@openagentpack/sdk 0.4.0 → 0.5.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   toSessionEvent
-} from "./chunk-GAAU67HX.js";
+} from "./chunk-6PDVAFLK.js";
 import {
   defaultFileUploadPurpose,
   enrichProviderFileInfo
@@ -628,6 +628,13 @@ async function listSessionEventsPaged(client, sessionId, options, toEvent, confi
   const params = new URLSearchParams();
   if (options?.limit) params.set("limit", String(options.limit));
   if (options?.order) params.set("order", options.order);
+  if (config?.forwardTypes !== false) {
+    for (const type of options?.types ?? []) params.append("types", type);
+  }
+  if (options?.created_at_gt) params.set("created_at[gt]", options.created_at_gt);
+  if (options?.created_at_gte) params.set("created_at[gte]", options.created_at_gte);
+  if (options?.created_at_lt) params.set("created_at[lt]", options.created_at_lt);
+  if (options?.created_at_lte) params.set("created_at[lte]", options.created_at_lte);
   const pageCursor = options?.page_token ?? options?.page;
   if (pageCursor) params.set("page", pageCursor);
   if (config?.forwardAfterId && options?.after_id) params.set("after_id", options.after_id);
@@ -794,7 +801,8 @@ function toCloudAgent(raw) {
     workspace_id: raw.workspace_id,
     created_at: raw.created_at,
     updated_at: raw.updated_at,
-    archived_at: raw.archived_at ?? null
+    archived_at: raw.archived_at ?? null,
+    attributes: raw
   };
 }
 function toCloudEnvironment(raw) {
@@ -810,7 +818,8 @@ function toCloudEnvironment(raw) {
     workspace_id: raw.workspace_id,
     created_at: raw.created_at,
     updated_at: raw.updated_at,
-    archived_at: raw.archived_at ?? null
+    archived_at: raw.archived_at ?? null,
+    attributes: raw
   };
 }
 function toCloudVault(raw) {
@@ -821,7 +830,8 @@ function toCloudVault(raw) {
     type: raw.type,
     created_at: raw.created_at ?? null,
     updated_at: raw.updated_at ?? null,
-    archived_at: raw.archived_at ?? null
+    archived_at: raw.archived_at ?? null,
+    attributes: raw
   };
 }
 function toRestFileInfo(res) {
@@ -833,7 +843,9 @@ function toRestFileInfo(res) {
     created_at: res.created_at,
     downloadable: res.downloadable,
     status: res.status,
-    purpose: res.purpose
+    purpose: res.purpose,
+    scope: res.scope,
+    attributes: res
   };
 }
 function toRestSkillInfo(res) {
@@ -846,7 +858,8 @@ function toRestSkillInfo(res) {
     status: "active",
     latest_version: res.latest_version,
     created_at: res.created_at,
-    updated_at: res.updated_at
+    updated_at: res.updated_at,
+    attributes: res
   };
 }
 
@@ -1238,7 +1251,7 @@ function mapAgent(name, decl, refs, version, projectName) {
     }
   }
   const body = {
-    name,
+    name: decl.name ?? name,
     model: modelValue,
     system: decl.instructions
   };
@@ -1297,7 +1310,7 @@ function mapAgent(name, decl, refs, version, projectName) {
 }
 function mapDeployment(name, decl, refs, projectName, uploadedFiles) {
   const body = {
-    name,
+    name: decl.name ?? name,
     agent: refs.agent_version !== void 0 ? { id: refs.agent_id, type: "agent", version: refs.agent_version } : refs.agent_id,
     environment_id: refs.environment_id,
     initial_events: mapInitialEvents(decl.initial_events)
@@ -2183,6 +2196,7 @@ function agentToDecl2(raw) {
     }));
   }
   return compactDeep({
+    name: raw.name,
     description: raw.description,
     model: raw.model,
     instructions: raw.system,
@@ -2201,7 +2215,7 @@ function mapMemoryStore2(name, decl) {
 }
 function mapDeployment2(name, decl, refs, projectName, uploadedFiles) {
   const body = {
-    name,
+    name: decl.name ?? name,
     agent: refs.agent_version !== void 0 ? { id: refs.agent_id, type: "agent", version: refs.agent_version } : refs.agent_id,
     environment_id: refs.environment_id,
     initial_events: mapDeploymentInitialEvents(decl.initial_events)
@@ -2307,7 +2321,7 @@ function mapAgent2(name, decl, refs, version, projectName) {
     model = typeof qoderModel === "string" ? qoderModel : qoderModel.id;
   }
   const body = {
-    name,
+    name: decl.name ?? name,
     model,
     system: decl.instructions
   };
@@ -2811,6 +2825,7 @@ var QoderAdapter = class _QoderAdapter {
       return compactDeep(normalized);
     }
     return compactDeep({
+      name: raw.name,
       description: raw.description,
       model: normalizeModel(raw.model),
       instructions: raw.system,
@@ -2831,7 +2846,7 @@ var QoderAdapter = class _QoderAdapter {
     const currentMetadata = current.metadata ?? {};
     const metadata = { ...body.metadata ?? {} };
     for (const key of Object.keys(currentMetadata)) {
-      if (!key.startsWith("agents.") && !(key in metadata)) metadata[key] = null;
+      if (key !== "created_by" && !key.startsWith("agents.") && !(key in metadata)) metadata[key] = null;
     }
     body.metadata = metadata;
     const res = await client.post(`/environments/${id}`, body);
@@ -2839,8 +2854,20 @@ var QoderAdapter = class _QoderAdapter {
   }
   async deleteEnvironment(id, cascade = false, mode = "managed") {
     if (mode === "forward") {
-      await this.forwardClient.delete(`/environments/${id}`);
-      return;
+      try {
+        await this.forwardClient.delete(`/environments/${id}`);
+        return;
+      } catch (err) {
+        const isConflict = err instanceof ApiError && (err.statusCode === 409 || err.responseBody.includes("in use"));
+        if (!isConflict) throw err;
+        if (!cascade) {
+          throw new UserError(
+            `Environment ${id} is referenced by one or more Forward sessions. Use --cascade to archive the environment.`
+          );
+        }
+        await this.forwardClient.post(`/environments/${id}/archive`, {});
+        return;
+      }
     }
     try {
       await this.client.delete(`/environments/${id}`);
@@ -3630,25 +3657,22 @@ function mapVault2(name, decl, projectName) {
   return body;
 }
 function mapCredential2(cred) {
-  if (cred.type === "environment_variable") {
-    return {
-      auth: {
-        type: "environment_variable",
-        secret_name: cred.secret_name,
-        secret_value: cred.secret_value,
-        networking: cred.networking ?? { type: "unrestricted" }
-      },
-      display_name: cred.name
-    };
+  if (cred.type !== "environment_variable") {
+    throw new UserError(
+      `credential '${cred.name}': Bailian only supports credential type 'environment_variable', but '${cred.type}' was declared.`
+    );
   }
-  return {
+  const body = {
     auth: {
-      type: cred.type,
-      token: cred.access_token,
-      mcp_server_url: cred.mcp_server_url
+      type: "environment_variable",
+      secret_name: cred.secret_name,
+      secret_value: cred.secret_value,
+      networking: cred.networking ?? { type: "unrestricted" }
     },
     display_name: cred.name
   };
+  if (cred.metadata) body.metadata = cred.metadata;
+  return body;
 }
 function credToDecl3(raw, vaultName) {
   const auth = raw.auth ?? {};
@@ -3658,6 +3682,7 @@ function credToDecl3(raw, vaultName) {
     return {
       name,
       type: "static_bearer",
+      metadata: stripAgentsMetadata(raw.metadata),
       mcp_server_url: auth.mcp_server_url ?? "",
       access_token: placeholder
     };
@@ -3666,6 +3691,7 @@ function credToDecl3(raw, vaultName) {
   return {
     name,
     type: "environment_variable",
+    metadata: stripAgentsMetadata(raw.metadata),
     secret_name: auth.secret_name ?? name,
     secret_value: placeholder,
     networking: networking ?? { type: "unrestricted" }
@@ -3733,6 +3759,7 @@ function agentToDecl3(raw) {
   const model = raw.model;
   const modelValue = typeof model === "object" && model ? model.id : model;
   return compactDeep({
+    name: raw.name,
     description: raw.description,
     model: modelValue,
     instructions: raw.system,
@@ -3752,7 +3779,7 @@ function mapAgent3(name, decl, refs, version, projectName, skillVersions) {
     modelId = typeof bailianModel === "string" ? bailianModel : bailianModel.id;
   }
   const body = {
-    name,
+    name: decl.name ?? name,
     model: { id: modelId },
     system: decl.instructions
   };
@@ -3845,7 +3872,7 @@ function mapDeployment3(name, decl, refs, projectName, uploadedFiles) {
   const agent = { id: refs.agent_id };
   if (refs.agent_version !== void 0) agent.version = refs.agent_version;
   const body = {
-    name,
+    name: decl.name ?? name,
     agent,
     environment_id: refs.environment_id,
     initial_events: mapMessageEvents(decl.initial_events)
@@ -3983,6 +4010,7 @@ var BailianAdapter = class _BailianAdapter {
       });
     }
     return compactDeep({
+      name: raw.name,
       description: raw.description,
       model: normalizeBailianModel(raw.model),
       instructions: raw.system,
@@ -4014,6 +4042,18 @@ var BailianAdapter = class _BailianAdapter {
   async deleteEnvironment(id) {
     await this.client.delete(`/environments/${id}`);
   }
+  async listEnvironmentResources(options) {
+    const params = cursorParams(options);
+    if (options?.include_archived !== void 0) {
+      params.set("include_archived", String(options.include_archived));
+    }
+    const res = await this.client.get(withQuery("/environments", params));
+    return cursorPage(res, toCloudEnvironment);
+  }
+  async getRemoteEnvironment(id) {
+    const res = await this.client.get(`/environments/${id}`);
+    return toCloudEnvironment(res);
+  }
   // --- Agent ---
   async createAgent(name, decl, refs) {
     const skillVersions = await this.fetchSkillVersions(refs);
@@ -4062,6 +4102,25 @@ var BailianAdapter = class _BailianAdapter {
   async deleteAgent(id) {
     await this.client.post(`/agents/${id}/archive`, {});
   }
+  async listAgentResources(options) {
+    const params = cursorParams(options);
+    if (options?.include_archived !== void 0) {
+      params.set("include_archived", String(options.include_archived));
+    }
+    const res = await this.client.get(withQuery("/agents", params));
+    return cursorPage(res, toCloudAgent);
+  }
+  async getRemoteAgent(id, version) {
+    const params = new URLSearchParams();
+    if (version !== void 0) params.set("version", String(version));
+    const res = await this.client.get(withQuery(`/agents/${id}`, params));
+    return toCloudAgent(res);
+  }
+  async listAgentVersions(id, options) {
+    const params = cursorParams(options);
+    const res = await this.client.get(withQuery(`/agents/${id}/versions`, params));
+    return cursorPage(res, toCloudAgent);
+  }
   // --- Skill (2-step: Files API → Skills API) ---
   async createSkill(name, decl, files) {
     const fileId = await this.uploadSkillZip(name, decl, files);
@@ -4160,10 +4219,31 @@ var BailianAdapter = class _BailianAdapter {
     const all = await this.client.getAllPaged(path);
     return all.map(toBailianSkillInfo);
   }
+  async listSkillResources(options) {
+    const params = cursorParams(options);
+    if (options?.source === "official") params.set("source", "official");
+    if (options?.source === "custom") params.set("source", "customer");
+    const res = await this.client.get(withQuery("/skills", params));
+    return cursorPage(res, toBailianSkillInfo);
+  }
   async getSkillInfo(id) {
     const res = await this.client.get(`/skills/${id}`);
     return toBailianSkillInfo(res);
   }
+  async listSkillVersions(id, options) {
+    const params = cursorParams(options);
+    const res = await this.client.get(withQuery(`/skills/${id}/versions`, params));
+    return cursorPage(res, toSkillVersionInfo);
+  }
+  async getSkillVersion(id, version) {
+    const res = await this.client.get(`/skills/${id}/versions/${encodeURIComponent(version)}`);
+    return toSkillVersionInfo(res);
+  }
+  async getSkillDownloadInfo(id, version) {
+    return await this.client.get(
+      `/skills/${id}/versions/${encodeURIComponent(version)}/content`
+    );
+  }
   // Non-blocking create: file already uploaded → POST /skills with retry for residual OSS
   // replication lag (postSkillWithRetry covers SKILL_FILE_NOT_FOUND for a few seconds), and return
   // the initial status WITHOUT waiting for the security scan. Callers MUST ensure the file has
@@ -4223,6 +4303,7 @@ var BailianAdapter = class _BailianAdapter {
   // thin wrappers over the AgentStudio endpoints, exposed so callers/tests can
   // exercise the full surface through real project code rather than raw fetch.
   async createVault(name, decl) {
+    for (const credential of decl.credentials ?? []) mapCredential2(credential);
     const body = mapVault2(name, decl, this.projectName);
     const res = await this.client.post("/vaults", body);
     const vaultId = res.id;
@@ -4235,6 +4316,18 @@ var BailianAdapter = class _BailianAdapter {
     const all = await this.client.getAllPaged("/vaults");
     return all.map(toCloudVault);
   }
+  async listVaultResources(options) {
+    const params = cursorParams(options);
+    if (options?.include_archived !== void 0) {
+      params.set("include_archived", String(options.include_archived));
+    }
+    const res = await this.client.get(withQuery("/vaults", params));
+    return cursorPage(res, toCloudVault);
+  }
+  async getRemoteVault(id) {
+    const res = await this.client.get(`/vaults/${id}`);
+    return toCloudVault(res);
+  }
   async getVault(id) {
     return await this.client.get(`/vaults/${id}`);
   }
@@ -4256,7 +4349,22 @@ var BailianAdapter = class _BailianAdapter {
   }
   async listCredentials(vaultId) {
     const all = await this.client.getAllPaged(`/vaults/${vaultId}/credentials`);
-    return all.map(toRemoteResource);
+    return all.map((raw) => {
+      const auth = raw.auth ?? {};
+      const networking = auth.networking;
+      const metadata = raw.metadata;
+      return {
+        id: raw.id,
+        display_name: raw.display_name ?? raw.id,
+        auth_type: auth.type ?? "",
+        secret_name: auth.secret_name,
+        mcp_server_url: auth.mcp_server_url,
+        networking_type: networking?.type,
+        metadata: metadata ? Object.fromEntries(
+          Object.entries(metadata).filter((entry) => typeof entry[1] === "string")
+        ) : void 0
+      };
+    });
   }
   async getCredential(vaultId, credentialId) {
     return await this.client.get(`/vaults/${vaultId}/credentials/${credentialId}`);
@@ -4306,11 +4414,7 @@ var BailianAdapter = class _BailianAdapter {
       throw new UserError(`Deployment '${ctx.name}' has no remote id; run \`agents apply\` first.`);
     }
     const res = await this.client.post(`/deployments/${ctx.id}/run`, {});
-    return {
-      run_id: res.id,
-      session_id: res.session_id ?? null,
-      error: res.error ?? void 0
-    };
+    return toDeploymentRunResult(res);
   }
   async getDeployment(ctx) {
     if (!ctx.id) {
@@ -4322,6 +4426,7 @@ var BailianAdapter = class _BailianAdapter {
   async listDeployments(filter) {
     const params = new URLSearchParams();
     if (filter?.agent_id) params.set("agent_id", filter.agent_id);
+    if (filter?.keyword) params.set("keyword", filter.keyword);
     if (filter?.status) params.set("status", filter.status);
     if (filter?.include_archived) params.set("include_archived", "true");
     if (filter?.limit) params.set("limit", String(filter.limit));
@@ -4337,6 +4442,32 @@ var BailianAdapter = class _BailianAdapter {
       next_page: nextPage
     };
   }
+  async getDeploymentById(id) {
+    const res = await this.client.get(`/deployments/${id}`);
+    return toDeploymentInfo3(res);
+  }
+  async runDeploymentById(id) {
+    const res = await this.client.post(`/deployments/${id}/run`, {});
+    return toDeploymentRunResult(res);
+  }
+  async pauseDeploymentById(id) {
+    const res = await this.client.post(`/deployments/${id}/pause`, {});
+    return toDeploymentInfo3(res);
+  }
+  async unpauseDeploymentById(id) {
+    const res = await this.client.post(`/deployments/${id}/unpause`, {});
+    return toDeploymentInfo3(res);
+  }
+  async listDeploymentRuns(deploymentId, options) {
+    const res = await this.client.get(
+      withQuery(`/deployments/${deploymentId}/runs`, cursorParams(options))
+    );
+    return cursorPage(res, toDeploymentRunInfo);
+  }
+  async getDeploymentRun(runId) {
+    const res = await this.client.get(`/deployment_runs/${runId}`);
+    return toDeploymentRunInfo(res);
+  }
   async pauseDeployment(ctx) {
     return this.setDeploymentPaused(ctx, true);
   }
@@ -4391,6 +4522,9 @@ var BailianAdapter = class _BailianAdapter {
   async listSessions(filter) {
     const params = new URLSearchParams();
     if (filter?.agent_id) params.set("agent_id", filter.agent_id);
+    for (const status of filter?.statuses ?? []) params.append("statuses[]", status);
+    if (filter?.created_at_gte) params.set("created_at[gte]", filter.created_at_gte);
+    if (filter?.created_at_lte) params.set("created_at[lte]", filter.created_at_lte);
     if (filter?.limit) params.set("limit", String(filter.limit));
     if (filter?.page) params.set("page", filter.page);
     const qs = params.toString();
@@ -4407,6 +4541,15 @@ var BailianAdapter = class _BailianAdapter {
     const res = await this.client.get(`/sessions/${id}`);
     return toSessionInfo3(res);
   }
+  async updateSession(id, input) {
+    const res = await this.client.post(`/sessions/${id}`, input);
+    if (!res.agent || !res.environment_id) return this.getSession(id);
+    return toSessionInfo3(res);
+  }
+  async archiveSession(id) {
+    const res = await this.client.post(`/sessions/${id}/archive`, {});
+    return toSessionInfo3(res);
+  }
   async deleteSession(id) {
     await this.client.delete(`/sessions/${id}`);
   }
@@ -4415,13 +4558,20 @@ var BailianAdapter = class _BailianAdapter {
     const res = await this.client.post(`/sessions/${sessionId}/events`, body);
     return extractCreatedEventId(res);
   }
+  async sendSessionEvents(sessionId, events) {
+    const res = await this.client.post(`/sessions/${sessionId}/events`, { input: events });
+    return {
+      event_ids: extractCreatedEventIds(res),
+      attributes: res
+    };
+  }
   async *streamSessionEvents(sessionId, _options) {
     for await (const raw of this.client.sse(`/sessions/${sessionId}/events/stream`)) {
       yield toSessionEvent(raw);
     }
   }
   async listSessionEvents(sessionId, options) {
-    return listSessionEventsPaged(this.client, sessionId, options, toSessionEvent);
+    return listSessionEventsPaged(this.client, sessionId, options, toSessionEvent, { forwardTypes: false });
   }
   // --- Files ---
   async uploadFile(filePath, options) {
@@ -4447,6 +4597,15 @@ var BailianAdapter = class _BailianAdapter {
     const all = await this.client.getAllPaged("/files");
     return all.map(toRestFileInfo);
   }
+  async listFileResources(options) {
+    const params = cursorParams(options);
+    if (options?.scope_id) params.set("scope_id", options.scope_id);
+    const res = await this.client.get(withQuery("/files", params));
+    return cursorPage(res, toRestFileInfo);
+  }
+  async downloadFileContent(id) {
+    return new Uint8Array(await this.client.getBuffer(`/files/${id}/content`));
+  }
   async deleteFile(id) {
     await this.client.delete(`/files/${id}`);
   }
@@ -4481,9 +4640,77 @@ function toBailianSkillInfo(res) {
     status: skillStatusFromString(res.status),
     latest_version: res.latest_version,
     created_at: res.created_at,
-    updated_at: res.updated_at
+    updated_at: res.updated_at,
+    attributes: res
+  };
+}
+function cursorParams(options) {
+  const params = new URLSearchParams();
+  if (options?.limit !== void 0) params.set("limit", String(options.limit));
+  if (options?.page) params.set("page", options.page);
+  return params;
+}
+function withQuery(path, params) {
+  const query2 = params.toString();
+  return query2 ? `${path}?${query2}` : path;
+}
+function cursorPage(res, mapper) {
+  const nextPage = res.next_page ?? void 0;
+  return {
+    data: (res.data ?? []).map(mapper),
+    has_more: res.has_more ?? nextPage !== void 0,
+    next_page: nextPage
+  };
+}
+function toSkillVersionInfo(res) {
+  return {
+    id: res.id,
+    skill_id: res.skill_id ?? "",
+    type: res.type ?? "skill_version",
+    name: res.name,
+    description: res.description,
+    version: res.version ?? "",
+    status: res.status,
+    created_at: res.created_at,
+    updated_at: res.updated_at,
+    additional_properties: res.additional_properties,
+    attributes: res
+  };
+}
+function toDeploymentRunResult(res) {
+  return {
+    run_id: res.id,
+    session_id: res.session_id ?? null,
+    error: res.error ?? void 0
+  };
+}
+function toDeploymentRunInfo(res) {
+  return {
+    id: res.id ?? "",
+    deployment_id: res.deployment_id,
+    session_id: res.session_id ?? void 0,
+    status: res.status,
+    error: res.error ?? void 0,
+    created_at: res.created_at,
+    updated_at: res.updated_at,
+    attributes: res
   };
 }
+function extractCreatedEventIds(res) {
+  const ids = /* @__PURE__ */ new Set();
+  const topLevel = extractCreatedEventId(res);
+  if (topLevel) ids.add(topLevel);
+  for (const key of ["data", "events"]) {
+    const items = res[key];
+    if (!Array.isArray(items)) continue;
+    for (const item of items) {
+      if (!item || typeof item !== "object") continue;
+      const id = item.id;
+      if (typeof id === "string") ids.add(id);
+    }
+  }
+  return Array.from(ids);
+}
 function normalizeBailianModel(value) {
   if (value && typeof value === "object" && "id" in value) {
     return value.id;
@@ -4548,7 +4775,7 @@ function guessMimeType(fileName) {
 // src/internal/providers/bailian/capabilities.ts
 var BAILIAN_CAPABILITIES = {
   environment: { tier: "native", reason: "environments API" },
-  vault: { tier: "native", reason: "vaults + credentials API (static_bearer MCP credentials)" },
+  vault: { tier: "native", reason: "vaults + environment_variable credentials API" },
   skill: { tier: "native", reason: "skills API with 2-step zip upload via Files API" },
   agent: { tier: "native", reason: "agents API with versioned updates" },
   template: { tier: "unsupported", reason: "no Forward Template equivalent on Bailian" },
@@ -4809,7 +5036,7 @@ function mapAgent4(name, decl, refs, version, projectName) {
   if (!arkModel) throw new UserError(`No Ark model specified for agent '${name}'`);
   const modelValue = typeof arkModel === "string" ? { id: arkModel } : { id: arkModel.id };
   const body = {
-    name,
+    name: decl.name ?? name,
     model: modelValue,
     system: decl.instructions
   };
@@ -5543,6 +5770,7 @@ var coerceString = z5.union([z5.string(), z5.number()]).transform(String);
 var staticBearerCredentialSchema = z5.object({
   name: z5.string(),
   type: z5.literal("static_bearer"),
+  metadata: z5.record(z5.string(), z5.string()).optional(),
   mcp_server_url: z5.string(),
   access_token: coerceString,
   protocol: z5.enum(["sse", "streamable_http"]).optional()
@@ -5550,6 +5778,7 @@ var staticBearerCredentialSchema = z5.object({
 var environmentVariableCredentialSchema = z5.object({
   name: z5.string(),
   type: z5.literal("environment_variable"),
+  metadata: z5.record(z5.string(), z5.string()).optional(),
   secret_name: z5.string(),
   secret_value: coerceString,
   networking: z5.object({ type: z5.enum(["unrestricted", "limited"]) }).optional()
@@ -5783,6 +6012,7 @@ var scheduleSchema = z5.object({
   timezone: z5.string()
 });
 var deploymentSchema = z5.object({
+  name: z5.string().optional(),
   agent: z5.string(),
   agent_version: z5.number().int().optional(),
   environment: z5.string().optional(),
@@ -6350,8 +6580,61 @@ function resolveTunnelIdFromConfig(config, tunnelName, provider) {
 }
 
 // src/internal/executor/skill-resolver.ts
+import { dirname as dirname9 } from "path";
+
+// src/internal/core/skill-source.ts
 import { readFileSync as readFileSync7, statSync as statSync3 } from "fs";
-import { dirname as dirname9, resolve as resolve10 } from "path";
+import { basename as basename6, resolve as resolve10 } from "path";
+import { parse } from "yaml";
+async function inspectSkillSource(source, options = {}) {
+  if (/^https?:\/\//i.test(source)) {
+    throw new UserError("Skill source inspection only accepts a local directory, zip, or SKILL.md file.");
+  }
+  const sourcePath = resolve10(options.basePath ?? process.cwd(), source);
+  const sourceStat = statSync3(sourcePath, { throwIfNoEntry: false });
+  if (!sourceStat) throw new UserError(`Skill source not found: ${source}`);
+  let files;
+  if (sourceStat.isDirectory()) {
+    files = collectFiles(sourcePath, "");
+  } else if (sourceStat.isFile() && sourcePath.toLowerCase().endsWith(".zip")) {
+    files = await extractSkillZipFiles(readFileSync7(sourcePath));
+  } else if (sourceStat.isFile() && basename6(sourcePath).toLowerCase() === "skill.md") {
+    files = [{ relativePath: "SKILL.md", content: readFileSync7(sourcePath) }];
+  } else {
+    throw new UserError("Skill source must be a directory, .zip archive, or SKILL.md file.");
+  }
+  const normalizedFiles = normalizeSkillRoot(files);
+  const manifest = normalizedFiles.find((file) => file.relativePath === "SKILL.md");
+  const name = parseSkillManifestName(manifest.content);
+  return { name, sourcePath, files: normalizedFiles };
+}
+function normalizeSkillRoot(files) {
+  if (files.some((file) => file.relativePath === "SKILL.md")) return files;
+  const manifests = files.filter((file) => file.relativePath.endsWith("/SKILL.md"));
+  if (manifests.length === 0) throw new UserError("Skill source does not contain SKILL.md.");
+  if (manifests.length > 1) {
+    throw new UserError("Skill source contains multiple SKILL.md files and has no unambiguous root.");
+  }
+  const prefix = manifests[0].relativePath.slice(0, -"SKILL.md".length);
+  return files.filter((file) => file.relativePath.startsWith(prefix)).map((file) => ({ ...file, relativePath: file.relativePath.slice(prefix.length) }));
+}
+function parseSkillManifestName(content) {
+  const text = content.toString("utf8");
+  const frontmatter = text.match(/^---\s*\r?\n([\s\S]*?)\r?\n---(?:\s*\r?\n|$)/);
+  if (!frontmatter) throw new UserError("SKILL.md must start with YAML frontmatter containing a name.");
+  let manifest;
+  try {
+    manifest = parse(frontmatter[1]);
+  } catch (error) {
+    throw new UserError(`Invalid SKILL.md frontmatter: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const rawName = manifest && typeof manifest === "object" ? manifest.name : void 0;
+  const name = typeof rawName === "string" ? rawName.trim() : "";
+  if (!name) throw new UserError("SKILL.md frontmatter must contain a non-empty name.");
+  return name;
+}
+
+// src/internal/executor/skill-resolver.ts
 async function resolveSkillFiles(decl, ctx) {
   if (/^https?:\/\//i.test(decl.source)) {
     const res = await resolveFetch()(decl.source);
@@ -6359,19 +6642,7 @@ async function resolveSkillFiles(decl, ctx) {
     return extractSkillZipFiles(Buffer.from(await res.arrayBuffer()));
   }
   if (!ctx.configPath) return [];
-  const sourcePath = resolve10(dirname9(ctx.configPath), decl.source);
-  const stat = statSync3(sourcePath, { throwIfNoEntry: false });
-  if (stat?.isDirectory()) {
-    return collectFiles(sourcePath, "");
-  }
-  if (stat?.isFile()) {
-    if (sourcePath.endsWith(".zip")) {
-      return extractSkillZipFiles(readFileSync7(sourcePath));
-    }
-    const content = readFileSync7(sourcePath);
-    return [{ relativePath: "SKILL.md", content }];
-  }
-  return [];
+  return (await inspectSkillSource(decl.source, { basePath: dirname9(ctx.configPath) })).files;
 }
 
 // src/internal/executor/executor.ts
@@ -6449,7 +6720,9 @@ async function executePlan(plan, ctx, options = {}) {
     await runWithConcurrency(level, concurrency, runAction);
     await ctx.state.save();
   }
-  await reconcileDefaultMemoryStores(ctx, new Set(plan.actions.map((action) => action.address.provider)));
+  if (!ctx.createOnly) {
+    await reconcileDefaultMemoryStores(ctx, new Set(plan.actions.map((action) => action.address.provider)));
+  }
   for (const action of deletions) {
     await runAction(action);
     await ctx.state.save();
@@ -6661,6 +6934,7 @@ async function executeActionInner(action, provider, ctx) {
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
             mode: apiMode,
+            createOnly: ctx.createOnly,
             onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl, apiMode)
           });
           adopted = true;
@@ -6680,6 +6954,7 @@ async function executeActionInner(action, provider, ctx) {
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
             mode: apiMode,
+            createOnly: ctx.createOnly,
             onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl, apiMode)
           });
           adopted = true;
@@ -6706,6 +6981,7 @@ async function executeActionInner(action, provider, ctx) {
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
             mode: apiMode,
+            createOnly: ctx.createOnly,
             onExisting: async (existing) => {
               await provider.deleteVault(existing.id, apiMode);
               return provider.createVault(name, decl, apiMode);
@@ -6742,6 +7018,7 @@ async function executeActionInner(action, provider, ctx) {
         const searchNames = manifestName && manifestName !== remoteName ? [remoteName, manifestName] : [remoteName];
         const existing = await findExistingByNames(provider, "skill", searchNames, apiMode);
         if (existing) {
+          if (ctx.createOnly) throw createOnlyExistingResourceError(address, existing.name);
           result = existing.resource;
           emitRuntimeFeedback(ctx.onFeedback, {
             type: "resource_adopted",
@@ -6757,6 +7034,7 @@ async function executeActionInner(action, provider, ctx) {
             result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
               mode: apiMode,
               searchNames,
+              createOnly: ctx.createOnly,
               onExisting: async (existing2) => existing2
             });
             adopted = true;
@@ -6823,6 +7101,7 @@ async function executeActionInner(action, provider, ctx) {
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
             mode: apiMode,
+            createOnly: ctx.createOnly,
             onExisting: async (existing) => reconcile(existing.id)
           });
           adopted = true;
@@ -6841,6 +7120,7 @@ async function executeActionInner(action, provider, ctx) {
           result = await provider.createAgent(remoteName, decl, refs);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            createOnly: ctx.createOnly,
             onExisting: (existing) => provider.updateAgent(existing.id, remoteName, decl, refs)
           });
           adopted = true;
@@ -6864,6 +7144,7 @@ async function executeActionInner(action, provider, ctx) {
           result = await createTemplate(remoteName, decl, refs);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            createOnly: ctx.createOnly,
             onExisting: (existing) => updateTemplate(existing.id, remoteName, decl, refs)
           });
           adopted = true;
@@ -6898,6 +7179,7 @@ async function executeActionInner(action, provider, ctx) {
           result = await createIdentity(name, decl);
         } catch (err) {
           if (!(err instanceof ConflictError)) throw err;
+          if (ctx.createOnly) throw createOnlyExistingResourceError(address);
           const existing = await provider.findResource("identity", decl.external_id);
           if (!existing?.id) throw err;
           result = await updateIdentity(existing.id, name, decl);
@@ -6921,6 +7203,7 @@ async function executeActionInner(action, provider, ctx) {
           result = await createChannel(name, decl, refs);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            createOnly: ctx.createOnly,
             onExisting: (existing) => updateChannel(existing.id, name, decl, refs)
           });
           adopted = true;
@@ -6940,6 +7223,7 @@ async function executeActionInner(action, provider, ctx) {
         } catch (err) {
           const preparedFiles = err instanceof DeploymentCreateConflictError ? err.preparedFiles : void 0;
           const existing = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            createOnly: ctx.createOnly,
             onExisting: (existing2) => provider.updateDeployment(existing2.id, name, decl, refs, ctx.configPath ?? "", preparedFiles)
           });
           adopted = true;
@@ -6951,6 +7235,7 @@ async function executeActionInner(action, provider, ctx) {
       } else {
         const existing = hasLocalFileSources ? await findExistingByNames(provider, "deployment", [name]) : null;
         if (existing) {
+          if (ctx.createOnly) throw createOnlyExistingResourceError(address, existing.name);
           result = await provider.updateDeployment(existing.resource.id, name, decl, refs, ctx.configPath ?? "");
           emitRuntimeFeedback(ctx.onFeedback, {
             type: "resource_adopted",
@@ -7051,6 +7336,7 @@ async function findExistingByNames(provider, type, names, mode) {
 async function adoptOnConflict(err, address, provider, onFeedback, opts) {
   if (!(err instanceof ConflictError)) throw err;
   const candidates = opts.searchNames?.length ? opts.searchNames : [address.name];
+  if (opts.createOnly) throw createOnlyExistingResourceError(address, candidates.join('" / "'));
   const existing = await findExistingByNames(provider, address.type, candidates, opts.mode);
   if (!existing) throw nameReservedError(err, address, candidates.join('" / "'));
   emitRuntimeFeedback(onFeedback, {
@@ -7061,6 +7347,11 @@ async function adoptOnConflict(err, address, provider, onFeedback, opts) {
   });
   return opts.onExisting(existing.resource);
 }
+function createOnlyExistingResourceError(address, remoteName = address.name) {
+  return new UserError(
+    `Create-only cannot adopt or reconcile existing ${address.type} "${remoteName}" on provider '${address.provider}'. Choose a new name, or use a normal apply/import workflow to manage the existing resource.`
+  );
+}
 function nameReservedError(err, address, searchName) {
   const detail = err instanceof ApiError ? err.message : String(err);
   if (address.type === "channel" && err instanceof ApiError && err.responseBody.includes("CHANNEL_CREDENTIAL_CONFLICT")) {
@@ -7073,73 +7364,6 @@ function nameReservedError(err, address, searchName) {
   );
 }
 
-// src/internal/diagnostics/diagnostics.ts
-var DiagnosticCollector = class {
-  items = [];
-  error(code, message, resource) {
-    this.items.push({ severity: "error", code, message, resource });
-  }
-  warning(code, message, resource) {
-    this.items.push({ severity: "warning", code, message, resource });
-  }
-  info(code, message, resource) {
-    this.items.push({ severity: "info", code, message, resource });
-  }
-  hasErrors() {
-    return this.items.some((d) => d.severity === "error");
-  }
-  getAll() {
-    return [...this.items];
-  }
-  format() {
-    if (this.items.length === 0) return "";
-    const lines = [];
-    for (const d of this.items) {
-      const icon = severityIcon(d.severity);
-      const addr = d.resource ? ` ${d.resource.type}.${d.resource.name} (${d.resource.provider})` : "";
-      lines.push(`${icon} ${d.code}`);
-      if (addr) lines.push(`  Resource:${addr}`);
-      lines.push(`  ${d.message}`);
-      lines.push("");
-    }
-    return lines.join("\n");
-  }
-};
-function severityIcon(s) {
-  switch (s) {
-    case "error":
-      return "\u2717";
-    case "warning":
-      return "\u26A0";
-    case "info":
-      return "\u2139";
-  }
-}
-
-// src/internal/validation/bailian.ts
-function findMissingBailianMcpToolConfigs(config, providerName = "bailian") {
-  if (providerName !== "bailian") return [];
-  const missing = [];
-  for (const [agentName, agent] of Object.entries(config.agents ?? {})) {
-    if (!agentTargetsProvider(config, agent.provider, providerName)) continue;
-    const configuredToolServers = new Set((agent.tools?.mcp ?? []).map((tool) => tool.mcp_server_name));
-    for (const server of agent.mcp_servers ?? []) {
-      if (!configuredToolServers.has(server.name)) {
-        missing.push({ agentName, serverName: server.name });
-      }
-    }
-  }
-  return missing;
-}
-function agentTargetsProvider(config, agentProvider, providerName) {
-  if (agentProvider) return agentProvider === providerName;
-  const defaultProvider = config.defaults?.provider;
-  if (defaultProvider && defaultProvider !== "all") {
-    return defaultProvider === providerName;
-  }
-  return Object.hasOwn(config.providers, providerName);
-}
-
 // src/internal/core/agent-materialization.ts
 function resolveAgentMaterialization(provider, agent) {
   const mode = agent.delivery?.[provider]?.type ?? "managed";
@@ -7147,44 +7371,334 @@ function resolveAgentMaterialization(provider, agent) {
   return { resourceType: "template", mode };
 }
 
-// src/internal/core/validate-config.ts
-function validateProjectConfig(config, options = {}) {
-  const collector = new DiagnosticCollector();
-  collectReferenceDiagnostics(config, collector);
-  const providers = options.providers ?? resolveTargetProviders(config);
-  collectProviderCapabilities(config, providers, collector);
-  return collector.getAll();
-}
-function collectConfigReferences(config) {
-  const collector = new DiagnosticCollector();
-  collectReferenceDiagnostics(config, collector);
-  return collector.getAll();
-}
-function resolveTargetProviders(config) {
-  const defaultProvider = config.defaults?.provider;
-  if (!defaultProvider || defaultProvider === "all") {
-    return Object.keys(config.providers);
+// src/internal/graph/dependency.ts
+function collectDependencyClosure(graph, roots) {
+  const selected = /* @__PURE__ */ new Map();
+  function visit(address) {
+    const key = addressKey(address);
+    if (selected.has(key)) return;
+    selected.set(key, graph.nodes.get(key) ?? address);
+    for (const dependencyKey of graph.edges.get(key) ?? []) {
+      const dependency = graph.nodes.get(dependencyKey);
+      if (dependency) visit(dependency);
+    }
   }
-  return [defaultProvider];
+  for (const root of roots) visit(root);
+  return [...selected.values()];
 }
-function collectReferenceDiagnostics(config, diagnostics) {
-  const envNames = new Set(Object.keys(config.environments ?? {}));
-  const tunnelNames = new Set(Object.keys(config.tunnels ?? {}));
-  const skillNames = new Set(Object.keys(config.skills ?? {}));
-  const vaultNames = new Set(Object.keys(config.vaults ?? {}));
-  const memoryNames = new Set(Object.keys(config.memory_stores ?? {}));
-  const fileNames = new Set(Object.keys(config.files ?? {}));
-  const agentNames = new Set(Object.keys(config.agents ?? {}));
-  const identityNames = new Set(Object.keys(config.identities ?? {}));
-  if (config.defaults?.identity && !identityNames.has(config.defaults.identity)) {
-    diagnostics.error(
-      "config.defaults.identity.unknown",
-      `defaults.identity references unknown identity '${config.defaults.identity}'`
-    );
+function buildDependencyGraph(config, targetProviders) {
+  const nodes = /* @__PURE__ */ new Map();
+  const edges = /* @__PURE__ */ new Map();
+  function addNode(addr) {
+    const key = addressKey(addr);
+    nodes.set(key, addr);
+    if (!edges.has(key)) edges.set(key, /* @__PURE__ */ new Set());
   }
-  for (const [name, agent] of Object.entries(config.agents ?? {})) {
-    if (agent.environment && !envNames.has(agent.environment)) {
-      diagnostics.error(
+  function addEdge(from, to) {
+    const fromKey = addressKey(from);
+    const toKey = addressKey(to);
+    edges.get(fromKey)?.add(toKey);
+  }
+  for (const provider of targetProviders) {
+    const def = getProvider(provider);
+    const caps = def?.capabilities;
+    if (config.environments) {
+      for (const name of Object.keys(config.environments)) {
+        const decl = config.environments[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "environment", name, provider });
+      }
+    }
+    if (config.memory_stores) {
+      for (const name of Object.keys(config.memory_stores)) {
+        const decl = config.memory_stores[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        if (!isSupported(caps, "memory_store")) continue;
+        addNode({ type: "memory_store", name, provider });
+      }
+    }
+    if (config.vaults) {
+      for (const name of Object.keys(config.vaults)) {
+        const decl = config.vaults[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "vault", name, provider });
+      }
+    }
+    if (config.skills) {
+      for (const name of Object.keys(config.skills)) {
+        const decl = config.skills[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "skill", name, provider });
+      }
+    }
+    if (config.files) {
+      for (const name of Object.keys(config.files)) {
+        const decl = config.files[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "file", name, provider });
+      }
+    }
+    if (config.identities && isSupported(caps, "identity")) {
+      for (const name of Object.keys(config.identities)) {
+        const decl = config.identities[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "identity", name, provider });
+      }
+    }
+    if (config.agents) {
+      for (const name of Object.keys(config.agents)) {
+        const decl = config.agents[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const materialization = resolveAgentMaterialization(provider, decl);
+        const agentAddr = { type: materialization.resourceType, name, provider };
+        addNode(agentAddr);
+        if ((decl.default_memory_store || decl.memory_stores?.length) && materialization.resourceType === "template") {
+          const identityName = config.defaults?.identity;
+          if (identityName) {
+            const identityAddr = { type: "identity", name: identityName, provider };
+            if (nodes.has(addressKey(identityAddr))) addEdge(agentAddr, identityAddr);
+          }
+        }
+        if (decl.environment && config.environments?.[decl.environment]) {
+          const envAddr = {
+            type: "environment",
+            name: decl.environment,
+            provider
+          };
+          if (nodes.has(addressKey(envAddr))) {
+            addEdge(agentAddr, envAddr);
+          }
+        }
+        if (decl.skills) {
+          for (const skillRef of decl.skills) {
+            if (typeof skillRef !== "string") continue;
+            const skillName = skillRef;
+            const skillAddr = { type: "skill", name: skillName, provider };
+            if (nodes.has(addressKey(skillAddr))) {
+              addEdge(agentAddr, skillAddr);
+            }
+          }
+        }
+        if (decl.vault) {
+          const vaultAddr = { type: "vault", name: decl.vault, provider };
+          if (nodes.has(addressKey(vaultAddr))) {
+            addEdge(agentAddr, vaultAddr);
+          }
+        }
+        if (decl.files) {
+          for (const fileName of decl.files) {
+            const fileAddr = { type: "file", name: fileName, provider };
+            if (nodes.has(addressKey(fileAddr))) addEdge(agentAddr, fileAddr);
+          }
+        }
+        if (decl.memory_stores) {
+          for (const msName of decl.memory_stores) {
+            const msAddr = {
+              type: "memory_store",
+              name: msName,
+              provider
+            };
+            if (nodes.has(addressKey(msAddr))) {
+              addEdge(agentAddr, msAddr);
+            }
+          }
+        }
+        if (decl.multiagent && isSupported(caps, "multiagent")) {
+          for (const subName of decl.multiagent.agents) {
+            const subDecl = config.agents[subName];
+            const subType = subDecl ? resolveAgentMaterialization(provider, subDecl).resourceType : "agent";
+            const subAddr = { type: subType, name: subName, provider };
+            addEdge(agentAddr, subAddr);
+          }
+        }
+      }
+    }
+    if (config.deployments) {
+      for (const name of Object.keys(config.deployments)) {
+        const decl = config.deployments[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const depAddr = { type: "deployment", name, provider };
+        addNode(depAddr);
+        const agentDecl = config.agents?.[decl.agent];
+        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
+        const agentAddr = { type: agentType, name: decl.agent, provider };
+        if (nodes.has(addressKey(agentAddr))) addEdge(depAddr, agentAddr);
+        if (decl.environment) {
+          const envAddr = { type: "environment", name: decl.environment, provider };
+          if (nodes.has(addressKey(envAddr))) addEdge(depAddr, envAddr);
+        }
+        if (decl.vaults) {
+          for (const vName of decl.vaults) {
+            const vAddr = { type: "vault", name: vName, provider };
+            if (nodes.has(addressKey(vAddr))) addEdge(depAddr, vAddr);
+          }
+        }
+        if (decl.memory_stores) {
+          for (const msName of decl.memory_stores) {
+            const msAddr = { type: "memory_store", name: msName, provider };
+            if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
+          }
+        }
+        if (decl.resources) {
+          for (const r of decl.resources) {
+            if (r.type === "memory_store") {
+              const msAddr = { type: "memory_store", name: r.memory_store, provider };
+              if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
+            }
+          }
+        }
+      }
+    }
+    if (config.channels && isSupported(caps, "channel")) {
+      for (const name of Object.keys(config.channels)) {
+        const decl = config.channels[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const channelAddr = { type: "channel", name, provider };
+        addNode(channelAddr);
+        if (decl.mode === "pairing" || !decl.agent) continue;
+        const agentDecl = config.agents?.[decl.agent];
+        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
+        const agentAddr = { type: agentType, name: decl.agent, provider };
+        if (nodes.has(addressKey(agentAddr))) addEdge(channelAddr, agentAddr);
+        const identityName = decl.identity ?? config.defaults?.identity;
+        if (identityName) {
+          const identityAddr = { type: "identity", name: identityName, provider };
+          if (nodes.has(addressKey(identityAddr))) addEdge(channelAddr, identityAddr);
+        }
+      }
+    }
+  }
+  return { nodes, edges };
+}
+function topologicalSort(graph) {
+  const visited = /* @__PURE__ */ new Set();
+  const sorted = [];
+  const visiting = /* @__PURE__ */ new Set();
+  function visit(key) {
+    if (visited.has(key)) return;
+    if (visiting.has(key)) {
+      throw new UserError(`Circular dependency detected involving: ${key}`);
+    }
+    visiting.add(key);
+    const deps = graph.edges.get(key) ?? /* @__PURE__ */ new Set();
+    for (const dep of deps) {
+      visit(dep);
+    }
+    visiting.delete(key);
+    visited.add(key);
+    sorted.push(graph.nodes.get(key));
+  }
+  for (const key of graph.nodes.keys()) {
+    visit(key);
+  }
+  return sorted;
+}
+
+// src/internal/diagnostics/diagnostics.ts
+var DiagnosticCollector = class {
+  items = [];
+  error(code, message, resource) {
+    this.items.push({ severity: "error", code, message, resource });
+  }
+  warning(code, message, resource) {
+    this.items.push({ severity: "warning", code, message, resource });
+  }
+  info(code, message, resource) {
+    this.items.push({ severity: "info", code, message, resource });
+  }
+  hasErrors() {
+    return this.items.some((d) => d.severity === "error");
+  }
+  getAll() {
+    return [...this.items];
+  }
+  format() {
+    if (this.items.length === 0) return "";
+    const lines = [];
+    for (const d of this.items) {
+      const icon = severityIcon(d.severity);
+      const addr = d.resource ? ` ${d.resource.type}.${d.resource.name} (${d.resource.provider})` : "";
+      lines.push(`${icon} ${d.code}`);
+      if (addr) lines.push(`  Resource:${addr}`);
+      lines.push(`  ${d.message}`);
+      lines.push("");
+    }
+    return lines.join("\n");
+  }
+};
+function severityIcon(s) {
+  switch (s) {
+    case "error":
+      return "\u2717";
+    case "warning":
+      return "\u26A0";
+    case "info":
+      return "\u2139";
+  }
+}
+
+// src/internal/validation/bailian.ts
+function findMissingBailianMcpToolConfigs(config, providerName = "bailian") {
+  if (providerName !== "bailian") return [];
+  const missing = [];
+  for (const [agentName, agent] of Object.entries(config.agents ?? {})) {
+    if (!agentTargetsProvider(config, agent.provider, providerName)) continue;
+    const configuredToolServers = new Set((agent.tools?.mcp ?? []).map((tool) => tool.mcp_server_name));
+    for (const server of agent.mcp_servers ?? []) {
+      if (!configuredToolServers.has(server.name)) {
+        missing.push({ agentName, serverName: server.name });
+      }
+    }
+  }
+  return missing;
+}
+function agentTargetsProvider(config, agentProvider, providerName) {
+  if (agentProvider) return agentProvider === providerName;
+  const defaultProvider = config.defaults?.provider;
+  if (defaultProvider && defaultProvider !== "all") {
+    return defaultProvider === providerName;
+  }
+  return Object.hasOwn(config.providers, providerName);
+}
+
+// src/internal/core/validate-config.ts
+function validateProjectConfig(config, options = {}) {
+  const collector = new DiagnosticCollector();
+  collectReferenceDiagnostics(config, collector);
+  const providers = options.providers ?? resolveTargetProviders(config);
+  collectProviderCapabilities(config, providers, collector);
+  return collector.getAll();
+}
+function collectConfigReferences(config) {
+  const collector = new DiagnosticCollector();
+  collectReferenceDiagnostics(config, collector);
+  return collector.getAll();
+}
+function resolveTargetProviders(config) {
+  const defaultProvider = config.defaults?.provider;
+  if (!defaultProvider || defaultProvider === "all") {
+    return Object.keys(config.providers);
+  }
+  return [defaultProvider];
+}
+function collectReferenceDiagnostics(config, diagnostics) {
+  const envNames = new Set(Object.keys(config.environments ?? {}));
+  const tunnelNames = new Set(Object.keys(config.tunnels ?? {}));
+  const skillNames = new Set(Object.keys(config.skills ?? {}));
+  const vaultNames = new Set(Object.keys(config.vaults ?? {}));
+  const memoryNames = new Set(Object.keys(config.memory_stores ?? {}));
+  const fileNames = new Set(Object.keys(config.files ?? {}));
+  const agentNames = new Set(Object.keys(config.agents ?? {}));
+  const identityNames = new Set(Object.keys(config.identities ?? {}));
+  if (config.defaults?.identity && !identityNames.has(config.defaults.identity)) {
+    diagnostics.error(
+      "config.defaults.identity.unknown",
+      `defaults.identity references unknown identity '${config.defaults.identity}'`
+    );
+  }
+  for (const [name, agent] of Object.entries(config.agents ?? {})) {
+    if (agent.environment && !envNames.has(agent.environment)) {
+      diagnostics.error(
         "config.agent.environment.unknown",
         `agent.${name}: references unknown environment '${agent.environment}'`
       );
@@ -7666,295 +8180,89 @@ function collectProviderCapabilities(config, providers, diagnostics) {
         { type: "agent", name: missing.agentName, provider: providerName }
       );
     }
-    if (config.memory_stores && !isSupported(caps, "memory_store")) {
-      for (const [name, decl] of Object.entries(config.memory_stores)) {
-        if (!decl.provider || decl.provider === providerName) {
-          diagnostics.error(
-            `${providerName}.memory_store.unsupported`,
-            `${caps.memory_store.reason}. ${caps.memory_store.remediation ?? ""}`.trim(),
-            { type: "memory_store", name, provider: providerName }
-          );
-        }
-      }
-    }
-    if (config.agents && !isSupported(caps, "multiagent")) {
-      for (const [name, agent] of Object.entries(config.agents)) {
-        if (agent.multiagent) {
-          if (!agent.provider || agent.provider === providerName) {
-            diagnostics.error(
-              `${providerName}.multiagent.unsupported`,
-              `${caps.multiagent.reason}. ${caps.multiagent.remediation ?? ""}`.trim(),
-              { type: "agent", name, provider: providerName }
-            );
-          }
-        }
-      }
-    }
-    if (config.deployments && caps.deployment.tier === "emulated") {
-      for (const [name, dep] of Object.entries(config.deployments)) {
-        if (dep.provider && dep.provider !== providerName) continue;
-        const addr = {
-          type: "deployment",
-          name,
-          provider: providerName
-        };
-        if (dep.schedule) {
-          diagnostics.warning(
-            `${providerName}.deployment.schedule_unsupported`,
-            "Schedules are not enforced server-side on this provider; trigger runs via external cron/CI.",
-            addr
-          );
-        }
-        if (dep.initial_events?.some((e) => e.type === "user.define_outcome")) {
-          diagnostics.warning(
-            `${providerName}.deployment.define_outcome_unsupported`,
-            "Outcome rubrics (user.define_outcome) are not enforced server-side on this provider; the run executes without rubric grading.",
-            addr
-          );
-        }
-        if (dep.resources?.some((r) => r.type === "github_repository")) {
-          diagnostics.warning(
-            `${providerName}.deployment.github_repository_unsupported`,
-            "github_repository resources are not provisioned on this provider; clone the repository inside the session instead.",
-            addr
-          );
-        }
-        if (dep.resources?.some((r) => r.type === "memory_store" && (r.access === "read_only" || r.instructions))) {
-          diagnostics.warning(
-            `${providerName}.deployment.memory_store_options_unsupported`,
-            "Per-resource memory_store access/instructions are not honored on this provider; the store is attached with default access.",
-            addr
-          );
-        }
-      }
-    }
-  }
-}
-
-// src/internal/graph/dependency.ts
-function buildDependencyGraph(config, targetProviders) {
-  const nodes = /* @__PURE__ */ new Map();
-  const edges = /* @__PURE__ */ new Map();
-  function addNode(addr) {
-    const key = addressKey(addr);
-    nodes.set(key, addr);
-    if (!edges.has(key)) edges.set(key, /* @__PURE__ */ new Set());
-  }
-  function addEdge(from, to) {
-    const fromKey = addressKey(from);
-    const toKey = addressKey(to);
-    edges.get(fromKey)?.add(toKey);
-  }
-  for (const provider of targetProviders) {
-    const def = getProvider(provider);
-    const caps = def?.capabilities;
-    if (config.environments) {
-      for (const name of Object.keys(config.environments)) {
-        const decl = config.environments[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "environment", name, provider });
-      }
-    }
-    if (config.memory_stores) {
-      for (const name of Object.keys(config.memory_stores)) {
-        const decl = config.memory_stores[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        if (!isSupported(caps, "memory_store")) continue;
-        addNode({ type: "memory_store", name, provider });
-      }
-    }
-    if (config.vaults) {
-      for (const name of Object.keys(config.vaults)) {
-        const decl = config.vaults[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "vault", name, provider });
-      }
-    }
-    if (config.skills) {
-      for (const name of Object.keys(config.skills)) {
-        const decl = config.skills[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "skill", name, provider });
-      }
-    }
-    if (config.files) {
-      for (const name of Object.keys(config.files)) {
-        const decl = config.files[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "file", name, provider });
-      }
-    }
-    if (config.identities && isSupported(caps, "identity")) {
-      for (const name of Object.keys(config.identities)) {
-        const decl = config.identities[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "identity", name, provider });
-      }
-    }
-    if (config.agents) {
-      for (const name of Object.keys(config.agents)) {
-        const decl = config.agents[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        const materialization = resolveAgentMaterialization(provider, decl);
-        const agentAddr = { type: materialization.resourceType, name, provider };
-        addNode(agentAddr);
-        if ((decl.default_memory_store || decl.memory_stores?.length) && materialization.resourceType === "template") {
-          const identityName = config.defaults?.identity;
-          if (identityName) {
-            const identityAddr = { type: "identity", name: identityName, provider };
-            if (nodes.has(addressKey(identityAddr))) addEdge(agentAddr, identityAddr);
-          }
-        }
-        if (decl.environment && config.environments?.[decl.environment]) {
-          const envAddr = {
-            type: "environment",
-            name: decl.environment,
-            provider
-          };
-          if (nodes.has(addressKey(envAddr))) {
-            addEdge(agentAddr, envAddr);
-          }
-        }
-        if (decl.skills) {
-          for (const skillRef of decl.skills) {
-            if (typeof skillRef !== "string") continue;
-            const skillName = skillRef;
-            const skillAddr = { type: "skill", name: skillName, provider };
-            if (nodes.has(addressKey(skillAddr))) {
-              addEdge(agentAddr, skillAddr);
-            }
-          }
-        }
-        if (decl.vault) {
-          const vaultAddr = { type: "vault", name: decl.vault, provider };
-          if (nodes.has(addressKey(vaultAddr))) {
-            addEdge(agentAddr, vaultAddr);
-          }
-        }
-        if (decl.files) {
-          for (const fileName of decl.files) {
-            const fileAddr = { type: "file", name: fileName, provider };
-            if (nodes.has(addressKey(fileAddr))) addEdge(agentAddr, fileAddr);
-          }
-        }
-        if (decl.memory_stores) {
-          for (const msName of decl.memory_stores) {
-            const msAddr = {
-              type: "memory_store",
-              name: msName,
-              provider
-            };
-            if (nodes.has(addressKey(msAddr))) {
-              addEdge(agentAddr, msAddr);
-            }
-          }
+    if (config.memory_stores && !isSupported(caps, "memory_store")) {
+      for (const [name, decl] of Object.entries(config.memory_stores)) {
+        if (!decl.provider || decl.provider === providerName) {
+          diagnostics.error(
+            `${providerName}.memory_store.unsupported`,
+            `${caps.memory_store.reason}. ${caps.memory_store.remediation ?? ""}`.trim(),
+            { type: "memory_store", name, provider: providerName }
+          );
         }
-        if (decl.multiagent && isSupported(caps, "multiagent")) {
-          for (const subName of decl.multiagent.agents) {
-            const subDecl = config.agents[subName];
-            const subType = subDecl ? resolveAgentMaterialization(provider, subDecl).resourceType : "agent";
-            const subAddr = { type: subType, name: subName, provider };
-            addEdge(agentAddr, subAddr);
+      }
+    }
+    if (config.agents && !isSupported(caps, "multiagent")) {
+      for (const [name, agent] of Object.entries(config.agents)) {
+        if (agent.multiagent) {
+          if (!agent.provider || agent.provider === providerName) {
+            diagnostics.error(
+              `${providerName}.multiagent.unsupported`,
+              `${caps.multiagent.reason}. ${caps.multiagent.remediation ?? ""}`.trim(),
+              { type: "agent", name, provider: providerName }
+            );
           }
         }
       }
     }
-    if (config.deployments) {
-      for (const name of Object.keys(config.deployments)) {
-        const decl = config.deployments[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        const depAddr = { type: "deployment", name, provider };
-        addNode(depAddr);
-        const agentDecl = config.agents?.[decl.agent];
-        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
-        const agentAddr = { type: agentType, name: decl.agent, provider };
-        if (nodes.has(addressKey(agentAddr))) addEdge(depAddr, agentAddr);
-        if (decl.environment) {
-          const envAddr = { type: "environment", name: decl.environment, provider };
-          if (nodes.has(addressKey(envAddr))) addEdge(depAddr, envAddr);
-        }
-        if (decl.vaults) {
-          for (const vName of decl.vaults) {
-            const vAddr = { type: "vault", name: vName, provider };
-            if (nodes.has(addressKey(vAddr))) addEdge(depAddr, vAddr);
-          }
+    if (config.deployments && caps.deployment.tier === "emulated") {
+      for (const [name, dep] of Object.entries(config.deployments)) {
+        if (dep.provider && dep.provider !== providerName) continue;
+        const addr = {
+          type: "deployment",
+          name,
+          provider: providerName
+        };
+        if (dep.schedule) {
+          diagnostics.warning(
+            `${providerName}.deployment.schedule_unsupported`,
+            "Schedules are not enforced server-side on this provider; trigger runs via external cron/CI.",
+            addr
+          );
         }
-        if (decl.memory_stores) {
-          for (const msName of decl.memory_stores) {
-            const msAddr = { type: "memory_store", name: msName, provider };
-            if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
-          }
+        if (dep.initial_events?.some((e) => e.type === "user.define_outcome")) {
+          diagnostics.warning(
+            `${providerName}.deployment.define_outcome_unsupported`,
+            "Outcome rubrics (user.define_outcome) are not enforced server-side on this provider; the run executes without rubric grading.",
+            addr
+          );
         }
-        if (decl.resources) {
-          for (const r of decl.resources) {
-            if (r.type === "memory_store") {
-              const msAddr = { type: "memory_store", name: r.memory_store, provider };
-              if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
-            }
-          }
+        if (dep.resources?.some((r) => r.type === "github_repository")) {
+          diagnostics.warning(
+            `${providerName}.deployment.github_repository_unsupported`,
+            "github_repository resources are not provisioned on this provider; clone the repository inside the session instead.",
+            addr
+          );
         }
-      }
-    }
-    if (config.channels && isSupported(caps, "channel")) {
-      for (const name of Object.keys(config.channels)) {
-        const decl = config.channels[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        const channelAddr = { type: "channel", name, provider };
-        addNode(channelAddr);
-        if (decl.mode === "pairing" || !decl.agent) continue;
-        const agentDecl = config.agents?.[decl.agent];
-        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
-        const agentAddr = { type: agentType, name: decl.agent, provider };
-        if (nodes.has(addressKey(agentAddr))) addEdge(channelAddr, agentAddr);
-        const identityName = decl.identity ?? config.defaults?.identity;
-        if (identityName) {
-          const identityAddr = { type: "identity", name: identityName, provider };
-          if (nodes.has(addressKey(identityAddr))) addEdge(channelAddr, identityAddr);
+        if (dep.resources?.some((r) => r.type === "memory_store" && (r.access === "read_only" || r.instructions))) {
+          diagnostics.warning(
+            `${providerName}.deployment.memory_store_options_unsupported`,
+            "Per-resource memory_store access/instructions are not honored on this provider; the store is attached with default access.",
+            addr
+          );
         }
       }
     }
   }
-  return { nodes, edges };
-}
-function topologicalSort(graph) {
-  const visited = /* @__PURE__ */ new Set();
-  const sorted = [];
-  const visiting = /* @__PURE__ */ new Set();
-  function visit(key) {
-    if (visited.has(key)) return;
-    if (visiting.has(key)) {
-      throw new UserError(`Circular dependency detected involving: ${key}`);
-    }
-    visiting.add(key);
-    const deps = graph.edges.get(key) ?? /* @__PURE__ */ new Set();
-    for (const dep of deps) {
-      visit(dep);
-    }
-    visiting.delete(key);
-    visited.add(key);
-    sorted.push(graph.nodes.get(key));
-  }
-  for (const key of graph.nodes.keys()) {
-    visit(key);
-  }
-  return sorted;
 }
 
 // src/internal/planner/planner.ts
 async function buildPlan(config, state, options = {}) {
+  const scopedConfig = options.resourceAddresses ? selectProjectConfig(config, options.resourceAddresses) : config;
+  const resourceKeys = options.resourceAddresses ? new Set(options.resourceAddresses.map(addressKey)) : void 0;
+  const scopedState = resourceKeys ? { ...state, resources: state.resources.filter((resource) => resourceKeys.has(addressKey(resource.address))) } : state;
   const diagnostics = new DiagnosticCollector();
   const actions = [];
-  const targetProviders = options.providers ?? resolveTargetProviders(config);
-  collectReferenceDiagnostics(config, diagnostics);
-  collectProviderCapabilities(config, targetProviders, diagnostics);
-  const graph = buildDependencyGraph(config, targetProviders);
+  const targetProviders = options.providers ?? resolveTargetProviders(scopedConfig);
+  collectReferenceDiagnostics(scopedConfig, diagnostics);
+  collectProviderCapabilities(scopedConfig, targetProviders, diagnostics);
+  const graph = buildDependencyGraph(scopedConfig, targetProviders);
   const sorted = topologicalSort(graph);
   const stateIndex = /* @__PURE__ */ new Map();
-  for (const res of state.resources) {
+  for (const res of scopedState.resources) {
     stateIndex.set(addressKey(res.address), res);
   }
   const remoteIdLookup = /* @__PURE__ */ new Map();
-  for (const res of state.resources) {
+  for (const res of scopedState.resources) {
     remoteIdLookup.set(addressKey(res.address), res);
   }
   const hashStateLookup = { getResource: (addr) => remoteIdLookup.get(addressKey(addr)) };
@@ -8098,9 +8406,53 @@ async function buildPlan(config, state, options = {}) {
       dependencies: replacement ? [replacement] : []
     });
   }
-  coalesceChannelRenames(actions, config, state);
+  coalesceChannelRenames(actions, scopedConfig, scopedState);
   return { actions, diagnostics: diagnostics.getAll() };
 }
+function selectProjectConfig(config, addresses) {
+  const providers = new Set(addresses.map((address) => address.provider));
+  const namesByType = /* @__PURE__ */ new Map();
+  for (const address of addresses) {
+    const names = namesByType.get(address.type) ?? /* @__PURE__ */ new Set();
+    names.add(address.name);
+    namesByType.set(address.type, names);
+  }
+  const pick = (record, names) => {
+    if (!record || !names?.size) return void 0;
+    const selected = Object.fromEntries(Object.entries(record).filter(([name]) => names.has(name)));
+    return Object.keys(selected).length > 0 ? selected : void 0;
+  };
+  const agentNames = /* @__PURE__ */ new Set([...namesByType.get("agent") ?? [], ...namesByType.get("template") ?? []]);
+  const selectedAgents = pick(config.agents, agentNames);
+  const tunnelNames = /* @__PURE__ */ new Set();
+  for (const agent of Object.values(selectedAgents ?? {})) {
+    if (agent.tunnel) tunnelNames.add(agent.tunnel);
+  }
+  for (const deployment of Object.values(pick(config.deployments, namesByType.get("deployment")) ?? {})) {
+    if (deployment.tunnel) tunnelNames.add(deployment.tunnel);
+  }
+  const identityNames = namesByType.get("identity");
+  const selectedProviders = Object.fromEntries(
+    Object.entries(config.providers).filter(([providerName]) => providers.has(providerName))
+  );
+  const defaultProvider = providers.size === 1 ? [...providers][0] : config.defaults?.provider;
+  const defaultIdentity = config.defaults?.identity && identityNames?.has(config.defaults.identity) ? config.defaults.identity : void 0;
+  return {
+    ...config,
+    providers: selectedProviders,
+    defaults: defaultProvider || defaultIdentity ? { provider: defaultProvider, identity: defaultIdentity } : void 0,
+    environments: pick(config.environments, namesByType.get("environment")),
+    tunnels: pick(config.tunnels, tunnelNames),
+    vaults: pick(config.vaults, namesByType.get("vault")),
+    memory_stores: pick(config.memory_stores, namesByType.get("memory_store")),
+    skills: pick(config.skills, namesByType.get("skill")),
+    files: pick(config.files, namesByType.get("file")),
+    identities: pick(config.identities, identityNames),
+    agents: selectedAgents,
+    channels: pick(config.channels, namesByType.get("channel")),
+    deployments: pick(config.deployments, namesByType.get("deployment"))
+  };
+}
 function coalesceChannelRenames(actions, config, state) {
   const creates = actions.filter((action) => action.action === "create" && action.address.type === "channel");
   const deletes = actions.filter((action) => action.action === "delete" && action.address.type === "channel");
@@ -8180,6 +8532,9 @@ async function refreshState(state, providers, options = {}) {
   const errors = [];
   let dirty = false;
   for (const res of resources) {
+    if (options.resourceKeys && !options.resourceKeys.has(addressKey(res.address))) {
+      continue;
+    }
     if (options.targetProviders && !options.targetProviders.includes(res.address.provider)) {
       continue;
     }
@@ -8293,12 +8648,19 @@ async function refreshState(state, providers, options = {}) {
 }
 
 // src/internal/core/resource-runtime.ts
+async function planProjectWithStateBackend(input, options = {}) {
+  return readProjectRuntime(input, (ctx) => planProjectContext(ctx, options));
+}
 async function syncProjectResourcesWithStateBackend(input, options = {}) {
   return writeProjectRuntime(input, async (ctx) => {
     const planned = await planProjectContext(ctx, options);
     if (options.refreshOnly) {
       return { planned };
     }
+    if (options.mode === "create-only") {
+      const errorDiagnostic = planned.plan.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+      if (errorDiagnostic) throw new UserError(errorDiagnostic.message);
+    }
     return {
       planned,
       execution: await executePlannedProject(planned, {
@@ -8366,26 +8728,103 @@ async function importResource(ctx, address, remoteId, options = {}) {
   return resource;
 }
 async function planProjectContext(ctx, options = {}) {
-  const targetProviders = resolveTargetProviders2(options.provider);
+  if (options.mode === "create-only" && !options.scope) {
+    throw new UserError("Resource create-only mode requires an explicit resource scope.");
+  }
+  let targetProviders = resolveTargetProviders2(options.provider);
+  if (!targetProviders && options.scope) {
+    targetProviders = [...new Set(options.scope.roots.map((root) => root.provider))];
+  }
+  const selectedAddresses = options.scope ? resolvePlanScope(ctx, targetProviders ?? [], options.scope) : void 0;
+  const resourceKeys = selectedAddresses ? new Set(selectedAddresses.map(addressKey)) : void 0;
   const refreshResult = options.refresh !== false && ctx.state.listResources().length > 0 ? await refreshState(ctx.state, ctx.providers, {
     targetProviders,
+    resourceKeys,
     config: ctx.config,
     quiet: options.quiet ?? true,
     onFeedback: options.onFeedback
   }) : void 0;
-  const plan = await buildPlan(ctx.config, ctx.state.getStateFile(), {
+  let plan = await buildPlan(ctx.config, ctx.state.getStateFile(), {
     providers: targetProviders,
-    configPath: ctx.configPath
+    configPath: ctx.configPath,
+    resourceAddresses: selectedAddresses
   });
+  if (options.mode === "create-only" && options.scope) {
+    plan = enforceCreateOnlyPlan(plan, options.scope, toResourceRefreshResult(refreshResult));
+  }
   return {
     executionContext: ctx,
     plan,
     refreshResult: toResourceRefreshResult(refreshResult),
     targetProviders,
-    destructiveActions: selectDestructive(plan.actions)
+    destructiveActions: selectDestructive(plan.actions),
+    selectedAddresses,
+    mode: options.mode
+  };
+}
+function enforceCreateOnlyPlan(plan, scope, refreshResult) {
+  const reasons = [];
+  const rootKeys = new Set(scope.roots.map(addressKey));
+  const refreshError = refreshResult?.errors[0];
+  if (refreshError) {
+    reasons.push(
+      `Cannot verify scoped dependencies because refresh failed for ${addressKey(refreshError.resource.address)}: ${refreshError.error}`
+    );
+  }
+  for (const root of scope.roots) {
+    const rootKey = addressKey(root);
+    const rootAction = plan.actions.find((action) => addressKey(action.address) === rootKey);
+    if (!rootAction) {
+      reasons.push(`Scoped plan did not contain target resource ${rootKey}.`);
+    } else if (rootAction.action !== "create") {
+      reasons.push(`Target resource ${rootKey} must be new, but the scoped plan requires '${rootAction.action}'.`);
+    }
+  }
+  const dependencyChanges = plan.actions.filter(
+    (action) => !rootKeys.has(addressKey(action.address)) && action.action !== "no-op"
+  );
+  if (dependencyChanges.length > 0) {
+    const labels = dependencyChanges.map((action) => `${addressKey(action.address)} (${action.action})`).join(", ");
+    reasons.push(`Create-only requires every scoped dependency to be up-to-date. Reconcile first: ${labels}.`);
+  }
+  if (reasons.length === 0) return plan;
+  return {
+    ...plan,
+    diagnostics: [
+      ...plan.diagnostics,
+      {
+        severity: "error",
+        code: "resource.create_only.blocked",
+        message: reasons.join(" "),
+        resource: scope.roots[0]
+      }
+    ]
   };
 }
+function resolvePlanScope(ctx, targetProviders, scope) {
+  if (scope.roots.length === 0) {
+    throw new UserError("Resource plan scope requires at least one root address.");
+  }
+  for (const root of scope.roots) {
+    if (!targetProviders.includes(root.provider)) {
+      throw new UserError(
+        `Scoped resource ${addressKey(root)} is outside the selected provider set: ${targetProviders.join(", ")}.`
+      );
+    }
+  }
+  const graph = buildDependencyGraph(ctx.config, targetProviders);
+  for (const root of scope.roots) {
+    if (!graph.nodes.has(addressKey(root))) {
+      throw new UserError(`Scoped resource ${addressKey(root)} is not declared in the project config.`);
+    }
+  }
+  return scope.includeDependencies === false ? [...scope.roots] : collectDependencyClosure(graph, scope.roots);
+}
 async function executePlannedProject(planned, options = {}) {
+  if (planned.mode === "create-only") {
+    const errorDiagnostic = planned.plan.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+    if (errorDiagnostic) throw new UserError(errorDiagnostic.message);
+  }
   const decision = await decideDestructive(planned.destructiveActions, {
     policy: options.policy,
     confirm: options.confirm
@@ -8403,7 +8842,8 @@ async function executePlannedProject(planned, options = {}) {
       configPath: ctx.configPath,
       providers: ctx.providers,
       state: ctx.state,
-      onFeedback: options.onFeedback
+      onFeedback: options.onFeedback,
+      createOnly: planned.mode === "create-only"
     },
     { concurrency: options.concurrency }
   );
@@ -8428,13 +8868,6 @@ async function decideDestructive(destructiveActions, options = {}) {
       return "blocked";
   }
 }
-function replaceResourcePlan(planned, plan) {
-  return {
-    ...planned,
-    plan,
-    destructiveActions: selectDestructive(plan.actions)
-  };
-}
 function toResourceRefreshResult(result) {
   if (!result) return void 0;
   return {
@@ -8783,6 +9216,369 @@ function buildDeploymentContext(ctx, name, provider) {
   };
 }
 
+// src/internal/core/managed-api-runtime.ts
+function resolveAdapter(ctx, provider) {
+  if (provider) return getRuntimeProvider(ctx, provider);
+  const configured = Array.from(ctx.providers.keys());
+  if (configured.length === 1) return getRuntimeProvider(ctx, configured[0]);
+  throw new UserError("Multiple providers configured. Use --provider to specify one.");
+}
+function requiredMethod(value, provider, operation) {
+  if (value) return value;
+  throw new UserError(`Provider '${provider}' does not support ${operation}.`);
+}
+async function listRemoteAgents(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listAgentResources, adapter2.name, "agent listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteAgent(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getRemoteAgent, adapter2.name, "agent lookup");
+  return method2.call(adapter2, id, options.version);
+}
+async function listRemoteAgentVersions(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listAgentVersions, adapter2.name, "agent version listing");
+  return method2.call(adapter2, id, options);
+}
+async function listRemoteEnvironments(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listEnvironmentResources, adapter2.name, "environment listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteEnvironment(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getRemoteEnvironment, adapter2.name, "environment lookup");
+  return method2.call(adapter2, id);
+}
+async function listRemoteVaults(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listVaultResources, adapter2.name, "vault listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteVault(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getRemoteVault, adapter2.name, "vault lookup");
+  return method2.call(adapter2, id);
+}
+async function listRemoteSkills(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listSkillResources, adapter2.name, "skill listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteSkill(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getSkillInfo, adapter2.name, "skill lookup");
+  return method2.call(adapter2, id);
+}
+async function listRemoteSkillVersions(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listSkillVersions, adapter2.name, "skill version listing");
+  return method2.call(adapter2, id, options);
+}
+async function getRemoteSkillVersion(ctx, id, version, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getSkillVersion, adapter2.name, "skill version lookup");
+  return method2.call(adapter2, id, version);
+}
+async function getRemoteSkillDownloadInfo(ctx, id, version, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getSkillDownloadInfo, adapter2.name, "skill version download");
+  return method2.call(adapter2, id, version);
+}
+async function downloadRemoteSkill(ctx, id, version, options = {}) {
+  const info = await getRemoteSkillDownloadInfo(ctx, id, version, options);
+  const response = await resolveFetch()(info.file_url, { method: "GET" });
+  if (!response.ok) {
+    throw new ApiError(response.status, await response.text(), "Skill download failed");
+  }
+  return new Uint8Array(await response.arrayBuffer());
+}
+async function listRemoteFiles(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listFileResources, adapter2.name, "file listing");
+  return method2.call(adapter2, options);
+}
+async function downloadRemoteFile(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.downloadFileContent, adapter2.name, "file content download");
+  return method2.call(adapter2, id);
+}
+async function updateRemoteSession(ctx, id, input, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.updateSession, adapter2.name, "session update");
+  return method2.call(adapter2, id, input);
+}
+async function archiveRemoteSession(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.archiveSession, adapter2.name, "session archive");
+  return method2.call(adapter2, id);
+}
+async function sendRemoteSessionEvents(ctx, id, events, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.sendSessionEvents, adapter2.name, "generic session event sending");
+  return method2.call(adapter2, id, events);
+}
+async function listRemoteDeployments(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listDeployments, adapter2.name, "deployment listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteDeployment(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getDeploymentById, adapter2.name, "deployment lookup");
+  return method2.call(adapter2, id);
+}
+async function runRemoteDeployment(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.runDeploymentById, adapter2.name, "deployment run");
+  return method2.call(adapter2, id);
+}
+async function setRemoteDeploymentPaused(ctx, id, paused, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = paused ? adapter2.pauseDeploymentById : adapter2.unpauseDeploymentById;
+  return requiredMethod(method2, adapter2.name, `${paused ? "pausing" : "unpausing"} deployments`).call(adapter2, id);
+}
+async function listRemoteDeploymentRuns(ctx, deploymentId, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listDeploymentRuns, adapter2.name, "deployment run listing");
+  return method2.call(adapter2, deploymentId, options);
+}
+async function getRemoteDeploymentRun(ctx, runId, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getDeploymentRun, adapter2.name, "deployment run lookup");
+  return method2.call(adapter2, runId);
+}
+var API_KEY = { supported: true, auth: "api_key" };
+var CLIENT_SEARCH = {
+  supported: true,
+  auth: "api_key",
+  reason: "Client-side filtering over the corresponding list API."
+};
+var UNSUPPORTED_MODEL = {
+  supported: false,
+  auth: null,
+  reason: "The public Managed Agents API does not expose a model catalog endpoint."
+};
+var UNSUPPORTED_THREAD = {
+  supported: false,
+  auth: null,
+  reason: "Managed Agents exposes child-thread ids and lifecycle events through Session Events, but no independent Thread resource API."
+};
+var UNSUPPORTED_OAUTH = {
+  supported: false,
+  auth: null,
+  reason: "The public Managed Agents data plane does not expose MCP OAuth login."
+};
+var BAILIAN_OPERATIONS = {
+  "agent.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "agent.list": API_KEY,
+  "agent.get": API_KEY,
+  "agent.search": CLIENT_SEARCH,
+  "agent.versions": API_KEY,
+  "environment.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "environment.list": API_KEY,
+  "environment.get": API_KEY,
+  "environment.search": CLIENT_SEARCH,
+  "skill.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "skill.list": API_KEY,
+  "skill.get": API_KEY,
+  "skill.search": CLIENT_SEARCH,
+  "skill.versions": API_KEY,
+  "skill.download": API_KEY,
+  "vault.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "vault.credential.create": {
+    ...API_KEY,
+    reason: "YAML declaration plus scoped Vault transaction; Bailian supports environment_variable credentials only."
+  },
+  "vault.list": API_KEY,
+  "vault.get": API_KEY,
+  "vault.search": CLIENT_SEARCH,
+  "deployment.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "deployment.list": API_KEY,
+  "deployment.get": API_KEY,
+  "deployment.search": { ...API_KEY, reason: "Maps to the server-side keyword parameter." },
+  "deployment.runs.list": API_KEY,
+  "deployment.runs.get": API_KEY,
+  "deployment.run": API_KEY,
+  "deployment.pause": API_KEY,
+  "deployment.unpause": API_KEY,
+  "session.create": API_KEY,
+  "session.list": API_KEY,
+  "session.get": API_KEY,
+  "session.search": CLIENT_SEARCH,
+  "session.update": API_KEY,
+  "session.archive": API_KEY,
+  "session.delete": API_KEY,
+  "session.run": { ...API_KEY, reason: "Client composition of session create and event send/stream." },
+  "session.event.send": API_KEY,
+  "session.event.list": API_KEY,
+  "session.event.stream": API_KEY,
+  "session.debug": { ...API_KEY, reason: "Client-side aggregation of supported read APIs." },
+  "session.export": { ...API_KEY, reason: "Client-side export of supported read APIs." },
+  "file.upload": API_KEY,
+  "file.list": API_KEY,
+  "file.get": API_KEY,
+  "file.search": CLIENT_SEARCH,
+  "file.download": API_KEY,
+  "file.delete": API_KEY,
+  "model.list": UNSUPPORTED_MODEL,
+  "model.search": UNSUPPORTED_MODEL,
+  "session_thread.list": UNSUPPORTED_THREAD,
+  "session_thread.get": UNSUPPORTED_THREAD,
+  "session_thread.archive": UNSUPPORTED_THREAD,
+  "session_thread.events": UNSUPPORTED_THREAD,
+  "mcp.oauth_login": UNSUPPORTED_OAUTH
+};
+function getManagedAgentProviderCapabilities(provider) {
+  if (provider === "bailian") {
+    return { provider, operations: { ...BAILIAN_OPERATIONS } };
+  }
+  return {
+    provider,
+    operations: {
+      "managed_agent.api": {
+        supported: false,
+        auth: null,
+        reason: "The operation-level API command surface is currently implemented for Bailian only."
+      }
+    }
+  };
+}
+
+// src/internal/core/vault-credential-runtime.ts
+async function planVaultCredentialCreate(ctx, vaultName, credentialName, options = {}) {
+  const prepared = await prepareVaultCredentialCreate(ctx, vaultName, credentialName, options);
+  return {
+    provider: prepared.provider,
+    vault: vaultName,
+    vaultRemoteId: prepared.vaultState.remote_id,
+    credential: credentialName,
+    remoteChecked: prepared.remoteChecked,
+    reuseRemote: Boolean(prepared.remoteCredential),
+    remoteCredentialId: prepared.remoteCredential?.id
+  };
+}
+async function planVaultCredentialCreateWithStateBackend(input, vaultName, credentialName, options = {}) {
+  return readProjectRuntime(input, (ctx) => planVaultCredentialCreate(ctx, vaultName, credentialName, options));
+}
+async function createVaultCredential(ctx, vaultName, credentialName, options = {}) {
+  if (options.checkRemote === false) {
+    throw new UserError("Vault Credential create requires the remote duplicate check.");
+  }
+  const prepared = await prepareVaultCredentialCreate(ctx, vaultName, credentialName, options);
+  const remote = prepared.remoteCredential ?? await prepared.adapter.createCredential(prepared.vaultState.remote_id, prepared.credential);
+  if (!remote.id) throw new UserError("Credential create returned no remote id.");
+  const address = { type: "vault", name: vaultName, provider: prepared.provider };
+  const desiredHash = await computeResourceHash(address, ctx.config, ctx.configPath, ctx.state);
+  ctx.state.setResource({
+    ...prepared.vaultState,
+    content_hash: desiredHash,
+    desired_hash: desiredHash,
+    drift_paths: [],
+    drift_status: "unchecked"
+  });
+  await ctx.state.save();
+  return {
+    provider: prepared.provider,
+    vault: vaultName,
+    vaultRemoteId: prepared.vaultState.remote_id,
+    credential: credentialName,
+    remoteChecked: prepared.remoteChecked,
+    credentialId: remote.id,
+    reuseRemote: Boolean(prepared.remoteCredential),
+    remoteCredentialId: prepared.remoteCredential?.id,
+    adopted: Boolean(prepared.remoteCredential)
+  };
+}
+async function createVaultCredentialWithStateBackend(input, vaultName, credentialName, options = {}) {
+  return writeProjectRuntime(input, (ctx) => createVaultCredential(ctx, vaultName, credentialName, options));
+}
+async function prepareVaultCredentialCreate(ctx, vaultName, credentialName, options) {
+  const vault = ctx.config.vaults?.[vaultName];
+  if (!vault) throw new UserError(`Vault '${vaultName}' is not declared in the project config.`);
+  const provider = resolveVaultProvider(ctx, vault.provider, options.provider);
+  const credential = vault.credentials.at(-1);
+  if (!credential || credential.name !== credentialName) {
+    throw new UserError(`Credential '${credentialName}' must be the final newly appended entry in vault.${vaultName}.`);
+  }
+  if (vault.credentials.slice(0, -1).some((entry) => entry.name === credentialName)) {
+    throw new UserError(`Vault '${vaultName}' already declares a credential named '${credentialName}'.`);
+  }
+  if (provider === "bailian" && credential.type !== "environment_variable") {
+    throw new UserError(
+      `Credential '${credentialName}' uses '${credential.type}', but Bailian only supports 'environment_variable' credentials.`
+    );
+  }
+  const address = { type: "vault", name: vaultName, provider };
+  const priorConfig = structuredClone(ctx.config);
+  priorConfig.vaults[vaultName] = {
+    ...priorConfig.vaults[vaultName],
+    credentials: priorConfig.vaults[vaultName].credentials.slice(0, -1)
+  };
+  const priorPlan = await planProjectContext(
+    { ...ctx, config: priorConfig },
+    {
+      provider,
+      scope: { roots: [address] },
+      refresh: options.refresh,
+      quiet: options.quiet ?? true
+    }
+  );
+  const refreshError = priorPlan.refreshResult?.errors[0];
+  if (refreshError) {
+    throw new UserError(`Cannot verify vault.${vaultName} because refresh failed: ${refreshError.error}`);
+  }
+  const errorDiagnostic = priorPlan.plan.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+  if (errorDiagnostic) throw new UserError(errorDiagnostic.message);
+  const vaultAction = priorPlan.plan.actions.find(
+    (action) => action.address.type === "vault" && action.address.name === vaultName
+  );
+  if (vaultAction?.action !== "no-op") {
+    throw new UserError(
+      `vault.${vaultName} must be tracked and up-to-date before adding a credential; current action is '${vaultAction?.action ?? "missing"}'.`
+    );
+  }
+  const vaultState = ctx.state.getResource(address);
+  if (!vaultState?.remote_id) throw new UserError(`vault.${vaultName} has no tracked remote id.`);
+  const adapter2 = getRuntimeProvider(ctx, provider);
+  if (!adapter2.createCredential || !adapter2.listCredentials) {
+    throw new UserError(`Provider '${provider}' does not support scoped Vault Credential create.`);
+  }
+  const remoteChecked = options.checkRemote !== false;
+  const sameName = remoteChecked ? (await adapter2.listCredentials(vaultState.remote_id)).filter(
+    (remoteCredential) => remoteCredential.display_name === credentialName
+  ) : [];
+  const exact = sameName.find((remoteCredential) => credentialMatches(remoteCredential, credential));
+  if (sameName.length > 0 && !exact) {
+    throw new UserError(`Vault '${vaultName}' already has a different remote credential named '${credentialName}'.`);
+  }
+  return { provider, credential, vaultState, adapter: adapter2, remoteChecked, remoteCredential: exact };
+}
+function resolveVaultProvider(ctx, declaredProvider, requestedProvider) {
+  if (requestedProvider && declaredProvider && requestedProvider !== declaredProvider) {
+    throw new UserError(
+      `Vault provider '${declaredProvider}' does not match requested provider '${requestedProvider}'.`
+    );
+  }
+  const provider = requestedProvider ?? declaredProvider ?? ctx.config.defaults?.provider;
+  if (provider && provider !== "all") return provider;
+  const configured = [...ctx.providers.keys()];
+  if (configured.length === 1) return configured[0];
+  throw new UserError("Cannot infer one provider for Vault Credential create.");
+}
+function credentialMatches(remote, desired) {
+  if (remote.auth_type !== desired.type || !metadataMatches(remote.metadata, desired.metadata)) return false;
+  if (desired.type === "static_bearer") return remote.mcp_server_url === desired.mcp_server_url;
+  return remote.secret_name === desired.secret_name && (remote.networking_type ?? "unrestricted") === (desired.networking?.type ?? "unrestricted");
+}
+function metadataMatches(remote, desired) {
+  const remoteEntries = Object.entries(remote ?? {});
+  const desiredEntries = Object.entries(desired ?? {});
+  return remoteEntries.length === desiredEntries.length && desiredEntries.every(([key, value]) => remote?.[key] === value);
+}
+
 // src/internal/core/destroy-runtime.ts
 var destroyOrder = {
   deployment: 0,
@@ -8805,11 +9601,14 @@ function planDestroyProjectContext(ctx) {
   for (const [agentName, agent] of Object.entries(ctx.config.agents ?? {})) {
     if (!agent.default_memory_store || agent.delivery?.qoder?.type !== "forward") continue;
     if (agent.provider && agent.provider !== "qoder") continue;
+    const identityId = identityName ? ctx.state.getResource({ type: "identity", name: identityName, provider: "qoder" })?.remote_id ?? null : null;
+    const templateId = ctx.state.getResource({ type: "template", name: agentName, provider: "qoder" })?.remote_id ?? null;
+    if (!identityId && !templateId) continue;
     defaultMemoryStores.push({
       agentName,
       provider: "qoder",
-      identityId: identityName ? ctx.state.getResource({ type: "identity", name: identityName, provider: "qoder" })?.remote_id ?? null : null,
-      templateId: ctx.state.getResource({ type: "template", name: agentName, provider: "qoder" })?.remote_id ?? null,
+      identityId,
+      templateId,
       deleteOnDestroy: agent.default_memory_store.delete_on_destroy ?? false
     });
   }
@@ -9322,6 +10121,7 @@ function buildAgentDecl(base, input) {
   });
   const agent = {
     ...base ?? {},
+    name: input.name ?? base?.name,
     description: input.description ?? base?.description,
     model,
     instructions: input.instructions ?? base?.instructions ?? "",
@@ -9558,28 +10358,36 @@ async function listAgentsWithReadiness(ctx, options = {}) {
 }
 async function planAgentResources(ctx, agentId, options = {}) {
   const agent = getAgent(ctx, agentId);
+  const rootAddress = collectAgentAddresses(ctx.config, agent.agentName, agent.provider)[0];
   const planned = await planProjectContext(ctx, {
     provider: agent.provider,
+    scope: { roots: [rootAddress] },
+    mode: options.mode,
     refresh: options.refresh,
     quiet: options.quiet ?? true
   });
-  const actions = filterAgentActions(ctx, agent, planned.plan);
+  const actions = planned.plan.actions;
+  const diagnostics = planned.plan.diagnostics;
   return {
     agentId,
     provider: agent.provider,
     actions,
-    diagnostics: filterAgentDiagnostics(ctx, agent, planned.plan),
+    diagnostics,
     destructiveActions: selectDestructive(actions),
     planned
   };
 }
+async function planAgentResourcesWithStateBackend(input, agentId, options = {}) {
+  return readProjectRuntime(input, (ctx) => planAgentResources(ctx, agentId, options));
+}
 async function syncAgentResources(ctx, agentId, options = {}) {
   return runAgentSync(ctx, agentId, options);
 }
 async function runAgentSync(ctx, agentId, options) {
   const fullPlan = await planAgentResources(ctx, agentId, {
     refresh: options.refresh,
-    quiet: options.quiet
+    quiet: options.quiet,
+    mode: options.mode
   });
   const actions = fullPlan.actions;
   const destructiveActions = fullPlan.destructiveActions;
@@ -9613,11 +10421,7 @@ async function runAgentSync(ctx, agentId, options) {
     };
   }
   try {
-    const scopedPlan = {
-      diagnostics: fullPlan.diagnostics,
-      actions: scopePlanActions(fullPlan.planned.plan, actions)
-    };
-    const execution = await executePlannedProject(replaceResourcePlan(fullPlan.planned, scopedPlan), {
+    const execution = await executePlannedProject(fullPlan.planned, {
       policy: "force"
     });
     const results = toAgentSyncResults(execution);
@@ -9721,29 +10525,6 @@ function getAgentReadinessFromPlan(ctx, agentId, plan) {
     plannedActions: relevantActions
   };
 }
-function filterAgentActions(ctx, agent, plan) {
-  const relevantKeys = agentAddressKeys(ctx, agent);
-  return plan.actions.filter(
-    (action) => relevantKeys.has(addressKey(action.address)) || action.dependencies.some((dependency) => relevantKeys.has(addressKey(dependency)))
-  );
-}
-function filterAgentDiagnostics(ctx, agent, plan) {
-  const relevantKeys = agentAddressKeys(ctx, agent);
-  return plan.diagnostics.filter(
-    (diagnostic) => !diagnostic.resource || relevantKeys.has(addressKey(diagnostic.resource))
-  );
-}
-function agentAddressKeys(ctx, agent) {
-  return new Set(collectAgentAddresses(ctx.config, agent.agentName, agent.provider).map(addressKey));
-}
-function scopePlanActions(fullPlan, agentActions) {
-  const allowedKeys = new Set(agentActions.filter((action) => action.action !== "no-op").map(actionKey));
-  return fullPlan.actions.filter((action) => action.action === "no-op" || allowedKeys.has(actionKey(action)));
-}
-function actionKey(action) {
-  const address = action.address;
-  return `${action.action}:${address.provider}:${address.type}:${address.name}`;
-}
 function isNonBlockingAgentDrift(action) {
   if (action.action === "no-op") return true;
   return action.readinessImpact === "non_blocking";
@@ -9755,33 +10536,13 @@ function collectAgentAddresses(config, agentName, provider) {
   }
   const resolvedProvider = provider ?? resolveSessionProvider(agentName, config, void 0);
   const materialization = resolveAgentMaterialization(resolvedProvider, agent);
-  const addresses = [
-    { type: materialization.resourceType, name: agentName, provider: resolvedProvider }
-  ];
-  if (agent.environment) {
-    addresses.push({
-      type: "environment",
-      name: agent.environment,
-      provider: resolvedProvider
-    });
-  }
-  if (agent.vault) {
-    addresses.push({ type: "vault", name: agent.vault, provider: resolvedProvider });
-  }
-  for (const name of agent.memory_stores ?? []) {
-    addresses.push({ type: "memory_store", name, provider: resolvedProvider });
-  }
-  for (const skill of agent.skills ?? []) {
-    if (typeof skill === "string") {
-      addresses.push({ type: "skill", name: skill, provider: resolvedProvider });
-    }
-  }
-  for (const subAgent of agent.multiagent?.agents ?? []) {
-    const subDecl = config.agents?.[subAgent];
-    const subType = subDecl ? resolveAgentMaterialization(resolvedProvider, subDecl).resourceType : "agent";
-    addresses.push({ type: subType, name: subAgent, provider: resolvedProvider });
-  }
-  return addresses;
+  const rootAddress = {
+    type: materialization.resourceType,
+    name: agentName,
+    provider: resolvedProvider
+  };
+  const graph = buildDependencyGraph(config, [resolvedProvider]);
+  return collectDependencyClosure(graph, [rootAddress]);
 }
 function toAgentDefinition(config, agentName, agent) {
   return {
@@ -10008,12 +10769,20 @@ async function listSessionEvents(ctx, sessionId, options = {}) {
   const listOptions = {};
   if (options.limit !== void 0) listOptions.limit = options.limit;
   if (options.order !== void 0) listOptions.order = options.order;
+  if (options.types !== void 0) listOptions.types = options.types;
+  if (options.created_at_gt !== void 0) listOptions.created_at_gt = options.created_at_gt;
+  if (options.created_at_gte !== void 0) listOptions.created_at_gte = options.created_at_gte;
+  if (options.created_at_lt !== void 0) listOptions.created_at_lt = options.created_at_lt;
+  if (options.created_at_lte !== void 0) listOptions.created_at_lte = options.created_at_lte;
   const pageToken = options.page_token ?? options.page;
   if (pageToken !== void 0) listOptions.page_token = pageToken;
-  return resolveDirectAdapter(ctx, options.provider).listSessionEvents(
+  const result = await resolveDirectAdapter(ctx, options.provider).listSessionEvents(
     sessionId,
     Object.keys(listOptions).length > 0 ? listOptions : void 0
   );
+  if (!options.types || options.types.length === 0) return result;
+  const allowedTypes = new Set(options.types);
+  return { ...result, events: result.events.filter((event) => allowedTypes.has(event.raw_type)) };
 }
 async function uploadFile(ctx, content, filename, options = {}) {
   const adapter2 = resolveDirectAdapter(ctx, options.provider);
@@ -10063,12 +10832,89 @@ async function deleteSkill(ctx, id, options = {}) {
   await resolveDirectAdapter(ctx, options.provider).deleteSkill(id);
 }
 function streamSessionEvents(ctx, sessionId, options = {}) {
+  const adapter2 = resolveDirectAdapter(ctx, options.provider);
+  if (options.after_id && !adapter2.eventResume) {
+    return replaySessionEventsByPolling(adapter2, sessionId, options.after_id);
+  }
   const streamOptions = {};
   if (options.after_id !== void 0) streamOptions.after_id = options.after_id;
-  return resolveDirectAdapter(ctx, options.provider).streamSessionEvents(
-    sessionId,
-    Object.keys(streamOptions).length > 0 ? streamOptions : void 0
-  );
+  return adapter2.streamSessionEvents(sessionId, Object.keys(streamOptions).length > 0 ? streamOptions : void 0);
+}
+async function* replaySessionEventsByPolling(adapter2, sessionId, afterId) {
+  const history = await listAllSessionEventHistory(adapter2, sessionId);
+  const markerIndex = history.findIndex((event) => event.id === afterId);
+  if (markerIndex < 0) {
+    throw new UserError(`Session event '${afterId}' was not found; list session events and choose a valid event id.`);
+  }
+  const knownEventKeys = new Set(history.slice(0, markerIndex + 1).map(sessionEventKey));
+  for (const event of history.slice(markerIndex + 1)) {
+    const eventKey = sessionEventKey(event);
+    if (knownEventKeys.has(eventKey)) continue;
+    knownEventKeys.add(eventKey);
+    yield event;
+    if (event.type === "status" && isTerminalSessionStatus(event.status)) return;
+  }
+  while (true) {
+    const newEvents = await listNewSessionEvents(adapter2, sessionId, knownEventKeys);
+    for (const event of newEvents) {
+      const eventKey = sessionEventKey(event);
+      if (knownEventKeys.has(eventKey)) continue;
+      knownEventKeys.add(eventKey);
+      yield event;
+      if (event.type === "status" && isTerminalSessionStatus(event.status)) return;
+    }
+    const session = await adapter2.getSession(sessionId);
+    if (isTerminalSessionStatus(session.status)) return;
+    await delay2(DEFAULT_POLL_INTERVAL_MS);
+  }
+}
+async function listAllSessionEventHistory(adapter2, sessionId) {
+  const events = [];
+  const seenPageTokens = /* @__PURE__ */ new Set();
+  let pageToken;
+  while (true) {
+    const result = await adapter2.listSessionEvents(sessionId, {
+      limit: 100,
+      order: "asc",
+      ...pageToken ? { page_token: pageToken } : {}
+    });
+    events.push(...result.events);
+    if (!result.next_page) return events;
+    if (seenPageTokens.has(result.next_page)) {
+      throw new UserError("Session event pagination returned a repeated cursor.");
+    }
+    seenPageTokens.add(result.next_page);
+    pageToken = result.next_page;
+  }
+}
+async function listNewSessionEvents(adapter2, sessionId, knownEventKeys) {
+  const descendingEvents = [];
+  const seenPageTokens = /* @__PURE__ */ new Set();
+  let pageToken;
+  while (true) {
+    const result = await adapter2.listSessionEvents(sessionId, {
+      limit: 100,
+      order: "desc",
+      ...pageToken ? { page_token: pageToken } : {}
+    });
+    let reachedKnownEvent = false;
+    for (const event of result.events) {
+      if (knownEventKeys.has(sessionEventKey(event))) {
+        reachedKnownEvent = true;
+        break;
+      }
+      descendingEvents.push(event);
+    }
+    if (reachedKnownEvent || !result.next_page) return descendingEvents.reverse();
+    if (seenPageTokens.has(result.next_page)) {
+      throw new UserError("Session event pagination returned a repeated cursor.");
+    }
+    seenPageTokens.add(result.next_page);
+    pageToken = result.next_page;
+  }
+}
+function sessionEventKey(event) {
+  return event.id ?? `raw:${event.raw_type}:${JSON.stringify(event.raw)}`;
 }
 function resolveDirectAdapter(ctx, overrideProvider) {
   if (overrideProvider) return getRuntimeProvider(ctx, overrideProvider);
@@ -10600,7 +11446,8 @@ var CloudAgentSchema = z6.object({
   workspace_id: z6.string().optional(),
   created_at: z6.string().optional(),
   updated_at: z6.string().optional(),
-  archived_at: z6.string().nullish()
+  archived_at: z6.string().nullish(),
+  attributes: z6.record(z6.string(), z6.unknown()).optional()
 });
 var ListCloudAgentsResponseSchema = z6.object({
   agents: z6.array(CloudAgentSchema)
@@ -10617,7 +11464,8 @@ var CloudEnvironmentSchema = z6.object({
   workspace_id: z6.string().optional(),
   created_at: z6.string().optional(),
   updated_at: z6.string().optional(),
-  archived_at: z6.string().nullish()
+  archived_at: z6.string().nullish(),
+  attributes: z6.record(z6.string(), z6.unknown()).optional()
 });
 var ListCloudEnvironmentsResponseSchema = z6.object({
   environments: z6.array(CloudEnvironmentSchema)
@@ -10629,7 +11477,8 @@ var CloudVaultSchema = z6.object({
   type: z6.string().optional(),
   created_at: z6.string().nullish(),
   updated_at: z6.string().nullish(),
-  archived_at: z6.string().nullish()
+  archived_at: z6.string().nullish(),
+  attributes: z6.record(z6.string(), z6.unknown()).optional()
 });
 var ListCloudVaultsResponseSchema = z6.object({
   vaults: z6.array(CloudVaultSchema)
@@ -10809,6 +11658,7 @@ export {
   applyProviderConfigToEnv,
   archiveCloudAgent,
   archiveMemoryStore,
+  archiveRemoteSession,
   areRuntimeCredentialsReady,
   batchCreateMemories,
   bootstrapRuntimeCredentials,
@@ -10822,6 +11672,8 @@ export {
   createProjectRuntime,
   createSessionForAgent,
   createSkillFromFileId,
+  createVaultCredential,
+  createVaultCredentialWithStateBackend,
   decideDestructive,
   deleteCloudEnvironment,
   deleteCloudVault,
@@ -10831,6 +11683,8 @@ export {
   deleteSession,
   deleteSkill,
   destroyPlannedProjectResources,
+  downloadRemoteFile,
+  downloadRemoteSkill,
   executePlannedProject,
   extractSkillZipFiles,
   getAgent,
@@ -10838,13 +11692,23 @@ export {
   getDeploymentRuntimeProviderForContext,
   getFileDownloadUrl,
   getFileInfo,
+  getManagedAgentProviderCapabilities,
   getMemory,
   getMemoryProviderCapabilities,
   getMemoryStore,
   getMemoryVersion,
+  getRemoteAgent,
+  getRemoteDeployment,
+  getRemoteDeploymentRun,
+  getRemoteEnvironment,
+  getRemoteSkill,
+  getRemoteSkillDownloadInfo,
+  getRemoteSkillVersion,
+  getRemoteVault,
   getSession,
   getSkillInfo,
   importResource,
+  inspectSkillSource,
   isTerminalSessionStatus,
   listAgentsWithReadiness,
   listCloudAgents,
@@ -10857,7 +11721,16 @@ export {
   listMemoryVersions,
   listProviderModelsForContext,
   listProviderNames,
+  listRemoteAgentVersions,
+  listRemoteAgents,
+  listRemoteDeploymentRuns,
+  listRemoteDeployments,
   listRemoteDeploymentsForContext,
+  listRemoteEnvironments,
+  listRemoteFiles,
+  listRemoteSkillVersions,
+  listRemoteSkills,
+  listRemoteVaults,
   listSessionEvents,
   listSessionSummaries,
   listSkills,
@@ -10867,8 +11740,13 @@ export {
   migrateConfig,
   parseStateAddress,
   pauseDeploymentForContext,
+  planAgentResources,
+  planAgentResourcesWithStateBackend,
   planDestroyProjectContext,
   planProjectContext,
+  planProjectWithStateBackend,
+  planVaultCredentialCreate,
+  planVaultCredentialCreateWithStateBackend,
   prepareInitialSessionPrompt,
   preparePromptForProvider,
   prependFileHint,
@@ -10884,9 +11762,12 @@ export {
   resolveSyncProvider,
   rewriteFileMentions,
   runDeploymentForContext,
+  runRemoteDeployment,
+  sendRemoteSessionEvents,
   sendSessionMessagePolling,
   sendSessionMessageStreaming,
   setDefaultFetch,
+  setRemoteDeploymentPaused,
   startSessionRun,
   startSessionRunPolling,
   streamSessionEvents,
@@ -10896,6 +11777,7 @@ export {
   syncProviderResourcesFromEnv,
   updateMemory,
   updateMemoryStore,
+  updateRemoteSession,
   uploadFile,
   validateProjectConfig,
   writeProjectRuntime