@openagentpack/sdk 0.6.0 → 0.7.0

package/dist/chunk-HIK5DY4I.js

@@ -0,0 +1,2429 @@
+import {
+  ApiError,
+  ConflictError,
+  DeploymentCreateConflictError,
+  DiagnosticCollector,
+  UserError,
+  buildProviders,
+  collectProviderCapabilities,
+  collectReferenceDiagnostics,
+  extractSkillZipFiles,
+  getProvider,
+  isSupported,
+  resolveAgentMaterialization,
+  resolveFetch,
+  resolveTargetProviders,
+  skillNameFromFiles
+} from "./chunk-ZBJDMUJT.js";
+
+// src/internal/core/project-runtime.ts
+function createProjectRuntime(input) {
+  const providers = buildProviders(input.providers ?? input.config.providers, input.projectName);
+  return {
+    configPath: input.configPath,
+    projectName: input.projectName,
+    config: input.config,
+    state: input.state,
+    providers
+  };
+}
+async function readProjectRuntime(input, fn) {
+  return input.stateBackend.read(
+    input.stateScope,
+    (state) => fn(
+      createProjectRuntime({
+        projectName: input.projectName,
+        config: input.config,
+        state,
+        configPath: input.configPath,
+        providers: input.providers
+      })
+    )
+  );
+}
+async function writeProjectRuntime(input, fn) {
+  return input.stateBackend.write(
+    input.stateScope,
+    (state) => fn(
+      createProjectRuntime({
+        projectName: input.projectName,
+        config: input.config,
+        state,
+        configPath: input.configPath,
+        providers: input.providers
+      })
+    )
+  );
+}
+function getRuntimeProvider(ctx, providerName) {
+  const adapter = ctx.providers.get(providerName);
+  if (!adapter) {
+    throw new UserError(`Provider '${providerName}' not configured.`);
+  }
+  return adapter;
+}
+
+// src/internal/core/skill-source.ts
+import { readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { basename, resolve as resolve2 } from "path";
+import { parse } from "yaml";
+
+// src/internal/utils/collect-files.ts
+import { readdirSync, readFileSync, statSync } from "fs";
+import { resolve } from "path";
+function collectFiles(dir, base) {
+  const results = [];
+  for (const entry of readdirSync(dir).sort()) {
+    const fullPath = resolve(dir, entry);
+    const rel = base ? `${base}/${entry}` : entry;
+    const entryStat = statSync(fullPath);
+    if (entryStat.isFile()) {
+      results.push({ relativePath: rel, content: readFileSync(fullPath) });
+    } else if (entryStat.isDirectory()) {
+      results.push(...collectFiles(fullPath, rel));
+    }
+  }
+  return results;
+}
+
+// src/internal/core/skill-source.ts
+async function inspectSkillSource(source, options = {}) {
+  if (/^https?:\/\//i.test(source)) {
+    throw new UserError("Skill source inspection only accepts a local directory, zip, or SKILL.md file.");
+  }
+  const sourcePath = resolve2(options.basePath ?? process.cwd(), source);
+  const sourceStat = statSync2(sourcePath, { throwIfNoEntry: false });
+  if (!sourceStat) throw new UserError(`Skill source not found: ${source}`);
+  let files;
+  if (sourceStat.isDirectory()) {
+    files = collectFiles(sourcePath, "");
+  } else if (sourceStat.isFile() && sourcePath.toLowerCase().endsWith(".zip")) {
+    files = await extractSkillZipFiles(readFileSync2(sourcePath));
+  } else if (sourceStat.isFile() && basename(sourcePath).toLowerCase() === "skill.md") {
+    files = [{ relativePath: "SKILL.md", content: readFileSync2(sourcePath) }];
+  } else {
+    throw new UserError("Skill source must be a directory, .zip archive, or SKILL.md file.");
+  }
+  const normalizedFiles = normalizeSkillRoot(files);
+  const manifest = normalizedFiles.find((file) => file.relativePath === "SKILL.md");
+  const name = parseSkillManifestName(manifest.content);
+  return { name, sourcePath, files: normalizedFiles };
+}
+function normalizeSkillRoot(files) {
+  if (files.some((file) => file.relativePath === "SKILL.md")) return files;
+  const manifests = files.filter((file) => file.relativePath.endsWith("/SKILL.md"));
+  if (manifests.length === 0) throw new UserError("Skill source does not contain SKILL.md.");
+  if (manifests.length > 1) {
+    throw new UserError("Skill source contains multiple SKILL.md files and has no unambiguous root.");
+  }
+  const prefix = manifests[0].relativePath.slice(0, -"SKILL.md".length);
+  return files.filter((file) => file.relativePath.startsWith(prefix)).map((file) => ({ ...file, relativePath: file.relativePath.slice(prefix.length) }));
+}
+function parseSkillManifestName(content) {
+  const text = content.toString("utf8");
+  const frontmatter = text.match(/^---\s*\r?\n([\s\S]*?)\r?\n---(?:\s*\r?\n|$)/);
+  if (!frontmatter) throw new UserError("SKILL.md must start with YAML frontmatter containing a name.");
+  let manifest;
+  try {
+    manifest = parse(frontmatter[1]);
+  } catch (error) {
+    throw new UserError(`Invalid SKILL.md frontmatter: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const rawName = manifest && typeof manifest === "object" ? manifest.name : void 0;
+  const name = typeof rawName === "string" ? rawName.trim() : "";
+  if (!name) throw new UserError("SKILL.md frontmatter must contain a non-empty name.");
+  return name;
+}
+
+// src/internal/executor/executor.ts
+import { basename as basename2, dirname as dirname3, resolve as resolve4 } from "path";
+
+// src/internal/utils/hash.ts
+import { createHash } from "crypto";
+function sha256(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
+function contentHash(obj) {
+  const normalized = JSON.stringify(sortDeep(obj));
+  return sha256(normalized);
+}
+function sortDeep(obj) {
+  if (obj === null || obj === void 0) return obj;
+  if (Array.isArray(obj)) return obj.map(sortDeep);
+  if (typeof obj === "object") {
+    const sorted = {};
+    for (const key of Object.keys(obj).sort()) {
+      sorted[key] = sortDeep(obj[key]);
+    }
+    return sorted;
+  }
+  return obj;
+}
+
+// src/internal/planner/declaration.ts
+function getResourceDeclaration(address, config) {
+  const { type, name } = address;
+  switch (type) {
+    case "environment":
+      return config.environments?.[name] ?? null;
+    case "vault":
+      return config.vaults?.[name] ?? null;
+    case "memory_store":
+      return config.memory_stores?.[name] ?? null;
+    case "skill":
+      return config.skills?.[name] ?? null;
+    case "agent":
+    case "template":
+      return config.agents?.[name] ?? null;
+    case "file":
+      return config.files?.[name] ?? null;
+    case "identity":
+      return config.identities?.[name] ?? null;
+    case "channel":
+      return config.channels?.[name] ?? null;
+    case "deployment":
+      return config.deployments?.[name] ?? null;
+    default:
+      return null;
+  }
+}
+
+// src/internal/planner/comparable.ts
+function computeComparableDesiredHash(address, config, provider) {
+  const decl = getResourceDeclaration(address, config);
+  if (!decl || !provider.normalizeDesiredResource) return void 0;
+  const comparable = provider.normalizeDesiredResource(address.type, address.name, decl);
+  return comparable === null ? void 0 : contentHash(comparable);
+}
+
+// src/internal/planner/hasher.ts
+import { readFileSync as readFileSync3, statSync as statSync3 } from "fs";
+import { dirname, resolve as resolve3 } from "path";
+async function computeResourceHash(address, config, basePath, state) {
+  const decl = getDeclaration(address, config);
+  if (!decl) return "";
+  if (address.type === "skill") {
+    const skillDecl = decl;
+    const apiMode = resolveQoderApiMode(address.type, address.name, address.provider, config);
+    if (basePath) {
+      const fileHash = computeSkillContentHash(skillDecl.source, basePath);
+      return contentHash({ decl, fileHash, apiMode });
+    }
+    return contentHash({ decl, apiMode });
+  }
+  if (address.type === "environment" || address.type === "vault" || address.type === "memory_store") {
+    return contentHash({ decl, apiMode: resolveQoderApiMode(address.type, address.name, address.provider, config) });
+  }
+  if (address.type === "file" && basePath) {
+    const fileDecl = decl;
+    const fileHash = computeLocalFileContentHash(fileDecl.source, basePath);
+    return contentHash({
+      decl,
+      fileHash,
+      apiMode: resolveQoderApiMode("file", address.name, address.provider, config)
+    });
+  }
+  if (address.type === "deployment") {
+    const refs = resolveDeploymentReferenceIds(decl, config, address.provider, state);
+    const sourceHashes = basePath ? computeDeploymentSourceHashes(decl, basePath) : void 0;
+    if (refs || sourceHashes) return contentHash({ decl, refs, sourceHashes });
+  }
+  if (address.type === "template") {
+    const refs = resolveTemplateReferenceIds(decl, config, address.provider, state);
+    return contentHash({ decl: withoutLocalSessionFileMounts(decl), refs });
+  }
+  if (address.type === "agent") return contentHash(withoutLocalSessionFileMounts(decl));
+  if (address.type === "channel") {
+    const refs = resolveChannelReferenceIds(
+      decl,
+      config,
+      address.provider,
+      state
+    );
+    return contentHash({ decl, refs });
+  }
+  return contentHash(decl);
+}
+function withoutLocalSessionFileMounts(decl) {
+  if (!decl || typeof decl !== "object" || Array.isArray(decl)) return decl;
+  const { files, ...remoteDeclaration } = decl;
+  const templateFiles = Array.isArray(files) ? files.filter((file) => typeof file === "string") : [];
+  return templateFiles.length ? { ...remoteDeclaration, files: templateFiles } : remoteDeclaration;
+}
+function resolveQoderApiMode(type, name, provider, config) {
+  if (provider !== "qoder") return void 0;
+  if (type === "environment" && config.environments?.[name]?.environment_id) return "auto";
+  for (const agent of Object.values(config.agents ?? {})) {
+    if (agent.provider && agent.provider !== provider) continue;
+    const referenced = type === "environment" ? agent.environment === name : type === "skill" ? agent.skills?.some(
+      (skill) => typeof skill === "string" ? skill === name : skill.type === "custom" && skill.skill_id === name
+    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.some((file) => (typeof file === "string" ? file : file.file) === name);
+    if (referenced && agent.delivery?.qoder?.type === "forward") return "forward";
+  }
+  return "managed";
+}
+function computeReplacementFingerprint(address, config) {
+  if (address.type !== "channel") return void 0;
+  const decl = config.channels?.[address.name];
+  if (!decl) return void 0;
+  return contentHash({ channel_type: decl.type, mode: decl.mode ?? "fixed", credentials: decl.credentials ?? {} });
+}
+function resolveChannelReferenceIds(decl, config, provider, state) {
+  if (decl.mode === "pairing" || !decl.agent) {
+    return { mode: "pairing" };
+  }
+  const agent = config.agents?.[decl.agent];
+  const agentType = agent?.delivery?.[provider]?.type === "forward" ? "template" : "agent";
+  const identity = decl.identity ?? config.defaults?.identity;
+  return {
+    agent_id: state?.getResource({ type: agentType, name: decl.agent, provider })?.remote_id,
+    identity_id: identity ? state?.getResource({ type: "identity", name: identity, provider })?.remote_id : void 0
+  };
+}
+function resolveTemplateReferenceIds(decl, config, provider, state) {
+  const environment = decl.environment ? config.environments?.[decl.environment] : void 0;
+  const tunnel = decl.tunnel ? config.tunnels?.[decl.tunnel] : void 0;
+  const skillIds = (decl.skills ?? []).map((skill) => {
+    if (typeof skill === "string") {
+      return state?.getResource({ type: "skill", name: skill, provider })?.remote_id ?? skill;
+    }
+    if (skill.type === "official") return `${skill.type}:${skill.skill_id}:${skill.version ?? ""}`;
+    return state?.getResource({ type: "skill", name: skill.skill_id, provider })?.remote_id ?? `${skill.type}:${skill.skill_id}:${skill.version ?? ""}`;
+  });
+  return {
+    environment_id: environment?.environment_id ?? (decl.environment ? state?.getResource({ type: "environment", name: decl.environment, provider })?.remote_id ?? void 0 : void 0),
+    tunnel_id: tunnel?.tunnel_id,
+    vault_ids: decl.vault ? [state?.getResource({ type: "vault", name: decl.vault, provider })?.remote_id ?? decl.vault] : [],
+    skill_ids: skillIds,
+    memory_store_ids: (decl.memory_stores ?? []).map(
+      (memoryStore) => state?.getResource({ type: "memory_store", name: memoryStore, provider })?.remote_id ?? memoryStore
+    ),
+    file_ids: (decl.files ?? []).filter((file) => typeof file === "string").map((file) => state?.getResource({ type: "file", name: file, provider })?.remote_id ?? file),
+    identity_id: decl.memory_stores?.length && config.defaults?.identity ? state?.getResource({ type: "identity", name: config.defaults.identity, provider })?.remote_id : void 0
+  };
+}
+function resolveDeploymentReferenceIds(decl, config, provider, state) {
+  const agent = config.agents?.[decl.agent];
+  const envName = decl.environment ?? agent?.environment;
+  if (!envName) return void 0;
+  const envDecl = config.environments?.[envName];
+  return {
+    environment_id: envDecl?.environment_id ?? (envDecl ? state?.getResource({ type: "environment", name: envName, provider })?.remote_id ?? void 0 : void 0)
+  };
+}
+function getDeclaration(address, config) {
+  return getResourceDeclaration(address, config);
+}
+function computeDeploymentSourceHashes(decl, basePath) {
+  const sources = [
+    ...new Set(
+      (decl.resources ?? []).flatMap(
+        (resource) => resource.type === "file" && !resource.file_id && resource.source ? [resource.source] : []
+      )
+    )
+  ];
+  if (sources.length === 0) return void 0;
+  return Object.fromEntries(sources.map((source) => [source, computeLocalFileContentHash(source, basePath)]));
+}
+function computeLocalFileContentHash(source, basePath) {
+  const fullPath = resolve3(dirname(basePath), source);
+  const stat = statSync3(fullPath, { throwIfNoEntry: false });
+  if (!stat?.isFile()) return "";
+  return contentHash(readFileSync3(fullPath).toString("base64"));
+}
+function computeSkillContentHash(source, basePath) {
+  const fullPath = resolve3(dirname(basePath), source);
+  const stat = statSync3(fullPath, { throwIfNoEntry: false });
+  if (stat?.isDirectory()) {
+    const parts = collectFiles(fullPath, "").map((file) => `${file.relativePath}:${file.content.toString("utf-8")}`);
+    return contentHash(parts.join("\n"));
+  }
+  if (stat?.isFile()) {
+    if (fullPath.endsWith(".zip")) {
+      const content2 = readFileSync3(fullPath);
+      return contentHash(content2.toString("base64"));
+    }
+    const content = readFileSync3(fullPath, "utf-8");
+    return contentHash(content);
+  }
+  return "";
+}
+
+// src/internal/planner/plan-semantics.ts
+var NON_BLOCKING_ROOT_FIELDS = /* @__PURE__ */ new Set(["description", "metadata"]);
+function diffChangedPaths(before, after, prefix = "") {
+  if (Object.is(before, after)) return [];
+  if (Array.isArray(before) || Array.isArray(after)) {
+    return structurallyEqual(before, after) ? [] : [prefix || "$root"];
+  }
+  if (isRecord(before) && isRecord(after)) {
+    const paths = [];
+    const keys = /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)]);
+    for (const key of [...keys].sort()) {
+      const path = prefix ? `${prefix}.${key}` : key;
+      paths.push(...diffChangedPaths(before[key], after[key], path));
+    }
+    return paths;
+  }
+  return [prefix || "$root"];
+}
+function classifyReadinessImpact(action, changedPaths) {
+  if (action === "no-op") return "none";
+  if (action !== "update" || !changedPaths || changedPaths.length === 0) return "blocking";
+  return changedPaths.every(isNonBlockingPath) ? "non_blocking" : "blocking";
+}
+function buildReadinessBaseline(declaration) {
+  const record = isRecord(declaration) ? declaration : {};
+  const { description: _description, metadata: _metadata, ...operational } = record;
+  return {
+    operational_hash: contentHash(operational),
+    description_hash: contentHash(record.description ?? null),
+    metadata_hash: contentHash(record.metadata ?? null)
+  };
+}
+function diffReadinessBaseline(before, after) {
+  const paths = [];
+  if (before.operational_hash !== after.operational_hash) paths.push("$operational");
+  if (before.description_hash !== after.description_hash) paths.push("description");
+  if (before.metadata_hash !== after.metadata_hash) paths.push("metadata");
+  return paths;
+}
+function isNonBlockingPath(path) {
+  const root = path.split(".", 1)[0];
+  return root !== void 0 && NON_BLOCKING_ROOT_FIELDS.has(root);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function structurallyEqual(left, right) {
+  return contentHash(left) === contentHash(right);
+}
+
+// src/internal/providers/drift-support.ts
+function supportsFullDrift(adapter, type) {
+  return adapter.getDriftSupport?.(type) === "full" && typeof adapter.readComparableResource === "function";
+}
+async function readComparableIfSupported(adapter, type, id, name) {
+  if (!supportsFullDrift(adapter, type)) return null;
+  if (typeof adapter.readComparableResource !== "function") return null;
+  try {
+    return await adapter.readComparableResource(type, id, name);
+  } catch {
+    return null;
+  }
+}
+
+// src/internal/types/runtime-feedback.ts
+function emitRuntimeFeedback(sink, event) {
+  sink?.(event);
+}
+
+// src/internal/types/state.ts
+function addressKey(addr) {
+  return `${addr.provider}.${addr.type}.${addr.name}`;
+}
+
+// src/internal/executor/resolver.ts
+function resolveRef(state, address) {
+  return state.getResource(address)?.remote_id;
+}
+function requireRef(state, address) {
+  const id = resolveRef(state, address);
+  if (!id) {
+    throw new UserError(
+      `Resource ${address.provider}.${address.type}.${address.name} not found in state. Run \`agents apply\` first.`
+    );
+  }
+  return id;
+}
+function resolveAgentRefs(agentName, config, provider, state) {
+  const agent = config.agents?.[agentName];
+  if (!agent) throw new UserError(`Agent '${agentName}' not found in config`);
+  const refs = {
+    skill_ids: []
+  };
+  if (agent.skills) {
+    for (const skill of agent.skills) {
+      if (typeof skill === "string") {
+        const id = requireRef(state, { type: "skill", name: skill, provider });
+        refs.skill_ids.push({ type: "custom", skill_id: id });
+      } else {
+        const resolvedId = skill.type === "custom" ? resolveRef(state, {
+          type: "skill",
+          name: skill.skill_id,
+          provider
+        }) ?? skill.skill_id : skill.skill_id;
+        refs.skill_ids.push({
+          type: skill.type,
+          skill_id: resolvedId,
+          version: skill.version
+        });
+      }
+    }
+  }
+  if (agent.multiagent) {
+    refs.multiagent_agent_ids = [];
+    for (const subName of agent.multiagent.agents) {
+      const id = resolveRef(state, { type: "agent", name: subName, provider });
+      if (id) refs.multiagent_agent_ids.push(id);
+    }
+  }
+  return refs;
+}
+function resolveTemplateRefs(agentName, config, provider, state) {
+  const agent = config.agents?.[agentName];
+  if (!agent) throw new UserError(`Agent '${agentName}' not found in config`);
+  if (!agent.environment) {
+    throw new UserError(`Forward template '${agentName}' must declare an environment.`);
+  }
+  const environment = config.environments?.[agent.environment];
+  if (!environment) throw new UserError(`Environment '${agent.environment}' is not defined in config.`);
+  const agentRefs = resolveAgentRefs(agentName, config, provider, state);
+  const memoryStoreIds = (agent.memory_stores ?? []).map(
+    (memoryStore) => requireRef(state, { type: "memory_store", name: memoryStore, provider })
+  );
+  const identityName = config.defaults?.identity;
+  return {
+    ...agentRefs,
+    environment_id: environment.environment_id ?? requireRef(state, { type: "environment", name: agent.environment, provider }),
+    ...agent.tunnel ? { tunnel_id: resolveTunnelIdFromConfig(config, agent.tunnel, provider) } : {},
+    vault_ids: agent.vault ? [requireRef(state, { type: "vault", name: agent.vault, provider })] : [],
+    file_ids: (agent.files ?? []).filter((file) => typeof file === "string").map((file) => requireRef(state, { type: "file", name: file, provider })),
+    memory_store_ids: memoryStoreIds,
+    owned_memory_store_ids: state.listResources().filter(
+      (resource) => resource.address.provider === provider && resource.address.type === "memory_store" && resource.api_mode === "forward" && typeof resource.remote_id === "string"
+    ).map((resource) => resource.remote_id),
+    ...identityName ? { identity_id: requireRef(state, { type: "identity", name: identityName, provider }) } : {}
+  };
+}
+function resolveDeploymentRefs(deploymentName, config, provider, state) {
+  const dep = config.deployments?.[deploymentName];
+  if (!dep) throw new UserError(`Deployment '${deploymentName}' not found in config`);
+  const agent = config.agents?.[dep.agent];
+  if (!agent) {
+    throw new UserError(`Deployment '${deploymentName}' references unknown agent '${dep.agent}'`);
+  }
+  const agent_id = requireRef(state, {
+    type: "agent",
+    name: dep.agent,
+    provider
+  });
+  const envName = dep.environment ?? agent.environment;
+  if (!envName) {
+    throw new UserError(
+      `Deployment '${deploymentName}' has no environment and agent '${dep.agent}' does not declare one`
+    );
+  }
+  const envDecl = config.environments?.[envName];
+  if (!envDecl) {
+    throw new UserError(`Environment '${envName}' is not defined in config.`);
+  }
+  const environment_id = envDecl.environment_id ?? requireRef(state, {
+    type: "environment",
+    name: envName,
+    provider
+  });
+  const tunnelName = dep.tunnel ?? agent.tunnel;
+  const tunnel_id = tunnelName ? resolveTunnelIdFromConfig(config, tunnelName, provider) : void 0;
+  const vaultNames = dep.vaults ?? (agent.vault ? [agent.vault] : []);
+  const vault_ids = vaultNames.map((v) => requireRef(state, { type: "vault", name: v, provider }));
+  const msNames = /* @__PURE__ */ new Set();
+  for (const m of dep.memory_stores ?? []) msNames.add(m);
+  for (const r of dep.resources ?? []) {
+    if (r.type === "memory_store") msNames.add(r.memory_store);
+  }
+  if (msNames.size === 0) {
+    for (const m of agent.memory_stores ?? []) msNames.add(m);
+  }
+  const memory_store_ids = {};
+  for (const m of msNames) {
+    memory_store_ids[m] = requireRef(state, {
+      type: "memory_store",
+      name: m,
+      provider
+    });
+  }
+  return {
+    agent_id,
+    agent_version: dep.agent_version,
+    environment_id,
+    tunnel_id,
+    vault_ids,
+    memory_store_ids
+  };
+}
+function resolveChannelRefs(channelName, config, provider, state) {
+  const channel = config.channels?.[channelName];
+  if (!channel) throw new UserError(`Channel '${channelName}' not found in config`);
+  if (channel.mode === "pairing") {
+    return {};
+  }
+  if (!channel.agent) {
+    throw new UserError(`Channel '${channelName}' is fixed mode and must declare agent`);
+  }
+  const agent = config.agents?.[channel.agent];
+  if (!agent) throw new UserError(`Channel '${channelName}' references unknown agent '${channel.agent}'`);
+  const agentType = agent.delivery?.[provider]?.type === "forward" ? "template" : "agent";
+  const agent_id = requireRef(state, { type: agentType, name: channel.agent, provider });
+  const identityName = channel.identity ?? config.defaults?.identity;
+  if (!identityName) {
+    throw new UserError(`Channel '${channelName}' must declare identity or use defaults.identity.`);
+  }
+  const identity_id = requireRef(state, { type: "identity", name: identityName, provider });
+  return { identity_id, agent_id };
+}
+function resolveTunnelIdFromConfig(config, tunnelName, provider) {
+  if (provider !== "qoder") {
+    throw new UserError("Tunnels are supported only by Qoder BYOC sessions.");
+  }
+  const tunnel = config.tunnels?.[tunnelName];
+  if (!tunnel) {
+    throw new UserError(`Tunnel '${tunnelName}' is not defined in config. Declare it under the 'tunnels:' section.`);
+  }
+  return tunnel.tunnel_id;
+}
+
+// src/internal/executor/skill-resolver.ts
+import { dirname as dirname2 } from "path";
+async function resolveSkillFiles(decl, ctx) {
+  if (/^https?:\/\//i.test(decl.source)) {
+    const res = await resolveFetch()(decl.source);
+    if (!res.ok) throw new Error(`skill source \u4E0B\u8F7D\u5931\u8D25\uFF1A${res.status} ${decl.source}`);
+    return extractSkillZipFiles(Buffer.from(await res.arrayBuffer()));
+  }
+  if (!ctx.configPath) return [];
+  return (await inspectSkillSource(decl.source, { basePath: dirname2(ctx.configPath) })).files;
+}
+
+// src/internal/executor/executor.ts
+function memoryStoreUnsupported(provider) {
+  return new UserError(`Provider '${provider}' does not support memory stores`);
+}
+var DEFAULT_CONCURRENCY = 6;
+var MAX_CONCURRENCY = 10;
+function clampConcurrency(value) {
+  if (value === void 0 || !Number.isFinite(value)) return DEFAULT_CONCURRENCY;
+  return Math.max(1, Math.min(MAX_CONCURRENCY, Math.floor(value)));
+}
+async function executePlan(plan, ctx, options = {}) {
+  const concurrency = clampConcurrency(options.concurrency);
+  const resultsByKey = /* @__PURE__ */ new Map();
+  const failed = /* @__PURE__ */ new Set();
+  let stateUpdated = false;
+  for (const action of plan.actions) {
+    if (action.address.type !== "environment" && action.address.type !== "identity") continue;
+    const existing = ctx.state.getResource(action.address);
+    const externalId = action.address.type === "environment" ? ctx.config.environments?.[action.address.name]?.environment_id : ctx.config.identities?.[action.address.name]?.identity_id;
+    if (externalId && existing && !existing.externally_managed) {
+      ctx.state.setResource({ ...existing, externally_managed: true });
+      stateUpdated = true;
+    }
+  }
+  if (stateUpdated) await ctx.state.save();
+  const actionable = plan.actions.filter((a) => a.action !== "no-op");
+  const mutations = actionable.filter((a) => a.action !== "delete");
+  const deletions = actionable.filter((a) => a.action === "delete");
+  const runAction = async (action) => {
+    const key = addressKey(action.address);
+    const depFailed = action.dependencies.some((d) => failed.has(addressKey(d)));
+    if (depFailed) {
+      resultsByKey.set(key, { action, status: "skipped" });
+      failed.add(key);
+      return;
+    }
+    const provider = ctx.providers.get(action.address.provider);
+    if (!provider) {
+      resultsByKey.set(key, {
+        action,
+        status: "failed",
+        error: new Error(`Provider '${action.address.provider}' not configured`)
+      });
+      failed.add(key);
+      return;
+    }
+    try {
+      const adopted = await executeAction(action, provider, ctx);
+      resultsByKey.set(key, { action, status: "success" });
+      if (!adopted) {
+        emitRuntimeFeedback(ctx.onFeedback, {
+          type: "resource_action_success",
+          level: "success",
+          action,
+          resource: action.address,
+          message: `${action.action} ${action.address.type}.${action.address.name} (${action.address.provider})`
+        });
+      }
+    } catch (err) {
+      const error = err instanceof Error ? err : new Error(String(err));
+      resultsByKey.set(key, { action, status: "failed", error });
+      failed.add(key);
+      emitRuntimeFeedback(ctx.onFeedback, {
+        type: "resource_action_failed",
+        level: "error",
+        action,
+        resource: action.address,
+        message: `Failed to ${action.action} ${action.address.type}.${action.address.name}: ${error.message}`
+      });
+    }
+  };
+  for (const level of buildActionLevels(mutations)) {
+    await runWithConcurrency(level, concurrency, runAction);
+    await ctx.state.save();
+  }
+  if (!ctx.createOnly) {
+    await reconcileDefaultMemoryStores(ctx, new Set(plan.actions.map((action) => action.address.provider)));
+  }
+  for (const action of deletions) {
+    await runAction(action);
+    await ctx.state.save();
+  }
+  const results = actionable.map((a) => resultsByKey.get(addressKey(a.address)));
+  return {
+    results,
+    partial: results.some((r) => r.status === "failed")
+  };
+}
+async function reconcileDefaultMemoryStores(ctx, plannedProviders) {
+  const identityName = ctx.config.defaults?.identity;
+  for (const [agentName, agent] of Object.entries(ctx.config.agents ?? {})) {
+    const desired = agent.default_memory_store;
+    if (!desired || agent.delivery?.qoder?.type !== "forward") continue;
+    const providerName = "qoder";
+    if (agent.provider && agent.provider !== providerName || !plannedProviders.has(providerName)) continue;
+    const provider = ctx.providers.get(providerName);
+    if (!provider?.reconcileDefaultMemoryStore || !identityName) continue;
+    const identityId = ctx.state.getResource({
+      type: "identity",
+      name: identityName,
+      provider: providerName
+    })?.remote_id;
+    const templateId = ctx.state.getResource({ type: "template", name: agentName, provider: providerName })?.remote_id;
+    if (!identityId || !templateId) continue;
+    const result = await provider.reconcileDefaultMemoryStore(identityId, templateId, desired);
+    const resource = { type: "template", name: agentName, provider: providerName };
+    if (result.status === "pending") {
+      emitRuntimeFeedback(ctx.onFeedback, {
+        type: "provider_wait",
+        level: "warning",
+        resource,
+        message: `default memory store for template.${agentName} is pending \u2014 create the first Forward Session, then run apply again`
+      });
+    } else if (result.status === "updated") {
+      emitRuntimeFeedback(ctx.onFeedback, {
+        type: "resource_action_success",
+        level: "success",
+        resource,
+        message: `updated default memory store for template.${agentName} to "${desired.name}"`
+      });
+    }
+  }
+}
+async function runWithConcurrency(items, limit, worker) {
+  if (items.length === 0) return;
+  let cursor = 0;
+  const size = Math.min(limit, items.length);
+  const runners = [];
+  for (let i = 0; i < size; i++) {
+    runners.push(
+      (async () => {
+        while (cursor < items.length) {
+          const item = items[cursor++];
+          await worker(item);
+        }
+      })()
+    );
+  }
+  await Promise.all(runners);
+}
+function buildActionLevels(actions) {
+  const inSet = new Set(actions.map((a) => addressKey(a.address)));
+  const remaining = /* @__PURE__ */ new Map();
+  const deps = /* @__PURE__ */ new Map();
+  for (const action of actions) {
+    const key = addressKey(action.address);
+    remaining.set(key, action);
+    const scoped = /* @__PURE__ */ new Set();
+    for (const dep of action.dependencies) {
+      const depKey = addressKey(dep);
+      if (inSet.has(depKey)) scoped.add(depKey);
+    }
+    deps.set(key, scoped);
+  }
+  const levels = [];
+  while (remaining.size > 0) {
+    const level = [];
+    for (const [key, action] of remaining) {
+      const scoped = deps.get(key);
+      let ready = true;
+      for (const depKey of scoped) {
+        if (remaining.has(depKey)) {
+          ready = false;
+          break;
+        }
+      }
+      if (ready) level.push(action);
+    }
+    if (level.length === 0) {
+      levels.push([...remaining.values()]);
+      break;
+    }
+    for (const action of level) remaining.delete(addressKey(action.address));
+    levels.push(level);
+  }
+  return levels;
+}
+async function executeAction(action, provider, ctx) {
+  try {
+    return await executeActionInner(action, provider, ctx);
+  } catch (err) {
+    if (action.action !== "update" || !ApiError.isNotFound(err)) throw err;
+    emitRuntimeFeedback(ctx.onFeedback, {
+      type: "resource_already_gone",
+      level: "warning",
+      action,
+      resource: action.address,
+      message: `update ${action.address.type}.${action.address.name} (${action.address.provider}) \u2014 not found remotely, recreating`
+    });
+    ctx.state.removeResource(action.previousAddress ?? action.address);
+    return executeActionInner({ ...action, action: "create", previousAddress: void 0 }, provider, ctx);
+  }
+}
+async function executeActionInner(action, provider, ctx) {
+  const { address } = action;
+  const { type, name } = address;
+  let adopted = false;
+  if (action.action === "delete") {
+    const existing = ctx.state.getResource(address);
+    if (!existing) return false;
+    const id = existing.remote_id;
+    const apiMode2 = existing.api_mode;
+    if (type === "environment" || type === "identity") {
+      const externalReference = type === "environment" ? ctx.config.environments?.[name]?.environment_id : ctx.config.identities?.[name]?.identity_id;
+      if (existing.externally_managed || externalReference) {
+        ctx.state.removeResource(address);
+        return false;
+      }
+    }
+    if (id !== null) {
+      try {
+        switch (type) {
+          case "environment":
+            await provider.deleteEnvironment(id, false, apiMode2);
+            break;
+          case "vault":
+            await provider.deleteVault(id, apiMode2);
+            break;
+          case "skill":
+            await provider.deleteSkill(id, apiMode2);
+            break;
+          case "agent":
+            await provider.deleteAgent(id);
+            break;
+          case "template":
+            if (!provider.archiveTemplate)
+              throw new UserError(`Provider '${address.provider}' does not support templates`);
+            await provider.archiveTemplate(id, ownedForwardMemoryStoreIds(ctx, address.provider));
+            break;
+          case "memory_store":
+            if (!provider.deleteMemoryStore) throw memoryStoreUnsupported(address.provider);
+            await provider.deleteMemoryStore(id, apiMode2);
+            break;
+          case "deployment":
+            await provider.deleteDeployment(id);
+            break;
+          case "file":
+            await provider.deleteFile(id, apiMode2);
+            break;
+          case "identity":
+            if (!provider.deleteIdentity)
+              throw new UserError(`Provider '${address.provider}' does not support identities`);
+            await provider.deleteIdentity(id);
+            break;
+          case "channel":
+            if (!provider.deleteChannel)
+              throw new UserError(`Provider '${address.provider}' does not support channels`);
+            await provider.deleteChannel(id);
+            break;
+        }
+      } catch (err) {
+        if (!ApiError.isNotFound(err)) throw err;
+        emitRuntimeFeedback(ctx.onFeedback, {
+          type: "resource_already_gone",
+          level: "warning",
+          resource: address,
+          message: `${type}.${name} (${address.provider}) \u2014 already deleted remotely, cleaning up state`
+        });
+      }
+    }
+    ctx.state.removeResource(address);
+    return false;
+  }
+  const isUpdate = action.action === "update";
+  const priorAddress = action.previousAddress ?? address;
+  const existingId = isUpdate ? ctx.state.getResource(priorAddress)?.remote_id : void 0;
+  const apiMode = resolveResourceApiMode(type, name, address.provider, ctx.config);
+  const priorApiMode = ctx.state.getResource(priorAddress)?.api_mode ?? (address.provider === "qoder" ? "managed" : void 0);
+  const apiModeChanged = isUpdate && apiMode !== void 0 && priorApiMode !== apiMode;
+  let result;
+  switch (type) {
+    case "environment": {
+      const decl = ctx.config.environments[name];
+      const remoteName = decl.name ?? name;
+      if (decl.environment_id) {
+        result = { id: decl.environment_id, type: "environment" };
+        emitRuntimeFeedback(ctx.onFeedback, {
+          type: "resource_action_success",
+          level: "info",
+          action,
+          resource: action.address,
+          message: `${action.action} ${action.address.type}.${action.address.name} (${action.address.provider}) \u2014 external reference, no remote mutation`
+        });
+      } else if (apiModeChanged) {
+        try {
+          result = await provider.createEnvironment(remoteName, decl, apiMode);
+        } catch (err) {
+          result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            mode: apiMode,
+            createOnly: ctx.createOnly,
+            onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl, apiMode)
+          });
+          adopted = true;
+        }
+        if (existingId) await provider.deleteEnvironment(existingId, false, priorApiMode);
+      } else if (isUpdate) {
+        const prior = ctx.state.getResource(address);
+        if (prior?.externally_managed) {
+          throw new UserError(
+            `environment.${name} is recorded as an external reference (${prior.remote_id ?? "unknown id"}); refusing to modify it remotely. Restore 'environment_id' to keep it as a reference, or release it first with 'agents state rm environment.${name}' (then 'agents state import' to adopt it as a managed resource).`
+          );
+        }
+        result = await provider.updateEnvironment(existingId, remoteName, decl, apiMode);
+      } else {
+        try {
+          result = await provider.createEnvironment(remoteName, decl, apiMode);
+        } catch (err) {
+          result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            mode: apiMode,
+            createOnly: ctx.createOnly,
+            onExisting: (existing) => provider.updateEnvironment(existing.id, remoteName, decl, apiMode)
+          });
+          adopted = true;
+        }
+      }
+      break;
+    }
+    case "vault": {
+      const decl = ctx.config.vaults[name];
+      if (apiModeChanged) {
+        result = await provider.createVault(name, decl, apiMode);
+        if (existingId) await provider.deleteVault(existingId, priorApiMode).catch(() => void 0);
+      } else if (isUpdate) {
+        try {
+          result = await provider.createVault(name, decl, apiMode);
+          await provider.deleteVault(existingId, apiMode);
+        } catch {
+          await provider.deleteVault(existingId, apiMode);
+          result = await provider.createVault(name, decl, apiMode);
+        }
+      } else {
+        try {
+          result = await provider.createVault(name, decl, apiMode);
+        } catch (err) {
+          result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            mode: apiMode,
+            createOnly: ctx.createOnly,
+            onExisting: async (existing) => {
+              await provider.deleteVault(existing.id, apiMode);
+              return provider.createVault(name, decl, apiMode);
+            }
+          });
+          adopted = true;
+        }
+      }
+      break;
+    }
+    case "skill": {
+      const decl = ctx.config.skills[name];
+      if (decl.origin && decl.origin !== "custom") {
+        emitRuntimeFeedback(ctx.onFeedback, {
+          type: "resource_action_success",
+          level: "info",
+          action,
+          resource: address,
+          message: `skip skill.${name} (${address.provider}) \u2014 official skill, no upload needed`
+        });
+        result = { id: null, type: "skill" };
+        adopted = true;
+        break;
+      }
+      const remoteName = decl.name ?? name;
+      const files = await resolveSkillFiles(decl, ctx);
+      if (apiModeChanged) {
+        result = await provider.createSkill(remoteName, decl, files, apiMode);
+        if (existingId) await provider.deleteSkill(existingId, priorApiMode).catch(() => void 0);
+      } else if (isUpdate) {
+        result = await provider.updateSkill(existingId, remoteName, decl, files, apiMode);
+      } else {
+        const manifestName = skillNameFromFiles(files);
+        const searchNames = manifestName && manifestName !== remoteName ? [remoteName, manifestName] : [remoteName];
+        const existing = await findExistingByNames(provider, "skill", searchNames, apiMode);
+        if (existing) {
+          if (ctx.createOnly) throw createOnlyExistingResourceError(address, existing.name);
+          result = existing.resource;
+          emitRuntimeFeedback(ctx.onFeedback, {
+            type: "resource_adopted",
+            level: "info",
+            resource: address,
+            message: `adopt skill.${name} (${address.provider}) \u2014 already existed remotely as "${existing.name}"`
+          });
+          adopted = true;
+        } else {
+          try {
+            result = await provider.createSkill(remoteName, decl, files, apiMode);
+          } catch (err) {
+            result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+              mode: apiMode,
+              searchNames,
+              createOnly: ctx.createOnly,
+              onExisting: async (existing2) => existing2
+            });
+            adopted = true;
+          }
+        }
+      }
+      break;
+    }
+    case "memory_store": {
+      const createMemoryStore = provider.createMemoryStore?.bind(provider);
+      const deleteMemoryStore = provider.deleteMemoryStore?.bind(provider);
+      if (!createMemoryStore || !deleteMemoryStore) throw memoryStoreUnsupported(address.provider);
+      const decl = ctx.config.memory_stores[name];
+      if (!provider.updateMemoryStore || !provider.listMemories || !provider.createMemory || !provider.updateMemory) {
+        throw memoryStoreUnsupported(address.provider);
+      }
+      const reconcile = async (storeId) => {
+        const store = await provider.updateMemoryStore(
+          storeId,
+          {
+            name,
+            description: decl.description,
+            metadata: decl.metadata ?? {}
+          },
+          apiMode
+        );
+        const current = /* @__PURE__ */ new Map();
+        let cursor;
+        do {
+          const page = await provider.listMemories(storeId, { limit: 100, cursor, view: "basic" }, apiMode);
+          for (const memory of page.data) {
+            if (memory.type === "memory") current.set(memory.path, memory);
+          }
+          cursor = page.has_more ? page.next_cursor : void 0;
+        } while (cursor);
+        for (const entry of decl.entries ?? []) {
+          const existing = current.get(entry.key.replace(/^\/+/, ""));
+          if (existing) {
+            if (existing.content_sha256 !== sha256(entry.content)) {
+              await provider.updateMemory(
+                storeId,
+                existing.id,
+                {
+                  content: entry.content,
+                  expected_content_sha256: existing.content_sha256
+                },
+                apiMode
+              );
+            }
+          } else {
+            await provider.createMemory(storeId, { path: entry.key, content: entry.content }, apiMode);
+          }
+        }
+        return store;
+      };
+      if (apiModeChanged) {
+        result = await createMemoryStore(name, decl, apiMode);
+        if (existingId) await deleteMemoryStore(existingId, priorApiMode).catch(() => void 0);
+      } else if (isUpdate) {
+        result = await reconcile(existingId);
+      } else {
+        try {
+          result = await createMemoryStore(name, decl, apiMode);
+        } catch (err) {
+          result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            mode: apiMode,
+            createOnly: ctx.createOnly,
+            onExisting: async (existing) => reconcile(existing.id)
+          });
+          adopted = true;
+        }
+      }
+      break;
+    }
+    case "agent": {
+      const decl = ctx.config.agents[name];
+      const remoteName = decl.name ?? name;
+      const refs = resolveAgentRefs(name, ctx.config, address.provider, ctx.state);
+      if (isUpdate) {
+        result = await provider.updateAgent(existingId, remoteName, decl, refs);
+      } else {
+        try {
+          result = await provider.createAgent(remoteName, decl, refs);
+        } catch (err) {
+          result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            createOnly: ctx.createOnly,
+            onExisting: (existing) => provider.updateAgent(existing.id, remoteName, decl, refs)
+          });
+          adopted = true;
+        }
+      }
+      break;
+    }
+    case "template": {
+      const createTemplate = provider.createTemplate?.bind(provider);
+      const updateTemplate = provider.updateTemplate?.bind(provider);
+      if (!createTemplate || !updateTemplate) {
+        throw new UserError(`Provider '${address.provider}' does not support templates`);
+      }
+      const decl = ctx.config.agents[name];
+      const remoteName = decl.name ?? name;
+      const refs = resolveTemplateRefs(name, ctx.config, address.provider, ctx.state);
+      if (isUpdate) {
+        result = await updateTemplate(existingId, remoteName, decl, refs);
+      } else {
+        try {
+          result = await createTemplate(remoteName, decl, refs);
+        } catch (err) {
+          result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            createOnly: ctx.createOnly,
+            onExisting: (existing) => updateTemplate(existing.id, remoteName, decl, refs)
+          });
+          adopted = true;
+        }
+      }
+      break;
+    }
+    case "identity": {
+      const createIdentity = provider.createIdentity?.bind(provider);
+      const updateIdentity = provider.updateIdentity?.bind(provider);
+      if (!createIdentity || !updateIdentity) {
+        throw new UserError(`Provider '${address.provider}' does not support identities`);
+      }
+      const decl = ctx.config.identities[name];
+      if (decl.identity_id) {
+        const remote2 = await provider.findResource("identity", name, decl.identity_id);
+        if (!remote2?.id) {
+          throw new UserError(
+            `External identity.${name} '${decl.identity_id}' was not found on provider '${address.provider}'.`
+          );
+        }
+        result = remote2;
+        break;
+      }
+      if (isUpdate) {
+        if (ctx.state.getResource(address)?.externally_managed) {
+          throw new UserError(`identity.${name} is recorded as an external reference; refusing to modify it remotely.`);
+        }
+        result = await updateIdentity(existingId, name, decl);
+      } else {
+        try {
+          result = await createIdentity(name, decl);
+        } catch (err) {
+          if (!(err instanceof ConflictError)) throw err;
+          if (ctx.createOnly) throw createOnlyExistingResourceError(address);
+          const existing = await provider.findResource("identity", decl.external_id);
+          if (!existing?.id) throw err;
+          result = await updateIdentity(existing.id, name, decl);
+          adopted = true;
+        }
+      }
+      break;
+    }
+    case "channel": {
+      const createChannel = provider.createChannel?.bind(provider);
+      const updateChannel = provider.updateChannel?.bind(provider);
+      if (!createChannel || !updateChannel) {
+        throw new UserError(`Provider '${address.provider}' does not support channels`);
+      }
+      const decl = ctx.config.channels[name];
+      const refs = resolveChannelRefs(name, ctx.config, address.provider, ctx.state);
+      if (isUpdate) {
+        result = await updateChannel(existingId, name, decl, refs);
+      } else {
+        try {
+          result = await createChannel(name, decl, refs);
+        } catch (err) {
+          result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            createOnly: ctx.createOnly,
+            onExisting: (existing) => updateChannel(existing.id, name, decl, refs)
+          });
+          adopted = true;
+        }
+      }
+      break;
+    }
+    case "deployment": {
+      const decl = ctx.config.deployments[name];
+      const refs = resolveDeploymentRefs(name, ctx.config, address.provider, ctx.state);
+      const hasLocalFileSources = decl.resources?.some(
+        (resource) => resource.type === "file" && !resource.file_id && Boolean(resource.source)
+      );
+      const materializeDeployment = async () => {
+        try {
+          return await provider.createDeployment(name, decl, refs, ctx.configPath ?? "");
+        } catch (err) {
+          const preparedFiles = err instanceof DeploymentCreateConflictError ? err.preparedFiles : void 0;
+          const existing = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            createOnly: ctx.createOnly,
+            onExisting: (existing2) => provider.updateDeployment(existing2.id, name, decl, refs, ctx.configPath ?? "", preparedFiles)
+          });
+          adopted = true;
+          return existing;
+        }
+      };
+      if (isUpdate && existingId) {
+        result = await provider.updateDeployment(existingId, name, decl, refs, ctx.configPath ?? "");
+      } else {
+        const existing = hasLocalFileSources ? await findExistingByNames(provider, "deployment", [name]) : null;
+        if (existing) {
+          if (ctx.createOnly) throw createOnlyExistingResourceError(address, existing.name);
+          result = await provider.updateDeployment(existing.resource.id, name, decl, refs, ctx.configPath ?? "");
+          emitRuntimeFeedback(ctx.onFeedback, {
+            type: "resource_adopted",
+            level: "info",
+            resource: address,
+            message: `adopt deployment.${name} (${address.provider}) \u2014 already existed remotely as "${existing.name}"`
+          });
+          adopted = true;
+        } else {
+          result = await materializeDeployment();
+        }
+      }
+      break;
+    }
+    case "file": {
+      const decl = ctx.config.files[name];
+      const filePath = resolve4(dirname3(ctx.configPath ?? ""), decl.source);
+      if (isUpdate) {
+        const oldId = ctx.state.getResource(address)?.remote_id;
+        if (oldId) {
+          try {
+            await provider.deleteFile(oldId, priorApiMode);
+          } catch {
+          }
+        }
+      }
+      const info = await provider.uploadFile(
+        filePath,
+        {
+          // Keep the source filename and extension; a declaration label must not
+          // change the multipart filename or the provider's inferred MIME type.
+          name: basename2(filePath),
+          purpose: decl.purpose
+        },
+        apiMode
+      );
+      result = { id: info.id, type: "file" };
+      break;
+    }
+    default:
+      throw new UserError(`Unknown resource type: ${type}`);
+  }
+  const hash = await computeResourceHash(address, ctx.config, ctx.configPath, ctx.state);
+  const comparableHash = computeComparableDesiredHash(address, ctx.config, provider);
+  let remoteHash = comparableHash;
+  let remoteSnapshot;
+  const remote = await readComparableIfSupported(provider, type, result.id, name);
+  if (remote) {
+    remoteHash = contentHash(remote.comparable);
+    remoteSnapshot = remote.snapshot ?? remote.comparable;
+  }
+  const priorResource = ctx.state.getResource(priorAddress);
+  ctx.state.setResource({
+    address,
+    remote_id: result.id,
+    externally_managed: priorResource?.externally_managed || type === "environment" && ctx.config.environments?.[name]?.environment_id || type === "identity" && ctx.config.identities?.[name]?.identity_id ? true : void 0,
+    api_mode: apiMode,
+    version: result.version,
+    content_hash: hash,
+    desired_hash: hash,
+    desired_comparable_hash: remoteHash,
+    desired_readiness_baseline: buildReadinessBaseline(getResourceDeclaration(address, ctx.config)),
+    remote_hash: remoteHash,
+    remote_snapshot: remoteSnapshot,
+    replacement_fingerprint: computeReplacementFingerprint(address, ctx.config),
+    drift_paths: [],
+    drift_status: remoteHash ? "in_sync" : void 0
+  });
+  if (action.previousAddress) ctx.state.removeResource(action.previousAddress);
+  return adopted;
+}
+function ownedForwardMemoryStoreIds(ctx, provider) {
+  return ctx.state.listResources().filter(
+    (resource) => resource.address.provider === provider && resource.address.type === "memory_store" && resource.api_mode === "forward" && typeof resource.remote_id === "string"
+  ).map((resource) => resource.remote_id);
+}
+function resolveResourceApiMode(type, name, provider, config) {
+  if (provider !== "qoder" || type !== "environment" && type !== "skill" && type !== "vault" && type !== "memory_store" && type !== "file") {
+    return void 0;
+  }
+  if (type === "environment" && config.environments?.[name]?.environment_id) return "auto";
+  let managed = false;
+  let forward = false;
+  for (const agent of Object.values(config.agents ?? {})) {
+    if (agent.provider && agent.provider !== provider) continue;
+    const referenced = type === "environment" ? agent.environment === name : type === "skill" ? agent.skills?.some(
+      (skill) => typeof skill === "string" ? skill === name : skill.type === "custom" && skill.skill_id === name
+    ) : type === "vault" ? agent.vault === name : type === "memory_store" ? agent.memory_stores?.includes(name) : agent.files?.some((file) => (typeof file === "string" ? file : file.file) === name);
+    if (!referenced) continue;
+    if (agent.delivery?.qoder?.type === "forward") forward = true;
+    else managed = true;
+  }
+  if (managed && forward) {
+    throw new UserError(
+      `Qoder ${type}.${name} is referenced by both Managed and Forward agents; declare separate resources for each API domain.`
+    );
+  }
+  return forward ? "forward" : "managed";
+}
+async function findExistingByNames(provider, type, names, mode) {
+  for (const candidate of names) {
+    const found = await provider.findResource(type, candidate, void 0, mode);
+    if (found && found.id !== null) return { resource: found, name: candidate };
+  }
+  return null;
+}
+async function adoptOnConflict(err, address, provider, onFeedback, opts) {
+  if (!(err instanceof ConflictError)) throw err;
+  const candidates = opts.searchNames?.length ? opts.searchNames : [address.name];
+  if (opts.createOnly) throw createOnlyExistingResourceError(address, candidates.join('" / "'));
+  const existing = await findExistingByNames(provider, address.type, candidates, opts.mode);
+  if (!existing) throw nameReservedError(err, address, candidates.join('" / "'));
+  emitRuntimeFeedback(onFeedback, {
+    type: "resource_adopted",
+    level: "info",
+    resource: address,
+    message: `adopt ${address.type}.${address.name} (${address.provider}) \u2014 already existed remotely as "${existing.name}"`
+  });
+  return opts.onExisting(existing.resource);
+}
+function createOnlyExistingResourceError(address, remoteName = address.name) {
+  return new UserError(
+    `Create-only cannot adopt or reconcile existing ${address.type} "${remoteName}" on provider '${address.provider}'. Choose a new name, or use a normal apply/import workflow to manage the existing resource.`
+  );
+}
+function nameReservedError(err, address, searchName) {
+  const detail = err instanceof ApiError ? err.message : String(err);
+  if (address.type === "channel" && err instanceof ApiError && err.responseBody.includes("CHANNEL_CREDENTIAL_CONFLICT")) {
+    return new UserError(
+      `${address.provider} rejected channel.${address.name} because its credentials are already used by another Channel. Keep the existing Channel address so it can be updated in place, remove the old Channel first, or use a different credential set. (${detail})`
+    );
+  }
+  return new UserError(
+    `${address.provider} reported ${address.type} "${searchName}" already exists, but it could not be found remotely to adopt. This usually means it was recently deleted and the provider still reserves the name. Wait for the provider to release the name, or use a different name for ${address.type}.${address.name}. (${detail})`
+  );
+}
+
+// src/internal/graph/dependency.ts
+function collectDependencyClosure(graph, roots) {
+  const selected = /* @__PURE__ */ new Map();
+  function visit(address) {
+    const key = addressKey(address);
+    if (selected.has(key)) return;
+    selected.set(key, graph.nodes.get(key) ?? address);
+    for (const dependencyKey of graph.edges.get(key) ?? []) {
+      const dependency = graph.nodes.get(dependencyKey);
+      if (dependency) visit(dependency);
+    }
+  }
+  for (const root of roots) visit(root);
+  return [...selected.values()];
+}
+function buildDependencyGraph(config, targetProviders) {
+  const nodes = /* @__PURE__ */ new Map();
+  const edges = /* @__PURE__ */ new Map();
+  function addNode(addr) {
+    const key = addressKey(addr);
+    nodes.set(key, addr);
+    if (!edges.has(key)) edges.set(key, /* @__PURE__ */ new Set());
+  }
+  function addEdge(from, to) {
+    const fromKey = addressKey(from);
+    const toKey = addressKey(to);
+    edges.get(fromKey)?.add(toKey);
+  }
+  for (const provider of targetProviders) {
+    const def = getProvider(provider);
+    const caps = def?.capabilities;
+    if (config.environments) {
+      for (const name of Object.keys(config.environments)) {
+        const decl = config.environments[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "environment", name, provider });
+      }
+    }
+    if (config.memory_stores) {
+      for (const name of Object.keys(config.memory_stores)) {
+        const decl = config.memory_stores[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        if (!isSupported(caps, "memory_store")) continue;
+        addNode({ type: "memory_store", name, provider });
+      }
+    }
+    if (config.vaults) {
+      for (const name of Object.keys(config.vaults)) {
+        const decl = config.vaults[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "vault", name, provider });
+      }
+    }
+    if (config.skills) {
+      for (const name of Object.keys(config.skills)) {
+        const decl = config.skills[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "skill", name, provider });
+      }
+    }
+    if (config.files) {
+      for (const name of Object.keys(config.files)) {
+        const decl = config.files[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "file", name, provider });
+      }
+    }
+    if (config.identities && isSupported(caps, "identity")) {
+      for (const name of Object.keys(config.identities)) {
+        const decl = config.identities[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "identity", name, provider });
+      }
+    }
+    if (config.agents) {
+      for (const name of Object.keys(config.agents)) {
+        const decl = config.agents[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const materialization = resolveAgentMaterialization(provider, decl);
+        const agentAddr = { type: materialization.resourceType, name, provider };
+        addNode(agentAddr);
+        if ((decl.default_memory_store || decl.memory_stores?.length) && materialization.resourceType === "template") {
+          const identityName = config.defaults?.identity;
+          if (identityName) {
+            const identityAddr = { type: "identity", name: identityName, provider };
+            if (nodes.has(addressKey(identityAddr))) addEdge(agentAddr, identityAddr);
+          }
+        }
+        if (decl.environment && config.environments?.[decl.environment]) {
+          const envAddr = {
+            type: "environment",
+            name: decl.environment,
+            provider
+          };
+          if (nodes.has(addressKey(envAddr))) {
+            addEdge(agentAddr, envAddr);
+          }
+        }
+        if (decl.skills) {
+          for (const skillRef of decl.skills) {
+            if (typeof skillRef !== "string") continue;
+            const skillName = skillRef;
+            const skillAddr = { type: "skill", name: skillName, provider };
+            if (nodes.has(addressKey(skillAddr))) {
+              addEdge(agentAddr, skillAddr);
+            }
+          }
+        }
+        if (decl.vault) {
+          const vaultAddr = { type: "vault", name: decl.vault, provider };
+          if (nodes.has(addressKey(vaultAddr))) {
+            addEdge(agentAddr, vaultAddr);
+          }
+        }
+        if (decl.files) {
+          for (const file of decl.files) {
+            const fileName = typeof file === "string" ? file : file.file;
+            const fileAddr = { type: "file", name: fileName, provider };
+            if (nodes.has(addressKey(fileAddr))) addEdge(agentAddr, fileAddr);
+          }
+        }
+        if (decl.memory_stores) {
+          for (const msName of decl.memory_stores) {
+            const msAddr = {
+              type: "memory_store",
+              name: msName,
+              provider
+            };
+            if (nodes.has(addressKey(msAddr))) {
+              addEdge(agentAddr, msAddr);
+            }
+          }
+        }
+        if (decl.multiagent && isSupported(caps, "multiagent")) {
+          for (const subName of decl.multiagent.agents) {
+            const subDecl = config.agents[subName];
+            const subType = subDecl ? resolveAgentMaterialization(provider, subDecl).resourceType : "agent";
+            const subAddr = { type: subType, name: subName, provider };
+            addEdge(agentAddr, subAddr);
+          }
+        }
+      }
+    }
+    if (config.deployments) {
+      for (const name of Object.keys(config.deployments)) {
+        const decl = config.deployments[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const depAddr = { type: "deployment", name, provider };
+        addNode(depAddr);
+        const agentDecl = config.agents?.[decl.agent];
+        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
+        const agentAddr = { type: agentType, name: decl.agent, provider };
+        if (nodes.has(addressKey(agentAddr))) addEdge(depAddr, agentAddr);
+        if (decl.environment) {
+          const envAddr = { type: "environment", name: decl.environment, provider };
+          if (nodes.has(addressKey(envAddr))) addEdge(depAddr, envAddr);
+        }
+        if (decl.vaults) {
+          for (const vName of decl.vaults) {
+            const vAddr = { type: "vault", name: vName, provider };
+            if (nodes.has(addressKey(vAddr))) addEdge(depAddr, vAddr);
+          }
+        }
+        if (decl.memory_stores) {
+          for (const msName of decl.memory_stores) {
+            const msAddr = { type: "memory_store", name: msName, provider };
+            if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
+          }
+        }
+        if (decl.resources) {
+          for (const r of decl.resources) {
+            if (r.type === "memory_store") {
+              const msAddr = { type: "memory_store", name: r.memory_store, provider };
+              if (nodes.has(addressKey(msAddr))) addEdge(depAddr, msAddr);
+            }
+          }
+        }
+      }
+    }
+    if (config.channels && isSupported(caps, "channel")) {
+      for (const name of Object.keys(config.channels)) {
+        const decl = config.channels[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const channelAddr = { type: "channel", name, provider };
+        addNode(channelAddr);
+        if (decl.mode === "pairing" || !decl.agent) continue;
+        const agentDecl = config.agents?.[decl.agent];
+        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
+        const agentAddr = { type: agentType, name: decl.agent, provider };
+        if (nodes.has(addressKey(agentAddr))) addEdge(channelAddr, agentAddr);
+        const identityName = decl.identity ?? config.defaults?.identity;
+        if (identityName) {
+          const identityAddr = { type: "identity", name: identityName, provider };
+          if (nodes.has(addressKey(identityAddr))) addEdge(channelAddr, identityAddr);
+        }
+      }
+    }
+  }
+  return { nodes, edges };
+}
+function topologicalSort(graph) {
+  const visited = /* @__PURE__ */ new Set();
+  const sorted = [];
+  const visiting = /* @__PURE__ */ new Set();
+  function visit(key) {
+    if (visited.has(key)) return;
+    if (visiting.has(key)) {
+      throw new UserError(`Circular dependency detected involving: ${key}`);
+    }
+    visiting.add(key);
+    const deps = graph.edges.get(key) ?? /* @__PURE__ */ new Set();
+    for (const dep of deps) {
+      visit(dep);
+    }
+    visiting.delete(key);
+    visited.add(key);
+    sorted.push(graph.nodes.get(key));
+  }
+  for (const key of graph.nodes.keys()) {
+    visit(key);
+  }
+  return sorted;
+}
+
+// src/internal/planner/planner.ts
+async function buildPlan(config, state, options = {}) {
+  const scopedConfig = options.resourceAddresses ? selectProjectConfig(config, options.resourceAddresses) : config;
+  const resourceKeys = options.resourceAddresses ? new Set(options.resourceAddresses.map(addressKey)) : void 0;
+  const scopedState = resourceKeys ? { ...state, resources: state.resources.filter((resource) => resourceKeys.has(addressKey(resource.address))) } : state;
+  const diagnostics = new DiagnosticCollector();
+  const actions = [];
+  const targetProviders = options.providers ?? resolveTargetProviders(scopedConfig);
+  collectReferenceDiagnostics(scopedConfig, diagnostics);
+  collectProviderCapabilities(scopedConfig, targetProviders, diagnostics);
+  const graph = buildDependencyGraph(scopedConfig, targetProviders);
+  const sorted = topologicalSort(graph);
+  const stateIndex = /* @__PURE__ */ new Map();
+  for (const res of scopedState.resources) {
+    stateIndex.set(addressKey(res.address), res);
+  }
+  const remoteIdLookup = /* @__PURE__ */ new Map();
+  for (const res of scopedState.resources) {
+    remoteIdLookup.set(addressKey(res.address), res);
+  }
+  const hashStateLookup = { getResource: (addr) => remoteIdLookup.get(addressKey(addr)) };
+  for (const address of sorted) {
+    const key = addressKey(address);
+    const desiredHash = await computeResourceHash(address, config, options.configPath, hashStateLookup);
+    const existing = stateIndex.get(key);
+    const deps = getDependencies(address, graph);
+    const needsNativeDeploymentMaterialization = address.type === "deployment" && existing?.remote_id === null && getProvider(address.provider)?.capabilities.deployment.tier === "native";
+    if (address.type === "environment" && existing) {
+      const envDecl = config.environments?.[address.name];
+      if (existing.externally_managed && envDecl && !envDecl.environment_id) {
+        diagnostics.error(
+          "plan.environment.ownership_transition",
+          `environment.${address.name} is recorded as an external reference (${existing.remote_id ?? "unknown id"}); removing 'environment_id' would make OpenCMA modify and eventually delete a remote environment it does not own. Restore 'environment_id' to keep it as a reference, or release it first with 'agents state rm environment.${address.name}' (then 'agents state import' to adopt the remote as a managed resource).`,
+          address
+        );
+        stateIndex.delete(key);
+        continue;
+      }
+      if (!existing.externally_managed && existing.remote_id && envDecl?.environment_id && envDecl.environment_id !== existing.remote_id) {
+        diagnostics.warning(
+          "plan.environment.ownership_orphan",
+          `environment.${address.name}: switching to external reference '${envDecl.environment_id}' orphans the previously managed remote environment '${existing.remote_id}' \u2014 it will no longer be tracked or deletable by OpenCMA.`,
+          address
+        );
+      }
+    }
+    if (address.type === "identity" && existing) {
+      const identityDecl = config.identities?.[address.name];
+      if (existing.externally_managed && identityDecl && !identityDecl.identity_id) {
+        diagnostics.error(
+          "plan.identity.ownership_transition",
+          `identity.${address.name} is recorded as an external reference (${existing.remote_id ?? "unknown id"}); replacing identity_id with a managed declaration would modify and eventually delete an Identity this project does not own. Restore identity_id or release the state reference first.`,
+          address
+        );
+        stateIndex.delete(key);
+        continue;
+      }
+      if (!existing.externally_managed && existing.remote_id && identityDecl?.identity_id && identityDecl.identity_id !== existing.remote_id) {
+        diagnostics.warning(
+          "plan.identity.ownership_orphan",
+          `identity.${address.name}: switching to external reference '${identityDecl.identity_id}' orphans the previously managed Identity '${existing.remote_id}'.`,
+          address
+        );
+      }
+    }
+    const isExternalReference = address.type === "environment" && Boolean(config.environments?.[address.name]?.environment_id) || address.type === "identity" && Boolean(config.identities?.[address.name]?.identity_id);
+    const createReason = isExternalReference ? `Record external ${address.type} reference (no remote mutation)` : "Resource does not exist in state";
+    const updateSuffix = isExternalReference ? " \u2014 external reference, no remote mutation" : "";
+    if (!existing) {
+      actions.push({
+        action: "create",
+        address,
+        driftKind: "none",
+        readinessImpact: "blocking",
+        reason: createReason,
+        after: { content_hash: desiredHash },
+        dependencies: deps
+      });
+    } else if (needsNativeDeploymentMaterialization) {
+      actions.push({
+        action: "update",
+        address,
+        driftKind: "none",
+        readinessImpact: "blocking",
+        reason: "Materialize legacy state as a native deployment",
+        before: { content_hash: existing.desired_hash ?? existing.content_hash },
+        after: { content_hash: desiredHash },
+        dependencies: deps
+      });
+    } else if ((existing.desired_hash ?? existing.content_hash) !== desiredHash && existing.drift_status === "drifted") {
+      const changedPaths = collectChangedPaths(address, config, existing, true);
+      actions.push({
+        action: "update",
+        address,
+        driftKind: "both",
+        readinessImpact: classifyReadinessImpact("update", changedPaths),
+        changedPaths,
+        reason: `Local config changed and remote drift detected${updateSuffix}`,
+        before: {
+          content_hash: existing.desired_hash ?? existing.content_hash,
+          remote_hash: existing.remote_hash,
+          drift_status: existing.drift_status
+        },
+        after: { content_hash: desiredHash },
+        dependencies: deps
+      });
+    } else if ((existing.desired_hash ?? existing.content_hash) !== desiredHash) {
+      const changedPaths = collectChangedPaths(address, config, existing, false);
+      actions.push({
+        action: "update",
+        address,
+        driftKind: "local",
+        readinessImpact: classifyReadinessImpact("update", changedPaths),
+        changedPaths,
+        reason: `Local config changed${updateSuffix}`,
+        before: { content_hash: existing.desired_hash ?? existing.content_hash },
+        after: { content_hash: desiredHash },
+        dependencies: deps
+      });
+    } else if (existing.drift_status === "drifted") {
+      const changedPaths = existing.drift_paths;
+      actions.push({
+        action: "update",
+        address,
+        driftKind: "remote",
+        readinessImpact: classifyReadinessImpact("update", changedPaths),
+        changedPaths,
+        reason: `Remote drift detected${updateSuffix}`,
+        before: {
+          content_hash: existing.desired_hash ?? existing.content_hash,
+          remote_hash: existing.remote_hash,
+          drift_status: existing.drift_status
+        },
+        after: { content_hash: desiredHash },
+        dependencies: deps
+      });
+    } else {
+      actions.push({
+        action: "no-op",
+        address,
+        driftKind: "none",
+        readinessImpact: "none",
+        reason: existing.drift_status === "unchecked" ? "No changes detected (remote content drift unchecked)" : "No changes detected",
+        dependencies: deps
+      });
+    }
+    stateIndex.delete(key);
+  }
+  const toDelete = Array.from(stateIndex.values()).reverse();
+  for (const res of toDelete) {
+    const replacement = deliveryReplacementAddress(res.address, graph);
+    actions.push({
+      action: "delete",
+      address: res.address,
+      driftKind: "none",
+      readinessImpact: "blocking",
+      reason: res.externally_managed ? "Remove local reference only \u2014 externally managed remote resource is left intact" : "Resource removed from configuration",
+      before: { content_hash: res.desired_hash ?? res.content_hash },
+      dependencies: replacement ? [replacement] : []
+    });
+  }
+  coalesceChannelRenames(actions, scopedConfig, scopedState);
+  return { actions, diagnostics: diagnostics.getAll() };
+}
+function selectProjectConfig(config, addresses) {
+  const providers = new Set(addresses.map((address) => address.provider));
+  const namesByType = /* @__PURE__ */ new Map();
+  for (const address of addresses) {
+    const names = namesByType.get(address.type) ?? /* @__PURE__ */ new Set();
+    names.add(address.name);
+    namesByType.set(address.type, names);
+  }
+  const pick = (record, names) => {
+    if (!record || !names?.size) return void 0;
+    const selected = Object.fromEntries(Object.entries(record).filter(([name]) => names.has(name)));
+    return Object.keys(selected).length > 0 ? selected : void 0;
+  };
+  const agentNames = /* @__PURE__ */ new Set([...namesByType.get("agent") ?? [], ...namesByType.get("template") ?? []]);
+  const selectedAgents = pick(config.agents, agentNames);
+  const tunnelNames = /* @__PURE__ */ new Set();
+  for (const agent of Object.values(selectedAgents ?? {})) {
+    if (agent.tunnel) tunnelNames.add(agent.tunnel);
+  }
+  for (const deployment of Object.values(pick(config.deployments, namesByType.get("deployment")) ?? {})) {
+    if (deployment.tunnel) tunnelNames.add(deployment.tunnel);
+  }
+  const identityNames = namesByType.get("identity");
+  const selectedProviders = Object.fromEntries(
+    Object.entries(config.providers).filter(([providerName]) => providers.has(providerName))
+  );
+  const defaultProvider = providers.size === 1 ? [...providers][0] : config.defaults?.provider;
+  const defaultIdentity = config.defaults?.identity && identityNames?.has(config.defaults.identity) ? config.defaults.identity : void 0;
+  return {
+    ...config,
+    providers: selectedProviders,
+    defaults: defaultProvider || defaultIdentity ? { provider: defaultProvider, identity: defaultIdentity } : void 0,
+    environments: pick(config.environments, namesByType.get("environment")),
+    tunnels: pick(config.tunnels, tunnelNames),
+    vaults: pick(config.vaults, namesByType.get("vault")),
+    memory_stores: pick(config.memory_stores, namesByType.get("memory_store")),
+    skills: pick(config.skills, namesByType.get("skill")),
+    files: pick(config.files, namesByType.get("file")),
+    identities: pick(config.identities, identityNames),
+    agents: selectedAgents,
+    channels: pick(config.channels, namesByType.get("channel")),
+    deployments: pick(config.deployments, namesByType.get("deployment"))
+  };
+}
+function coalesceChannelRenames(actions, config, state) {
+  const creates = actions.filter((action) => action.action === "create" && action.address.type === "channel");
+  const deletes = actions.filter((action) => action.action === "delete" && action.address.type === "channel");
+  const stateByAddress = new Map(state.resources.map((resource) => [addressKey(resource.address), resource]));
+  const matchedDeletes = /* @__PURE__ */ new Set();
+  for (const create of creates) {
+    const desiredType = config.channels?.[create.address.name]?.type;
+    if (!desiredType) continue;
+    const desiredFingerprint = computeReplacementFingerprint(create.address, config);
+    const candidates = deletes.filter((deletion2) => {
+      if (matchedDeletes.has(deletion2) || deletion2.address.provider !== create.address.provider) return false;
+      const prior2 = stateByAddress.get(addressKey(deletion2.address));
+      const snapshot = prior2?.remote_snapshot;
+      if (snapshot?.channel_type !== desiredType) return false;
+      return !prior2?.replacement_fingerprint || prior2.replacement_fingerprint === desiredFingerprint;
+    });
+    if (candidates.length !== 1) continue;
+    const deletion = candidates[0];
+    const prior = stateByAddress.get(addressKey(deletion.address));
+    const competingCreates = creates.filter(
+      (candidate) => candidate !== create && candidate.address.provider === create.address.provider && config.channels?.[candidate.address.name]?.type === desiredType && (!prior?.replacement_fingerprint || computeReplacementFingerprint(candidate.address, config) === prior.replacement_fingerprint)
+    );
+    if (competingCreates.length > 0) continue;
+    create.action = "update";
+    create.previousAddress = deletion.address;
+    create.before = deletion.before;
+    create.driftKind = "local";
+    create.reason = `Channel key renamed from '${deletion.address.name}' (remote resource retained)`;
+    protectRenamedChannelDependencies(actions, stateByAddress, deletion, create);
+    matchedDeletes.add(deletion);
+  }
+  for (let index = actions.length - 1; index >= 0; index--) {
+    if (matchedDeletes.has(actions[index])) actions.splice(index, 1);
+  }
+}
+function protectRenamedChannelDependencies(actions, stateByAddress, deletion, replacement) {
+  const prior = stateByAddress.get(addressKey(deletion.address));
+  const snapshot = prior?.remote_snapshot;
+  const referencedIds = new Set(
+    [snapshot?.identity_id, snapshot?.template_id].filter((id) => typeof id === "string")
+  );
+  if (referencedIds.size === 0) return;
+  for (const action of actions) {
+    if (action.action !== "delete" || action.address.type !== "identity" && action.address.type !== "template" || action.address.provider !== replacement.address.provider) {
+      continue;
+    }
+    const dependency = stateByAddress.get(addressKey(action.address));
+    if (!dependency?.remote_id || !referencedIds.has(dependency.remote_id)) continue;
+    if (!action.dependencies.some((address) => addressKey(address) === addressKey(replacement.address))) {
+      action.dependencies.push(replacement.address);
+    }
+  }
+}
+function deliveryReplacementAddress(address, graph) {
+  if (address.type !== "agent" && address.type !== "template") return void 0;
+  const replacementType = address.type === "agent" ? "template" : "agent";
+  const candidate = { ...address, type: replacementType };
+  return graph.nodes.has(addressKey(candidate)) ? candidate : void 0;
+}
+function collectChangedPaths(address, config, existing, includeRemote) {
+  const current = buildReadinessBaseline(getResourceDeclaration(address, config));
+  const localPaths = existing.desired_readiness_baseline ? diffReadinessBaseline(existing.desired_readiness_baseline, current) : void 0;
+  if (!includeRemote) return localPaths;
+  if (!localPaths && !existing.drift_paths) return void 0;
+  return [.../* @__PURE__ */ new Set([...localPaths ?? [], ...existing.drift_paths ?? []])].sort();
+}
+function getDependencies(address, graph) {
+  const key = addressKey(address);
+  const depKeys = graph.edges.get(key) ?? /* @__PURE__ */ new Set();
+  return Array.from(depKeys).map((k) => graph.nodes.get(k)).filter((n) => n !== void 0);
+}
+
+// src/internal/planner/refresh.ts
+async function refreshState(state, providers, options = {}) {
+  const resources = state.listResources();
+  const removed = [];
+  const errors = [];
+  let dirty = false;
+  for (const res of resources) {
+    if (options.resourceKeys && !options.resourceKeys.has(addressKey(res.address))) {
+      continue;
+    }
+    if (options.targetProviders && !options.targetProviders.includes(res.address.provider)) {
+      continue;
+    }
+    const provider = providers.get(res.address.provider);
+    if (!provider) continue;
+    try {
+      const support = provider.getDriftSupport?.(res.address.type) ?? "existence";
+      if (supportsFullDrift(provider, res.address.type) && provider.normalizeDesiredResource) {
+        const remote2 = await provider.readComparableResource?.(res.address.type, res.remote_id, res.address.name);
+        if (!remote2) {
+          if (!options.quiet) {
+            emitRuntimeFeedback(options.onFeedback, {
+              type: "refresh_resource_missing",
+              level: "warning",
+              resource: res.address,
+              message: `${res.address.type}.${res.address.name} (${res.address.provider}) \u2014 not found remotely, will recreate`
+            });
+          }
+          state.removeResource(res.address);
+          removed.push(res);
+          dirty = true;
+          continue;
+        }
+        const remoteHash = contentHash(remote2.comparable);
+        const decl = options.config ? getResourceDeclaration(res.address, options.config) : null;
+        const desiredComparable = decl ? provider.normalizeDesiredResource(res.address.type, res.address.name, decl) : null;
+        const desiredComparableHash = desiredComparable === null ? void 0 : contentHash(desiredComparable);
+        const baselineHash = res.desired_comparable_hash ?? desiredComparableHash ?? remoteHash;
+        const driftStatus = baselineHash && remoteHash !== baselineHash ? "drifted" : "in_sync";
+        const comparisonBaseline = res.remote_snapshot ?? desiredComparable;
+        const driftPaths = driftStatus === "drifted" && comparisonBaseline != null ? diffChangedPaths(comparisonBaseline, remote2.comparable) : [];
+        state.setResource({
+          ...res,
+          version: remote2.version ?? res.version,
+          remote_id: remote2.id,
+          desired_hash: res.desired_hash ?? res.content_hash,
+          desired_comparable_hash: baselineHash,
+          remote_hash: remoteHash,
+          remote_snapshot: remote2.snapshot ?? remote2.comparable,
+          drift_paths: driftPaths,
+          drift_status: driftStatus
+        });
+        dirty = true;
+        continue;
+      }
+      if (support === "unsupported") {
+        if (!options.quiet) {
+          emitRuntimeFeedback(options.onFeedback, {
+            type: "refresh_drift_unchecked",
+            level: "warning",
+            resource: res.address,
+            message: `Content drift not checked for ${res.address.type}.${res.address.name} (${res.address.provider}): unsupported`
+          });
+        }
+        state.setResource({
+          ...res,
+          desired_hash: res.desired_hash ?? res.content_hash,
+          drift_status: "unchecked"
+        });
+        dirty = true;
+        continue;
+      }
+      const remote = await provider.findResource(res.address.type, res.address.name, res.remote_id, res.api_mode);
+      if (!remote) {
+        if (!options.quiet) {
+          emitRuntimeFeedback(options.onFeedback, {
+            type: "refresh_resource_missing",
+            level: "warning",
+            resource: res.address,
+            message: `${res.address.type}.${res.address.name} (${res.address.provider}) \u2014 not found remotely, will recreate`
+          });
+        }
+        state.removeResource(res.address);
+        removed.push(res);
+        dirty = true;
+      } else {
+        if (!options.quiet) {
+          emitRuntimeFeedback(options.onFeedback, {
+            type: "refresh_drift_unchecked",
+            level: "warning",
+            resource: res.address,
+            message: `Content drift not checked for ${res.address.type}.${res.address.name} (${res.address.provider}): existence-only`
+          });
+        }
+        state.setResource({
+          ...res,
+          version: remote.version ?? res.version,
+          remote_id: remote.id,
+          desired_hash: res.desired_hash ?? res.content_hash,
+          drift_status: "unchecked"
+        });
+        dirty = true;
+      }
+    } catch (err) {
+      const error = err instanceof Error ? err : new Error(String(err));
+      if (!options.quiet) {
+        emitRuntimeFeedback(options.onFeedback, {
+          type: "refresh_resource_failed",
+          level: "warning",
+          resource: res.address,
+          message: `Failed to refresh ${res.address.type}.${res.address.name} (${res.address.provider}): ${error.message}`
+        });
+      }
+      errors.push({ resource: res, error });
+    }
+  }
+  if (dirty) {
+    await state.save();
+  }
+  return { removed, errors };
+}
+
+// src/internal/core/resource-runtime.ts
+async function planProjectWithStateBackend(input, options = {}) {
+  return readProjectRuntime(input, (ctx) => planProjectContext(ctx, options));
+}
+async function syncProjectResourcesWithStateBackend(input, options = {}) {
+  return writeProjectRuntime(input, async (ctx) => {
+    const planned = await planProjectContext(ctx, options);
+    if (options.refreshOnly) {
+      return { planned };
+    }
+    if (options.mode === "create-only") {
+      const errorDiagnostic = planned.plan.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+      if (errorDiagnostic) throw new UserError(errorDiagnostic.message);
+    }
+    return {
+      planned,
+      execution: await executePlannedProject(planned, {
+        onFeedback: options.onFeedback,
+        policy: options.policy,
+        confirm: options.confirm,
+        concurrency: options.concurrency
+      })
+    };
+  });
+}
+var IMPORTABLE_RESOURCE_TYPES = /* @__PURE__ */ new Set([
+  "environment",
+  "vault",
+  "memory_store",
+  "skill",
+  "agent",
+  "template",
+  "identity",
+  "channel"
+]);
+async function importResource(ctx, address, remoteId, options = {}) {
+  if (!IMPORTABLE_RESOURCE_TYPES.has(address.type)) {
+    throw new UserError(
+      `Invalid resource type: ${address.type}. Valid types: ${[...IMPORTABLE_RESOURCE_TYPES].join(", ")}`
+    );
+  }
+  if (ctx.state.getResource(address)) {
+    throw new UserError(
+      `Resource ${address.provider}.${address.type}.${address.name} already exists in state. Remove it before re-importing.`
+    );
+  }
+  const planned = await planProjectContext(ctx, {
+    provider: address.provider,
+    refresh: false,
+    quiet: true
+  });
+  const action = planned.plan.actions.find(
+    (item) => item.address.provider === address.provider && item.address.type === address.type && item.address.name === address.name
+  );
+  if (action?.action !== "create") {
+    throw new UserError(`Resource ${address.type}.${address.name} is not declared in the project config.`);
+  }
+  const contentHash2 = action.after?.content_hash;
+  if (!contentHash2) {
+    throw new UserError(`Planned ${address.type}.${address.name} is missing a content hash.`);
+  }
+  const provider = ctx.providers.get(address.provider);
+  const remote = provider ? await readComparableIfSupported(provider, address.type, remoteId, address.name) : null;
+  const remoteHash = remote ? contentHash(remote.comparable) : void 0;
+  const resource = {
+    address,
+    remote_id: remoteId,
+    externally_managed: address.type === "environment" && ctx.config.environments?.[address.name]?.environment_id ? true : void 0,
+    version: options.resourceVersion ?? remote?.version,
+    content_hash: contentHash2,
+    desired_hash: contentHash2,
+    desired_comparable_hash: remoteHash,
+    desired_readiness_baseline: buildReadinessBaseline(getResourceDeclaration(address, ctx.config)),
+    remote_hash: remoteHash,
+    remote_snapshot: remote ? remote.snapshot ?? remote.comparable : void 0,
+    drift_status: remoteHash ? "in_sync" : void 0
+  };
+  ctx.state.setResource(resource);
+  await ctx.state.save();
+  return resource;
+}
+async function planProjectContext(ctx, options = {}) {
+  if (options.mode === "create-only" && !options.scope) {
+    throw new UserError("Resource create-only mode requires an explicit resource scope.");
+  }
+  let targetProviders = resolveTargetProviders2(options.provider);
+  if (!targetProviders && options.scope) {
+    targetProviders = [...new Set(options.scope.roots.map((root) => root.provider))];
+  }
+  const selectedAddresses = options.scope ? resolvePlanScope(ctx, targetProviders ?? [], options.scope) : void 0;
+  const resourceKeys = selectedAddresses ? new Set(selectedAddresses.map(addressKey)) : void 0;
+  const refreshResult = options.refresh !== false && ctx.state.listResources().length > 0 ? await refreshState(ctx.state, ctx.providers, {
+    targetProviders,
+    resourceKeys,
+    config: ctx.config,
+    quiet: options.quiet ?? true,
+    onFeedback: options.onFeedback
+  }) : void 0;
+  let plan = await buildPlan(ctx.config, ctx.state.getStateFile(), {
+    providers: targetProviders,
+    configPath: ctx.configPath,
+    resourceAddresses: selectedAddresses
+  });
+  if (options.mode === "create-only" && options.scope) {
+    plan = enforceCreateOnlyPlan(plan, options.scope, toResourceRefreshResult(refreshResult));
+  }
+  return {
+    executionContext: ctx,
+    plan,
+    refreshResult: toResourceRefreshResult(refreshResult),
+    targetProviders,
+    destructiveActions: selectDestructive(plan.actions),
+    selectedAddresses,
+    mode: options.mode
+  };
+}
+function enforceCreateOnlyPlan(plan, scope, refreshResult) {
+  const reasons = [];
+  const rootKeys = new Set(scope.roots.map(addressKey));
+  const refreshError = refreshResult?.errors[0];
+  if (refreshError) {
+    reasons.push(
+      `Cannot verify scoped dependencies because refresh failed for ${addressKey(refreshError.resource.address)}: ${refreshError.error}`
+    );
+  }
+  for (const root of scope.roots) {
+    const rootKey = addressKey(root);
+    const rootAction = plan.actions.find((action) => addressKey(action.address) === rootKey);
+    if (!rootAction) {
+      reasons.push(`Scoped plan did not contain target resource ${rootKey}.`);
+    } else if (rootAction.action !== "create") {
+      reasons.push(`Target resource ${rootKey} must be new, but the scoped plan requires '${rootAction.action}'.`);
+    }
+  }
+  const dependencyChanges = plan.actions.filter(
+    (action) => !rootKeys.has(addressKey(action.address)) && action.action !== "no-op"
+  );
+  if (dependencyChanges.length > 0) {
+    const labels = dependencyChanges.map((action) => `${addressKey(action.address)} (${action.action})`).join(", ");
+    reasons.push(`Create-only requires every scoped dependency to be up-to-date. Reconcile first: ${labels}.`);
+  }
+  if (reasons.length === 0) return plan;
+  return {
+    ...plan,
+    diagnostics: [
+      ...plan.diagnostics,
+      {
+        severity: "error",
+        code: "resource.create_only.blocked",
+        message: reasons.join(" "),
+        resource: scope.roots[0]
+      }
+    ]
+  };
+}
+function resolvePlanScope(ctx, targetProviders, scope) {
+  if (scope.roots.length === 0) {
+    throw new UserError("Resource plan scope requires at least one root address.");
+  }
+  for (const root of scope.roots) {
+    if (!targetProviders.includes(root.provider)) {
+      throw new UserError(
+        `Scoped resource ${addressKey(root)} is outside the selected provider set: ${targetProviders.join(", ")}.`
+      );
+    }
+  }
+  const graph = buildDependencyGraph(ctx.config, targetProviders);
+  for (const root of scope.roots) {
+    if (!graph.nodes.has(addressKey(root))) {
+      throw new UserError(`Scoped resource ${addressKey(root)} is not declared in the project config.`);
+    }
+  }
+  return scope.includeDependencies === false ? [...scope.roots] : collectDependencyClosure(graph, scope.roots);
+}
+async function executePlannedProject(planned, options = {}) {
+  if (planned.mode === "create-only") {
+    const errorDiagnostic = planned.plan.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+    if (errorDiagnostic) throw new UserError(errorDiagnostic.message);
+  }
+  const decision = await decideDestructive(planned.destructiveActions, {
+    policy: options.policy,
+    confirm: options.confirm
+  });
+  if (decision !== "proceed") {
+    throw new UserError(
+      decision === "cancelled" ? "Destructive actions were declined. No remote resources were changed." : "Current plan contains destructive actions. Apply will not delete remote resources."
+    );
+  }
+  const ctx = planned.executionContext;
+  const execution = await executePlan(
+    planned.plan,
+    {
+      config: ctx.config,
+      configPath: ctx.configPath,
+      providers: ctx.providers,
+      state: ctx.state,
+      onFeedback: options.onFeedback,
+      createOnly: planned.mode === "create-only"
+    },
+    { concurrency: options.concurrency }
+  );
+  return toResourceExecutionResult(execution);
+}
+function resolveTargetProviders2(provider) {
+  if (!provider || provider === "all") return void 0;
+  return [provider];
+}
+function selectDestructive(actions) {
+  return actions.filter((action) => action.action === "delete");
+}
+async function decideDestructive(destructiveActions, options = {}) {
+  if (destructiveActions.length === 0) return "proceed";
+  switch (options.policy ?? "block") {
+    case "force":
+      return "proceed";
+    case "prompt":
+      if (!options.confirm) return "blocked";
+      return await options.confirm(destructiveActions) ? "proceed" : "cancelled";
+    default:
+      return "blocked";
+  }
+}
+function toResourceRefreshResult(result) {
+  if (!result) return void 0;
+  return {
+    removed: result.removed,
+    errors: result.errors.map((item) => ({
+      resource: item.resource,
+      error: item.error.message
+    }))
+  };
+}
+function toResourceExecutionResult(result) {
+  return {
+    results: result.results.map((item) => ({
+      action: item.action,
+      status: item.status,
+      error: item.error?.message
+    })),
+    partial: result.partial
+  };
+}
+
+// src/internal/state/state-manager.ts
+import { mkdir, readFile, rename, unlink, writeFile } from "fs/promises";
+import { dirname as dirname4 } from "path";
+var StateManager = class _StateManager {
+  state;
+  path;
+  index;
+  constructor(state, path) {
+    this.state = state;
+    this.path = path;
+    this.index = this.buildIndex();
+  }
+  buildIndex() {
+    const idx = /* @__PURE__ */ new Map();
+    for (let i = 0; i < this.state.resources.length; i++) {
+      idx.set(addressKey(this.state.resources[i].address), i);
+    }
+    return idx;
+  }
+  static async load(path) {
+    try {
+      const data = JSON.parse(await readFile(path, "utf8"));
+      const raw = data.resources ?? [];
+      const resources = raw.map((r) => ({
+        address: r.address,
+        remote_id: r.remote_id,
+        externally_managed: r.externally_managed === true ? true : void 0,
+        api_mode: r.api_mode === "forward" ? "forward" : r.api_mode === "managed" ? "managed" : void 0,
+        version: r.version,
+        content_hash: r.content_hash ?? r.desired_hash ?? "",
+        desired_hash: r.desired_hash ?? r.content_hash ?? "",
+        desired_comparable_hash: r.desired_comparable_hash,
+        desired_readiness_baseline: r.desired_readiness_baseline,
+        remote_hash: r.remote_hash,
+        remote_snapshot: r.remote_snapshot,
+        replacement_fingerprint: r.replacement_fingerprint,
+        drift_paths: r.drift_paths,
+        drift_status: r.drift_status
+      }));
+      const pending = Array.isArray(data.pending_default_memory_store_cleanups) ? data.pending_default_memory_store_cleanups : void 0;
+      return new _StateManager(
+        { resources, ...pending ? { pending_default_memory_store_cleanups: pending } : {} },
+        path
+      );
+    } catch (err) {
+      if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+        return _StateManager.initialize(path);
+      }
+      throw err;
+    }
+  }
+  static initialize(path) {
+    return new _StateManager({ resources: [] }, path);
+  }
+  getResource(address) {
+    const i = this.index.get(addressKey(address));
+    return i !== void 0 ? this.state.resources[i] : void 0;
+  }
+  setResource(resource) {
+    const key = addressKey(resource.address);
+    const i = this.index.get(key);
+    if (i !== void 0) {
+      this.state.resources[i] = resource;
+    } else {
+      this.index.set(key, this.state.resources.length);
+      this.state.resources.push(resource);
+    }
+  }
+  removeResource(address) {
+    const key = addressKey(address);
+    const i = this.index.get(key);
+    if (i === void 0) return;
+    this.state.resources.splice(i, 1);
+    this.index.delete(key);
+    for (let j = i; j < this.state.resources.length; j++) {
+      this.index.set(addressKey(this.state.resources[j].address), j);
+    }
+  }
+  listResources() {
+    return [...this.state.resources];
+  }
+  findResource(query) {
+    return this.state.resources.find((resource) => {
+      const matchType = resource.address.type === query.type;
+      const matchName = resource.address.name === query.name;
+      const matchProvider = !query.provider || resource.address.provider === query.provider;
+      return matchType && matchName && matchProvider;
+    });
+  }
+  getStateFile() {
+    return this.state;
+  }
+  async save() {
+    await mkdir(dirname4(this.path), { recursive: true });
+    const tmpPath = `${this.path}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+    try {
+      await writeFile(tmpPath, `${JSON.stringify(this.state, null, 2)}
+`);
+      await rename(tmpPath, this.path);
+    } catch (error) {
+      await unlink(tmpPath).catch(() => {
+      });
+      throw error;
+    }
+  }
+};
+
+// src/internal/state/local-file-state-backend.ts
+import { resolve as resolve5 } from "path";
+
+// src/internal/utils/paths.ts
+function deriveStatePath(configPath) {
+  return /\.ya?ml$/i.test(configPath) ? configPath.replace(/\.ya?ml$/i, ".state.json") : `${configPath}.state.json`;
+}
+
+// src/internal/state/backend.ts
+function cloneStateFile(state) {
+  return structuredClone(state);
+}
+
+// src/internal/state/in-memory-state-manager.ts
+var InMemoryStateManager = class _InMemoryStateManager {
+  state;
+  index;
+  constructor(state) {
+    this.state = state;
+    this.index = this.buildIndex();
+  }
+  buildIndex() {
+    const idx = /* @__PURE__ */ new Map();
+    for (let i = 0; i < this.state.resources.length; i++) {
+      idx.set(addressKey(this.state.resources[i].address), i);
+    }
+    return idx;
+  }
+  static fromJSON(data) {
+    return new _InMemoryStateManager(structuredClone(data));
+  }
+  static empty() {
+    return new _InMemoryStateManager({ resources: [] });
+  }
+  getResource(address) {
+    const i = this.index.get(addressKey(address));
+    return i !== void 0 ? this.state.resources[i] : void 0;
+  }
+  setResource(resource) {
+    const key = addressKey(resource.address);
+    const i = this.index.get(key);
+    if (i !== void 0) {
+      this.state.resources[i] = resource;
+    } else {
+      this.index.set(key, this.state.resources.length);
+      this.state.resources.push(resource);
+    }
+  }
+  removeResource(address) {
+    const key = addressKey(address);
+    const i = this.index.get(key);
+    if (i === void 0) return;
+    this.state.resources.splice(i, 1);
+    this.index.delete(key);
+    for (let j = i; j < this.state.resources.length; j++) {
+      this.index.set(addressKey(this.state.resources[j].address), j);
+    }
+  }
+  listResources() {
+    return [...this.state.resources];
+  }
+  findResource(query) {
+    return this.state.resources.find((resource) => {
+      const matchType = resource.address.type === query.type;
+      const matchName = resource.address.name === query.name;
+      const matchProvider = !query.provider || resource.address.provider === query.provider;
+      return matchType && matchName && matchProvider;
+    });
+  }
+  getStateFile() {
+    return this.state;
+  }
+  async save() {
+  }
+};
+
+// src/internal/state/local-file-state-backend.ts
+var LocalFileStateBackend = class {
+  configPath;
+  statePath;
+  constructor(options = {}) {
+    this.configPath = options.configPath ? resolve5(options.configPath) : void 0;
+    this.statePath = options.statePath ? resolve5(options.statePath) : void 0;
+  }
+  async read(scope, fn) {
+    const manager = await StateManager.load(this.getStatePath(scope));
+    const readonlyState = InMemoryStateManager.fromJSON(cloneStateFile(manager.getStateFile()));
+    return fn(readonlyState);
+  }
+  async write(scope, fn) {
+    const manager = await StateManager.load(this.getStatePath(scope));
+    const result = await fn(manager);
+    await manager.save();
+    return result;
+  }
+  getStatePath(_scope) {
+    if (this.statePath) return this.statePath;
+    if (this.configPath) return deriveStatePath(this.configPath);
+    throw new Error("LocalFileStateBackend requires configPath or statePath");
+  }
+};
+
+export {
+  createProjectRuntime,
+  readProjectRuntime,
+  writeProjectRuntime,
+  getRuntimeProvider,
+  contentHash,
+  computeResourceHash,
+  emitRuntimeFeedback,
+  addressKey,
+  requireRef,
+  resolveDeploymentRefs,
+  inspectSkillSource,
+  collectDependencyClosure,
+  buildDependencyGraph,
+  planProjectWithStateBackend,
+  syncProjectResourcesWithStateBackend,
+  importResource,
+  planProjectContext,
+  executePlannedProject,
+  selectDestructive,
+  decideDestructive,
+  cloneStateFile,
+  InMemoryStateManager,
+  StateManager,
+  LocalFileStateBackend
+};