@openagentpack/sdk 0.4.0 → 0.6.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   toSessionEvent
-} from "./chunk-GAAU67HX.js";
+} from "./chunk-6PDVAFLK.js";
 import {
   defaultFileUploadPurpose,
   enrichProviderFileInfo
@@ -628,6 +628,13 @@ async function listSessionEventsPaged(client, sessionId, options, toEvent, confi
   const params = new URLSearchParams();
   if (options?.limit) params.set("limit", String(options.limit));
   if (options?.order) params.set("order", options.order);
+  if (config?.forwardTypes !== false) {
+    for (const type of options?.types ?? []) params.append("types", type);
+  }
+  if (options?.created_at_gt) params.set("created_at[gt]", options.created_at_gt);
+  if (options?.created_at_gte) params.set("created_at[gte]", options.created_at_gte);
+  if (options?.created_at_lt) params.set("created_at[lt]", options.created_at_lt);
+  if (options?.created_at_lte) params.set("created_at[lte]", options.created_at_lte);
   const pageCursor = options?.page_token ?? options?.page;
   if (pageCursor) params.set("page", pageCursor);
   if (config?.forwardAfterId && options?.after_id) params.set("after_id", options.after_id);
@@ -794,7 +801,8 @@ function toCloudAgent(raw) {
     workspace_id: raw.workspace_id,
     created_at: raw.created_at,
     updated_at: raw.updated_at,
-    archived_at: raw.archived_at ?? null
+    archived_at: raw.archived_at ?? null,
+    attributes: raw
   };
 }
 function toCloudEnvironment(raw) {
@@ -810,7 +818,8 @@ function toCloudEnvironment(raw) {
     workspace_id: raw.workspace_id,
     created_at: raw.created_at,
     updated_at: raw.updated_at,
-    archived_at: raw.archived_at ?? null
+    archived_at: raw.archived_at ?? null,
+    attributes: raw
   };
 }
 function toCloudVault(raw) {
@@ -821,7 +830,8 @@ function toCloudVault(raw) {
     type: raw.type,
     created_at: raw.created_at ?? null,
     updated_at: raw.updated_at ?? null,
-    archived_at: raw.archived_at ?? null
+    archived_at: raw.archived_at ?? null,
+    attributes: raw
   };
 }
 function toRestFileInfo(res) {
@@ -833,7 +843,9 @@ function toRestFileInfo(res) {
     created_at: res.created_at,
     downloadable: res.downloadable,
     status: res.status,
-    purpose: res.purpose
+    purpose: res.purpose,
+    scope: res.scope,
+    attributes: res
   };
 }
 function toRestSkillInfo(res) {
@@ -846,7 +858,8 @@ function toRestSkillInfo(res) {
     status: "active",
     latest_version: res.latest_version,
     created_at: res.created_at,
-    updated_at: res.updated_at
+    updated_at: res.updated_at,
+    attributes: res
   };
 }
 
@@ -1238,7 +1251,7 @@ function mapAgent(name, decl, refs, version, projectName) {
     }
   }
   const body = {
-    name,
+    name: decl.name ?? name,
     model: modelValue,
     system: decl.instructions
   };
@@ -1297,7 +1310,7 @@ function mapAgent(name, decl, refs, version, projectName) {
 }
 function mapDeployment(name, decl, refs, projectName, uploadedFiles) {
   const body = {
-    name,
+    name: decl.name ?? name,
     agent: refs.agent_version !== void 0 ? { id: refs.agent_id, type: "agent", version: refs.agent_version } : refs.agent_id,
     environment_id: refs.environment_id,
     initial_events: mapInitialEvents(decl.initial_events)
@@ -2183,6 +2196,7 @@ function agentToDecl2(raw) {
     }));
   }
   return compactDeep({
+    name: raw.name,
     description: raw.description,
     model: raw.model,
     instructions: raw.system,
@@ -2201,7 +2215,7 @@ function mapMemoryStore2(name, decl) {
 }
 function mapDeployment2(name, decl, refs, projectName, uploadedFiles) {
   const body = {
-    name,
+    name: decl.name ?? name,
     agent: refs.agent_version !== void 0 ? { id: refs.agent_id, type: "agent", version: refs.agent_version } : refs.agent_id,
     environment_id: refs.environment_id,
     initial_events: mapDeploymentInitialEvents(decl.initial_events)
@@ -2307,7 +2321,7 @@ function mapAgent2(name, decl, refs, version, projectName) {
     model = typeof qoderModel === "string" ? qoderModel : qoderModel.id;
   }
   const body = {
-    name,
+    name: decl.name ?? name,
     model,
     system: decl.instructions
   };
@@ -2811,6 +2825,7 @@ var QoderAdapter = class _QoderAdapter {
       return compactDeep(normalized);
     }
     return compactDeep({
+      name: raw.name,
       description: raw.description,
       model: normalizeModel(raw.model),
       instructions: raw.system,
@@ -2831,7 +2846,7 @@ var QoderAdapter = class _QoderAdapter {
     const currentMetadata = current.metadata ?? {};
     const metadata = { ...body.metadata ?? {} };
     for (const key of Object.keys(currentMetadata)) {
-      if (!key.startsWith("agents.") && !(key in metadata)) metadata[key] = null;
+      if (key !== "created_by" && !key.startsWith("agents.") && !(key in metadata)) metadata[key] = null;
     }
     body.metadata = metadata;
     const res = await client.post(`/environments/${id}`, body);
@@ -2839,8 +2854,20 @@ var QoderAdapter = class _QoderAdapter {
   }
   async deleteEnvironment(id, cascade = false, mode = "managed") {
     if (mode === "forward") {
-      await this.forwardClient.delete(`/environments/${id}`);
-      return;
+      try {
+        await this.forwardClient.delete(`/environments/${id}`);
+        return;
+      } catch (err) {
+        const isConflict = err instanceof ApiError && (err.statusCode === 409 || err.responseBody.includes("in use"));
+        if (!isConflict) throw err;
+        if (!cascade) {
+          throw new UserError(
+            `Environment ${id} is referenced by one or more Forward sessions. Use --cascade to archive the environment.`
+          );
+        }
+        await this.forwardClient.post(`/environments/${id}/archive`, {});
+        return;
+      }
     }
     try {
       await this.client.delete(`/environments/${id}`);
@@ -3630,25 +3657,26 @@ function mapVault2(name, decl, projectName) {
   return body;
 }
 function mapCredential2(cred) {
-  if (cred.type === "environment_variable") {
-    return {
-      auth: {
-        type: "environment_variable",
-        secret_name: cred.secret_name,
-        secret_value: cred.secret_value,
-        networking: cred.networking ?? { type: "unrestricted" }
-      },
-      display_name: cred.name
-    };
+  if (cred.type !== "environment_variable") {
+    throw new UserError(
+      `credential '${cred.name}': Bailian only supports credential type 'environment_variable', but '${cred.type}' was declared.`
+    );
   }
-  return {
+  if (cred.networking?.type === "limited" && cred.networking.allowed_hosts === void 0) {
+    throw new UserError(`credential '${cred.name}': Bailian limited networking requires networking.allowed_hosts.`);
+  }
+  const body = {
     auth: {
-      type: cred.type,
-      token: cred.access_token,
-      mcp_server_url: cred.mcp_server_url
+      type: "environment_variable",
+      secret_name: cred.secret_name,
+      secret_value: cred.secret_value,
+      networking: { allowed_hosts: cred.networking?.allowed_hosts ?? ["*"] },
+      injection_location: cred.injection_location ?? { header: true, body: false }
     },
     display_name: cred.name
   };
+  if (cred.metadata) body.metadata = cred.metadata;
+  return body;
 }
 function credToDecl3(raw, vaultName) {
   const auth = raw.auth ?? {};
@@ -3658,17 +3686,21 @@ function credToDecl3(raw, vaultName) {
     return {
       name,
       type: "static_bearer",
+      metadata: stripAgentsMetadata(raw.metadata),
       mcp_server_url: auth.mcp_server_url ?? "",
       access_token: placeholder
     };
   }
   const networking = auth.networking;
+  const injectionLocation = auth.injection_location;
   return {
     name,
     type: "environment_variable",
+    metadata: stripAgentsMetadata(raw.metadata),
     secret_name: auth.secret_name ?? name,
     secret_value: placeholder,
-    networking: networking ?? { type: "unrestricted" }
+    networking: networking ?? { type: "unrestricted" },
+    ...injectionLocation ? { injection_location: injectionLocation } : {}
   };
 }
 function vaultToDecl3(raw, rawCredentials, resourceName) {
@@ -3733,6 +3765,7 @@ function agentToDecl3(raw) {
   const model = raw.model;
   const modelValue = typeof model === "object" && model ? model.id : model;
   return compactDeep({
+    name: raw.name,
     description: raw.description,
     model: modelValue,
     instructions: raw.system,
@@ -3752,7 +3785,7 @@ function mapAgent3(name, decl, refs, version, projectName, skillVersions) {
     modelId = typeof bailianModel === "string" ? bailianModel : bailianModel.id;
   }
   const body = {
-    name,
+    name: decl.name ?? name,
     model: { id: modelId },
     system: decl.instructions
   };
@@ -3845,7 +3878,7 @@ function mapDeployment3(name, decl, refs, projectName, uploadedFiles) {
   const agent = { id: refs.agent_id };
   if (refs.agent_version !== void 0) agent.version = refs.agent_version;
   const body = {
-    name,
+    name: decl.name ?? name,
     agent,
     environment_id: refs.environment_id,
     initial_events: mapMessageEvents(decl.initial_events)
@@ -3983,6 +4016,7 @@ var BailianAdapter = class _BailianAdapter {
       });
     }
     return compactDeep({
+      name: raw.name,
       description: raw.description,
       model: normalizeBailianModel(raw.model),
       instructions: raw.system,
@@ -4014,6 +4048,18 @@ var BailianAdapter = class _BailianAdapter {
   async deleteEnvironment(id) {
     await this.client.delete(`/environments/${id}`);
   }
+  async listEnvironmentResources(options) {
+    const params = cursorParams(options);
+    if (options?.include_archived !== void 0) {
+      params.set("include_archived", String(options.include_archived));
+    }
+    const res = await this.client.get(withQuery("/environments", params));
+    return cursorPage(res, toCloudEnvironment);
+  }
+  async getRemoteEnvironment(id) {
+    const res = await this.client.get(`/environments/${id}`);
+    return toCloudEnvironment(res);
+  }
   // --- Agent ---
   async createAgent(name, decl, refs) {
     const skillVersions = await this.fetchSkillVersions(refs);
@@ -4062,6 +4108,25 @@ var BailianAdapter = class _BailianAdapter {
   async deleteAgent(id) {
     await this.client.post(`/agents/${id}/archive`, {});
   }
+  async listAgentResources(options) {
+    const params = cursorParams(options);
+    if (options?.include_archived !== void 0) {
+      params.set("include_archived", String(options.include_archived));
+    }
+    const res = await this.client.get(withQuery("/agents", params));
+    return cursorPage(res, toCloudAgent);
+  }
+  async getRemoteAgent(id, version) {
+    const params = new URLSearchParams();
+    if (version !== void 0) params.set("version", String(version));
+    const res = await this.client.get(withQuery(`/agents/${id}`, params));
+    return toCloudAgent(res);
+  }
+  async listAgentVersions(id, options) {
+    const params = cursorParams(options);
+    const res = await this.client.get(withQuery(`/agents/${id}/versions`, params));
+    return cursorPage(res, toCloudAgent);
+  }
   // --- Skill (2-step: Files API → Skills API) ---
   async createSkill(name, decl, files) {
     const fileId = await this.uploadSkillZip(name, decl, files);
@@ -4160,10 +4225,31 @@ var BailianAdapter = class _BailianAdapter {
     const all = await this.client.getAllPaged(path);
     return all.map(toBailianSkillInfo);
   }
+  async listSkillResources(options) {
+    const params = cursorParams(options);
+    if (options?.source === "official") params.set("source", "official");
+    if (options?.source === "custom") params.set("source", "customer");
+    const res = await this.client.get(withQuery("/skills", params));
+    return cursorPage(res, toBailianSkillInfo);
+  }
   async getSkillInfo(id) {
     const res = await this.client.get(`/skills/${id}`);
     return toBailianSkillInfo(res);
   }
+  async listSkillVersions(id, options) {
+    const params = cursorParams(options);
+    const res = await this.client.get(withQuery(`/skills/${id}/versions`, params));
+    return cursorPage(res, toSkillVersionInfo);
+  }
+  async getSkillVersion(id, version) {
+    const res = await this.client.get(`/skills/${id}/versions/${encodeURIComponent(version)}`);
+    return toSkillVersionInfo(res);
+  }
+  async getSkillDownloadInfo(id, version) {
+    return await this.client.get(
+      `/skills/${id}/versions/${encodeURIComponent(version)}/content`
+    );
+  }
   // Non-blocking create: file already uploaded → POST /skills with retry for residual OSS
   // replication lag (postSkillWithRetry covers SKILL_FILE_NOT_FOUND for a few seconds), and return
   // the initial status WITHOUT waiting for the security scan. Callers MUST ensure the file has
@@ -4223,6 +4309,7 @@ var BailianAdapter = class _BailianAdapter {
   // thin wrappers over the AgentStudio endpoints, exposed so callers/tests can
   // exercise the full surface through real project code rather than raw fetch.
   async createVault(name, decl) {
+    for (const credential of decl.credentials ?? []) mapCredential2(credential);
     const body = mapVault2(name, decl, this.projectName);
     const res = await this.client.post("/vaults", body);
     const vaultId = res.id;
@@ -4235,6 +4322,18 @@ var BailianAdapter = class _BailianAdapter {
     const all = await this.client.getAllPaged("/vaults");
     return all.map(toCloudVault);
   }
+  async listVaultResources(options) {
+    const params = cursorParams(options);
+    if (options?.include_archived !== void 0) {
+      params.set("include_archived", String(options.include_archived));
+    }
+    const res = await this.client.get(withQuery("/vaults", params));
+    return cursorPage(res, toCloudVault);
+  }
+  async getRemoteVault(id) {
+    const res = await this.client.get(`/vaults/${id}`);
+    return toCloudVault(res);
+  }
   async getVault(id) {
     return await this.client.get(`/vaults/${id}`);
   }
@@ -4256,7 +4355,24 @@ var BailianAdapter = class _BailianAdapter {
   }
   async listCredentials(vaultId) {
     const all = await this.client.getAllPaged(`/vaults/${vaultId}/credentials`);
-    return all.map(toRemoteResource);
+    return all.map((raw) => {
+      const auth = raw.auth ?? {};
+      const networking = auth.networking;
+      const metadata = raw.metadata;
+      return {
+        id: raw.id,
+        display_name: raw.display_name ?? raw.id,
+        auth_type: auth.type ?? "",
+        secret_name: auth.secret_name,
+        mcp_server_url: auth.mcp_server_url,
+        networking_type: networking?.type,
+        networking,
+        injection_location: auth.injection_location,
+        metadata: metadata ? Object.fromEntries(
+          Object.entries(metadata).filter((entry) => typeof entry[1] === "string")
+        ) : void 0
+      };
+    });
   }
   async getCredential(vaultId, credentialId) {
     return await this.client.get(`/vaults/${vaultId}/credentials/${credentialId}`);
@@ -4306,11 +4422,7 @@ var BailianAdapter = class _BailianAdapter {
       throw new UserError(`Deployment '${ctx.name}' has no remote id; run \`agents apply\` first.`);
     }
     const res = await this.client.post(`/deployments/${ctx.id}/run`, {});
-    return {
-      run_id: res.id,
-      session_id: res.session_id ?? null,
-      error: res.error ?? void 0
-    };
+    return toDeploymentRunResult(res);
   }
   async getDeployment(ctx) {
     if (!ctx.id) {
@@ -4322,6 +4434,7 @@ var BailianAdapter = class _BailianAdapter {
   async listDeployments(filter) {
     const params = new URLSearchParams();
     if (filter?.agent_id) params.set("agent_id", filter.agent_id);
+    if (filter?.keyword) params.set("keyword", filter.keyword);
     if (filter?.status) params.set("status", filter.status);
     if (filter?.include_archived) params.set("include_archived", "true");
     if (filter?.limit) params.set("limit", String(filter.limit));
@@ -4337,6 +4450,32 @@ var BailianAdapter = class _BailianAdapter {
       next_page: nextPage
     };
   }
+  async getDeploymentById(id) {
+    const res = await this.client.get(`/deployments/${id}`);
+    return toDeploymentInfo3(res);
+  }
+  async runDeploymentById(id) {
+    const res = await this.client.post(`/deployments/${id}/run`, {});
+    return toDeploymentRunResult(res);
+  }
+  async pauseDeploymentById(id) {
+    const res = await this.client.post(`/deployments/${id}/pause`, {});
+    return toDeploymentInfo3(res);
+  }
+  async unpauseDeploymentById(id) {
+    const res = await this.client.post(`/deployments/${id}/unpause`, {});
+    return toDeploymentInfo3(res);
+  }
+  async listDeploymentRuns(deploymentId, options) {
+    const res = await this.client.get(
+      withQuery(`/deployments/${deploymentId}/runs`, cursorParams(options))
+    );
+    return cursorPage(res, toDeploymentRunInfo);
+  }
+  async getDeploymentRun(runId) {
+    const res = await this.client.get(`/deployment_runs/${runId}`);
+    return toDeploymentRunInfo(res);
+  }
   async pauseDeployment(ctx) {
     return this.setDeploymentPaused(ctx, true);
   }
@@ -4391,6 +4530,9 @@ var BailianAdapter = class _BailianAdapter {
   async listSessions(filter) {
     const params = new URLSearchParams();
     if (filter?.agent_id) params.set("agent_id", filter.agent_id);
+    for (const status of filter?.statuses ?? []) params.append("statuses[]", status);
+    if (filter?.created_at_gte) params.set("created_at[gte]", filter.created_at_gte);
+    if (filter?.created_at_lte) params.set("created_at[lte]", filter.created_at_lte);
     if (filter?.limit) params.set("limit", String(filter.limit));
     if (filter?.page) params.set("page", filter.page);
     const qs = params.toString();
@@ -4407,6 +4549,15 @@ var BailianAdapter = class _BailianAdapter {
     const res = await this.client.get(`/sessions/${id}`);
     return toSessionInfo3(res);
   }
+  async updateSession(id, input) {
+    const res = await this.client.post(`/sessions/${id}`, input);
+    if (!res.agent || !res.environment_id) return this.getSession(id);
+    return toSessionInfo3(res);
+  }
+  async archiveSession(id) {
+    const res = await this.client.post(`/sessions/${id}/archive`, {});
+    return toSessionInfo3(res);
+  }
   async deleteSession(id) {
     await this.client.delete(`/sessions/${id}`);
   }
@@ -4415,13 +4566,20 @@ var BailianAdapter = class _BailianAdapter {
     const res = await this.client.post(`/sessions/${sessionId}/events`, body);
     return extractCreatedEventId(res);
   }
+  async sendSessionEvents(sessionId, events) {
+    const res = await this.client.post(`/sessions/${sessionId}/events`, { input: events });
+    return {
+      event_ids: extractCreatedEventIds(res),
+      attributes: res
+    };
+  }
   async *streamSessionEvents(sessionId, _options) {
     for await (const raw of this.client.sse(`/sessions/${sessionId}/events/stream`)) {
       yield toSessionEvent(raw);
     }
   }
   async listSessionEvents(sessionId, options) {
-    return listSessionEventsPaged(this.client, sessionId, options, toSessionEvent);
+    return listSessionEventsPaged(this.client, sessionId, options, toSessionEvent, { forwardTypes: false });
   }
   // --- Files ---
   async uploadFile(filePath, options) {
@@ -4447,6 +4605,15 @@ var BailianAdapter = class _BailianAdapter {
     const all = await this.client.getAllPaged("/files");
     return all.map(toRestFileInfo);
   }
+  async listFileResources(options) {
+    const params = cursorParams(options);
+    if (options?.scope_id) params.set("scope_id", options.scope_id);
+    const res = await this.client.get(withQuery("/files", params));
+    return cursorPage(res, toRestFileInfo);
+  }
+  async downloadFileContent(id) {
+    return new Uint8Array(await this.client.getBuffer(`/files/${id}/content`));
+  }
   async deleteFile(id) {
     await this.client.delete(`/files/${id}`);
   }
@@ -4481,9 +4648,77 @@ function toBailianSkillInfo(res) {
     status: skillStatusFromString(res.status),
     latest_version: res.latest_version,
     created_at: res.created_at,
-    updated_at: res.updated_at
+    updated_at: res.updated_at,
+    attributes: res
+  };
+}
+function cursorParams(options) {
+  const params = new URLSearchParams();
+  if (options?.limit !== void 0) params.set("limit", String(options.limit));
+  if (options?.page) params.set("page", options.page);
+  return params;
+}
+function withQuery(path, params) {
+  const query2 = params.toString();
+  return query2 ? `${path}?${query2}` : path;
+}
+function cursorPage(res, mapper) {
+  const nextPage = res.next_page ?? void 0;
+  return {
+    data: (res.data ?? []).map(mapper),
+    has_more: res.has_more ?? nextPage !== void 0,
+    next_page: nextPage
+  };
+}
+function toSkillVersionInfo(res) {
+  return {
+    id: res.id,
+    skill_id: res.skill_id ?? "",
+    type: res.type ?? "skill_version",
+    name: res.name,
+    description: res.description,
+    version: res.version ?? "",
+    status: res.status,
+    created_at: res.created_at,
+    updated_at: res.updated_at,
+    additional_properties: res.additional_properties,
+    attributes: res
+  };
+}
+function toDeploymentRunResult(res) {
+  return {
+    run_id: res.id,
+    session_id: res.session_id ?? null,
+    error: res.error ?? void 0
+  };
+}
+function toDeploymentRunInfo(res) {
+  return {
+    id: res.id ?? "",
+    deployment_id: res.deployment_id,
+    session_id: res.session_id ?? void 0,
+    status: res.status,
+    error: res.error ?? void 0,
+    created_at: res.created_at,
+    updated_at: res.updated_at,
+    attributes: res
   };
 }
+function extractCreatedEventIds(res) {
+  const ids = /* @__PURE__ */ new Set();
+  const topLevel = extractCreatedEventId(res);
+  if (topLevel) ids.add(topLevel);
+  for (const key of ["data", "events"]) {
+    const items = res[key];
+    if (!Array.isArray(items)) continue;
+    for (const item of items) {
+      if (!item || typeof item !== "object") continue;
+      const id = item.id;
+      if (typeof id === "string") ids.add(id);
+    }
+  }
+  return Array.from(ids);
+}
 function normalizeBailianModel(value) {
   if (value && typeof value === "object" && "id" in value) {
     return value.id;
@@ -4548,7 +4783,7 @@ function guessMimeType(fileName) {
 // src/internal/providers/bailian/capabilities.ts
 var BAILIAN_CAPABILITIES = {
   environment: { tier: "native", reason: "environments API" },
-  vault: { tier: "native", reason: "vaults + credentials API (static_bearer MCP credentials)" },
+  vault: { tier: "native", reason: "vaults + environment_variable credentials API" },
   skill: { tier: "native", reason: "skills API with 2-step zip upload via Files API" },
   agent: { tier: "native", reason: "agents API with versioned updates" },
   template: { tier: "unsupported", reason: "no Forward Template equivalent on Bailian" },
@@ -4809,7 +5044,7 @@ function mapAgent4(name, decl, refs, version, projectName) {
   if (!arkModel) throw new UserError(`No Ark model specified for agent '${name}'`);
   const modelValue = typeof arkModel === "string" ? { id: arkModel } : { id: arkModel.id };
   const body = {
-    name,
+    name: decl.name ?? name,
     model: modelValue,
     system: decl.instructions
   };
@@ -5499,6 +5734,30 @@ async function resolveFileReferences(config, configPath) {
 // src/internal/parser/resolve-project-config.ts
 import { basename as basename5, dirname as dirname7, resolve as resolve7 } from "path";
 
+// src/internal/utils/env.ts
+var ENV_VAR_PATTERN = /\$\{([^}]+)\}/g;
+function interpolateEnvVars(value, resolve13 = false, environment = process.env) {
+  return value.replace(ENV_VAR_PATTERN, (match, varName) => {
+    if (!resolve13) return match;
+    const resolvedValue = environment[varName];
+    if (resolvedValue === void 0) {
+      throw new UserError(`Environment variable '${varName}' is not set`);
+    }
+    return resolvedValue;
+  });
+}
+function interpolateObjectEnv(value, environment = process.env) {
+  if (typeof value === "string") return interpolateEnvVars(value, true, environment);
+  if (Array.isArray(value)) return value.map((entry) => interpolateObjectEnv(entry, environment));
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      interpolateObjectEnv(entry, environment)
+    ])
+  );
+}
+
 // src/internal/parser/schema.ts
 import { z as z5 } from "zod";
 var networkingSchema = z5.object({
@@ -5543,6 +5802,7 @@ var coerceString = z5.union([z5.string(), z5.number()]).transform(String);
 var staticBearerCredentialSchema = z5.object({
   name: z5.string(),
   type: z5.literal("static_bearer"),
+  metadata: z5.record(z5.string(), z5.string()).optional(),
   mcp_server_url: z5.string(),
   access_token: coerceString,
   protocol: z5.enum(["sse", "streamable_http"]).optional()
@@ -5550,9 +5810,17 @@ var staticBearerCredentialSchema = z5.object({
 var environmentVariableCredentialSchema = z5.object({
   name: z5.string(),
   type: z5.literal("environment_variable"),
+  metadata: z5.record(z5.string(), z5.string()).optional(),
   secret_name: z5.string(),
   secret_value: coerceString,
-  networking: z5.object({ type: z5.enum(["unrestricted", "limited"]) }).optional()
+  networking: z5.object({
+    type: z5.enum(["unrestricted", "limited"]).optional(),
+    allowed_hosts: z5.array(z5.string()).optional()
+  }).optional(),
+  injection_location: z5.object({
+    header: z5.boolean().optional(),
+    body: z5.boolean().optional()
+  }).optional()
 });
 var credentialSchema = z5.discriminatedUnion("type", [
   staticBearerCredentialSchema,
@@ -5692,6 +5960,10 @@ var agentSkillRefSchema = z5.object({
 var agentDeliverySchema = z5.object({
   type: z5.enum(["managed", "forward"])
 });
+var agentFileMountSchema = z5.object({
+  file: z5.string().min(1),
+  mount_path: z5.string().min(1)
+});
 var managedToolConfigSchema = z5.object({
   enabled_tools: z5.array(z5.string().min(1))
 });
@@ -5716,8 +5988,8 @@ var agentSchema = z5.object({
   mcp_servers: z5.array(mcpServerSchema).optional(),
   skills: z5.array(z5.union([z5.string(), agentSkillRefSchema])).optional(),
   vault: z5.string().optional(),
-  files: z5.array(z5.string()).optional(),
   memory_stores: z5.array(z5.string()).optional(),
+  files: z5.array(z5.union([z5.string().min(1), agentFileMountSchema])).optional(),
   default_memory_store: z5.object({
     name: z5.string().trim().min(1).max(255),
     description: z5.string().max(1024).optional(),
@@ -5783,6 +6055,7 @@ var scheduleSchema = z5.object({
   timezone: z5.string()
 });
 var deploymentSchema = z5.object({
+  name: z5.string().optional(),
   agent: z5.string(),
   agent_version: z5.number().int().optional(),
   environment: z5.string().optional(),
@@ -5819,22 +6092,7 @@ var projectConfigSchema = z5.object({
 // src/internal/parser/yaml-loader.ts
 import { readFile as readFile3 } from "fs/promises";
 import { parse as parseYaml } from "yaml";
-
-// src/internal/utils/env.ts
-var ENV_VAR_PATTERN = /\$\{([^}]+)\}/g;
-function interpolateEnvVars(value, resolve13 = false) {
-  return value.replace(ENV_VAR_PATTERN, (match, varName) => {
-    if (!resolve13) return match;
-    const val = process.env[varName];
-    if (val === void 0) {
-      throw new UserError(`Environment variable '${varName}' is not set`);
-    }
-    return val;
-  });
-}
-
-// src/internal/parser/yaml-loader.ts
-async function loadConfig(filePath, resolveEnv = false) {
+async function loadConfig(filePath, resolveEnv = false, environment) {
   let raw;
   try {
     raw = await readFile3(filePath, "utf8");
@@ -5845,7 +6103,7 @@ async function loadConfig(filePath, resolveEnv = false) {
     const msg = err instanceof Error ? err.message : String(err);
     return { config: null, errors: [`Failed to read file: ${msg}`] };
   }
-  if (resolveEnv) {
+  if (resolveEnv && !environment) {
     raw = interpolateEnvVars(raw, true);
   }
   let parsed;
@@ -5855,6 +6113,7 @@ async function loadConfig(filePath, resolveEnv = false) {
     const msg = e instanceof Error ? e.message : String(e);
     return { config: null, errors: [`YAML parse error: ${msg}`] };
   }
+  if (resolveEnv && environment) parsed = interpolateObjectEnv(parsed, environment);
   const result = projectConfigSchema.safeParse(parsed);
   if (!result.success) {
     const errors = result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`);
@@ -5867,27 +6126,73 @@ async function loadConfig(filePath, resolveEnv = false) {
 async function resolveProjectConfig(filePath, options = {}) {
   const configPath = resolve7(filePath);
   const projectName = options.projectName ?? basename5(dirname7(configPath));
-  const { config: parsed, errors } = await loadConfig(configPath, options.resolveEnv ?? true);
+  const { config: parsed, errors } = await loadConfig(
+    configPath,
+    options.resolveEnv ?? true,
+    options.environment ? { ...options.environment, ...process.env } : void 0
+  );
   if (errors.length > 0) {
     throw new UserError(errors.join("\n"));
   }
-  const config = await resolveFileReferences(parsed, configPath);
-  return { configPath, projectName, config };
+  const sourcePaths = collectProjectSourcePaths(parsed, configPath, true);
+  let config;
+  try {
+    config = await resolveFileReferences(parsed, configPath);
+  } catch (error) {
+    if (error && typeof error === "object") {
+      Object.assign(error, { sourcePaths });
+    }
+    throw error;
+  }
+  return { configPath, projectName, config, sourcePaths };
 }
 async function resolveProjectConfigFromObject(rawConfig, options) {
   const basePath = resolve7(options.basePath ?? process.cwd());
-  const result = projectConfigSchema.safeParse(rawConfig);
+  const input = options.resolveEnv ? interpolateObjectEnv(rawConfig, { ...options.environment, ...process.env }) : rawConfig;
+  const result = projectConfigSchema.safeParse(input);
   if (!result.success) {
     const errors = result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`);
     throw new UserError(errors.join("\n"));
   }
   const anchor = resolve7(basePath, "__in_memory_config__");
-  const config = await resolveFileReferences(result.data, anchor);
-  return { configPath: basePath, projectName: options.projectName, config };
+  const parsed = result.data;
+  const sourcePaths = collectProjectSourcePaths(parsed, anchor, false);
+  const config = await resolveFileReferences(parsed, anchor);
+  return { configPath: basePath, projectName: options.projectName, config, sourcePaths };
+}
+function collectProjectSourcePaths(config, configPath, includeConfigPath) {
+  const baseDirectory = dirname7(configPath);
+  const paths = /* @__PURE__ */ new Set();
+  if (includeConfigPath) paths.add(configPath);
+  const addLocalPath = (value, requirePathSyntax = false) => {
+    if (!value || /^https?:\/\//i.test(value)) return;
+    if (requirePathSyntax && !isLocalPathReference(value)) return;
+    paths.add(resolve7(baseDirectory, value));
+  };
+  for (const agent of Object.values(config.agents ?? {})) {
+    addLocalPath(agent.instructions, true);
+  }
+  for (const store of Object.values(config.memory_stores ?? {})) {
+    for (const entry of store.entries ?? []) addLocalPath(entry.content, true);
+  }
+  for (const skill of Object.values(config.skills ?? {})) addLocalPath(skill.source);
+  for (const file of Object.values(config.files ?? {})) addLocalPath(file.source);
+  for (const deployment of Object.values(config.deployments ?? {})) {
+    for (const resource of deployment.resources ?? []) {
+      if (resource.type === "file") addLocalPath(resource.source);
+    }
+    for (const event of deployment.initial_events ?? []) {
+      if (event.type === "user.define_outcome") addLocalPath(event.rubric_file, true);
+    }
+  }
+  return [...paths].sort();
+}
+function isLocalPathReference(value) {
+  return value.startsWith("./") || value.startsWith("../") || value.startsWith("/");
 }
 
 // src/internal/executor/executor.ts
-import { dirname as dirname10, resolve as resolve11 } from "path";
+import { basename as basename7, dirname as dirname10, resolve as resolve11 } from "path";
 
 // src/internal/utils/hash.ts
 import { createHash } from "crypto";
@@ -6001,8 +6306,9 @@ async function computeResourceHash(address, config, basePath, state) {
   }
   if (address.type === "template") {
     const refs = resolveTemplateReferenceIds(decl, config, address.provider, state);
-    return contentHash({ decl, refs });
+    return contentHash({ decl: withoutLocalSessionFileMounts(decl), refs });
   }
+  if (address.type === "agent") return contentHash(withoutLocalSessionFileMounts(decl));
   if (address.type === "channel") {
     const refs = resolveChannelReferenceIds(
       decl,
@@ -6014,6 +6320,12 @@ async function computeResourceHash(address, config, basePath, state) {
   }
   return contentHash(decl);
 }
+function withoutLocalSessionFileMounts(decl) {
+  if (!decl || typeof decl !== "object" || Array.isArray(decl)) return decl;
+  const { files, ...remoteDeclaration } = decl;
+  const templateFiles = Array.isArray(files) ? files.filter((file) => typeof file === "string") : [];
+  return templateFiles.length ? { ...remoteDeclaration, files: templateFiles } : remoteDeclaration;
+}
 function resolveQoderApiMode(type, name, provider, config) {
   if (provider !== "qoder") return void 0;
   if (type === "environment" && config.environments?.[name]?.environment_id) return "auto";
@@ -6021,7 +6333,7 @@ function resolveQoderApiMode(type, name, provider, config) {
     if (agent.provider && agent.provider !== provider) continue;
     const referenced = type === "environment" ? agent.environment === name : type === "skill" ? agent.skills?.some(
       (skill) => typeof skill === "string" ? skill === name : skill.type === "custom" && skill.skill_id === name
-    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.includes(name);
+    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.some((file) => (typeof file === "string" ? file : file.file) === name);
     if (referenced && agent.delivery?.qoder?.type === "forward") return "forward";
   }
   return "managed";
@@ -6062,9 +6374,7 @@ function resolveTemplateReferenceIds(decl, config, provider, state) {
     memory_store_ids: (decl.memory_stores ?? []).map(
       (memoryStore) => state?.getResource({ type: "memory_store", name: memoryStore, provider })?.remote_id ?? memoryStore
     ),
-    file_ids: (decl.files ?? []).map(
-      (file) => state?.getResource({ type: "file", name: file, provider })?.remote_id ?? file
-    ),
+    file_ids: (decl.files ?? []).filter((file) => typeof file === "string").map((file) => state?.getResource({ type: "file", name: file, provider })?.remote_id ?? file),
     identity_id: decl.memory_stores?.length && config.defaults?.identity ? state?.getResource({ type: "identity", name: config.defaults.identity, provider })?.remote_id : void 0
   };
 }
@@ -6254,7 +6564,7 @@ function resolveTemplateRefs(agentName, config, provider, state) {
     environment_id: environment.environment_id ?? requireRef(state, { type: "environment", name: agent.environment, provider }),
     ...agent.tunnel ? { tunnel_id: resolveTunnelIdFromConfig(config, agent.tunnel, provider) } : {},
     vault_ids: agent.vault ? [requireRef(state, { type: "vault", name: agent.vault, provider })] : [],
-    file_ids: (agent.files ?? []).map((file) => requireRef(state, { type: "file", name: file, provider })),
+    file_ids: (agent.files ?? []).filter((file) => typeof file === "string").map((file) => requireRef(state, { type: "file", name: file, provider })),
     memory_store_ids: memoryStoreIds,
     owned_memory_store_ids: state.listResources().filter(
       (resource) => resource.address.provider === provider && resource.address.type === "memory_store" && resource.api_mode === "forward" && typeof resource.remote_id === "string"
@@ -6350,8 +6660,61 @@ function resolveTunnelIdFromConfig(config, tunnelName, provider) {
 }
 
 // src/internal/executor/skill-resolver.ts
+import { dirname as dirname9 } from "path";
+
+// src/internal/core/skill-source.ts
 import { readFileSync as readFileSync7, statSync as statSync3 } from "fs";
-import { dirname as dirname9, resolve as resolve10 } from "path";
+import { basename as basename6, resolve as resolve10 } from "path";
+import { parse } from "yaml";
+async function inspectSkillSource(source, options = {}) {
+  if (/^https?:\/\//i.test(source)) {
+    throw new UserError("Skill source inspection only accepts a local directory, zip, or SKILL.md file.");
+  }
+  const sourcePath = resolve10(options.basePath ?? process.cwd(), source);
+  const sourceStat = statSync3(sourcePath, { throwIfNoEntry: false });
+  if (!sourceStat) throw new UserError(`Skill source not found: ${source}`);
+  let files;
+  if (sourceStat.isDirectory()) {
+    files = collectFiles(sourcePath, "");
+  } else if (sourceStat.isFile() && sourcePath.toLowerCase().endsWith(".zip")) {
+    files = await extractSkillZipFiles(readFileSync7(sourcePath));
+  } else if (sourceStat.isFile() && basename6(sourcePath).toLowerCase() === "skill.md") {
+    files = [{ relativePath: "SKILL.md", content: readFileSync7(sourcePath) }];
+  } else {
+    throw new UserError("Skill source must be a directory, .zip archive, or SKILL.md file.");
+  }
+  const normalizedFiles = normalizeSkillRoot(files);
+  const manifest = normalizedFiles.find((file) => file.relativePath === "SKILL.md");
+  const name = parseSkillManifestName(manifest.content);
+  return { name, sourcePath, files: normalizedFiles };
+}
+function normalizeSkillRoot(files) {
+  if (files.some((file) => file.relativePath === "SKILL.md")) return files;
+  const manifests = files.filter((file) => file.relativePath.endsWith("/SKILL.md"));
+  if (manifests.length === 0) throw new UserError("Skill source does not contain SKILL.md.");
+  if (manifests.length > 1) {
+    throw new UserError("Skill source contains multiple SKILL.md files and has no unambiguous root.");
+  }
+  const prefix = manifests[0].relativePath.slice(0, -"SKILL.md".length);
+  return files.filter((file) => file.relativePath.startsWith(prefix)).map((file) => ({ ...file, relativePath: file.relativePath.slice(prefix.length) }));
+}
+function parseSkillManifestName(content) {
+  const text = content.toString("utf8");
+  const frontmatter = text.match(/^---\s*\r?\n([\s\S]*?)\r?\n---(?:\s*\r?\n|$)/);
+  if (!frontmatter) throw new UserError("SKILL.md must start with YAML frontmatter containing a name.");
+  let manifest;
+  try {
+    manifest = parse(frontmatter[1]);
+  } catch (error) {
+    throw new UserError(`Invalid SKILL.md frontmatter: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const rawName = manifest && typeof manifest === "object" ? manifest.name : void 0;
+  const name = typeof rawName === "string" ? rawName.trim() : "";
+  if (!name) throw new UserError("SKILL.md frontmatter must contain a non-empty name.");
+  return name;
+}
+
+// src/internal/executor/skill-resolver.ts
 async function resolveSkillFiles(decl, ctx) {
   if (/^https?:\/\//i.test(decl.source)) {
     const res = await resolveFetch()(decl.source);
@@ -6359,19 +6722,7 @@ async function resolveSkillFiles(decl, ctx) {
     return extractSkillZipFiles(Buffer.from(await res.arrayBuffer()));
   }
   if (!ctx.configPath) return [];
-  const sourcePath = resolve10(dirname9(ctx.configPath), decl.source);
-  const stat = statSync3(sourcePath, { throwIfNoEntry: false });
-  if (stat?.isDirectory()) {
-    return collectFiles(sourcePath, "");
-  }
-  if (stat?.isFile()) {
-    if (sourcePath.endsWith(".zip")) {
-      return extractSkillZipFiles(readFileSync7(sourcePath));
-    }
-    const content = readFileSync7(sourcePath);
-    return [{ relativePath: "SKILL.md", content }];
-  }
-  return [];
+  return (await inspectSkillSource(decl.source, { basePath: dirname9(ctx.configPath) })).files;
 }
 
 // src/internal/executor/executor.ts
@@ -6449,7 +6800,9 @@ async function executePlan(plan, ctx, options = {}) {
     await runWithConcurrency(level, concurrency, runAction);
     await ctx.state.save();
   }
-  await reconcileDefaultMemoryStores(ctx, new Set(plan.actions.map((action) => action.address.provider)));
+  if (!ctx.createOnly) {
+    await reconcileDefaultMemoryStores(ctx, new Set(plan.actions.map((action) => action.address.provider)));
+  }
   for (const action of deletions) {
     await runAction(action);
     await ctx.state.save();
@@ -6661,6 +7014,7 @@ async function executeActionInner(action, provider, ctx) {
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
             mode: apiMode,
+            createOnly: ctx.createOnly,
             onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl, apiMode)
           });
           adopted = true;
@@ -6680,6 +7034,7 @@ async function executeActionInner(action, provider, ctx) {
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
             mode: apiMode,
+            createOnly: ctx.createOnly,
             onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl, apiMode)
           });
           adopted = true;
@@ -6706,6 +7061,7 @@ async function executeActionInner(action, provider, ctx) {
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
             mode: apiMode,
+            createOnly: ctx.createOnly,
             onExisting: async (existing) => {
               await provider.deleteVault(existing.id, apiMode);
               return provider.createVault(name, decl, apiMode);
@@ -6742,6 +7098,7 @@ async function executeActionInner(action, provider, ctx) {
         const searchNames = manifestName && manifestName !== remoteName ? [remoteName, manifestName] : [remoteName];
         const existing = await findExistingByNames(provider, "skill", searchNames, apiMode);
         if (existing) {
+          if (ctx.createOnly) throw createOnlyExistingResourceError(address, existing.name);
           result = existing.resource;
           emitRuntimeFeedback(ctx.onFeedback, {
             type: "resource_adopted",
@@ -6757,6 +7114,7 @@ async function executeActionInner(action, provider, ctx) {
             result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
               mode: apiMode,
               searchNames,
+              createOnly: ctx.createOnly,
               onExisting: async (existing2) => existing2
             });
             adopted = true;
@@ -6823,6 +7181,7 @@ async function executeActionInner(action, provider, ctx) {
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
             mode: apiMode,
+            createOnly: ctx.createOnly,
             onExisting: async (existing) => reconcile(existing.id)
           });
           adopted = true;
@@ -6841,6 +7200,7 @@ async function executeActionInner(action, provider, ctx) {
           result = await provider.createAgent(remoteName, decl, refs);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            createOnly: ctx.createOnly,
             onExisting: (existing) => provider.updateAgent(existing.id, remoteName, decl, refs)
           });
           adopted = true;
@@ -6864,6 +7224,7 @@ async function executeActionInner(action, provider, ctx) {
           result = await createTemplate(remoteName, decl, refs);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            createOnly: ctx.createOnly,
             onExisting: (existing) => updateTemplate(existing.id, remoteName, decl, refs)
           });
           adopted = true;
@@ -6898,6 +7259,7 @@ async function executeActionInner(action, provider, ctx) {
           result = await createIdentity(name, decl);
         } catch (err) {
           if (!(err instanceof ConflictError)) throw err;
+          if (ctx.createOnly) throw createOnlyExistingResourceError(address);
           const existing = await provider.findResource("identity", decl.external_id);
           if (!existing?.id) throw err;
           result = await updateIdentity(existing.id, name, decl);
@@ -6921,6 +7283,7 @@ async function executeActionInner(action, provider, ctx) {
           result = await createChannel(name, decl, refs);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            createOnly: ctx.createOnly,
             onExisting: (existing) => updateChannel(existing.id, name, decl, refs)
           });
           adopted = true;
@@ -6940,6 +7303,7 @@ async function executeActionInner(action, provider, ctx) {
         } catch (err) {
           const preparedFiles = err instanceof DeploymentCreateConflictError ? err.preparedFiles : void 0;
           const existing = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            createOnly: ctx.createOnly,
             onExisting: (existing2) => provider.updateDeployment(existing2.id, name, decl, refs, ctx.configPath ?? "", preparedFiles)
           });
           adopted = true;
@@ -6951,6 +7315,7 @@ async function executeActionInner(action, provider, ctx) {
       } else {
         const existing = hasLocalFileSources ? await findExistingByNames(provider, "deployment", [name]) : null;
         if (existing) {
+          if (ctx.createOnly) throw createOnlyExistingResourceError(address, existing.name);
           result = await provider.updateDeployment(existing.resource.id, name, decl, refs, ctx.configPath ?? "");
           emitRuntimeFeedback(ctx.onFeedback, {
             type: "resource_adopted",
@@ -6977,7 +7342,16 @@ async function executeActionInner(action, provider, ctx) {
           }
         }
       }
-      const info = await provider.uploadFile(filePath, { name: decl.name, purpose: decl.purpose }, apiMode);
+      const info = await provider.uploadFile(
+        filePath,
+        {
+          // Keep the source filename and extension; a declaration label must not
+          // change the multipart filename or the provider's inferred MIME type.
+          name: basename7(filePath),
+          purpose: decl.purpose
+        },
+        apiMode
+      );
       result = { id: info.id, type: "file" };
       break;
     }
@@ -7029,7 +7403,7 @@ function resolveResourceApiMode(type, name, provider, config) {
     if (agent.provider && agent.provider !== provider) continue;
     const referenced = type === "environment" ? agent.environment === name : type === "skill" ? agent.skills?.some(
       (skill) => typeof skill === "string" ? skill === name : skill.type === "custom" && skill.skill_id === name
-    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.includes(name);
+    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.some((file) => (typeof file === "string" ? file : file.file) === name);
     if (!referenced) continue;
     if (agent.delivery?.qoder?.type === "forward") forward = true;
     else managed = true;
@@ -7051,6 +7425,7 @@ async function findExistingByNames(provider, type, names, mode) {
 async function adoptOnConflict(err, address, provider, onFeedback, opts) {
   if (!(err instanceof ConflictError)) throw err;
   const candidates = opts.searchNames?.length ? opts.searchNames : [address.name];
+  if (opts.createOnly) throw createOnlyExistingResourceError(address, candidates.join('" / "'));
   const existing = await findExistingByNames(provider, address.type, candidates, opts.mode);
   if (!existing) throw nameReservedError(err, address, candidates.join('" / "'));
   emitRuntimeFeedback(onFeedback, {
@@ -7061,6 +7436,11 @@ async function adoptOnConflict(err, address, provider, onFeedback, opts) {
   });
   return opts.onExisting(existing.resource);
 }
+function createOnlyExistingResourceError(address, remoteName = address.name) {
+  return new UserError(
+    `Create-only cannot adopt or reconcile existing ${address.type} "${remoteName}" on provider '${address.provider}'. Choose a new name, or use a normal apply/import workflow to manage the existing resource.`
+  );
+}
 function nameReservedError(err, address, searchName) {
   const detail = err instanceof ApiError ? err.message : String(err);
   if (address.type === "channel" && err instanceof ApiError && err.responseBody.includes("CHANNEL_CREDENTIAL_CONFLICT")) {
@@ -7073,73 +7453,6 @@ function nameReservedError(err, address, searchName) {
   );
 }
 
-// src/internal/diagnostics/diagnostics.ts
-var DiagnosticCollector = class {
-  items = [];
-  error(code, message, resource) {
-    this.items.push({ severity: "error", code, message, resource });
-  }
-  warning(code, message, resource) {
-    this.items.push({ severity: "warning", code, message, resource });
-  }
-  info(code, message, resource) {
-    this.items.push({ severity: "info", code, message, resource });
-  }
-  hasErrors() {
-    return this.items.some((d) => d.severity === "error");
-  }
-  getAll() {
-    return [...this.items];
-  }
-  format() {
-    if (this.items.length === 0) return "";
-    const lines = [];
-    for (const d of this.items) {
-      const icon = severityIcon(d.severity);
-      const addr = d.resource ? ` ${d.resource.type}.${d.resource.name} (${d.resource.provider})` : "";
-      lines.push(`${icon} ${d.code}`);
-      if (addr) lines.push(`  Resource:${addr}`);
-      lines.push(`  ${d.message}`);
-      lines.push("");
-    }
-    return lines.join("\n");
-  }
-};
-function severityIcon(s) {
-  switch (s) {
-    case "error":
-      return "\u2717";
-    case "warning":
-      return "\u26A0";
-    case "info":
-      return "\u2139";
-  }
-}
-
-// src/internal/validation/bailian.ts
-function findMissingBailianMcpToolConfigs(config, providerName = "bailian") {
-  if (providerName !== "bailian") return [];
-  const missing = [];
-  for (const [agentName, agent] of Object.entries(config.agents ?? {})) {
-    if (!agentTargetsProvider(config, agent.provider, providerName)) continue;
-    const configuredToolServers = new Set((agent.tools?.mcp ?? []).map((tool) => tool.mcp_server_name));
-    for (const server of agent.mcp_servers ?? []) {
-      if (!configuredToolServers.has(server.name)) {
-        missing.push({ agentName, serverName: server.name });
-      }
-    }
-  }
-  return missing;
-}
-function agentTargetsProvider(config, agentProvider, providerName) {
-  if (agentProvider) return agentProvider === providerName;
-  const defaultProvider = config.defaults?.provider;
-  if (defaultProvider && defaultProvider !== "all") {
-    return defaultProvider === providerName;
-  }
-  return Object.hasOwn(config.providers, providerName);
-}
-
 // src/internal/core/agent-materialization.ts
 function resolveAgentMaterialization(provider, agent) {
   const mode = agent.delivery?.[provider]?.type ?? "managed";
@@ -7147,7 +7460,298 @@ function resolveAgentMaterialization(provider, agent) {
   return { resourceType: "template", mode };
 }
 
-// src/internal/core/validate-config.ts
+// src/internal/graph/dependency.ts
+function collectDependencyClosure(graph, roots) {
+  const selected = /* @__PURE__ */ new Map();
+  function visit2(address) {
+    const key = addressKey(address);
+    if (selected.has(key)) return;
+    selected.set(key, graph.nodes.get(key) ?? address);
+    for (const dependencyKey of graph.edges.get(key) ?? []) {
+      const dependency = graph.nodes.get(dependencyKey);
+      if (dependency) visit2(dependency);
+    }
+  }
+  for (const root of roots) visit2(root);
+  return [...selected.values()];
+}
+function buildDependencyGraph(config, targetProviders) {
+  const nodes = /* @__PURE__ */ new Map();
+  const edges = /* @__PURE__ */ new Map();
+  function addNode(addr) {
+    const key = addressKey(addr);
+    nodes.set(key, addr);
+    if (!edges.has(key)) edges.set(key, /* @__PURE__ */ new Set());
+  }
+  function addEdge(from, to) {
+    const fromKey = addressKey(from);
+    const toKey = addressKey(to);
+    edges.get(fromKey)?.add(toKey);
+  }
+  for (const provider of targetProviders) {
+    const def = getProvider(provider);
+    const caps = def?.capabilities;
+    if (config.environments) {
+      for (const name of Object.keys(config.environments)) {
+        const decl = config.environments[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "environment", name, provider });
+      }
+    }
+    if (config.memory_stores) {
+      for (const name of Object.keys(config.memory_stores)) {
+        const decl = config.memory_stores[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        if (!isSupported(caps, "memory_store")) continue;
+        addNode({ type: "memory_store", name, provider });
+      }
+    }
+    if (config.vaults) {
+      for (const name of Object.keys(config.vaults)) {
+        const decl = config.vaults[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "vault", name, provider });
+      }
+    }
+    if (config.skills) {
+      for (const name of Object.keys(config.skills)) {
+        const decl = config.skills[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "skill", name, provider });
+      }
+    }
+    if (config.files) {
+      for (const name of Object.keys(config.files)) {
+        const decl = config.files[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "file", name, provider });
+      }
+    }
+    if (config.identities && isSupported(caps, "identity")) {
+      for (const name of Object.keys(config.identities)) {
+        const decl = config.identities[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "identity", name, provider });
+      }
+    }
+    if (config.agents) {
+      for (const name of Object.keys(config.agents)) {
+        const decl = config.agents[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const materialization = resolveAgentMaterialization(provider, decl);
+        const agentAddr = { type: materialization.resourceType, name, provider };
+        addNode(agentAddr);
+        if ((decl.default_memory_store || decl.memory_stores?.length) && materialization.resourceType === "template") {
+          const identityName = config.defaults?.identity;
+          if (identityName) {
+            const identityAddr = { type: "identity", name: identityName, provider };
+            if (nodes.has(addressKey(identityAddr))) addEdge(agentAddr, identityAddr);
+          }
+        }
+        if (decl.environment && config.environments?.[decl.environment]) {
+          const envAddr = {
+            type: "environment",
+            name: decl.environment,
+            provider
+          };
+          if (nodes.has(addressKey(envAddr))) {
+            addEdge(agentAddr, envAddr);
+          }
+        }
+        if (decl.skills) {
+          for (const skillRef of decl.skills) {
+            if (typeof skillRef !== "string") continue;
+            const skillName = skillRef;
+            const skillAddr = { type: "skill", name: skillName, provider };
+            if (nodes.has(addressKey(skillAddr))) {
+              addEdge(agentAddr, skillAddr);
+            }
+          }
+        }
+        if (decl.vault) {
+          const vaultAddr = { type: "vault", name: decl.vault, provider };
+          if (nodes.has(addressKey(vaultAddr))) {
+            addEdge(agentAddr, vaultAddr);
+          }
+        }
+        if (decl.files) {
+          for (const file of decl.files) {
+            const fileName = typeof file === "string" ? file : file.file;
+            const fileAddr = { type: "file", name: fileName, provider };
+            if (nodes.has(addressKey(fileAddr))) addEdge(agentAddr, fileAddr);
+          }
+        }
+        if (decl.memory_stores) {
+          for (const msName of decl.memory_stores) {
+            const msAddr = {
+              type: "memory_store",
+              name: msName,
+              provider
+            };
+            if (nodes.has(addressKey(msAddr))) {
+              addEdge(agentAddr, msAddr);
+            }
+          }
+        }
+        if (decl.multiagent && isSupported(caps, "multiagent")) {
+          for (const subName of decl.multiagent.agents) {
+            const subDecl = config.agents[subName];
+            const subType = subDecl ? resolveAgentMaterialization(provider, subDecl).resourceType : "agent";
+            const subAddr = { type: subType, name: subName, provider };
+            addEdge(agentAddr, subAddr);
+          }
+        }
+      }
+    }
+    if (config.deployments) {
+      for (const name of Object.keys(config.deployments)) {
+        const decl = config.deployments[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const depAddr = { type: "deployment", name, provider };
+        addNode(depAddr);
+        const agentDecl = config.agents?.[decl.agent];
+        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
+        const agentAddr = { type: agentType, name: decl.agent, provider };
+        if (nodes.has(addressKey(agentAddr))) addEdge(depAddr, agentAddr);
+        if (decl.environment) {
+          const envAddr = { type: "environment", name: decl.environment, provider };
+          if (nodes.has(addressKey(envAddr))) addEdge(depAddr, envAddr);
+        }
+        if (decl.vaults) {
+          for (const vName of decl.vaults) {
+            const vAddr = { type: "vault", name: vName, provider };
+            if (nodes.has(addressKey(vAddr))) addEdge(depAddr, vAddr);
+          }
+        }
+        if (decl.memory_stores) {
+          for (const msName of decl.memory_stores) {
+            const msAddr = { type: "memory_store", name: msName, provider };
+            if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
+          }
+        }
+        if (decl.resources) {
+          for (const r of decl.resources) {
+            if (r.type === "memory_store") {
+              const msAddr = { type: "memory_store", name: r.memory_store, provider };
+              if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
+            }
+          }
+        }
+      }
+    }
+    if (config.channels && isSupported(caps, "channel")) {
+      for (const name of Object.keys(config.channels)) {
+        const decl = config.channels[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const channelAddr = { type: "channel", name, provider };
+        addNode(channelAddr);
+        if (decl.mode === "pairing" || !decl.agent) continue;
+        const agentDecl = config.agents?.[decl.agent];
+        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
+        const agentAddr = { type: agentType, name: decl.agent, provider };
+        if (nodes.has(addressKey(agentAddr))) addEdge(channelAddr, agentAddr);
+        const identityName = decl.identity ?? config.defaults?.identity;
+        if (identityName) {
+          const identityAddr = { type: "identity", name: identityName, provider };
+          if (nodes.has(addressKey(identityAddr))) addEdge(channelAddr, identityAddr);
+        }
+      }
+    }
+  }
+  return { nodes, edges };
+}
+function topologicalSort(graph) {
+  const visited = /* @__PURE__ */ new Set();
+  const sorted = [];
+  const visiting = /* @__PURE__ */ new Set();
+  function visit2(key) {
+    if (visited.has(key)) return;
+    if (visiting.has(key)) {
+      throw new UserError(`Circular dependency detected involving: ${key}`);
+    }
+    visiting.add(key);
+    const deps = graph.edges.get(key) ?? /* @__PURE__ */ new Set();
+    for (const dep of deps) {
+      visit2(dep);
+    }
+    visiting.delete(key);
+    visited.add(key);
+    sorted.push(graph.nodes.get(key));
+  }
+  for (const key of graph.nodes.keys()) {
+    visit2(key);
+  }
+  return sorted;
+}
+
+// src/internal/diagnostics/diagnostics.ts
+var DiagnosticCollector = class {
+  items = [];
+  error(code, message, resource) {
+    this.items.push({ severity: "error", code, message, resource });
+  }
+  warning(code, message, resource) {
+    this.items.push({ severity: "warning", code, message, resource });
+  }
+  info(code, message, resource) {
+    this.items.push({ severity: "info", code, message, resource });
+  }
+  hasErrors() {
+    return this.items.some((d) => d.severity === "error");
+  }
+  getAll() {
+    return [...this.items];
+  }
+  format() {
+    if (this.items.length === 0) return "";
+    const lines = [];
+    for (const d of this.items) {
+      const icon = severityIcon(d.severity);
+      const addr = d.resource ? ` ${d.resource.type}.${d.resource.name} (${d.resource.provider})` : "";
+      lines.push(`${icon} ${d.code}`);
+      if (addr) lines.push(`  Resource:${addr}`);
+      lines.push(`  ${d.message}`);
+      lines.push("");
+    }
+    return lines.join("\n");
+  }
+};
+function severityIcon(s) {
+  switch (s) {
+    case "error":
+      return "\u2717";
+    case "warning":
+      return "\u26A0";
+    case "info":
+      return "\u2139";
+  }
+}
+
+// src/internal/validation/bailian.ts
+function findMissingBailianMcpToolConfigs(config, providerName = "bailian") {
+  if (providerName !== "bailian") return [];
+  const missing = [];
+  for (const [agentName, agent] of Object.entries(config.agents ?? {})) {
+    if (!agentTargetsProvider(config, agent.provider, providerName)) continue;
+    const configuredToolServers = new Set((agent.tools?.mcp ?? []).map((tool) => tool.mcp_server_name));
+    for (const server of agent.mcp_servers ?? []) {
+      if (!configuredToolServers.has(server.name)) {
+        missing.push({ agentName, serverName: server.name });
+      }
+    }
+  }
+  return missing;
+}
+function agentTargetsProvider(config, agentProvider, providerName) {
+  if (agentProvider) return agentProvider === providerName;
+  const defaultProvider = config.defaults?.provider;
+  if (defaultProvider && defaultProvider !== "all") {
+    return defaultProvider === providerName;
+  }
+  return Object.hasOwn(config.providers, providerName);
+}
+
+// src/internal/core/validate-config.ts
 function validateProjectConfig(config, options = {}) {
   const collector = new DiagnosticCollector();
   collectReferenceDiagnostics(config, collector);
@@ -7202,8 +7806,9 @@ function collectReferenceDiagnostics(config, diagnostics) {
       diagnostics.error("config.agent.vault.unknown", `agent.${name}: references unknown vault '${agent.vault}'`);
     }
     for (const file of agent.files ?? []) {
-      if (!fileNames.has(file)) {
-        diagnostics.error("config.agent.file.unknown", `agent.${name}: references unknown file '${file}'`);
+      const fileName = typeof file === "string" ? file : file.file;
+      if (!fileNames.has(fileName)) {
+        diagnostics.error("config.agent.file.unknown", `agent.${name}: references unknown file '${fileName}'`);
       }
     }
     for (const memory of agent.memory_stores ?? []) {
@@ -7268,6 +7873,16 @@ function collectProviderCapabilities(config, providers, diagnostics) {
       continue;
     }
     const caps = def.capabilities;
+    for (const [name, vault] of Object.entries(config.vaults ?? {})) {
+      if (vault.provider && vault.provider !== providerName) continue;
+      if (providerName !== "bailian" && vault.credentials.some((credential) => credential.injection_location !== void 0)) {
+        diagnostics.error(
+          `${providerName}.vault.injection_location.unsupported`,
+          `vault.${name}: provider '${providerName}' does not support credential injection_location; pin this vault to bailian.`,
+          { type: "vault", name, provider: providerName }
+        );
+      }
+    }
     for (const [name, environment] of Object.entries(config.environments ?? {})) {
       if (environment.provider && environment.provider !== providerName) continue;
       if (environment.environment_id) continue;
@@ -7387,7 +8002,7 @@ function collectProviderCapabilities(config, providers, diagnostics) {
           ),
           ...agent.vault ? [`vault:${agent.vault}`] : [],
           ...(agent.memory_stores ?? []).map((store) => `memory_store:${store}`),
-          ...(agent.files ?? []).map((file) => `file:${file}`)
+          ...(agent.files ?? []).map((file) => `file:${typeof file === "string" ? file : file.file}`)
         ];
         for (const ref of refs) {
           const modes = domains.get(ref) ?? /* @__PURE__ */ new Set();
@@ -7407,7 +8022,7 @@ function collectProviderCapabilities(config, providers, diagnostics) {
     }
     for (const [name, agent] of Object.entries(config.agents ?? {})) {
       if (agent.provider && agent.provider !== providerName) continue;
-      if (agent.files?.length && (providerName !== "qoder" || agent.delivery?.qoder?.type !== "forward")) {
+      if (agent.files?.some((file) => typeof file === "string") && (providerName !== "qoder" || agent.delivery?.qoder?.type !== "forward")) {
         diagnostics.error(
           "config.agent.files.unsupported",
           `agent.${name}: files are supported only by Qoder Forward Templates.`,
@@ -7431,6 +8046,30 @@ function collectProviderCapabilities(config, providers, diagnostics) {
           address
         );
       }
+      const normalizedFileMountPaths = /* @__PURE__ */ new Set();
+      for (const file of agent.files ?? []) {
+        if (typeof file === "string") continue;
+        let normalizedMountPath;
+        try {
+          normalizedMountPath = resolveSandboxMountPath(providerName, file.mount_path);
+        } catch (error) {
+          diagnostics.error(
+            `${providerName}.agent.file.mount_path.invalid`,
+            `agent.${name}: ${error instanceof Error ? error.message : String(error)}`,
+            address
+          );
+          continue;
+        }
+        if (normalizedFileMountPaths.has(normalizedMountPath)) {
+          diagnostics.error(
+            `${providerName}.agent.file.mount_path.duplicate`,
+            `agent.${name}: file mount_path '${normalizedMountPath}' is duplicated after normalization.`,
+            address
+          );
+        } else {
+          normalizedFileMountPaths.add(normalizedMountPath);
+        }
+      }
       for (const resource of agent.resources ?? []) {
         if (!def.features.session_resources.includes(resource.type)) {
           diagnostics.error(
@@ -7591,370 +8230,164 @@ function collectProviderCapabilities(config, providers, diagnostics) {
               `${providerName}.deployment.file.mount_path.invalid`,
               `deployment.${name}: Bailian file mount_path must start with '${mountPrefix}/'.`,
               addr
-            );
-            continue;
-          }
-          const normalizedMountPath = resolveSandboxMountPath(providerName, resource.mount_path);
-          if (normalizedMountPaths.has(normalizedMountPath)) {
-            diagnostics.error(
-              `${providerName}.deployment.file.mount_path.duplicate`,
-              `deployment.${name}: Bailian file mount_path '${normalizedMountPath}' is duplicated after normalization.`,
-              addr
-            );
-          } else {
-            normalizedMountPaths.add(normalizedMountPath);
-          }
-        }
-      }
-    }
-    if (providerName !== "qoder") {
-      for (const [name, env] of Object.entries(config.environments ?? {})) {
-        if (env.environment_id) continue;
-        if (env.config.type === "self_hosted" && (!env.provider || env.provider === providerName)) {
-          diagnostics.error(
-            `${providerName}.environment.self_hosted.unsupported`,
-            `environment.${name}: self_hosted environments are supported only by Qoder BYOC; use type 'cloud' or pin this environment to the qoder provider.`,
-            { type: "environment", name, provider: providerName }
-          );
-        }
-      }
-      for (const [name, agent] of Object.entries(config.agents ?? {})) {
-        if (agent.environment_variables && (!agent.provider || agent.provider === providerName)) {
-          diagnostics.error(
-            `${providerName}.agent.environment_variables.unsupported`,
-            `agent.${name}: environment_variables is supported only by Qoder; remove it or pin this agent to qoder.`,
-            { type: "agent", name, provider: providerName }
-          );
-        }
-        if (agent.managed_tool_config && (!agent.provider || agent.provider === providerName)) {
-          diagnostics.error(
-            `${providerName}.agent.managed_tool_config.unsupported`,
-            `agent.${name}: managed_tool_config is supported only by Qoder; remove it or pin this agent to qoder.`,
-            { type: "agent", name, provider: providerName }
-          );
-        }
-        if (agent.tunnel && (!agent.provider || agent.provider === providerName)) {
-          diagnostics.error(
-            `${providerName}.agent.tunnel.unsupported`,
-            "Tunnels are supported only by Qoder BYOC sessions.",
-            { type: "agent", name, provider: providerName }
-          );
-        }
-      }
-      for (const [name, deployment] of Object.entries(config.deployments ?? {})) {
-        if (deployment.provider && deployment.provider !== providerName) continue;
-        if (deployment.environment_variables !== void 0) {
-          diagnostics.error(
-            `${providerName}.deployment.environment_variables.unsupported`,
-            `deployment.${name}: environment_variables is supported only by Qoder deployments; remove it or pin this deployment to the qoder provider.`,
-            { type: "deployment", name, provider: providerName }
-          );
-        }
-        if (deployment.tunnel && (!deployment.provider || deployment.provider === providerName)) {
-          diagnostics.error(
-            `${providerName}.deployment.tunnel.unsupported`,
-            "Tunnels are supported only by Qoder BYOC sessions.",
-            { type: "deployment", name, provider: providerName }
-          );
-        }
-      }
-    }
-    for (const missing of findMissingBailianMcpToolConfigs(config, providerName)) {
-      diagnostics.error(
-        `${providerName}.agent.mcp_toolkit_missing`,
-        `Bailian MCP server '${missing.serverName}' requires a matching tools.mcp entry.`,
-        { type: "agent", name: missing.agentName, provider: providerName }
-      );
-    }
-    if (config.memory_stores && !isSupported(caps, "memory_store")) {
-      for (const [name, decl] of Object.entries(config.memory_stores)) {
-        if (!decl.provider || decl.provider === providerName) {
-          diagnostics.error(
-            `${providerName}.memory_store.unsupported`,
-            `${caps.memory_store.reason}. ${caps.memory_store.remediation ?? ""}`.trim(),
-            { type: "memory_store", name, provider: providerName }
-          );
-        }
-      }
-    }
-    if (config.agents && !isSupported(caps, "multiagent")) {
-      for (const [name, agent] of Object.entries(config.agents)) {
-        if (agent.multiagent) {
-          if (!agent.provider || agent.provider === providerName) {
-            diagnostics.error(
-              `${providerName}.multiagent.unsupported`,
-              `${caps.multiagent.reason}. ${caps.multiagent.remediation ?? ""}`.trim(),
-              { type: "agent", name, provider: providerName }
-            );
-          }
-        }
-      }
-    }
-    if (config.deployments && caps.deployment.tier === "emulated") {
-      for (const [name, dep] of Object.entries(config.deployments)) {
-        if (dep.provider && dep.provider !== providerName) continue;
-        const addr = {
-          type: "deployment",
-          name,
-          provider: providerName
-        };
-        if (dep.schedule) {
-          diagnostics.warning(
-            `${providerName}.deployment.schedule_unsupported`,
-            "Schedules are not enforced server-side on this provider; trigger runs via external cron/CI.",
-            addr
-          );
-        }
-        if (dep.initial_events?.some((e) => e.type === "user.define_outcome")) {
-          diagnostics.warning(
-            `${providerName}.deployment.define_outcome_unsupported`,
-            "Outcome rubrics (user.define_outcome) are not enforced server-side on this provider; the run executes without rubric grading.",
-            addr
-          );
-        }
-        if (dep.resources?.some((r) => r.type === "github_repository")) {
-          diagnostics.warning(
-            `${providerName}.deployment.github_repository_unsupported`,
-            "github_repository resources are not provisioned on this provider; clone the repository inside the session instead.",
-            addr
-          );
-        }
-        if (dep.resources?.some((r) => r.type === "memory_store" && (r.access === "read_only" || r.instructions))) {
-          diagnostics.warning(
-            `${providerName}.deployment.memory_store_options_unsupported`,
-            "Per-resource memory_store access/instructions are not honored on this provider; the store is attached with default access.",
-            addr
-          );
-        }
-      }
-    }
-  }
-}
-
-// src/internal/graph/dependency.ts
-function buildDependencyGraph(config, targetProviders) {
-  const nodes = /* @__PURE__ */ new Map();
-  const edges = /* @__PURE__ */ new Map();
-  function addNode(addr) {
-    const key = addressKey(addr);
-    nodes.set(key, addr);
-    if (!edges.has(key)) edges.set(key, /* @__PURE__ */ new Set());
-  }
-  function addEdge(from, to) {
-    const fromKey = addressKey(from);
-    const toKey = addressKey(to);
-    edges.get(fromKey)?.add(toKey);
-  }
-  for (const provider of targetProviders) {
-    const def = getProvider(provider);
-    const caps = def?.capabilities;
-    if (config.environments) {
-      for (const name of Object.keys(config.environments)) {
-        const decl = config.environments[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "environment", name, provider });
-      }
-    }
-    if (config.memory_stores) {
-      for (const name of Object.keys(config.memory_stores)) {
-        const decl = config.memory_stores[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        if (!isSupported(caps, "memory_store")) continue;
-        addNode({ type: "memory_store", name, provider });
-      }
-    }
-    if (config.vaults) {
-      for (const name of Object.keys(config.vaults)) {
-        const decl = config.vaults[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "vault", name, provider });
-      }
-    }
-    if (config.skills) {
-      for (const name of Object.keys(config.skills)) {
-        const decl = config.skills[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "skill", name, provider });
-      }
-    }
-    if (config.files) {
-      for (const name of Object.keys(config.files)) {
-        const decl = config.files[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "file", name, provider });
-      }
-    }
-    if (config.identities && isSupported(caps, "identity")) {
-      for (const name of Object.keys(config.identities)) {
-        const decl = config.identities[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        addNode({ type: "identity", name, provider });
-      }
-    }
-    if (config.agents) {
-      for (const name of Object.keys(config.agents)) {
-        const decl = config.agents[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        const materialization = resolveAgentMaterialization(provider, decl);
-        const agentAddr = { type: materialization.resourceType, name, provider };
-        addNode(agentAddr);
-        if ((decl.default_memory_store || decl.memory_stores?.length) && materialization.resourceType === "template") {
-          const identityName = config.defaults?.identity;
-          if (identityName) {
-            const identityAddr = { type: "identity", name: identityName, provider };
-            if (nodes.has(addressKey(identityAddr))) addEdge(agentAddr, identityAddr);
-          }
-        }
-        if (decl.environment && config.environments?.[decl.environment]) {
-          const envAddr = {
-            type: "environment",
-            name: decl.environment,
-            provider
-          };
-          if (nodes.has(addressKey(envAddr))) {
-            addEdge(agentAddr, envAddr);
-          }
-        }
-        if (decl.skills) {
-          for (const skillRef of decl.skills) {
-            if (typeof skillRef !== "string") continue;
-            const skillName = skillRef;
-            const skillAddr = { type: "skill", name: skillName, provider };
-            if (nodes.has(addressKey(skillAddr))) {
-              addEdge(agentAddr, skillAddr);
-            }
-          }
-        }
-        if (decl.vault) {
-          const vaultAddr = { type: "vault", name: decl.vault, provider };
-          if (nodes.has(addressKey(vaultAddr))) {
-            addEdge(agentAddr, vaultAddr);
-          }
-        }
-        if (decl.files) {
-          for (const fileName of decl.files) {
-            const fileAddr = { type: "file", name: fileName, provider };
-            if (nodes.has(addressKey(fileAddr))) addEdge(agentAddr, fileAddr);
-          }
-        }
-        if (decl.memory_stores) {
-          for (const msName of decl.memory_stores) {
-            const msAddr = {
-              type: "memory_store",
-              name: msName,
-              provider
-            };
-            if (nodes.has(addressKey(msAddr))) {
-              addEdge(agentAddr, msAddr);
-            }
+            );
+            continue;
           }
-        }
-        if (decl.multiagent && isSupported(caps, "multiagent")) {
-          for (const subName of decl.multiagent.agents) {
-            const subDecl = config.agents[subName];
-            const subType = subDecl ? resolveAgentMaterialization(provider, subDecl).resourceType : "agent";
-            const subAddr = { type: subType, name: subName, provider };
-            addEdge(agentAddr, subAddr);
+          const normalizedMountPath = resolveSandboxMountPath(providerName, resource.mount_path);
+          if (normalizedMountPaths.has(normalizedMountPath)) {
+            diagnostics.error(
+              `${providerName}.deployment.file.mount_path.duplicate`,
+              `deployment.${name}: Bailian file mount_path '${normalizedMountPath}' is duplicated after normalization.`,
+              addr
+            );
+          } else {
+            normalizedMountPaths.add(normalizedMountPath);
           }
         }
       }
     }
-    if (config.deployments) {
-      for (const name of Object.keys(config.deployments)) {
-        const decl = config.deployments[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        const depAddr = { type: "deployment", name, provider };
-        addNode(depAddr);
-        const agentDecl = config.agents?.[decl.agent];
-        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
-        const agentAddr = { type: agentType, name: decl.agent, provider };
-        if (nodes.has(addressKey(agentAddr))) addEdge(depAddr, agentAddr);
-        if (decl.environment) {
-          const envAddr = { type: "environment", name: decl.environment, provider };
-          if (nodes.has(addressKey(envAddr))) addEdge(depAddr, envAddr);
+    if (providerName !== "qoder") {
+      for (const [name, env] of Object.entries(config.environments ?? {})) {
+        if (env.environment_id) continue;
+        if (env.config.type === "self_hosted" && (!env.provider || env.provider === providerName)) {
+          diagnostics.error(
+            `${providerName}.environment.self_hosted.unsupported`,
+            `environment.${name}: self_hosted environments are supported only by Qoder BYOC; use type 'cloud' or pin this environment to the qoder provider.`,
+            { type: "environment", name, provider: providerName }
+          );
         }
-        if (decl.vaults) {
-          for (const vName of decl.vaults) {
-            const vAddr = { type: "vault", name: vName, provider };
-            if (nodes.has(addressKey(vAddr))) addEdge(depAddr, vAddr);
-          }
+      }
+      for (const [name, agent] of Object.entries(config.agents ?? {})) {
+        if (agent.environment_variables && (!agent.provider || agent.provider === providerName)) {
+          diagnostics.error(
+            `${providerName}.agent.environment_variables.unsupported`,
+            `agent.${name}: environment_variables is supported only by Qoder; remove it or pin this agent to qoder.`,
+            { type: "agent", name, provider: providerName }
+          );
         }
-        if (decl.memory_stores) {
-          for (const msName of decl.memory_stores) {
-            const msAddr = { type: "memory_store", name: msName, provider };
-            if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
-          }
+        if (agent.managed_tool_config && (!agent.provider || agent.provider === providerName)) {
+          diagnostics.error(
+            `${providerName}.agent.managed_tool_config.unsupported`,
+            `agent.${name}: managed_tool_config is supported only by Qoder; remove it or pin this agent to qoder.`,
+            { type: "agent", name, provider: providerName }
+          );
         }
-        if (decl.resources) {
-          for (const r of decl.resources) {
-            if (r.type === "memory_store") {
-              const msAddr = { type: "memory_store", name: r.memory_store, provider };
-              if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
-            }
-          }
+        if (agent.tunnel && (!agent.provider || agent.provider === providerName)) {
+          diagnostics.error(
+            `${providerName}.agent.tunnel.unsupported`,
+            "Tunnels are supported only by Qoder BYOC sessions.",
+            { type: "agent", name, provider: providerName }
+          );
+        }
+      }
+      for (const [name, deployment] of Object.entries(config.deployments ?? {})) {
+        if (deployment.provider && deployment.provider !== providerName) continue;
+        if (deployment.environment_variables !== void 0) {
+          diagnostics.error(
+            `${providerName}.deployment.environment_variables.unsupported`,
+            `deployment.${name}: environment_variables is supported only by Qoder deployments; remove it or pin this deployment to the qoder provider.`,
+            { type: "deployment", name, provider: providerName }
+          );
+        }
+        if (deployment.tunnel && (!deployment.provider || deployment.provider === providerName)) {
+          diagnostics.error(
+            `${providerName}.deployment.tunnel.unsupported`,
+            "Tunnels are supported only by Qoder BYOC sessions.",
+            { type: "deployment", name, provider: providerName }
+          );
         }
       }
     }
-    if (config.channels && isSupported(caps, "channel")) {
-      for (const name of Object.keys(config.channels)) {
-        const decl = config.channels[name];
-        if (decl.provider && decl.provider !== provider) continue;
-        const channelAddr = { type: "channel", name, provider };
-        addNode(channelAddr);
-        if (decl.mode === "pairing" || !decl.agent) continue;
-        const agentDecl = config.agents?.[decl.agent];
-        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
-        const agentAddr = { type: agentType, name: decl.agent, provider };
-        if (nodes.has(addressKey(agentAddr))) addEdge(channelAddr, agentAddr);
-        const identityName = decl.identity ?? config.defaults?.identity;
-        if (identityName) {
-          const identityAddr = { type: "identity", name: identityName, provider };
-          if (nodes.has(addressKey(identityAddr))) addEdge(channelAddr, identityAddr);
+    for (const missing of findMissingBailianMcpToolConfigs(config, providerName)) {
+      diagnostics.error(
+        `${providerName}.agent.mcp_toolkit_missing`,
+        `Bailian MCP server '${missing.serverName}' requires a matching tools.mcp entry.`,
+        { type: "agent", name: missing.agentName, provider: providerName }
+      );
+    }
+    if (config.memory_stores && !isSupported(caps, "memory_store")) {
+      for (const [name, decl] of Object.entries(config.memory_stores)) {
+        if (!decl.provider || decl.provider === providerName) {
+          diagnostics.error(
+            `${providerName}.memory_store.unsupported`,
+            `${caps.memory_store.reason}. ${caps.memory_store.remediation ?? ""}`.trim(),
+            { type: "memory_store", name, provider: providerName }
+          );
         }
       }
     }
-  }
-  return { nodes, edges };
-}
-function topologicalSort(graph) {
-  const visited = /* @__PURE__ */ new Set();
-  const sorted = [];
-  const visiting = /* @__PURE__ */ new Set();
-  function visit(key) {
-    if (visited.has(key)) return;
-    if (visiting.has(key)) {
-      throw new UserError(`Circular dependency detected involving: ${key}`);
+    if (config.agents && !isSupported(caps, "multiagent")) {
+      for (const [name, agent] of Object.entries(config.agents)) {
+        if (agent.multiagent) {
+          if (!agent.provider || agent.provider === providerName) {
+            diagnostics.error(
+              `${providerName}.multiagent.unsupported`,
+              `${caps.multiagent.reason}. ${caps.multiagent.remediation ?? ""}`.trim(),
+              { type: "agent", name, provider: providerName }
+            );
+          }
+        }
+      }
     }
-    visiting.add(key);
-    const deps = graph.edges.get(key) ?? /* @__PURE__ */ new Set();
-    for (const dep of deps) {
-      visit(dep);
+    if (config.deployments && caps.deployment.tier === "emulated") {
+      for (const [name, dep] of Object.entries(config.deployments)) {
+        if (dep.provider && dep.provider !== providerName) continue;
+        const addr = {
+          type: "deployment",
+          name,
+          provider: providerName
+        };
+        if (dep.schedule) {
+          diagnostics.warning(
+            `${providerName}.deployment.schedule_unsupported`,
+            "Schedules are not enforced server-side on this provider; trigger runs via external cron/CI.",
+            addr
+          );
+        }
+        if (dep.initial_events?.some((e) => e.type === "user.define_outcome")) {
+          diagnostics.warning(
+            `${providerName}.deployment.define_outcome_unsupported`,
+            "Outcome rubrics (user.define_outcome) are not enforced server-side on this provider; the run executes without rubric grading.",
+            addr
+          );
+        }
+        if (dep.resources?.some((r) => r.type === "github_repository")) {
+          diagnostics.warning(
+            `${providerName}.deployment.github_repository_unsupported`,
+            "github_repository resources are not provisioned on this provider; clone the repository inside the session instead.",
+            addr
+          );
+        }
+        if (dep.resources?.some((r) => r.type === "memory_store" && (r.access === "read_only" || r.instructions))) {
+          diagnostics.warning(
+            `${providerName}.deployment.memory_store_options_unsupported`,
+            "Per-resource memory_store access/instructions are not honored on this provider; the store is attached with default access.",
+            addr
+          );
+        }
+      }
     }
-    visiting.delete(key);
-    visited.add(key);
-    sorted.push(graph.nodes.get(key));
-  }
-  for (const key of graph.nodes.keys()) {
-    visit(key);
   }
-  return sorted;
 }
 
 // src/internal/planner/planner.ts
 async function buildPlan(config, state, options = {}) {
+  const scopedConfig = options.resourceAddresses ? selectProjectConfig(config, options.resourceAddresses) : config;
+  const resourceKeys = options.resourceAddresses ? new Set(options.resourceAddresses.map(addressKey)) : void 0;
+  const scopedState = resourceKeys ? { ...state, resources: state.resources.filter((resource) => resourceKeys.has(addressKey(resource.address))) } : state;
   const diagnostics = new DiagnosticCollector();
   const actions = [];
-  const targetProviders = options.providers ?? resolveTargetProviders(config);
-  collectReferenceDiagnostics(config, diagnostics);
-  collectProviderCapabilities(config, targetProviders, diagnostics);
-  const graph = buildDependencyGraph(config, targetProviders);
+  const targetProviders = options.providers ?? resolveTargetProviders(scopedConfig);
+  collectReferenceDiagnostics(scopedConfig, diagnostics);
+  collectProviderCapabilities(scopedConfig, targetProviders, diagnostics);
+  const graph = buildDependencyGraph(scopedConfig, targetProviders);
   const sorted = topologicalSort(graph);
   const stateIndex = /* @__PURE__ */ new Map();
-  for (const res of state.resources) {
+  for (const res of scopedState.resources) {
     stateIndex.set(addressKey(res.address), res);
   }
   const remoteIdLookup = /* @__PURE__ */ new Map();
-  for (const res of state.resources) {
+  for (const res of scopedState.resources) {
     remoteIdLookup.set(addressKey(res.address), res);
   }
   const hashStateLookup = { getResource: (addr) => remoteIdLookup.get(addressKey(addr)) };
@@ -8098,9 +8531,53 @@ async function buildPlan(config, state, options = {}) {
       dependencies: replacement ? [replacement] : []
     });
   }
-  coalesceChannelRenames(actions, config, state);
+  coalesceChannelRenames(actions, scopedConfig, scopedState);
   return { actions, diagnostics: diagnostics.getAll() };
 }
+function selectProjectConfig(config, addresses) {
+  const providers = new Set(addresses.map((address) => address.provider));
+  const namesByType = /* @__PURE__ */ new Map();
+  for (const address of addresses) {
+    const names = namesByType.get(address.type) ?? /* @__PURE__ */ new Set();
+    names.add(address.name);
+    namesByType.set(address.type, names);
+  }
+  const pick = (record, names) => {
+    if (!record || !names?.size) return void 0;
+    const selected = Object.fromEntries(Object.entries(record).filter(([name]) => names.has(name)));
+    return Object.keys(selected).length > 0 ? selected : void 0;
+  };
+  const agentNames = /* @__PURE__ */ new Set([...namesByType.get("agent") ?? [], ...namesByType.get("template") ?? []]);
+  const selectedAgents = pick(config.agents, agentNames);
+  const tunnelNames = /* @__PURE__ */ new Set();
+  for (const agent of Object.values(selectedAgents ?? {})) {
+    if (agent.tunnel) tunnelNames.add(agent.tunnel);
+  }
+  for (const deployment of Object.values(pick(config.deployments, namesByType.get("deployment")) ?? {})) {
+    if (deployment.tunnel) tunnelNames.add(deployment.tunnel);
+  }
+  const identityNames = namesByType.get("identity");
+  const selectedProviders = Object.fromEntries(
+    Object.entries(config.providers).filter(([providerName]) => providers.has(providerName))
+  );
+  const defaultProvider = providers.size === 1 ? [...providers][0] : config.defaults?.provider;
+  const defaultIdentity = config.defaults?.identity && identityNames?.has(config.defaults.identity) ? config.defaults.identity : void 0;
+  return {
+    ...config,
+    providers: selectedProviders,
+    defaults: defaultProvider || defaultIdentity ? { provider: defaultProvider, identity: defaultIdentity } : void 0,
+    environments: pick(config.environments, namesByType.get("environment")),
+    tunnels: pick(config.tunnels, tunnelNames),
+    vaults: pick(config.vaults, namesByType.get("vault")),
+    memory_stores: pick(config.memory_stores, namesByType.get("memory_store")),
+    skills: pick(config.skills, namesByType.get("skill")),
+    files: pick(config.files, namesByType.get("file")),
+    identities: pick(config.identities, identityNames),
+    agents: selectedAgents,
+    channels: pick(config.channels, namesByType.get("channel")),
+    deployments: pick(config.deployments, namesByType.get("deployment"))
+  };
+}
 function coalesceChannelRenames(actions, config, state) {
   const creates = actions.filter((action) => action.action === "create" && action.address.type === "channel");
   const deletes = actions.filter((action) => action.action === "delete" && action.address.type === "channel");
@@ -8180,6 +8657,9 @@ async function refreshState(state, providers, options = {}) {
   const errors = [];
   let dirty = false;
   for (const res of resources) {
+    if (options.resourceKeys && !options.resourceKeys.has(addressKey(res.address))) {
+      continue;
+    }
     if (options.targetProviders && !options.targetProviders.includes(res.address.provider)) {
       continue;
     }
@@ -8293,18 +8773,26 @@ async function refreshState(state, providers, options = {}) {
 }
 
 // src/internal/core/resource-runtime.ts
+async function planProjectWithStateBackend(input, options = {}) {
+  return readProjectRuntime(input, (ctx) => planProjectContext(ctx, options));
+}
 async function syncProjectResourcesWithStateBackend(input, options = {}) {
   return writeProjectRuntime(input, async (ctx) => {
     const planned = await planProjectContext(ctx, options);
     if (options.refreshOnly) {
       return { planned };
     }
+    if (options.mode === "create-only") {
+      const errorDiagnostic = planned.plan.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+      if (errorDiagnostic) throw new UserError(errorDiagnostic.message);
+    }
     return {
       planned,
       execution: await executePlannedProject(planned, {
         onFeedback: options.onFeedback,
         policy: options.policy,
-        confirm: options.confirm
+        confirm: options.confirm,
+        concurrency: options.concurrency
       })
     };
   });
@@ -8366,26 +8854,103 @@ async function importResource(ctx, address, remoteId, options = {}) {
   return resource;
 }
 async function planProjectContext(ctx, options = {}) {
-  const targetProviders = resolveTargetProviders2(options.provider);
+  if (options.mode === "create-only" && !options.scope) {
+    throw new UserError("Resource create-only mode requires an explicit resource scope.");
+  }
+  let targetProviders = resolveTargetProviders2(options.provider);
+  if (!targetProviders && options.scope) {
+    targetProviders = [...new Set(options.scope.roots.map((root) => root.provider))];
+  }
+  const selectedAddresses = options.scope ? resolvePlanScope(ctx, targetProviders ?? [], options.scope) : void 0;
+  const resourceKeys = selectedAddresses ? new Set(selectedAddresses.map(addressKey)) : void 0;
   const refreshResult = options.refresh !== false && ctx.state.listResources().length > 0 ? await refreshState(ctx.state, ctx.providers, {
     targetProviders,
+    resourceKeys,
     config: ctx.config,
     quiet: options.quiet ?? true,
     onFeedback: options.onFeedback
   }) : void 0;
-  const plan = await buildPlan(ctx.config, ctx.state.getStateFile(), {
+  let plan = await buildPlan(ctx.config, ctx.state.getStateFile(), {
     providers: targetProviders,
-    configPath: ctx.configPath
+    configPath: ctx.configPath,
+    resourceAddresses: selectedAddresses
   });
+  if (options.mode === "create-only" && options.scope) {
+    plan = enforceCreateOnlyPlan(plan, options.scope, toResourceRefreshResult(refreshResult));
+  }
   return {
     executionContext: ctx,
     plan,
     refreshResult: toResourceRefreshResult(refreshResult),
     targetProviders,
-    destructiveActions: selectDestructive(plan.actions)
+    destructiveActions: selectDestructive(plan.actions),
+    selectedAddresses,
+    mode: options.mode
+  };
+}
+function enforceCreateOnlyPlan(plan, scope, refreshResult) {
+  const reasons = [];
+  const rootKeys = new Set(scope.roots.map(addressKey));
+  const refreshError = refreshResult?.errors[0];
+  if (refreshError) {
+    reasons.push(
+      `Cannot verify scoped dependencies because refresh failed for ${addressKey(refreshError.resource.address)}: ${refreshError.error}`
+    );
+  }
+  for (const root of scope.roots) {
+    const rootKey = addressKey(root);
+    const rootAction = plan.actions.find((action) => addressKey(action.address) === rootKey);
+    if (!rootAction) {
+      reasons.push(`Scoped plan did not contain target resource ${rootKey}.`);
+    } else if (rootAction.action !== "create") {
+      reasons.push(`Target resource ${rootKey} must be new, but the scoped plan requires '${rootAction.action}'.`);
+    }
+  }
+  const dependencyChanges = plan.actions.filter(
+    (action) => !rootKeys.has(addressKey(action.address)) && action.action !== "no-op"
+  );
+  if (dependencyChanges.length > 0) {
+    const labels = dependencyChanges.map((action) => `${addressKey(action.address)} (${action.action})`).join(", ");
+    reasons.push(`Create-only requires every scoped dependency to be up-to-date. Reconcile first: ${labels}.`);
+  }
+  if (reasons.length === 0) return plan;
+  return {
+    ...plan,
+    diagnostics: [
+      ...plan.diagnostics,
+      {
+        severity: "error",
+        code: "resource.create_only.blocked",
+        message: reasons.join(" "),
+        resource: scope.roots[0]
+      }
+    ]
   };
 }
+function resolvePlanScope(ctx, targetProviders, scope) {
+  if (scope.roots.length === 0) {
+    throw new UserError("Resource plan scope requires at least one root address.");
+  }
+  for (const root of scope.roots) {
+    if (!targetProviders.includes(root.provider)) {
+      throw new UserError(
+        `Scoped resource ${addressKey(root)} is outside the selected provider set: ${targetProviders.join(", ")}.`
+      );
+    }
+  }
+  const graph = buildDependencyGraph(ctx.config, targetProviders);
+  for (const root of scope.roots) {
+    if (!graph.nodes.has(addressKey(root))) {
+      throw new UserError(`Scoped resource ${addressKey(root)} is not declared in the project config.`);
+    }
+  }
+  return scope.includeDependencies === false ? [...scope.roots] : collectDependencyClosure(graph, scope.roots);
+}
 async function executePlannedProject(planned, options = {}) {
+  if (planned.mode === "create-only") {
+    const errorDiagnostic = planned.plan.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+    if (errorDiagnostic) throw new UserError(errorDiagnostic.message);
+  }
   const decision = await decideDestructive(planned.destructiveActions, {
     policy: options.policy,
     confirm: options.confirm
@@ -8403,7 +8968,8 @@ async function executePlannedProject(planned, options = {}) {
       configPath: ctx.configPath,
       providers: ctx.providers,
       state: ctx.state,
-      onFeedback: options.onFeedback
+      onFeedback: options.onFeedback,
+      createOnly: planned.mode === "create-only"
     },
     { concurrency: options.concurrency }
   );
@@ -8428,13 +8994,6 @@ async function decideDestructive(destructiveActions, options = {}) {
       return "blocked";
   }
 }
-function replaceResourcePlan(planned, plan) {
-  return {
-    ...planned,
-    plan,
-    destructiveActions: selectDestructive(plan.actions)
-  };
-}
 function toResourceRefreshResult(result) {
   if (!result) return void 0;
   return {
@@ -8456,6 +9015,124 @@ function toResourceExecutionResult(result) {
   };
 }
 
+// src/internal/core/project-source-security.ts
+import { basename as basename8, dirname as dirname11 } from "path";
+import { isScalar, parseDocument, visit } from "yaml";
+var REDACTED = "[redacted]";
+var ENVIRONMENT_REFERENCE = /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/;
+var SENSITIVE_KEY = /(access[_-]?key(?:[_-]?id)?|api[_-]?key|authorization|credential|headers?|password|secret(?![_-]?name)|signature|token)/i;
+async function inspectProjectSource(source, configPath) {
+  const document = parseDocument(source, { keepSourceTokens: true, prettyErrors: true });
+  if (document.errors.length > 0) {
+    return {
+      diagnostics: document.errors.map(() => ({
+        severity: "error",
+        code: "project.config.invalid",
+        message: "agents.yaml contains invalid YAML. Fix the syntax before creating or restoring a version."
+      })),
+      redacted_source: "# Invalid agents.yaml source omitted from the safe preview.\n",
+      sensitive_literals: []
+    };
+  }
+  const rawConfig = document.toJS({ mapAsMap: false });
+  const displaySecrets = collectSensitiveScalars(rawConfig);
+  const sensitiveLiterals = [...displaySecrets].filter((value) => !ENVIRONMENT_REFERENCE.test(value));
+  let diagnostics;
+  try {
+    const loaded = await resolveProjectConfigFromObject(rawConfig, {
+      projectName: basename8(dirname11(configPath)),
+      basePath: dirname11(configPath)
+    });
+    diagnostics = validateProjectConfig(loaded.config);
+  } catch (error) {
+    diagnostics = [
+      {
+        severity: "error",
+        code: "project.config.invalid",
+        message: error instanceof Error ? error.message : String(error)
+      }
+    ];
+  }
+  if (sensitiveLiterals.length > 0) {
+    diagnostics.push({
+      severity: "error",
+      code: "project.version.sensitive_literal",
+      message: "agents.yaml contains a credential value in a sensitive field. Replace it with an environment variable reference before creating or restoring a version."
+    });
+  }
+  return {
+    diagnostics: redactDiagnostics(diagnostics, displaySecrets),
+    redacted_source: redactDocumentSource(source, document, displaySecrets),
+    sensitive_literals: sensitiveLiterals.map(() => REDACTED)
+  };
+}
+function collectSensitiveScalars(value, result = /* @__PURE__ */ new Set(), key = "", ancestorSensitive = false) {
+  if (Array.isArray(value)) {
+    const nestedSensitive = ancestorSensitive || isSensitiveValueKey(key);
+    for (const entry of value) collectSensitiveScalars(entry, result, key, nestedSensitive);
+    return result;
+  }
+  if (isRecord2(value)) {
+    const nestedSensitive = ancestorSensitive || isSensitiveContainerKey(key);
+    for (const [entryKey, entry] of Object.entries(value)) {
+      collectSensitiveScalars(entry, result, entryKey, nestedSensitive);
+    }
+    return result;
+  }
+  if ((ancestorSensitive || isSensitiveValueKey(key)) && (typeof value === "string" || typeof value === "number") && String(value).length > 0) {
+    result.add(String(value));
+  }
+  return result;
+}
+function isSensitiveContainerKey(key) {
+  return ["header", "headers", "authorization"].includes(key.toLowerCase().replaceAll("-", "_"));
+}
+function isSensitiveValueKey(key) {
+  const normalized = key.toLowerCase().replaceAll("-", "_");
+  if (normalized === "secret_name" || normalized === "credentials") return false;
+  return SENSITIVE_KEY.test(normalized);
+}
+function redactDocumentSource(source, document, secrets) {
+  if (secrets.size === 0) return source;
+  const redactedDocument = document.clone();
+  visit(redactedDocument, (_key, node) => {
+    if (isScalar(node) && (typeof node.value === "string" || typeof node.value === "number")) {
+      const value = String(node.value);
+      const redacted = redactText(value, secrets);
+      if (redacted !== value) {
+        node.value = redacted;
+        node.source = redacted;
+        node.type = "PLAIN";
+      }
+    }
+    redactComments(node, secrets);
+  });
+  redactComments(redactedDocument, secrets);
+  return redactedDocument.toString();
+}
+function redactText(source, secrets) {
+  let redacted = source;
+  for (const secret of [...secrets].sort((left, right) => right.length - left.length)) {
+    redacted = redacted.replaceAll(secret, REDACTED);
+  }
+  return redacted;
+}
+function redactComments(value, secrets) {
+  if (!value || typeof value !== "object") return;
+  const commented = value;
+  if (commented.comment) commented.comment = redactText(commented.comment, secrets);
+  if (commented.commentBefore) commented.commentBefore = redactText(commented.commentBefore, secrets);
+}
+function redactDiagnostics(diagnostics, secrets) {
+  return diagnostics.map((diagnostic) => ({
+    ...diagnostic,
+    message: redactText(diagnostic.message, secrets)
+  }));
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/internal/core/sync-runtime.ts
 import { stringify as stringifyYaml } from "yaml";
 var SYNCABLE_GROUP = {
@@ -8783,6 +9460,378 @@ function buildDeploymentContext(ctx, name, provider) {
   };
 }
 
+// src/internal/core/managed-api-runtime.ts
+function resolveAdapter(ctx, provider) {
+  if (provider) return getRuntimeProvider(ctx, provider);
+  const configured = Array.from(ctx.providers.keys());
+  if (configured.length === 1) return getRuntimeProvider(ctx, configured[0]);
+  throw new UserError("Multiple providers configured. Use --provider to specify one.");
+}
+function requiredMethod(value, provider, operation) {
+  if (value) return value;
+  throw new UserError(`Provider '${provider}' does not support ${operation}.`);
+}
+async function listRemoteAgents(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listAgentResources, adapter2.name, "agent listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteAgent(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getRemoteAgent, adapter2.name, "agent lookup");
+  return method2.call(adapter2, id, options.version);
+}
+async function listRemoteAgentVersions(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listAgentVersions, adapter2.name, "agent version listing");
+  return method2.call(adapter2, id, options);
+}
+async function listRemoteEnvironments(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listEnvironmentResources, adapter2.name, "environment listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteEnvironment(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getRemoteEnvironment, adapter2.name, "environment lookup");
+  return method2.call(adapter2, id);
+}
+async function listRemoteVaults(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listVaultResources, adapter2.name, "vault listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteVault(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getRemoteVault, adapter2.name, "vault lookup");
+  return method2.call(adapter2, id);
+}
+async function listRemoteSkills(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listSkillResources, adapter2.name, "skill listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteSkill(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getSkillInfo, adapter2.name, "skill lookup");
+  return method2.call(adapter2, id);
+}
+async function listRemoteSkillVersions(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listSkillVersions, adapter2.name, "skill version listing");
+  return method2.call(adapter2, id, options);
+}
+async function getRemoteSkillVersion(ctx, id, version, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getSkillVersion, adapter2.name, "skill version lookup");
+  return method2.call(adapter2, id, version);
+}
+async function getRemoteSkillDownloadInfo(ctx, id, version, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getSkillDownloadInfo, adapter2.name, "skill version download");
+  return method2.call(adapter2, id, version);
+}
+async function downloadRemoteSkill(ctx, id, version, options = {}) {
+  const info = await getRemoteSkillDownloadInfo(ctx, id, version, options);
+  const response = await resolveFetch()(info.file_url, { method: "GET" });
+  if (!response.ok) {
+    throw new ApiError(response.status, await response.text(), "Skill download failed");
+  }
+  return new Uint8Array(await response.arrayBuffer());
+}
+async function listRemoteFiles(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listFileResources, adapter2.name, "file listing");
+  return method2.call(adapter2, options);
+}
+async function downloadRemoteFile(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.downloadFileContent, adapter2.name, "file content download");
+  return method2.call(adapter2, id);
+}
+async function updateRemoteSession(ctx, id, input, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.updateSession, adapter2.name, "session update");
+  return method2.call(adapter2, id, input);
+}
+async function archiveRemoteSession(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.archiveSession, adapter2.name, "session archive");
+  return method2.call(adapter2, id);
+}
+async function sendRemoteSessionEvents(ctx, id, events, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.sendSessionEvents, adapter2.name, "generic session event sending");
+  return method2.call(adapter2, id, events);
+}
+async function listRemoteDeployments(ctx, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listDeployments, adapter2.name, "deployment listing");
+  return method2.call(adapter2, options);
+}
+async function getRemoteDeployment(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getDeploymentById, adapter2.name, "deployment lookup");
+  return method2.call(adapter2, id);
+}
+async function runRemoteDeployment(ctx, id, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.runDeploymentById, adapter2.name, "deployment run");
+  return method2.call(adapter2, id);
+}
+async function setRemoteDeploymentPaused(ctx, id, paused, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = paused ? adapter2.pauseDeploymentById : adapter2.unpauseDeploymentById;
+  return requiredMethod(method2, adapter2.name, `${paused ? "pausing" : "unpausing"} deployments`).call(adapter2, id);
+}
+async function listRemoteDeploymentRuns(ctx, deploymentId, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.listDeploymentRuns, adapter2.name, "deployment run listing");
+  return method2.call(adapter2, deploymentId, options);
+}
+async function getRemoteDeploymentRun(ctx, runId, options = {}) {
+  const adapter2 = resolveAdapter(ctx, options.provider);
+  const method2 = requiredMethod(adapter2.getDeploymentRun, adapter2.name, "deployment run lookup");
+  return method2.call(adapter2, runId);
+}
+var API_KEY = { supported: true, auth: "api_key" };
+var CLIENT_SEARCH = {
+  supported: true,
+  auth: "api_key",
+  reason: "Client-side filtering over the corresponding list API."
+};
+var UNSUPPORTED_MODEL = {
+  supported: false,
+  auth: null,
+  reason: "The public Managed Agents API does not expose a model catalog endpoint."
+};
+var UNSUPPORTED_THREAD = {
+  supported: false,
+  auth: null,
+  reason: "Managed Agents exposes child-thread ids and lifecycle events through Session Events, but no independent Thread resource API."
+};
+var UNSUPPORTED_OAUTH = {
+  supported: false,
+  auth: null,
+  reason: "The public Managed Agents data plane does not expose MCP OAuth login."
+};
+var BAILIAN_OPERATIONS = {
+  "agent.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "agent.list": API_KEY,
+  "agent.get": API_KEY,
+  "agent.search": CLIENT_SEARCH,
+  "agent.versions": API_KEY,
+  "environment.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "environment.list": API_KEY,
+  "environment.get": API_KEY,
+  "environment.search": CLIENT_SEARCH,
+  "skill.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "skill.list": API_KEY,
+  "skill.get": API_KEY,
+  "skill.search": CLIENT_SEARCH,
+  "skill.versions": API_KEY,
+  "skill.download": API_KEY,
+  "vault.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "vault.credential.create": {
+    ...API_KEY,
+    reason: "YAML declaration plus scoped Vault transaction; Bailian supports environment_variable credentials only."
+  },
+  "vault.list": API_KEY,
+  "vault.get": API_KEY,
+  "vault.search": CLIENT_SEARCH,
+  "deployment.create": { ...API_KEY, reason: "YAML declaration plus scoped create-only apply." },
+  "deployment.list": API_KEY,
+  "deployment.get": API_KEY,
+  "deployment.search": { ...API_KEY, reason: "Maps to the server-side keyword parameter." },
+  "deployment.runs.list": API_KEY,
+  "deployment.runs.get": API_KEY,
+  "deployment.run": API_KEY,
+  "deployment.pause": API_KEY,
+  "deployment.unpause": API_KEY,
+  "session.create": API_KEY,
+  "session.list": API_KEY,
+  "session.get": API_KEY,
+  "session.search": CLIENT_SEARCH,
+  "session.update": API_KEY,
+  "session.archive": API_KEY,
+  "session.delete": API_KEY,
+  "session.run": { ...API_KEY, reason: "Client composition of session create and event send/stream." },
+  "session.event.send": API_KEY,
+  "session.event.list": API_KEY,
+  "session.event.stream": API_KEY,
+  "session.debug": { ...API_KEY, reason: "Client-side aggregation of supported read APIs." },
+  "session.export": { ...API_KEY, reason: "Client-side export of supported read APIs." },
+  "file.upload": API_KEY,
+  "file.list": API_KEY,
+  "file.get": API_KEY,
+  "file.search": CLIENT_SEARCH,
+  "file.download": API_KEY,
+  "file.delete": API_KEY,
+  "model.list": UNSUPPORTED_MODEL,
+  "model.search": UNSUPPORTED_MODEL,
+  "session_thread.list": UNSUPPORTED_THREAD,
+  "session_thread.get": UNSUPPORTED_THREAD,
+  "session_thread.archive": UNSUPPORTED_THREAD,
+  "session_thread.events": UNSUPPORTED_THREAD,
+  "mcp.oauth_login": UNSUPPORTED_OAUTH
+};
+function getManagedAgentProviderCapabilities(provider) {
+  if (provider === "bailian") {
+    return { provider, operations: { ...BAILIAN_OPERATIONS } };
+  }
+  return {
+    provider,
+    operations: {
+      "managed_agent.api": {
+        supported: false,
+        auth: null,
+        reason: "The operation-level API command surface is currently implemented for Bailian only."
+      }
+    }
+  };
+}
+
+// src/internal/core/vault-credential-runtime.ts
+async function planVaultCredentialCreate(ctx, vaultName, credentialName, options = {}) {
+  const prepared = await prepareVaultCredentialCreate(ctx, vaultName, credentialName, options);
+  return {
+    provider: prepared.provider,
+    vault: vaultName,
+    vaultRemoteId: prepared.vaultState.remote_id,
+    credential: credentialName,
+    remoteChecked: prepared.remoteChecked,
+    reuseRemote: Boolean(prepared.remoteCredential),
+    remoteCredentialId: prepared.remoteCredential?.id
+  };
+}
+async function planVaultCredentialCreateWithStateBackend(input, vaultName, credentialName, options = {}) {
+  return readProjectRuntime(input, (ctx) => planVaultCredentialCreate(ctx, vaultName, credentialName, options));
+}
+async function createVaultCredential(ctx, vaultName, credentialName, options = {}) {
+  if (options.checkRemote === false) {
+    throw new UserError("Vault Credential create requires the remote duplicate check.");
+  }
+  const prepared = await prepareVaultCredentialCreate(ctx, vaultName, credentialName, options);
+  const remote = prepared.remoteCredential ?? await prepared.adapter.createCredential(prepared.vaultState.remote_id, prepared.credential);
+  if (!remote.id) throw new UserError("Credential create returned no remote id.");
+  const address = { type: "vault", name: vaultName, provider: prepared.provider };
+  const desiredHash = await computeResourceHash(address, ctx.config, ctx.configPath, ctx.state);
+  ctx.state.setResource({
+    ...prepared.vaultState,
+    content_hash: desiredHash,
+    desired_hash: desiredHash,
+    drift_paths: [],
+    drift_status: "unchecked"
+  });
+  await ctx.state.save();
+  return {
+    provider: prepared.provider,
+    vault: vaultName,
+    vaultRemoteId: prepared.vaultState.remote_id,
+    credential: credentialName,
+    remoteChecked: prepared.remoteChecked,
+    credentialId: remote.id,
+    reuseRemote: Boolean(prepared.remoteCredential),
+    remoteCredentialId: prepared.remoteCredential?.id,
+    adopted: Boolean(prepared.remoteCredential)
+  };
+}
+async function createVaultCredentialWithStateBackend(input, vaultName, credentialName, options = {}) {
+  return writeProjectRuntime(input, (ctx) => createVaultCredential(ctx, vaultName, credentialName, options));
+}
+async function prepareVaultCredentialCreate(ctx, vaultName, credentialName, options) {
+  const vault = ctx.config.vaults?.[vaultName];
+  if (!vault) throw new UserError(`Vault '${vaultName}' is not declared in the project config.`);
+  const provider = resolveVaultProvider(ctx, vault.provider, options.provider);
+  const credential = vault.credentials.at(-1);
+  if (!credential || credential.name !== credentialName) {
+    throw new UserError(`Credential '${credentialName}' must be the final newly appended entry in vault.${vaultName}.`);
+  }
+  if (vault.credentials.slice(0, -1).some((entry) => entry.name === credentialName)) {
+    throw new UserError(`Vault '${vaultName}' already declares a credential named '${credentialName}'.`);
+  }
+  if (provider === "bailian" && credential.type !== "environment_variable") {
+    throw new UserError(
+      `Credential '${credentialName}' uses '${credential.type}', but Bailian only supports 'environment_variable' credentials.`
+    );
+  }
+  const address = { type: "vault", name: vaultName, provider };
+  const priorConfig = structuredClone(ctx.config);
+  priorConfig.vaults[vaultName] = {
+    ...priorConfig.vaults[vaultName],
+    credentials: priorConfig.vaults[vaultName].credentials.slice(0, -1)
+  };
+  const priorPlan = await planProjectContext(
+    { ...ctx, config: priorConfig },
+    {
+      provider,
+      scope: { roots: [address] },
+      refresh: options.refresh,
+      quiet: options.quiet ?? true
+    }
+  );
+  const refreshError = priorPlan.refreshResult?.errors[0];
+  if (refreshError) {
+    throw new UserError(`Cannot verify vault.${vaultName} because refresh failed: ${refreshError.error}`);
+  }
+  const errorDiagnostic = priorPlan.plan.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+  if (errorDiagnostic) throw new UserError(errorDiagnostic.message);
+  const vaultAction = priorPlan.plan.actions.find(
+    (action) => action.address.type === "vault" && action.address.name === vaultName
+  );
+  if (vaultAction?.action !== "no-op") {
+    throw new UserError(
+      `vault.${vaultName} must be tracked and up-to-date before adding a credential; current action is '${vaultAction?.action ?? "missing"}'.`
+    );
+  }
+  const vaultState = ctx.state.getResource(address);
+  if (!vaultState?.remote_id) throw new UserError(`vault.${vaultName} has no tracked remote id.`);
+  const adapter2 = getRuntimeProvider(ctx, provider);
+  if (!adapter2.createCredential || !adapter2.listCredentials) {
+    throw new UserError(`Provider '${provider}' does not support scoped Vault Credential create.`);
+  }
+  const remoteChecked = options.checkRemote !== false;
+  const sameName = remoteChecked ? (await adapter2.listCredentials(vaultState.remote_id)).filter(
+    (remoteCredential) => remoteCredential.display_name === credentialName
+  ) : [];
+  const exact = sameName.find((remoteCredential) => credentialMatches(remoteCredential, credential));
+  if (sameName.length > 0 && !exact) {
+    throw new UserError(`Vault '${vaultName}' already has a different remote credential named '${credentialName}'.`);
+  }
+  return { provider, credential, vaultState, adapter: adapter2, remoteChecked, remoteCredential: exact };
+}
+function resolveVaultProvider(ctx, declaredProvider, requestedProvider) {
+  if (requestedProvider && declaredProvider && requestedProvider !== declaredProvider) {
+    throw new UserError(
+      `Vault provider '${declaredProvider}' does not match requested provider '${requestedProvider}'.`
+    );
+  }
+  const provider = requestedProvider ?? declaredProvider ?? ctx.config.defaults?.provider;
+  if (provider && provider !== "all") return provider;
+  const configured = [...ctx.providers.keys()];
+  if (configured.length === 1) return configured[0];
+  throw new UserError("Cannot infer one provider for Vault Credential create.");
+}
+function credentialMatches(remote, desired) {
+  if (remote.auth_type !== desired.type || !metadataMatches(remote.metadata, desired.metadata)) return false;
+  if (desired.type === "static_bearer") return remote.mcp_server_url === desired.mcp_server_url;
+  const desiredHosts = credentialHosts(desired.networking);
+  const remoteHosts = credentialHosts(remote.networking ?? { type: remote.networking_type });
+  const desiredLocation = desired.injection_location;
+  const remoteLocation = remote.injection_location;
+  if (desiredLocation && !remoteLocation) return false;
+  return remote.secret_name === desired.secret_name && desiredHosts !== void 0 && remoteHosts !== void 0 && desiredHosts.length === remoteHosts.length && desiredHosts.every((host) => remoteHosts.includes(host)) && (desiredLocation?.header ?? true) === (remoteLocation?.header ?? true) && (desiredLocation?.body ?? false) === (remoteLocation?.body ?? false);
+}
+function credentialHosts(networking) {
+  if (networking?.allowed_hosts !== void 0) return [...new Set(networking.allowed_hosts)];
+  return networking?.type === "limited" ? void 0 : ["*"];
+}
+function metadataMatches(remote, desired) {
+  const remoteEntries = Object.entries(remote ?? {});
+  const desiredEntries = Object.entries(desired ?? {});
+  return remoteEntries.length === desiredEntries.length && desiredEntries.every(([key, value]) => remote?.[key] === value);
+}
+
 // src/internal/core/destroy-runtime.ts
 var destroyOrder = {
   deployment: 0,
@@ -8805,11 +9854,14 @@ function planDestroyProjectContext(ctx) {
   for (const [agentName, agent] of Object.entries(ctx.config.agents ?? {})) {
     if (!agent.default_memory_store || agent.delivery?.qoder?.type !== "forward") continue;
     if (agent.provider && agent.provider !== "qoder") continue;
+    const identityId = identityName ? ctx.state.getResource({ type: "identity", name: identityName, provider: "qoder" })?.remote_id ?? null : null;
+    const templateId = ctx.state.getResource({ type: "template", name: agentName, provider: "qoder" })?.remote_id ?? null;
+    if (!identityId && !templateId) continue;
     defaultMemoryStores.push({
       agentName,
       provider: "qoder",
-      identityId: identityName ? ctx.state.getResource({ type: "identity", name: identityName, provider: "qoder" })?.remote_id ?? null : null,
-      templateId: ctx.state.getResource({ type: "template", name: agentName, provider: "qoder" })?.remote_id ?? null,
+      identityId,
+      templateId,
       deleteOnDestroy: agent.default_memory_store.delete_on_destroy ?? false
     });
   }
@@ -9322,6 +10374,7 @@ function buildAgentDecl(base, input) {
   });
   const agent = {
     ...base ?? {},
+    name: input.name ?? base?.name,
     description: input.description ?? base?.description,
     model,
     instructions: input.instructions ?? base?.instructions ?? "",
@@ -9365,6 +10418,7 @@ function buildSessionBindings(agentName, config, provider, state, options = {})
     throw new UserError(`Agent '${agentName}' not found in config. Available agents: ${available || "(none)"}`);
   }
   const sessionResources = options.resources ?? agent.resources;
+  const sessionFiles = resolveSessionFiles(agentName, agent, provider, state, options.files ?? []);
   const environmentVariables = options.environmentVariables ?? agent.environment_variables;
   if (environmentVariables && provider !== "qoder") {
     throw new UserError("Session environment variables are supported only by Qoder.");
@@ -9395,7 +10449,7 @@ function buildSessionBindings(agentName, config, provider, state, options = {})
       delivery: "forward",
       template_id: templateId,
       identity_id: identityId,
-      files: (options.files ?? []).map((file) => ({ file_id: file.fileId, mount_path: file.mountPath })),
+      files: sessionFiles,
       title: options.title,
       metadata: options.metadata,
       environment_variables: environmentVariables
@@ -9440,13 +10494,41 @@ function buildSessionBindings(agentName, config, provider, state, options = {})
     tunnel_id: tunnelId,
     vault_ids: vaultIds,
     memory_store_ids: memoryStoreIds,
-    files: (options.files ?? []).map((f) => ({ file_id: f.fileId, mount_path: f.mountPath })),
+    files: sessionFiles,
     resources: sessionResources,
     title: options.title,
     metadata: options.metadata,
     environment_variables: environmentVariables
   };
 }
+function resolveSessionFiles(agentName, agent, provider, state, explicitFiles) {
+  const resolved = [];
+  const mountOwners = /* @__PURE__ */ new Map();
+  for (const file of agent.files ?? []) {
+    if (typeof file === "string") continue;
+    const mountPath = resolveSandboxMountPath(provider, file.mount_path);
+    assertUniqueMountPath(mountOwners, mountPath, `declared file '${file.file}'`, agentName);
+    resolved.push({
+      file_id: requireRef(state, { type: "file", name: file.file, provider }),
+      mount_path: mountPath
+    });
+  }
+  for (const file of explicitFiles) {
+    const mountPath = resolveSandboxMountPath(provider, file.mountPath);
+    assertUniqueMountPath(mountOwners, mountPath, `Session file '${file.fileId}'`, agentName);
+    resolved.push({ file_id: file.fileId, mount_path: mountPath });
+  }
+  return resolved;
+}
+function assertUniqueMountPath(mountOwners, mountPath, owner, agentName) {
+  const existing = mountOwners.get(mountPath);
+  if (existing) {
+    throw new UserError(
+      `Agent '${agentName}' cannot mount ${owner} at '${mountPath}'; the path is already used by ${existing}.`
+    );
+  }
+  mountOwners.set(mountPath, owner);
+}
 function resolveTunnelId(agent, config, options, provider) {
   const tunnelName = options.tunnel ?? agent.tunnel;
   if (!options.tunnelId && !tunnelName) return void 0;
@@ -9466,6 +10548,74 @@ function validateResourceInConfig(name, type, resources) {
   }
 }
 
+// src/internal/state/backend.ts
+function cloneStateFile(state) {
+  return structuredClone(state);
+}
+
+// src/internal/state/in-memory-state-manager.ts
+var InMemoryStateManager = class _InMemoryStateManager {
+  state;
+  index;
+  constructor(state) {
+    this.state = state;
+    this.index = this.buildIndex();
+  }
+  buildIndex() {
+    const idx = /* @__PURE__ */ new Map();
+    for (let i = 0; i < this.state.resources.length; i++) {
+      idx.set(addressKey(this.state.resources[i].address), i);
+    }
+    return idx;
+  }
+  static fromJSON(data) {
+    return new _InMemoryStateManager(structuredClone(data));
+  }
+  static empty() {
+    return new _InMemoryStateManager({ resources: [] });
+  }
+  getResource(address) {
+    const i = this.index.get(addressKey(address));
+    return i !== void 0 ? this.state.resources[i] : void 0;
+  }
+  setResource(resource) {
+    const key = addressKey(resource.address);
+    const i = this.index.get(key);
+    if (i !== void 0) {
+      this.state.resources[i] = resource;
+    } else {
+      this.index.set(key, this.state.resources.length);
+      this.state.resources.push(resource);
+    }
+  }
+  removeResource(address) {
+    const key = addressKey(address);
+    const i = this.index.get(key);
+    if (i === void 0) return;
+    this.state.resources.splice(i, 1);
+    this.index.delete(key);
+    for (let j = i; j < this.state.resources.length; j++) {
+      this.index.set(addressKey(this.state.resources[j].address), j);
+    }
+  }
+  listResources() {
+    return [...this.state.resources];
+  }
+  findResource(query2) {
+    return this.state.resources.find((resource) => {
+      const matchType = resource.address.type === query2.type;
+      const matchName = resource.address.name === query2.name;
+      const matchProvider = !query2.provider || resource.address.provider === query2.provider;
+      return matchType && matchName && matchProvider;
+    });
+  }
+  getStateFile() {
+    return this.state;
+  }
+  async save() {
+  }
+};
+
 // src/internal/core/agent-runtime.ts
 function listAgents(ctx) {
   const agents = ctx.config.agents ?? {};
@@ -9556,34 +10706,64 @@ async function listAgentsWithReadiness(ctx, options = {}) {
     readiness: getAgentReadinessFromPlan(ctx, agent.id, planResult.plan)
   }));
 }
+function isAgentRunnable(readiness) {
+  return readiness.status === "ready" || readiness.status === "drifted" && readiness.driftSeverity === "non_blocking";
+}
 async function planAgentResources(ctx, agentId, options = {}) {
   const agent = getAgent(ctx, agentId);
+  const addresses = collectAgentAddresses(ctx.config, agent.agentName, agent.provider);
   const planned = await planProjectContext(ctx, {
     provider: agent.provider,
+    scope: { roots: options.scope === "runtime" ? addresses : [addresses[0]] },
+    mode: options.mode,
     refresh: options.refresh,
-    quiet: options.quiet ?? true
+    quiet: options.quiet ?? true,
+    onFeedback: options.onFeedback
   });
-  const actions = filterAgentActions(ctx, agent, planned.plan);
+  const actions = planned.plan.actions;
+  const diagnostics = planned.plan.diagnostics;
   return {
     agentId,
     provider: agent.provider,
+    fingerprint: computeAgentPlanFingerprint(agentId, agent.provider, actions, diagnostics),
     actions,
-    diagnostics: filterAgentDiagnostics(ctx, agent, planned.plan),
+    diagnostics,
     destructiveActions: selectDestructive(actions),
     planned
   };
 }
+async function planAgentResourcesWithStateBackend(input, agentId, options = {}) {
+  return readProjectRuntime(input, (ctx) => planAgentResources(ctx, agentId, options));
+}
 async function syncAgentResources(ctx, agentId, options = {}) {
   return runAgentSync(ctx, agentId, options);
 }
 async function runAgentSync(ctx, agentId, options) {
-  const fullPlan = await planAgentResources(ctx, agentId, {
+  const transactionalState = options.expectedPlanFingerprint ? InMemoryStateManager.fromJSON(cloneStateFile(ctx.state.getStateFile())) : void 0;
+  const planningContext = transactionalState ? { ...ctx, state: transactionalState } : ctx;
+  const fullPlan = await planAgentResources(planningContext, agentId, {
     refresh: options.refresh,
-    quiet: options.quiet
+    quiet: options.quiet,
+    onFeedback: options.onFeedback,
+    scope: options.scope,
+    mode: options.mode
   });
   const actions = fullPlan.actions;
   const destructiveActions = fullPlan.destructiveActions;
   const errorDiagnostic = fullPlan.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+  if (options.expectedPlanFingerprint && options.expectedPlanFingerprint !== fullPlan.fingerprint) {
+    return {
+      agentId,
+      provider: fullPlan.provider,
+      status: "blocked",
+      reason: "plan_stale",
+      actions,
+      diagnostics: fullPlan.diagnostics,
+      destructiveActions,
+      results: [],
+      error: "The project or remote resources changed after planning. Create a new plan before applying."
+    };
+  }
   const decision = await decideDestructive(destructiveActions, {
     policy: options.policy,
     confirm: options.confirm
@@ -9593,6 +10773,7 @@ async function runAgentSync(ctx, agentId, options) {
       agentId,
       provider: fullPlan.provider,
       status: "blocked",
+      reason: decision === "cancelled" ? "cancelled" : "destructive_blocked",
       actions,
       diagnostics: fullPlan.diagnostics,
       destructiveActions,
@@ -9605,6 +10786,7 @@ async function runAgentSync(ctx, agentId, options) {
       agentId,
       provider: fullPlan.provider,
       status: "blocked",
+      reason: "diagnostic_error",
       actions,
       diagnostics: fullPlan.diagnostics,
       destructiveActions,
@@ -9613,13 +10795,11 @@ async function runAgentSync(ctx, agentId, options) {
     };
   }
   try {
-    const scopedPlan = {
-      diagnostics: fullPlan.diagnostics,
-      actions: scopePlanActions(fullPlan.planned.plan, actions)
-    };
-    const execution = await executePlannedProject(replaceResourcePlan(fullPlan.planned, scopedPlan), {
+    const execution = await executePlannedProject(fullPlan.planned, {
+      onFeedback: options.onFeedback,
       policy: "force"
     });
+    if (transactionalState) await replaceState(ctx.state, transactionalState);
     const results = toAgentSyncResults(execution);
     const failed = results.find((result) => result.status === "failed");
     return {
@@ -9633,6 +10813,7 @@ async function runAgentSync(ctx, agentId, options) {
       error: failed?.error
     };
   } catch (error) {
+    if (transactionalState) await replaceState(ctx.state, transactionalState);
     return {
       agentId,
       provider: fullPlan.provider,
@@ -9645,6 +10826,11 @@ async function runAgentSync(ctx, agentId, options) {
     };
   }
 }
+async function replaceState(target, source) {
+  for (const resource of target.listResources()) target.removeResource(resource.address);
+  for (const resource of source.listResources()) target.setResource(resource);
+  await target.save();
+}
 async function syncAgentResourcesWithStateBackend(input, agentId, options = {}) {
   return writeProjectRuntime(input, (ctx) => syncAgentResources(ctx, agentId, options));
 }
@@ -9721,25 +10907,6 @@ function getAgentReadinessFromPlan(ctx, agentId, plan) {
     plannedActions: relevantActions
   };
 }
-function filterAgentActions(ctx, agent, plan) {
-  const relevantKeys = agentAddressKeys(ctx, agent);
-  return plan.actions.filter(
-    (action) => relevantKeys.has(addressKey(action.address)) || action.dependencies.some((dependency) => relevantKeys.has(addressKey(dependency)))
-  );
-}
-function filterAgentDiagnostics(ctx, agent, plan) {
-  const relevantKeys = agentAddressKeys(ctx, agent);
-  return plan.diagnostics.filter(
-    (diagnostic) => !diagnostic.resource || relevantKeys.has(addressKey(diagnostic.resource))
-  );
-}
-function agentAddressKeys(ctx, agent) {
-  return new Set(collectAgentAddresses(ctx.config, agent.agentName, agent.provider).map(addressKey));
-}
-function scopePlanActions(fullPlan, agentActions) {
-  const allowedKeys = new Set(agentActions.filter((action) => action.action !== "no-op").map(actionKey));
-  return fullPlan.actions.filter((action) => action.action === "no-op" || allowedKeys.has(actionKey(action)));
-}
 function actionKey(action) {
   const address = action.address;
   return `${action.action}:${address.provider}:${address.type}:${address.name}`;
@@ -9755,33 +10922,48 @@ function collectAgentAddresses(config, agentName, provider) {
   }
   const resolvedProvider = provider ?? resolveSessionProvider(agentName, config, void 0);
   const materialization = resolveAgentMaterialization(resolvedProvider, agent);
-  const addresses = [
-    { type: materialization.resourceType, name: agentName, provider: resolvedProvider }
-  ];
-  if (agent.environment) {
-    addresses.push({
-      type: "environment",
-      name: agent.environment,
-      provider: resolvedProvider
-    });
-  }
-  if (agent.vault) {
-    addresses.push({ type: "vault", name: agent.vault, provider: resolvedProvider });
-  }
-  for (const name of agent.memory_stores ?? []) {
-    addresses.push({ type: "memory_store", name, provider: resolvedProvider });
-  }
-  for (const skill of agent.skills ?? []) {
-    if (typeof skill === "string") {
-      addresses.push({ type: "skill", name: skill, provider: resolvedProvider });
+  const rootAddress = {
+    type: materialization.resourceType,
+    name: agentName,
+    provider: resolvedProvider
+  };
+  const graph = buildDependencyGraph(config, [resolvedProvider]);
+  const roots = [rootAddress];
+  const visited = /* @__PURE__ */ new Set();
+  function collectRuntimeRoots(name) {
+    if (visited.has(name)) return;
+    visited.add(name);
+    const declaration = config.agents?.[name];
+    if (!declaration) return;
+    const type = resolveAgentMaterialization(resolvedProvider, declaration).resourceType;
+    if (type === "template" && config.defaults?.identity) {
+      roots.push({ type: "identity", name: config.defaults.identity, provider: resolvedProvider });
+    }
+    for (const subAgentName of declaration.multiagent?.agents ?? []) {
+      const subAgent = config.agents?.[subAgentName];
+      if (!subAgent) continue;
+      roots.push({
+        type: resolveAgentMaterialization(resolvedProvider, subAgent).resourceType,
+        name: subAgentName,
+        provider: resolvedProvider
+      });
+      collectRuntimeRoots(subAgentName);
     }
   }
-  for (const subAgent of agent.multiagent?.agents ?? []) {
-    const subDecl = config.agents?.[subAgent];
-    const subType = subDecl ? resolveAgentMaterialization(resolvedProvider, subDecl).resourceType : "agent";
-    addresses.push({ type: subType, name: subAgent, provider: resolvedProvider });
-  }
-  return addresses;
+  collectRuntimeRoots(agentName);
+  return collectDependencyClosure(graph, roots);
+}
+function computeAgentPlanFingerprint(agentId, provider, actions, diagnostics) {
+  const normalizedActions = actions.map((action) => ({
+    ...action,
+    dependencies: [...action.dependencies].sort((left, right) => addressKey(left).localeCompare(addressKey(right)))
+  })).sort((left, right) => actionKey(left).localeCompare(actionKey(right)));
+  const normalizedDiagnostics = [...diagnostics].sort((left, right) => {
+    const leftKey = `${left.resource ? addressKey(left.resource) : ""}:${left.severity}:${left.code}:${left.message}`;
+    const rightKey = `${right.resource ? addressKey(right.resource) : ""}:${right.severity}:${right.code}:${right.message}`;
+    return leftKey.localeCompare(rightKey);
+  });
+  return contentHash({ agentId, provider, actions: normalizedActions, diagnostics: normalizedDiagnostics });
 }
 function toAgentDefinition(config, agentName, agent) {
   return {
@@ -10008,12 +11190,20 @@ async function listSessionEvents(ctx, sessionId, options = {}) {
   const listOptions = {};
   if (options.limit !== void 0) listOptions.limit = options.limit;
   if (options.order !== void 0) listOptions.order = options.order;
+  if (options.types !== void 0) listOptions.types = options.types;
+  if (options.created_at_gt !== void 0) listOptions.created_at_gt = options.created_at_gt;
+  if (options.created_at_gte !== void 0) listOptions.created_at_gte = options.created_at_gte;
+  if (options.created_at_lt !== void 0) listOptions.created_at_lt = options.created_at_lt;
+  if (options.created_at_lte !== void 0) listOptions.created_at_lte = options.created_at_lte;
   const pageToken = options.page_token ?? options.page;
   if (pageToken !== void 0) listOptions.page_token = pageToken;
-  return resolveDirectAdapter(ctx, options.provider).listSessionEvents(
+  const result = await resolveDirectAdapter(ctx, options.provider).listSessionEvents(
     sessionId,
     Object.keys(listOptions).length > 0 ? listOptions : void 0
   );
+  if (!options.types || options.types.length === 0) return result;
+  const allowedTypes = new Set(options.types);
+  return { ...result, events: result.events.filter((event) => allowedTypes.has(event.raw_type)) };
 }
 async function uploadFile(ctx, content, filename, options = {}) {
   const adapter2 = resolveDirectAdapter(ctx, options.provider);
@@ -10063,12 +11253,89 @@ async function deleteSkill(ctx, id, options = {}) {
   await resolveDirectAdapter(ctx, options.provider).deleteSkill(id);
 }
 function streamSessionEvents(ctx, sessionId, options = {}) {
+  const adapter2 = resolveDirectAdapter(ctx, options.provider);
+  if (options.after_id && !adapter2.eventResume) {
+    return replaySessionEventsByPolling(adapter2, sessionId, options.after_id);
+  }
   const streamOptions = {};
   if (options.after_id !== void 0) streamOptions.after_id = options.after_id;
-  return resolveDirectAdapter(ctx, options.provider).streamSessionEvents(
-    sessionId,
-    Object.keys(streamOptions).length > 0 ? streamOptions : void 0
-  );
+  return adapter2.streamSessionEvents(sessionId, Object.keys(streamOptions).length > 0 ? streamOptions : void 0);
+}
+async function* replaySessionEventsByPolling(adapter2, sessionId, afterId) {
+  const history = await listAllSessionEventHistory(adapter2, sessionId);
+  const markerIndex = history.findIndex((event) => event.id === afterId);
+  if (markerIndex < 0) {
+    throw new UserError(`Session event '${afterId}' was not found; list session events and choose a valid event id.`);
+  }
+  const knownEventKeys = new Set(history.slice(0, markerIndex + 1).map(sessionEventKey));
+  for (const event of history.slice(markerIndex + 1)) {
+    const eventKey = sessionEventKey(event);
+    if (knownEventKeys.has(eventKey)) continue;
+    knownEventKeys.add(eventKey);
+    yield event;
+    if (event.type === "status" && isTerminalSessionStatus(event.status)) return;
+  }
+  while (true) {
+    const newEvents = await listNewSessionEvents(adapter2, sessionId, knownEventKeys);
+    for (const event of newEvents) {
+      const eventKey = sessionEventKey(event);
+      if (knownEventKeys.has(eventKey)) continue;
+      knownEventKeys.add(eventKey);
+      yield event;
+      if (event.type === "status" && isTerminalSessionStatus(event.status)) return;
+    }
+    const session = await adapter2.getSession(sessionId);
+    if (isTerminalSessionStatus(session.status)) return;
+    await delay2(DEFAULT_POLL_INTERVAL_MS);
+  }
+}
+async function listAllSessionEventHistory(adapter2, sessionId) {
+  const events = [];
+  const seenPageTokens = /* @__PURE__ */ new Set();
+  let pageToken;
+  while (true) {
+    const result = await adapter2.listSessionEvents(sessionId, {
+      limit: 100,
+      order: "asc",
+      ...pageToken ? { page_token: pageToken } : {}
+    });
+    events.push(...result.events);
+    if (!result.next_page) return events;
+    if (seenPageTokens.has(result.next_page)) {
+      throw new UserError("Session event pagination returned a repeated cursor.");
+    }
+    seenPageTokens.add(result.next_page);
+    pageToken = result.next_page;
+  }
+}
+async function listNewSessionEvents(adapter2, sessionId, knownEventKeys) {
+  const descendingEvents = [];
+  const seenPageTokens = /* @__PURE__ */ new Set();
+  let pageToken;
+  while (true) {
+    const result = await adapter2.listSessionEvents(sessionId, {
+      limit: 100,
+      order: "desc",
+      ...pageToken ? { page_token: pageToken } : {}
+    });
+    let reachedKnownEvent = false;
+    for (const event of result.events) {
+      if (knownEventKeys.has(sessionEventKey(event))) {
+        reachedKnownEvent = true;
+        break;
+      }
+      descendingEvents.push(event);
+    }
+    if (reachedKnownEvent || !result.next_page) return descendingEvents.reverse();
+    if (seenPageTokens.has(result.next_page)) {
+      throw new UserError("Session event pagination returned a repeated cursor.");
+    }
+    seenPageTokens.add(result.next_page);
+    pageToken = result.next_page;
+  }
+}
+function sessionEventKey(event) {
+  return event.id ?? `raw:${event.raw_type}:${JSON.stringify(event.raw)}`;
 }
 function resolveDirectAdapter(ctx, overrideProvider) {
   if (overrideProvider) return getRuntimeProvider(ctx, overrideProvider);
@@ -10141,7 +11408,7 @@ function delay2(ms) {
 import { readFileSync as readFileSync8 } from "fs";
 import { readFile as readFile5 } from "fs/promises";
 import { homedir } from "os";
-import { dirname as dirname11, join } from "path";
+import { dirname as dirname12, join } from "path";
 var AGENTS_CONFIG_PROVIDERS = ["bailian", "qoder", "ark", "claude"];
 var AGENTS_PROVIDER_FIELDS = {
   bailian: [
@@ -10210,7 +11477,7 @@ function loadDotEnv(startDir = process.cwd()) {
       return envPath;
     } catch {
     }
-    const parent = dirname11(dir);
+    const parent = dirname12(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -10294,7 +11561,7 @@ function parseStateAddress(address, options = {}) {
 
 // src/internal/state/state-manager.ts
 import { mkdir, readFile as readFile6, rename, unlink, writeFile } from "fs/promises";
-import { dirname as dirname12 } from "path";
+import { dirname as dirname13 } from "path";
 var StateManager = class _StateManager {
   state;
   path;
@@ -10385,7 +11652,7 @@ var StateManager = class _StateManager {
     return this.state;
   }
   async save() {
-    await mkdir(dirname12(this.path), { recursive: true });
+    await mkdir(dirname13(this.path), { recursive: true });
     const tmpPath = `${this.path}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
     try {
       await writeFile(tmpPath, `${JSON.stringify(this.state, null, 2)}
@@ -10407,74 +11674,6 @@ function deriveStatePath(configPath) {
   return /\.ya?ml$/i.test(configPath) ? configPath.replace(/\.ya?ml$/i, ".state.json") : `${configPath}.state.json`;
 }
 
-// src/internal/state/backend.ts
-function cloneStateFile(state) {
-  return structuredClone(state);
-}
-
-// src/internal/state/in-memory-state-manager.ts
-var InMemoryStateManager = class _InMemoryStateManager {
-  state;
-  index;
-  constructor(state) {
-    this.state = state;
-    this.index = this.buildIndex();
-  }
-  buildIndex() {
-    const idx = /* @__PURE__ */ new Map();
-    for (let i = 0; i < this.state.resources.length; i++) {
-      idx.set(addressKey(this.state.resources[i].address), i);
-    }
-    return idx;
-  }
-  static fromJSON(data) {
-    return new _InMemoryStateManager(structuredClone(data));
-  }
-  static empty() {
-    return new _InMemoryStateManager({ resources: [] });
-  }
-  getResource(address) {
-    const i = this.index.get(addressKey(address));
-    return i !== void 0 ? this.state.resources[i] : void 0;
-  }
-  setResource(resource) {
-    const key = addressKey(resource.address);
-    const i = this.index.get(key);
-    if (i !== void 0) {
-      this.state.resources[i] = resource;
-    } else {
-      this.index.set(key, this.state.resources.length);
-      this.state.resources.push(resource);
-    }
-  }
-  removeResource(address) {
-    const key = addressKey(address);
-    const i = this.index.get(key);
-    if (i === void 0) return;
-    this.state.resources.splice(i, 1);
-    this.index.delete(key);
-    for (let j = i; j < this.state.resources.length; j++) {
-      this.index.set(addressKey(this.state.resources[j].address), j);
-    }
-  }
-  listResources() {
-    return [...this.state.resources];
-  }
-  findResource(query2) {
-    return this.state.resources.find((resource) => {
-      const matchType = resource.address.type === query2.type;
-      const matchName = resource.address.name === query2.name;
-      const matchProvider = !query2.provider || resource.address.provider === query2.provider;
-      return matchType && matchName && matchProvider;
-    });
-  }
-  getStateFile() {
-    return this.state;
-  }
-  async save() {
-  }
-};
-
 // src/internal/state/local-file-state-backend.ts
 var LocalFileStateBackend = class {
   configPath;
@@ -10600,7 +11799,8 @@ var CloudAgentSchema = z6.object({
   workspace_id: z6.string().optional(),
   created_at: z6.string().optional(),
   updated_at: z6.string().optional(),
-  archived_at: z6.string().nullish()
+  archived_at: z6.string().nullish(),
+  attributes: z6.record(z6.string(), z6.unknown()).optional()
 });
 var ListCloudAgentsResponseSchema = z6.object({
   agents: z6.array(CloudAgentSchema)
@@ -10617,7 +11817,8 @@ var CloudEnvironmentSchema = z6.object({
   workspace_id: z6.string().optional(),
   created_at: z6.string().optional(),
   updated_at: z6.string().optional(),
-  archived_at: z6.string().nullish()
+  archived_at: z6.string().nullish(),
+  attributes: z6.record(z6.string(), z6.unknown()).optional()
 });
 var ListCloudEnvironmentsResponseSchema = z6.object({
   environments: z6.array(CloudEnvironmentSchema)
@@ -10629,7 +11830,8 @@ var CloudVaultSchema = z6.object({
   type: z6.string().optional(),
   created_at: z6.string().nullish(),
   updated_at: z6.string().nullish(),
-  archived_at: z6.string().nullish()
+  archived_at: z6.string().nullish(),
+  attributes: z6.record(z6.string(), z6.unknown()).optional()
 });
 var ListCloudVaultsResponseSchema = z6.object({
   vaults: z6.array(CloudVaultSchema)
@@ -10644,6 +11846,7 @@ var SessionEventTypeSchema = z6.enum([
   "unknown"
 ]);
 var AgentSyncStatusSchema = z6.enum(["completed", "blocked", "failed"]);
+var AgentSyncReasonSchema = z6.enum(["destructive_blocked", "cancelled", "diagnostic_error", "plan_stale"]);
 var AgentSyncResultSchema = z6.object({
   action: PlannedActionSchema,
   status: z6.enum(["success", "failed", "skipped"]),
@@ -10653,6 +11856,7 @@ var AgentSyncRunSchema = z6.object({
   agentId: z6.string(),
   provider: z6.string().optional(),
   status: AgentSyncStatusSchema,
+  reason: AgentSyncReasonSchema.optional(),
   actions: z6.array(PlannedActionSchema),
   diagnostics: z6.array(DiagnosticSchema),
   destructiveActions: z6.array(PlannedActionSchema),
@@ -10770,6 +11974,7 @@ export {
   AgentReadinessStatusSchema,
   AgentRecoveryActionSchema,
   AgentSkillRefSchema,
+  AgentSyncReasonSchema,
   AgentSyncResultSchema,
   AgentSyncRunSchema,
   AgentSyncStatusSchema,
@@ -10809,6 +12014,7 @@ export {
   applyProviderConfigToEnv,
   archiveCloudAgent,
   archiveMemoryStore,
+  archiveRemoteSession,
   areRuntimeCredentialsReady,
   batchCreateMemories,
   bootstrapRuntimeCredentials,
@@ -10822,6 +12028,8 @@ export {
   createProjectRuntime,
   createSessionForAgent,
   createSkillFromFileId,
+  createVaultCredential,
+  createVaultCredentialWithStateBackend,
   decideDestructive,
   deleteCloudEnvironment,
   deleteCloudVault,
@@ -10831,6 +12039,8 @@ export {
   deleteSession,
   deleteSkill,
   destroyPlannedProjectResources,
+  downloadRemoteFile,
+  downloadRemoteSkill,
   executePlannedProject,
   extractSkillZipFiles,
   getAgent,
@@ -10838,13 +12048,25 @@ export {
   getDeploymentRuntimeProviderForContext,
   getFileDownloadUrl,
   getFileInfo,
+  getManagedAgentProviderCapabilities,
   getMemory,
   getMemoryProviderCapabilities,
   getMemoryStore,
   getMemoryVersion,
+  getRemoteAgent,
+  getRemoteDeployment,
+  getRemoteDeploymentRun,
+  getRemoteEnvironment,
+  getRemoteSkill,
+  getRemoteSkillDownloadInfo,
+  getRemoteSkillVersion,
+  getRemoteVault,
   getSession,
   getSkillInfo,
   importResource,
+  inspectProjectSource,
+  inspectSkillSource,
+  isAgentRunnable,
   isTerminalSessionStatus,
   listAgentsWithReadiness,
   listCloudAgents,
@@ -10857,7 +12079,16 @@ export {
   listMemoryVersions,
   listProviderModelsForContext,
   listProviderNames,
+  listRemoteAgentVersions,
+  listRemoteAgents,
+  listRemoteDeploymentRuns,
+  listRemoteDeployments,
   listRemoteDeploymentsForContext,
+  listRemoteEnvironments,
+  listRemoteFiles,
+  listRemoteSkillVersions,
+  listRemoteSkills,
+  listRemoteVaults,
   listSessionEvents,
   listSessionSummaries,
   listSkills,
@@ -10867,8 +12098,13 @@ export {
   migrateConfig,
   parseStateAddress,
   pauseDeploymentForContext,
+  planAgentResources,
+  planAgentResourcesWithStateBackend,
   planDestroyProjectContext,
   planProjectContext,
+  planProjectWithStateBackend,
+  planVaultCredentialCreate,
+  planVaultCredentialCreateWithStateBackend,
   prepareInitialSessionPrompt,
   preparePromptForProvider,
   prependFileHint,
@@ -10884,9 +12120,12 @@ export {
   resolveSyncProvider,
   rewriteFileMentions,
   runDeploymentForContext,
+  runRemoteDeployment,
+  sendRemoteSessionEvents,
   sendSessionMessagePolling,
   sendSessionMessageStreaming,
   setDefaultFetch,
+  setRemoteDeploymentPaused,
   startSessionRun,
   startSessionRunPolling,
   streamSessionEvents,
@@ -10896,6 +12135,7 @@ export {
   syncProviderResourcesFromEnv,
   updateMemory,
   updateMemoryStore,
+  updateRemoteSession,
   uploadFile,
   validateProjectConfig,
   writeProjectRuntime