memeloop 0.0.1 → 0.1.0

package/dist/scriptDeploymentPipeline-BAeo1dPb.d.cts

@@ -0,0 +1,2463 @@
+import { u as OrchestrationResourceManifest, v as OrchestrationOwnerReference, w as OrchestrationTypeMeta, x as OrchestrationObjectMetadata, y as OrchestrationResourceStatus, O as OrchestrationErrorData, t as AgentOrchestrationClient, z as OrchestrationResourceReference, B as OrchestrationGetOptions, E as OrchestrationResource, F as OrchestrationResourceQuery, J as OrchestrationListOptions, K as OrchestrationResourceList, N as OrchestrationWatchOptions, P as OrchestrationWatchEvent, Q as OrchestrationDeleteOptions, R as OrchestrationDeleteResult, b as ChatMessage, S as AgentFrameworkConfig, r as AiAPIConfig, U as IPrompt, I as IAgentStorage, m as AgentDefinition, C as ConversationMeta } from './interface-IrKBFtL1.cjs';
+
+declare const AGENT_WORKLOAD_API_VERSION = "workload.memeloop.io/v1alpha1";
+declare const AGENT_WORKLOAD_KIND = "AgentWorkload";
+declare const AGENT_RUN_API_VERSION = "run.memeloop.io/v1alpha1";
+declare const AGENT_RUN_KIND = "AgentRun";
+/**
+ * Host-asserted trust classification of a node or workload. The trust class
+ * is bound by the host; it is never self-reported by the workload, the model,
+ * or a `.mjs` script.
+ */
+type NodeTrustClass = 'trusted' | 'restricted' | 'quarantine';
+type AgentTrustLevel = NodeTrustClass;
+/** Ordered data classifications; higher ranks are more sensitive. */
+type DataClassification = 'public' | 'internal' | 'confidential' | 'restricted';
+type ToolAdmissionAction = 'allow' | 'deny' | 'require-approval';
+/**
+ * Declarative trusted-admission rule. Rules are evaluated in order; the first
+ * matching rule wins (firewall semantics). A rule matches when `toolPattern`
+ * matches the tool reference name and either `effects` is omitted (all
+ * effects) or contains the operation effect.
+ */
+interface ToolAdmissionRule {
+    toolPattern: string;
+    effects?: ToolOperationEffect[];
+    action: ToolAdmissionAction;
+    reason?: string;
+}
+interface ToolAdmissionPolicy {
+    /** Applied when no rule matches. Restricted/quarantine profiles resolve to `deny` regardless of this field. */
+    defaultAction: ToolAdmissionAction;
+    rules?: ToolAdmissionRule[];
+}
+interface AgentWorkloadModelPolicy {
+    modelClass?: string;
+    allowedModelNames?: string[];
+    budget?: {
+        maxTokens?: number;
+        maxCost?: number;
+    };
+}
+interface AgentWorkloadToolPolicy {
+    allowedToolClasses?: string[];
+    /** Tool classes that must have a healthy executor on the selected node. */
+    requiredToolClasses?: string[];
+    allowedToolIds?: string[];
+    defaultAction?: 'allow' | 'ask' | 'deny';
+    rules?: Array<{
+        pattern: string;
+        action: 'allow' | 'ask' | 'deny';
+    }>;
+}
+interface AgentWorkloadNetworkPolicy {
+    networkClass?: string;
+    egress?: 'none' | 'same-node' | 'restricted' | 'open';
+    /** Minimum boundary that must enforce this policy before the workload binds. */
+    minimumEnforcement?: 'none' | 'process' | 'namespace' | 'host' | 'external';
+}
+interface AgentWorkloadVolumeClaim {
+    name: string;
+    claimRef: string;
+}
+interface AgentWorkloadStoragePolicy {
+    storageClass?: string;
+    volumes?: AgentWorkloadVolumeClaim[];
+}
+interface AgentWorkloadCredentialPolicy {
+    /** Credential broker class required on the selected node. */
+    brokerClass?: string;
+    /** Audiences for which the node must be able to request scoped grants. */
+    audiences?: string[];
+    /** Target classes for which scoped grants may be issued. */
+    targets?: string[];
+}
+interface AgentWorkloadResourceRequirements {
+    cpuMillicores?: number;
+    memoryBytes?: number;
+    gpuCount?: number;
+    diskBytes?: number;
+    bandwidthKbps?: number;
+}
+interface AgentWorkloadPlacement {
+    /**
+     * Registered external-orchestrator driver name. When set, the external
+     * orchestration controller owns placement and the local node binder skips
+     * this workload. External placement is always explicit; there is no silent
+     * spillover from the local runtime.
+     */
+    orchestrator?: string;
+    nodeSelector?: Record<string, string>;
+    requiredNode?: string;
+    antiAffinity?: string[];
+    /** Soft co-location preference; never overrides a hard security filter. */
+    preferredNode?: string;
+    /** Taints the workload tolerates. Nodes with taints not listed here are filtered out. */
+    tolerations?: string[];
+    /**
+     * Maximum data classification the workload may carry. Nodes with a lower
+     * `maxDataClassification` than the workload's effective classification are
+     * filtered out. Quarantine nodes are always treated as `public`-only.
+     */
+    dataClassification?: DataClassification;
+    /** Allowed residency labels (for example `local`, `cn`, or `eu-west`). */
+    dataResidency?: string[];
+    /** Require a currently verified node attestation. */
+    requireAttestation?: boolean;
+    /** Fleet batch constraints enforced before a target binds. */
+    rollout?: {
+        batchId: string;
+        excludedFaultDomains?: string[];
+        maxConcurrentPerFaultDomain?: number;
+    };
+}
+type AgentWorkloadCompletionPolicy = 'complete' | 'detach' | 'daemon';
+interface AgentWorkloadSpec {
+    profileId?: string;
+    scriptReference?: string;
+    promptReference?: string;
+    trust?: AgentTrustLevel;
+    /** RuntimeClass selected for script workloads (plan 24.18); declarative only. */
+    runtimeClass?: string;
+    /**
+     * Non-secret environment variables for the workload (plan 24.14 `env`).
+     * Secret-shaped values are rejected at admission (deployGeneratedScript)
+     * and stripped again at launch (plan 24.35), so specs persisted in the
+     * ControlStore never carry provider keys.
+     */
+    env?: Record<string, string>;
+    /** Name of a SecurityProfile resource governing admission and model access. */
+    securityProfileRef?: string;
+    placement?: AgentWorkloadPlacement;
+    modelPolicy?: AgentWorkloadModelPolicy;
+    toolPolicy?: AgentWorkloadToolPolicy;
+    networkPolicy?: AgentWorkloadNetworkPolicy;
+    storagePolicy?: AgentWorkloadStoragePolicy;
+    credentialPolicy?: AgentWorkloadCredentialPolicy;
+    resources?: AgentWorkloadResourceRequirements;
+    /** Content-addressed artifacts whose locality may influence placement. */
+    artifactReferences?: string[];
+    /** Durable checkpoint whose locality may influence placement. */
+    checkpointReference?: string;
+    completionPolicy?: AgentWorkloadCompletionPolicy;
+    ownerReferences?: OrchestrationOwnerReference[];
+}
+interface AgentWorkloadStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Scheduling' | 'Running' | 'Completed' | 'Failed';
+    /** Node the binding controller scheduled this workload onto. */
+    assignedNode?: string;
+    /** Durable trusted policy decision that authorized the current binding. */
+    placementDecisionRef?: string;
+    /** Policy snapshot digest bound to placementDecisionRef. */
+    placementPolicyDigest?: string;
+    /** External driver selected for this workload, when any. */
+    assignedDriver?: string;
+    /** Opaque native workload identifier returned by the external driver. */
+    externalId?: string;
+    /** Non-secret, string-only backend metadata used for diagnostics/adoption. */
+    externalMetadata?: Record<string, string>;
+    runs?: Array<{
+        apiVersion: string;
+        kind: string;
+        name?: string;
+        namespace?: string;
+        uid?: string;
+    }>;
+    lastRunResult?: string;
+}
+interface AgentWorkloadCondition {
+    type: string;
+    status: 'True' | 'False' | 'Unknown';
+}
+type AgentWorkloadManifest = OrchestrationResourceManifest<AgentWorkloadSpec>;
+interface AgentWorkloadResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: AgentWorkloadSpec;
+    status?: AgentWorkloadStatus;
+}
+interface AgentRunSpec {
+    workloadRef: {
+        apiVersion: string;
+        kind: string;
+        name?: string;
+        namespace?: string;
+        uid?: string;
+    };
+    promptReference?: string;
+    retry?: number;
+    timeoutMs?: number;
+}
+interface AgentRunStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Starting' | 'Running' | 'Completed' | 'Failed' | 'Cancelled';
+    /**
+     * Durable claim written before invoking a LoopRuntimeDriver. A different
+     * daemon instance that observes Starting/Running must adopt through a
+     * managed driver or fail UNKNOWN_EFFECT; it must never blindly start again.
+     */
+    runtimeExecutionClaim?: {
+        controllerInstanceId: string;
+        claimedAt: string;
+    };
+    /** Independently selected serving endpoint for this run's model calls. */
+    assignedModelEndpoint?: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        namespace?: string;
+        uid: string;
+    };
+    /** Fences the model binding decision to the controller leadership epoch. */
+    modelBinding?: {
+        leaseEpoch: string;
+        endpointResourceVersion: string;
+        boundAt: string;
+    };
+    /** NetworkAttachment that must reach Attached before this run starts. */
+    networkAttachmentRef?: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        namespace?: string;
+        uid: string;
+    };
+    volumePhase?: 'Pending' | 'Publishing' | 'Ready' | 'Releasing' | 'Released' | 'Failed';
+    volumePublishClaim?: {
+        leaseEpoch: string;
+        claimedAt: string;
+    };
+    volumeBindings?: Array<{
+        name: string;
+        claimRef: {
+            name: string;
+            uid: string;
+        };
+        volumeRef: {
+            name: string;
+            uid: string;
+        };
+        assignedDriver: string;
+        assignedNode: string;
+        /** Managed node-stage handle used for ordered publish cleanup. */
+        stageHandle?: string;
+        publishHandle: string;
+        readOnly: boolean;
+    }>;
+    volumeReleaseRequestedAt?: string;
+    volumeError?: OrchestrationErrorData;
+    outputReference?: string;
+    summary?: string;
+    exitCode?: number;
+}
+interface AgentRunCondition {
+    type: string;
+    status: 'True' | 'False' | 'Unknown';
+}
+type AgentRunManifest = OrchestrationResourceManifest<AgentRunSpec>;
+interface AgentRunResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: AgentRunSpec;
+    status?: AgentRunStatus;
+}
+declare function createAgentWorkloadManifest(name: string, spec: AgentWorkloadSpec): AgentWorkloadManifest;
+declare function createAgentRunManifest(name: string, spec: AgentRunSpec): AgentRunManifest;
+declare function isAgentWorkload(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is AgentWorkloadResource;
+declare function isAgentRun(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is AgentRunResource;
+declare function agentWorkloadReference(name: string, namespace?: string): {
+    apiVersion: string;
+    kind: string;
+    name: string;
+    namespace?: string;
+};
+declare const TOOL_OPERATION_API_VERSION = "execution.memeloop.io/v1alpha1";
+declare const TOOL_OPERATION_KIND = "ToolOperation";
+type ToolOperationEffect = 'read' | 'create' | 'update' | 'delete' | 'execute' | 'unknown';
+interface ToolOperationToolReference {
+    apiVersion?: string;
+    kind: string;
+    name: string;
+    namespace?: string;
+    /** Expected input/output schema digest; executors with another digest are rejected. */
+    schemaDigest?: string;
+}
+interface ToolOperationRetryPolicy {
+    maxAttempts?: number;
+    nonRetryable?: boolean;
+    fencingToken?: string;
+}
+interface ToolOperationPolicy {
+    requireApproval?: boolean;
+    auditLevel?: 'none' | 'metadata' | 'payload';
+}
+interface ToolOperationSpec {
+    toolRef: ToolOperationToolReference;
+    arguments?: Record<string, unknown>;
+    effect: ToolOperationEffect;
+    idempotencyKey?: string;
+    timeoutMs?: number;
+    retry?: ToolOperationRetryPolicy;
+    policy?: ToolOperationPolicy;
+    /** Explicit registered external-orchestrator driver selection. */
+    placement?: {
+        orchestrator?: string;
+        requiredNode?: string;
+        preferredNode?: string;
+        nodeSelector?: Record<string, string>;
+        minimumTrust?: NodeTrustClass;
+    };
+}
+interface ToolOperationResult {
+    value?: unknown;
+    error?: OrchestrationErrorData;
+    evidenceRef?: string;
+}
+interface ToolOperationApprovalEvidence {
+    approvalId: string;
+    decision: 'allow' | 'deny';
+    /** Trusted human/service identity. Model-provided identities are invalid. */
+    actor: string;
+    decidedAt: string;
+    reason?: string;
+}
+interface ToolOperationStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Running' | 'Completed' | 'Failed' | 'Cancelled';
+    result?: ToolOperationResult;
+    attempts?: number;
+    startedAt?: string;
+    completedAt?: string;
+    /** Trusted approval evidence returned by the host-bound approval driver. */
+    approval?: ToolOperationApprovalEvidence;
+    assignedDriver?: string;
+    assignedNode?: string;
+    assignedExecutor?: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        namespace?: string;
+        uid?: string;
+    };
+    /**
+     * Durable claim written before a local effect starts. A different fencing
+     * epoch observing Running must reconcile unknown effect instead of blindly
+     * repeating the operation.
+     */
+    executionClaim?: {
+        leaseEpoch: string;
+        claimedAt: string;
+    };
+    externalId?: string;
+    externalMetadata?: Record<string, string>;
+}
+type ToolOperationManifest = OrchestrationResourceManifest<ToolOperationSpec>;
+interface ToolOperationResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: ToolOperationSpec;
+    status?: ToolOperationStatus;
+}
+declare function createToolOperationManifest(name: string, spec: ToolOperationSpec): ToolOperationManifest;
+declare function isToolOperation(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is ToolOperationResource;
+declare function agentRunReference(name: string, namespace?: string): {
+    apiVersion: string;
+    kind: string;
+    name: string;
+    namespace?: string;
+};
+declare const TOOL_CLASS_API_VERSION = "tool.memeloop.io/v1alpha1";
+declare const TOOL_CLASS_KIND = "ToolClass";
+declare const TOOL_EXECUTOR_API_VERSION = "tool.memeloop.io/v1alpha1";
+declare const TOOL_EXECUTOR_KIND = "ToolExecutor";
+type ToolRiskLevel = 'none' | 'low' | 'medium' | 'high' | 'critical';
+interface ToolClassSchema {
+    input: Record<string, unknown>;
+    output?: Record<string, unknown>;
+    required?: string[];
+}
+interface ToolClassSpec {
+    description?: string;
+    version?: string;
+    schema: ToolClassSchema;
+    schemaDigest?: string;
+    risk?: ToolRiskLevel;
+    effects?: ToolOperationEffect[];
+    allowedTargets?: string[];
+    categories?: string[];
+}
+interface ToolClassStatus extends OrchestrationResourceStatus {
+    endpointCount?: number;
+    healthyEndpointCount?: number;
+}
+type ToolClassManifest = OrchestrationResourceManifest<ToolClassSpec>;
+interface ToolClassResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: ToolClassSpec;
+    status?: ToolClassStatus;
+}
+interface ToolExecutorCapability {
+    toolClassRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    schemaDigest: string;
+    effects?: ToolOperationEffect[];
+    endpoint: string;
+    capacity?: {
+        maxConcurrent?: number;
+        queueDepth?: number;
+    };
+    health?: {
+        lastHeartbeat?: string;
+        healthy: boolean;
+    };
+}
+interface ToolExecutorSpec {
+    nodeId?: string;
+    selectors?: Record<string, string>;
+    capabilities: ToolExecutorCapability[];
+    trust?: 'trusted' | 'restricted' | 'quarantine';
+}
+interface ToolExecutorStatus extends OrchestrationResourceStatus {
+    heartbeat?: string;
+    healthy?: boolean;
+}
+type ToolExecutorManifest = OrchestrationResourceManifest<ToolExecutorSpec>;
+interface ToolExecutorResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: ToolExecutorSpec;
+    status?: ToolExecutorStatus;
+}
+declare function createToolClassManifest(name: string, spec: ToolClassSpec): ToolClassManifest;
+declare function createToolExecutorManifest(name: string, spec: ToolExecutorSpec): ToolExecutorManifest;
+declare function isToolClass(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is ToolClassResource;
+declare function isToolExecutor(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is ToolExecutorResource;
+declare const MODEL_CLASS_API_VERSION = "models.memeloop.io/v1alpha1";
+declare const MODEL_CLASS_KIND = "ModelClass";
+declare const MODEL_ENDPOINT_API_VERSION = "models.memeloop.io/v1alpha1";
+declare const MODEL_ENDPOINT_KIND = "ModelEndpoint";
+declare const MODEL_CALL_RECORD_API_VERSION = "models.memeloop.io/v1alpha1";
+declare const MODEL_CALL_RECORD_KIND = "ModelCallRecord";
+type ModelModality = 'text' | 'vision' | 'audio' | 'embedding';
+interface ModelClassCapabilities {
+    streaming?: boolean;
+    toolUse?: boolean;
+    jsonMode?: boolean;
+    systemPrompt?: boolean;
+}
+/**
+ * Declarative model catalog entry. Carries identity, digest, capabilities,
+ * residency, and cost metadata only — raw provider SDK clients, base URLs with
+ * embedded credentials, and API keys must never appear here.
+ */
+interface ModelClassSpec {
+    description?: string;
+    /** Provider family identifier, e.g. `openai`, `anthropic`, `ollama`. */
+    provider: string;
+    /** Provider model name, e.g. `gpt-4o-mini`, `qwen2.5:7b`. */
+    model: string;
+    version?: string;
+    /** Content digest: local weights hash or provider snapshot identifier. */
+    digest?: string;
+    modalities?: ModelModality[];
+    contextWindow?: number;
+    maxOutputTokens?: number;
+    capabilities?: ModelClassCapabilities;
+    /** `local`, `cloud`, or a region/zone label constraining data residency. */
+    dataResidency?: string;
+    cost?: {
+        inputPerMillion?: number;
+        outputPerMillion?: number;
+        currency?: string;
+    };
+}
+interface ModelClassStatus extends OrchestrationResourceStatus {
+    endpointCount?: number;
+    healthyEndpointCount?: number;
+}
+type ModelClassManifest = OrchestrationResourceManifest<ModelClassSpec>;
+interface ModelClassResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: ModelClassSpec;
+    status?: ModelClassStatus;
+}
+/**
+ * Schedulable model serving endpoint. The endpoint string is an opaque driver
+ * handle (e.g. `ollama://node-1/qwen2.5:7b` or `gateway://default`) and must
+ * not embed credentials.
+ */
+interface ModelEndpointSpec {
+    modelClassRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    /** Must match the referenced ModelClass digest for schedulability. */
+    modelDigest?: string;
+    nodeId?: string;
+    trust?: 'trusted' | 'restricted' | 'quarantine';
+    endpoint: string;
+    capacity?: {
+        maxConcurrent?: number;
+        tokensPerMinute?: number;
+    };
+    dataPolicy?: {
+        classification?: string;
+        retention?: string;
+    };
+}
+interface ModelEndpointStatus extends OrchestrationResourceStatus {
+    healthy?: boolean;
+    heartbeat?: string;
+    activeCalls?: number;
+}
+type ModelEndpointManifest = OrchestrationResourceManifest<ModelEndpointSpec>;
+interface ModelEndpointResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: ModelEndpointSpec;
+    status?: ModelEndpointStatus;
+}
+/**
+ * Audit and usage record for a single model call. Records carry usage and
+ * classification metadata, never raw prompts, completions, or credentials.
+ */
+interface ModelCallRecordSpec {
+    modelClassRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    /** Immutable model artifact/provider snapshot selected for this call. */
+    modelDigest?: string;
+    endpointRef?: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    runRef?: OrchestrationOwnerReference;
+    /** Immutable attempt number from the authorizing ModelAccessHandle. */
+    runAttempt?: number;
+    /** Bound actor identity asserted by the host, not self-reported. */
+    caller?: string;
+    /** Name of the ModelAccessHandle authorizing this call. */
+    accessHandleRef?: string;
+    /** Admission/policy snapshot bound into the authorizing handle. */
+    policyDigest?: string;
+    inputClassification?: string;
+    outputClassification?: string;
+}
+interface ModelCallRecordStatus extends OrchestrationResourceStatus {
+    phase?: 'Running' | 'Completed' | 'Failed' | 'Cancelled';
+    usage?: {
+        inputTokens?: number;
+        outputTokens?: number;
+        cost?: number;
+        currency?: string;
+    };
+    latencyMs?: number;
+    startedAt?: string;
+    completedAt?: string;
+    error?: OrchestrationErrorData;
+}
+type ModelCallRecordManifest = OrchestrationResourceManifest<ModelCallRecordSpec>;
+interface ModelCallRecordResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: ModelCallRecordSpec;
+    status?: ModelCallRecordStatus;
+}
+declare function createModelClassManifest(name: string, spec: ModelClassSpec): ModelClassManifest;
+declare function createModelEndpointManifest(name: string, spec: ModelEndpointSpec): ModelEndpointManifest;
+declare function createModelCallRecordManifest(name: string, spec: ModelCallRecordSpec): ModelCallRecordManifest;
+declare function isModelClass(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is ModelClassResource;
+declare function isModelEndpoint(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is ModelEndpointResource;
+declare function isModelCallRecord(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is ModelCallRecordResource;
+declare const SECURITY_PROFILE_API_VERSION = "security.memeloop.io/v1alpha1";
+declare const SECURITY_PROFILE_KIND = "SecurityProfile";
+/**
+ * Reusable security posture referenced by workloads. The profile is applied
+ * by trusted admission, never by the workload itself: for restricted and
+ * quarantine trust classes the resolved tool-admission default is forced to
+ * `deny` regardless of `toolAdmission.defaultAction`.
+ */
+interface SecurityProfileSpec {
+    description?: string;
+    /** Trust class this profile applies to. */
+    trustClass: NodeTrustClass;
+    /** Tool admission overlay merged over the trust-class default policy. */
+    toolAdmission?: ToolAdmissionPolicy;
+    /** Model access constraints for workloads under this profile. */
+    modelPolicy?: {
+        allowedModelClasses?: string[];
+        maxInputClassification?: DataClassification;
+    };
+}
+interface SecurityProfileStatus extends OrchestrationResourceStatus {
+    /** Number of workloads currently referencing this profile. */
+    workloadCount?: number;
+}
+type SecurityProfileManifest = OrchestrationResourceManifest<SecurityProfileSpec>;
+interface SecurityProfileResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: SecurityProfileSpec;
+    status?: SecurityProfileStatus;
+}
+declare function createSecurityProfileManifest(name: string, spec: SecurityProfileSpec): SecurityProfileManifest;
+declare function isSecurityProfile(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is SecurityProfileResource;
+declare const POLICY_DECISION_API_VERSION = "security.memeloop.io/v1alpha1";
+declare const POLICY_DECISION_KIND = "PolicyDecision";
+type PersistedPolicyDecisionKind = 'resource-admission' | 'placement' | 'tool-operation' | 'approval' | 'transition';
+/** Immutable decision evidence; only a pending approval's status may resolve. */
+interface PolicyDecisionSpec {
+    subjectRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        namespace?: string;
+        uid: string;
+        generation: number;
+    };
+    decisionKind: PersistedPolicyDecisionKind;
+    policyDigest: string;
+    inputDigest: string;
+    requestFingerprint: string;
+    idempotencyKey: string;
+    fencingEpoch: number;
+    requestedBy: string;
+    reasons: string[];
+    obligations: string[];
+    decidedAt: string;
+    initialOutcome: 'allow' | 'deny' | 'pending';
+    approval?: {
+        subjectDigest: string;
+        requestedBy: string;
+        requestedAt: string;
+        expiresAt: string;
+    };
+}
+interface PolicyDecisionStatus extends OrchestrationResourceStatus {
+    outcome: 'allow' | 'deny' | 'pending';
+    decidedBy: string;
+    decidedAt: string;
+    reasons: string[];
+    resolutionInputDigest?: string;
+}
+type PolicyDecisionManifest = OrchestrationResourceManifest<PolicyDecisionSpec>;
+interface PolicyDecisionResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: PolicyDecisionSpec;
+    status?: PolicyDecisionStatus;
+}
+declare function createPolicyDecisionManifest(name: string, spec: PolicyDecisionSpec): PolicyDecisionManifest;
+declare function isPolicyDecision(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is PolicyDecisionResource;
+declare const AUDIT_RECORD_API_VERSION = "audit.memeloop.io/v1alpha1";
+declare const AUDIT_RECORD_KIND = "AuditRecord";
+/**
+ * Immutable, metadata-only audit/telemetry evidence. The record digest covers
+ * every field except itself and links to the preceding record in the named
+ * stream. Raw request/response bodies and credentials have no representation.
+ */
+interface AuditRecordSpec {
+    stream: string;
+    sequence: number;
+    resourceUid: string;
+    recordKind: 'audit' | 'event' | 'metric' | 'trace';
+    receivedAt: string;
+    actor: {
+        id: string;
+        kind: 'controller' | 'verifier' | 'admin';
+    };
+    policyDigest: string;
+    capabilityDigest: string;
+    effect: 'read' | 'create' | 'update' | 'delete' | 'execute' | 'decision' | 'security';
+    provenance: {
+        source: 'controller' | 'gateway' | 'driver' | 'worker' | 'operator';
+        producer: string;
+        subject?: string;
+    };
+    attributes: Record<string, string>;
+    data: {
+        kind: 'audit';
+        action: string;
+        outcome: 'success' | 'denied' | 'failure';
+        reasonCode?: string;
+    } | {
+        kind: 'event';
+        name: string;
+        severity: 'debug' | 'info' | 'warning' | 'error' | 'critical';
+    } | {
+        kind: 'metric';
+        name: string;
+        value: number;
+        unit: string;
+    } | {
+        kind: 'trace';
+        name: string;
+        traceId: string;
+        spanId: string;
+        durationMs: number;
+        status: 'ok' | 'error';
+    };
+    previousDigest?: string;
+    recordDigest: string;
+    requestFingerprint: string;
+    idempotencyDigest: string;
+    fencingEpoch: number;
+}
+type AuditRecordManifest = OrchestrationResourceManifest<AuditRecordSpec>;
+interface AuditRecordResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: AuditRecordSpec;
+    status?: OrchestrationResourceStatus;
+}
+declare function createAuditRecordManifest(name: string, spec: AuditRecordSpec): AuditRecordManifest;
+declare function isAuditRecord(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is AuditRecordResource;
+declare const NETWORK_CLASS_API_VERSION = "network.memeloop.io/v1alpha1";
+declare const NETWORK_CLASS_KIND = "NetworkClass";
+declare const NETWORK_ATTACHMENT_API_VERSION = "network.memeloop.io/v1alpha1";
+declare const NETWORK_ATTACHMENT_KIND = "NetworkAttachment";
+interface NetworkEgressRule {
+    /** Host, domain suffix, or CIDR, e.g. `api.openai.com` or `10.0.0.0/8`. */
+    target: string;
+    ports?: number[];
+    protocol?: 'tcp' | 'udp' | 'http' | 'https' | 'any';
+    action: 'allow' | 'deny';
+}
+/**
+ * CNI-like network desired state. `enforcement: required` means the workload
+ * must not start unless the driver can enforce every configured feature;
+ * `best-effort` allows partial enforcement with recorded degradation.
+ */
+interface NetworkClassSpec {
+    description?: string;
+    /** NetworkDriver name responsible for this class. */
+    driver: string;
+    dns?: {
+        policy?: 'default' | 'none' | 'custom';
+        servers?: string[];
+        searchDomains?: string[];
+    };
+    proxy?: {
+        httpProxy?: string;
+        httpsProxy?: string;
+        noProxy?: string[];
+        /** When true, traffic bypassing the proxy must be blocked. */
+        mandatory?: boolean;
+    };
+    ingress?: {
+        defaultAction?: 'allow' | 'deny';
+        allow?: Array<{
+            from?: string;
+            ports?: number[];
+        }>;
+    };
+    egress?: {
+        defaultAction: 'allow' | 'deny';
+        rules?: NetworkEgressRule[];
+    };
+    serviceAccess?: {
+        allowControlPlane?: boolean;
+        allowClusterServices?: boolean;
+        allowModelGateway?: boolean;
+    };
+    bandwidth?: {
+        ingressKbps?: number;
+        egressKbps?: number;
+    };
+    dataPolicy?: {
+        classification?: DataClassification;
+        retention?: string;
+    };
+    enforcement: 'required' | 'best-effort';
+}
+interface NetworkClassStatus extends OrchestrationResourceStatus {
+    attachmentCount?: number;
+}
+type NetworkClassManifest = OrchestrationResourceManifest<NetworkClassSpec>;
+interface NetworkClassResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: NetworkClassSpec;
+    status?: NetworkClassStatus;
+}
+interface NetworkAttachmentSpec {
+    networkClassRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    workloadRef?: OrchestrationOwnerReference;
+    /** Exact AgentRun whose sandbox and authority this attachment belongs to. */
+    runRef?: OrchestrationOwnerReference;
+    nodeId?: string;
+}
+interface NetworkAttachmentStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Preparing' | 'Attached' | 'Failed' | 'Detached';
+    /** Node and driver selected independently from workload execution. */
+    assignedNode?: string;
+    assignedDriver?: string;
+    /** Fences the placement decision and the NetworkClass version it validated. */
+    binding?: {
+        leaseEpoch: string;
+        networkClassResourceVersion: string;
+        boundAt: string;
+    };
+    /**
+     * Durable claim written before prepare() may create host-side state.
+     * A new lease epoch must not blindly repeat an unconfirmed prepare.
+     */
+    executionClaim?: {
+        leaseEpoch: string;
+        claimedAt: string;
+    };
+    /** Opaque driver handle; consumers must never parse it. */
+    handle?: string;
+    addresses?: string[];
+    routes?: string[];
+    dns?: {
+        servers?: string[];
+    };
+    /** Features the driver could not enforce under a best-effort class. */
+    degraded?: string[];
+    attachedAt?: string;
+    /** Set by the workload owner after execution; the node driver must release before Detached. */
+    releaseRequestedAt?: string;
+    detachedAt?: string;
+    error?: OrchestrationErrorData;
+}
+type NetworkAttachmentManifest = OrchestrationResourceManifest<NetworkAttachmentSpec>;
+interface NetworkAttachmentResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: NetworkAttachmentSpec;
+    status?: NetworkAttachmentStatus;
+}
+declare function createNetworkClassManifest(name: string, spec: NetworkClassSpec): NetworkClassManifest;
+declare function createNetworkAttachmentManifest(name: string, spec: NetworkAttachmentSpec): NetworkAttachmentManifest;
+declare function isNetworkClass(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is NetworkClassResource;
+declare function isNetworkAttachment(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is NetworkAttachmentResource;
+declare const STORAGE_CLASS_API_VERSION = "storage.memeloop.io/v1alpha1";
+declare const STORAGE_CLASS_KIND = "StorageClass";
+declare const VOLUME_CLAIM_API_VERSION = "storage.memeloop.io/v1alpha1";
+declare const VOLUME_CLAIM_KIND = "AgentVolumeClaim";
+declare const VOLUME_API_VERSION = "storage.memeloop.io/v1alpha1";
+declare const VOLUME_KIND = "AgentVolume";
+declare const SNAPSHOT_API_VERSION = "storage.memeloop.io/v1alpha1";
+declare const SNAPSHOT_KIND = "AgentSnapshot";
+type VolumeAccessMode = 'ReadWriteOnce' | 'ReadOnlyMany' | 'ReadWriteMany';
+/** CSI-like storage class: provisioning and replication policy. */
+interface StorageClassSpec {
+    description?: string;
+    /** StorageDriver name responsible for this class. */
+    driver: string;
+    replication?: {
+        /** Desired replica count across fault domains (1 = no replication). */
+        factor?: number;
+        /** Fault-domain labels replicas must be spread across (e.g. `node`, `zone`). */
+        faultDomains?: string[];
+        /** Rebuild replicas automatically after loss. */
+        autoRebuild?: boolean;
+    };
+    encryption?: {
+        enabled?: boolean;
+        /** Reference to a key in the credential domain (never key material). */
+        keyRef?: string;
+    };
+    allowedAccessModes?: VolumeAccessMode[];
+    snapshotSupport?: boolean;
+    backup?: {
+        /** Cron-like schedule expression evaluated by the backup controller. */
+        schedule?: string;
+        retentionCount?: number;
+    };
+    dataPolicy?: {
+        classification?: DataClassification;
+        retention?: string;
+    };
+}
+interface StorageClassStatus extends OrchestrationResourceStatus {
+    volumeCount?: number;
+    healthyVolumeCount?: number;
+}
+type StorageClassManifest = OrchestrationResourceManifest<StorageClassSpec>;
+interface StorageClassResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: StorageClassSpec;
+    status?: StorageClassStatus;
+}
+/** PVC-like claim: a workload's request for storage. */
+interface AgentVolumeClaimSpec {
+    storageClassRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    accessMode: VolumeAccessMode;
+    sizeBytes?: number;
+    selector?: Record<string, string>;
+    /** Restore from a snapshot when provisioning. */
+    dataSourceRef?: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+}
+interface AgentVolumeClaimStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Provisioning' | 'Bound' | 'Lost' | 'Failed';
+    assignedNode?: string;
+    assignedDriver?: string;
+    binding?: {
+        leaseEpoch: string;
+        storageClassResourceVersion: string;
+        boundAt: string;
+    };
+    provisionClaim?: {
+        leaseEpoch: string;
+        claimedAt: string;
+    };
+    volumeRef?: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        uid?: string;
+    };
+    error?: OrchestrationErrorData;
+}
+type AgentVolumeClaimManifest = OrchestrationResourceManifest<AgentVolumeClaimSpec>;
+interface AgentVolumeClaimResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: AgentVolumeClaimSpec;
+    status?: AgentVolumeClaimStatus;
+}
+interface AgentVolumeReplicaStatus {
+    nodeId: string;
+    state: 'healthy' | 'degraded' | 'rebuilding' | 'offline';
+    /** Verified content hash of this replica (must equal the volume contentHash). */
+    contentHash?: string;
+    updatedAt?: string;
+}
+/** PV-like provisioned volume. `driverHandle` is opaque and never parsed by consumers. */
+interface AgentVolumeSpec {
+    storageClassRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    claimRef?: OrchestrationOwnerReference;
+    /** Opaque driver handle for the provisioned volume. */
+    driverHandle: string;
+    capacityBytes?: number;
+    topology?: {
+        nodeId?: string;
+        zone?: string;
+    };
+    accessModes?: VolumeAccessMode[];
+}
+interface AgentVolumeStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Available' | 'Bound' | 'Published' | 'Failed';
+    replicas?: AgentVolumeReplicaStatus[];
+    /** Last verified content hash; the replication source of truth. */
+    contentHash?: string;
+    /** Current primary replica node; transfers originate only from the primary. */
+    primaryNodeId?: string;
+    /** Monotonically increasing fencing epoch, bumped on every primary change. */
+    primaryEpoch?: number;
+    publishedTo?: Array<{
+        nodeId?: string;
+        workloadRef?: OrchestrationOwnerReference;
+    }>;
+    health?: 'healthy' | 'degraded' | 'rebuilding' | 'failed';
+}
+type AgentVolumeManifest = OrchestrationResourceManifest<AgentVolumeSpec>;
+interface AgentVolumeResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: AgentVolumeSpec;
+    status?: AgentVolumeStatus;
+}
+/** Point-in-time snapshot of a volume; restorable into new claims. */
+interface AgentSnapshotSpec {
+    sourceVolumeRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    snapshotClass?: string;
+}
+interface AgentSnapshotStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Ready' | 'Failed';
+    readyToUse?: boolean;
+    restoreSizeBytes?: number;
+    /** Opaque driver handle for the snapshot. */
+    driverHandle?: string;
+    createdAt?: string;
+}
+type AgentSnapshotManifest = OrchestrationResourceManifest<AgentSnapshotSpec>;
+interface AgentSnapshotResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: AgentSnapshotSpec;
+    status?: AgentSnapshotStatus;
+}
+declare function createStorageClassManifest(name: string, spec: StorageClassSpec): StorageClassManifest;
+declare function createVolumeClaimManifest(name: string, spec: AgentVolumeClaimSpec): AgentVolumeClaimManifest;
+declare function createVolumeManifest(name: string, spec: AgentVolumeSpec): AgentVolumeManifest;
+declare function createSnapshotManifest(name: string, spec: AgentSnapshotSpec): AgentSnapshotManifest;
+declare function isStorageClass(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is StorageClassResource;
+declare function isVolumeClaim(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is AgentVolumeClaimResource;
+declare function isVolume(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is AgentVolumeResource;
+declare function isSnapshot(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is AgentSnapshotResource;
+declare const CREDENTIAL_GRANT_API_VERSION = "security.memeloop.io/v1alpha1";
+declare const CREDENTIAL_GRANT_KIND = "CredentialGrant";
+/**
+ * JIT credential authorization (plan 24.46). The resource records grant
+ * metadata only — the opaque handle lives in the credential domain and raw
+ * secret material never appears in spec or status.
+ */
+interface CredentialGrantSpec {
+    runRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        uid: string;
+    };
+    attempt: number;
+    /** Fingerprint of the worker's ephemeral public key. */
+    workerKey: string;
+    /** Target system the credential acts on (e.g. `ssh://node-7`, `model:openai/gpt-4o`). */
+    target: string;
+    /** Operation the credential authorizes (e.g. `exec`, `generate`, `read`). */
+    method: string;
+    /** Audience the resulting handle is valid for. */
+    audience: string;
+    policyDigest: string;
+    budget?: {
+        maxCalls?: number;
+        maxCost?: number;
+        currency?: string;
+    };
+    /** Requested TTL in milliseconds; the broker caps it. */
+    ttlMs?: number;
+}
+interface CredentialGrantStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Issuing' | 'Issued' | 'Renewed' | 'Revoked' | 'Expired' | 'Failed';
+    assignedNode?: string;
+    assignedBroker?: string;
+    binding?: {
+        leaseEpoch: string;
+        boundAt: string;
+    };
+    issuanceClaim?: {
+        leaseEpoch: string;
+        claimedAt: string;
+    };
+    /** Opaque handle reference in the credential domain — never the handle itself. */
+    handleRef?: string;
+    issuedAt?: string;
+    expiresAt?: string;
+    renewedAt?: string;
+    revokedAt?: string;
+    /** Exposure assessment used to decide post-task rotation. */
+    exposure?: 'none' | 'worker-visible' | 'potentially-exposed';
+    rotationRequired?: boolean;
+    rotationReason?: string;
+    error?: OrchestrationErrorData;
+}
+type CredentialGrantManifest = OrchestrationResourceManifest<CredentialGrantSpec>;
+interface CredentialGrantResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: CredentialGrantSpec;
+    status?: CredentialGrantStatus;
+}
+declare function createCredentialGrantManifest(name: string, spec: CredentialGrantSpec): CredentialGrantManifest;
+declare function isCredentialGrant(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is CredentialGrantResource;
+declare const ARTIFACT_RECORD_API_VERSION = "artifacts.memeloop.io/v1alpha1";
+declare const ARTIFACT_RECORD_KIND = "ArtifactRecord";
+type ArtifactTrust = 'trusted' | 'restricted' | 'quarantine' | 'untrusted';
+type ArtifactDestination = 'prompt' | 'volume' | 'backup' | 'knowledge';
+type ArtifactReviewKind = 'scan' | 'sanitize' | 'verify';
+interface ArtifactReviewEvidence {
+    kind: ArtifactReviewKind;
+    outcome: 'passed' | 'failed';
+    reviewer: string;
+    contentHash: string;
+    policyDigest: string;
+    destinations: ArtifactDestination[];
+    /** Narrow properties certified by the reviewer; never implies general trust. */
+    properties?: string[];
+    recordedAt: string;
+}
+/**
+ * Content-addressed artifact with provenance and trust (plan 24.47). Derived
+ * content inherits the lowest trust of its inputs; untrusted or unverified
+ * content cannot enter trusted prompts, volumes, backups, or knowledge
+ * ingestion without explicit policy and a verifier pass.
+ */
+interface ArtifactRecordSpec {
+    /** Content hash (e.g. `sha256:...`); the storage address. */
+    contentHash: string;
+    sizeBytes?: number;
+    mimeType?: string;
+    /** Producing run and its trust at production time. */
+    producer?: {
+        runRef?: OrchestrationOwnerReference;
+        trust: ArtifactTrust;
+    };
+    /** Parent artifacts this one derives from. */
+    parents?: Array<{
+        apiVersion: string;
+        kind: string;
+        name: string;
+    }>;
+    trust: ArtifactTrust;
+}
+interface ArtifactRecordStatus extends OrchestrationResourceStatus {
+    /** Append-only evidence written only by the trusted artifact review actor. */
+    reviews?: ArtifactReviewEvidence[];
+    quarantined?: boolean;
+    quarantineReason?: string;
+    /** Downstream artifact names derived from this one (lineage). */
+    derivedBy?: string[];
+}
+type ArtifactRecordManifest = OrchestrationResourceManifest<ArtifactRecordSpec>;
+interface ArtifactRecordResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: ArtifactRecordSpec;
+    status?: ArtifactRecordStatus;
+}
+declare function createArtifactRecordManifest(name: string, spec: ArtifactRecordSpec): ArtifactRecordManifest;
+declare function isArtifactRecord(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is ArtifactRecordResource;
+declare const DRIVER_MANIFEST_API_VERSION = "drivers.memeloop.io/v1alpha1";
+declare const DRIVER_MANIFEST_KIND = "DriverManifest";
+type InfrastructureDriverType = 'control-store' | 'loop-runtime' | 'tool-catalog' | 'tool-execution' | 'model-provider' | 'network' | 'storage' | 'credential' | 'artifact' | 'identity-attestation' | 'policy-approval' | 'audit-telemetry' | 'external-orchestrator';
+type DriverManifestConformance = {
+    suiteVersion: string;
+    status: 'not-run';
+} | {
+    suiteVersion: string;
+    status: 'failed';
+    failedAt: string;
+    failure: string;
+} | {
+    suiteVersion: string;
+    status: 'passed';
+    passedAt: string;
+    /** Content digest of the exact golden fixture/result bundle. */
+    fixtureDigest: string;
+};
+/**
+ * Control-plane representation of a registered driver (plan §11, 24.62).
+ * A RuntimeClass/NetworkClass/ModelClass/scheduler can only reference a
+ * driver whose manifest is registered and conformance-checked; external
+ * orchestrator drivers register through the CLI discovery loader.
+ */
+interface DriverManifestSpec {
+    driverType: InfrastructureDriverType;
+    /** Driver package version (from getCapabilities or the package manifest). */
+    version: string;
+    execution: {
+        location: 'controller' | 'node' | 'worker' | 'external';
+        transport: 'in-process' | 'stdio' | 'utility-process' | 'http' | 'peer-rpc' | 'container-api' | 'other';
+    };
+    supportedTrustClasses: NodeTrustClass[];
+    resourceKinds: string[];
+    capabilities: Record<string, boolean | string | number>;
+    downgradeBehavior: 'reject' | 'explicit-degrade';
+    requiredHostPrivileges: string[];
+    isolation: {
+        boundary: 'none' | 'process' | 'namespace' | 'host' | 'external';
+        threatAssumptions: string[];
+    };
+    configuration: {
+        /** Stable reference to the schema used to validate non-secret configuration. */
+        schemaRef: string;
+        /** Names of opaque SecretRef fields; never secret values. */
+        secretRefs: string[];
+    };
+    health: {
+        mode: 'method' | 'endpoint';
+        endpoint?: string;
+    };
+    lifecycle: {
+        discoverable: boolean;
+        hotReload: boolean;
+        gracefulShutdown: boolean;
+    };
+    conformance: DriverManifestConformance;
+    supportsCancellation: boolean;
+    supportsBackpressure: boolean;
+    supportsAdoption: boolean;
+    supportsFencing: boolean;
+    /** External orchestrators: the resource kinds this driver manages. */
+    manages?: Array<'AgentWorkload' | 'ToolOperation'>;
+    /** External orchestrators: co-located scheduling support. */
+    supportsColocation?: boolean;
+}
+interface DriverManifestStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Ready' | 'Failed';
+    registeredAt?: string;
+    error?: OrchestrationErrorData;
+}
+type DriverManifestManifest = OrchestrationResourceManifest<DriverManifestSpec>;
+interface DriverManifestResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: DriverManifestSpec;
+    status?: DriverManifestStatus;
+}
+declare function createDriverManifestManifest(name: string, spec: DriverManifestSpec): DriverManifestManifest;
+declare function isDriverManifest(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is DriverManifestResource;
+/** A class may only select a manifest whose current conformance evidence passed. */
+declare function isDriverManifestAdmitted(resource: DriverManifestResource): boolean;
+
+interface CreateAgentWorkloadOptions {
+    name?: string;
+    generateName?: string;
+    namespace?: string;
+    profileId?: string;
+    scriptReference?: string;
+    promptReference?: string;
+    trust?: AgentTrustLevel;
+    placement?: AgentWorkloadPlacement;
+    modelPolicy?: AgentWorkloadModelPolicy;
+    toolPolicy?: AgentWorkloadToolPolicy;
+    networkPolicy?: AgentWorkloadNetworkPolicy;
+    storagePolicy?: AgentWorkloadStoragePolicy;
+    completionPolicy?: AgentWorkloadCompletionPolicy;
+    ownerReferences?: OrchestrationOwnerReference[];
+    idempotencyKey?: string;
+}
+interface CreateAgentRunOptions {
+    name?: string;
+    generateName?: string;
+    namespace?: string;
+    workloadName: string;
+    workloadNamespace?: string;
+    promptReference?: string;
+    retry?: number;
+    timeoutMs?: number;
+    idempotencyKey?: string;
+}
+interface WaitForConditionOptions {
+    timeout?: number;
+    interval?: number;
+    signal?: AbortSignal;
+    /** Host cancellation hook for runtimes that expose a boolean marker instead of AbortSignal. */
+    isCancelled?: () => boolean;
+}
+interface AgentClient {
+    createWorkload(options: CreateAgentWorkloadOptions): Promise<AgentWorkloadResource>;
+    getWorkload(name: string, namespace?: string): Promise<AgentWorkloadResource | null>;
+    deleteWorkload(name: string, namespace?: string): Promise<void>;
+    waitForWorkloadCondition(name: string, condition: AgentWorkloadCondition, options?: WaitForConditionOptions): Promise<{
+        observedResourceVersion: string;
+        matched: true;
+    }>;
+    createRun(options: CreateAgentRunOptions): Promise<AgentRunResource>;
+    getRun(name: string, namespace?: string): Promise<AgentRunResource | null>;
+    deleteRun(name: string, namespace?: string): Promise<void>;
+    waitForRunCondition(name: string, condition: AgentRunCondition, options?: WaitForConditionOptions): Promise<{
+        observedResourceVersion: string;
+        matched: true;
+    }>;
+}
+declare function waitForCondition<TResource extends {
+    metadata?: {
+        resourceVersion?: string;
+    };
+    status?: {
+        conditions?: Array<{
+            type: string;
+            status: 'True' | 'False' | 'Unknown';
+        }>;
+    };
+}>(get: () => Promise<TResource | null>, condition: {
+    type: string;
+    status: 'True' | 'False' | 'Unknown';
+}, options: WaitForConditionOptions): Promise<{
+    observedResourceVersion: string;
+    matched: true;
+}>;
+declare function createAgentClient(client: AgentOrchestrationClient, defaultNamespace?: string): AgentClient;
+
+type ControlStoreVerb = 'create' | 'apply' | 'update-status' | 'delete' | 'acquire-lease' | 'renew-lease' | 'release-lease';
+interface ControlStoreActor {
+    id: string;
+    kind: 'controller' | 'verifier' | 'admin';
+    properties?: string[];
+}
+interface ControlStoreAuthorizationRequest {
+    actor: ControlStoreActor;
+    verb: ControlStoreVerb;
+    reference: OrchestrationResourceReference;
+    current?: OrchestrationResource;
+    proposedResource?: OrchestrationResourceManifest;
+    proposedStatus?: OrchestrationResourceStatus;
+}
+interface ControlStoreAuthorizer {
+    /** Must return synchronously so authorization and the protected write share one transaction. */
+    authorize(request: ControlStoreAuthorizationRequest): void;
+}
+interface ControlStoreCreateOptions {
+    idempotencyKey?: string;
+    dryRun?: boolean;
+}
+interface ControlStoreApplyOptions {
+    /** Required when changing an existing spec; omitted only for create/same-spec retry. */
+    resourceVersion?: string;
+    idempotencyKey?: string;
+    dryRun?: boolean;
+}
+interface ControlStoreStatusUpdateOptions {
+    /** Exact compare-and-swap precondition. */
+    resourceVersion: string;
+    idempotencyKey?: string;
+    dryRun?: boolean;
+}
+interface ControlLeaseRequest {
+    name: string;
+    holder: string;
+    ttlMs: number;
+}
+interface ControlLeaseIdentity {
+    name: string;
+    holder: string;
+    leaseId: string;
+    epoch: string;
+}
+interface ControlLeaseGrant extends ControlLeaseIdentity {
+    acquiredAt: string;
+    renewedAt: string;
+    expiresAt: string;
+    resourceVersion: string;
+}
+interface ControlStoreCompactionResult {
+    compactedThrough: string;
+    resourceVersion: string;
+}
+interface ControlStoreSnapshotResult {
+    resourceVersion: string;
+    createdAt: string;
+}
+interface ControlStoreHealth {
+    healthy: boolean;
+    resourceVersion: string;
+    detail?: string;
+}
+/**
+ * Trusted controller-facing state store. Agent-facing clients never receive
+ * status, lease, compaction, snapshot, or actor-selection capabilities.
+ */
+interface ControlStore {
+    get<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(reference: OrchestrationResourceReference, options?: OrchestrationGetOptions): Promise<OrchestrationResource<TSpec, TStatus> | null>;
+    list<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(query: OrchestrationResourceQuery, options?: OrchestrationListOptions): Promise<OrchestrationResourceList<TSpec, TStatus>>;
+    watch<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(query: OrchestrationResourceQuery, options?: OrchestrationWatchOptions): AsyncIterable<OrchestrationWatchEvent<TSpec, TStatus>>;
+    create<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(actor: ControlStoreActor, resource: OrchestrationResourceManifest<TSpec>, options?: ControlStoreCreateOptions): Promise<OrchestrationResource<TSpec, TStatus>>;
+    apply<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(actor: ControlStoreActor, resource: OrchestrationResourceManifest<TSpec>, options?: ControlStoreApplyOptions): Promise<OrchestrationResource<TSpec, TStatus>>;
+    updateStatus<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(actor: ControlStoreActor, reference: OrchestrationResourceReference, status: TStatus, options: ControlStoreStatusUpdateOptions): Promise<OrchestrationResource<TSpec, TStatus>>;
+    delete(actor: ControlStoreActor, reference: OrchestrationResourceReference, options?: OrchestrationDeleteOptions): Promise<OrchestrationDeleteResult>;
+    acquireLease(actor: ControlStoreActor, request: ControlLeaseRequest): Promise<ControlLeaseGrant>;
+    renewLease(actor: ControlStoreActor, identity: ControlLeaseIdentity, ttlMs: number): Promise<ControlLeaseGrant>;
+    releaseLease(actor: ControlStoreActor, identity: ControlLeaseIdentity): Promise<void>;
+    compact(throughResourceVersion: string): Promise<ControlStoreCompactionResult>;
+    snapshot(targetPath: string): Promise<ControlStoreSnapshotResult>;
+    getHealth(): Promise<ControlStoreHealth>;
+    close(): Promise<void>;
+}
+/** Key-order-independent structural form used by every ControlStore backend. */
+declare function canonicalControlStoreValue(value: unknown): string;
+/** Whether an apply manifest is already represented by the stored resource. */
+declare function controlStoreApplyMatches(current: OrchestrationResource, proposed: OrchestrationResourceManifest): boolean;
+
+/**
+ * Generated-script validation and normalization (plan 24.16).
+ *
+ * Validates Agent-generated .mjs scripts before they are scheduled:
+ * - Syntax check via a real JavaScript parser (Acorn) — regexes could be
+ *   fooled by comments/strings/regex literals; an AST cannot.
+ * - Required export shape: the default export must be an async generator
+ *   function (inline or via an identifier bound to one in the same module).
+ * - Import extraction from the AST: static `import` declarations, re-exports
+ *   (`export ... from`), and string-literal dynamic `import()` arguments.
+ *   Non-literal dynamic imports are rejected because they defeat admission.
+ * - Forbidden imports: no Node builtins except 'node:events'.
+ * - Size limits.
+ * - Canonical SHA-256 digest for provenance. The digest commits to the
+ *   NORMALIZED source (see {@link normalizeScript}), so semantically
+ *   identical scripts with different line endings share one digest.
+ *
+ * Security note: this runs in the controller process, but never executes
+ * the script. Execution is delegated to the sandbox from plan 24.48.
+ */
+interface ScriptValidationResult {
+    valid: boolean;
+    /**
+     * Canonical SHA-256 hex digest of the NORMALIZED source
+     * (`normalizeScript(source)`). The digest commits to the normalized form,
+     * not the raw bytes, so CRLF/LF variants of the same script are equal.
+     */
+    digest: string;
+    /** Detected imports, from the AST (static, re-export, literal dynamic). */
+    imports: string[];
+    /** Whether the script's default export is an async generator function. */
+    hasDefaultExport: boolean;
+    /**
+     * Whether the script contains a dynamic `import()` whose argument is not
+     * a string literal. Such scripts are always invalid: the import target
+     * cannot be known statically, which defeats admission control.
+     */
+    hasNonLiteralDynamicImport: boolean;
+    /** Human-readable errors if invalid. */
+    errors: string[];
+    /** Normalized source size in bytes. */
+    sizeBytes: number;
+}
+/**
+ * Compute the canonical SHA-256 hex digest of an already-normalized script.
+ * Callers with raw source must pass it through {@link normalizeScript} first
+ * (or use {@link validateScript}, which normalizes internally).
+ */
+declare function digestNormalizedScript(normalizedSource: string): Promise<string>;
+/**
+ * Validate a script string using a real AST parse (Acorn).
+ * Returns a structured result; never throws.
+ */
+declare function validateScript(source: string): Promise<ScriptValidationResult>;
+/**
+ * Normalize a script to a canonical form for digest stability.
+ * Strips BOM, normalizes line endings to LF, and trims trailing whitespace.
+ * Idempotent: `normalizeScript(normalizeScript(s)) === normalizeScript(s)`.
+ * The canonical digest in {@link validateScript} commits to this form.
+ */
+declare function normalizeScript(source: string): string;
+
+/**
+ * Script admission policy and checkpoint compatibility (plan 24.17, 24.19).
+ *
+ * - Admission: trust class, author, imports, resource limits, approval
+ * - Compatibility: script digest/API version vs checkpoint schema
+ *
+ * Quarantine scripts cannot enable arbitrary network imports or plugin loading.
+ * A changed script cannot resume an incompatible checkpoint without explicit
+ * converter or restart policy.
+ */
+
+type ScriptTrustClass = 'trusted' | 'restricted' | 'quarantine';
+interface ScriptAdmissionRequest {
+    /** The validated script result. */
+    script: ScriptValidationResult;
+    /** Trust class of the author (e.g., the Agent that generated the script). */
+    authorTrust: ScriptTrustClass;
+    /** Requested interfaces the script wants to use. */
+    requestedInterfaces: string[];
+    /** Optional checkpoint digest the script expects to resume from. */
+    expectedCheckpointDigest?: string;
+    /** The checkpoint's API version (for compatibility check). */
+    checkpointApiVersion?: string;
+}
+interface ScriptAdmissionDecision {
+    admitted: boolean;
+    reason: string;
+    /** Which interfaces are approved for this script. */
+    approvedInterfaces: string[];
+    /** Whether the checkpoint is compatible. */
+    checkpointCompatible: boolean;
+    /** If not admitted, whether the author can retry with changes. */
+    retryable: boolean;
+}
+/**
+ * The full interface set a host may grant to scripts authored under the
+ * given trust class — a defensive copy of the trust profile's allowlist.
+ *
+ * Hosts wiring a {@link ../loopAPI/types.ScriptLoadGate} or a deployment
+ * pipeline should pass these as `requestedInterfaces`; {@link admitScript}
+ * rejects any request outside the trust profile, so this is the widest set
+ * that can ever be approved for that class. Callers may pass a narrower
+ * subset to further restrict a specific runtime.
+ */
+declare function defaultRequestedInterfacesForTrustClass(trustClass: ScriptTrustClass): string[];
+/** Maximum script size in bytes admitted for the given trust class. */
+declare function maxScriptBytesForTrustClass(trustClass: ScriptTrustClass): number;
+/**
+ * Decide whether a generated script may be admitted for execution.
+ */
+declare function admitScript(request: ScriptAdmissionRequest): ScriptAdmissionDecision;
+
+/**
+ * Unified loop contract for all agent loop types.
+ * Replaces the old AgentToolLoopInput / AgentToolLoopStep naming entirely.
+ */
+
+/** Standard input for any agent loop. */
+interface AgentLoopInput {
+    conversationId: string;
+    message: string;
+    /** Host-prepared user message, used when the platform needs metadata/attachments on the turn root. */
+    userMessage?: Omit<Partial<ChatMessage>, 'conversationId' | 'role'> & {
+        content?: string;
+    };
+    /** If provided, these messages are loaded as conversation history on resume. */
+    resumeSession?: ChatMessage[];
+}
+/** Standard output step yielded by any agent loop. */
+interface AgentLoopStep {
+    type: 'thinking' | 'tool' | 'message' | 'permission_request';
+    data: unknown;
+}
+/** Async iterable signature shared by all loop runners. */
+type AgentLoopGenerator = AsyncIterable<AgentLoopStep>;
+/** Describes a registered loop type. */
+interface AgentLoopDefinition {
+    /** Unique id, e.g. "agent-tool-loop" or "agent-agent-loop". */
+    id: string;
+    /** Human-readable display name. */
+    name: string;
+    /** Short description of this loop's behaviour. */
+    description: string;
+    /** Factory: create a loop runner function for the given context. */
+    createRunner: (context: {
+        [key: string]: unknown;
+    }) => (input: AgentLoopInput) => AgentLoopGenerator;
+}
+type LoopProfileScriptReference = {
+    kind: 'builtin';
+    id: string;
+} | {
+    kind: 'specifier';
+    specifier: string;
+} | {
+    kind: 'source';
+    source: string;
+    name?: string;
+};
+/**
+ * Request handed to a {@link ScriptLoadGate} before a data-URL/source script
+ * is imported into the current process. The source has already been
+ * normalized; the digest commits to the normalized form (plan 24.16).
+ */
+interface ScriptLoadGateRequest {
+    /** Normalized script source (`normalizeScript` output). */
+    normalizedSource: string;
+    /** Canonical SHA-256 hex digest of the normalized source. */
+    digest: string;
+    /** The original script reference being loaded. */
+    reference: LoopProfileScriptReference;
+    /** Script type label for diagnostics (e.g. "AgentAgentLoop script"). */
+    scriptType: string;
+}
+/** Admission decision returned by a {@link ScriptLoadGate}. */
+interface ScriptLoadGateDecision {
+    /** Whether the script may be imported into this process. */
+    allowed: boolean;
+    /** Human-readable denial reason (required when `allowed` is false). */
+    reason?: string;
+    /** Trust class assigned by admission (plan 24.17). */
+    trustClass?: ScriptTrustClass;
+    /** RuntimeClass name selected for the script (plan 24.18). */
+    runtimeClass?: string;
+    /** Whether the script may resume its expected checkpoint (plan 24.19). */
+    checkpointCompatible?: boolean;
+}
+/**
+ * Port: host-injected admission gate for script loading. Every non-builtin
+ * script source must pass this gate before `import()`; when no gate is
+ * configured the loader fails closed (denies all non-builtin sources).
+ */
+interface ScriptLoadGate {
+    admitScriptLoad(request: ScriptLoadGateRequest): Promise<ScriptLoadGateDecision> | ScriptLoadGateDecision;
+}
+interface AgentLoopScriptPolicy {
+    allowBuiltin?: boolean;
+    allowFile?: boolean;
+    allowNetwork?: boolean;
+    allowSource?: boolean;
+    allowSpecifier?: boolean;
+    importModule?: (specifier: string) => Promise<unknown>;
+    /**
+     * Host-provided admission gate for non-builtin script sources. When
+     * omitted, all non-builtin sources are denied (fail-closed).
+     */
+    scriptLoadGate?: ScriptLoadGate;
+}
+/** Capability extension point for a loop. */
+interface LoopPlugin {
+    /** Unique plugin id, e.g. "fullReplacement" or "wikiTools". */
+    id: string;
+    /** Which loop id this plugin targets, or "*" for all loops. */
+    targetLoopId?: string;
+    /** Optional schema to validate against profile config. */
+    schema?: Record<string, unknown>;
+    /** Install the plugin into the given context. Mutates the context in place. */
+    install?: (context: {
+        [key: string]: unknown;
+    }, config?: Record<string, unknown>) => void;
+}
+/** A complete agent profile that describes which loop, which .mjs script, prompts, plugins, and hooks to use. */
+interface LoopProfile {
+    /** Unique profile id, e.g. "memeloop:general-assistant". */
+    id: string;
+    /** Display name. */
+    name: string;
+    /** Description. */
+    description: string;
+    /** Which loop to run. Defaults to "agent-tool-loop" if omitted. */
+    loopId?: string;
+    /** Structured reference to the loop script. Prefer this over `script` for new profiles. */
+    scriptReference?: LoopProfileScriptReference;
+    /** Legacy alias for `scriptReference`. */
+    scriptRef?: LoopProfileScriptReference;
+    /** Legacy path/specifier to the .mjs loop script. */
+    script?: string;
+    /** System prompt (concise form; detailed prompts go to `prompts`). */
+    systemPrompt?: string;
+    /** Tool allowlist IDs. */
+    tools?: string[];
+    /** Agent-level tool configuration. */
+    agentTools?: Array<{
+        toolId: string;
+        enabled?: boolean;
+        parameters?: Record<string, unknown>;
+        tags?: string[];
+    }>;
+    /** Full agent framework configuration. */
+    agentFrameworkConfig?: AgentFrameworkConfig;
+    /** System prompt(s) for the agent. */
+    prompts?: LoopProfilePrompt[];
+    /** Tool / prompt / response plugin configs. */
+    plugins?: LoopProfilePluginEntry[];
+    /** Hook plugin configs. */
+    hookPlugins?: LoopProfilePluginEntry[];
+    /** Model configuration. */
+    modelConfig?: {
+        provider?: string;
+        model?: string;
+        temperature?: number;
+        maxTokens?: number;
+    };
+    /** Host-specific AI API config override. */
+    aiApiConfig?: AiAPIConfig;
+    /** Periodic auto-wake configuration. */
+    heartbeat?: {
+        enabled: boolean;
+        intervalSeconds: number;
+        message: string;
+        activeHoursStart?: string;
+        activeHoursEnd?: string;
+    };
+    /** Host-specific handler / framework ID. */
+    agentFrameworkID?: string;
+    /** Host-specific avatar or icon URL. */
+    avatarUrl?: string;
+    /** Tool permission configuration. */
+    permissions?: {
+        default?: 'allow' | 'ask' | 'deny';
+        rules?: Array<{
+            pattern: string;
+            action: 'allow' | 'ask' | 'deny';
+        }>;
+        perAgent?: Record<string, {
+            default?: string;
+            rules?: Array<{
+                pattern: string;
+                action: string;
+            }>;
+        }>;
+    };
+    /** Open schema for host-specific or loop-specific configuration. */
+    schema?: Record<string, unknown>;
+    /** Arbitrary metadata. */
+    metadata?: Record<string, unknown>;
+    /** Version string. */
+    version?: string;
+}
+interface LoopProfilePrompt {
+    id: string;
+    role: string;
+    text: string;
+    caption?: string;
+    children?: LoopProfilePrompt[];
+}
+interface LoopProfilePluginEntry {
+    /** Plugin id registered in the plugin registry. */
+    id: string;
+    /** Whether this plugin is enabled. */
+    enabled?: boolean;
+    /** Plugin-specific configuration. */
+    config?: Record<string, unknown>;
+}
+/** Minimal runtime context passed to a loop runner. */
+interface AgentLoopRuntime {
+    /** Resolve a profile by id. */
+    resolveProfile: (profileId: string) => Promise<LoopProfile | null>;
+    /** Policy-scoped declarative manager facade available to this loop. */
+    orchestration?: AgentOrchestrationClient;
+    /** Host-bound script deployment configuration used to build `ctx.scriptClient` (plan 24.14). */
+    scriptDeployment?: ScriptDeploymentClientConfig;
+    /** Run a child agent (or sub-loop) and return its result. */
+    runChildAgent: (input: {
+        profileId: string;
+        prompt: string;
+        conversationId: string;
+    }) => AgentLoopGenerator;
+    /** Log an event for observability. */
+    log: (event: string, data?: Record<string, unknown>) => void;
+    /** Read/write persistent state for this run. */
+    state: {
+        get: <T>(key: string) => Promise<T | undefined>;
+        set: (key: string, value: unknown) => Promise<void>;
+        update: (key: string, updater: (previous: unknown) => unknown) => Promise<void>;
+    };
+    /** Checkpoint a completed step so it can be skipped on resume. */
+    checkpoint: (key: string, result: unknown) => Promise<void>;
+    /** Load a previously completed step after process restart. */
+    loadCheckpoint: <T>(key: string) => Promise<T | undefined>;
+    /** Emit a progress step upstream. */
+    emit: (step: AgentLoopStep) => void;
+    /** Signal whether the run has been cancelled. */
+    signal: {
+        cancelled: boolean;
+    };
+}
+interface LoopScriptCheckpointStore {
+    saveCheckpoint(conversationId: string, key: string, result: unknown): Promise<void>;
+    loadCheckpoint<T>(conversationId: string, key: string): Promise<T | undefined>;
+}
+
+type ToolCallingMatch = {
+    found: false;
+} | {
+    found: true;
+    toolId: string;
+    parameters: Record<string, unknown>;
+    originalText: string;
+};
+declare function matchToolCalling(responseText: string): ToolCallingMatch;
+declare function matchAllToolCallings(responseText: string): {
+    calls: Array<ToolCallingMatch & {
+        found: true;
+    }>;
+    parallel: boolean;
+};
+
+/**
+ * TidGi-Desktop `agentInstance/tools/types.ts` 迁移并适配 memeloop（无 tapable，用 HookSlot.promise 串行执行）。
+ */
+
+/** 供 defineTool / 审批使用：agent 视图包含完整 AgentInstance。 */
+type DefineToolAgentFrameworkContext = AgentFrameworkContext & {
+    agent: AgentInstanceModel;
+};
+type ToolApprovalMode = 'auto' | 'confirm';
+interface ToolApprovalConfig {
+    mode: ToolApprovalMode;
+    allowPatterns?: string[];
+    denyPatterns?: string[];
+    timeoutMs?: number;
+}
+type ApprovalDecision = 'allow' | 'deny' | 'pending';
+interface ToolApprovalRequest {
+    approvalId: string;
+    agentId: string;
+    toolName: string;
+    parameters: Record<string, unknown>;
+    originalText?: string;
+    created: Date;
+}
+type YieldNextRoundTarget = 'human' | 'self' | `agent:${string}`;
+interface ToolActions {
+    yieldNextRoundTo?: YieldNextRoundTarget;
+    newUserMessage?: string;
+    toolCalling?: ToolCallingMatch;
+}
+interface BaseToolContext {
+    agentFrameworkContext: DefineToolAgentFrameworkContext;
+    metadata?: Record<string, unknown>;
+    actions?: ToolActions;
+}
+/** 与 TidGi IPromptConcatTool 对齐的插件行 */
+interface FrameworkPluginToolConfig {
+    id: string;
+    toolId: string;
+    enabled?: boolean;
+    caption?: string;
+    content?: string;
+    forbidOverrides?: boolean;
+    approval?: ToolApprovalConfig;
+    timeoutMs?: number;
+    [key: string]: unknown;
+}
+interface PromptConcatHookContext extends BaseToolContext {
+    messages: ChatMessage[];
+    prompts: IPrompt[];
+    toolConfig: FrameworkPluginToolConfig;
+    pluginIndex?: number;
+}
+interface AgentResponse {
+    id: string;
+    text?: string;
+    enabled?: boolean;
+    children?: AgentResponse[];
+}
+interface PostProcessContext extends PromptConcatHookContext {
+    llmResponse: string;
+    responses?: AgentResponse[];
+}
+/** 流式响应子集（memeloop ILLMProvider 聚合为最终文本后注入） */
+interface AIStreamResponseSubset {
+    status: 'update' | 'done';
+    content: string;
+}
+interface AIResponseContext extends BaseToolContext {
+    toolConfig: FrameworkPluginToolConfig;
+    agentFrameworkConfig?: {
+        plugins?: FrameworkPluginToolConfig[];
+    };
+    response: AIStreamResponseSubset;
+    requestId?: string;
+    isFinal?: boolean;
+}
+interface UserMessageContext extends BaseToolContext {
+    content: {
+        text: string;
+        file?: unknown;
+        wikiTiddlers?: Array<{
+            workspaceName: string;
+            tiddlerTitle: string;
+        }>;
+    };
+    messageId: string;
+    timestamp: Date;
+}
+interface AgentStatusContext extends BaseToolContext {
+    status: {
+        state: 'working' | 'completed' | 'failed' | 'canceled';
+        modified: Date;
+    };
+}
+interface ToolExecutionContext extends BaseToolContext {
+    toolResult: {
+        success: boolean;
+        data?: string;
+        error?: string;
+        metadata?: Record<string, unknown>;
+    };
+    toolInfo: {
+        toolId: string;
+        parameters: Record<string, unknown>;
+        originalText?: string;
+    };
+    requestId?: string;
+}
+/**
+ * Hook 槽：与 tapable AsyncSeriesHook 一致 — `tapAsync` 注册，`promise(ctx)` 串行触发。
+ */
+type TapAsyncHandler = {
+    bivarianceHack(context: unknown, callback: () => void): void;
+}['bivarianceHack'];
+interface HookSlot {
+    tapAsync(name: string, function_: TapAsyncHandler): void;
+    promise(context: unknown): Promise<void>;
+}
+interface PromptConcatHooks {
+    processPrompts: HookSlot;
+    finalizePrompts: HookSlot;
+    postProcess: HookSlot;
+    userMessageReceived: HookSlot;
+    agentStatusChanged: HookSlot;
+    toolExecuted: HookSlot;
+    responseUpdate: HookSlot;
+    responseComplete: HookSlot;
+}
+type PromptConcatTool = (hooks: PromptConcatHooks) => void;
+
+interface CheckpointRecord {
+    conversationId: string;
+    messages: ChatMessage[];
+    savedAt: string;
+    messageCount: number;
+    lastMessagePreview: string;
+}
+interface CheckpointSummary {
+    conversationId: string;
+    savedAt: string;
+    messageCount: number;
+    lastMessagePreview: string;
+}
+interface CheckpointStore {
+    saveCheckpoint(conversationId: string, messages: ChatMessage[]): Promise<CheckpointRecord>;
+    loadCheckpoint(conversationId: string): Promise<CheckpointRecord | null>;
+    listCheckpoints(): Promise<CheckpointSummary[]>;
+    deleteCheckpoint(conversationId: string): Promise<boolean>;
+}
+interface SessionStorageOptions {
+    records?: CheckpointRecord[];
+}
+declare function createCheckpointRecord(conversationId: string, messages: ChatMessage[], savedAt?: string): CheckpointRecord;
+declare function parseCheckpointRecord(raw: string): CheckpointRecord | null;
+declare function serializeCheckpointRecord(record: CheckpointRecord): string;
+declare class InMemoryCheckpointStore implements CheckpointStore {
+    private readonly records;
+    constructor(options?: SessionStorageOptions);
+    saveCheckpoint(conversationId: string, messages: ChatMessage[]): Promise<CheckpointRecord>;
+    loadCheckpoint(conversationId: string): Promise<CheckpointRecord | null>;
+    listCheckpoints(): Promise<CheckpointSummary[]>;
+    deleteCheckpoint(conversationId: string): Promise<boolean>;
+}
+declare class SessionStorage extends InMemoryCheckpointStore {
+}
+
+interface MemeLoopLogger {
+    debug?(message: string, ...arguments_: unknown[]): void;
+    info?(message: string, ...arguments_: unknown[]): void;
+    warn?(message: string, ...arguments_: unknown[]): void;
+    error?(message: string, ...arguments_: unknown[]): void;
+}
+interface ILLMProvider {
+    name: string;
+    /**
+     * Serializable default model identity used by orchestration resources.
+     * `model` may be an SDK object or factory and must never be persisted.
+     */
+    modelId?: string;
+    model?: unknown;
+    chat(request: unknown): AsyncIterable<unknown> | Promise<unknown>;
+}
+interface IToolRegistry {
+    registerTool(id: string, impl: unknown, parameterSchema?: unknown, effect?: ToolOperationEffect): void;
+    getTool(id: string): unknown | undefined;
+    listTools(): string[];
+    /**
+     * Instance-local schema lookup. Managed catalogs use this when available so
+     * one embedded runtime cannot inherit another runtime's process-global schema.
+     */
+    getToolParameterSchema?: (id: string) => unknown | undefined;
+    /** Host-authoritative effect classification; omitted tools default to conservative execute. */
+    getToolEffect?: (id: string) => ToolOperationEffect | undefined;
+    /** Prompt-concat plugin registry, isolated per runtime. Falls back to the process-level default registry. */
+    getPromptPlugins?: () => Map<string, (hooks: PromptConcatHooks) => void>;
+}
+interface IChatSyncAdapter {
+    start(): Promise<void>;
+    stop(): Promise<void>;
+}
+interface INetworkService {
+    start(): Promise<void>;
+    stop(): Promise<void>;
+}
+interface AgentToolLoopOptions {
+    /** Maximum LLM-to-tool round-trips. `0` means unlimited, still capped internally. */
+    maxIterations?: number;
+    /** Whether to parse `<tool_use>` / `<function_call>` and execute through `IToolRegistry` (default true). */
+    enableToolLoop?: boolean;
+    /** Cancellation check, e.g. when the user stops a run. */
+    isCancelled?: (conversationId: string) => boolean;
+    /** Attachment injection for promptConcat, aligned with `PromptConcatOptions`. */
+    readAttachmentFile?: (path: string) => Promise<Uint8Array>;
+    /** Omit history older than this many milliseconds when building LLM input. `0` disables trimming. */
+    maxHistoryAgeMs?: number;
+    /**
+     * When `defineTool` / plugins are configured, fall back to `IToolRegistry` for tool calls not handled by `onResponseComplete`.
+     */
+    fallbackRegistryTools?: boolean;
+    /**
+     * Tool permission rules (default allow).
+     * Supports wildcards such as "terminal.*" and "file.read".
+     */
+    toolPermissions?: {
+        default?: 'allow' | 'ask' | 'deny';
+        rules?: Array<{
+            pattern: string;
+            action: 'allow' | 'ask' | 'deny';
+        }>;
+        perAgent?: Record<string, {
+            default?: 'allow' | 'ask' | 'deny';
+            rules?: Array<{
+                pattern: string;
+                action: 'allow' | 'ask' | 'deny';
+            }>;
+        }>;
+    };
+    /** Threshold for repeated identical tool+input calls (default 3). */
+    doomLoopThreshold?: number;
+    /**
+     * Timeout for a single ToolOperation executed through the orchestration
+     * facade (default 60_000ms). Covers the full lifecycle from apply until a
+     * terminal phase, including scheduling and remote execution.
+     */
+    toolOperationTimeoutMs?: number;
+    /**
+     * Host-bound trust class of the node running this loop. Restricted and
+     * quarantine nodes default the model-facing tool permission layer to deny
+     * when no explicit wildcard rule exists. Bound by the host at assembly
+     * time; never self-reported by the workload or model.
+     */
+    trustClass?: NodeTrustClass;
+    /** History compaction window: keep the most recent N turns plus the last user message. */
+    contextCompaction?: {
+        maxMessages?: number;
+        replayLastUserMessage?: boolean;
+    };
+    /**
+     * Auto-compaction: when message count exceeds threshold, summarizes old
+     * conversation turns via truncation or LLM summarization. Default: disabled.
+     */
+    autoCompact?: {
+        /** Trigger compaction when message count exceeds this (default: 50) */
+        threshold?: number;
+        /** Number of recent turns to preserve (default: 4) */
+        recentTurnsToKeep?: number;
+        /** Maximum token estimate before compaction; 0 disables token-based compaction */
+        maxTokens?: number;
+    };
+    /** Session checkpoint: save conversation history after each turn for resume. */
+    sessionCheckpoint?: {
+        /** Enable checkpoint saves. Default: false. */
+        enabled?: boolean;
+        /** Store provided by the runtime host. */
+        store?: CheckpointStore;
+        /** Custom checkpoint directory (default: ~/.memeloop/sessions/) */
+        directory?: string;
+    };
+    /**
+     * After a tool returns `__memeloopToolResult.awaitSessionId`, AgentToolLoop waits here before the next LLM round.
+     */
+    waitForTerminalSession?: (sessionId: string) => Promise<{
+        exitCode: number | null;
+        truncatedOutput: string;
+    }>;
+}
+interface AgentFrameworkContext {
+    storage: IAgentStorage;
+    llmProvider: ILLMProvider;
+    tools: IToolRegistry;
+    syncAdapters: IChatSyncAdapter[];
+    network: INetworkService;
+    /** Policy-scoped declarative manager facade shared by Agent loops and Agent-facing tools. */
+    orchestration?: AgentOrchestrationClient;
+    /**
+     * Host-bound script deployment configuration (plan 24.14). Loop runtimes
+     * build a `ctx.scriptClient` from it; scripts never see the raw config,
+     * so trust class and interface ceilings stay host-controlled.
+     */
+    scriptDeployment?: ScriptDeploymentClientConfig;
+    /** Trusted controller state store; Agent-facing loop scripts receive only its checkpoint adapter. */
+    controlStore?: ControlStore;
+    /** Durable milestones used by script-backed loops such as quality-gate. */
+    loopCheckpoints?: LoopScriptCheckpointStore;
+    /** Let host runtimes preserve platform-specific message aliases/metadata while core owns the loop. */
+    normalizeMessage?: (message: ChatMessage) => ChatMessage;
+    /**
+     * Notify a host about an in-memory streaming message. The core invokes this
+     * with the same message ID used for the immutable final persisted message.
+     */
+    onTransientMessage?: (message: ChatMessage) => void | Promise<void>;
+    /** AgentToolLoop ReAct behavior, migrated from the TidGi-Desktop agentToolLoop integration. */
+    agentToolLoop?: AgentToolLoopOptions;
+    /**
+     * Host-injected runner used by `createMemeLoopRuntime` after a user sends a message.
+     */
+    runAgentToolLoop?: (input: AgentLoopInput) => AgentLoopGenerator;
+    /** Run a child agent for orchestration loops such as AgentAgentLoop. */
+    runChildAgent?: AgentLoopRuntime['runChildAgent'];
+    /** Policy for loading script-backed loops. Defaults to bundled scripts + import specifiers only. */
+    loopScriptPolicy?: AgentLoopScriptPolicy;
+    /**
+     * Build the agent view supplied to defineTool hooks for a conversation.
+     */
+    resolveAgentRuntimeView?: (conversationId: string, messages: ChatMessage[]) => Promise<AgentInstanceModel>;
+    /** Current agent view for defineTool / TidGi compatibility. */
+    agent?: {
+        id: string;
+        messages: ChatMessage[];
+    };
+    /** Persist a `ChatMessage` if the runtime host supplies this hook. */
+    persistAgentMessage?: (message: ChatMessage) => Promise<void>;
+    /** Cancellation markers written by `createMemeLoopRuntime`. */
+    conversationCancellation?: Set<string>;
+    /** Resolve an AgentDefinition from host-specific sources. */
+    resolveAgentDefinition?: (definitionId: string) => Promise<AgentDefinition | null>;
+    /** Fallback logger used when the host does not inject one. */
+    logger?: MemeLoopLogger;
+    /** TidGi defineTool compatibility: legacy plugins call this without arguments. */
+    isCancelled?: () => boolean;
+}
+type AgentInstanceState = 'submitted' | 'working' | 'input-required' | 'completed' | 'canceled' | 'failed' | 'unknown';
+interface AgentInstanceLatestStatus {
+    state: AgentInstanceState;
+    message?: ChatMessage;
+    /** Human-readable sub-status for the header — shown while agent is working. */
+    progress?: string;
+    created?: Date;
+    modified?: Date;
+}
+interface AgentInstanceModel extends Omit<AgentDefinition, 'name'> {
+    agentDefId: string;
+    name?: string;
+    agentFrameworkConfig?: AgentFrameworkConfig;
+    messages: ChatMessage[];
+    status: AgentInstanceLatestStatus;
+    created: Date;
+    modified?: Date;
+    closed?: boolean;
+    volatile?: boolean;
+    isDelegatedAgentRun?: boolean;
+    parentAgentRunId?: string;
+}
+
+declare function isUserInitiatedConversation(meta: ConversationMeta): boolean;
+declare function createInstanceDeltaFromDefinition(definition: AgentDefinition, overrides: Partial<AgentDefinition>): Partial<AgentDefinition>;
+
+interface RuntimeClassSpec {
+    /** Module isolation level. */
+    isolation: 'none' | 'process' | 'container';
+    /** CPU limit in millicores (1000 = 1 core). */
+    cpuLimitMillis?: number;
+    /** Memory limit in bytes. */
+    memoryLimitBytes?: number;
+    /** Wall-clock time limit in milliseconds. */
+    timeLimitMs?: number;
+    /** Whether the runtime supports cancellation signals. */
+    supportsCancellation: boolean;
+    /** Supported trust classes for this runtime. */
+    supportedTrustClasses: ScriptTrustClass[];
+    /** Whether network access is allowed (outbound-only for quarantine). */
+    networkAccess: 'none' | 'outbound-only' | 'full';
+}
+interface RuntimeClassResource {
+    apiVersion: 'execution.memeloop.io/v1alpha1';
+    kind: 'RuntimeClass';
+    metadata: {
+        name: string;
+        namespace?: string;
+    };
+    spec: RuntimeClassSpec;
+}
+declare const BUILTIN_RUNTIME_CLASSES: Record<string, RuntimeClassSpec>;
+interface SandboxSelectionResult {
+    runtimeClass: string;
+    isolation: RuntimeClassSpec['isolation'];
+    cpuLimitMillis: number;
+    memoryLimitBytes: number;
+    timeLimitMs: number;
+    networkAccess: RuntimeClassSpec['networkAccess'];
+}
+/**
+ * Select the most restrictive RuntimeClass capable of hosting the given
+ * trust class. Throws when no available RuntimeClass supports the trust
+ * class — there is no silent fallback (24.18).
+ */
+declare function selectRuntimeClass(trustClass: ScriptTrustClass, available?: string[]): SandboxSelectionResult;
+/**
+ * Reference to a content-addressed ArtifactRecord holding the script source
+ * (plan 24.15/24.47). Remote deployments never carry raw script source
+ * strings; the target node resolves the artifact by identity and verifies
+ * it against `contentDigest` before loading.
+ */
+interface ScriptArtifactReference {
+    /** API version of the artifact resource (`artifacts.memeloop.io/v1alpha1`). */
+    apiVersion: string;
+    /** Resource kind; always `ArtifactRecord`. */
+    kind: 'ArtifactRecord';
+    /** Artifact resource name. */
+    name: string;
+    /** Artifact namespace, if any. */
+    namespace?: string;
+    /**
+     * Content digest (`sha256:<hex>`) of the NORMALIZED script source. The
+     * remote node must verify the fetched artifact content against this
+     * digest before admission.
+     */
+    contentDigest: string;
+}
+interface RemoteDeploymentRequest {
+    /**
+     * Content-addressed reference to the script artifact. Raw script source
+     * is never transported inside a deployment request.
+     */
+    artifactRef: ScriptArtifactReference;
+    /** Trust class assigned by admission. */
+    trustClass: ScriptTrustClass;
+    /** Desired lifecycle. */
+    lifecycle: 'run-once' | 'service' | 'schedule';
+    /** Runtime class to use. */
+    runtimeClass: string;
+    /** Node selector for scheduling. */
+    nodeSelector?: Record<string, string>;
+    /** Environment variables (never credentials). */
+    env?: Record<string, string>;
+    /** Network attachment requirements enforced before the script starts. */
+    networkPolicy?: AgentWorkloadNetworkPolicy;
+    /** Existing claims to publish before the script starts. */
+    storagePolicy?: AgentWorkloadStoragePolicy;
+}
+interface RemoteDeploymentResult {
+    /** Workload name created on the target node. */
+    workloadName: string;
+    /** Node the workload was placed on. */
+    nodeName: string;
+    /** When the deployment was requested. */
+    requestedAt: string;
+}
+
+/**
+ * Generated-script deployment pipeline (plans 24.14–24.19, 24.47).
+ *
+ * Connects the full security chain for remote/generated scripts:
+ *
+ *   normalizeScript → validateScript (Acorn AST) → admitScript (trust-class
+ *   policy) → ArtifactRecord manifest (content-addressed) → persist via the
+ *   injected artifact store port → selectRuntimeClass →
+ *   RemoteDeploymentRequest (artifactRef only — raw source is never carried).
+ *
+ * Also provides {@link createScriptLoadGate}, the production
+ * {@link ScriptLoadGate} implementation for the in-process script loading
+ * path (`loopAPI/scriptLoader`): validate (AST) → admit → assign
+ * trustClass/RuntimeClass before any `import()` executes.
+ *
+ * Everything here is pure and portable; artifact persistence sits behind the
+ * {@link ScriptArtifactStore} port so the CLI can back it with real storage.
+ */
+
+/**
+ * Port: persists a script ArtifactRecord manifest plus its normalized
+ * content. Implementations (e.g. CLI storage) must store content addressed
+ * by `manifest.spec.contentHash` and must not trust content whose hash does
+ * not match the manifest.
+ */
+interface ScriptArtifactStore {
+    putArtifact(manifest: ArtifactRecordManifest, normalizedContent: string): Promise<void> | void;
+}
+/** Input for {@link deployGeneratedScript}. */
+interface ScriptDeploymentRequest {
+    /** Raw generated `.mjs` source (normalized internally). */
+    source: string;
+    /** Trust class of the author (the Agent that generated the script). */
+    authorTrust: ScriptTrustClass;
+    /** Interfaces the script requests (loop-runtime, model-provider, ...). */
+    requestedInterfaces: string[];
+    /** Desired lifecycle for the remote workload. */
+    lifecycle: 'run-once' | 'service' | 'schedule';
+    /** Node selector for scheduling. */
+    nodeSelector?: Record<string, string>;
+    /** Environment variables (never credentials). */
+    env?: Record<string, string>;
+    /** Network attachment requirements for the deployed workload. */
+    networkPolicy?: AgentWorkloadNetworkPolicy;
+    /** Existing volume claims required by the deployed workload. */
+    storagePolicy?: AgentWorkloadStoragePolicy;
+    /** Optional checkpoint digest the script expects to resume from. */
+    expectedCheckpointDigest?: string;
+    /** API version of the expected checkpoint (plan 24.19). */
+    checkpointApiVersion?: string;
+    /** Namespace for the ArtifactRecord and deployment. */
+    namespace?: string;
+}
+/** Tunables for {@link deployGeneratedScript}. */
+interface ScriptDeploymentPipelineOptions {
+    /** Artifact persistence port; when omitted the manifest is built but not persisted. */
+    artifactStore?: ScriptArtifactStore;
+    /** RuntimeClass names available for selection (defaults to all built-ins). */
+    availableRuntimeClasses?: string[];
+}
+/** Result of {@link deployGeneratedScript}; `deployed` gates artifact/deployment presence. */
+interface ScriptDeploymentResult {
+    /** Whether a deployment request was produced. */
+    deployed: boolean;
+    /** Human-readable outcome (validation/admission/enforcement reason). */
+    reason: string;
+    /** AST validation outcome (always present). */
+    validation: ScriptValidationResult;
+    /** Admission decision (present once validation passed). */
+    admission?: ScriptAdmissionDecision;
+    /** Content-addressed artifact manifest (present when deployed). */
+    artifact?: ArtifactRecordManifest;
+    /** Selected RuntimeClass (present when deployed). */
+    runtimeClass?: SandboxSelectionResult;
+    /** Deployment request referencing the artifact by digest (present when deployed). */
+    deployment?: RemoteDeploymentRequest;
+    /** Applied AgentWorkload (present when deployed through an orchestration facade). */
+    workload?: AgentWorkloadResource;
+}
+interface RemoteDeploymentWorkloadOptions {
+    /** Workload name (defaults to the content-addressed artifact name). */
+    name?: string;
+    namespace?: string;
+    ownerReferences?: OrchestrationOwnerReference[];
+}
+/**
+ * Translate a {@link RemoteDeploymentRequest} into an AgentWorkload manifest
+ * the binding controller (24.56) can schedule. The script declares placement
+ * and lifecycle; the scheduler — never the script — selects the node.
+ */
+declare function remoteDeploymentToWorkloadManifest(deployment: RemoteDeploymentRequest, options?: RemoteDeploymentWorkloadOptions): AgentWorkloadManifest;
+/**
+ * Run the full generated-script security chain and produce a remote
+ * deployment request. Never throws for script-content problems — invalid or
+ * inadmissible scripts yield `deployed: false` with a structured reason.
+ *
+ * Checkpoint compatibility (plan 24.19) is enforced here: when the caller
+ * expects to resume a checkpoint and admission found it incompatible, no
+ * deployment is produced (an explicit converter or restart policy would be
+ * required first).
+ */
+declare function deployGeneratedScript(request: ScriptDeploymentRequest, options?: ScriptDeploymentPipelineOptions): Promise<ScriptDeploymentResult>;
+/** Configuration for {@link createScriptLoadGate}. */
+interface ScriptLoadGateConfig {
+    /** Trust class to assign admitted scripts (plan 24.17). */
+    authorTrust: ScriptTrustClass;
+    /** Interfaces admitted scripts may request. */
+    requestedInterfaces: string[];
+    /** RuntimeClass names available for selection (defaults to all built-ins). */
+    availableRuntimeClasses?: string[];
+    /** Optional checkpoint digest admitted scripts expect to resume from. */
+    expectedCheckpointDigest?: string;
+    /** API version of the expected checkpoint (plan 24.19). */
+    checkpointApiVersion?: string;
+}
+/**
+ * Create the production {@link ScriptLoadGate}: every non-builtin source is
+ * validated (Acorn AST), admitted under the configured trust-class policy,
+ * and assigned a RuntimeClass before the loader is allowed to `import()` it.
+ * The gate verifies that the digest computed by the loader matches the
+ * digest of the source it validated, so the admitted bytes are exactly the
+ * imported bytes.
+ */
+declare function createScriptLoadGate(config: ScriptLoadGateConfig): ScriptLoadGate;
+/**
+ * Host-bound configuration for {@link createScriptDeploymentClient}.
+ * Trust and interface ceilings come from the host, never from the calling
+ * script — a script cannot elevate its own trust class or widen the
+ * interface set beyond what the host configured.
+ */
+interface ScriptDeploymentClientConfig {
+    /** Trust class the host assigns to deployments from this context. */
+    authorTrust: ScriptTrustClass;
+    /**
+     * Interface ceiling for deployments (defaults to the widest set
+     * admissible for `authorTrust`). Scripts may request a narrower subset;
+     * anything wider is rejected by admission.
+     */
+    requestedInterfaces?: string[];
+    /** RuntimeClass names available for selection (defaults to all built-ins). */
+    availableRuntimeClasses?: string[];
+    /** Artifact persistence port; when omitted manifests are built but not persisted. */
+    artifactStore?: ScriptArtifactStore;
+    /** Default namespace for produced ArtifactRecords and deployments. */
+    namespace?: string;
+    /**
+     * Orchestration facade. When present, `deploy` also applies an
+     * AgentWorkload so the scheduler binds a node (plan 24.14); when absent,
+     * `deploy` only produces the deployment request and the readiness/deletion
+     * methods reject with UNSUPPORTED.
+     */
+    orchestration?: AgentOrchestrationClient;
+    /** Field manager for applied workloads (default `memeloop/script-deployment`). */
+    fieldManager?: string;
+}
+/** Request a script makes through the deployment client. */
+interface ScriptDeploymentClientRequest {
+    /** Raw generated `.mjs` source (normalized internally). */
+    source: string;
+    /** Desired lifecycle for the remote workload. */
+    lifecycle: 'run-once' | 'service' | 'schedule';
+    /** Optional narrower interface subset (must stay within the host ceiling). */
+    requestedInterfaces?: string[];
+    /** Node selector for scheduling. */
+    nodeSelector?: Record<string, string>;
+    /** Environment variables (never credentials). */
+    env?: Record<string, string>;
+    /** Network attachment requirements for the deployed workload. */
+    networkPolicy?: AgentWorkloadNetworkPolicy;
+    /** Existing volume claims required by the deployed workload. */
+    storagePolicy?: AgentWorkloadStoragePolicy;
+    /** Optional checkpoint digest the script expects to resume from. */
+    expectedCheckpointDigest?: string;
+    /** API version of the expected checkpoint (plan 24.19). */
+    checkpointApiVersion?: string;
+    /** Namespace override (defaults to the configured namespace). */
+    namespace?: string;
+}
+/** Agent-facing handle for declarative script deployment (plan 24.14). */
+interface ScriptDeploymentClient {
+    /**
+     * Validate, admit, persist, and package a generated script as a
+     * {@link RemoteDeploymentRequest} referencing its ArtifactRecord by
+     * digest. When an orchestration facade is configured, also applies the
+     * AgentWorkload so the scheduler binds a node. Never throws for
+     * script-content problems — inadmissible scripts yield `deployed: false`
+     * with a structured reason.
+     */
+    deploy(request: ScriptDeploymentClientRequest): Promise<ScriptDeploymentResult>;
+    /**
+     * Wait until the scheduler has bound the deployment's workload
+     * (`Scheduled=True` condition written by the binding controller).
+     */
+    waitForScheduled(name: string, options?: WaitForConditionOptions & {
+        namespace?: string;
+    }): Promise<{
+        observedResourceVersion: string;
+        matched: true;
+    }>;
+    /** Delete the deployment's workload. */
+    deleteDeployment(name: string, namespace?: string): Promise<void>;
+}
+/**
+ * Create the Agent-facing deployment client injected into `.mjs` scripts
+ * as `ctx.scriptClient` (plan 24.14). The script declares placement and
+ * lifecycle; trust, interface ceilings, and persistence are bound by the
+ * host. The scheduler — not the script — selects the target node.
+ */
+declare function createScriptDeploymentClient(config: ScriptDeploymentClientConfig): ScriptDeploymentClient;
+
+export { type AgentRunManifest as $, type AgentFrameworkContext as A, type ScriptDeploymentClient as B, type ToolApprovalConfig as C, type ApprovalDecision as D, type ToolApprovalRequest as E, type PromptConcatHookContext as F, type DefineToolAgentFrameworkContext as G, type PostProcessContext as H, type IChatSyncAdapter as I, type AIResponseContext as J, type PromptConcatHooks as K, type LoopPlugin as L, type MemeLoopLogger as M, AGENT_RUN_API_VERSION as N, AGENT_RUN_KIND as O, type PromptConcatTool as P, AGENT_WORKLOAD_API_VERSION as Q, AGENT_WORKLOAD_KIND as R, type ScriptLoadGate as S, type ToolCallingMatch as T, type AIStreamResponseSubset as U, ARTIFACT_RECORD_API_VERSION as V, ARTIFACT_RECORD_KIND as W, AUDIT_RECORD_API_VERSION as X, AUDIT_RECORD_KIND as Y, type AgentResponse as Z, type AgentRunCondition as _, type AgentInstanceModel as a, type ControlStoreVerb as a$, type AgentRunResource as a0, type AgentRunSpec as a1, type AgentRunStatus as a2, type AgentSnapshotManifest as a3, type AgentSnapshotResource as a4, type AgentSnapshotSpec as a5, type AgentSnapshotStatus as a6, type AgentStatusContext as a7, type AgentTrustLevel as a8, type AgentVolumeClaimManifest as a9, type ArtifactRecordStatus as aA, type ArtifactReviewEvidence as aB, type ArtifactReviewKind as aC, type ArtifactTrust as aD, type AuditRecordManifest as aE, type AuditRecordResource as aF, type AuditRecordSpec as aG, BUILTIN_RUNTIME_CLASSES as aH, type BaseToolContext as aI, CREDENTIAL_GRANT_API_VERSION as aJ, CREDENTIAL_GRANT_KIND as aK, type CheckpointRecord as aL, type CheckpointStore as aM, type CheckpointSummary as aN, type ControlLeaseGrant as aO, type ControlLeaseIdentity as aP, type ControlLeaseRequest as aQ, type ControlStore as aR, type ControlStoreActor as aS, type ControlStoreApplyOptions as aT, type ControlStoreAuthorizationRequest as aU, type ControlStoreAuthorizer as aV, type ControlStoreCompactionResult as aW, type ControlStoreCreateOptions as aX, type ControlStoreHealth as aY, type ControlStoreSnapshotResult as aZ, type ControlStoreStatusUpdateOptions as a_, type AgentVolumeClaimResource as aa, type AgentVolumeClaimSpec as ab, type AgentVolumeClaimStatus as ac, type AgentVolumeManifest as ad, type AgentVolumeReplicaStatus as ae, type AgentVolumeResource as af, type AgentVolumeSpec as ag, type AgentVolumeStatus as ah, type AgentWorkloadCompletionPolicy as ai, type AgentWorkloadCondition as aj, type AgentWorkloadCredentialPolicy as ak, type AgentWorkloadManifest as al, type AgentWorkloadModelPolicy as am, type AgentWorkloadNetworkPolicy as an, type AgentWorkloadPlacement as ao, type AgentWorkloadResource as ap, type AgentWorkloadResourceRequirements as aq, type AgentWorkloadSpec as ar, type AgentWorkloadStatus as as, type AgentWorkloadStoragePolicy as at, type AgentWorkloadToolPolicy as au, type AgentWorkloadVolumeClaim as av, type ArtifactDestination as aw, type ArtifactRecordManifest as ax, type ArtifactRecordResource as ay, type ArtifactRecordSpec as az, type AgentInstanceLatestStatus as b, SECURITY_PROFILE_API_VERSION as b$, type CreateAgentRunOptions as b0, type CreateAgentWorkloadOptions as b1, type CredentialGrantManifest as b2, type CredentialGrantResource as b3, type CredentialGrantSpec as b4, type CredentialGrantStatus as b5, DRIVER_MANIFEST_API_VERSION as b6, DRIVER_MANIFEST_KIND as b7, type DataClassification as b8, type DriverManifestConformance as b9, type ModelModality as bA, NETWORK_ATTACHMENT_API_VERSION as bB, NETWORK_ATTACHMENT_KIND as bC, NETWORK_CLASS_API_VERSION as bD, NETWORK_CLASS_KIND as bE, type NetworkAttachmentManifest as bF, type NetworkAttachmentResource as bG, type NetworkAttachmentSpec as bH, type NetworkAttachmentStatus as bI, type NetworkClassManifest as bJ, type NetworkClassResource as bK, type NetworkClassSpec as bL, type NetworkClassStatus as bM, type NetworkEgressRule as bN, type NodeTrustClass as bO, POLICY_DECISION_API_VERSION as bP, POLICY_DECISION_KIND as bQ, type PersistedPolicyDecisionKind as bR, type PolicyDecisionManifest as bS, type PolicyDecisionResource as bT, type PolicyDecisionSpec as bU, type PolicyDecisionStatus as bV, type RemoteDeploymentRequest as bW, type RemoteDeploymentResult as bX, type RemoteDeploymentWorkloadOptions as bY, type RuntimeClassResource as bZ, type RuntimeClassSpec as b_, type DriverManifestManifest as ba, type DriverManifestResource as bb, type DriverManifestSpec as bc, type DriverManifestStatus as bd, type FrameworkPluginToolConfig as be, type HookSlot as bf, type InfrastructureDriverType as bg, MODEL_CALL_RECORD_API_VERSION as bh, MODEL_CALL_RECORD_KIND as bi, MODEL_CLASS_API_VERSION as bj, MODEL_CLASS_KIND as bk, MODEL_ENDPOINT_API_VERSION as bl, MODEL_ENDPOINT_KIND as bm, type ModelCallRecordManifest as bn, type ModelCallRecordResource as bo, type ModelCallRecordSpec as bp, type ModelCallRecordStatus as bq, type ModelClassCapabilities as br, type ModelClassManifest as bs, type ModelClassResource as bt, type ModelClassSpec as bu, type ModelClassStatus as bv, type ModelEndpointManifest as bw, type ModelEndpointResource as bx, type ModelEndpointSpec as by, type ModelEndpointStatus as bz, type AgentInstanceState as c, VOLUME_CLAIM_KIND as c$, SECURITY_PROFILE_KIND as c0, SNAPSHOT_API_VERSION as c1, SNAPSHOT_KIND as c2, STORAGE_CLASS_API_VERSION as c3, STORAGE_CLASS_KIND as c4, type SandboxSelectionResult as c5, type ScriptAdmissionDecision as c6, type ScriptAdmissionRequest as c7, type ScriptArtifactReference as c8, type ScriptArtifactStore as c9, type ToolAdmissionPolicy as cA, type ToolAdmissionRule as cB, type ToolApprovalMode as cC, type ToolClassManifest as cD, type ToolClassResource as cE, type ToolClassSchema as cF, type ToolClassSpec as cG, type ToolClassStatus as cH, type ToolExecutionContext as cI, type ToolExecutorCapability as cJ, type ToolExecutorManifest as cK, type ToolExecutorResource as cL, type ToolExecutorSpec as cM, type ToolExecutorStatus as cN, type ToolOperationApprovalEvidence as cO, type ToolOperationManifest as cP, type ToolOperationPolicy as cQ, type ToolOperationResource as cR, type ToolOperationResult as cS, type ToolOperationRetryPolicy as cT, type ToolOperationSpec as cU, type ToolOperationStatus as cV, type ToolOperationToolReference as cW, type ToolRiskLevel as cX, type UserMessageContext as cY, VOLUME_API_VERSION as cZ, VOLUME_CLAIM_API_VERSION as c_, type ScriptDeploymentClientConfig as ca, type ScriptDeploymentClientRequest as cb, type ScriptDeploymentPipelineOptions as cc, type ScriptDeploymentRequest as cd, type ScriptDeploymentResult as ce, type ScriptLoadGateConfig as cf, type ScriptTrustClass as cg, type ScriptValidationResult as ch, type SecurityProfileManifest as ci, type SecurityProfileResource as cj, type SecurityProfileSpec as ck, type SecurityProfileStatus as cl, SessionStorage as cm, type StorageClassManifest as cn, type StorageClassResource as co, type StorageClassSpec as cp, type StorageClassStatus as cq, TOOL_CLASS_API_VERSION as cr, TOOL_CLASS_KIND as cs, TOOL_EXECUTOR_API_VERSION as ct, TOOL_EXECUTOR_KIND as cu, TOOL_OPERATION_API_VERSION as cv, TOOL_OPERATION_KIND as cw, type TapAsyncHandler as cx, type ToolActions as cy, type ToolAdmissionAction as cz, type AgentLoopDefinition as d, serializeCheckpointRecord as d$, VOLUME_KIND as d0, type VolumeAccessMode as d1, type WaitForConditionOptions as d2, type YieldNextRoundTarget as d3, admitScript as d4, agentRunReference as d5, agentWorkloadReference as d6, canonicalControlStoreValue as d7, controlStoreApplyMatches as d8, createAgentClient as d9, digestNormalizedScript as dA, isAgentRun as dB, isAgentWorkload as dC, isArtifactRecord as dD, isAuditRecord as dE, isCredentialGrant as dF, isDriverManifest as dG, isDriverManifestAdmitted as dH, isModelCallRecord as dI, isModelClass as dJ, isModelEndpoint as dK, isNetworkAttachment as dL, isNetworkClass as dM, isPolicyDecision as dN, isSecurityProfile as dO, isSnapshot as dP, isStorageClass as dQ, isToolClass as dR, isToolExecutor as dS, isToolOperation as dT, isVolume as dU, isVolumeClaim as dV, maxScriptBytesForTrustClass as dW, normalizeScript as dX, parseCheckpointRecord as dY, remoteDeploymentToWorkloadManifest as dZ, selectRuntimeClass as d_, createAgentRunManifest as da, createAgentWorkloadManifest as db, createArtifactRecordManifest as dc, createAuditRecordManifest as dd, createCheckpointRecord as de, createCredentialGrantManifest as df, createDriverManifestManifest as dg, createModelCallRecordManifest as dh, createModelClassManifest as di, createModelEndpointManifest as dj, createNetworkAttachmentManifest as dk, createNetworkClassManifest as dl, createPolicyDecisionManifest as dm, createScriptDeploymentClient as dn, createScriptLoadGate as dp, createSecurityProfileManifest as dq, createSnapshotManifest as dr, createStorageClassManifest as ds, createToolClassManifest as dt, createToolExecutorManifest as du, createToolOperationManifest as dv, createVolumeClaimManifest as dw, createVolumeManifest as dx, defaultRequestedInterfacesForTrustClass as dy, deployGeneratedScript as dz, type AgentLoopGenerator as e, validateScript as e0, waitForCondition as e1, InMemoryCheckpointStore as e2, type SessionStorageOptions as e3, type AgentLoopInput as f, type AgentLoopRuntime as g, type AgentLoopScriptPolicy as h, type AgentLoopStep as i, type AgentToolLoopOptions as j, type ILLMProvider as k, type INetworkService as l, type IToolRegistry as m, type LoopProfile as n, type LoopProfilePluginEntry as o, type LoopProfilePrompt as p, type LoopProfileScriptReference as q, type LoopScriptCheckpointStore as r, type ScriptLoadGateDecision as s, type ScriptLoadGateRequest as t, createInstanceDeltaFromDefinition as u, isUserInitiatedConversation as v, matchAllToolCallings as w, matchToolCalling as x, type ToolOperationEffect as y, type AgentClient as z };