fix(qoder): keep forward resource ownership consistent

Change-Id: I611e80304831f8240784d56362f64bcf45a0e641

Author: heimanba

packages/sdk/src/internal/core/validate-config.ts

@@ -264,6 +264,35 @@ export function collectProviderCapabilities(
 			}
 		}
 
+		if (providerName === "qoder") {
+			const domains = new Map<string, Set<"managed" | "forward">>();
+			for (const agent of Object.values(config.agents ?? {})) {
+				if (agent.provider && agent.provider !== providerName) continue;
+				const mode = agent.delivery?.qoder?.type === "forward" ? "forward" : "managed";
+				const refs = [
+					...(agent.skills ?? []).flatMap((skill) =>
+						typeof skill === "string" ? [`skill:${skill}`] : skill.type === "custom" ? [`skill:${skill.skill_id}`] : [],
+					),
+					...(agent.vault ? [`vault:${agent.vault}`] : []),
+					...(agent.memory_stores ?? []).map((store) => `memory_store:${store}`),
+				];
+				for (const ref of refs) {
+					const modes = domains.get(ref) ?? new Set<"managed" | "forward">();
+					modes.add(mode);
+					domains.set(ref, modes);
+				}
+			}
+			for (const [ref, modes] of domains) {
+				if (modes.size < 2) continue;
+				const [type, name] = ref.split(":") as ["skill" | "vault" | "memory_store", string];
+				diagnostics.error(
+					`qoder.${type}.delivery_domain.conflict`,
+					`${type}.${name}: referenced by both Managed and Forward agents; declare separate resources because Qoder uses different API domains.`,
+					{ type, name, provider: providerName },
+				);
+			}
+		}
+
 		for (const [name, agent] of Object.entries(config.agents ?? {})) {
 			if (agent.provider && agent.provider !== providerName) continue;
 			const delivery = agent.delivery?.[providerName]?.type ?? "managed";
@@ -364,10 +393,10 @@ export function collectProviderCapabilities(
 						{ type: "template", name, provider: providerName },
 					);
 				}
-				if (agent.memory_stores?.length) {
+				if (agent.memory_stores?.length && !config.defaults?.identity) {
 					diagnostics.error(
-						"qoder.template.memory_store.unsupported",
-						`agent.${name}: memory_stores are not yet supported by Qoder Forward Template delivery.`,
+						"qoder.template.memory_store.identity.required",
+						`agent.${name}: Forward memory_stores require defaults.identity for the Identity/Template mount.`,
 						{ type: "template", name, provider: providerName },
 					);
 				}

packages/sdk/src/internal/executor/executor.ts

@@ -328,7 +328,7 @@ async function executeActionInner(
 						break;
 					case "memory_store":
 						if (!provider.deleteMemoryStore) throw memoryStoreUnsupported(address.provider);
-						await provider.deleteMemoryStore(id);
+						await provider.deleteMemoryStore(id, apiMode);
 						break;
 					case "deployment":
 						await provider.deleteDeployment(id);
@@ -504,18 +504,22 @@ async function executeActionInner(
 				throw memoryStoreUnsupported(address.provider);
 			}
 			const reconcile = async (storeId: string): Promise<RemoteResource> => {
-				const store = await provider.updateMemoryStore!(storeId, {
-					name,
-					description: decl.description,
-					metadata: decl.metadata ?? {},
-				});
+				const store = await provider.updateMemoryStore!(
+					storeId,
+					{
+						name,
+						description: decl.description,
+						metadata: decl.metadata ?? {},
+					},
+					apiMode,
+				);
 
 				// Declarative entries are managed seeds. Update/create those paths in place,
 				// while preserving memories learned by agents at runtime.
 				const current = new Map<string, { id: string; content_sha256: string }>();
 				let cursor: string | undefined;
 				do {
-					const page = await provider.listMemories!(storeId, { limit: 100, cursor, view: "basic" });
+					const page = await provider.listMemories!(storeId, { limit: 100, cursor, view: "basic" }, apiMode);
 					for (const memory of page.data) {
 						if (memory.type === "memory") current.set(memory.path, memory);
 					}
@@ -526,22 +530,30 @@ async function executeActionInner(
 					const existing = current.get(entry.key.replace(/^\/+/, ""));
 					if (existing) {
 						if (existing.content_sha256 !== sha256(entry.content)) {
-							await provider.updateMemory!(storeId, existing.id, {
-								content: entry.content,
-								expected_content_sha256: existing.content_sha256,
-							});
+							await provider.updateMemory!(
+								storeId,
+								existing.id,
+								{
+									content: entry.content,
+									expected_content_sha256: existing.content_sha256,
+								},
+								apiMode,
+							);
 						}
 					} else {
-						await provider.createMemory!(storeId, { path: entry.key, content: entry.content });
+						await provider.createMemory!(storeId, { path: entry.key, content: entry.content }, apiMode);
 					}
 				}
 				return store;
 			};
-			if (isUpdate) {
+			if (apiModeChanged) {
+				result = await createMemoryStore(name, decl, apiMode);
+				if (existingId) await deleteMemoryStore(existingId, priorApiMode).catch(() => undefined);
+			} else if (isUpdate) {
 				result = await reconcile(existingId!);
 			} else {
 				try {
-					result = await createMemoryStore(name, decl);
+					result = await createMemoryStore(name, decl, apiMode);
 				} catch (err) {
 					result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
 						onExisting: async (existing) => reconcile(existing.id!),

packages/sdk/src/internal/executor/resolver.ts

@@ -87,12 +87,18 @@ export function resolveTemplateRefs(
 	if (!environment) throw new UserError(`Environment '${agent.environment}' is not defined in config.`);
 
 	const agentRefs = resolveAgentRefs(agentName, config, provider, state);
+	const memoryStoreIds = agent.memory_stores?.map((memoryStore) =>
+		requireRef(state, { type: "memory_store", name: memoryStore, provider }),
+	);
+	const identityName = config.defaults?.identity;
 	return {
 		...agentRefs,
 		environment_id:
 			environment.environment_id ?? requireRef(state, { type: "environment", name: agent.environment, provider }),
 		...(agent.tunnel ? { tunnel_id: resolveTunnelIdFromConfig(config, agent.tunnel, provider) } : {}),
 		vault_ids: agent.vault ? [requireRef(state, { type: "vault", name: agent.vault, provider })] : [],
+		...(memoryStoreIds ? { memory_store_ids: memoryStoreIds } : {}),
+		...(identityName ? { identity_id: requireRef(state, { type: "identity", name: identityName, provider }) } : {}),
 	};
 }
 

packages/sdk/src/internal/graph/dependency.ts

@@ -88,7 +88,7 @@ export function buildDependencyGraph(config: ProjectConfig, targetProviders: str
 				const agentAddr: ResourceAddress = { type: materialization.resourceType, name, provider };
 				addNode(agentAddr);
 
-				if (decl.default_memory_store && materialization.resourceType === "template") {
+				if ((decl.default_memory_store || decl.memory_stores?.length) && materialization.resourceType === "template") {
 					const identityName = config.defaults?.identity;
 					if (identityName) {
 						const identityAddr: ResourceAddress = { type: "identity", name: identityName, provider };

packages/sdk/src/internal/planner/hasher.ts

@@ -22,10 +22,16 @@ export async function computeResourceHash(
 
 	if (address.type === "skill") {
 		const skillDecl = decl as { source: string };
+		const apiMode = resolveQoderApiMode(address.type, address.name, address.provider, config);
 		if (basePath) {
 			const fileHash = computeSkillContentHash(skillDecl.source, basePath);
-			return contentHash({ decl, fileHash });
+			return contentHash({ decl, fileHash, apiMode });
 		}
+		return contentHash({ decl, apiMode });
+	}
+
+	if (address.type === "vault" || address.type === "memory_store") {
+		return contentHash({ decl, apiMode: resolveQoderApiMode(address.type, address.name, address.provider, config) });
 	}
 
 	if (address.type === "file" && basePath) {
@@ -58,6 +64,28 @@ export async function computeResourceHash(
 	return contentHash(decl);
 }
 
+function resolveQoderApiMode(
+	type: "skill" | "vault" | "memory_store",
+	name: string,
+	provider: string,
+	config: ProjectConfig,
+): "managed" | "forward" | undefined {
+	if (provider !== "qoder") return undefined;
+	for (const agent of Object.values(config.agents ?? {})) {
+		if (agent.provider && agent.provider !== provider) continue;
+		const referenced =
+			type === "skill"
+				? agent.skills?.some((skill) =>
+						typeof skill === "string" ? skill === name : skill.type === "custom" && skill.skill_id === name,
+					)
+				: type === "vault"
+					? agent.vault === name
+					: agent.memory_stores?.includes(name);
+		if (referenced && agent.delivery?.qoder?.type === "forward") return "forward";
+	}
+	return "managed";
+}
+
 /** Stable, non-reversible identity hint for resources whose YAML key may change. */
 export function computeReplacementFingerprint(address: ResourceAddress, config: ProjectConfig): string | undefined {
 	if (address.type !== "channel") return undefined;

packages/sdk/src/internal/providers/base-client.ts

@@ -34,10 +34,10 @@ export abstract class BaseApiClient {
 		throw new ApiError(res.status, body, this.errorPrefix);
 	}
 
-	async post(path: string, body: unknown): Promise<unknown> {
+	async post(path: string, body: unknown, options?: { headers?: Record<string, string> }): Promise<unknown> {
 		const res = await resolveFetch()(`${this.baseUrl}${path}`, {
 			method: "POST",
-			headers: this.headers(),
+			headers: { ...this.headers(), ...options?.headers },
 			body: JSON.stringify(body),
 		});
 		await this.throwIfError(res);

packages/sdk/src/internal/providers/interface.ts

@@ -87,6 +87,8 @@ export interface ResolvedTemplateRefs extends ResolvedAgentRefs {
 	/** Qoder BYOC private-network route used by Forward Templates. */
 	tunnel_id?: string;
 	vault_ids: string[];
+	identity_id?: string;
+	memory_store_ids?: string[];
 }
 
 export interface ResolvedDeploymentRefs {
@@ -231,17 +233,26 @@ export interface ProviderAdapter {
 	updateChannel?(id: string, name: string, decl: ChannelDecl, refs: ResolvedChannelRefs): Promise<RemoteResource>;
 	deleteChannel?(id: string): Promise<void>;
 
-	createMemoryStore?(name: string, decl: MemoryStoreDecl): Promise<RemoteResource>;
-	deleteMemoryStore?(id: string): Promise<void>;
+	createMemoryStore?(name: string, decl: MemoryStoreDecl, mode?: ProviderResourceMode): Promise<RemoteResource>;
+	deleteMemoryStore?(id: string, mode?: ProviderResourceMode): Promise<void>;
 	listMemoryStores?(options?: MemoryStoreListOptions): Promise<MemoryPage<MemoryStoreInfo>>;
 	getMemoryStore?(id: string): Promise<MemoryStoreInfo>;
-	updateMemoryStore?(id: string, input: UpdateMemoryStoreInput): Promise<MemoryStoreInfo>;
+	updateMemoryStore?(id: string, input: UpdateMemoryStoreInput, mode?: ProviderResourceMode): Promise<MemoryStoreInfo>;
 	archiveMemoryStore?(id: string): Promise<MemoryStoreInfo>;
-	createMemory?(storeId: string, input: CreateMemoryInput): Promise<MemoryInfo>;
+	createMemory?(storeId: string, input: CreateMemoryInput, mode?: ProviderResourceMode): Promise<MemoryInfo>;
 	batchCreateMemories?(storeId: string, input: BatchCreateMemoryInput): Promise<BatchCreateMemoryResult>;
-	listMemories?(storeId: string, options?: MemoryListOptions): Promise<MemoryPage<MemoryListItem>>;
+	listMemories?(
+		storeId: string,
+		options?: MemoryListOptions,
+		mode?: ProviderResourceMode,
+	): Promise<MemoryPage<MemoryListItem>>;
 	getMemory?(storeId: string, memoryId: string): Promise<MemoryInfo>;
-	updateMemory?(storeId: string, memoryId: string, input: UpdateMemoryInput): Promise<MemoryInfo>;
+	updateMemory?(
+		storeId: string,
+		memoryId: string,
+		input: UpdateMemoryInput,
+		mode?: ProviderResourceMode,
+	): Promise<MemoryInfo>;
 	deleteMemory?(storeId: string, memoryId: string, expectedContentSha256?: string): Promise<void>;
 	listMemoryVersions?(storeId: string, options?: MemoryVersionListOptions): Promise<MemoryPage<MemoryVersionInfo>>;
 	getMemoryVersion?(storeId: string, versionId: string): Promise<MemoryVersionInfo>;