@openagentpack/sdk 0.5.0 → 0.6.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { C as CloudAgent, a as CloudEnvironment, b as CloudVault, R as ResourceAddress, c as ResourceType, E as EventStreamOptions, P as ProviderSessionEvent, d as EventListOptions, e as ProviderSessionEventList, f as PlannedAction, D as Diagnostic, A as AgentDefinition, g as AgentWithReadiness, h as AgentSyncRun } from './session-event-5kLRNMHC.js';
-export { i as ActionType, j as ActionTypeSchema, k as AgentDefinitionSchema, l as AgentDriftSeverity, m as AgentDriftSeveritySchema, n as AgentModel, o as AgentModelSchema, p as AgentReadiness, q as AgentReadinessSchema, r as AgentReadinessStatus, s as AgentReadinessStatusSchema, t as AgentRecoveryAction, u as AgentRecoveryActionSchema, v as AgentSkillRef, w as AgentSkillRefSchema, x as AgentSyncResult, y as AgentSyncResultSchema, z as AgentSyncRunSchema, B as AgentSyncStatus, F as AgentSyncStatusSchema, G as AgentWithReadinessSchema, H as CloudAgentSchema, I as CloudEnvironmentSchema, J as CloudVaultSchema, K as CreateSessionRequest, L as CreateSessionRequestSchema, M as CreateSessionResponse, N as CreateSessionResponseSchema, O as DiagnosticSchema, Q as DiagnosticSeverity, S as DiagnosticSeveritySchema, T as DriftKind, U as DriftKindSchema, V as GetSessionRequest, W as GetSessionRequestSchema, X as KNOWN_SESSION_EVENT_TYPES, Y as KnownSessionEventType, Z as ListCloudAgentsResponse, _ as ListCloudAgentsResponseSchema, $ as ListCloudEnvironmentsResponse, a0 as ListCloudEnvironmentsResponseSchema, a1 as ListSessionEventsRequest, a2 as ListSessionEventsRequestSchema, a3 as ListSessionEventsResponse, a4 as ListSessionEventsResponseSchema, a5 as ListSessionsRequest, a6 as ListSessionsRequestSchema, a7 as ListSessionsResponse, a8 as ListSessionsResponseSchema, a9 as PlanReadinessImpact, aa as PlanReadinessImpactSchema, ab as PlannedActionSchema, ac as ResourceAddressSchema, ad as ResourceTypeSchema, ae as SendEventRequest, af as SendEventRequestSchema, ag as SendEventResponse, ah as SendEventResponseSchema, ai as Session, aj as SessionAgent, ak as SessionAgentSchema, al as SessionContentBlock, am as SessionContentBlockSchema, an as SessionEvent, ao as SessionEventSchema, ap as SessionEventType, aq as SessionEventTypeName, ar as SessionEventTypeSchema, as as SessionSchema } from './session-event-5kLRNMHC.js';
+import { C as CloudAgent, a as CloudEnvironment, b as CloudVault, R as ResourceAddress, c as ResourceType, E as EventStreamOptions, P as ProviderSessionEvent, d as EventListOptions, e as ProviderSessionEventList, f as PlannedAction, D as Diagnostic, A as AgentDefinition, g as AgentReadiness, h as AgentWithReadiness, i as AgentSyncRun } from './session-event-B63Rbjim.js';
+export { j as ActionType, k as ActionTypeSchema, l as AgentDefinitionSchema, m as AgentDriftSeverity, n as AgentDriftSeveritySchema, o as AgentModel, p as AgentModelSchema, q as AgentReadinessSchema, r as AgentReadinessStatus, s as AgentReadinessStatusSchema, t as AgentRecoveryAction, u as AgentRecoveryActionSchema, v as AgentSkillRef, w as AgentSkillRefSchema, x as AgentSyncReason, y as AgentSyncReasonSchema, z as AgentSyncResult, B as AgentSyncResultSchema, F as AgentSyncRunSchema, G as AgentSyncStatus, H as AgentSyncStatusSchema, I as AgentWithReadinessSchema, J as CloudAgentSchema, K as CloudEnvironmentSchema, L as CloudVaultSchema, M as CreateSessionRequest, N as CreateSessionRequestSchema, O as CreateSessionResponse, Q as CreateSessionResponseSchema, S as DiagnosticSchema, T as DiagnosticSeverity, U as DiagnosticSeveritySchema, V as DriftKind, W as DriftKindSchema, X as GetSessionRequest, Y as GetSessionRequestSchema, Z as KNOWN_SESSION_EVENT_TYPES, _ as KnownSessionEventType, $ as ListCloudAgentsResponse, a0 as ListCloudAgentsResponseSchema, a1 as ListCloudEnvironmentsResponse, a2 as ListCloudEnvironmentsResponseSchema, a3 as ListSessionEventsRequest, a4 as ListSessionEventsRequestSchema, a5 as ListSessionEventsResponse, a6 as ListSessionEventsResponseSchema, a7 as ListSessionsRequest, a8 as ListSessionsRequestSchema, a9 as ListSessionsResponse, aa as ListSessionsResponseSchema, ab as PlanReadinessImpact, ac as PlanReadinessImpactSchema, ad as PlannedActionSchema, ae as ResourceAddressSchema, af as ResourceTypeSchema, ag as SendEventRequest, ah as SendEventRequestSchema, ai as SendEventResponse, aj as SendEventResponseSchema, ak as Session, al as SessionAgent, am as SessionAgentSchema, an as SessionContentBlock, ao as SessionContentBlockSchema, ap as SessionEvent, aq as SessionEventSchema, ar as SessionEventType, as as SessionEventTypeName, at as SessionEventTypeSchema, au as SessionSchema } from './session-event-B63Rbjim.js';
 import { P as ProviderFileInfo } from './file-Cj5-Vx27.js';
 import 'zod';
 
@@ -90,6 +90,15 @@ interface VaultDecl {
     metadata?: Record<string, string>;
 }
 type CredentialType = "static_bearer" | "environment_variable";
+interface CredentialNetworking {
+    /** Legacy policy type; Bailian requests use allowed_hosts instead. */
+    type?: "unrestricted" | "limited";
+    allowed_hosts?: string[];
+}
+interface CredentialInjectionLocation {
+    header?: boolean;
+    body?: boolean;
+}
 interface CredentialDecl {
     name: string;
     type: CredentialType;
@@ -99,9 +108,8 @@ interface CredentialDecl {
     protocol?: "sse" | "streamable_http";
     secret_name?: string;
     secret_value?: string;
-    networking?: {
-        type: "unrestricted" | "limited";
-    };
+    networking?: CredentialNetworking;
+    injection_location?: CredentialInjectionLocation;
 }
 interface MemoryStoreDecl {
     description: string;
@@ -123,6 +131,7 @@ interface SkillDecl {
 }
 interface FileDecl {
     source: string;
+    /** Local label only; declarative uploads preserve the source file's basename. */
     name?: string;
     purpose?: string;
     provider?: ProviderName;
@@ -144,9 +153,9 @@ interface AgentDecl {
     mcp_servers?: McpServerDecl[];
     skills?: AgentSkillDecl[];
     vault?: string;
-    /** File declarations inherited by a Qoder Forward Template. */
-    files?: string[];
     memory_stores?: string[];
+    /** String refs are inherited by Qoder Forward Templates; object refs mount Files into Sessions. */
+    files?: Array<string | AgentFileMountDecl>;
     /** Desired display metadata for Qoder Forward's system-managed writable Store. */
     default_memory_store?: DefaultMemoryStoreDecl;
     /** Resources mounted into every managed session created for this agent. */
@@ -160,6 +169,12 @@ interface AgentDecl {
     /** Provider-specific remote materialization. Omitted means the existing managed Agent resource. */
     delivery?: Record<ProviderName, AgentDeliveryDecl>;
 }
+interface AgentFileMountDecl {
+    /** Logical key under the top-level files section. */
+    file: string;
+    /** Provider sandbox path. Bailian paths live under /mnt. */
+    mount_path: string;
+}
 interface DefaultMemoryStoreDecl {
     name: string;
     description?: string;
@@ -335,6 +350,8 @@ interface VaultCredentialInfo {
     secret_name?: string;
     mcp_server_url?: string;
     networking_type?: string;
+    networking?: CredentialNetworking;
+    injection_location?: CredentialInjectionLocation;
     metadata?: Record<string, string>;
 }
 interface SkillListOptions extends CursorListOptions {
@@ -1013,11 +1030,15 @@ interface ResolveProjectConfigOptions {
     projectName?: string;
     /** Expand `${env:...}` references while loading (defaults to true). */
     resolveEnv?: boolean;
+    /** Project-local fallback values; the process environment takes precedence. Never mutates process.env. */
+    environment?: Record<string, string>;
 }
 interface LoadedProjectConfig {
     configPath: string;
     projectName: string;
     config: ResolvedProjectConfig;
+    /** Root config and local files/directories that influence the resolved project. */
+    sourcePaths: string[];
 }
 /**
  * Shared config-resolution spine for every host: load the config file, raise
@@ -1030,6 +1051,10 @@ interface ResolveProjectConfigFromObjectOptions {
     projectName: string;
     /** Base path used to resolve any `file:` references (defaults to process.cwd()). */
     basePath?: string;
+    /** Resolve `${ENV_VAR}` references recursively before schema validation. */
+    resolveEnv?: boolean;
+    /** Project-local fallback values; the process environment takes precedence. */
+    environment?: Record<string, string>;
 }
 /**
  * Object-level twin of {@link resolveProjectConfig}: validate an in-memory config
@@ -1063,6 +1088,7 @@ interface ResourceRuntimeOptions extends DestructiveDecisionOptions {
     refreshOnly?: boolean;
     quiet?: boolean;
     onFeedback?: RuntimeFeedbackSink;
+    concurrency?: number;
 }
 type ResourceSyncMode = "reconcile" | "create-only";
 interface ResourcePlanScope {
@@ -1128,6 +1154,14 @@ declare function validateProjectConfig(config: ProjectConfig, options?: Validate
  */
 declare function collectConfigReferences(config: ProjectConfig): Diagnostic[];
 
+interface ProjectSourceInspection {
+    diagnostics: Diagnostic[];
+    redacted_source: string;
+    sensitive_literals: string[];
+}
+/** Validates a complete agents.yaml source and produces a display-safe copy. */
+declare function inspectProjectSource(source: string, configPath: string): Promise<ProjectSourceInspection>;
+
 interface SyncProjectOptions {
     /** Provider to read remote resources from (single provider, not "all"). */
     provider: string;
@@ -1497,6 +1531,7 @@ declare function buildAgentDecl(base: AgentDecl | undefined, input: AgentBuildIn
 interface AgentResourcePlan {
     agentId: string;
     provider: string;
+    fingerprint: string;
     actions: PlannedAction[];
     diagnostics: Diagnostic[];
     destructiveActions: PlannedAction[];
@@ -1505,12 +1540,17 @@ interface AgentResourcePlan {
 interface AgentResourcePlanOptions {
     refresh?: boolean;
     quiet?: boolean;
+    onFeedback?: RuntimeFeedbackSink;
+    /** Strict Agent runtime closure; excludes downstream resources such as deployments. */
+    scope?: "runtime";
     mode?: AgentResourceSyncMode;
 }
 type AgentResourceSyncMode = ResourceSyncMode;
 interface AgentResourceSyncOptions extends AgentResourcePlanOptions {
     policy?: DestructivePolicy;
     confirm?: (actions: PlannedAction[]) => boolean | Promise<boolean>;
+    /** Refuse execution when a fresh plan no longer matches the plan shown to the user. */
+    expectedPlanFingerprint?: string;
 }
 /**
  * List RAW cloud agents from the provider — the actual remote objects, not the local
@@ -1567,6 +1607,7 @@ declare function getAgent(ctx: ProjectRuntimeContext, agentId: string): AgentDef
 declare function listAgentsWithReadiness(ctx: ProjectRuntimeContext, options?: {
     refresh?: boolean;
 }): Promise<AgentWithReadiness[]>;
+declare function isAgentRunnable(readiness: AgentReadiness): boolean;
 declare function planAgentResources(ctx: ProjectRuntimeContext, agentId: string, options?: AgentResourcePlanOptions): Promise<AgentResourcePlan>;
 declare function planAgentResourcesWithStateBackend(input: BackendRuntimeInput, agentId: string, options?: AgentResourcePlanOptions): Promise<AgentResourcePlan>;
 declare function syncAgentResourcesWithStateBackend(input: BackendRuntimeInput, agentId: string, options?: AgentResourceSyncOptions): Promise<AgentSyncRun>;
@@ -1797,4 +1838,4 @@ declare function inspectSkillSource(source: string, options?: {
     basePath?: string;
 }): Promise<SkillSourceInspection>;
 
-export { AGENTS_CONFIG_PROVIDERS, AGENTS_PROVIDER_FIELDS, type AgentBuildInput, AgentDefinition, type AgentListOptions, type AgentMcpBuildInput, type AgentPage, type AgentResourcePlan, type AgentResourcePlanOptions, type AgentResourceSyncMode, type AgentResourceSyncOptions, type AgentSkillBuildInput, AgentSyncRun, type AgentVersionListOptions, AgentWithReadiness, ApiError, type BackendRuntimeInput, type BatchCreateMemoryInput, type BatchCreateMemoryResult, CloudAgent, CloudEnvironment, CloudVault, type CollectedSessionEvents, ConflictError, type CreateMemoryInput, type CreateMemoryStoreInput, type CredentialDecl, type CursorListOptions, type CursorPage, type DeploymentDecl, type DeploymentInfo$1 as DeploymentInfo, type DeploymentListFilter, type DeploymentListResult, type DeploymentRunInfo, type DeploymentRunPage, type DeploymentRunResult$1 as DeploymentRunResult, type DestroyDefaultMemoryStoreResult, type DestroyResourceResult, type DestructivePolicy, Diagnostic, type EnvironmentDecl, type EnvironmentListOptions, type EnvironmentPage, EventListOptions, EventStreamOptions, type FetchLike, type FileListOptions, type FilePage, type IStateManager, type LoadedProjectConfig, LocalFileStateBackend, type ManagedAgentOperationAuth, type ManagedAgentOperationCapability, type ManagedAgentProviderCapabilities, type ManagedApiTarget, type MemoryInfo, type MemoryListItem, type MemoryListOptions, type MemoryPage, type MemoryPrefixInfo, type MemoryProviderCapabilities, type MemoryStoreInfo, type MemoryStoreListOptions, type MemoryVersionInfo, type MemoryVersionListOptions, type MigrateOptions, type MigrateResult, PlannedAction, type ProjectConfig, type ProjectRuntimeContext, type ProviderConfig, type ProviderConfigProvider, ProviderFileInfo, ProviderSessionEvent, ProviderSessionEventList, type ProviderSessionInfo, type ProviderSkillInfo, type ResolvedProjectConfig, type ResourceActionResult, ResourceAddress, type ResourceExecutionResult, type ResourcePlanResult, type ResourcePlanScope, type ResourceRefreshResult, type ResourceRuntimeOptions, type ResourceState, type ResourceSyncMode, type ResourceSyncRun, ResourceType, type RuntimeFeedbackEvent, type RuntimeFeedbackSink, type SecretPlaceholder, type SessionEventInput, type SessionEventSendResult, type SessionFilter, type SessionListResult, type SessionUpdateInput, type SkillDecl, type SkillDownloadInfo, type SkillFile, type SkillListOptions, type SkillPage, type SkillSourceInspection, type SkillVersionInfo, type SkillVersionListOptions, type SkillVersionPage, StateManager, type StateScope, type SyncProjectOptions, type SyncProjectResult, type UpdateMemoryInput, type UpdateMemoryStoreInput, UserError, type ValidateProjectConfigOptions, type VaultCredentialCreateOptions, type VaultCredentialCreatePlan, type VaultCredentialCreateResult, type VaultCredentialInfo, type VaultDecl, type VaultListOptions, type VaultPage, applyProviderConfigToEnv, archiveCloudAgent, archiveMemoryStore, archiveRemoteSession, areRuntimeCredentialsReady, batchCreateMemories, bootstrapRuntimeCredentials, bootstrapRuntimeCredentialsSync, buildAgentDecl, collectConfigReferences, createCloudEnvironment, createCloudVault, createMemory, createMemoryStore, createProjectRuntime, createSessionForAgent, createSkillFromFileId, createVaultCredential, createVaultCredentialWithStateBackend, decideDestructive, deleteCloudEnvironment, deleteCloudVault, deleteFile, deleteMemory, deleteMemoryStore, deleteSession, deleteSkill, destroyPlannedProjectResources, downloadRemoteFile, downloadRemoteSkill, executePlannedProject, extractSkillZipFiles, getAgent, getDeploymentDetailsForContext, getDeploymentRuntimeProviderForContext, getFileDownloadUrl, getFileInfo, getManagedAgentProviderCapabilities, getMemory, getMemoryProviderCapabilities, getMemoryStore, getMemoryVersion, getRemoteAgent, getRemoteDeployment, getRemoteDeploymentRun, getRemoteEnvironment, getRemoteSkill, getRemoteSkillDownloadInfo, getRemoteSkillVersion, getRemoteVault, getSession, getSkillInfo, importResource, inspectSkillSource, isTerminalSessionStatus, listAgentsWithReadiness, listCloudAgents, listCloudEnvironments, listCloudVaults, listDeploymentsForContext, listFiles, listMemories, listMemoryStores, listMemoryVersions, listProviderModelsForContext, listProviderNames, listRemoteAgentVersions, listRemoteAgents, listRemoteDeploymentRuns, listRemoteDeployments, listRemoteDeploymentsForContext, listRemoteEnvironments, listRemoteFiles, listRemoteSkillVersions, listRemoteSkills, listRemoteVaults, listSessionEvents, listSessionSummaries, listSkills, loadDotEnv, loadProviderConfigIntoEnv, loadProviderConfigIntoEnvSync, migrateConfig, parseStateAddress, pauseDeploymentForContext, planAgentResources, planAgentResourcesWithStateBackend, planDestroyProjectContext, planProjectContext, planProjectWithStateBackend, planVaultCredentialCreate, planVaultCredentialCreateWithStateBackend, prepareInitialSessionPrompt, preparePromptForProvider, prependFileHint, providerConfigPath, readProjectRuntime, redactMemoryVersion, resolveActiveProvider, resolveProjectConfig, resolveProjectConfigFromObject, resolveProviderConfigFromEnv, resolveRepositoryMountPath, resolveSessionProvider, resolveSyncProvider, rewriteFileMentions, runDeploymentForContext, runRemoteDeployment, sendRemoteSessionEvents, sendSessionMessagePolling, sendSessionMessageStreaming, setDefaultFetch, setRemoteDeploymentPaused, startSessionRun, startSessionRunPolling, streamSessionEvents, syncAgentResourcesWithStateBackend, syncProjectResourcesWithStateBackend, syncProviderResourcesFromContext, syncProviderResourcesFromEnv, updateMemory, updateMemoryStore, updateRemoteSession, uploadFile, validateProjectConfig, writeProjectRuntime };
+export { AGENTS_CONFIG_PROVIDERS, AGENTS_PROVIDER_FIELDS, type AgentBuildInput, AgentDefinition, type AgentListOptions, type AgentMcpBuildInput, type AgentPage, AgentReadiness, type AgentResourcePlan, type AgentResourcePlanOptions, type AgentResourceSyncMode, type AgentResourceSyncOptions, type AgentSkillBuildInput, AgentSyncRun, type AgentVersionListOptions, AgentWithReadiness, ApiError, type BackendRuntimeInput, type BatchCreateMemoryInput, type BatchCreateMemoryResult, CloudAgent, CloudEnvironment, CloudVault, type CollectedSessionEvents, ConflictError, type CreateMemoryInput, type CreateMemoryStoreInput, type CredentialDecl, type CredentialInjectionLocation, type CredentialNetworking, type CursorListOptions, type CursorPage, type DeploymentDecl, type DeploymentInfo$1 as DeploymentInfo, type DeploymentListFilter, type DeploymentListResult, type DeploymentRunInfo, type DeploymentRunPage, type DeploymentRunResult$1 as DeploymentRunResult, type DestroyDefaultMemoryStoreResult, type DestroyResourceResult, type DestructivePolicy, Diagnostic, type EnvironmentDecl, type EnvironmentListOptions, type EnvironmentPage, EventListOptions, EventStreamOptions, type FetchLike, type FileListOptions, type FilePage, type IStateManager, type LoadedProjectConfig, LocalFileStateBackend, type ManagedAgentOperationAuth, type ManagedAgentOperationCapability, type ManagedAgentProviderCapabilities, type ManagedApiTarget, type MemoryInfo, type MemoryListItem, type MemoryListOptions, type MemoryPage, type MemoryPrefixInfo, type MemoryProviderCapabilities, type MemoryStoreInfo, type MemoryStoreListOptions, type MemoryVersionInfo, type MemoryVersionListOptions, type MigrateOptions, type MigrateResult, PlannedAction, type ProjectConfig, type ProjectRuntimeContext, type ProjectSourceInspection, type ProviderConfig, type ProviderConfigProvider, ProviderFileInfo, ProviderSessionEvent, ProviderSessionEventList, type ProviderSessionInfo, type ProviderSkillInfo, type ResolvedProjectConfig, type ResourceActionResult, ResourceAddress, type ResourceExecutionResult, type ResourcePlanResult, type ResourcePlanScope, type ResourceRefreshResult, type ResourceRuntimeOptions, type ResourceState, type ResourceSyncMode, type ResourceSyncRun, ResourceType, type RuntimeFeedbackEvent, type RuntimeFeedbackSink, type SecretPlaceholder, type SessionEventInput, type SessionEventSendResult, type SessionFilter, type SessionListResult, type SessionUpdateInput, type SkillDecl, type SkillDownloadInfo, type SkillFile, type SkillListOptions, type SkillPage, type SkillSourceInspection, type SkillVersionInfo, type SkillVersionListOptions, type SkillVersionPage, StateManager, type StateScope, type SyncProjectOptions, type SyncProjectResult, type UpdateMemoryInput, type UpdateMemoryStoreInput, UserError, type ValidateProjectConfigOptions, type VaultCredentialCreateOptions, type VaultCredentialCreatePlan, type VaultCredentialCreateResult, type VaultCredentialInfo, type VaultDecl, type VaultListOptions, type VaultPage, applyProviderConfigToEnv, archiveCloudAgent, archiveMemoryStore, archiveRemoteSession, areRuntimeCredentialsReady, batchCreateMemories, bootstrapRuntimeCredentials, bootstrapRuntimeCredentialsSync, buildAgentDecl, collectConfigReferences, createCloudEnvironment, createCloudVault, createMemory, createMemoryStore, createProjectRuntime, createSessionForAgent, createSkillFromFileId, createVaultCredential, createVaultCredentialWithStateBackend, decideDestructive, deleteCloudEnvironment, deleteCloudVault, deleteFile, deleteMemory, deleteMemoryStore, deleteSession, deleteSkill, destroyPlannedProjectResources, downloadRemoteFile, downloadRemoteSkill, executePlannedProject, extractSkillZipFiles, getAgent, getDeploymentDetailsForContext, getDeploymentRuntimeProviderForContext, getFileDownloadUrl, getFileInfo, getManagedAgentProviderCapabilities, getMemory, getMemoryProviderCapabilities, getMemoryStore, getMemoryVersion, getRemoteAgent, getRemoteDeployment, getRemoteDeploymentRun, getRemoteEnvironment, getRemoteSkill, getRemoteSkillDownloadInfo, getRemoteSkillVersion, getRemoteVault, getSession, getSkillInfo, importResource, inspectProjectSource, inspectSkillSource, isAgentRunnable, isTerminalSessionStatus, listAgentsWithReadiness, listCloudAgents, listCloudEnvironments, listCloudVaults, listDeploymentsForContext, listFiles, listMemories, listMemoryStores, listMemoryVersions, listProviderModelsForContext, listProviderNames, listRemoteAgentVersions, listRemoteAgents, listRemoteDeploymentRuns, listRemoteDeployments, listRemoteDeploymentsForContext, listRemoteEnvironments, listRemoteFiles, listRemoteSkillVersions, listRemoteSkills, listRemoteVaults, listSessionEvents, listSessionSummaries, listSkills, loadDotEnv, loadProviderConfigIntoEnv, loadProviderConfigIntoEnvSync, migrateConfig, parseStateAddress, pauseDeploymentForContext, planAgentResources, planAgentResourcesWithStateBackend, planDestroyProjectContext, planProjectContext, planProjectWithStateBackend, planVaultCredentialCreate, planVaultCredentialCreateWithStateBackend, prepareInitialSessionPrompt, preparePromptForProvider, prependFileHint, providerConfigPath, readProjectRuntime, redactMemoryVersion, resolveActiveProvider, resolveProjectConfig, resolveProjectConfigFromObject, resolveProviderConfigFromEnv, resolveRepositoryMountPath, resolveSessionProvider, resolveSyncProvider, rewriteFileMentions, runDeploymentForContext, runRemoteDeployment, sendRemoteSessionEvents, sendSessionMessagePolling, sendSessionMessageStreaming, setDefaultFetch, setRemoteDeploymentPaused, startSessionRun, startSessionRunPolling, streamSessionEvents, syncAgentResourcesWithStateBackend, syncProjectResourcesWithStateBackend, syncProviderResourcesFromContext, syncProviderResourcesFromEnv, updateMemory, updateMemoryStore, updateRemoteSession, uploadFile, validateProjectConfig, writeProjectRuntime };

package/dist/index.js

@@ -3662,12 +3662,16 @@ function mapCredential2(cred) {
       `credential '${cred.name}': Bailian only supports credential type 'environment_variable', but '${cred.type}' was declared.`
     );
   }
+  if (cred.networking?.type === "limited" && cred.networking.allowed_hosts === void 0) {
+    throw new UserError(`credential '${cred.name}': Bailian limited networking requires networking.allowed_hosts.`);
+  }
   const body = {
     auth: {
       type: "environment_variable",
       secret_name: cred.secret_name,
       secret_value: cred.secret_value,
-      networking: cred.networking ?? { type: "unrestricted" }
+      networking: { allowed_hosts: cred.networking?.allowed_hosts ?? ["*"] },
+      injection_location: cred.injection_location ?? { header: true, body: false }
     },
     display_name: cred.name
   };
@@ -3688,13 +3692,15 @@ function credToDecl3(raw, vaultName) {
     };
   }
   const networking = auth.networking;
+  const injectionLocation = auth.injection_location;
   return {
     name,
     type: "environment_variable",
     metadata: stripAgentsMetadata(raw.metadata),
     secret_name: auth.secret_name ?? name,
     secret_value: placeholder,
-    networking: networking ?? { type: "unrestricted" }
+    networking: networking ?? { type: "unrestricted" },
+    ...injectionLocation ? { injection_location: injectionLocation } : {}
   };
 }
 function vaultToDecl3(raw, rawCredentials, resourceName) {
@@ -4360,6 +4366,8 @@ var BailianAdapter = class _BailianAdapter {
         secret_name: auth.secret_name,
         mcp_server_url: auth.mcp_server_url,
         networking_type: networking?.type,
+        networking,
+        injection_location: auth.injection_location,
         metadata: metadata ? Object.fromEntries(
           Object.entries(metadata).filter((entry) => typeof entry[1] === "string")
         ) : void 0
@@ -5726,6 +5734,30 @@ async function resolveFileReferences(config, configPath) {
 // src/internal/parser/resolve-project-config.ts
 import { basename as basename5, dirname as dirname7, resolve as resolve7 } from "path";
 
+// src/internal/utils/env.ts
+var ENV_VAR_PATTERN = /\$\{([^}]+)\}/g;
+function interpolateEnvVars(value, resolve13 = false, environment = process.env) {
+  return value.replace(ENV_VAR_PATTERN, (match, varName) => {
+    if (!resolve13) return match;
+    const resolvedValue = environment[varName];
+    if (resolvedValue === void 0) {
+      throw new UserError(`Environment variable '${varName}' is not set`);
+    }
+    return resolvedValue;
+  });
+}
+function interpolateObjectEnv(value, environment = process.env) {
+  if (typeof value === "string") return interpolateEnvVars(value, true, environment);
+  if (Array.isArray(value)) return value.map((entry) => interpolateObjectEnv(entry, environment));
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      interpolateObjectEnv(entry, environment)
+    ])
+  );
+}
+
 // src/internal/parser/schema.ts
 import { z as z5 } from "zod";
 var networkingSchema = z5.object({
@@ -5781,7 +5813,14 @@ var environmentVariableCredentialSchema = z5.object({
   metadata: z5.record(z5.string(), z5.string()).optional(),
   secret_name: z5.string(),
   secret_value: coerceString,
-  networking: z5.object({ type: z5.enum(["unrestricted", "limited"]) }).optional()
+  networking: z5.object({
+    type: z5.enum(["unrestricted", "limited"]).optional(),
+    allowed_hosts: z5.array(z5.string()).optional()
+  }).optional(),
+  injection_location: z5.object({
+    header: z5.boolean().optional(),
+    body: z5.boolean().optional()
+  }).optional()
 });
 var credentialSchema = z5.discriminatedUnion("type", [
   staticBearerCredentialSchema,
@@ -5921,6 +5960,10 @@ var agentSkillRefSchema = z5.object({
 var agentDeliverySchema = z5.object({
   type: z5.enum(["managed", "forward"])
 });
+var agentFileMountSchema = z5.object({
+  file: z5.string().min(1),
+  mount_path: z5.string().min(1)
+});
 var managedToolConfigSchema = z5.object({
   enabled_tools: z5.array(z5.string().min(1))
 });
@@ -5945,8 +5988,8 @@ var agentSchema = z5.object({
   mcp_servers: z5.array(mcpServerSchema).optional(),
   skills: z5.array(z5.union([z5.string(), agentSkillRefSchema])).optional(),
   vault: z5.string().optional(),
-  files: z5.array(z5.string()).optional(),
   memory_stores: z5.array(z5.string()).optional(),
+  files: z5.array(z5.union([z5.string().min(1), agentFileMountSchema])).optional(),
   default_memory_store: z5.object({
     name: z5.string().trim().min(1).max(255),
     description: z5.string().max(1024).optional(),
@@ -6049,22 +6092,7 @@ var projectConfigSchema = z5.object({
 // src/internal/parser/yaml-loader.ts
 import { readFile as readFile3 } from "fs/promises";
 import { parse as parseYaml } from "yaml";
-
-// src/internal/utils/env.ts
-var ENV_VAR_PATTERN = /\$\{([^}]+)\}/g;
-function interpolateEnvVars(value, resolve13 = false) {
-  return value.replace(ENV_VAR_PATTERN, (match, varName) => {
-    if (!resolve13) return match;
-    const val = process.env[varName];
-    if (val === void 0) {
-      throw new UserError(`Environment variable '${varName}' is not set`);
-    }
-    return val;
-  });
-}
-
-// src/internal/parser/yaml-loader.ts
-async function loadConfig(filePath, resolveEnv = false) {
+async function loadConfig(filePath, resolveEnv = false, environment) {
   let raw;
   try {
     raw = await readFile3(filePath, "utf8");
@@ -6075,7 +6103,7 @@ async function loadConfig(filePath, resolveEnv = false) {
     const msg = err instanceof Error ? err.message : String(err);
     return { config: null, errors: [`Failed to read file: ${msg}`] };
   }
-  if (resolveEnv) {
+  if (resolveEnv && !environment) {
     raw = interpolateEnvVars(raw, true);
   }
   let parsed;
@@ -6085,6 +6113,7 @@ async function loadConfig(filePath, resolveEnv = false) {
     const msg = e instanceof Error ? e.message : String(e);
     return { config: null, errors: [`YAML parse error: ${msg}`] };
   }
+  if (resolveEnv && environment) parsed = interpolateObjectEnv(parsed, environment);
   const result = projectConfigSchema.safeParse(parsed);
   if (!result.success) {
     const errors = result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`);
@@ -6097,27 +6126,73 @@ async function loadConfig(filePath, resolveEnv = false) {
 async function resolveProjectConfig(filePath, options = {}) {
   const configPath = resolve7(filePath);
   const projectName = options.projectName ?? basename5(dirname7(configPath));
-  const { config: parsed, errors } = await loadConfig(configPath, options.resolveEnv ?? true);
+  const { config: parsed, errors } = await loadConfig(
+    configPath,
+    options.resolveEnv ?? true,
+    options.environment ? { ...options.environment, ...process.env } : void 0
+  );
   if (errors.length > 0) {
     throw new UserError(errors.join("\n"));
   }
-  const config = await resolveFileReferences(parsed, configPath);
-  return { configPath, projectName, config };
+  const sourcePaths = collectProjectSourcePaths(parsed, configPath, true);
+  let config;
+  try {
+    config = await resolveFileReferences(parsed, configPath);
+  } catch (error) {
+    if (error && typeof error === "object") {
+      Object.assign(error, { sourcePaths });
+    }
+    throw error;
+  }
+  return { configPath, projectName, config, sourcePaths };
 }
 async function resolveProjectConfigFromObject(rawConfig, options) {
   const basePath = resolve7(options.basePath ?? process.cwd());
-  const result = projectConfigSchema.safeParse(rawConfig);
+  const input = options.resolveEnv ? interpolateObjectEnv(rawConfig, { ...options.environment, ...process.env }) : rawConfig;
+  const result = projectConfigSchema.safeParse(input);
   if (!result.success) {
     const errors = result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`);
     throw new UserError(errors.join("\n"));
   }
   const anchor = resolve7(basePath, "__in_memory_config__");
-  const config = await resolveFileReferences(result.data, anchor);
-  return { configPath: basePath, projectName: options.projectName, config };
+  const parsed = result.data;
+  const sourcePaths = collectProjectSourcePaths(parsed, anchor, false);
+  const config = await resolveFileReferences(parsed, anchor);
+  return { configPath: basePath, projectName: options.projectName, config, sourcePaths };
+}
+function collectProjectSourcePaths(config, configPath, includeConfigPath) {
+  const baseDirectory = dirname7(configPath);
+  const paths = /* @__PURE__ */ new Set();
+  if (includeConfigPath) paths.add(configPath);
+  const addLocalPath = (value, requirePathSyntax = false) => {
+    if (!value || /^https?:\/\//i.test(value)) return;
+    if (requirePathSyntax && !isLocalPathReference(value)) return;
+    paths.add(resolve7(baseDirectory, value));
+  };
+  for (const agent of Object.values(config.agents ?? {})) {
+    addLocalPath(agent.instructions, true);
+  }
+  for (const store of Object.values(config.memory_stores ?? {})) {
+    for (const entry of store.entries ?? []) addLocalPath(entry.content, true);
+  }
+  for (const skill of Object.values(config.skills ?? {})) addLocalPath(skill.source);
+  for (const file of Object.values(config.files ?? {})) addLocalPath(file.source);
+  for (const deployment of Object.values(config.deployments ?? {})) {
+    for (const resource of deployment.resources ?? []) {
+      if (resource.type === "file") addLocalPath(resource.source);
+    }
+    for (const event of deployment.initial_events ?? []) {
+      if (event.type === "user.define_outcome") addLocalPath(event.rubric_file, true);
+    }
+  }
+  return [...paths].sort();
+}
+function isLocalPathReference(value) {
+  return value.startsWith("./") || value.startsWith("../") || value.startsWith("/");
 }
 
 // src/internal/executor/executor.ts
-import { dirname as dirname10, resolve as resolve11 } from "path";
+import { basename as basename7, dirname as dirname10, resolve as resolve11 } from "path";
 
 // src/internal/utils/hash.ts
 import { createHash } from "crypto";
@@ -6231,8 +6306,9 @@ async function computeResourceHash(address, config, basePath, state) {
   }
   if (address.type === "template") {
     const refs = resolveTemplateReferenceIds(decl, config, address.provider, state);
-    return contentHash({ decl, refs });
+    return contentHash({ decl: withoutLocalSessionFileMounts(decl), refs });
   }
+  if (address.type === "agent") return contentHash(withoutLocalSessionFileMounts(decl));
   if (address.type === "channel") {
     const refs = resolveChannelReferenceIds(
       decl,
@@ -6244,6 +6320,12 @@ async function computeResourceHash(address, config, basePath, state) {
   }
   return contentHash(decl);
 }
+function withoutLocalSessionFileMounts(decl) {
+  if (!decl || typeof decl !== "object" || Array.isArray(decl)) return decl;
+  const { files, ...remoteDeclaration } = decl;
+  const templateFiles = Array.isArray(files) ? files.filter((file) => typeof file === "string") : [];
+  return templateFiles.length ? { ...remoteDeclaration, files: templateFiles } : remoteDeclaration;
+}
 function resolveQoderApiMode(type, name, provider, config) {
   if (provider !== "qoder") return void 0;
   if (type === "environment" && config.environments?.[name]?.environment_id) return "auto";
@@ -6251,7 +6333,7 @@ function resolveQoderApiMode(type, name, provider, config) {
     if (agent.provider && agent.provider !== provider) continue;
     const referenced = type === "environment" ? agent.environment === name : type === "skill" ? agent.skills?.some(
       (skill) => typeof skill === "string" ? skill === name : skill.type === "custom" && skill.skill_id === name
-    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.includes(name);
+    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.some((file) => (typeof file === "string" ? file : file.file) === name);
     if (referenced && agent.delivery?.qoder?.type === "forward") return "forward";
   }
   return "managed";
@@ -6292,9 +6374,7 @@ function resolveTemplateReferenceIds(decl, config, provider, state) {
     memory_store_ids: (decl.memory_stores ?? []).map(
       (memoryStore) => state?.getResource({ type: "memory_store", name: memoryStore, provider })?.remote_id ?? memoryStore
     ),
-    file_ids: (decl.files ?? []).map(
-      (file) => state?.getResource({ type: "file", name: file, provider })?.remote_id ?? file
-    ),
+    file_ids: (decl.files ?? []).filter((file) => typeof file === "string").map((file) => state?.getResource({ type: "file", name: file, provider })?.remote_id ?? file),
     identity_id: decl.memory_stores?.length && config.defaults?.identity ? state?.getResource({ type: "identity", name: config.defaults.identity, provider })?.remote_id : void 0
   };
 }
@@ -6484,7 +6564,7 @@ function resolveTemplateRefs(agentName, config, provider, state) {
     environment_id: environment.environment_id ?? requireRef(state, { type: "environment", name: agent.environment, provider }),
     ...agent.tunnel ? { tunnel_id: resolveTunnelIdFromConfig(config, agent.tunnel, provider) } : {},
     vault_ids: agent.vault ? [requireRef(state, { type: "vault", name: agent.vault, provider })] : [],
-    file_ids: (agent.files ?? []).map((file) => requireRef(state, { type: "file", name: file, provider })),
+    file_ids: (agent.files ?? []).filter((file) => typeof file === "string").map((file) => requireRef(state, { type: "file", name: file, provider })),
     memory_store_ids: memoryStoreIds,
     owned_memory_store_ids: state.listResources().filter(
       (resource) => resource.address.provider === provider && resource.address.type === "memory_store" && resource.api_mode === "forward" && typeof resource.remote_id === "string"
@@ -7262,7 +7342,16 @@ async function executeActionInner(action, provider, ctx) {
           }
         }
       }
-      const info = await provider.uploadFile(filePath, { name: decl.name, purpose: decl.purpose }, apiMode);
+      const info = await provider.uploadFile(
+        filePath,
+        {
+          // Keep the source filename and extension; a declaration label must not
+          // change the multipart filename or the provider's inferred MIME type.
+          name: basename7(filePath),
+          purpose: decl.purpose
+        },
+        apiMode
+      );
       result = { id: info.id, type: "file" };
       break;
     }
@@ -7314,7 +7403,7 @@ function resolveResourceApiMode(type, name, provider, config) {
     if (agent.provider && agent.provider !== provider) continue;
     const referenced = type === "environment" ? agent.environment === name : type === "skill" ? agent.skills?.some(
       (skill) => typeof skill === "string" ? skill === name : skill.type === "custom" && skill.skill_id === name
-    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.includes(name);
+    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.some((file) => (typeof file === "string" ? file : file.file) === name);
     if (!referenced) continue;
     if (agent.delivery?.qoder?.type === "forward") forward = true;
     else managed = true;
@@ -7374,16 +7463,16 @@ function resolveAgentMaterialization(provider, agent) {
 // src/internal/graph/dependency.ts
 function collectDependencyClosure(graph, roots) {
   const selected = /* @__PURE__ */ new Map();
-  function visit(address) {
+  function visit2(address) {
     const key = addressKey(address);
     if (selected.has(key)) return;
     selected.set(key, graph.nodes.get(key) ?? address);
     for (const dependencyKey of graph.edges.get(key) ?? []) {
       const dependency = graph.nodes.get(dependencyKey);
-      if (dependency) visit(dependency);
+      if (dependency) visit2(dependency);
     }
   }
-  for (const root of roots) visit(root);
+  for (const root of roots) visit2(root);
   return [...selected.values()];
 }
 function buildDependencyGraph(config, targetProviders) {
@@ -7486,7 +7575,8 @@ function buildDependencyGraph(config, targetProviders) {
           }
         }
         if (decl.files) {
-          for (const fileName of decl.files) {
+          for (const file of decl.files) {
+            const fileName = typeof file === "string" ? file : file.file;
             const fileAddr = { type: "file", name: fileName, provider };
             if (nodes.has(addressKey(fileAddr))) addEdge(agentAddr, fileAddr);
           }
@@ -7574,7 +7664,7 @@ function topologicalSort(graph) {
   const visited = /* @__PURE__ */ new Set();
   const sorted = [];
   const visiting = /* @__PURE__ */ new Set();
-  function visit(key) {
+  function visit2(key) {
     if (visited.has(key)) return;
     if (visiting.has(key)) {
       throw new UserError(`Circular dependency detected involving: ${key}`);
@@ -7582,14 +7672,14 @@ function topologicalSort(graph) {
     visiting.add(key);
     const deps = graph.edges.get(key) ?? /* @__PURE__ */ new Set();
     for (const dep of deps) {
-      visit(dep);
+      visit2(dep);
     }
     visiting.delete(key);
     visited.add(key);
     sorted.push(graph.nodes.get(key));
   }
   for (const key of graph.nodes.keys()) {
-    visit(key);
+    visit2(key);
   }
   return sorted;
 }
@@ -7716,8 +7806,9 @@ function collectReferenceDiagnostics(config, diagnostics) {
       diagnostics.error("config.agent.vault.unknown", `agent.${name}: references unknown vault '${agent.vault}'`);
     }
     for (const file of agent.files ?? []) {
-      if (!fileNames.has(file)) {
-        diagnostics.error("config.agent.file.unknown", `agent.${name}: references unknown file '${file}'`);
+      const fileName = typeof file === "string" ? file : file.file;
+      if (!fileNames.has(fileName)) {
+        diagnostics.error("config.agent.file.unknown", `agent.${name}: references unknown file '${fileName}'`);
       }
     }
     for (const memory of agent.memory_stores ?? []) {
@@ -7782,6 +7873,16 @@ function collectProviderCapabilities(config, providers, diagnostics) {
       continue;
     }
     const caps = def.capabilities;
+    for (const [name, vault] of Object.entries(config.vaults ?? {})) {
+      if (vault.provider && vault.provider !== providerName) continue;
+      if (providerName !== "bailian" && vault.credentials.some((credential) => credential.injection_location !== void 0)) {
+        diagnostics.error(
+          `${providerName}.vault.injection_location.unsupported`,
+          `vault.${name}: provider '${providerName}' does not support credential injection_location; pin this vault to bailian.`,
+          { type: "vault", name, provider: providerName }
+        );
+      }
+    }
     for (const [name, environment] of Object.entries(config.environments ?? {})) {
       if (environment.provider && environment.provider !== providerName) continue;
       if (environment.environment_id) continue;
@@ -7901,7 +8002,7 @@ function collectProviderCapabilities(config, providers, diagnostics) {
           ),
           ...agent.vault ? [`vault:${agent.vault}`] : [],
           ...(agent.memory_stores ?? []).map((store) => `memory_store:${store}`),
-          ...(agent.files ?? []).map((file) => `file:${file}`)
+          ...(agent.files ?? []).map((file) => `file:${typeof file === "string" ? file : file.file}`)
         ];
         for (const ref of refs) {
           const modes = domains.get(ref) ?? /* @__PURE__ */ new Set();
@@ -7921,7 +8022,7 @@ function collectProviderCapabilities(config, providers, diagnostics) {
     }
     for (const [name, agent] of Object.entries(config.agents ?? {})) {
       if (agent.provider && agent.provider !== providerName) continue;
-      if (agent.files?.length && (providerName !== "qoder" || agent.delivery?.qoder?.type !== "forward")) {
+      if (agent.files?.some((file) => typeof file === "string") && (providerName !== "qoder" || agent.delivery?.qoder?.type !== "forward")) {
         diagnostics.error(
           "config.agent.files.unsupported",
           `agent.${name}: files are supported only by Qoder Forward Templates.`,
@@ -7945,6 +8046,30 @@ function collectProviderCapabilities(config, providers, diagnostics) {
           address
         );
       }
+      const normalizedFileMountPaths = /* @__PURE__ */ new Set();
+      for (const file of agent.files ?? []) {
+        if (typeof file === "string") continue;
+        let normalizedMountPath;
+        try {
+          normalizedMountPath = resolveSandboxMountPath(providerName, file.mount_path);
+        } catch (error) {
+          diagnostics.error(
+            `${providerName}.agent.file.mount_path.invalid`,
+            `agent.${name}: ${error instanceof Error ? error.message : String(error)}`,
+            address
+          );
+          continue;
+        }
+        if (normalizedFileMountPaths.has(normalizedMountPath)) {
+          diagnostics.error(
+            `${providerName}.agent.file.mount_path.duplicate`,
+            `agent.${name}: file mount_path '${normalizedMountPath}' is duplicated after normalization.`,
+            address
+          );
+        } else {
+          normalizedFileMountPaths.add(normalizedMountPath);
+        }
+      }
       for (const resource of agent.resources ?? []) {
         if (!def.features.session_resources.includes(resource.type)) {
           diagnostics.error(
@@ -8666,7 +8791,8 @@ async function syncProjectResourcesWithStateBackend(input, options = {}) {
       execution: await executePlannedProject(planned, {
         onFeedback: options.onFeedback,
         policy: options.policy,
-        confirm: options.confirm
+        confirm: options.confirm,
+        concurrency: options.concurrency
       })
     };
   });
@@ -8889,6 +9015,124 @@ function toResourceExecutionResult(result) {
   };
 }
 
+// src/internal/core/project-source-security.ts
+import { basename as basename8, dirname as dirname11 } from "path";
+import { isScalar, parseDocument, visit } from "yaml";
+var REDACTED = "[redacted]";
+var ENVIRONMENT_REFERENCE = /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/;
+var SENSITIVE_KEY = /(access[_-]?key(?:[_-]?id)?|api[_-]?key|authorization|credential|headers?|password|secret(?![_-]?name)|signature|token)/i;
+async function inspectProjectSource(source, configPath) {
+  const document = parseDocument(source, { keepSourceTokens: true, prettyErrors: true });
+  if (document.errors.length > 0) {
+    return {
+      diagnostics: document.errors.map(() => ({
+        severity: "error",
+        code: "project.config.invalid",
+        message: "agents.yaml contains invalid YAML. Fix the syntax before creating or restoring a version."
+      })),
+      redacted_source: "# Invalid agents.yaml source omitted from the safe preview.\n",
+      sensitive_literals: []
+    };
+  }
+  const rawConfig = document.toJS({ mapAsMap: false });
+  const displaySecrets = collectSensitiveScalars(rawConfig);
+  const sensitiveLiterals = [...displaySecrets].filter((value) => !ENVIRONMENT_REFERENCE.test(value));
+  let diagnostics;
+  try {
+    const loaded = await resolveProjectConfigFromObject(rawConfig, {
+      projectName: basename8(dirname11(configPath)),
+      basePath: dirname11(configPath)
+    });
+    diagnostics = validateProjectConfig(loaded.config);
+  } catch (error) {
+    diagnostics = [
+      {
+        severity: "error",
+        code: "project.config.invalid",
+        message: error instanceof Error ? error.message : String(error)
+      }
+    ];
+  }
+  if (sensitiveLiterals.length > 0) {
+    diagnostics.push({
+      severity: "error",
+      code: "project.version.sensitive_literal",
+      message: "agents.yaml contains a credential value in a sensitive field. Replace it with an environment variable reference before creating or restoring a version."
+    });
+  }
+  return {
+    diagnostics: redactDiagnostics(diagnostics, displaySecrets),
+    redacted_source: redactDocumentSource(source, document, displaySecrets),
+    sensitive_literals: sensitiveLiterals.map(() => REDACTED)
+  };
+}
+function collectSensitiveScalars(value, result = /* @__PURE__ */ new Set(), key = "", ancestorSensitive = false) {
+  if (Array.isArray(value)) {
+    const nestedSensitive = ancestorSensitive || isSensitiveValueKey(key);
+    for (const entry of value) collectSensitiveScalars(entry, result, key, nestedSensitive);
+    return result;
+  }
+  if (isRecord2(value)) {
+    const nestedSensitive = ancestorSensitive || isSensitiveContainerKey(key);
+    for (const [entryKey, entry] of Object.entries(value)) {
+      collectSensitiveScalars(entry, result, entryKey, nestedSensitive);
+    }
+    return result;
+  }
+  if ((ancestorSensitive || isSensitiveValueKey(key)) && (typeof value === "string" || typeof value === "number") && String(value).length > 0) {
+    result.add(String(value));
+  }
+  return result;
+}
+function isSensitiveContainerKey(key) {
+  return ["header", "headers", "authorization"].includes(key.toLowerCase().replaceAll("-", "_"));
+}
+function isSensitiveValueKey(key) {
+  const normalized = key.toLowerCase().replaceAll("-", "_");
+  if (normalized === "secret_name" || normalized === "credentials") return false;
+  return SENSITIVE_KEY.test(normalized);
+}
+function redactDocumentSource(source, document, secrets) {
+  if (secrets.size === 0) return source;
+  const redactedDocument = document.clone();
+  visit(redactedDocument, (_key, node) => {
+    if (isScalar(node) && (typeof node.value === "string" || typeof node.value === "number")) {
+      const value = String(node.value);
+      const redacted = redactText(value, secrets);
+      if (redacted !== value) {
+        node.value = redacted;
+        node.source = redacted;
+        node.type = "PLAIN";
+      }
+    }
+    redactComments(node, secrets);
+  });
+  redactComments(redactedDocument, secrets);
+  return redactedDocument.toString();
+}
+function redactText(source, secrets) {
+  let redacted = source;
+  for (const secret of [...secrets].sort((left, right) => right.length - left.length)) {
+    redacted = redacted.replaceAll(secret, REDACTED);
+  }
+  return redacted;
+}
+function redactComments(value, secrets) {
+  if (!value || typeof value !== "object") return;
+  const commented = value;
+  if (commented.comment) commented.comment = redactText(commented.comment, secrets);
+  if (commented.commentBefore) commented.commentBefore = redactText(commented.commentBefore, secrets);
+}
+function redactDiagnostics(diagnostics, secrets) {
+  return diagnostics.map((diagnostic) => ({
+    ...diagnostic,
+    message: redactText(diagnostic.message, secrets)
+  }));
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/internal/core/sync-runtime.ts
 import { stringify as stringifyYaml } from "yaml";
 var SYNCABLE_GROUP = {
@@ -9571,7 +9815,16 @@ function resolveVaultProvider(ctx, declaredProvider, requestedProvider) {
 function credentialMatches(remote, desired) {
   if (remote.auth_type !== desired.type || !metadataMatches(remote.metadata, desired.metadata)) return false;
   if (desired.type === "static_bearer") return remote.mcp_server_url === desired.mcp_server_url;
-  return remote.secret_name === desired.secret_name && (remote.networking_type ?? "unrestricted") === (desired.networking?.type ?? "unrestricted");
+  const desiredHosts = credentialHosts(desired.networking);
+  const remoteHosts = credentialHosts(remote.networking ?? { type: remote.networking_type });
+  const desiredLocation = desired.injection_location;
+  const remoteLocation = remote.injection_location;
+  if (desiredLocation && !remoteLocation) return false;
+  return remote.secret_name === desired.secret_name && desiredHosts !== void 0 && remoteHosts !== void 0 && desiredHosts.length === remoteHosts.length && desiredHosts.every((host) => remoteHosts.includes(host)) && (desiredLocation?.header ?? true) === (remoteLocation?.header ?? true) && (desiredLocation?.body ?? false) === (remoteLocation?.body ?? false);
+}
+function credentialHosts(networking) {
+  if (networking?.allowed_hosts !== void 0) return [...new Set(networking.allowed_hosts)];
+  return networking?.type === "limited" ? void 0 : ["*"];
 }
 function metadataMatches(remote, desired) {
   const remoteEntries = Object.entries(remote ?? {});
@@ -10165,6 +10418,7 @@ function buildSessionBindings(agentName, config, provider, state, options = {})
     throw new UserError(`Agent '${agentName}' not found in config. Available agents: ${available || "(none)"}`);
   }
   const sessionResources = options.resources ?? agent.resources;
+  const sessionFiles = resolveSessionFiles(agentName, agent, provider, state, options.files ?? []);
   const environmentVariables = options.environmentVariables ?? agent.environment_variables;
   if (environmentVariables && provider !== "qoder") {
     throw new UserError("Session environment variables are supported only by Qoder.");
@@ -10195,7 +10449,7 @@ function buildSessionBindings(agentName, config, provider, state, options = {})
       delivery: "forward",
       template_id: templateId,
       identity_id: identityId,
-      files: (options.files ?? []).map((file) => ({ file_id: file.fileId, mount_path: file.mountPath })),
+      files: sessionFiles,
       title: options.title,
       metadata: options.metadata,
       environment_variables: environmentVariables
@@ -10240,13 +10494,41 @@ function buildSessionBindings(agentName, config, provider, state, options = {})
     tunnel_id: tunnelId,
     vault_ids: vaultIds,
     memory_store_ids: memoryStoreIds,
-    files: (options.files ?? []).map((f) => ({ file_id: f.fileId, mount_path: f.mountPath })),
+    files: sessionFiles,
     resources: sessionResources,
     title: options.title,
     metadata: options.metadata,
     environment_variables: environmentVariables
   };
 }
+function resolveSessionFiles(agentName, agent, provider, state, explicitFiles) {
+  const resolved = [];
+  const mountOwners = /* @__PURE__ */ new Map();
+  for (const file of agent.files ?? []) {
+    if (typeof file === "string") continue;
+    const mountPath = resolveSandboxMountPath(provider, file.mount_path);
+    assertUniqueMountPath(mountOwners, mountPath, `declared file '${file.file}'`, agentName);
+    resolved.push({
+      file_id: requireRef(state, { type: "file", name: file.file, provider }),
+      mount_path: mountPath
+    });
+  }
+  for (const file of explicitFiles) {
+    const mountPath = resolveSandboxMountPath(provider, file.mountPath);
+    assertUniqueMountPath(mountOwners, mountPath, `Session file '${file.fileId}'`, agentName);
+    resolved.push({ file_id: file.fileId, mount_path: mountPath });
+  }
+  return resolved;
+}
+function assertUniqueMountPath(mountOwners, mountPath, owner, agentName) {
+  const existing = mountOwners.get(mountPath);
+  if (existing) {
+    throw new UserError(
+      `Agent '${agentName}' cannot mount ${owner} at '${mountPath}'; the path is already used by ${existing}.`
+    );
+  }
+  mountOwners.set(mountPath, owner);
+}
 function resolveTunnelId(agent, config, options, provider) {
   const tunnelName = options.tunnel ?? agent.tunnel;
   if (!options.tunnelId && !tunnelName) return void 0;
@@ -10266,6 +10548,74 @@ function validateResourceInConfig(name, type, resources) {
   }
 }
 
+// src/internal/state/backend.ts
+function cloneStateFile(state) {
+  return structuredClone(state);
+}
+
+// src/internal/state/in-memory-state-manager.ts
+var InMemoryStateManager = class _InMemoryStateManager {
+  state;
+  index;
+  constructor(state) {
+    this.state = state;
+    this.index = this.buildIndex();
+  }
+  buildIndex() {
+    const idx = /* @__PURE__ */ new Map();
+    for (let i = 0; i < this.state.resources.length; i++) {
+      idx.set(addressKey(this.state.resources[i].address), i);
+    }
+    return idx;
+  }
+  static fromJSON(data) {
+    return new _InMemoryStateManager(structuredClone(data));
+  }
+  static empty() {
+    return new _InMemoryStateManager({ resources: [] });
+  }
+  getResource(address) {
+    const i = this.index.get(addressKey(address));
+    return i !== void 0 ? this.state.resources[i] : void 0;
+  }
+  setResource(resource) {
+    const key = addressKey(resource.address);
+    const i = this.index.get(key);
+    if (i !== void 0) {
+      this.state.resources[i] = resource;
+    } else {
+      this.index.set(key, this.state.resources.length);
+      this.state.resources.push(resource);
+    }
+  }
+  removeResource(address) {
+    const key = addressKey(address);
+    const i = this.index.get(key);
+    if (i === void 0) return;
+    this.state.resources.splice(i, 1);
+    this.index.delete(key);
+    for (let j = i; j < this.state.resources.length; j++) {
+      this.index.set(addressKey(this.state.resources[j].address), j);
+    }
+  }
+  listResources() {
+    return [...this.state.resources];
+  }
+  findResource(query2) {
+    return this.state.resources.find((resource) => {
+      const matchType = resource.address.type === query2.type;
+      const matchName = resource.address.name === query2.name;
+      const matchProvider = !query2.provider || resource.address.provider === query2.provider;
+      return matchType && matchName && matchProvider;
+    });
+  }
+  getStateFile() {
+    return this.state;
+  }
+  async save() {
+  }
+};
+
 // src/internal/core/agent-runtime.ts
 function listAgents(ctx) {
   const agents = ctx.config.agents ?? {};
@@ -10356,21 +10706,26 @@ async function listAgentsWithReadiness(ctx, options = {}) {
     readiness: getAgentReadinessFromPlan(ctx, agent.id, planResult.plan)
   }));
 }
+function isAgentRunnable(readiness) {
+  return readiness.status === "ready" || readiness.status === "drifted" && readiness.driftSeverity === "non_blocking";
+}
 async function planAgentResources(ctx, agentId, options = {}) {
   const agent = getAgent(ctx, agentId);
-  const rootAddress = collectAgentAddresses(ctx.config, agent.agentName, agent.provider)[0];
+  const addresses = collectAgentAddresses(ctx.config, agent.agentName, agent.provider);
   const planned = await planProjectContext(ctx, {
     provider: agent.provider,
-    scope: { roots: [rootAddress] },
+    scope: { roots: options.scope === "runtime" ? addresses : [addresses[0]] },
     mode: options.mode,
     refresh: options.refresh,
-    quiet: options.quiet ?? true
+    quiet: options.quiet ?? true,
+    onFeedback: options.onFeedback
   });
   const actions = planned.plan.actions;
   const diagnostics = planned.plan.diagnostics;
   return {
     agentId,
     provider: agent.provider,
+    fingerprint: computeAgentPlanFingerprint(agentId, agent.provider, actions, diagnostics),
     actions,
     diagnostics,
     destructiveActions: selectDestructive(actions),
@@ -10384,14 +10739,31 @@ async function syncAgentResources(ctx, agentId, options = {}) {
   return runAgentSync(ctx, agentId, options);
 }
 async function runAgentSync(ctx, agentId, options) {
-  const fullPlan = await planAgentResources(ctx, agentId, {
+  const transactionalState = options.expectedPlanFingerprint ? InMemoryStateManager.fromJSON(cloneStateFile(ctx.state.getStateFile())) : void 0;
+  const planningContext = transactionalState ? { ...ctx, state: transactionalState } : ctx;
+  const fullPlan = await planAgentResources(planningContext, agentId, {
     refresh: options.refresh,
     quiet: options.quiet,
+    onFeedback: options.onFeedback,
+    scope: options.scope,
     mode: options.mode
   });
   const actions = fullPlan.actions;
   const destructiveActions = fullPlan.destructiveActions;
   const errorDiagnostic = fullPlan.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+  if (options.expectedPlanFingerprint && options.expectedPlanFingerprint !== fullPlan.fingerprint) {
+    return {
+      agentId,
+      provider: fullPlan.provider,
+      status: "blocked",
+      reason: "plan_stale",
+      actions,
+      diagnostics: fullPlan.diagnostics,
+      destructiveActions,
+      results: [],
+      error: "The project or remote resources changed after planning. Create a new plan before applying."
+    };
+  }
   const decision = await decideDestructive(destructiveActions, {
     policy: options.policy,
     confirm: options.confirm
@@ -10401,6 +10773,7 @@ async function runAgentSync(ctx, agentId, options) {
       agentId,
       provider: fullPlan.provider,
       status: "blocked",
+      reason: decision === "cancelled" ? "cancelled" : "destructive_blocked",
       actions,
       diagnostics: fullPlan.diagnostics,
       destructiveActions,
@@ -10413,6 +10786,7 @@ async function runAgentSync(ctx, agentId, options) {
       agentId,
       provider: fullPlan.provider,
       status: "blocked",
+      reason: "diagnostic_error",
       actions,
       diagnostics: fullPlan.diagnostics,
       destructiveActions,
@@ -10422,8 +10796,10 @@ async function runAgentSync(ctx, agentId, options) {
   }
   try {
     const execution = await executePlannedProject(fullPlan.planned, {
+      onFeedback: options.onFeedback,
       policy: "force"
     });
+    if (transactionalState) await replaceState(ctx.state, transactionalState);
     const results = toAgentSyncResults(execution);
     const failed = results.find((result) => result.status === "failed");
     return {
@@ -10437,6 +10813,7 @@ async function runAgentSync(ctx, agentId, options) {
       error: failed?.error
     };
   } catch (error) {
+    if (transactionalState) await replaceState(ctx.state, transactionalState);
     return {
       agentId,
       provider: fullPlan.provider,
@@ -10449,6 +10826,11 @@ async function runAgentSync(ctx, agentId, options) {
     };
   }
 }
+async function replaceState(target, source) {
+  for (const resource of target.listResources()) target.removeResource(resource.address);
+  for (const resource of source.listResources()) target.setResource(resource);
+  await target.save();
+}
 async function syncAgentResourcesWithStateBackend(input, agentId, options = {}) {
   return writeProjectRuntime(input, (ctx) => syncAgentResources(ctx, agentId, options));
 }
@@ -10525,6 +10907,10 @@ function getAgentReadinessFromPlan(ctx, agentId, plan) {
     plannedActions: relevantActions
   };
 }
+function actionKey(action) {
+  const address = action.address;
+  return `${action.action}:${address.provider}:${address.type}:${address.name}`;
+}
 function isNonBlockingAgentDrift(action) {
   if (action.action === "no-op") return true;
   return action.readinessImpact === "non_blocking";
@@ -10542,7 +10928,42 @@ function collectAgentAddresses(config, agentName, provider) {
     provider: resolvedProvider
   };
   const graph = buildDependencyGraph(config, [resolvedProvider]);
-  return collectDependencyClosure(graph, [rootAddress]);
+  const roots = [rootAddress];
+  const visited = /* @__PURE__ */ new Set();
+  function collectRuntimeRoots(name) {
+    if (visited.has(name)) return;
+    visited.add(name);
+    const declaration = config.agents?.[name];
+    if (!declaration) return;
+    const type = resolveAgentMaterialization(resolvedProvider, declaration).resourceType;
+    if (type === "template" && config.defaults?.identity) {
+      roots.push({ type: "identity", name: config.defaults.identity, provider: resolvedProvider });
+    }
+    for (const subAgentName of declaration.multiagent?.agents ?? []) {
+      const subAgent = config.agents?.[subAgentName];
+      if (!subAgent) continue;
+      roots.push({
+        type: resolveAgentMaterialization(resolvedProvider, subAgent).resourceType,
+        name: subAgentName,
+        provider: resolvedProvider
+      });
+      collectRuntimeRoots(subAgentName);
+    }
+  }
+  collectRuntimeRoots(agentName);
+  return collectDependencyClosure(graph, roots);
+}
+function computeAgentPlanFingerprint(agentId, provider, actions, diagnostics) {
+  const normalizedActions = actions.map((action) => ({
+    ...action,
+    dependencies: [...action.dependencies].sort((left, right) => addressKey(left).localeCompare(addressKey(right)))
+  })).sort((left, right) => actionKey(left).localeCompare(actionKey(right)));
+  const normalizedDiagnostics = [...diagnostics].sort((left, right) => {
+    const leftKey = `${left.resource ? addressKey(left.resource) : ""}:${left.severity}:${left.code}:${left.message}`;
+    const rightKey = `${right.resource ? addressKey(right.resource) : ""}:${right.severity}:${right.code}:${right.message}`;
+    return leftKey.localeCompare(rightKey);
+  });
+  return contentHash({ agentId, provider, actions: normalizedActions, diagnostics: normalizedDiagnostics });
 }
 function toAgentDefinition(config, agentName, agent) {
   return {
@@ -10987,7 +11408,7 @@ function delay2(ms) {
 import { readFileSync as readFileSync8 } from "fs";
 import { readFile as readFile5 } from "fs/promises";
 import { homedir } from "os";
-import { dirname as dirname11, join } from "path";
+import { dirname as dirname12, join } from "path";
 var AGENTS_CONFIG_PROVIDERS = ["bailian", "qoder", "ark", "claude"];
 var AGENTS_PROVIDER_FIELDS = {
   bailian: [
@@ -11056,7 +11477,7 @@ function loadDotEnv(startDir = process.cwd()) {
       return envPath;
     } catch {
     }
-    const parent = dirname11(dir);
+    const parent = dirname12(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -11140,7 +11561,7 @@ function parseStateAddress(address, options = {}) {
 
 // src/internal/state/state-manager.ts
 import { mkdir, readFile as readFile6, rename, unlink, writeFile } from "fs/promises";
-import { dirname as dirname12 } from "path";
+import { dirname as dirname13 } from "path";
 var StateManager = class _StateManager {
   state;
   path;
@@ -11231,7 +11652,7 @@ var StateManager = class _StateManager {
     return this.state;
   }
   async save() {
-    await mkdir(dirname12(this.path), { recursive: true });
+    await mkdir(dirname13(this.path), { recursive: true });
     const tmpPath = `${this.path}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
     try {
       await writeFile(tmpPath, `${JSON.stringify(this.state, null, 2)}
@@ -11253,74 +11674,6 @@ function deriveStatePath(configPath) {
   return /\.ya?ml$/i.test(configPath) ? configPath.replace(/\.ya?ml$/i, ".state.json") : `${configPath}.state.json`;
 }
 
-// src/internal/state/backend.ts
-function cloneStateFile(state) {
-  return structuredClone(state);
-}
-
-// src/internal/state/in-memory-state-manager.ts
-var InMemoryStateManager = class _InMemoryStateManager {
-  state;
-  index;
-  constructor(state) {
-    this.state = state;
-    this.index = this.buildIndex();
-  }
-  buildIndex() {
-    const idx = /* @__PURE__ */ new Map();
-    for (let i = 0; i < this.state.resources.length; i++) {
-      idx.set(addressKey(this.state.resources[i].address), i);
-    }
-    return idx;
-  }
-  static fromJSON(data) {
-    return new _InMemoryStateManager(structuredClone(data));
-  }
-  static empty() {
-    return new _InMemoryStateManager({ resources: [] });
-  }
-  getResource(address) {
-    const i = this.index.get(addressKey(address));
-    return i !== void 0 ? this.state.resources[i] : void 0;
-  }
-  setResource(resource) {
-    const key = addressKey(resource.address);
-    const i = this.index.get(key);
-    if (i !== void 0) {
-      this.state.resources[i] = resource;
-    } else {
-      this.index.set(key, this.state.resources.length);
-      this.state.resources.push(resource);
-    }
-  }
-  removeResource(address) {
-    const key = addressKey(address);
-    const i = this.index.get(key);
-    if (i === void 0) return;
-    this.state.resources.splice(i, 1);
-    this.index.delete(key);
-    for (let j = i; j < this.state.resources.length; j++) {
-      this.index.set(addressKey(this.state.resources[j].address), j);
-    }
-  }
-  listResources() {
-    return [...this.state.resources];
-  }
-  findResource(query2) {
-    return this.state.resources.find((resource) => {
-      const matchType = resource.address.type === query2.type;
-      const matchName = resource.address.name === query2.name;
-      const matchProvider = !query2.provider || resource.address.provider === query2.provider;
-      return matchType && matchName && matchProvider;
-    });
-  }
-  getStateFile() {
-    return this.state;
-  }
-  async save() {
-  }
-};
-
 // src/internal/state/local-file-state-backend.ts
 var LocalFileStateBackend = class {
   configPath;
@@ -11493,6 +11846,7 @@ var SessionEventTypeSchema = z6.enum([
   "unknown"
 ]);
 var AgentSyncStatusSchema = z6.enum(["completed", "blocked", "failed"]);
+var AgentSyncReasonSchema = z6.enum(["destructive_blocked", "cancelled", "diagnostic_error", "plan_stale"]);
 var AgentSyncResultSchema = z6.object({
   action: PlannedActionSchema,
   status: z6.enum(["success", "failed", "skipped"]),
@@ -11502,6 +11856,7 @@ var AgentSyncRunSchema = z6.object({
   agentId: z6.string(),
   provider: z6.string().optional(),
   status: AgentSyncStatusSchema,
+  reason: AgentSyncReasonSchema.optional(),
   actions: z6.array(PlannedActionSchema),
   diagnostics: z6.array(DiagnosticSchema),
   destructiveActions: z6.array(PlannedActionSchema),
@@ -11619,6 +11974,7 @@ export {
   AgentReadinessStatusSchema,
   AgentRecoveryActionSchema,
   AgentSkillRefSchema,
+  AgentSyncReasonSchema,
   AgentSyncResultSchema,
   AgentSyncRunSchema,
   AgentSyncStatusSchema,
@@ -11708,7 +12064,9 @@ export {
   getSession,
   getSkillInfo,
   importResource,
+  inspectProjectSource,
   inspectSkillSource,
+  isAgentRunnable,
   isTerminalSessionStatus,
   listAgentsWithReadiness,
   listCloudAgents,

package/dist/{session-event-5kLRNMHC.d.ts → session-event-B63Rbjim.d.ts}

@@ -590,6 +590,13 @@ declare const AgentSyncStatusSchema: z.ZodEnum<{
     failed: "failed";
 }>;
 type AgentSyncStatus = z.infer<typeof AgentSyncStatusSchema>;
+declare const AgentSyncReasonSchema: z.ZodEnum<{
+    destructive_blocked: "destructive_blocked";
+    cancelled: "cancelled";
+    diagnostic_error: "diagnostic_error";
+    plan_stale: "plan_stale";
+}>;
+type AgentSyncReason = z.infer<typeof AgentSyncReasonSchema>;
 declare const AgentSyncResultSchema: z.ZodObject<{
     action: z.ZodObject<{
         action: z.ZodEnum<{
@@ -678,6 +685,12 @@ declare const AgentSyncRunSchema: z.ZodObject<{
         blocked: "blocked";
         failed: "failed";
     }>;
+    reason: z.ZodOptional<z.ZodEnum<{
+        destructive_blocked: "destructive_blocked";
+        cancelled: "cancelled";
+        diagnostic_error: "diagnostic_error";
+        plan_stale: "plan_stale";
+    }>>;
     actions: z.ZodArray<z.ZodObject<{
         action: z.ZodEnum<{
             create: "create";
@@ -1133,4 +1146,4 @@ interface ProviderSessionEventList {
     next_page?: string;
 }
 
-export { type ListCloudEnvironmentsResponse as $, type AgentDefinition as A, type AgentSyncStatus as B, type CloudAgent as C, type Diagnostic as D, type EventStreamOptions as E, AgentSyncStatusSchema as F, AgentWithReadinessSchema as G, CloudAgentSchema as H, CloudEnvironmentSchema as I, CloudVaultSchema as J, type CreateSessionRequest as K, CreateSessionRequestSchema as L, type CreateSessionResponse as M, CreateSessionResponseSchema as N, DiagnosticSchema as O, type ProviderSessionEvent as P, type DiagnosticSeverity as Q, type ResourceAddress as R, DiagnosticSeveritySchema as S, type DriftKind as T, DriftKindSchema as U, type GetSessionRequest as V, GetSessionRequestSchema as W, KNOWN_SESSION_EVENT_TYPES as X, type KnownSessionEventType as Y, type ListCloudAgentsResponse as Z, ListCloudAgentsResponseSchema as _, type CloudEnvironment as a, ListCloudEnvironmentsResponseSchema as a0, type ListSessionEventsRequest as a1, ListSessionEventsRequestSchema as a2, type ListSessionEventsResponse as a3, ListSessionEventsResponseSchema as a4, type ListSessionsRequest as a5, ListSessionsRequestSchema as a6, type ListSessionsResponse as a7, ListSessionsResponseSchema as a8, type PlanReadinessImpact as a9, PlanReadinessImpactSchema as aa, PlannedActionSchema as ab, ResourceAddressSchema as ac, ResourceTypeSchema as ad, type SendEventRequest as ae, SendEventRequestSchema as af, type SendEventResponse as ag, SendEventResponseSchema as ah, type Session as ai, type SessionAgent as aj, SessionAgentSchema as ak, type SessionContentBlock as al, SessionContentBlockSchema as am, type SessionEvent as an, SessionEventSchema as ao, type SessionEventType as ap, type SessionEventTypeName as aq, SessionEventTypeSchema as ar, SessionSchema as as, type CloudVault as b, type ResourceType as c, type EventListOptions as d, type ProviderSessionEventList as e, type PlannedAction as f, type AgentWithReadiness as g, type AgentSyncRun as h, type ActionType as i, ActionTypeSchema as j, AgentDefinitionSchema as k, type AgentDriftSeverity as l, AgentDriftSeveritySchema as m, type AgentModel as n, AgentModelSchema as o, type AgentReadiness as p, AgentReadinessSchema as q, type AgentReadinessStatus as r, AgentReadinessStatusSchema as s, type AgentRecoveryAction as t, AgentRecoveryActionSchema as u, type AgentSkillRef as v, AgentSkillRefSchema as w, type AgentSyncResult as x, AgentSyncResultSchema as y, AgentSyncRunSchema as z };
+export { type ListCloudAgentsResponse as $, type AgentDefinition as A, AgentSyncResultSchema as B, type CloudAgent as C, type Diagnostic as D, type EventStreamOptions as E, AgentSyncRunSchema as F, type AgentSyncStatus as G, AgentSyncStatusSchema as H, AgentWithReadinessSchema as I, CloudAgentSchema as J, CloudEnvironmentSchema as K, CloudVaultSchema as L, type CreateSessionRequest as M, CreateSessionRequestSchema as N, type CreateSessionResponse as O, type ProviderSessionEvent as P, CreateSessionResponseSchema as Q, type ResourceAddress as R, DiagnosticSchema as S, type DiagnosticSeverity as T, DiagnosticSeveritySchema as U, type DriftKind as V, DriftKindSchema as W, type GetSessionRequest as X, GetSessionRequestSchema as Y, KNOWN_SESSION_EVENT_TYPES as Z, type KnownSessionEventType as _, type CloudEnvironment as a, ListCloudAgentsResponseSchema as a0, type ListCloudEnvironmentsResponse as a1, ListCloudEnvironmentsResponseSchema as a2, type ListSessionEventsRequest as a3, ListSessionEventsRequestSchema as a4, type ListSessionEventsResponse as a5, ListSessionEventsResponseSchema as a6, type ListSessionsRequest as a7, ListSessionsRequestSchema as a8, type ListSessionsResponse as a9, ListSessionsResponseSchema as aa, type PlanReadinessImpact as ab, PlanReadinessImpactSchema as ac, PlannedActionSchema as ad, ResourceAddressSchema as ae, ResourceTypeSchema as af, type SendEventRequest as ag, SendEventRequestSchema as ah, type SendEventResponse as ai, SendEventResponseSchema as aj, type Session as ak, type SessionAgent as al, SessionAgentSchema as am, type SessionContentBlock as an, SessionContentBlockSchema as ao, type SessionEvent as ap, SessionEventSchema as aq, type SessionEventType as ar, type SessionEventTypeName as as, SessionEventTypeSchema as at, SessionSchema as au, type CloudVault as b, type ResourceType as c, type EventListOptions as d, type ProviderSessionEventList as e, type PlannedAction as f, type AgentReadiness as g, type AgentWithReadiness as h, type AgentSyncRun as i, type ActionType as j, ActionTypeSchema as k, AgentDefinitionSchema as l, type AgentDriftSeverity as m, AgentDriftSeveritySchema as n, type AgentModel as o, AgentModelSchema as p, AgentReadinessSchema as q, type AgentReadinessStatus as r, AgentReadinessStatusSchema as s, type AgentRecoveryAction as t, AgentRecoveryActionSchema as u, type AgentSkillRef as v, AgentSkillRefSchema as w, type AgentSyncReason as x, AgentSyncReasonSchema as y, type AgentSyncResult as z };

package/dist/session-events.d.ts

@@ -1,4 +1,4 @@
-import { P as ProviderSessionEvent, an as SessionEvent } from './session-event-5kLRNMHC.js';
+import { P as ProviderSessionEvent, ap as SessionEvent } from './session-event-B63Rbjim.js';
 import 'zod';
 
 declare function sanitizeSessionEvents(events: ProviderSessionEvent[], options?: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openagentpack/sdk",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "OpenAgentPack SDK (Node-compatible runtime)",
   "license": "Apache-2.0",
   "keywords": [