has(addressKey(vaultAddr))) {
+            addEdge(agentAddr, vaultAddr);
+          }
+        }
+        if (decl.files) {
+          for (const fileName of decl.files) {
+            const fileAddr = { type: "file", name: fileName, provider };
+            if (nodes.has(addressKey(fileAddr))) addEdge(agentAddr, fileAddr);
+          }
+        }
+        if (decl.memory_stores) {
+          for (const msName of decl.memory_stores) {
+            const msAddr = {
+              type: "memory_store",
+              name: msName,
+              provider
+            };
+            if (nodes.has(addressKey(msAddr))) {
+              addEdge(agentAddr, msAddr);
+            }
+          }
+        }
+        if (decl.multiagent && isSupported(caps, "multiagent")) {
+          for (const subName of decl.multiagent.agents) {
+            const subDecl = config.agents[subName];
+            const subType = subDecl ? resolveAgentMaterialization(provider, subDecl).resourceType : "agent";
+            const subAddr = { type: subType, name: subName, provider };
+            addEdge(agentAddr, subAddr);
+          }
+        }
+      }
+    }
+    if (config.deployments) {
+      for (const name of Object.keys(config.deployments)) {
+        const decl = config.deployments[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const depAddr = { type: "deployment", name, provider };
+        addNode(depAddr);
+        const agentDecl = config.agents?.[decl.agent];
+        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
+        const agentAddr = { type: agentType, name: decl.agent, provider };
+        if (nodes.has(addressKey(agentAddr))) addEdge(depAddr, agentAddr);
+        if (decl.environment) {
+          const envAddr = { type: "environment", name: decl.environment, provider };
+          if (nodes.has(addressKey(envAddr))) addEdge(depAddr, envAddr);
+        }
+        if (decl.vaults) {
+          for (const vName of decl.vaults) {
+            const vAddr = { type: "vault", name: vName, provider };
+            if (nodes.has(addressKey(vAddr))) addEdge(depAddr, vAddr);
+          }
+        }
+        if (decl.memory_stores) {
+          for (const msName of decl.memory_stores) {
+            const msAddr = { type: "memory_store", name: msName, provider };
+            if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
+          }
+        }
+        if (decl.resources) {
+          for (const r of decl.resources) {
+            if (r.type === "memory_store") {
+              const msAddr = { type: "memory_store", name: r.memory_store, provider };
+              if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
+            }
+          }
+        }
+      }
+    }
+    if (config.channels && isSupported(caps, "channel")) {
+      for (const name of Object.keys(config.channels)) {
+        const decl = config.channels[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const channelAddr = { type: "channel", name, provider };
+        addNode(channelAddr);
+        if (decl.mode === "pairing" || !decl.agent) continue;
+        const agentDecl = config.agents?.[decl.agent];
+        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
+        const agentAddr = { type: agentType, name: decl.agent, provider };
+        if (nodes.has(addressKey(agentAddr))) addEdge(channelAddr, agentAddr);
+        const identityName = decl.identity ?? config.defaults?.identity;
+        if (identityName) {
+          const identityAddr = { type: "identity", name: identityName, provider };
+          if (nodes.has(addressKey(identityAddr))) addEdge(channelAddr, identityAddr);
+        }
+      }
+    }
+  }
+  return { nodes, edges };
+}
+function topologicalSort(graph) {
+  const visited = /* @__PURE__ */ new Set();
+  const sorted = [];
+  const visiting = /* @__PURE__ */ new Set();
+  function visit(key) {
+    if (visited.has(key)) return;
+    if (visiting.has(key)) {
+      throw new UserError(`Circular dependency detected involving: ${key}`);
+    }
+    visiting.add(key);
+    const deps = graph.edges.get(key) ?? /* @__PURE__ */ new Set();
+    for (const dep of deps) {
+      visit(dep);
+    }
+    visiting.delete(key);
+    visited.add(key);
+    sorted.push(graph.nodes.get(key));
+  }
+  for (const key of graph.nodes.keys()) {
+    visit(key);
+  }
+  return sorted;
+}
+
 // src/internal/diagnostics/diagnostics.ts
 var DiagnosticCollector = class {
   items = [];
@@ -6873,6 +7672,7 @@ function collectReferenceDiagnostics(config, diagnostics) {
   const skillNames = new Set(Object.keys(config.skills ?? {}));
   const vaultNames = new Set(Object.keys(config.vaults ?? {}));
   const memoryNames = new Set(Object.keys(config.memory_stores ?? {}));
+  const fileNames = new Set(Object.keys(config.files ?? {}));
   const agentNames = new Set(Object.keys(config.agents ?? {}));
   const identityNames = new Set(Object.keys(config.identities ?? {}));
   if (config.defaults?.identity && !identityNames.has(config.defaults.identity)) {
@@ -6900,6 +7700,11 @@ function collectReferenceDiagnostics(config, diagnostics) {
     if (agent.vault && !vaultNames.has(agent.vault)) {
       diagnostics.error("config.agent.vault.unknown", `agent.${name}: references unknown vault '${agent.vault}'`);
     }
+    for (const file of agent.files ?? []) {
+      if (!fileNames.has(file)) {
+        diagnostics.error("config.agent.file.unknown", `agent.${name}: references unknown file '${file}'`);
+      }
+    }
     for (const memory of agent.memory_stores ?? []) {
       if (!memoryNames.has(memory)) {
         diagnostics.error(
@@ -6931,7 +7736,10 @@ function collectReferenceDiagnostics(config, diagnostics) {
     }
   }
   for (const [name, channel] of Object.entries(config.channels ?? {})) {
-    if (!agentNames.has(channel.agent)) {
+    if (channel.mode === "pairing") continue;
+    if (!channel.agent) {
+      diagnostics.error("config.channel.agent.required", `channel.${name}: fixed-mode channels require agent`);
+    } else if (!agentNames.has(channel.agent)) {
       diagnostics.error("config.channel.agent.unknown", `channel.${name}: references unknown agent '${channel.agent}'`);
     }
     const identity = channel.identity ?? config.defaults?.identity;
@@ -7011,29 +7819,31 @@ function collectProviderCapabilities(config, providers, diagnostics) {
         continue;
       }
       if (providerName === "qoder") {
-        const agent = config.agents?.[channel.agent];
-        if (agent?.provider && agent.provider !== providerName) {
-          diagnostics.error(
-            "config.channel.agent.provider_mismatch",
-            `channel.${name}: agent '${channel.agent}' is pinned to provider '${agent.provider}'.`,
-            { type: "channel", name, provider: providerName }
-          );
-        }
-        const identityName = channel.identity ?? config.defaults?.identity;
-        const identity = identityName ? config.identities?.[identityName] : void 0;
-        if (identity?.provider && identity.provider !== providerName) {
-          diagnostics.error(
-            "config.channel.identity.provider_mismatch",
-            `channel.${name}: identity '${identityName}' is pinned to provider '${identity.provider}'.`,
-            { type: "channel", name, provider: providerName }
-          );
-        }
-        if (agent && agent.delivery?.qoder?.type !== "forward") {
-          diagnostics.error(
-            "qoder.channel.forward_template.required",
-            `channel.${name}: Qoder Channels require agent '${channel.agent}' to use delivery.qoder.type: forward.`,
-            { type: "channel", name, provider: providerName }
-          );
+        if (channel.mode !== "pairing" && channel.agent) {
+          const agent = config.agents?.[channel.agent];
+          if (agent?.provider && agent.provider !== providerName) {
+            diagnostics.error(
+              "config.channel.agent.provider_mismatch",
+              `channel.${name}: agent '${channel.agent}' is pinned to provider '${agent.provider}'.`,
+              { type: "channel", name, provider: providerName }
+            );
+          }
+          const identityName = channel.identity ?? config.defaults?.identity;
+          const identity = identityName ? config.identities?.[identityName] : void 0;
+          if (identity?.provider && identity.provider !== providerName) {
+            diagnostics.error(
+              "config.channel.identity.provider_mismatch",
+              `channel.${name}: identity '${identityName}' is pinned to provider '${identity.provider}'.`,
+              { type: "channel", name, provider: providerName }
+            );
+          }
+          if (agent && agent.delivery?.qoder?.type !== "forward") {
+            diagnostics.error(
+              "qoder.channel.forward_template.required",
+              `channel.${name}: Qoder Channels require agent '${channel.agent}' to use delivery.qoder.type: forward.`,
+              { type: "channel", name, provider: providerName }
+            );
+          }
         }
         const requiredCredentials = {
           dingtalk: ["client_id", "client_secret"],
@@ -7064,6 +7874,46 @@ function collectProviderCapabilities(config, providers, diagnostics) {
         }
       }
     }
+    if (providerName === "qoder") {
+      const domains = /* @__PURE__ */ new Map();
+      for (const agent of Object.values(config.agents ?? {})) {
+        if (agent.provider && agent.provider !== providerName) continue;
+        const mode = agent.delivery?.qoder?.type === "forward" ? "forward" : "managed";
+        const refs = [
+          ...agent.environment && !config.environments?.[agent.environment]?.environment_id ? [`environment:${agent.environment}`] : [],
+          ...(agent.skills ?? []).flatMap(
+            (skill) => typeof skill === "string" ? [`skill:${skill}`] : skill.type === "custom" ? [`skill:${skill.skill_id}`] : []
+          ),
+          ...agent.vault ? [`vault:${agent.vault}`] : [],
+          ...(agent.memory_stores ?? []).map((store) => `memory_store:${store}`),
+          ...(agent.files ?? []).map((file) => `file:${file}`)
+        ];
+        for (const ref of refs) {
+          const modes = domains.get(ref) ?? /* @__PURE__ */ new Set();
+          modes.add(mode);
+          domains.set(ref, modes);
+        }
+      }
+      for (const [ref, modes] of domains) {
+        if (modes.size < 2) continue;
+        const [type, name] = ref.split(":");
+        diagnostics.error(
+          `qoder.${type}.delivery_domain.conflict`,
+          `${type}.${name}: referenced by both Managed and Forward agents; declare separate resources because Qoder uses different API domains.`,
+          { type, name, provider: providerName }
+        );
+      }
+    }
+    for (const [name, agent] of Object.entries(config.agents ?? {})) {
+      if (agent.provider && agent.provider !== providerName) continue;
+      if (agent.files?.length && (providerName !== "qoder" || agent.delivery?.qoder?.type !== "forward")) {
+        diagnostics.error(
+          "config.agent.files.unsupported",
+          `agent.${name}: files are supported only by Qoder Forward Templates.`,
+          { type: resolveAgentMaterialization(providerName, agent).resourceType, name, provider: providerName }
+        );
+      }
+    }
     for (const [name, agent] of Object.entries(config.agents ?? {})) {
       if (agent.provider && agent.provider !== providerName) continue;
       const delivery = agent.delivery?.[providerName]?.type ?? "managed";
@@ -7104,6 +7954,44 @@ function collectProviderCapabilities(config, providers, diagnostics) {
           address
         );
       }
+      if (delivery !== "forward" && agent.managed_tool_config) {
+        diagnostics.error(
+          `${providerName}.agent.managed_tool_config.forward_required`,
+          `agent.${name}: managed_tool_config applies to Forward Templates; set delivery.${providerName}.type: forward or remove it.`,
+          address
+        );
+      }
+      if (agent.default_memory_store) {
+        if (providerName !== "qoder" || delivery !== "forward") {
+          diagnostics.error(
+            `${providerName}.agent.default_memory_store.forward_required`,
+            `agent.${name}: default_memory_store is supported only by Qoder Forward delivery.`,
+            address
+          );
+        } else if (!config.defaults?.identity) {
+          diagnostics.error(
+            "qoder.template.default_memory_store.identity.required",
+            `agent.${name}: default_memory_store requires defaults.identity to select the owning Forward Identity.`,
+            { type: "template", name, provider: providerName }
+          );
+        } else {
+          const identity = config.identities?.[config.defaults.identity];
+          if (identity?.provider && identity.provider !== providerName) {
+            diagnostics.error(
+              "qoder.template.default_memory_store.identity.provider_mismatch",
+              `agent.${name}: defaults.identity '${config.defaults.identity}' is pinned to provider '${identity.provider}'.`,
+              { type: "template", name, provider: providerName }
+            );
+          }
+          if (agent.default_memory_store.delete_on_destroy && identity?.identity_id) {
+            diagnostics.error(
+              "qoder.template.default_memory_store.delete.external_identity",
+              `agent.${name}: delete_on_destroy requires an OpenCMA-managed Identity because an external Identity keeps the default Memory Store mounted.`,
+              { type: "template", name, provider: providerName }
+            );
+          }
+        }
+      }
       if (delivery === "forward" && !isSupported(caps, "template")) {
         diagnostics.error(
           `${providerName}.agent.delivery.forward.unsupported`,
@@ -7119,10 +8007,10 @@ function collectProviderCapabilities(config, providers, diagnostics) {
             { type: "template", name, provider: providerName }
           );
         }
-        if (agent.memory_stores?.length) {
+        if (agent.memory_stores?.length && !config.defaults?.identity) {
           diagnostics.error(
-            "qoder.template.memory_store.unsupported",
-            `agent.${name}: memory_stores are not yet supported by Qoder Forward Template delivery.`,
+            "qoder.template.memory_store.identity.required",
+            `agent.${name}: Forward memory_stores require defaults.identity for the Identity/Template mount.`,
             { type: "template", name, provider: providerName }
           );
         }
@@ -7237,6 +8125,13 @@ function collectProviderCapabilities(config, providers, diagnostics) {
             { type: "agent", name, provider: providerName }
           );
         }
+        if (agent.managed_tool_config && (!agent.provider || agent.provider === providerName)) {
+          diagnostics.error(
+            `${providerName}.agent.managed_tool_config.unsupported`,
+            `agent.${name}: managed_tool_config is supported only by Qoder; remove it or pin this agent to qoder.`,
+            { type: "agent", name, provider: providerName }
+          );
+        }
         if (agent.tunnel && (!agent.provider || agent.provider === providerName)) {
           diagnostics.error(
             `${providerName}.agent.tunnel.unsupported`,
@@ -7307,251 +8202,52 @@ function collectProviderCapabilities(config, providers, diagnostics) {
             `${providerName}.deployment.schedule_unsupported`,
             "Schedules are not enforced server-side on this provider; trigger runs via external cron/CI.",
             addr
-          );
-        }
-        if (dep.initial_events?.some((e) => e.type === "user.define_outcome")) {
-          diagnostics.warning(
-            `${providerName}.deployment.define_outcome_unsupported`,
-            "Outcome rubrics (user.define_outcome) are not enforced server-side on this provider; the run executes without rubric grading.",
-            addr
-          );
-        }
-        if (dep.resources?.some((r) => r.type === "github_repository")) {
-          diagnostics.warning(
-            `${providerName}.deployment.github_repository_unsupported`,
-            "github_repository resources are not provisioned on this provider; clone the repository inside the session instead.",
-            addr
-          );
-        }
-        if (dep.resources?.some((r) => r.type === "memory_store" && (r.access === "read_only" || r.instructions))) {
-          diagnostics.warning(
-            `${providerName}.deployment.memory_store_options_unsupported`,
-            "Per-resource memory_store access/instructions are not honored on this provider; the store is attached with default access.",
-            addr
-          );
-        }
-      }
-    }
-  }
-}
-
-// src/internal/core/agent-materialization.ts
-function resolveAgentMaterialization(provider, agent) {
-  const mode = agent.delivery?.[provider]?.type ?? "managed";
-  if (mode === "managed") return { resourceType: "agent", mode };
-  return { resourceType: "template", mode };
-}
-
-// src/internal/graph/dependency.ts
-function buildDependencyGraph(config, targetProviders) {
-  const nodes = /* @__PURE__ */ new Map();
-  const edges = /* @__PURE__ */ new Map();
-  function addNode(addr) {
-    const key = addressKey(addr);
-    nodes.set(key, addr);
-    if (!edges.has(key)) edges.set(key, /* @__PURE__ */ new Set());
-  }
-  function addEdge(from, to) {
-    const fromKey = addressKey(from);
-    const toKey = addressKey(to);
-    edges.get(fromKey)?.add(toKey);
-  }
-  for (const provider of targetProviders) {
-    const def = getProvider(provider);
-    const caps = def?.capabilities;
-    if (config.environments) {
-      for (const name of Object.keys(config.environments)) {
-        const decl = config.environments[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "environment", name, provider });
-      }
-    }
-    if (config.memory_stores) {
-      for (const name of Object.keys(config.memory_stores)) {
-        const decl = config.memory_stores[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        if (!isSupported(caps, "memory_store")) continue;
-        addNode({ type: "memory_store", name, provider });
-      }
-    }
-    if (config.vaults) {
-      for (const name of Object.keys(config.vaults)) {
-        const decl = config.vaults[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "vault", name, provider });
-      }
-    }
-    if (config.skills) {
-      for (const name of Object.keys(config.skills)) {
-        const decl = config.skills[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "skill", name, provider });
-      }
-    }
-    if (config.files) {
-      for (const name of Object.keys(config.files)) {
-        const decl = config.files[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "file", name, provider });
-      }
-    }
-    if (config.identities && isSupported(caps, "identity")) {
-      for (const name of Object.keys(config.identities)) {
-        const decl = config.identities[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "identity", name, provider });
-      }
-    }
-    if (config.agents) {
-      for (const name of Object.keys(config.agents)) {
-        const decl = config.agents[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        const materialization = resolveAgentMaterialization(provider, decl);
-        const agentAddr = { type: materialization.resourceType, name, provider };
-        addNode(agentAddr);
-        if (decl.environment && config.environments?.[decl.environment]) {
-          const envAddr = {
-            type: "environment",
-            name: decl.environment,
-            provider
-          };
-          if (nodes.has(addressKey(envAddr))) {
-            addEdge(agentAddr, envAddr);
-          }
-        }
-        if (decl.skills) {
-          for (const skillRef of decl.skills) {
-            if (typeof skillRef !== "string") continue;
-            const skillName = skillRef;
-            const skillAddr = { type: "skill", name: skillName, provider };
-            if (nodes.has(addressKey(skillAddr))) {
-              addEdge(agentAddr, skillAddr);
-            }
-          }
-        }
-        if (decl.vault) {
-          const vaultAddr = { type: "vault", name: decl.vault, provider };
-          if (nodes.has(addressKey(vaultAddr))) {
-            addEdge(agentAddr, vaultAddr);
-          }
-        }
-        if (decl.memory_stores) {
-          for (const msName of decl.memory_stores) {
-            const msAddr = {
-              type: "memory_store",
-              name: msName,
-              provider
-            };
-            if (nodes.has(addressKey(msAddr))) {
-              addEdge(agentAddr, msAddr);
-            }
-          }
-        }
-        if (decl.multiagent && isSupported(caps, "multiagent")) {
-          for (const subName of decl.multiagent.agents) {
-            const subDecl = config.agents[subName];
-            const subType = subDecl ? resolveAgentMaterialization(provider, subDecl).resourceType : "agent";
-            const subAddr = { type: subType, name: subName, provider };
-            addEdge(agentAddr, subAddr);
-          }
-        }
-      }
-    }
-    if (config.deployments) {
-      for (const name of Object.keys(config.deployments)) {
-        const decl = config.deployments[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        const depAddr = { type: "deployment", name, provider };
-        addNode(depAddr);
-        const agentDecl = config.agents?.[decl.agent];
-        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
-        const agentAddr = { type: agentType, name: decl.agent, provider };
-        if (nodes.has(addressKey(agentAddr))) addEdge(depAddr, agentAddr);
-        if (decl.environment) {
-          const envAddr = { type: "environment", name: decl.environment, provider };
-          if (nodes.has(addressKey(envAddr))) addEdge(depAddr, envAddr);
-        }
-        if (decl.vaults) {
-          for (const vName of decl.vaults) {
-            const vAddr = { type: "vault", name: vName, provider };
-            if (nodes.has(addressKey(vAddr))) addEdge(depAddr, vAddr);
-          }
-        }
-        if (decl.memory_stores) {
-          for (const msName of decl.memory_stores) {
-            const msAddr = { type: "memory_store", name: msName, provider };
-            if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
-          }
+          );
         }
-        if (decl.resources) {
-          for (const r of decl.resources) {
-            if (r.type === "memory_store") {
-              const msAddr = { type: "memory_store", name: r.memory_store, provider };
-              if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
-            }
-          }
+        if (dep.initial_events?.some((e) => e.type === "user.define_outcome")) {
+          diagnostics.warning(
+            `${providerName}.deployment.define_outcome_unsupported`,
+            "Outcome rubrics (user.define_outcome) are not enforced server-side on this provider; the run executes without rubric grading.",
+            addr
+          );
         }
-      }
-    }
-    if (config.channels && isSupported(caps, "channel")) {
-      for (const name of Object.keys(config.channels)) {
-        const decl = config.channels[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        const channelAddr = { type: "channel", name, provider };
-        addNode(channelAddr);
-        const agentDecl = config.agents?.[decl.agent];
-        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
-        const agentAddr = { type: agentType, name: decl.agent, provider };
-        if (nodes.has(addressKey(agentAddr))) addEdge(channelAddr, agentAddr);
-        const identityName = decl.identity ?? config.defaults?.identity;
-        if (identityName) {
-          const identityAddr = { type: "identity", name: identityName, provider };
-          if (nodes.has(addressKey(identityAddr))) addEdge(channelAddr, identityAddr);
+        if (dep.resources?.some((r) => r.type === "github_repository")) {
+          diagnostics.warning(
+            `${providerName}.deployment.github_repository_unsupported`,
+            "github_repository resources are not provisioned on this provider; clone the repository inside the session instead.",
+            addr
+          );
+        }
+        if (dep.resources?.some((r) => r.type === "memory_store" && (r.access === "read_only" || r.instructions))) {
+          diagnostics.warning(
+            `${providerName}.deployment.memory_store_options_unsupported`,
+            "Per-resource memory_store access/instructions are not honored on this provider; the store is attached with default access.",
+            addr
+          );
         }
       }
     }
   }
-  return { nodes, edges };
-}
-function topologicalSort(graph) {
-  const visited = /* @__PURE__ */ new Set();
-  const sorted = [];
-  const visiting = /* @__PURE__ */ new Set();
-  function visit(key) {
-    if (visited.has(key)) return;
-    if (visiting.has(key)) {
-      throw new UserError(`Circular dependency detected involving: ${key}`);
-    }
-    visiting.add(key);
-    const deps = graph.edges.get(key) ?? /* @__PURE__ */ new Set();
-    for (const dep of deps) {
-      visit(dep);
-    }
-    visiting.delete(key);
-    visited.add(key);
-    sorted.push(graph.nodes.get(key));
-  }
-  for (const key of graph.nodes.keys()) {
-    visit(key);
-  }
-  return sorted;
 }
 
 // src/internal/planner/planner.ts
 async function buildPlan(config, state, options = {}) {
+  const scopedConfig = options.resourceAddresses ? selectProjectConfig(config, options.resourceAddresses) : config;
+  const resourceKeys = options.resourceAddresses ? new Set(options.resourceAddresses.map(addressKey)) : void 0;
+  const scopedState = resourceKeys ? { ...state, resources: state.resources.filter((resource) => resourceKeys.has(addressKey(resource.address))) } : state;
   const diagnostics = new DiagnosticCollector();
   const actions = [];
-  const targetProviders = options.providers ?? resolveTargetProviders(config);
-  collectReferenceDiagnostics(config, diagnostics);
-  collectProviderCapabilities(config, targetProviders, diagnostics);
-  const graph = buildDependencyGraph(config, targetProviders);
+  const targetProviders = options.providers ?? resolveTargetProviders(scopedConfig);
+  collectReferenceDiagnostics(scopedConfig, diagnostics);
+  collectProviderCapabilities(scopedConfig, targetProviders, diagnostics);
+  const graph = buildDependencyGraph(scopedConfig, targetProviders);
   const sorted = topologicalSort(graph);
   const stateIndex = /* @__PURE__ */ new Map();
-  for (const res of state.resources) {
+  for (const res of scopedState.resources) {
     stateIndex.set(addressKey(res.address), res);
   }
   const remoteIdLookup = /* @__PURE__ */ new Map();
-  for (const res of state.resources) {
+  for (const res of scopedState.resources) {
     remoteIdLookup.set(addressKey(res.address), res);
   }
   const hashStateLookup = { getResource: (addr) => remoteIdLookup.get(addressKey(addr)) };
@@ -7695,9 +8391,53 @@ async function buildPlan(config, state, options = {}) {
       dependencies: replacement ? [replacement] : []
     });
   }
-  coalesceChannelRenames(actions, config, state);
+  coalesceChannelRenames(actions, scopedConfig, scopedState);
   return { actions, diagnostics: diagnostics.getAll() };
 }
+function selectProjectConfig(config, addresses) {
+  const providers = new Set(addresses.map((address) => address.provider));
+  const namesByType = /* @__PURE__ */ new Map();
+  for (const address of addresses) {
+    const names = namesByType.get(address.type) ?? /* @__PURE__ */ new Set();
+    names.add(address.name);
+    namesByType.set(address.type, names);
+  }
+  const pick = (record, names) => {
+    if (!record || !names?.size) return void 0;
+    const selected = Object.fromEntries(Object.entries(record).filter(([name]) => names.has(name)));
+    return Object.keys(selected).length > 0 ? selected : void 0;
+  };
+  const agentNames = /* @__PURE__ */ new Set([...namesByType.get("agent") ?? [], ...namesByType.get("template") ?? []]);
+  const selectedAgents = pick(config.agents, agentNames);
+  const tunnelNames = /* @__PURE__ */ new Set();
+  for (const agent of Object.values(selectedAgents ?? {})) {
+    if (agent.tunnel) tunnelNames.add(agent.tunnel);
+  }
+  for (const deployment of Object.values(pick(config.deployments, namesByType.get("deployment")) ?? {})) {
+    if (deployment.tunnel) tunnelNames.add(deployment.tunnel);
+  }
+  const identityNames = namesByType.get("identity");
+  const selectedProviders = Object.fromEntries(
+    Object.entries(config.providers).filter(([providerName]) => providers.has(providerName))
+  );
+  const defaultProvider = providers.size === 1 ? [...providers][0] : config.defaults?.provider;
+  const defaultIdentity = config.defaults?.identity && identityNames?.has(config.defaults.identity) ? config.defaults.identity : void 0;
+  return {
+    ...config,
+    providers: selectedProviders,
+    defaults: defaultProvider || defaultIdentity ? { provider: defaultProvider, identity: defaultIdentity } : void 0,
+    environments: pick(config.environments, namesByType.get("environment")),
+    tunnels: pick(config.tunnels, tunnelNames),
+    vaults: pick(config.vaults, namesByType.get("vault")),
+    memory_stores: pick(config.memory_stores, namesByType.get("memory_store")),
+    skills: pick(config.skills, namesByType.get("skill")),
+    files: pick(config.files, namesByType.get("file")),
+    identities: pick(config.identities, identityNames),
+    agents: selectedAgents,
+    channels: pick(config.channels, namesByType.get("channel")),
+    deployments: pick(config.deployments, namesByType.get("deployment"))
+  };
+}
 function coalesceChannelRenames(actions, config, state) {
   const creates = actions.filter((action) => action.action === "create" && action.address.type === "channel");
   const deletes = actions.filter((action) => action.action === "delete" && action.address.type === "channel");
@@ -7777,6 +8517,9 @@ async function refreshState(state, providers, options = {}) {
   const errors = [];
   let dirty = false;
   for (const res of resources) {
+    if (options.resourceKeys && !options.resourceKeys.has(addressKey(res.address))) {
+      continue;
+    }
     if (options.targetProviders && !options.targetProviders.includes(res.address.provider)) {
       continue;
     }
@@ -7839,7 +8582,7 @@ async function refreshState(state, providers, options = {}) {
         dirty = true;
         continue;
       }
-      const remote = await provider.findResource(res.address.type, res.address.name, res.remote_id);
+      const remote = await provider.findResource(res.address.type, res.address.name, res.remote_id, res.api_mode);
       if (!remote) {
         if (!options.quiet) {
           emitRuntimeFeedback(options.onFeedback, {
@@ -7890,12 +8633,19 @@ async function refreshState(state, providers, options = {}) {
 }
 
 // src/internal/core/resource-runtime.ts
+async function planProjectWithStateBackend(input, options = {}) {
+  return readProjectRuntime(input, (ctx) => planProjectContext(ctx, options));
+}
 async function syncProjectResourcesWithStateBackend(input, options = {}) {
   return writeProjectRuntime(input, async (ctx) => {
     const planned = await planProjectContext(ctx, options);
     if (options.refreshOnly) {
       return { planned };
     }
+    if (options.mode === "create-only") {
+      const errorDiagnostic = planned.plan.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+      if (errorDiagnostic) throw new UserError(errorDiagnostic.message);
+    }
     return {
       planned,
       execution: await executePlannedProject(planned, {
@@ -7963,25 +8713,98 @@ async function importResource(ctx, address, remoteId, options = {}) {
   return resource;
 }
 async function planProjectContext(ctx, options = {}) {
-  const targetProviders = resolveTargetProviders2(options.provider);
+  if (options.mode === "create-only" && !options.scope) {
+    throw new UserError("Resource create-only mode requires an explicit resource scope.");
+  }
+  let targetProviders = resolveTargetProviders2(options.provider);
+  if (!targetProviders && options.scope) {
+    targetProviders = [...new Set(options.scope.roots.map((root) => root.provider))];
+  }
+  const selectedAddresses = options.scope ? resolvePlanScope(ctx, targetProviders ?? [], options.scope) : void 0;
+  const resourceKeys = selectedAddresses ? new Set(selectedAddresses.map(addressKey)) : void 0;
   const refreshResult = options.refresh !== false && ctx.state.listResources().length > 0 ? await refreshState(ctx.state, ctx.providers, {
     targetProviders,
+    resourceKeys,
     config: ctx.config,
     quiet: options.quiet ?? true,
     onFeedback: options.onFeedback
   }) : void 0;
-  const plan = await buildPlan(ctx.config, ctx.state.getStateFile(), {
+  let plan = await buildPlan(ctx.config, ctx.state.getStateFile(), {
     providers: targetProviders,
-    configPath: ctx.configPath
+    configPath: ctx.configPath,
+    resourceAddresses: selectedAddresses
   });
+  if (options.mode === "create-only" && options.scope) {
+    plan = enforceCreateOnlyPlan(plan, options.scope, toResourceRefreshResult(refreshResult));
+  }
   return {
     executionContext: ctx,
     plan,
     refreshResult: toResourceRefreshResult(refreshResult),
     targetProviders,
-    destructiveActions: selectDestructive(plan.actions)
+    destructiveActions: selectDestructive(plan.actions),
+    selectedAddresses,
+    mode: options.mode
+  };
+}
+function enforceCreateOnlyPlan(plan, scope, refreshResult) {
+  const reasons = [];
+  const rootKeys = new Set(scope.roots.map(addressKey));
+  const refreshError = refreshResult?.errors[0];
+  if (refreshError) {
+    reasons.push(
+      `Cannot verify scoped dependencies because refresh failed for ${addressKey(refreshError.resource.address)}: ${refreshError.error}`
+    );
+  }
+  for (const root of scope.roots) {
+    const rootKey = addressKey(root);
+    const rootAction = plan.actions.find((action) => addressKey(action.address) === rootKey);
+    if (!rootAction) {
+      reasons.push(`Scoped plan did not contain target resource ${rootKey}.`);
+    } else if (rootAction.action !== "create") {
+      reasons.push(`Target resource ${rootKey} must be new, but the scoped plan requires '${rootAction.action}'.`);
+    }
+  }
+  const dependencyChanges = plan.actions.filter(
+    (action) => !rootKeys.has(addressKey(action.address)) && action.action !== "no-op"
+  );
+  if (dependencyChanges.length > 0) {
+    const labels = dependencyChanges.map((action) => `${addressKey(action.address)} (${action.action})`).join(", ");
+    reasons.push(`Create-only requires every scoped dependency to be up-to-date. Reconcile first: ${labels}.`);
+  }
+  if (reasons.length === 0) return plan;
+  return {
+    ...plan,
+    diagnostics: [
+      ...plan.diagnostics,
+      {
+        severity: "error",
+        code: "resource.create_only.blocked",
+        message: reasons.join(" "),
+        resource: scope.roots[0]
+      }
+    ]
   };
 }
+function resolvePlanScope(ctx, targetProviders, scope) {
+  if (scope.roots.length === 0) {
+    throw new UserError("Resource plan scope requires at least one root address.");
+  }
+  for (const root of scope.roots) {
+    if (!targetProviders.includes(root.provider)) {
+      throw new UserError(
+        `Scoped resource ${addressKey(root)} is outside the selected provider set: ${targetProviders.join(", ")}.`
+      );
+    }
+  }
+  const graph = buildDependencyGraph(ctx.config, targetProviders);
+  for (const root of scope.roots) {
+    if (!graph.nodes.has(addressKey(root))) {
+      throw new UserError(`Scoped resource ${addressKey(root)} is not declared in the project config.`);
+    }
+  }
+  return scope.includeDependencies === false ? [...scope.roots] : collectDependencyClosure(graph, scope.roots);
+}
 async function executePlannedProject(planned, options = {}) {
   const decision = await decideDestructive(planned.destructiveActions, {
     policy: options.policy,
@@ -8025,13 +8848,6 @@ async function decideDestructive(destructiveActions, options = {}) {
       return "blocked";
   }
 }
-function replaceResourcePlan(planned, plan) {
-  return {
-    ...planned,
-    plan,
-    destructiveActions: selectDestructive(plan.actions)
-  };
-}
 function toResourceRefreshResult(result) {
   if (!result) return void 0;
   return {
@@ -8380,6 +9196,354 @@ function buildDeploymentContext(ctx, name, provider) {
   };
 }
 
+// src/internal/core/managed-api-runtime.ts
+function resolveAdapter(ctx, provider) {
+  if (provider) return getRuntimeProvider(ctx, provider);
+  const configured = Array.from(ctx.providers.keys());
+  if (configured.length === 1) return getRuntimeProvider(ctx, configured[0]);
+  throw new UserError("Multiple providers configured. Use --provider to specify one.");
+}
+function requiredMethod(value, provider, operation) {
+  if (value) return value;
+  throw new UserError(`Provider '${provider}' does not support ${operation}.`);
+}
+async function listRemoteAgents(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listAgentResources, adapter2.name, "agent listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteAgent(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getRemoteAgent, adapter2.name, "agent lookup");
+  return method2.call(adapter2, id, options.version);
+}
+async function listRemoteAgentVersions(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listAgentVersions, adapter2.name, "agent version listing");
+  return method2.call(adapter2, id, options);
+}
+async function listRemoteEnvironments(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listEnvironmentResources, adapter2.name, "environment listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteEnvironment(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getRemoteEnvironment, adapter2.name, "environment lookup");
+  return method2.call(adapter2, id);
+}
+async function listRemoteVaults(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listVaultResources, adapter2.name, "vault listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteVault(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getRemoteVault, adapter2.name, "vault lookup");
+  return method2.call(adapter2, id);
+}
+async function listRemoteSkills(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listSkillResources, adapter2.name, "skill listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteSkill(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getSkillInfo, adapter2.name, "skill lookup");
+  return method2.call(adapter2, id);
+}
+async function listRemoteSkillVersions(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listSkillVersions, adapter2.name, "skill version listing");
+  return method2.call(adapter2, id, options);
+}
+async function getRemoteSkillVersion(ctx, id, version, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getSkillVersion, adapter2.name, "skill version lookup");
+  return method2.call(adapter2, id, version);
+}
+async function getRemoteSkillDownloadInfo(ctx, id, version, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getSkillDownloadInfo, adapter2.name, "skill version download");
+  return method2.call(adapter2, id, version);
+}
+async function downloadRemoteSkill(ctx, id, version, options = {}) {
+  const info = await getRemoteSkillDownloadInfo(ctx, id, version, options);
+  const response = await resolveFetch()(info.file_url, { method: "GET" });
+  if (!response.ok) {
+    throw new ApiError(response.status, await response.text(), "Skill download failed");
+  }
+  return new Uint8Array(await response.arrayBuffer());
+}
+async function listRemoteFiles(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listFileResources, adapter2.name, "file listing");
+  return method2.call(adapter2, options);
+}
+async function downloadRemoteFile(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.downloadFileContent, adapter2.name, "file content download");
+  return method2.call(adapter2, id);
+}
+async function updateRemoteSession(ctx, id, input, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.updateSession, adapter2.name, "session update");
+  return method2.call(adapter2, id, input);
+}
+async function archiveRemoteSession(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.archiveSession, adapter2.name, "session archive");
+  return method2.call(adapter2, id);
+}
+async function sendRemoteSessionEvents(ctx, id, events, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.sendSessionEvents, adapter2.name, "generic session event sending");
+  return method2.call(adapter2, id, events);
+}
+async function listRemoteDeployments(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listDeployments, adapter2.name, "deployment listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteDeployment(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getDeploymentById, adapter2.name, "deployment lookup");
+  return method2.call(adapter2, id);
+}
+async function runRemoteDeployment(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.runDeploymentById, adapter2.name, "deployment run");
+  return method2.call(adapter2, id);
+}
+async function setRemoteDeploymentPaused(ctx, id, paused, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = paused ? adapter2.pauseDeploymentById : adapter2.unpauseDeploymentById;
+  return requiredMethod(method2, adapter2.name, `${paused ? "pausing" : "unpausing"} deployments`).call(adapter2, id);
+}
+async function listRemoteDeploymentRuns(ctx, deploymentId, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listDeploymentRuns, adapter2.name, "deployment run listing");
+  return method2.call(adapter2, deploymentId, options);
+}
+async function getRemoteDeploymentRun(ctx, runId, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getDeploymentRun, adapter2.name, "deployment run lookup");
+  return method2.call(adapter2, runId);
+}
+var API_KEY = { supported: true, auth: "api_key" };
+var CLIENT_SEARCH = {
+  supported: true,
+  auth: "api_key",
+  reason: "Client-side filtering over the corresponding list API."
+};
+var UNSUPPORTED_MODEL = {
+  supported: false,
+  auth: null,
+  reason: "The public Managed Agents API does not expose a model catalog endpoint."
+};
+var UNSUPPORTED_THREAD = {
+  supported: false,
+  auth: null,
+  reason: "Managed Agents exposes child-thread ids and lifecycle events through Session Events, but no independent Thread resource API."
+};
+var UNSUPPORTED_OAUTH = {
+  supported: false,
+  auth: null,
+  reason: "The public Managed Agents data plane does not expose MCP OAuth login."
+};
+var BAILIAN_OPERATIONS = {
+  "agent.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "agent.list": API_KEY,
+  "agent.get": API_KEY,
+  "agent.search": CLIENT_SEARCH,
+  "agent.versions": API_KEY,
+  "environment.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "environment.list": API_KEY,
+  "environment.get": API_KEY,
+  "environment.search": CLIENT_SEARCH,
+  "skill.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "skill.list": API_KEY,
+  "skill.get": API_KEY,
+  "skill.search": CLIENT_SEARCH,
+  "skill.versions": API_KEY,
+  "skill.download": API_KEY,
+  "vault.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "vault.credential.create": { ...API_KEY, reason: "YAML declaration plus scoped Vault transaction." },
+  "vault.list": API_KEY,
+  "vault.get": API_KEY,
+  "vault.search": CLIENT_SEARCH,
+  "deployment.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "deployment.list": API_KEY,
+  "deployment.get": API_KEY,
+  "deployment.search": { ...API_KEY, reason: "Maps to the server-side keyword parameter." },
+  "deployment.runs.list": API_KEY,
+  "deployment.runs.get": API_KEY,
+  "deployment.run": API_KEY,
+  "deployment.pause": API_KEY,
+  "deployment.unpause": API_KEY,
+  "session.create": API_KEY,
+  "session.list": API_KEY,
+  "session.get": API_KEY,
+  "session.search": CLIENT_SEARCH,
+  "session.update": API_KEY,
+  "session.archive": API_KEY,
+  "session.delete": API_KEY,
+  "session.run": { ...API_KEY, reason: "Client composition of session create and event send/stream." },
+  "session.event.send": API_KEY,
+  "session.event.list": API_KEY,
+  "session.event.stream": API_KEY,
+  "session.debug": { ...API_KEY, reason: "Client-side aggregation of supported read APIs." },
+  "session.export": { ...API_KEY, reason: "Client-side export of supported read APIs." },
+  "file.upload": API_KEY,
+  "file.list": API_KEY,
+  "file.get": API_KEY,
+  "file.search": CLIENT_SEARCH,
+  "file.download": API_KEY,
+  "file.delete": API_KEY,
+  "model.list": UNSUPPORTED_MODEL,
+  "model.search": UNSUPPORTED_MODEL,
+  "session_thread.list": UNSUPPORTED_THREAD,
+  "session_thread.get": UNSUPPORTED_THREAD,
+  "session_thread.archive": UNSUPPORTED_THREAD,
+  "session_thread.events": UNSUPPORTED_THREAD,
+  "mcp.oauth_login": UNSUPPORTED_OAUTH
+};
+function getManagedAgentProviderCapabilities(provider) {
+  if (provider === "bailian") {
+    return { provider, operations: { ...BAILIAN_OPERATIONS } };
+  }
+  return {
+    provider,
+    operations: {
+      "managed_agent.api": {
+        supported: false,
+        auth: null,
+        reason: "The operation-level API command surface is currently implemented for Bailian only."
+      }
+    }
+  };
+}
+
+// src/internal/core/vault-credential-runtime.ts
+async function planVaultCredentialCreate(ctx, vaultName, credentialName, options = {}) {
+  const prepared = await prepareVaultCredentialCreate(ctx, vaultName, credentialName, options);
+  return {
+    provider: prepared.provider,
+    vault: vaultName,
+    vaultRemoteId: prepared.vaultState.remote_id,
+    credential: credentialName,
+    remoteChecked: prepared.remoteChecked,
+    reuseRemote: Boolean(prepared.remoteCredential),
+    remoteCredentialId: prepared.remoteCredential?.id
+  };
+}
+async function planVaultCredentialCreateWithStateBackend(input, vaultName, credentialName, options = {}) {
+  return readProjectRuntime(input, (ctx) => planVaultCredentialCreate(ctx, vaultName, credentialName, options));
+}
+async function createVaultCredential(ctx, vaultName, credentialName, options = {}) {
+  if (options.checkRemote === false) {
+    throw new UserError("Vault Credential create requires the remote duplicate check.");
+  }
+  const prepared = await prepareVaultCredentialCreate(ctx, vaultName, credentialName, options);
+  const remote = prepared.remoteCredential ?? await prepared.adapter.createCredential(prepared.vaultState.remote_id, prepared.credential);
+  if (!remote.id) throw new UserError("Credential create returned no remote id.");
+  const address = { type: "vault", name: vaultName, provider: prepared.provider };
+  const desiredHash = await computeResourceHash(address, ctx.config, ctx.configPath, ctx.state);
+  ctx.state.setResource({
+    ...prepared.vaultState,
+    content_hash: desiredHash,
+    desired_hash: desiredHash,
+    drift_paths: [],
+    drift_status: "unchecked"
+  });
+  await ctx.state.save();
+  return {
+    provider: prepared.provider,
+    vault: vaultName,
+    vaultRemoteId: prepared.vaultState.remote_id,
+    credential: credentialName,
+    remoteChecked: prepared.remoteChecked,
+    credentialId: remote.id,
+    reuseRemote: Boolean(prepared.remoteCredential),
+    remoteCredentialId: prepared.remoteCredential?.id,
+    adopted: Boolean(prepared.remoteCredential)
+  };
+}
+async function createVaultCredentialWithStateBackend(input, vaultName, credentialName, options = {}) {
+  return writeProjectRuntime(input, (ctx) => createVaultCredential(ctx, vaultName, credentialName, options));
+}
+async function prepareVaultCredentialCreate(ctx, vaultName, credentialName, options) {
+  const vault = ctx.config.vaults?.[vaultName];
+  if (!vault) throw new UserError(`Vault '${vaultName}' is not declared in the project config.`);
+  const provider = resolveVaultProvider(ctx, vault.provider, options.provider);
+  const credential = vault.credentials.at(-1);
+  if (!credential || credential.name !== credentialName) {
+    throw new UserError(`Credential '${credentialName}' must be the final newly appended entry in vault.${vaultName}.`);
+  }
+  if (vault.credentials.slice(0, -1).some((entry) => entry.name === credentialName)) {
+    throw new UserError(`Vault '${vaultName}' already declares a credential named '${credentialName}'.`);
+  }
+  const address = { type: "vault", name: vaultName, provider };
+  const priorConfig = structuredClone(ctx.config);
+  priorConfig.vaults[vaultName] = {
+    ...priorConfig.vaults[vaultName],
+    credentials: priorConfig.vaults[vaultName].credentials.slice(0, -1)
+  };
+  const priorPlan = await planProjectContext(
+    { ...ctx, config: priorConfig },
+    {
+      provider,
+      scope: { roots: [address] },
+      refresh: options.refresh,
+      quiet: options.quiet ?? true
+    }
+  );
+  const refreshError = priorPlan.refreshResult?.errors[0];
+  if (refreshError) {
+    throw new UserError(`Cannot verify vault.${vaultName} because refresh failed: ${refreshError.error}`);
+  }
+  const errorDiagnostic = priorPlan.plan.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+  if (errorDiagnostic) throw new UserError(errorDiagnostic.message);
+  const vaultAction = priorPlan.plan.actions.find(
+    (action) => action.address.type === "vault" && action.address.name === vaultName
+  );
+  if (vaultAction?.action !== "no-op") {
+    throw new UserError(
+      `vault.${vaultName} must be tracked and up-to-date before adding a credential; current action is '${vaultAction?.action ?? "missing"}'.`
+    );
+  }
+  const vaultState = ctx.state.getResource(address);
+  if (!vaultState?.remote_id) throw new UserError(`vault.${vaultName} has no tracked remote id.`);
+  const adapter2 = getRuntimeProvider(ctx, provider);
+  if (!adapter2.createCredential || !adapter2.listCredentials) {
+    throw new UserError(`Provider '${provider}' does not support scoped Vault Credential create.`);
+  }
+  const remoteChecked = options.checkRemote !== false;
+  const sameName = remoteChecked ? (await adapter2.listCredentials(vaultState.remote_id)).filter(
+    (remoteCredential) => remoteCredential.display_name === credentialName
+  ) : [];
+  const exact = sameName.find((remoteCredential) => credentialMatches(remoteCredential, credential));
+  if (sameName.length > 0 && !exact) {
+    throw new UserError(`Vault '${vaultName}' already has a different remote credential named '${credentialName}'.`);
+  }
+  return { provider, credential, vaultState, adapter: adapter2, remoteChecked, remoteCredential: exact };
+}
+function resolveVaultProvider(ctx, declaredProvider, requestedProvider) {
+  if (requestedProvider && declaredProvider && requestedProvider !== declaredProvider) {
+    throw new UserError(
+      `Vault provider '${declaredProvider}' does not match requested provider '${requestedProvider}'.`
+    );
+  }
+  const provider = requestedProvider ?? declaredProvider ?? ctx.config.defaults?.provider;
+  if (provider && provider !== "all") return provider;
+  const configured = [...ctx.providers.keys()];
+  if (configured.length === 1) return configured[0];
+  throw new UserError("Cannot infer one provider for Vault Credential create.");
+}
+function credentialMatches(remote, desired) {
+  return remote.auth_type === desired.type && remote.secret_name === desired.secret_name && (remote.networking_type ?? "unrestricted") === (desired.networking?.type ?? "unrestricted");
+}
+
 // src/internal/core/destroy-runtime.ts
 var destroyOrder = {
   deployment: 0,
@@ -8397,12 +9561,64 @@ function planDestroyProjectContext(ctx) {
   const resources = [...ctx.state.listResources()].sort(
     (a, b) => (destroyOrder[a.address.type] ?? 99) - (destroyOrder[b.address.type] ?? 99)
   );
-  return { resources, executionContext: ctx };
+  const identityName = ctx.config.defaults?.identity;
+  const defaultMemoryStores = [];
+  for (const [agentName, agent] of Object.entries(ctx.config.agents ?? {})) {
+    if (!agent.default_memory_store || agent.delivery?.qoder?.type !== "forward") continue;
+    if (agent.provider && agent.provider !== "qoder") continue;
+    const identityId = identityName ? ctx.state.getResource({ type: "identity", name: identityName, provider: "qoder" })?.remote_id ?? null : null;
+    const templateId = ctx.state.getResource({ type: "template", name: agentName, provider: "qoder" })?.remote_id ?? null;
+    if (!identityId && !templateId) continue;
+    defaultMemoryStores.push({
+      agentName,
+      provider: "qoder",
+      identityId,
+      templateId,
+      deleteOnDestroy: agent.default_memory_store.delete_on_destroy ?? false
+    });
+  }
+  for (const pending of ctx.state.getStateFile().pending_default_memory_store_cleanups ?? []) {
+    const existing = defaultMemoryStores.find(
+      (item) => item.agentName === pending.agent_name && item.provider === pending.provider
+    );
+    if (existing) {
+      existing.memoryStoreId = pending.remote_id;
+      existing.deleteOnDestroy = true;
+    } else {
+      defaultMemoryStores.push({
+        agentName: pending.agent_name,
+        provider: pending.provider,
+        identityId: pending.identity_id ?? null,
+        templateId: pending.template_id ?? null,
+        deleteOnDestroy: true,
+        memoryStoreId: pending.remote_id
+      });
+    }
+  }
+  return { resources, defaultMemoryStores, executionContext: ctx };
 }
 async function destroyPlannedProjectResources(planned, options = {}) {
   const results = [];
-  let stateChanged = false;
+  const capturedDefaults = await captureDefaultMemoryStores(planned);
   const ctx = planned.executionContext;
+  if (capturedDefaults.some((item) => item.error)) {
+    const defaultMemoryStoreResults2 = capturedDefaults.map(preflightFailureResult);
+    for (const resource of planned.resources) {
+      const result = {
+        resource,
+        status: "blocked",
+        reason: "skipped",
+        error: "Destroy aborted because the default Memory Store preflight failed."
+      };
+      results.push(result);
+      options.onResourceResult?.(result);
+    }
+    return { ...planned, results, defaultMemoryStoreResults: defaultMemoryStoreResults2, destroyed: 0, partial: true };
+  }
+  if (await persistCapturedDefaultMemoryStores(ctx, capturedDefaults)) {
+    await ctx.state.save();
+  }
+  let stateChanged = false;
   for (const resource of planned.resources) {
     options.onResourceStart?.(resource);
     const result = await destroyOneResource(ctx, resource, options);
@@ -8413,14 +9629,171 @@ async function destroyPlannedProjectResources(planned, options = {}) {
   if (stateChanged) {
     await ctx.state.save();
   }
+  const defaultMemoryStoreResults = await finalizeDefaultMemoryStores(planned, capturedDefaults, options);
+  if (recordFailedDefaultMemoryStoreCleanups(ctx, defaultMemoryStoreResults)) {
+    await ctx.state.save();
+  }
+  if (clearCompletedDefaultMemoryStoreCleanups(ctx, defaultMemoryStoreResults)) {
+    await ctx.state.save();
+  }
   const destroyed = results.filter((result) => result.status === "success").length;
   return {
     ...planned,
     results,
+    defaultMemoryStoreResults,
     destroyed,
-    partial: destroyed !== planned.resources.length
+    partial: destroyed !== planned.resources.length || defaultMemoryStoreResults.some((result) => result.status === "failed")
+  };
+}
+async function persistCapturedDefaultMemoryStores(ctx, captured) {
+  const state = ctx.state.getStateFile();
+  if (!state.pending_default_memory_store_cleanups) state.pending_default_memory_store_cleanups = [];
+  const pending = state.pending_default_memory_store_cleanups;
+  let changed = false;
+  for (const item of captured) {
+    if (!item.plan.deleteOnDestroy || !item.memoryStoreId) continue;
+    if (pending.some((entry) => entry.provider === item.plan.provider && entry.remote_id === item.memoryStoreId))
+      continue;
+    pending.push({
+      agent_name: item.plan.agentName,
+      provider: item.plan.provider,
+      remote_id: item.memoryStoreId,
+      ...item.plan.identityId ? { identity_id: item.plan.identityId } : {},
+      ...item.plan.templateId ? { template_id: item.plan.templateId } : {}
+    });
+    changed = true;
+  }
+  return changed;
+}
+function clearCompletedDefaultMemoryStoreCleanups(ctx, results) {
+  const state = ctx.state.getStateFile();
+  const completedIds = new Set(
+    results.filter((item) => item.status === "deleted" || item.status === "already_gone").map((item) => item.memoryStoreId).filter((id) => Boolean(id))
+  );
+  if (completedIds.size === 0 || !state.pending_default_memory_store_cleanups?.length) return false;
+  const remaining = state.pending_default_memory_store_cleanups.filter((item) => !completedIds.has(item.remote_id));
+  if (remaining.length === state.pending_default_memory_store_cleanups.length) return false;
+  state.pending_default_memory_store_cleanups = remaining;
+  return true;
+}
+function recordFailedDefaultMemoryStoreCleanups(ctx, results) {
+  const pending = ctx.state.getStateFile().pending_default_memory_store_cleanups;
+  if (!pending?.length) return false;
+  let changed = false;
+  for (const result of results) {
+    if (result.status !== "failed" || !result.memoryStoreId) continue;
+    const entry = pending.find((item) => item.remote_id === result.memoryStoreId);
+    if (entry && entry.last_error !== result.error) {
+      entry.last_error = result.error;
+      changed = true;
+    }
+  }
+  return changed;
+}
+function preflightFailureResult(item) {
+  if (!item.plan.deleteOnDestroy) return { ...item.plan, status: "retained" };
+  return {
+    ...item.plan,
+    status: "failed",
+    ...item.memoryStoreId ? { memoryStoreId: item.memoryStoreId } : {},
+    error: item.error ?? "Destroy aborted because another default Memory Store preflight failed."
   };
 }
+async function captureDefaultMemoryStores(planned) {
+  return Promise.all(
+    planned.defaultMemoryStores.map(async (item) => {
+      if (!item.deleteOnDestroy) return { plan: item };
+      if (item.memoryStoreId) return { plan: item, memoryStoreId: item.memoryStoreId };
+      if (!item.identityId || !item.templateId) {
+        return { plan: item, error: "Cannot resolve the Identity and Template before destroy." };
+      }
+      try {
+        const provider = getRuntimeProvider(planned.executionContext, item.provider);
+        if (!provider.findDefaultMemoryStoreId || !provider.deleteDefaultMemoryStore) {
+          return { plan: item, error: `Provider '${item.provider}' cannot delete a default memory store.` };
+        }
+        const memoryStoreId = await provider.findDefaultMemoryStoreId(item.identityId, item.templateId);
+        return { plan: item, ...memoryStoreId ? { memoryStoreId } : {} };
+      } catch (error) {
+        return { plan: item, error: error instanceof Error ? error.message : String(error) };
+      }
+    })
+  );
+}
+async function finalizeDefaultMemoryStores(planned, captured, options) {
+  const output = [];
+  for (const item of captured) {
+    if (!item.plan.deleteOnDestroy) {
+      output.push({ ...item.plan, status: "retained" });
+      continue;
+    }
+    if (item.error) {
+      output.push({ ...item.plan, status: "failed", error: item.error });
+      continue;
+    }
+    if (!item.memoryStoreId) {
+      output.push({ ...item.plan, status: "already_gone" });
+      continue;
+    }
+    try {
+      const provider = getRuntimeProvider(planned.executionContext, item.plan.provider);
+      await deleteDefaultMemoryStoreWithArchiveFallback(
+        provider,
+        item.memoryStoreId,
+        options.defaultMemoryStoreRetryDelaysMs ?? [1e3, 2e3, 4e3, 8e3]
+      );
+      output.push({ ...item.plan, status: "deleted", memoryStoreId: item.memoryStoreId });
+    } catch (error) {
+      if (ApiError.isNotFound(error)) {
+        output.push({ ...item.plan, status: "already_gone", memoryStoreId: item.memoryStoreId });
+      } else {
+        output.push({
+          ...item.plan,
+          status: "failed",
+          memoryStoreId: item.memoryStoreId,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+  }
+  return output;
+}
+async function deleteDefaultMemoryStoreWithArchiveFallback(provider, memoryStoreId, retryDelaysMs) {
+  try {
+    await retryDefaultMemoryStoreOperation(() => provider.deleteDefaultMemoryStore(memoryStoreId), retryDelaysMs);
+  } catch (error) {
+    if (isAlreadyArchivedConflict(error) && provider.deleteMemoryStore) {
+      await retryDefaultMemoryStoreOperation(() => provider.deleteMemoryStore(memoryStoreId), retryDelaysMs);
+      return;
+    }
+    if (!isStillMountedConflict(error) || !provider.archiveMemoryStore || !provider.deleteMemoryStore) throw error;
+    await retryDefaultMemoryStoreOperation(() => provider.archiveMemoryStore(memoryStoreId), retryDelaysMs);
+    await retryDefaultMemoryStoreOperation(() => provider.deleteMemoryStore(memoryStoreId), retryDelaysMs);
+  }
+}
+async function retryDefaultMemoryStoreOperation(operation, delaysMs) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await operation();
+      return;
+    } catch (error) {
+      if (!isRetryableDefaultMemoryStoreError(error) || attempt >= delaysMs.length) throw error;
+      await delay(delaysMs[attempt]);
+    }
+  }
+}
+function isRetryableDefaultMemoryStoreError(error) {
+  return error instanceof ApiError && (isStillMountedConflict(error) || isAlreadyArchivedConflict(error) || error.statusCode === 429 || [500, 502, 503].includes(error.statusCode));
+}
+function isStillMountedConflict(error) {
+  return error instanceof ApiError && error.statusCode === 409 && error.responseBody.includes("still mounted");
+}
+function isAlreadyArchivedConflict(error) {
+  return error instanceof ApiError && error.statusCode === 409 && error.responseBody.toLowerCase().includes("already archived");
+}
+function delay(ms) {
+  return new Promise((resolve13) => setTimeout(resolve13, ms));
+}
 async function destroyOneResource(ctx, resource, options) {
   if (isExternalReference(ctx, resource)) {
     ctx.state.removeResource(resource.address);
@@ -8441,8 +9814,18 @@ async function destroyOneResource(ctx, resource, options) {
     ctx.state.removeResource(resource.address);
     return successResult(resource, "destroyed");
   }
+  const apiMode = resource.api_mode === "auto" ? void 0 : resource.api_mode;
   try {
-    await deleteRemoteResource(provider, resource.address.type, resource.remote_id, options.cascade);
+    await deleteRemoteResource(
+      provider,
+      resource.address.type,
+      resource.remote_id,
+      options.cascade,
+      apiMode,
+      ctx.state.listResources().filter(
+        (candidate) => candidate.address.provider === resource.address.provider && candidate.address.type === "memory_store" && candidate.api_mode === "forward" && typeof candidate.remote_id === "string"
+      ).map((candidate) => candidate.remote_id)
+    );
     ctx.state.removeResource(resource.address);
     emitRuntimeFeedback(options.onFeedback, {
       type: "resource_action_success",
@@ -8471,7 +9854,7 @@ async function destroyOneResource(ctx, resource, options) {
       };
       if (await options.onCascadeRequired?.(blocked)) {
         try {
-          await provider.deleteEnvironment(resource.remote_id, true);
+          await provider.deleteEnvironment(resource.remote_id, true, apiMode);
           ctx.state.removeResource(resource.address);
           return {
             ...successResult(resource, "destroyed"),
@@ -8507,29 +9890,29 @@ function failureResult(resource, error) {
     error: error instanceof Error ? error.message : String(error)
   };
 }
-async function deleteRemoteResource(provider, type, id, cascade) {
+async function deleteRemoteResource(provider, type, id, cascade, mode, ownedMemoryStoreIds = []) {
   switch (type) {
     case "agent":
       await provider.deleteAgent(id);
       return;
     case "template":
       if (!provider.archiveTemplate) throw new UserError(`Provider does not support templates`);
-      await provider.archiveTemplate(id);
+      await provider.archiveTemplate(id, ownedMemoryStoreIds);
       return;
     case "skill":
-      await provider.deleteSkill(id);
+      await provider.deleteSkill(id, mode);
       return;
     case "memory_store":
       if (!provider.deleteMemoryStore) {
         throw new UserError(`Provider does not support memory stores`);
       }
-      await provider.deleteMemoryStore(id);
+      await provider.deleteMemoryStore(id, mode);
       return;
     case "vault":
-      await provider.deleteVault(id);
+      await provider.deleteVault(id, mode);
       return;
     case "environment":
-      await provider.deleteEnvironment(id, cascade);
+      await provider.deleteEnvironment(id, cascade, mode);
       return;
     case "deployment":
       await provider.deleteDeployment(id);
@@ -8543,7 +9926,7 @@ async function deleteRemoteResource(provider, type, id, cascade) {
       await provider.deleteChannel(id);
       return;
     case "file":
-      await provider.deleteFile(id);
+      await provider.deleteFile(id, mode);
       return;
   }
 }
@@ -8703,6 +10086,7 @@ function buildAgentDecl(base, input) {
   });
   const agent = {
     ...base ?? {},
+    name: input.name ?? base?.name,
     description: input.description ?? base?.description,
     model,
     instructions: input.instructions ?? base?.instructions ?? "",
@@ -8939,28 +10323,36 @@ async function listAgentsWithReadiness(ctx, options = {}) {
 }
 async function planAgentResources(ctx, agentId, options = {}) {
   const agent = getAgent(ctx, agentId);
+  const rootAddress = collectAgentAddresses(ctx.config, agent.agentName, agent.provider)[0];
   const planned = await planProjectContext(ctx, {
     provider: agent.provider,
+    scope: { roots: [rootAddress] },
+    mode: options.mode,
     refresh: options.refresh,
     quiet: options.quiet ?? true
   });
-  const actions = filterAgentActions(ctx, agent, planned.plan);
+  const actions = planned.plan.actions;
+  const diagnostics = planned.plan.diagnostics;
   return {
     agentId,
     provider: agent.provider,
     actions,
-    diagnostics: filterAgentDiagnostics(ctx, agent, planned.plan),
+    diagnostics,
     destructiveActions: selectDestructive(actions),
     planned
   };
 }
+async function planAgentResourcesWithStateBackend(input, agentId, options = {}) {
+  return readProjectRuntime(input, (ctx) => planAgentResources(ctx, agentId, options));
+}
 async function syncAgentResources(ctx, agentId, options = {}) {
   return runAgentSync(ctx, agentId, options);
 }
 async function runAgentSync(ctx, agentId, options) {
   const fullPlan = await planAgentResources(ctx, agentId, {
     refresh: options.refresh,
-    quiet: options.quiet
+    quiet: options.quiet,
+    mode: options.mode
   });
   const actions = fullPlan.actions;
   const destructiveActions = fullPlan.destructiveActions;
@@ -8994,11 +10386,7 @@ async function runAgentSync(ctx, agentId, options) {
     };
   }
   try {
-    const scopedPlan = {
-      diagnostics: fullPlan.diagnostics,
-      actions: scopePlanActions(fullPlan.planned.plan, actions)
-    };
-    const execution = await executePlannedProject(replaceResourcePlan(fullPlan.planned, scopedPlan), {
+    const execution = await executePlannedProject(fullPlan.planned, {
       policy: "force"
     });
     const results = toAgentSyncResults(execution);
@@ -9102,29 +10490,6 @@ function getAgentReadinessFromPlan(ctx, agentId, plan) {
     plannedActions: relevantActions
   };
 }
-function filterAgentActions(ctx, agent, plan) {
-  const relevantKeys = agentAddressKeys(ctx, agent);
-  return plan.actions.filter(
-    (action) => relevantKeys.has(addressKey(action.address)) || action.dependencies.some((dependency) => relevantKeys.has(addressKey(dependency)))
-  );
-}
-function filterAgentDiagnostics(ctx, agent, plan) {
-  const relevantKeys = agentAddressKeys(ctx, agent);
-  return plan.diagnostics.filter(
-    (diagnostic) => !diagnostic.resource || relevantKeys.has(addressKey(diagnostic.resource))
-  );
-}
-function agentAddressKeys(ctx, agent) {
-  return new Set(collectAgentAddresses(ctx.config, agent.agentName, agent.provider).map(addressKey));
-}
-function scopePlanActions(fullPlan, agentActions) {
-  const allowedKeys = new Set(agentActions.filter((action) => action.action !== "no-op").map(actionKey));
-  return fullPlan.actions.filter((action) => action.action === "no-op" || allowedKeys.has(actionKey(action)));
-}
-function actionKey(action) {
-  const address = action.address;
-  return `${action.action}:${address.provider}:${address.type}:${address.name}`;
-}
 function isNonBlockingAgentDrift(action) {
   if (action.action === "no-op") return true;
   return action.readinessImpact === "non_blocking";
@@ -9136,33 +10501,13 @@ function collectAgentAddresses(config, agentName, provider) {
   }
   const resolvedProvider = provider ?? resolveSessionProvider(agentName, config, void 0);
   const materialization = resolveAgentMaterialization(resolvedProvider, agent);
-  const addresses = [
-    { type: materialization.resourceType, name: agentName, provider: resolvedProvider }
-  ];
-  if (agent.environment) {
-    addresses.push({
-      type: "environment",
-      name: agent.environment,
-      provider: resolvedProvider
-    });
-  }
-  if (agent.vault) {
-    addresses.push({ type: "vault", name: agent.vault, provider: resolvedProvider });
-  }
-  for (const name of agent.memory_stores ?? []) {
-    addresses.push({ type: "memory_store", name, provider: resolvedProvider });
-  }
-  for (const skill of agent.skills ?? []) {
-    if (typeof skill === "string") {
-      addresses.push({ type: "skill", name: skill, provider: resolvedProvider });
-    }
-  }
-  for (const subAgent of agent.multiagent?.agents ?? []) {
-    const subDecl = config.agents?.[subAgent];
-    const subType = subDecl ? resolveAgentMaterialization(resolvedProvider, subDecl).resourceType : "agent";
-    addresses.push({ type: subType, name: subAgent, provider: resolvedProvider });
-  }
-  return addresses;
+  const rootAddress = {
+    type: materialization.resourceType,
+    name: agentName,
+    provider: resolvedProvider
+  };
+  const graph = buildDependencyGraph(config, [resolvedProvider]);
+  return collectDependencyClosure(graph, [rootAddress]);
 }
 function toAgentDefinition(config, agentName, agent) {
   return {
@@ -9308,7 +10653,7 @@ async function collectEventsUntilTerminal(adapter2, sessionId, options = {}) {
         terminalStatus = terminalEvent.status;
         break;
       }
-      await delay(currentIntervalMs);
+      await delay2(currentIntervalMs);
       currentIntervalMs = Math.min(currentIntervalMs * 2, maxPollIntervalMs);
     }
   } else {
@@ -9319,7 +10664,7 @@ async function collectEventsUntilTerminal(adapter2, sessionId, options = {}) {
         terminalStatus = session.status;
         break;
       }
-      await delay(currentIntervalMs);
+      await delay2(currentIntervalMs);
       currentIntervalMs = Math.min(currentIntervalMs * 2, maxPollIntervalMs);
     }
     result = await adapter2.listSessionEvents(sessionId, { limit: 100 });
@@ -9389,12 +10734,20 @@ async function listSessionEvents(ctx, sessionId, options = {}) {
   const listOptions = {};
   if (options.limit !== void 0) listOptions.limit = options.limit;
   if (options.order !== void 0) listOptions.order = options.order;
+  if (options.types !== void 0) listOptions.types = options.types;
+  if (options.created_at_gt !== void 0) listOptions.created_at_gt = options.created_at_gt;
+  if (options.created_at_gte !== void 0) listOptions.created_at_gte = options.created_at_gte;
+  if (options.created_at_lt !== void 0) listOptions.created_at_lt = options.created_at_lt;
+  if (options.created_at_lte !== void 0) listOptions.created_at_lte = options.created_at_lte;
   const pageToken = options.page_token ?? options.page;
   if (pageToken !== void 0) listOptions.page_token = pageToken;
-  return resolveDirectAdapter(ctx, options.provider).listSessionEvents(
+  const result = await resolveDirectAdapter(ctx, options.provider).listSessionEvents(
     sessionId,
     Object.keys(listOptions).length > 0 ? listOptions : void 0
   );
+  if (!options.types || options.types.length === 0) return result;
+  const allowedTypes = new Set(options.types);
+  return { ...result, events: result.events.filter((event) => allowedTypes.has(event.raw_type)) };
 }
 async function uploadFile(ctx, content, filename, options = {}) {
   const adapter2 = resolveDirectAdapter(ctx, options.provider);
@@ -9444,12 +10797,89 @@ async function deleteSkill(ctx, id, options = {}) {
   await resolveDirectAdapter(ctx, options.provider).deleteSkill(id);
 }
 function streamSessionEvents(ctx, sessionId, options = {}) {
+  const adapter2 = resolveDirectAdapter(ctx, options.provider);
+  if (options.after_id && !adapter2.eventResume) {
+    return replaySessionEventsByPolling(adapter2, sessionId, options.after_id);
+  }
   const streamOptions = {};
   if (options.after_id !== void 0) streamOptions.after_id = options.after_id;
-  return resolveDirectAdapter(ctx, options.provider).streamSessionEvents(
-    sessionId,
-    Object.keys(streamOptions).length > 0 ? streamOptions : void 0
-  );
+  return adapter2.streamSessionEvents(sessionId, Object.keys(streamOptions).length > 0 ? streamOptions : void 0);
+}
+async function* replaySessionEventsByPolling(adapter2, sessionId, afterId) {
+  const history = await listAllSessionEventHistory(adapter2, sessionId);
+  const markerIndex = history.findIndex((event) => event.id === afterId);
+  if (markerIndex < 0) {
+    throw new UserError(`Session event '${afterId}' was not found; list session events and choose a valid event id.`);
+  }
+  const knownEventKeys = new Set(history.slice(0, markerIndex + 1).map(sessionEventKey));
+  for (const event of history.slice(markerIndex + 1)) {
+    const eventKey = sessionEventKey(event);
+    if (knownEventKeys.has(eventKey)) continue;
+    knownEventKeys.add(eventKey);
+    yield event;
+    if (event.type === "status" && isTerminalSessionStatus(event.status)) return;
+  }
+  while (true) {
+    const newEvents = await listNewSessionEvents(adapter2, sessionId, knownEventKeys);
+    for (const event of newEvents) {
+      const eventKey = sessionEventKey(event);
+      if (knownEventKeys.has(eventKey)) continue;
+      knownEventKeys.add(eventKey);
+      yield event;
+      if (event.type === "status" && isTerminalSessionStatus(event.status)) return;
+    }
+    const session = await adapter2.getSession(sessionId);
+    if (isTerminalSessionStatus(session.status)) return;
+    await delay2(DEFAULT_POLL_INTERVAL_MS);
+  }
+}
+async function listAllSessionEventHistory(adapter2, sessionId) {
+  const events = [];
+  const seenPageTokens = /* @__PURE__ */ new Set();
+  let pageToken;
+  while (true) {
+    const result = await adapter2.listSessionEvents(sessionId, {
+      limit: 100,
+      order: "asc",
+      ...pageToken ? { page_token: pageToken } : {}
+    });
+    events.push(...result.events);
+    if (!result.next_page) return events;
+    if (seenPageTokens.has(result.next_page)) {
+      throw new UserError("Session event pagination returned a repeated cursor.");
+    }
+    seenPageTokens.add(result.next_page);
+    pageToken = result.next_page;
+  }
+}
+async function listNewSessionEvents(adapter2, sessionId, knownEventKeys) {
+  const descendingEvents = [];
+  const seenPageTokens = /* @__PURE__ */ new Set();
+  let pageToken;
+  while (true) {
+    const result = await adapter2.listSessionEvents(sessionId, {
+      limit: 100,
+      order: "desc",
+      ...pageToken ? { page_token: pageToken } : {}
+    });
+    let reachedKnownEvent = false;
+    for (const event of result.events) {
+      if (knownEventKeys.has(sessionEventKey(event))) {
+        reachedKnownEvent = true;
+        break;
+      }
+      descendingEvents.push(event);
+    }
+    if (reachedKnownEvent || !result.next_page) return descendingEvents.reverse();
+    if (seenPageTokens.has(result.next_page)) {
+      throw new UserError("Session event pagination returned a repeated cursor.");
+    }
+    seenPageTokens.add(result.next_page);
+    pageToken = result.next_page;
+  }
+}
+function sessionEventKey(event) {
+  return event.id ?? `raw:${event.raw_type}:${JSON.stringify(event.raw)}`;
 }
 function resolveDirectAdapter(ctx, overrideProvider) {
   if (overrideProvider) return getRuntimeProvider(ctx, overrideProvider);
@@ -9486,7 +10916,7 @@ async function* streamWithResume(adapter2, sessionId, message) {
       }
     }
     if (!reachedTerminal) {
-      await delay(reconnectIntervalMs);
+      await delay2(reconnectIntervalMs);
       reconnectIntervalMs = Math.min(reconnectIntervalMs * 2, DEFAULT_POLL_INTERVAL_MS);
     }
   }
@@ -9514,7 +10944,7 @@ function assertNotTimedOut(start, timeoutMs) {
     throw new UserError(`Session did not complete within the timeout (${Math.floor(timeoutMs / 1e3)} seconds).`);
   }
 }
-function delay(ms) {
+function delay2(ms) {
   return new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 
@@ -9700,6 +11130,7 @@ var StateManager = class _StateManager {
         address: r.address,
         remote_id: r.remote_id,
         externally_managed: r.externally_managed === true ? true : void 0,
+        api_mode: r.api_mode === "forward" ? "forward" : r.api_mode === "managed" ? "managed" : void 0,
         version: r.version,
         content_hash: r.content_hash ?? r.desired_hash ?? "",
         desired_hash: r.desired_hash ?? r.content_hash ?? "",
@@ -9711,7 +11142,11 @@ var StateManager = class _StateManager {
         drift_paths: r.drift_paths,
         drift_status: r.drift_status
       }));
-      return new _StateManager({ resources }, path);
+      const pending = Array.isArray(data.pending_default_memory_store_cleanups) ? data.pending_default_memory_store_cleanups : void 0;
+      return new _StateManager(
+        { resources, ...pending ? { pending_default_memory_store_cleanups: pending } : {} },
+        path
+      );
     } catch (err) {
       if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
         return _StateManager.initialize(path);
@@ -9976,7 +11411,8 @@ var CloudAgentSchema = z6.object({
   workspace_id: z6.string().optional(),
   created_at: z6.string().optional(),
   updated_at: z6.string().optional(),
-  archived_at: z6.string().nullish()
+  archived_at: z6.string().nullish(),
+  attributes: z6.record(z6.string(), z6.unknown()).optional()
 });
 var ListCloudAgentsResponseSchema = z6.object({
   agents: z6.array(CloudAgentSchema)
@@ -9993,7 +11429,8 @@ var CloudEnvironmentSchema = z6.object({
   workspace_id: z6.string().optional(),
   created_at: z6.string().optional(),
   updated_at: z6.string().optional(),
-  archived_at: z6.string().nullish()
+  archived_at: z6.string().nullish(),
+  attributes: z6.record(z6.string(), z6.unknown()).optional()
 });
 var ListCloudEnvironmentsResponseSchema = z6.object({
   environments: z6.array(CloudEnvironmentSchema)
@@ -10005,7 +11442,8 @@ var CloudVaultSchema = z6.object({
   type: z6.string().optional(),
   created_at: z6.string().nullish(),
   updated_at: z6.string().nullish(),
-  archived_at: z6.string().nullish()
+  archived_at: z6.string().nullish(),
+  attributes: z6.record(z6.string(), z6.unknown()).optional()
 });
 var ListCloudVaultsResponseSchema = z6.object({
   vaults: z6.array(CloudVaultSchema)
@@ -10185,6 +11623,7 @@ export {
   applyProviderConfigToEnv,
   archiveCloudAgent,
   archiveMemoryStore,
+  archiveRemoteSession,
   areRuntimeCredentialsReady,
   batchCreateMemories,
   bootstrapRuntimeCredentials,
@@ -10198,6 +11637,8 @@ export {
   createProjectRuntime,
   createSessionForAgent,
   createSkillFromFileId,
+  createVaultCredential,
+  createVaultCredentialWithStateBackend,
   decideDestructive,
   deleteCloudEnvironment,
   deleteCloudVault,
@@ -10207,6 +11648,8 @@ export {
   deleteSession,
   deleteSkill,
   destroyPlannedProjectResources,
+  downloadRemoteFile,
+  downloadRemoteSkill,
   executePlannedProject,
   extractSkillZipFiles,
   getAgent,
@@ -10214,13 +11657,23 @@ export {
   getDeploymentRuntimeProviderForContext,
   getFileDownloadUrl,
   getFileInfo,
+  getManagedAgentProviderCapabilities,
   getMemory,
   getMemoryProviderCapabilities,
   getMemoryStore,
   getMemoryVersion,
+  getRemoteAgent,
+  getRemoteDeployment,
+  getRemoteDeploymentRun,
+  getRemoteEnvironment,
+  getRemoteSkill,
+  getRemoteSkillDownloadInfo,
+  getRemoteSkillVersion,
+  getRemoteVault,
   getSession,
   getSkillInfo,
   importResource,
+  inspectSkillSource,
   isTerminalSessionStatus,
   listAgentsWithReadiness,
   listCloudAgents,
@@ -10233,7 +11686,16 @@ export {
   listMemoryVersions,
   listProviderModelsForContext,
   listProviderNames,
+  listRemoteAgentVersions,
+  listRemoteAgents,
+  listRemoteDeploymentRuns,
+  listRemoteDeployments,
   listRemoteDeploymentsForContext,
+  listRemoteEnvironments,
+  listRemoteFiles,
+  listRemoteSkillVersions,
+  listRemoteSkills,
+  listRemoteVaults,
   listSessionEvents,
   listSessionSummaries,
   listSkills,
@@ -10243,8 +11705,13 @@ export {
   migrateConfig,
   parseStateAddress,
   pauseDeploymentForContext,
+  planAgentResources,
+  planAgentResourcesWithStateBackend,
   planDestroyProjectContext,
   planProjectContext,
+  planProjectWithStateBackend,
+  planVaultCredentialCreate,
+  planVaultCredentialCreateWithStateBackend,
   prepareInitialSessionPrompt,
   preparePromptForProvider,
   prependFileHint,
@@ -10260,9 +11727,12 @@ export {
   resolveSyncProvider,
   rewriteFileMentions,
   runDeploymentForContext,
+  runRemoteDeployment,
+  sendRemoteSessionEvents,
   sendSessionMessagePolling,
   sendSessionMessageStreaming,
   setDefaultFetch,
+  setRemoteDeploymentPaused,
   startSessionRun,
   startSessionRunPolling,
   streamSessionEvents,
@@ -10272,6 +11742,7 @@ export {
   syncProviderResourcesFromEnv,
   updateMemory,
   updateMemoryStore,
+  updateRemoteSession,
   uploadFile,
   validateProjectConfig,
   writeProjectRuntime