memeloop 0.0.1 → 0.1.1

package/dist/scriptDeploymentPipeline-yG1ZhVVI.d.cts

@@ -0,0 +1,2464 @@
+import { u as OrchestrationResourceManifest, v as OrchestrationOwnerReference, w as OrchestrationTypeMeta, x as OrchestrationObjectMetadata, y as OrchestrationResourceStatus, O as OrchestrationErrorData, t as AgentOrchestrationClient, z as OrchestrationResourceReference, B as OrchestrationGetOptions, E as OrchestrationResource, F as OrchestrationResourceQuery, J as OrchestrationListOptions, K as OrchestrationResourceList, N as OrchestrationWatchOptions, P as OrchestrationWatchEvent, Q as OrchestrationDeleteOptions, R as OrchestrationDeleteResult, b as ChatMessage, S as AgentFrameworkConfig, r as AiAPIConfig, U as IPrompt, I as IAgentStorage, m as AgentDefinition, C as ConversationMeta } from './interface-IrKBFtL1.cjs';
+
+declare const AGENT_WORKLOAD_API_VERSION = "workload.memeloop.io/v1alpha1";
+declare const AGENT_WORKLOAD_KIND = "AgentWorkload";
+declare const AGENT_RUN_API_VERSION = "run.memeloop.io/v1alpha1";
+declare const AGENT_RUN_KIND = "AgentRun";
+/**
+ * Host-asserted trust classification of a node or workload. The trust class
+ * is bound by the host; it is never self-reported by the workload, the model,
+ * or a `.mjs` script.
+ */
+type NodeTrustClass = 'trusted' | 'restricted' | 'quarantine';
+type AgentTrustLevel = NodeTrustClass;
+/** Ordered data classifications; higher ranks are more sensitive. */
+type DataClassification = 'public' | 'internal' | 'confidential' | 'restricted';
+type ToolAdmissionAction = 'allow' | 'deny' | 'require-approval';
+/**
+ * Declarative trusted-admission rule. Rules are evaluated in order; the first
+ * matching rule wins (firewall semantics). A rule matches when `toolPattern`
+ * matches the tool reference name and either `effects` is omitted (all
+ * effects) or contains the operation effect.
+ */
+interface ToolAdmissionRule {
+    toolPattern: string;
+    effects?: ToolOperationEffect[];
+    action: ToolAdmissionAction;
+    reason?: string;
+}
+interface ToolAdmissionPolicy {
+    /** Applied when no rule matches. Restricted/quarantine profiles resolve to `deny` regardless of this field. */
+    defaultAction: ToolAdmissionAction;
+    rules?: ToolAdmissionRule[];
+}
+interface AgentWorkloadModelPolicy {
+    modelClass?: string;
+    allowedModelNames?: string[];
+    budget?: {
+        maxTokens?: number;
+        maxCost?: number;
+    };
+}
+interface AgentWorkloadToolPolicy {
+    allowedToolClasses?: string[];
+    /** Tool classes that must have a healthy executor on the selected node. */
+    requiredToolClasses?: string[];
+    allowedToolIds?: string[];
+    defaultAction?: 'allow' | 'ask' | 'deny';
+    rules?: Array<{
+        pattern: string;
+        action: 'allow' | 'ask' | 'deny';
+    }>;
+}
+interface AgentWorkloadNetworkPolicy {
+    networkClass?: string;
+    egress?: 'none' | 'same-node' | 'restricted' | 'open';
+    /** Minimum boundary that must enforce this policy before the workload binds. */
+    minimumEnforcement?: 'none' | 'process' | 'namespace' | 'host' | 'external';
+}
+interface AgentWorkloadVolumeClaim {
+    name: string;
+    claimRef: string;
+}
+interface AgentWorkloadStoragePolicy {
+    storageClass?: string;
+    volumes?: AgentWorkloadVolumeClaim[];
+}
+interface AgentWorkloadCredentialPolicy {
+    /** Credential broker class required on the selected node. */
+    brokerClass?: string;
+    /** Audiences for which the node must be able to request scoped grants. */
+    audiences?: string[];
+    /** Target classes for which scoped grants may be issued. */
+    targets?: string[];
+}
+interface AgentWorkloadResourceRequirements {
+    cpuMillicores?: number;
+    memoryBytes?: number;
+    gpuCount?: number;
+    diskBytes?: number;
+    bandwidthKbps?: number;
+}
+interface AgentWorkloadPlacement {
+    /**
+     * Registered external-orchestrator driver name. When set, the external
+     * orchestration controller owns placement and the local node binder skips
+     * this workload. External placement is always explicit; there is no silent
+     * spillover from the local runtime.
+     */
+    orchestrator?: string;
+    nodeSelector?: Record<string, string>;
+    requiredNode?: string;
+    antiAffinity?: string[];
+    /** Soft co-location preference; never overrides a hard security filter. */
+    preferredNode?: string;
+    /** Taints the workload tolerates. Nodes with taints not listed here are filtered out. */
+    tolerations?: string[];
+    /**
+     * Maximum data classification the workload may carry. Nodes with a lower
+     * `maxDataClassification` than the workload's effective classification are
+     * filtered out. Quarantine nodes are always treated as `public`-only.
+     */
+    dataClassification?: DataClassification;
+    /** Allowed residency labels (for example `local`, `cn`, or `eu-west`). */
+    dataResidency?: string[];
+    /** Require a currently verified node attestation. */
+    requireAttestation?: boolean;
+    /** Fleet batch constraints enforced before a target binds. */
+    rollout?: {
+        batchId: string;
+        excludedFaultDomains?: string[];
+        maxConcurrentPerFaultDomain?: number;
+    };
+}
+type AgentWorkloadCompletionPolicy = 'complete' | 'detach' | 'daemon';
+interface AgentWorkloadSpec {
+    profileId?: string;
+    scriptReference?: string;
+    promptReference?: string;
+    trust?: AgentTrustLevel;
+    /** RuntimeClass selected for script workloads (plan 24.18); declarative only. */
+    runtimeClass?: string;
+    /**
+     * Non-secret environment variables for the workload (plan 24.14 `env`).
+     * Secret-shaped values are rejected at admission (deployGeneratedScript)
+     * and stripped again at launch (plan 24.35), so specs persisted in the
+     * ControlStore never carry provider keys.
+     */
+    env?: Record<string, string>;
+    /** Name of a SecurityProfile resource governing admission and model access. */
+    securityProfileRef?: string;
+    placement?: AgentWorkloadPlacement;
+    modelPolicy?: AgentWorkloadModelPolicy;
+    toolPolicy?: AgentWorkloadToolPolicy;
+    networkPolicy?: AgentWorkloadNetworkPolicy;
+    storagePolicy?: AgentWorkloadStoragePolicy;
+    credentialPolicy?: AgentWorkloadCredentialPolicy;
+    resources?: AgentWorkloadResourceRequirements;
+    /** Content-addressed artifacts whose locality may influence placement. */
+    artifactReferences?: string[];
+    /** Durable checkpoint whose locality may influence placement. */
+    checkpointReference?: string;
+    completionPolicy?: AgentWorkloadCompletionPolicy;
+    ownerReferences?: OrchestrationOwnerReference[];
+}
+interface AgentWorkloadStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Scheduling' | 'Running' | 'Completed' | 'Failed';
+    /** Node the binding controller scheduled this workload onto. */
+    assignedNode?: string;
+    /** Durable trusted policy decision that authorized the current binding. */
+    placementDecisionRef?: string;
+    /** Policy snapshot digest bound to placementDecisionRef. */
+    placementPolicyDigest?: string;
+    /** External driver selected for this workload, when any. */
+    assignedDriver?: string;
+    /** Opaque native workload identifier returned by the external driver. */
+    externalId?: string;
+    /** Non-secret, string-only backend metadata used for diagnostics/adoption. */
+    externalMetadata?: Record<string, string>;
+    runs?: Array<{
+        apiVersion: string;
+        kind: string;
+        name?: string;
+        namespace?: string;
+        uid?: string;
+    }>;
+    lastRunResult?: string;
+}
+interface AgentWorkloadCondition {
+    type: string;
+    status: 'True' | 'False' | 'Unknown';
+}
+type AgentWorkloadManifest = OrchestrationResourceManifest<AgentWorkloadSpec>;
+interface AgentWorkloadResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: AgentWorkloadSpec;
+    status?: AgentWorkloadStatus;
+}
+interface AgentRunSpec {
+    workloadRef: {
+        apiVersion: string;
+        kind: string;
+        name?: string;
+        namespace?: string;
+        uid?: string;
+    };
+    promptReference?: string;
+    retry?: number;
+    timeoutMs?: number;
+}
+interface AgentRunStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Starting' | 'Running' | 'Completed' | 'Failed' | 'Cancelled';
+    /**
+     * Durable claim written before invoking a LoopRuntimeDriver. A different
+     * daemon instance that observes Starting/Running must adopt through a
+     * managed driver or fail UNKNOWN_EFFECT; it must never blindly start again.
+     */
+    runtimeExecutionClaim?: {
+        controllerInstanceId: string;
+        claimedAt: string;
+    };
+    /** Independently selected serving endpoint for this run's model calls. */
+    assignedModelEndpoint?: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        namespace?: string;
+        uid: string;
+    };
+    /** Fences the model binding decision to the controller leadership epoch. */
+    modelBinding?: {
+        leaseEpoch: string;
+        endpointResourceVersion: string;
+        boundAt: string;
+    };
+    /** NetworkAttachment that must reach Attached before this run starts. */
+    networkAttachmentRef?: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        namespace?: string;
+        uid: string;
+    };
+    volumePhase?: 'Pending' | 'Publishing' | 'Ready' | 'Releasing' | 'Released' | 'Failed';
+    volumePublishClaim?: {
+        leaseEpoch: string;
+        claimedAt: string;
+    };
+    volumeBindings?: Array<{
+        name: string;
+        claimRef: {
+            name: string;
+            uid: string;
+        };
+        volumeRef: {
+            name: string;
+            uid: string;
+        };
+        assignedDriver: string;
+        assignedNode: string;
+        /** Managed node-stage handle used for ordered publish cleanup. */
+        stageHandle?: string;
+        publishHandle: string;
+        readOnly: boolean;
+    }>;
+    volumeReleaseRequestedAt?: string;
+    volumeError?: OrchestrationErrorData;
+    outputReference?: string;
+    summary?: string;
+    exitCode?: number;
+}
+interface AgentRunCondition {
+    type: string;
+    status: 'True' | 'False' | 'Unknown';
+}
+type AgentRunManifest = OrchestrationResourceManifest<AgentRunSpec>;
+interface AgentRunResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: AgentRunSpec;
+    status?: AgentRunStatus;
+}
+declare function createAgentWorkloadManifest(name: string, spec: AgentWorkloadSpec): AgentWorkloadManifest;
+declare function createAgentRunManifest(name: string, spec: AgentRunSpec): AgentRunManifest;
+declare function isAgentWorkload(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is AgentWorkloadResource;
+declare function isAgentRun(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is AgentRunResource;
+declare function agentWorkloadReference(name: string, namespace?: string): {
+    apiVersion: string;
+    kind: string;
+    name: string;
+    namespace?: string;
+};
+declare const TOOL_OPERATION_API_VERSION = "execution.memeloop.io/v1alpha1";
+declare const TOOL_OPERATION_KIND = "ToolOperation";
+type ToolOperationEffect = 'read' | 'create' | 'update' | 'delete' | 'execute' | 'unknown';
+interface ToolOperationToolReference {
+    apiVersion?: string;
+    kind: string;
+    name: string;
+    namespace?: string;
+    /** Expected input/output schema digest; executors with another digest are rejected. */
+    schemaDigest?: string;
+}
+interface ToolOperationRetryPolicy {
+    maxAttempts?: number;
+    nonRetryable?: boolean;
+    fencingToken?: string;
+}
+interface ToolOperationPolicy {
+    requireApproval?: boolean;
+    auditLevel?: 'none' | 'metadata' | 'payload';
+}
+interface ToolOperationSpec {
+    toolRef: ToolOperationToolReference;
+    arguments?: Record<string, unknown>;
+    effect: ToolOperationEffect;
+    idempotencyKey?: string;
+    timeoutMs?: number;
+    retry?: ToolOperationRetryPolicy;
+    policy?: ToolOperationPolicy;
+    /** Explicit registered external-orchestrator driver selection. */
+    placement?: {
+        orchestrator?: string;
+        requiredNode?: string;
+        preferredNode?: string;
+        nodeSelector?: Record<string, string>;
+        minimumTrust?: NodeTrustClass;
+    };
+}
+interface ToolOperationResult {
+    value?: unknown;
+    error?: OrchestrationErrorData;
+    evidenceRef?: string;
+}
+interface ToolOperationApprovalEvidence {
+    approvalId: string;
+    decision: 'allow' | 'deny';
+    /** Trusted human/service identity. Model-provided identities are invalid. */
+    actor: string;
+    decidedAt: string;
+    reason?: string;
+}
+interface ToolOperationStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Running' | 'Completed' | 'Failed' | 'Cancelled';
+    result?: ToolOperationResult;
+    attempts?: number;
+    startedAt?: string;
+    completedAt?: string;
+    /** Trusted approval evidence returned by the host-bound approval driver. */
+    approval?: ToolOperationApprovalEvidence;
+    assignedDriver?: string;
+    assignedNode?: string;
+    assignedExecutor?: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        namespace?: string;
+        uid?: string;
+    };
+    /**
+     * Durable claim written before a local effect starts. A different fencing
+     * epoch observing Running must reconcile unknown effect instead of blindly
+     * repeating the operation.
+     */
+    executionClaim?: {
+        leaseEpoch: string;
+        claimedAt: string;
+    };
+    externalId?: string;
+    externalMetadata?: Record<string, string>;
+}
+type ToolOperationManifest = OrchestrationResourceManifest<ToolOperationSpec>;
+interface ToolOperationResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: ToolOperationSpec;
+    status?: ToolOperationStatus;
+}
+declare function createToolOperationManifest(name: string, spec: ToolOperationSpec): ToolOperationManifest;
+declare function isToolOperation(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is ToolOperationResource;
+declare function agentRunReference(name: string, namespace?: string): {
+    apiVersion: string;
+    kind: string;
+    name: string;
+    namespace?: string;
+};
+declare const TOOL_CLASS_API_VERSION = "tool.memeloop.io/v1alpha1";
+declare const TOOL_CLASS_KIND = "ToolClass";
+declare const TOOL_EXECUTOR_API_VERSION = "tool.memeloop.io/v1alpha1";
+declare const TOOL_EXECUTOR_KIND = "ToolExecutor";
+type ToolRiskLevel = 'none' | 'low' | 'medium' | 'high' | 'critical';
+interface ToolClassSchema {
+    input: Record<string, unknown>;
+    output?: Record<string, unknown>;
+    required?: string[];
+}
+interface ToolClassSpec {
+    description?: string;
+    version?: string;
+    schema: ToolClassSchema;
+    schemaDigest?: string;
+    risk?: ToolRiskLevel;
+    effects?: ToolOperationEffect[];
+    allowedTargets?: string[];
+    categories?: string[];
+}
+interface ToolClassStatus extends OrchestrationResourceStatus {
+    endpointCount?: number;
+    healthyEndpointCount?: number;
+}
+type ToolClassManifest = OrchestrationResourceManifest<ToolClassSpec>;
+interface ToolClassResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: ToolClassSpec;
+    status?: ToolClassStatus;
+}
+interface ToolExecutorCapability {
+    toolClassRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    schemaDigest: string;
+    effects?: ToolOperationEffect[];
+    endpoint: string;
+    capacity?: {
+        maxConcurrent?: number;
+        queueDepth?: number;
+    };
+    health?: {
+        lastHeartbeat?: string;
+        healthy: boolean;
+    };
+}
+interface ToolExecutorSpec {
+    nodeId?: string;
+    selectors?: Record<string, string>;
+    capabilities: ToolExecutorCapability[];
+    trust?: 'trusted' | 'restricted' | 'quarantine';
+}
+interface ToolExecutorStatus extends OrchestrationResourceStatus {
+    heartbeat?: string;
+    healthy?: boolean;
+}
+type ToolExecutorManifest = OrchestrationResourceManifest<ToolExecutorSpec>;
+interface ToolExecutorResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: ToolExecutorSpec;
+    status?: ToolExecutorStatus;
+}
+declare function createToolClassManifest(name: string, spec: ToolClassSpec): ToolClassManifest;
+declare function createToolExecutorManifest(name: string, spec: ToolExecutorSpec): ToolExecutorManifest;
+declare function isToolClass(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is ToolClassResource;
+declare function isToolExecutor(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is ToolExecutorResource;
+declare const MODEL_CLASS_API_VERSION = "models.memeloop.io/v1alpha1";
+declare const MODEL_CLASS_KIND = "ModelClass";
+declare const MODEL_ENDPOINT_API_VERSION = "models.memeloop.io/v1alpha1";
+declare const MODEL_ENDPOINT_KIND = "ModelEndpoint";
+declare const MODEL_CALL_RECORD_API_VERSION = "models.memeloop.io/v1alpha1";
+declare const MODEL_CALL_RECORD_KIND = "ModelCallRecord";
+type ModelModality = 'text' | 'vision' | 'audio' | 'embedding';
+interface ModelClassCapabilities {
+    streaming?: boolean;
+    toolUse?: boolean;
+    jsonMode?: boolean;
+    systemPrompt?: boolean;
+}
+/**
+ * Declarative model catalog entry. Carries identity, digest, capabilities,
+ * residency, and cost metadata only — raw provider SDK clients, base URLs with
+ * embedded credentials, and API keys must never appear here.
+ */
+interface ModelClassSpec {
+    description?: string;
+    /** Provider family identifier, e.g. `openai`, `anthropic`, `ollama`. */
+    provider: string;
+    /** Provider model name, e.g. `gpt-4o-mini`, `qwen2.5:7b`. */
+    model: string;
+    version?: string;
+    /** Content digest: local weights hash or provider snapshot identifier. */
+    digest?: string;
+    modalities?: ModelModality[];
+    contextWindow?: number;
+    maxOutputTokens?: number;
+    capabilities?: ModelClassCapabilities;
+    /** `local`, `cloud`, or a region/zone label constraining data residency. */
+    dataResidency?: string;
+    cost?: {
+        inputPerMillion?: number;
+        outputPerMillion?: number;
+        currency?: string;
+    };
+}
+interface ModelClassStatus extends OrchestrationResourceStatus {
+    endpointCount?: number;
+    healthyEndpointCount?: number;
+}
+type ModelClassManifest = OrchestrationResourceManifest<ModelClassSpec>;
+interface ModelClassResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: ModelClassSpec;
+    status?: ModelClassStatus;
+}
+/**
+ * Schedulable model serving endpoint. The endpoint string is an opaque driver
+ * handle (e.g. `ollama://node-1/qwen2.5:7b` or `gateway://default`) and must
+ * not embed credentials.
+ */
+interface ModelEndpointSpec {
+    modelClassRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    /** Must match the referenced ModelClass digest for schedulability. */
+    modelDigest?: string;
+    nodeId?: string;
+    trust?: 'trusted' | 'restricted' | 'quarantine';
+    endpoint: string;
+    capacity?: {
+        maxConcurrent?: number;
+        tokensPerMinute?: number;
+    };
+    dataPolicy?: {
+        classification?: string;
+        retention?: string;
+    };
+}
+interface ModelEndpointStatus extends OrchestrationResourceStatus {
+    healthy?: boolean;
+    heartbeat?: string;
+    activeCalls?: number;
+}
+type ModelEndpointManifest = OrchestrationResourceManifest<ModelEndpointSpec>;
+interface ModelEndpointResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: ModelEndpointSpec;
+    status?: ModelEndpointStatus;
+}
+/**
+ * Audit and usage record for a single model call. Records carry usage and
+ * classification metadata, never raw prompts, completions, or credentials.
+ */
+interface ModelCallRecordSpec {
+    modelClassRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    /** Immutable model artifact/provider snapshot selected for this call. */
+    modelDigest?: string;
+    endpointRef?: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    runRef?: OrchestrationOwnerReference;
+    /** Immutable attempt number from the authorizing ModelAccessHandle. */
+    runAttempt?: number;
+    /** Bound actor identity asserted by the host, not self-reported. */
+    caller?: string;
+    /** Name of the ModelAccessHandle authorizing this call. */
+    accessHandleRef?: string;
+    /** Admission/policy snapshot bound into the authorizing handle. */
+    policyDigest?: string;
+    inputClassification?: string;
+    outputClassification?: string;
+}
+interface ModelCallRecordStatus extends OrchestrationResourceStatus {
+    phase?: 'Running' | 'Completed' | 'Failed' | 'Cancelled';
+    usage?: {
+        inputTokens?: number;
+        outputTokens?: number;
+        cost?: number;
+        currency?: string;
+    };
+    latencyMs?: number;
+    startedAt?: string;
+    completedAt?: string;
+    error?: OrchestrationErrorData;
+}
+type ModelCallRecordManifest = OrchestrationResourceManifest<ModelCallRecordSpec>;
+interface ModelCallRecordResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: ModelCallRecordSpec;
+    status?: ModelCallRecordStatus;
+}
+declare function createModelClassManifest(name: string, spec: ModelClassSpec): ModelClassManifest;
+declare function createModelEndpointManifest(name: string, spec: ModelEndpointSpec): ModelEndpointManifest;
+declare function createModelCallRecordManifest(name: string, spec: ModelCallRecordSpec): ModelCallRecordManifest;
+declare function isModelClass(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is ModelClassResource;
+declare function isModelEndpoint(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is ModelEndpointResource;
+declare function isModelCallRecord(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is ModelCallRecordResource;
+declare const SECURITY_PROFILE_API_VERSION = "security.memeloop.io/v1alpha1";
+declare const SECURITY_PROFILE_KIND = "SecurityProfile";
+/**
+ * Reusable security posture referenced by workloads. The profile is applied
+ * by trusted admission, never by the workload itself: for restricted and
+ * quarantine trust classes the resolved tool-admission default is forced to
+ * `deny` regardless of `toolAdmission.defaultAction`.
+ */
+interface SecurityProfileSpec {
+    description?: string;
+    /** Trust class this profile applies to. */
+    trustClass: NodeTrustClass;
+    /** Tool admission overlay merged over the trust-class default policy. */
+    toolAdmission?: ToolAdmissionPolicy;
+    /** Model access constraints for workloads under this profile. */
+    modelPolicy?: {
+        allowedModelClasses?: string[];
+        maxInputClassification?: DataClassification;
+    };
+}
+interface SecurityProfileStatus extends OrchestrationResourceStatus {
+    /** Number of workloads currently referencing this profile. */
+    workloadCount?: number;
+}
+type SecurityProfileManifest = OrchestrationResourceManifest<SecurityProfileSpec>;
+interface SecurityProfileResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: SecurityProfileSpec;
+    status?: SecurityProfileStatus;
+}
+declare function createSecurityProfileManifest(name: string, spec: SecurityProfileSpec): SecurityProfileManifest;
+declare function isSecurityProfile(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is SecurityProfileResource;
+declare const POLICY_DECISION_API_VERSION = "security.memeloop.io/v1alpha1";
+declare const POLICY_DECISION_KIND = "PolicyDecision";
+type PersistedPolicyDecisionKind = 'resource-admission' | 'placement' | 'tool-operation' | 'approval' | 'transition';
+/** Immutable decision evidence; only a pending approval's status may resolve. */
+interface PolicyDecisionSpec {
+    subjectRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        namespace?: string;
+        uid: string;
+        generation: number;
+    };
+    decisionKind: PersistedPolicyDecisionKind;
+    policyDigest: string;
+    inputDigest: string;
+    requestFingerprint: string;
+    idempotencyKey: string;
+    fencingEpoch: number;
+    requestedBy: string;
+    reasons: string[];
+    obligations: string[];
+    decidedAt: string;
+    initialOutcome: 'allow' | 'deny' | 'pending';
+    approval?: {
+        subjectDigest: string;
+        requestedBy: string;
+        requestedAt: string;
+        expiresAt: string;
+    };
+}
+interface PolicyDecisionStatus extends OrchestrationResourceStatus {
+    outcome: 'allow' | 'deny' | 'pending';
+    decidedBy: string;
+    decidedAt: string;
+    reasons: string[];
+    resolutionInputDigest?: string;
+}
+type PolicyDecisionManifest = OrchestrationResourceManifest<PolicyDecisionSpec>;
+interface PolicyDecisionResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: PolicyDecisionSpec;
+    status?: PolicyDecisionStatus;
+}
+declare function createPolicyDecisionManifest(name: string, spec: PolicyDecisionSpec): PolicyDecisionManifest;
+declare function isPolicyDecision(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is PolicyDecisionResource;
+declare const AUDIT_RECORD_API_VERSION = "audit.memeloop.io/v1alpha1";
+declare const AUDIT_RECORD_KIND = "AuditRecord";
+/**
+ * Immutable, metadata-only audit/telemetry evidence. The record digest covers
+ * every field except itself and links to the preceding record in the named
+ * stream. Raw request/response bodies and credentials have no representation.
+ */
+interface AuditRecordSpec {
+    stream: string;
+    sequence: number;
+    resourceUid: string;
+    recordKind: 'audit' | 'event' | 'metric' | 'trace';
+    receivedAt: string;
+    actor: {
+        id: string;
+        kind: 'controller' | 'verifier' | 'admin';
+    };
+    policyDigest: string;
+    capabilityDigest: string;
+    effect: 'read' | 'create' | 'update' | 'delete' | 'execute' | 'decision' | 'security';
+    provenance: {
+        source: 'controller' | 'gateway' | 'driver' | 'worker' | 'operator';
+        producer: string;
+        subject?: string;
+    };
+    attributes: Record<string, string>;
+    data: {
+        kind: 'audit';
+        action: string;
+        outcome: 'success' | 'denied' | 'failure';
+        reasonCode?: string;
+    } | {
+        kind: 'event';
+        name: string;
+        severity: 'debug' | 'info' | 'warning' | 'error' | 'critical';
+    } | {
+        kind: 'metric';
+        name: string;
+        value: number;
+        unit: string;
+    } | {
+        kind: 'trace';
+        name: string;
+        traceId: string;
+        spanId: string;
+        durationMs: number;
+        status: 'ok' | 'error';
+    };
+    previousDigest?: string;
+    recordDigest: string;
+    requestFingerprint: string;
+    idempotencyDigest: string;
+    fencingEpoch: number;
+}
+type AuditRecordManifest = OrchestrationResourceManifest<AuditRecordSpec>;
+interface AuditRecordResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: AuditRecordSpec;
+    status?: OrchestrationResourceStatus;
+}
+declare function createAuditRecordManifest(name: string, spec: AuditRecordSpec): AuditRecordManifest;
+declare function isAuditRecord(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is AuditRecordResource;
+declare const NETWORK_CLASS_API_VERSION = "network.memeloop.io/v1alpha1";
+declare const NETWORK_CLASS_KIND = "NetworkClass";
+declare const NETWORK_ATTACHMENT_API_VERSION = "network.memeloop.io/v1alpha1";
+declare const NETWORK_ATTACHMENT_KIND = "NetworkAttachment";
+interface NetworkEgressRule {
+    /** Host, domain suffix, or CIDR, e.g. `api.openai.com` or `10.0.0.0/8`. */
+    target: string;
+    ports?: number[];
+    protocol?: 'tcp' | 'udp' | 'http' | 'https' | 'any';
+    action: 'allow' | 'deny';
+}
+/**
+ * CNI-like network desired state. `enforcement: required` means the workload
+ * must not start unless the driver can enforce every configured feature;
+ * `best-effort` allows partial enforcement with recorded degradation.
+ */
+interface NetworkClassSpec {
+    description?: string;
+    /** NetworkDriver name responsible for this class. */
+    driver: string;
+    dns?: {
+        policy?: 'default' | 'none' | 'custom';
+        servers?: string[];
+        searchDomains?: string[];
+    };
+    proxy?: {
+        httpProxy?: string;
+        httpsProxy?: string;
+        noProxy?: string[];
+        /** When true, traffic bypassing the proxy must be blocked. */
+        mandatory?: boolean;
+    };
+    ingress?: {
+        defaultAction?: 'allow' | 'deny';
+        allow?: Array<{
+            from?: string;
+            ports?: number[];
+        }>;
+    };
+    egress?: {
+        defaultAction: 'allow' | 'deny';
+        rules?: NetworkEgressRule[];
+    };
+    serviceAccess?: {
+        allowControlPlane?: boolean;
+        allowClusterServices?: boolean;
+        allowModelGateway?: boolean;
+    };
+    bandwidth?: {
+        ingressKbps?: number;
+        egressKbps?: number;
+    };
+    dataPolicy?: {
+        classification?: DataClassification;
+        retention?: string;
+    };
+    enforcement: 'required' | 'best-effort';
+}
+interface NetworkClassStatus extends OrchestrationResourceStatus {
+    attachmentCount?: number;
+}
+type NetworkClassManifest = OrchestrationResourceManifest<NetworkClassSpec>;
+interface NetworkClassResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: NetworkClassSpec;
+    status?: NetworkClassStatus;
+}
+interface NetworkAttachmentSpec {
+    networkClassRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    workloadRef?: OrchestrationOwnerReference;
+    /** Exact AgentRun whose sandbox and authority this attachment belongs to. */
+    runRef?: OrchestrationOwnerReference;
+    nodeId?: string;
+}
+interface NetworkAttachmentStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Preparing' | 'Attached' | 'Failed' | 'Detached';
+    /** Node and driver selected independently from workload execution. */
+    assignedNode?: string;
+    assignedDriver?: string;
+    /** Fences the placement decision and the NetworkClass version it validated. */
+    binding?: {
+        leaseEpoch: string;
+        networkClassResourceVersion: string;
+        boundAt: string;
+    };
+    /**
+     * Durable claim written before prepare() may create host-side state.
+     * A new lease epoch must not blindly repeat an unconfirmed prepare.
+     */
+    executionClaim?: {
+        leaseEpoch: string;
+        claimedAt: string;
+    };
+    /** Opaque driver handle; consumers must never parse it. */
+    handle?: string;
+    addresses?: string[];
+    routes?: string[];
+    dns?: {
+        servers?: string[];
+    };
+    /** Features the driver could not enforce under a best-effort class. */
+    degraded?: string[];
+    attachedAt?: string;
+    /** Set by the workload owner after execution; the node driver must release before Detached. */
+    releaseRequestedAt?: string;
+    detachedAt?: string;
+    error?: OrchestrationErrorData;
+}
+type NetworkAttachmentManifest = OrchestrationResourceManifest<NetworkAttachmentSpec>;
+interface NetworkAttachmentResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: NetworkAttachmentSpec;
+    status?: NetworkAttachmentStatus;
+}
+declare function createNetworkClassManifest(name: string, spec: NetworkClassSpec): NetworkClassManifest;
+declare function createNetworkAttachmentManifest(name: string, spec: NetworkAttachmentSpec): NetworkAttachmentManifest;
+declare function isNetworkClass(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is NetworkClassResource;
+declare function isNetworkAttachment(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is NetworkAttachmentResource;
+declare const STORAGE_CLASS_API_VERSION = "storage.memeloop.io/v1alpha1";
+declare const STORAGE_CLASS_KIND = "StorageClass";
+declare const VOLUME_CLAIM_API_VERSION = "storage.memeloop.io/v1alpha1";
+declare const VOLUME_CLAIM_KIND = "AgentVolumeClaim";
+declare const VOLUME_API_VERSION = "storage.memeloop.io/v1alpha1";
+declare const VOLUME_KIND = "AgentVolume";
+declare const SNAPSHOT_API_VERSION = "storage.memeloop.io/v1alpha1";
+declare const SNAPSHOT_KIND = "AgentSnapshot";
+type VolumeAccessMode = 'ReadWriteOnce' | 'ReadOnlyMany' | 'ReadWriteMany';
+/** CSI-like storage class: provisioning and replication policy. */
+interface StorageClassSpec {
+    description?: string;
+    /** StorageDriver name responsible for this class. */
+    driver: string;
+    replication?: {
+        /** Desired replica count across fault domains (1 = no replication). */
+        factor?: number;
+        /** Fault-domain labels replicas must be spread across (e.g. `node`, `zone`). */
+        faultDomains?: string[];
+        /** Rebuild replicas automatically after loss. */
+        autoRebuild?: boolean;
+    };
+    encryption?: {
+        enabled?: boolean;
+        /** Reference to a key in the credential domain (never key material). */
+        keyRef?: string;
+    };
+    allowedAccessModes?: VolumeAccessMode[];
+    snapshotSupport?: boolean;
+    backup?: {
+        /** Cron-like schedule expression evaluated by the backup controller. */
+        schedule?: string;
+        retentionCount?: number;
+    };
+    dataPolicy?: {
+        classification?: DataClassification;
+        retention?: string;
+    };
+}
+interface StorageClassStatus extends OrchestrationResourceStatus {
+    volumeCount?: number;
+    healthyVolumeCount?: number;
+}
+type StorageClassManifest = OrchestrationResourceManifest<StorageClassSpec>;
+interface StorageClassResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: StorageClassSpec;
+    status?: StorageClassStatus;
+}
+/** PVC-like claim: a workload's request for storage. */
+interface AgentVolumeClaimSpec {
+    storageClassRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    accessMode: VolumeAccessMode;
+    sizeBytes?: number;
+    selector?: Record<string, string>;
+    /** Restore from a snapshot when provisioning. */
+    dataSourceRef?: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+}
+interface AgentVolumeClaimStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Provisioning' | 'Bound' | 'Lost' | 'Failed';
+    assignedNode?: string;
+    assignedDriver?: string;
+    binding?: {
+        leaseEpoch: string;
+        storageClassResourceVersion: string;
+        boundAt: string;
+    };
+    provisionClaim?: {
+        leaseEpoch: string;
+        claimedAt: string;
+    };
+    volumeRef?: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        uid?: string;
+    };
+    error?: OrchestrationErrorData;
+}
+type AgentVolumeClaimManifest = OrchestrationResourceManifest<AgentVolumeClaimSpec>;
+interface AgentVolumeClaimResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: AgentVolumeClaimSpec;
+    status?: AgentVolumeClaimStatus;
+}
+interface AgentVolumeReplicaStatus {
+    nodeId: string;
+    state: 'healthy' | 'degraded' | 'rebuilding' | 'offline';
+    /** Verified content hash of this replica (must equal the volume contentHash). */
+    contentHash?: string;
+    updatedAt?: string;
+}
+/** PV-like provisioned volume. `driverHandle` is opaque and never parsed by consumers. */
+interface AgentVolumeSpec {
+    storageClassRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    claimRef?: OrchestrationOwnerReference;
+    /** Opaque driver handle for the provisioned volume. */
+    driverHandle: string;
+    capacityBytes?: number;
+    topology?: {
+        nodeId?: string;
+        zone?: string;
+    };
+    accessModes?: VolumeAccessMode[];
+}
+interface AgentVolumeStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Available' | 'Bound' | 'Published' | 'Failed';
+    replicas?: AgentVolumeReplicaStatus[];
+    /** Last verified content hash; the replication source of truth. */
+    contentHash?: string;
+    /** Current primary replica node; transfers originate only from the primary. */
+    primaryNodeId?: string;
+    /** Monotonically increasing fencing epoch, bumped on every primary change. */
+    primaryEpoch?: number;
+    publishedTo?: Array<{
+        nodeId?: string;
+        workloadRef?: OrchestrationOwnerReference;
+    }>;
+    health?: 'healthy' | 'degraded' | 'rebuilding' | 'failed';
+}
+type AgentVolumeManifest = OrchestrationResourceManifest<AgentVolumeSpec>;
+interface AgentVolumeResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: AgentVolumeSpec;
+    status?: AgentVolumeStatus;
+}
+/** Point-in-time snapshot of a volume; restorable into new claims. */
+interface AgentSnapshotSpec {
+    sourceVolumeRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    snapshotClass?: string;
+}
+interface AgentSnapshotStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Ready' | 'Failed';
+    readyToUse?: boolean;
+    restoreSizeBytes?: number;
+    /** Opaque driver handle for the snapshot. */
+    driverHandle?: string;
+    createdAt?: string;
+}
+type AgentSnapshotManifest = OrchestrationResourceManifest<AgentSnapshotSpec>;
+interface AgentSnapshotResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: AgentSnapshotSpec;
+    status?: AgentSnapshotStatus;
+}
+declare function createStorageClassManifest(name: string, spec: StorageClassSpec): StorageClassManifest;
+declare function createVolumeClaimManifest(name: string, spec: AgentVolumeClaimSpec): AgentVolumeClaimManifest;
+declare function createVolumeManifest(name: string, spec: AgentVolumeSpec): AgentVolumeManifest;
+declare function createSnapshotManifest(name: string, spec: AgentSnapshotSpec): AgentSnapshotManifest;
+declare function isStorageClass(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is StorageClassResource;
+declare function isVolumeClaim(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is AgentVolumeClaimResource;
+declare function isVolume(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is AgentVolumeResource;
+declare function isSnapshot(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is AgentSnapshotResource;
+declare const CREDENTIAL_GRANT_API_VERSION = "security.memeloop.io/v1alpha1";
+declare const CREDENTIAL_GRANT_KIND = "CredentialGrant";
+/**
+ * JIT credential authorization (plan 24.46). The resource records grant
+ * metadata only — the opaque handle lives in the credential domain and raw
+ * secret material never appears in spec or status.
+ */
+interface CredentialGrantSpec {
+    runRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        uid: string;
+    };
+    attempt: number;
+    /** Fingerprint of the worker's ephemeral public key. */
+    workerKey: string;
+    /** Target system the credential acts on (e.g. `ssh://node-7`, `model:openai/gpt-4o`). */
+    target: string;
+    /** Operation the credential authorizes (e.g. `exec`, `generate`, `read`). */
+    method: string;
+    /** Audience the resulting handle is valid for. */
+    audience: string;
+    policyDigest: string;
+    budget?: {
+        maxCalls?: number;
+        maxCost?: number;
+        currency?: string;
+    };
+    /** Requested TTL in milliseconds; the broker caps it. */
+    ttlMs?: number;
+}
+interface CredentialGrantStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Issuing' | 'Issued' | 'Renewed' | 'Revoked' | 'Expired' | 'Failed';
+    assignedNode?: string;
+    assignedBroker?: string;
+    binding?: {
+        leaseEpoch: string;
+        boundAt: string;
+    };
+    issuanceClaim?: {
+        leaseEpoch: string;
+        claimedAt: string;
+    };
+    /** Opaque handle reference in the credential domain — never the handle itself. */
+    handleRef?: string;
+    issuedAt?: string;
+    expiresAt?: string;
+    renewedAt?: string;
+    revokedAt?: string;
+    /** Exposure assessment used to decide post-task rotation. */
+    exposure?: 'none' | 'worker-visible' | 'potentially-exposed';
+    rotationRequired?: boolean;
+    rotationReason?: string;
+    error?: OrchestrationErrorData;
+}
+type CredentialGrantManifest = OrchestrationResourceManifest<CredentialGrantSpec>;
+interface CredentialGrantResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: CredentialGrantSpec;
+    status?: CredentialGrantStatus;
+}
+declare function createCredentialGrantManifest(name: string, spec: CredentialGrantSpec): CredentialGrantManifest;
+declare function isCredentialGrant(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is CredentialGrantResource;
+declare const ARTIFACT_RECORD_API_VERSION = "artifacts.memeloop.io/v1alpha1";
+declare const ARTIFACT_RECORD_KIND = "ArtifactRecord";
+type ArtifactTrust = 'trusted' | 'restricted' | 'quarantine' | 'untrusted';
+type ArtifactDestination = 'prompt' | 'volume' | 'backup' | 'knowledge';
+type ArtifactReviewKind = 'scan' | 'sanitize' | 'verify';
+interface ArtifactReviewEvidence {
+    kind: ArtifactReviewKind;
+    outcome: 'passed' | 'failed';
+    reviewer: string;
+    contentHash: string;
+    policyDigest: string;
+    destinations: ArtifactDestination[];
+    /** Narrow properties certified by the reviewer; never implies general trust. */
+    properties?: string[];
+    recordedAt: string;
+}
+/**
+ * Content-addressed artifact with provenance and trust (plan 24.47). Derived
+ * content inherits the lowest trust of its inputs; untrusted or unverified
+ * content cannot enter trusted prompts, volumes, backups, or knowledge
+ * ingestion without explicit policy and a verifier pass.
+ */
+interface ArtifactRecordSpec {
+    /** Content hash (e.g. `sha256:...`); the storage address. */
+    contentHash: string;
+    sizeBytes?: number;
+    mimeType?: string;
+    /** Producing run and its trust at production time. */
+    producer?: {
+        runRef?: OrchestrationOwnerReference;
+        trust: ArtifactTrust;
+    };
+    /** Parent artifacts this one derives from. */
+    parents?: Array<{
+        apiVersion: string;
+        kind: string;
+        name: string;
+    }>;
+    trust: ArtifactTrust;
+}
+interface ArtifactRecordStatus extends OrchestrationResourceStatus {
+    /** Append-only evidence written only by the trusted artifact review actor. */
+    reviews?: ArtifactReviewEvidence[];
+    quarantined?: boolean;
+    quarantineReason?: string;
+    /** Downstream artifact names derived from this one (lineage). */
+    derivedBy?: string[];
+}
+type ArtifactRecordManifest = OrchestrationResourceManifest<ArtifactRecordSpec>;
+interface ArtifactRecordResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: ArtifactRecordSpec;
+    status?: ArtifactRecordStatus;
+}
+declare function createArtifactRecordManifest(name: string, spec: ArtifactRecordSpec): ArtifactRecordManifest;
+declare function isArtifactRecord(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is ArtifactRecordResource;
+declare const DRIVER_MANIFEST_API_VERSION = "drivers.memeloop.io/v1alpha1";
+declare const DRIVER_MANIFEST_KIND = "DriverManifest";
+type InfrastructureDriverType = 'control-store' | 'loop-runtime' | 'tool-catalog' | 'tool-execution' | 'model-provider' | 'network' | 'storage' | 'credential' | 'artifact' | 'identity-attestation' | 'policy-approval' | 'audit-telemetry' | 'external-orchestrator';
+type DriverManifestConformance = {
+    suiteVersion: string;
+    status: 'not-run';
+} | {
+    suiteVersion: string;
+    status: 'failed';
+    failedAt: string;
+    failure: string;
+} | {
+    suiteVersion: string;
+    status: 'passed';
+    passedAt: string;
+    /** Content digest of the exact golden fixture/result bundle. */
+    fixtureDigest: string;
+};
+/**
+ * Control-plane representation of a registered driver (plan §11, 24.62).
+ * A RuntimeClass/NetworkClass/ModelClass/scheduler can only reference a
+ * driver whose manifest is registered and conformance-checked; external
+ * orchestrator drivers register through the CLI discovery loader.
+ */
+interface DriverManifestSpec {
+    driverType: InfrastructureDriverType;
+    /** Driver package version (from getCapabilities or the package manifest). */
+    version: string;
+    execution: {
+        location: 'controller' | 'node' | 'worker' | 'external';
+        transport: 'in-process' | 'stdio' | 'utility-process' | 'http' | 'peer-rpc' | 'container-api' | 'other';
+    };
+    supportedTrustClasses: NodeTrustClass[];
+    resourceKinds: string[];
+    capabilities: Record<string, boolean | string | number>;
+    downgradeBehavior: 'reject' | 'explicit-degrade';
+    requiredHostPrivileges: string[];
+    isolation: {
+        boundary: 'none' | 'process' | 'namespace' | 'host' | 'external';
+        threatAssumptions: string[];
+    };
+    configuration: {
+        /** Stable reference to the schema used to validate non-secret configuration. */
+        schemaRef: string;
+        /** Names of opaque SecretRef fields; never secret values. */
+        secretRefs: string[];
+    };
+    health: {
+        mode: 'method' | 'endpoint';
+        endpoint?: string;
+    };
+    lifecycle: {
+        discoverable: boolean;
+        hotReload: boolean;
+        gracefulShutdown: boolean;
+    };
+    conformance: DriverManifestConformance;
+    supportsCancellation: boolean;
+    supportsBackpressure: boolean;
+    supportsAdoption: boolean;
+    supportsFencing: boolean;
+    /** External orchestrators: the resource kinds this driver manages. */
+    manages?: Array<'AgentWorkload' | 'ToolOperation'>;
+    /** External orchestrators: co-located scheduling support. */
+    supportsColocation?: boolean;
+}
+interface DriverManifestStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Ready' | 'Failed';
+    registeredAt?: string;
+    error?: OrchestrationErrorData;
+}
+type DriverManifestManifest = OrchestrationResourceManifest<DriverManifestSpec>;
+interface DriverManifestResource extends OrchestrationTypeMeta {
+    metadata: OrchestrationObjectMetadata;
+    spec: DriverManifestSpec;
+    status?: DriverManifestStatus;
+}
+declare function createDriverManifestManifest(name: string, spec: DriverManifestSpec): DriverManifestManifest;
+declare function isDriverManifest(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is DriverManifestResource;
+/** A class may only select a manifest whose current conformance evidence passed. */
+declare function isDriverManifestAdmitted(resource: DriverManifestResource): boolean;
+
+interface CreateAgentWorkloadOptions {
+    name?: string;
+    generateName?: string;
+    namespace?: string;
+    profileId?: string;
+    scriptReference?: string;
+    promptReference?: string;
+    trust?: AgentTrustLevel;
+    placement?: AgentWorkloadPlacement;
+    modelPolicy?: AgentWorkloadModelPolicy;
+    toolPolicy?: AgentWorkloadToolPolicy;
+    networkPolicy?: AgentWorkloadNetworkPolicy;
+    storagePolicy?: AgentWorkloadStoragePolicy;
+    completionPolicy?: AgentWorkloadCompletionPolicy;
+    ownerReferences?: OrchestrationOwnerReference[];
+    idempotencyKey?: string;
+}
+interface CreateAgentRunOptions {
+    name?: string;
+    generateName?: string;
+    namespace?: string;
+    workloadName: string;
+    workloadNamespace?: string;
+    promptReference?: string;
+    retry?: number;
+    timeoutMs?: number;
+    idempotencyKey?: string;
+}
+interface WaitForConditionOptions {
+    timeout?: number;
+    interval?: number;
+    signal?: AbortSignal;
+    /** Host cancellation hook for runtimes that expose a boolean marker instead of AbortSignal. */
+    isCancelled?: () => boolean;
+}
+interface AgentClient {
+    createWorkload(options: CreateAgentWorkloadOptions): Promise<AgentWorkloadResource>;
+    getWorkload(name: string, namespace?: string): Promise<AgentWorkloadResource | null>;
+    deleteWorkload(name: string, namespace?: string): Promise<void>;
+    waitForWorkloadCondition(name: string, condition: AgentWorkloadCondition, options?: WaitForConditionOptions): Promise<{
+        observedResourceVersion: string;
+        matched: true;
+    }>;
+    createRun(options: CreateAgentRunOptions): Promise<AgentRunResource>;
+    getRun(name: string, namespace?: string): Promise<AgentRunResource | null>;
+    deleteRun(name: string, namespace?: string): Promise<void>;
+    waitForRunCondition(name: string, condition: AgentRunCondition, options?: WaitForConditionOptions): Promise<{
+        observedResourceVersion: string;
+        matched: true;
+    }>;
+}
+declare function waitForCondition<TResource extends {
+    metadata?: {
+        resourceVersion?: string;
+    };
+    status?: {
+        conditions?: Array<{
+            type: string;
+            status: 'True' | 'False' | 'Unknown';
+        }>;
+    };
+}>(get: () => Promise<TResource | null>, condition: {
+    type: string;
+    status: 'True' | 'False' | 'Unknown';
+}, options: WaitForConditionOptions): Promise<{
+    observedResourceVersion: string;
+    matched: true;
+}>;
+declare function createAgentClient(client: AgentOrchestrationClient, defaultNamespace?: string): AgentClient;
+
+type ControlStoreVerb = 'create' | 'apply' | 'update-status' | 'delete' | 'acquire-lease' | 'renew-lease' | 'release-lease';
+interface ControlStoreActor {
+    id: string;
+    kind: 'controller' | 'verifier' | 'admin';
+    properties?: string[];
+}
+interface ControlStoreAuthorizationRequest {
+    actor: ControlStoreActor;
+    verb: ControlStoreVerb;
+    reference: OrchestrationResourceReference;
+    current?: OrchestrationResource;
+    proposedResource?: OrchestrationResourceManifest;
+    proposedStatus?: OrchestrationResourceStatus;
+}
+interface ControlStoreAuthorizer {
+    /** Must return synchronously so authorization and the protected write share one transaction. */
+    authorize(request: ControlStoreAuthorizationRequest): void;
+}
+interface ControlStoreCreateOptions {
+    idempotencyKey?: string;
+    dryRun?: boolean;
+}
+interface ControlStoreApplyOptions {
+    /** Required when changing an existing spec; omitted only for create/same-spec retry. */
+    resourceVersion?: string;
+    idempotencyKey?: string;
+    dryRun?: boolean;
+}
+interface ControlStoreStatusUpdateOptions {
+    /** Exact compare-and-swap precondition. */
+    resourceVersion: string;
+    idempotencyKey?: string;
+    dryRun?: boolean;
+}
+interface ControlLeaseRequest {
+    name: string;
+    holder: string;
+    ttlMs: number;
+}
+interface ControlLeaseIdentity {
+    name: string;
+    holder: string;
+    leaseId: string;
+    epoch: string;
+}
+interface ControlLeaseGrant extends ControlLeaseIdentity {
+    acquiredAt: string;
+    renewedAt: string;
+    expiresAt: string;
+    resourceVersion: string;
+}
+interface ControlStoreCompactionResult {
+    compactedThrough: string;
+    resourceVersion: string;
+}
+interface ControlStoreSnapshotResult {
+    resourceVersion: string;
+    createdAt: string;
+}
+interface ControlStoreHealth {
+    healthy: boolean;
+    resourceVersion: string;
+    detail?: string;
+}
+/**
+ * Trusted controller-facing state store. Agent-facing clients never receive
+ * status, lease, compaction, snapshot, or actor-selection capabilities.
+ */
+interface ControlStore {
+    get<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(reference: OrchestrationResourceReference, options?: OrchestrationGetOptions): Promise<OrchestrationResource<TSpec, TStatus> | null>;
+    list<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(query: OrchestrationResourceQuery, options?: OrchestrationListOptions): Promise<OrchestrationResourceList<TSpec, TStatus>>;
+    watch<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(query: OrchestrationResourceQuery, options?: OrchestrationWatchOptions): AsyncIterable<OrchestrationWatchEvent<TSpec, TStatus>>;
+    create<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(actor: ControlStoreActor, resource: OrchestrationResourceManifest<TSpec>, options?: ControlStoreCreateOptions): Promise<OrchestrationResource<TSpec, TStatus>>;
+    apply<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(actor: ControlStoreActor, resource: OrchestrationResourceManifest<TSpec>, options?: ControlStoreApplyOptions): Promise<OrchestrationResource<TSpec, TStatus>>;
+    updateStatus<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(actor: ControlStoreActor, reference: OrchestrationResourceReference, status: TStatus, options: ControlStoreStatusUpdateOptions): Promise<OrchestrationResource<TSpec, TStatus>>;
+    delete(actor: ControlStoreActor, reference: OrchestrationResourceReference, options?: OrchestrationDeleteOptions): Promise<OrchestrationDeleteResult>;
+    acquireLease(actor: ControlStoreActor, request: ControlLeaseRequest): Promise<ControlLeaseGrant>;
+    renewLease(actor: ControlStoreActor, identity: ControlLeaseIdentity, ttlMs: number): Promise<ControlLeaseGrant>;
+    releaseLease(actor: ControlStoreActor, identity: ControlLeaseIdentity): Promise<void>;
+    compact(throughResourceVersion: string): Promise<ControlStoreCompactionResult>;
+    snapshot(targetPath: string): Promise<ControlStoreSnapshotResult>;
+    getHealth(): Promise<ControlStoreHealth>;
+    close(): Promise<void>;
+}
+/** Key-order-independent structural form used by every ControlStore backend. */
+declare function canonicalControlStoreValue(value: unknown): string;
+/** Whether an apply manifest is already represented by the stored resource. */
+declare function controlStoreApplyMatches(current: OrchestrationResource, proposed: OrchestrationResourceManifest): boolean;
+
+/**
+ * Generated-script validation and normalization (plan 24.16).
+ *
+ * Validates Agent-generated .mjs scripts before they are scheduled:
+ * - Syntax check via a real JavaScript parser (Acorn) — regexes could be
+ *   fooled by comments/strings/regex literals; an AST cannot.
+ * - Required export shape: the default export must be an async generator
+ *   function (inline or via an identifier bound to one in the same module).
+ * - Import extraction from the AST: static `import` declarations, re-exports
+ *   (`export ... from`), and string-literal dynamic `import()` arguments.
+ *   Non-literal dynamic imports are rejected because they defeat admission.
+ * - Forbidden imports: no Node builtins except 'node:events'.
+ * - Size limits.
+ * - Canonical SHA-256 digest for provenance. The digest commits to the
+ *   NORMALIZED source (see {@link normalizeScript}), so semantically
+ *   identical scripts with different line endings share one digest.
+ *
+ * Security note: this runs in the controller process, but never executes
+ * the script. Execution is delegated to the sandbox from plan 24.48.
+ */
+interface ScriptValidationResult {
+    valid: boolean;
+    /**
+     * Canonical SHA-256 hex digest of the NORMALIZED source
+     * (`normalizeScript(source)`). The digest commits to the normalized form,
+     * not the raw bytes, so CRLF/LF variants of the same script are equal.
+     */
+    digest: string;
+    /** Detected imports, from the AST (static, re-export, literal dynamic). */
+    imports: string[];
+    /** Whether the script's default export is an async generator function. */
+    hasDefaultExport: boolean;
+    /**
+     * Whether the script contains a dynamic `import()` whose argument is not
+     * a string literal. Such scripts are always invalid: the import target
+     * cannot be known statically, which defeats admission control.
+     */
+    hasNonLiteralDynamicImport: boolean;
+    /** Human-readable errors if invalid. */
+    errors: string[];
+    /** Normalized source size in bytes. */
+    sizeBytes: number;
+}
+/**
+ * Compute the canonical SHA-256 hex digest of an already-normalized script.
+ * Callers with raw source must pass it through {@link normalizeScript} first
+ * (or use {@link validateScript}, which normalizes internally).
+ */
+declare function digestNormalizedScript(normalizedSource: string): Promise<string>;
+/**
+ * Validate a script string using a real AST parse (Acorn).
+ * Returns a structured result; never throws.
+ */
+declare function validateScript(source: string): Promise<ScriptValidationResult>;
+/**
+ * Normalize a script to a canonical form for digest stability.
+ * Strips BOM, normalizes line endings to LF, and trims trailing whitespace.
+ * Idempotent: `normalizeScript(normalizeScript(s)) === normalizeScript(s)`.
+ * The canonical digest in {@link validateScript} commits to this form.
+ */
+declare function normalizeScript(source: string): string;
+
+/**
+ * Script admission policy and checkpoint compatibility (plan 24.17, 24.19).
+ *
+ * - Admission: trust class, author, imports, resource limits, approval
+ * - Compatibility: script digest/API version vs checkpoint schema
+ *
+ * Quarantine scripts cannot enable arbitrary network imports or plugin loading.
+ * A changed script cannot resume an incompatible checkpoint without explicit
+ * converter or restart policy.
+ */
+
+type ScriptTrustClass = 'trusted' | 'restricted' | 'quarantine';
+interface ScriptAdmissionRequest {
+    /** The validated script result. */
+    script: ScriptValidationResult;
+    /** Trust class of the author (e.g., the Agent that generated the script). */
+    authorTrust: ScriptTrustClass;
+    /** Requested interfaces the script wants to use. */
+    requestedInterfaces: string[];
+    /** Optional checkpoint digest the script expects to resume from. */
+    expectedCheckpointDigest?: string;
+    /** The checkpoint's API version (for compatibility check). */
+    checkpointApiVersion?: string;
+}
+interface ScriptAdmissionDecision {
+    admitted: boolean;
+    reason: string;
+    /** Which interfaces are approved for this script. */
+    approvedInterfaces: string[];
+    /** Whether the checkpoint is compatible. */
+    checkpointCompatible: boolean;
+    /** If not admitted, whether the author can retry with changes. */
+    retryable: boolean;
+}
+/**
+ * The full interface set a host may grant to scripts authored under the
+ * given trust class — a defensive copy of the trust profile's allowlist.
+ *
+ * Hosts wiring a {@link ../loopAPI/types.ScriptLoadGate} or a deployment
+ * pipeline should pass these as `requestedInterfaces`; {@link admitScript}
+ * rejects any request outside the trust profile, so this is the widest set
+ * that can ever be approved for that class. Callers may pass a narrower
+ * subset to further restrict a specific runtime.
+ */
+declare function defaultRequestedInterfacesForTrustClass(trustClass: ScriptTrustClass): string[];
+/** Maximum script size in bytes admitted for the given trust class. */
+declare function maxScriptBytesForTrustClass(trustClass: ScriptTrustClass): number;
+/**
+ * Decide whether a generated script may be admitted for execution.
+ */
+declare function admitScript(request: ScriptAdmissionRequest): ScriptAdmissionDecision;
+
+/**
+ * Unified loop contract for all agent loop types.
+ * Replaces the old AgentToolLoopInput / AgentToolLoopStep naming entirely.
+ */
+
+/** Standard input for any agent loop. */
+interface AgentLoopInput {
+    conversationId: string;
+    message: string;
+    /** Host-prepared user message, used when the platform needs metadata/attachments on the turn root. */
+    userMessage?: Omit<Partial<ChatMessage>, 'conversationId' | 'role'> & {
+        content?: string;
+    };
+    /** If provided, these messages are loaded as conversation history on resume. */
+    resumeSession?: ChatMessage[];
+}
+/** Standard output step yielded by any agent loop. */
+interface AgentLoopStep {
+    type: 'thinking' | 'tool' | 'message' | 'permission_request';
+    data: unknown;
+}
+/** Async iterable signature shared by all loop runners. */
+type AgentLoopGenerator = AsyncIterable<AgentLoopStep>;
+/** Describes a registered loop type. */
+interface AgentLoopDefinition {
+    /** Unique id, e.g. "agent-tool-loop" or "agent-agent-loop". */
+    id: string;
+    /** Human-readable display name. */
+    name: string;
+    /** Short description of this loop's behaviour. */
+    description: string;
+    /** Factory: create a loop runner function for the given context. */
+    createRunner: (context: {
+        [key: string]: unknown;
+    }) => (input: AgentLoopInput) => AgentLoopGenerator;
+}
+type LoopProfileScriptReference = {
+    kind: 'builtin';
+    id: string;
+} | {
+    kind: 'specifier';
+    specifier: string;
+} | {
+    kind: 'source';
+    source: string;
+    name?: string;
+};
+/**
+ * Request handed to a {@link ScriptLoadGate} before a data-URL/source script
+ * is imported into the current process. The source has already been
+ * normalized; the digest commits to the normalized form (plan 24.16).
+ */
+interface ScriptLoadGateRequest {
+    /** Normalized script source (`normalizeScript` output). */
+    normalizedSource: string;
+    /** Canonical SHA-256 hex digest of the normalized source. */
+    digest: string;
+    /** The original script reference being loaded. */
+    reference: LoopProfileScriptReference;
+    /** Script type label for diagnostics (e.g. "AgentAgentLoop script"). */
+    scriptType: string;
+}
+/** Admission decision returned by a {@link ScriptLoadGate}. */
+interface ScriptLoadGateDecision {
+    /** Whether the script may be imported into this process. */
+    allowed: boolean;
+    /** Human-readable denial reason (required when `allowed` is false). */
+    reason?: string;
+    /** Trust class assigned by admission (plan 24.17). */
+    trustClass?: ScriptTrustClass;
+    /** RuntimeClass name selected for the script (plan 24.18). */
+    runtimeClass?: string;
+    /** Whether the script may resume its expected checkpoint (plan 24.19). */
+    checkpointCompatible?: boolean;
+}
+/**
+ * Port: host-injected admission gate for script loading. Every non-builtin
+ * script source must pass this gate before `import()`; when no gate is
+ * configured the loader fails closed (denies all non-builtin sources).
+ */
+interface ScriptLoadGate {
+    admitScriptLoad(request: ScriptLoadGateRequest): Promise<ScriptLoadGateDecision> | ScriptLoadGateDecision;
+}
+interface AgentLoopScriptPolicy {
+    allowBuiltin?: boolean;
+    allowFile?: boolean;
+    allowNetwork?: boolean;
+    allowSource?: boolean;
+    allowSpecifier?: boolean;
+    importModule?: (specifier: string) => Promise<unknown>;
+    /**
+     * Host-provided admission gate for non-builtin script sources. When
+     * omitted, all non-builtin sources are denied (fail-closed).
+     */
+    scriptLoadGate?: ScriptLoadGate;
+}
+/** Capability extension point for a loop. */
+interface LoopPlugin {
+    /** Unique plugin id, e.g. "fullReplacement" or "wikiTools". */
+    id: string;
+    /** Which loop id this plugin targets, or "*" for all loops. */
+    targetLoopId?: string;
+    /** Optional schema to validate against profile config. */
+    schema?: Record<string, unknown>;
+    /** Install the plugin into the given context. Mutates the context in place. */
+    install?: (context: {
+        [key: string]: unknown;
+    }, config?: Record<string, unknown>) => void;
+}
+/** A complete agent profile that describes which loop, which .mjs script, prompts, plugins, and hooks to use. */
+interface LoopProfile {
+    /** Unique profile id, e.g. "memeloop:general-assistant". */
+    id: string;
+    /** Display name. */
+    name: string;
+    /** Description. */
+    description: string;
+    /** Which loop to run. Defaults to "agent-tool-loop" if omitted. */
+    loopId?: string;
+    /** Structured reference to the loop script. Prefer this over `script` for new profiles. */
+    scriptReference?: LoopProfileScriptReference;
+    /** Legacy alias for `scriptReference`. */
+    scriptRef?: LoopProfileScriptReference;
+    /** Legacy path/specifier to the .mjs loop script. */
+    script?: string;
+    /** System prompt (concise form; detailed prompts go to `prompts`). */
+    systemPrompt?: string;
+    /** Tool allowlist IDs. */
+    tools?: string[];
+    /** Agent-level tool configuration. */
+    agentTools?: Array<{
+        toolId: string;
+        enabled?: boolean;
+        parameters?: Record<string, unknown>;
+        tags?: string[];
+    }>;
+    /** Full agent framework configuration. */
+    agentFrameworkConfig?: AgentFrameworkConfig;
+    /** System prompt(s) for the agent. */
+    prompts?: LoopProfilePrompt[];
+    /** Tool / prompt / response plugin configs. */
+    plugins?: LoopProfilePluginEntry[];
+    /** Hook plugin configs. */
+    hookPlugins?: LoopProfilePluginEntry[];
+    /** Model configuration. */
+    modelConfig?: {
+        provider?: string;
+        model?: string;
+        temperature?: number;
+        maxTokens?: number;
+    };
+    /** Host-specific AI API config override. */
+    aiApiConfig?: AiAPIConfig;
+    /** Periodic auto-wake configuration. */
+    heartbeat?: {
+        enabled: boolean;
+        intervalSeconds: number;
+        message: string;
+        activeHoursStart?: string;
+        activeHoursEnd?: string;
+    };
+    /** Host-specific handler / framework ID. */
+    agentFrameworkID?: string;
+    /** Host-specific avatar or icon URL. */
+    avatarUrl?: string;
+    /** Tool permission configuration. */
+    permissions?: {
+        default?: 'allow' | 'ask' | 'deny';
+        rules?: Array<{
+            pattern: string;
+            action: 'allow' | 'ask' | 'deny';
+        }>;
+        perAgent?: Record<string, {
+            default?: string;
+            rules?: Array<{
+                pattern: string;
+                action: string;
+            }>;
+        }>;
+    };
+    /** Open schema for host-specific or loop-specific configuration. */
+    schema?: Record<string, unknown>;
+    /** Arbitrary metadata. */
+    metadata?: Record<string, unknown>;
+    /** Version string. */
+    version?: string;
+}
+interface LoopProfilePrompt {
+    id: string;
+    role: string;
+    text: string;
+    caption?: string;
+    children?: LoopProfilePrompt[];
+}
+interface LoopProfilePluginEntry {
+    /** Plugin id registered in the plugin registry. */
+    id: string;
+    /** Whether this plugin is enabled. */
+    enabled?: boolean;
+    /** Plugin-specific configuration. */
+    config?: Record<string, unknown>;
+}
+/** Minimal runtime context passed to a loop runner. */
+interface AgentLoopRuntime {
+    /** Resolve a profile by id. */
+    resolveProfile: (profileId: string) => Promise<LoopProfile | null>;
+    /** Policy-scoped declarative manager facade available to this loop. */
+    orchestration?: AgentOrchestrationClient;
+    /** Host-bound script deployment configuration used to build `ctx.scriptClient` (plan 24.14). */
+    scriptDeployment?: ScriptDeploymentClientConfig;
+    /** Run a child agent (or sub-loop) and return its result. */
+    runChildAgent: (input: {
+        profileId: string;
+        prompt: string;
+        conversationId: string;
+    }) => AgentLoopGenerator;
+    /** Log an event for observability. */
+    log: (event: string, data?: Record<string, unknown>) => void;
+    /** Read/write persistent state for this run. */
+    state: {
+        get: <T>(key: string) => Promise<T | undefined>;
+        set: (key: string, value: unknown) => Promise<void>;
+        update: (key: string, updater: (previous: unknown) => unknown) => Promise<void>;
+    };
+    /** Checkpoint a completed step so it can be skipped on resume. */
+    checkpoint: (key: string, result: unknown) => Promise<void>;
+    /** Load a previously completed step after process restart. */
+    loadCheckpoint: <T>(key: string) => Promise<T | undefined>;
+    /** Emit a progress step upstream. */
+    emit: (step: AgentLoopStep) => void;
+    /** Signal whether the run has been cancelled. */
+    signal: {
+        cancelled: boolean;
+    };
+}
+interface LoopScriptCheckpointStore {
+    saveCheckpoint(conversationId: string, key: string, result: unknown): Promise<void>;
+    loadCheckpoint<T>(conversationId: string, key: string): Promise<T | undefined>;
+}
+
+declare const TOOL_PARAMETER_PARSE_ERROR_KEY = "__memeloopToolParameterParseError";
+type ToolCallingMatch = {
+    found: false;
+} | {
+    found: true;
+    toolId: string;
+    parameters: Record<string, unknown>;
+    originalText: string;
+};
+declare function matchToolCalling(responseText: string): ToolCallingMatch;
+declare function matchAllToolCallings(responseText: string): {
+    calls: Array<ToolCallingMatch & {
+        found: true;
+    }>;
+    parallel: boolean;
+};
+
+/**
+ * TidGi-Desktop `agentInstance/tools/types.ts` 迁移并适配 memeloop（无 tapable，用 HookSlot.promise 串行执行）。
+ */
+
+/** 供 defineTool / 审批使用：agent 视图包含完整 AgentInstance。 */
+type DefineToolAgentFrameworkContext = AgentFrameworkContext & {
+    agent: AgentInstanceModel;
+};
+type ToolApprovalMode = 'auto' | 'confirm';
+interface ToolApprovalConfig {
+    mode: ToolApprovalMode;
+    allowPatterns?: string[];
+    denyPatterns?: string[];
+    timeoutMs?: number;
+}
+type ApprovalDecision = 'allow' | 'deny' | 'pending';
+interface ToolApprovalRequest {
+    approvalId: string;
+    agentId: string;
+    toolName: string;
+    parameters: Record<string, unknown>;
+    originalText?: string;
+    created: Date;
+}
+type YieldNextRoundTarget = 'human' | 'self' | `agent:${string}`;
+interface ToolActions {
+    yieldNextRoundTo?: YieldNextRoundTarget;
+    newUserMessage?: string;
+    toolCalling?: ToolCallingMatch;
+}
+interface BaseToolContext {
+    agentFrameworkContext: DefineToolAgentFrameworkContext;
+    metadata?: Record<string, unknown>;
+    actions?: ToolActions;
+}
+/** 与 TidGi IPromptConcatTool 对齐的插件行 */
+interface FrameworkPluginToolConfig {
+    id: string;
+    toolId: string;
+    enabled?: boolean;
+    caption?: string;
+    content?: string;
+    forbidOverrides?: boolean;
+    approval?: ToolApprovalConfig;
+    timeoutMs?: number;
+    [key: string]: unknown;
+}
+interface PromptConcatHookContext extends BaseToolContext {
+    messages: ChatMessage[];
+    prompts: IPrompt[];
+    toolConfig: FrameworkPluginToolConfig;
+    pluginIndex?: number;
+}
+interface AgentResponse {
+    id: string;
+    text?: string;
+    enabled?: boolean;
+    children?: AgentResponse[];
+}
+interface PostProcessContext extends PromptConcatHookContext {
+    llmResponse: string;
+    responses?: AgentResponse[];
+}
+/** 流式响应子集（memeloop ILLMProvider 聚合为最终文本后注入） */
+interface AIStreamResponseSubset {
+    status: 'update' | 'done';
+    content: string;
+}
+interface AIResponseContext extends BaseToolContext {
+    toolConfig: FrameworkPluginToolConfig;
+    agentFrameworkConfig?: {
+        plugins?: FrameworkPluginToolConfig[];
+    };
+    response: AIStreamResponseSubset;
+    requestId?: string;
+    isFinal?: boolean;
+}
+interface UserMessageContext extends BaseToolContext {
+    content: {
+        text: string;
+        file?: unknown;
+        wikiTiddlers?: Array<{
+            workspaceName: string;
+            tiddlerTitle: string;
+        }>;
+    };
+    messageId: string;
+    timestamp: Date;
+}
+interface AgentStatusContext extends BaseToolContext {
+    status: {
+        state: 'working' | 'completed' | 'failed' | 'canceled';
+        modified: Date;
+    };
+}
+interface ToolExecutionContext extends BaseToolContext {
+    toolResult: {
+        success: boolean;
+        data?: string;
+        error?: string;
+        metadata?: Record<string, unknown>;
+    };
+    toolInfo: {
+        toolId: string;
+        parameters: Record<string, unknown>;
+        originalText?: string;
+    };
+    requestId?: string;
+}
+/**
+ * Hook 槽：与 tapable AsyncSeriesHook 一致 — `tapAsync` 注册，`promise(ctx)` 串行触发。
+ */
+type TapAsyncHandler = {
+    bivarianceHack(context: unknown, callback: () => void): void;
+}['bivarianceHack'];
+interface HookSlot {
+    tapAsync(name: string, function_: TapAsyncHandler): void;
+    promise(context: unknown): Promise<void>;
+}
+interface PromptConcatHooks {
+    processPrompts: HookSlot;
+    finalizePrompts: HookSlot;
+    postProcess: HookSlot;
+    userMessageReceived: HookSlot;
+    agentStatusChanged: HookSlot;
+    toolExecuted: HookSlot;
+    responseUpdate: HookSlot;
+    responseComplete: HookSlot;
+}
+type PromptConcatTool = (hooks: PromptConcatHooks) => void;
+
+interface CheckpointRecord {
+    conversationId: string;
+    messages: ChatMessage[];
+    savedAt: string;
+    messageCount: number;
+    lastMessagePreview: string;
+}
+interface CheckpointSummary {
+    conversationId: string;
+    savedAt: string;
+    messageCount: number;
+    lastMessagePreview: string;
+}
+interface CheckpointStore {
+    saveCheckpoint(conversationId: string, messages: ChatMessage[]): Promise<CheckpointRecord>;
+    loadCheckpoint(conversationId: string): Promise<CheckpointRecord | null>;
+    listCheckpoints(): Promise<CheckpointSummary[]>;
+    deleteCheckpoint(conversationId: string): Promise<boolean>;
+}
+interface SessionStorageOptions {
+    records?: CheckpointRecord[];
+}
+declare function createCheckpointRecord(conversationId: string, messages: ChatMessage[], savedAt?: string): CheckpointRecord;
+declare function parseCheckpointRecord(raw: string): CheckpointRecord | null;
+declare function serializeCheckpointRecord(record: CheckpointRecord): string;
+declare class InMemoryCheckpointStore implements CheckpointStore {
+    private readonly records;
+    constructor(options?: SessionStorageOptions);
+    saveCheckpoint(conversationId: string, messages: ChatMessage[]): Promise<CheckpointRecord>;
+    loadCheckpoint(conversationId: string): Promise<CheckpointRecord | null>;
+    listCheckpoints(): Promise<CheckpointSummary[]>;
+    deleteCheckpoint(conversationId: string): Promise<boolean>;
+}
+declare class SessionStorage extends InMemoryCheckpointStore {
+}
+
+interface MemeLoopLogger {
+    debug?(message: string, ...arguments_: unknown[]): void;
+    info?(message: string, ...arguments_: unknown[]): void;
+    warn?(message: string, ...arguments_: unknown[]): void;
+    error?(message: string, ...arguments_: unknown[]): void;
+}
+interface ILLMProvider {
+    name: string;
+    /**
+     * Serializable default model identity used by orchestration resources.
+     * `model` may be an SDK object or factory and must never be persisted.
+     */
+    modelId?: string;
+    model?: unknown;
+    chat(request: unknown): AsyncIterable<unknown> | Promise<unknown>;
+}
+interface IToolRegistry {
+    registerTool(id: string, impl: unknown, parameterSchema?: unknown, effect?: ToolOperationEffect): void;
+    getTool(id: string): unknown | undefined;
+    listTools(): string[];
+    /**
+     * Instance-local schema lookup. Managed catalogs use this when available so
+     * one embedded runtime cannot inherit another runtime's process-global schema.
+     */
+    getToolParameterSchema?: (id: string) => unknown | undefined;
+    /** Host-authoritative effect classification; omitted tools default to conservative execute. */
+    getToolEffect?: (id: string) => ToolOperationEffect | undefined;
+    /** Prompt-concat plugin registry, isolated per runtime. Falls back to the process-level default registry. */
+    getPromptPlugins?: () => Map<string, (hooks: PromptConcatHooks) => void>;
+}
+interface IChatSyncAdapter {
+    start(): Promise<void>;
+    stop(): Promise<void>;
+}
+interface INetworkService {
+    start(): Promise<void>;
+    stop(): Promise<void>;
+}
+interface AgentToolLoopOptions {
+    /** Maximum LLM-to-tool round-trips. `0` means unlimited, still capped internally. */
+    maxIterations?: number;
+    /** Whether to parse `<tool_use>` / `<function_call>` and execute through `IToolRegistry` (default true). */
+    enableToolLoop?: boolean;
+    /** Cancellation check, e.g. when the user stops a run. */
+    isCancelled?: (conversationId: string) => boolean;
+    /** Attachment injection for promptConcat, aligned with `PromptConcatOptions`. */
+    readAttachmentFile?: (path: string) => Promise<Uint8Array>;
+    /** Omit history older than this many milliseconds when building LLM input. `0` disables trimming. */
+    maxHistoryAgeMs?: number;
+    /**
+     * When `defineTool` / plugins are configured, fall back to `IToolRegistry` for tool calls not handled by `onResponseComplete`.
+     */
+    fallbackRegistryTools?: boolean;
+    /**
+     * Tool permission rules (default allow).
+     * Supports wildcards such as "terminal.*" and "file.read".
+     */
+    toolPermissions?: {
+        default?: 'allow' | 'ask' | 'deny';
+        rules?: Array<{
+            pattern: string;
+            action: 'allow' | 'ask' | 'deny';
+        }>;
+        perAgent?: Record<string, {
+            default?: 'allow' | 'ask' | 'deny';
+            rules?: Array<{
+                pattern: string;
+                action: 'allow' | 'ask' | 'deny';
+            }>;
+        }>;
+    };
+    /** Threshold for repeated identical tool+input calls (default 3). */
+    doomLoopThreshold?: number;
+    /**
+     * Timeout for a single ToolOperation executed through the orchestration
+     * facade (default 60_000ms). Covers the full lifecycle from apply until a
+     * terminal phase, including scheduling and remote execution.
+     */
+    toolOperationTimeoutMs?: number;
+    /**
+     * Host-bound trust class of the node running this loop. Restricted and
+     * quarantine nodes default the model-facing tool permission layer to deny
+     * when no explicit wildcard rule exists. Bound by the host at assembly
+     * time; never self-reported by the workload or model.
+     */
+    trustClass?: NodeTrustClass;
+    /** History compaction window: keep the most recent N turns plus the last user message. */
+    contextCompaction?: {
+        maxMessages?: number;
+        replayLastUserMessage?: boolean;
+    };
+    /**
+     * Auto-compaction: when message count exceeds threshold, summarizes old
+     * conversation turns via truncation or LLM summarization. Default: disabled.
+     */
+    autoCompact?: {
+        /** Trigger compaction when message count exceeds this (default: 50) */
+        threshold?: number;
+        /** Number of recent turns to preserve (default: 4) */
+        recentTurnsToKeep?: number;
+        /** Maximum token estimate before compaction; 0 disables token-based compaction */
+        maxTokens?: number;
+    };
+    /** Session checkpoint: save conversation history after each turn for resume. */
+    sessionCheckpoint?: {
+        /** Enable checkpoint saves. Default: false. */
+        enabled?: boolean;
+        /** Store provided by the runtime host. */
+        store?: CheckpointStore;
+        /** Custom checkpoint directory (default: ~/.memeloop/sessions/) */
+        directory?: string;
+    };
+    /**
+     * After a tool returns `__memeloopToolResult.awaitSessionId`, AgentToolLoop waits here before the next LLM round.
+     */
+    waitForTerminalSession?: (sessionId: string) => Promise<{
+        exitCode: number | null;
+        truncatedOutput: string;
+    }>;
+}
+interface AgentFrameworkContext {
+    storage: IAgentStorage;
+    llmProvider: ILLMProvider;
+    tools: IToolRegistry;
+    syncAdapters: IChatSyncAdapter[];
+    network: INetworkService;
+    /** Policy-scoped declarative manager facade shared by Agent loops and Agent-facing tools. */
+    orchestration?: AgentOrchestrationClient;
+    /**
+     * Host-bound script deployment configuration (plan 24.14). Loop runtimes
+     * build a `ctx.scriptClient` from it; scripts never see the raw config,
+     * so trust class and interface ceilings stay host-controlled.
+     */
+    scriptDeployment?: ScriptDeploymentClientConfig;
+    /** Trusted controller state store; Agent-facing loop scripts receive only its checkpoint adapter. */
+    controlStore?: ControlStore;
+    /** Durable milestones used by script-backed loops such as quality-gate. */
+    loopCheckpoints?: LoopScriptCheckpointStore;
+    /** Let host runtimes preserve platform-specific message aliases/metadata while core owns the loop. */
+    normalizeMessage?: (message: ChatMessage) => ChatMessage;
+    /**
+     * Notify a host about an in-memory streaming message. The core invokes this
+     * with the same message ID used for the immutable final persisted message.
+     */
+    onTransientMessage?: (message: ChatMessage) => void | Promise<void>;
+    /** AgentToolLoop ReAct behavior, migrated from the TidGi-Desktop agentToolLoop integration. */
+    agentToolLoop?: AgentToolLoopOptions;
+    /**
+     * Host-injected runner used by `createMemeLoopRuntime` after a user sends a message.
+     */
+    runAgentToolLoop?: (input: AgentLoopInput) => AgentLoopGenerator;
+    /** Run a child agent for orchestration loops such as AgentAgentLoop. */
+    runChildAgent?: AgentLoopRuntime['runChildAgent'];
+    /** Policy for loading script-backed loops. Defaults to bundled scripts + import specifiers only. */
+    loopScriptPolicy?: AgentLoopScriptPolicy;
+    /**
+     * Build the agent view supplied to defineTool hooks for a conversation.
+     */
+    resolveAgentRuntimeView?: (conversationId: string, messages: ChatMessage[]) => Promise<AgentInstanceModel>;
+    /** Current agent view for defineTool / TidGi compatibility. */
+    agent?: {
+        id: string;
+        messages: ChatMessage[];
+    };
+    /** Persist a `ChatMessage` if the runtime host supplies this hook. */
+    persistAgentMessage?: (message: ChatMessage) => Promise<void>;
+    /** Cancellation markers written by `createMemeLoopRuntime`. */
+    conversationCancellation?: Set<string>;
+    /** Resolve an AgentDefinition from host-specific sources. */
+    resolveAgentDefinition?: (definitionId: string) => Promise<AgentDefinition | null>;
+    /** Fallback logger used when the host does not inject one. */
+    logger?: MemeLoopLogger;
+    /** TidGi defineTool compatibility: legacy plugins call this without arguments. */
+    isCancelled?: () => boolean;
+}
+type AgentInstanceState = 'submitted' | 'working' | 'input-required' | 'completed' | 'canceled' | 'failed' | 'unknown';
+interface AgentInstanceLatestStatus {
+    state: AgentInstanceState;
+    message?: ChatMessage;
+    /** Human-readable sub-status for the header — shown while agent is working. */
+    progress?: string;
+    created?: Date;
+    modified?: Date;
+}
+interface AgentInstanceModel extends Omit<AgentDefinition, 'name'> {
+    agentDefId: string;
+    name?: string;
+    agentFrameworkConfig?: AgentFrameworkConfig;
+    messages: ChatMessage[];
+    status: AgentInstanceLatestStatus;
+    created: Date;
+    modified?: Date;
+    closed?: boolean;
+    volatile?: boolean;
+    isDelegatedAgentRun?: boolean;
+    parentAgentRunId?: string;
+}
+
+declare function isUserInitiatedConversation(meta: ConversationMeta): boolean;
+declare function createInstanceDeltaFromDefinition(definition: AgentDefinition, overrides: Partial<AgentDefinition>): Partial<AgentDefinition>;
+
+interface RuntimeClassSpec {
+    /** Module isolation level. */
+    isolation: 'none' | 'process' | 'container';
+    /** CPU limit in millicores (1000 = 1 core). */
+    cpuLimitMillis?: number;
+    /** Memory limit in bytes. */
+    memoryLimitBytes?: number;
+    /** Wall-clock time limit in milliseconds. */
+    timeLimitMs?: number;
+    /** Whether the runtime supports cancellation signals. */
+    supportsCancellation: boolean;
+    /** Supported trust classes for this runtime. */
+    supportedTrustClasses: ScriptTrustClass[];
+    /** Whether network access is allowed (outbound-only for quarantine). */
+    networkAccess: 'none' | 'outbound-only' | 'full';
+}
+interface RuntimeClassResource {
+    apiVersion: 'execution.memeloop.io/v1alpha1';
+    kind: 'RuntimeClass';
+    metadata: {
+        name: string;
+        namespace?: string;
+    };
+    spec: RuntimeClassSpec;
+}
+declare const BUILTIN_RUNTIME_CLASSES: Record<string, RuntimeClassSpec>;
+interface SandboxSelectionResult {
+    runtimeClass: string;
+    isolation: RuntimeClassSpec['isolation'];
+    cpuLimitMillis: number;
+    memoryLimitBytes: number;
+    timeLimitMs: number;
+    networkAccess: RuntimeClassSpec['networkAccess'];
+}
+/**
+ * Select the most restrictive RuntimeClass capable of hosting the given
+ * trust class. Throws when no available RuntimeClass supports the trust
+ * class — there is no silent fallback (24.18).
+ */
+declare function selectRuntimeClass(trustClass: ScriptTrustClass, available?: string[]): SandboxSelectionResult;
+/**
+ * Reference to a content-addressed ArtifactRecord holding the script source
+ * (plan 24.15/24.47). Remote deployments never carry raw script source
+ * strings; the target node resolves the artifact by identity and verifies
+ * it against `contentDigest` before loading.
+ */
+interface ScriptArtifactReference {
+    /** API version of the artifact resource (`artifacts.memeloop.io/v1alpha1`). */
+    apiVersion: string;
+    /** Resource kind; always `ArtifactRecord`. */
+    kind: 'ArtifactRecord';
+    /** Artifact resource name. */
+    name: string;
+    /** Artifact namespace, if any. */
+    namespace?: string;
+    /**
+     * Content digest (`sha256:<hex>`) of the NORMALIZED script source. The
+     * remote node must verify the fetched artifact content against this
+     * digest before admission.
+     */
+    contentDigest: string;
+}
+interface RemoteDeploymentRequest {
+    /**
+     * Content-addressed reference to the script artifact. Raw script source
+     * is never transported inside a deployment request.
+     */
+    artifactRef: ScriptArtifactReference;
+    /** Trust class assigned by admission. */
+    trustClass: ScriptTrustClass;
+    /** Desired lifecycle. */
+    lifecycle: 'run-once' | 'service' | 'schedule';
+    /** Runtime class to use. */
+    runtimeClass: string;
+    /** Node selector for scheduling. */
+    nodeSelector?: Record<string, string>;
+    /** Environment variables (never credentials). */
+    env?: Record<string, string>;
+    /** Network attachment requirements enforced before the script starts. */
+    networkPolicy?: AgentWorkloadNetworkPolicy;
+    /** Existing claims to publish before the script starts. */
+    storagePolicy?: AgentWorkloadStoragePolicy;
+}
+interface RemoteDeploymentResult {
+    /** Workload name created on the target node. */
+    workloadName: string;
+    /** Node the workload was placed on. */
+    nodeName: string;
+    /** When the deployment was requested. */
+    requestedAt: string;
+}
+
+/**
+ * Generated-script deployment pipeline (plans 24.14–24.19, 24.47).
+ *
+ * Connects the full security chain for remote/generated scripts:
+ *
+ *   normalizeScript → validateScript (Acorn AST) → admitScript (trust-class
+ *   policy) → ArtifactRecord manifest (content-addressed) → persist via the
+ *   injected artifact store port → selectRuntimeClass →
+ *   RemoteDeploymentRequest (artifactRef only — raw source is never carried).
+ *
+ * Also provides {@link createScriptLoadGate}, the production
+ * {@link ScriptLoadGate} implementation for the in-process script loading
+ * path (`loopAPI/scriptLoader`): validate (AST) → admit → assign
+ * trustClass/RuntimeClass before any `import()` executes.
+ *
+ * Everything here is pure and portable; artifact persistence sits behind the
+ * {@link ScriptArtifactStore} port so the CLI can back it with real storage.
+ */
+
+/**
+ * Port: persists a script ArtifactRecord manifest plus its normalized
+ * content. Implementations (e.g. CLI storage) must store content addressed
+ * by `manifest.spec.contentHash` and must not trust content whose hash does
+ * not match the manifest.
+ */
+interface ScriptArtifactStore {
+    putArtifact(manifest: ArtifactRecordManifest, normalizedContent: string): Promise<void> | void;
+}
+/** Input for {@link deployGeneratedScript}. */
+interface ScriptDeploymentRequest {
+    /** Raw generated `.mjs` source (normalized internally). */
+    source: string;
+    /** Trust class of the author (the Agent that generated the script). */
+    authorTrust: ScriptTrustClass;
+    /** Interfaces the script requests (loop-runtime, model-provider, ...). */
+    requestedInterfaces: string[];
+    /** Desired lifecycle for the remote workload. */
+    lifecycle: 'run-once' | 'service' | 'schedule';
+    /** Node selector for scheduling. */
+    nodeSelector?: Record<string, string>;
+    /** Environment variables (never credentials). */
+    env?: Record<string, string>;
+    /** Network attachment requirements for the deployed workload. */
+    networkPolicy?: AgentWorkloadNetworkPolicy;
+    /** Existing volume claims required by the deployed workload. */
+    storagePolicy?: AgentWorkloadStoragePolicy;
+    /** Optional checkpoint digest the script expects to resume from. */
+    expectedCheckpointDigest?: string;
+    /** API version of the expected checkpoint (plan 24.19). */
+    checkpointApiVersion?: string;
+    /** Namespace for the ArtifactRecord and deployment. */
+    namespace?: string;
+}
+/** Tunables for {@link deployGeneratedScript}. */
+interface ScriptDeploymentPipelineOptions {
+    /** Artifact persistence port; when omitted the manifest is built but not persisted. */
+    artifactStore?: ScriptArtifactStore;
+    /** RuntimeClass names available for selection (defaults to all built-ins). */
+    availableRuntimeClasses?: string[];
+}
+/** Result of {@link deployGeneratedScript}; `deployed` gates artifact/deployment presence. */
+interface ScriptDeploymentResult {
+    /** Whether a deployment request was produced. */
+    deployed: boolean;
+    /** Human-readable outcome (validation/admission/enforcement reason). */
+    reason: string;
+    /** AST validation outcome (always present). */
+    validation: ScriptValidationResult;
+    /** Admission decision (present once validation passed). */
+    admission?: ScriptAdmissionDecision;
+    /** Content-addressed artifact manifest (present when deployed). */
+    artifact?: ArtifactRecordManifest;
+    /** Selected RuntimeClass (present when deployed). */
+    runtimeClass?: SandboxSelectionResult;
+    /** Deployment request referencing the artifact by digest (present when deployed). */
+    deployment?: RemoteDeploymentRequest;
+    /** Applied AgentWorkload (present when deployed through an orchestration facade). */
+    workload?: AgentWorkloadResource;
+}
+interface RemoteDeploymentWorkloadOptions {
+    /** Workload name (defaults to the content-addressed artifact name). */
+    name?: string;
+    namespace?: string;
+    ownerReferences?: OrchestrationOwnerReference[];
+}
+/**
+ * Translate a {@link RemoteDeploymentRequest} into an AgentWorkload manifest
+ * the binding controller (24.56) can schedule. The script declares placement
+ * and lifecycle; the scheduler — never the script — selects the node.
+ */
+declare function remoteDeploymentToWorkloadManifest(deployment: RemoteDeploymentRequest, options?: RemoteDeploymentWorkloadOptions): AgentWorkloadManifest;
+/**
+ * Run the full generated-script security chain and produce a remote
+ * deployment request. Never throws for script-content problems — invalid or
+ * inadmissible scripts yield `deployed: false` with a structured reason.
+ *
+ * Checkpoint compatibility (plan 24.19) is enforced here: when the caller
+ * expects to resume a checkpoint and admission found it incompatible, no
+ * deployment is produced (an explicit converter or restart policy would be
+ * required first).
+ */
+declare function deployGeneratedScript(request: ScriptDeploymentRequest, options?: ScriptDeploymentPipelineOptions): Promise<ScriptDeploymentResult>;
+/** Configuration for {@link createScriptLoadGate}. */
+interface ScriptLoadGateConfig {
+    /** Trust class to assign admitted scripts (plan 24.17). */
+    authorTrust: ScriptTrustClass;
+    /** Interfaces admitted scripts may request. */
+    requestedInterfaces: string[];
+    /** RuntimeClass names available for selection (defaults to all built-ins). */
+    availableRuntimeClasses?: string[];
+    /** Optional checkpoint digest admitted scripts expect to resume from. */
+    expectedCheckpointDigest?: string;
+    /** API version of the expected checkpoint (plan 24.19). */
+    checkpointApiVersion?: string;
+}
+/**
+ * Create the production {@link ScriptLoadGate}: every non-builtin source is
+ * validated (Acorn AST), admitted under the configured trust-class policy,
+ * and assigned a RuntimeClass before the loader is allowed to `import()` it.
+ * The gate verifies that the digest computed by the loader matches the
+ * digest of the source it validated, so the admitted bytes are exactly the
+ * imported bytes.
+ */
+declare function createScriptLoadGate(config: ScriptLoadGateConfig): ScriptLoadGate;
+/**
+ * Host-bound configuration for {@link createScriptDeploymentClient}.
+ * Trust and interface ceilings come from the host, never from the calling
+ * script — a script cannot elevate its own trust class or widen the
+ * interface set beyond what the host configured.
+ */
+interface ScriptDeploymentClientConfig {
+    /** Trust class the host assigns to deployments from this context. */
+    authorTrust: ScriptTrustClass;
+    /**
+     * Interface ceiling for deployments (defaults to the widest set
+     * admissible for `authorTrust`). Scripts may request a narrower subset;
+     * anything wider is rejected by admission.
+     */
+    requestedInterfaces?: string[];
+    /** RuntimeClass names available for selection (defaults to all built-ins). */
+    availableRuntimeClasses?: string[];
+    /** Artifact persistence port; when omitted manifests are built but not persisted. */
+    artifactStore?: ScriptArtifactStore;
+    /** Default namespace for produced ArtifactRecords and deployments. */
+    namespace?: string;
+    /**
+     * Orchestration facade. When present, `deploy` also applies an
+     * AgentWorkload so the scheduler binds a node (plan 24.14); when absent,
+     * `deploy` only produces the deployment request and the readiness/deletion
+     * methods reject with UNSUPPORTED.
+     */
+    orchestration?: AgentOrchestrationClient;
+    /** Field manager for applied workloads (default `memeloop/script-deployment`). */
+    fieldManager?: string;
+}
+/** Request a script makes through the deployment client. */
+interface ScriptDeploymentClientRequest {
+    /** Raw generated `.mjs` source (normalized internally). */
+    source: string;
+    /** Desired lifecycle for the remote workload. */
+    lifecycle: 'run-once' | 'service' | 'schedule';
+    /** Optional narrower interface subset (must stay within the host ceiling). */
+    requestedInterfaces?: string[];
+    /** Node selector for scheduling. */
+    nodeSelector?: Record<string, string>;
+    /** Environment variables (never credentials). */
+    env?: Record<string, string>;
+    /** Network attachment requirements for the deployed workload. */
+    networkPolicy?: AgentWorkloadNetworkPolicy;
+    /** Existing volume claims required by the deployed workload. */
+    storagePolicy?: AgentWorkloadStoragePolicy;
+    /** Optional checkpoint digest the script expects to resume from. */
+    expectedCheckpointDigest?: string;
+    /** API version of the expected checkpoint (plan 24.19). */
+    checkpointApiVersion?: string;
+    /** Namespace override (defaults to the configured namespace). */
+    namespace?: string;
+}
+/** Agent-facing handle for declarative script deployment (plan 24.14). */
+interface ScriptDeploymentClient {
+    /**
+     * Validate, admit, persist, and package a generated script as a
+     * {@link RemoteDeploymentRequest} referencing its ArtifactRecord by
+     * digest. When an orchestration facade is configured, also applies the
+     * AgentWorkload so the scheduler binds a node. Never throws for
+     * script-content problems — inadmissible scripts yield `deployed: false`
+     * with a structured reason.
+     */
+    deploy(request: ScriptDeploymentClientRequest): Promise<ScriptDeploymentResult>;
+    /**
+     * Wait until the scheduler has bound the deployment's workload
+     * (`Scheduled=True` condition written by the binding controller).
+     */
+    waitForScheduled(name: string, options?: WaitForConditionOptions & {
+        namespace?: string;
+    }): Promise<{
+        observedResourceVersion: string;
+        matched: true;
+    }>;
+    /** Delete the deployment's workload. */
+    deleteDeployment(name: string, namespace?: string): Promise<void>;
+}
+/**
+ * Create the Agent-facing deployment client injected into `.mjs` scripts
+ * as `ctx.scriptClient` (plan 24.14). The script declares placement and
+ * lifecycle; trust, interface ceilings, and persistence are bound by the
+ * host. The scheduler — not the script — selects the target node.
+ */
+declare function createScriptDeploymentClient(config: ScriptDeploymentClientConfig): ScriptDeploymentClient;
+
+export { type AgentRunCondition as $, type AgentFrameworkContext as A, type AgentClient as B, type ScriptDeploymentClient as C, type ToolApprovalConfig as D, type ApprovalDecision as E, type ToolApprovalRequest as F, type PromptConcatHookContext as G, type DefineToolAgentFrameworkContext as H, type IChatSyncAdapter as I, type PostProcessContext as J, type AIResponseContext as K, type LoopPlugin as L, type MemeLoopLogger as M, type PromptConcatHooks as N, AGENT_RUN_API_VERSION as O, type PromptConcatTool as P, AGENT_RUN_KIND as Q, AGENT_WORKLOAD_API_VERSION as R, type ScriptLoadGate as S, TOOL_PARAMETER_PARSE_ERROR_KEY as T, AGENT_WORKLOAD_KIND as U, type AIStreamResponseSubset as V, ARTIFACT_RECORD_API_VERSION as W, ARTIFACT_RECORD_KIND as X, AUDIT_RECORD_API_VERSION as Y, AUDIT_RECORD_KIND as Z, type AgentResponse as _, type AgentInstanceModel as a, type ControlStoreStatusUpdateOptions as a$, type AgentRunManifest as a0, type AgentRunResource as a1, type AgentRunSpec as a2, type AgentRunStatus as a3, type AgentSnapshotManifest as a4, type AgentSnapshotResource as a5, type AgentSnapshotSpec as a6, type AgentSnapshotStatus as a7, type AgentStatusContext as a8, type AgentTrustLevel as a9, type ArtifactRecordSpec as aA, type ArtifactRecordStatus as aB, type ArtifactReviewEvidence as aC, type ArtifactReviewKind as aD, type ArtifactTrust as aE, type AuditRecordManifest as aF, type AuditRecordResource as aG, type AuditRecordSpec as aH, BUILTIN_RUNTIME_CLASSES as aI, type BaseToolContext as aJ, CREDENTIAL_GRANT_API_VERSION as aK, CREDENTIAL_GRANT_KIND as aL, type CheckpointRecord as aM, type CheckpointStore as aN, type CheckpointSummary as aO, type ControlLeaseGrant as aP, type ControlLeaseIdentity as aQ, type ControlLeaseRequest as aR, type ControlStore as aS, type ControlStoreActor as aT, type ControlStoreApplyOptions as aU, type ControlStoreAuthorizationRequest as aV, type ControlStoreAuthorizer as aW, type ControlStoreCompactionResult as aX, type ControlStoreCreateOptions as aY, type ControlStoreHealth as aZ, type ControlStoreSnapshotResult as a_, type AgentVolumeClaimManifest as aa, type AgentVolumeClaimResource as ab, type AgentVolumeClaimSpec as ac, type AgentVolumeClaimStatus as ad, type AgentVolumeManifest as ae, type AgentVolumeReplicaStatus as af, type AgentVolumeResource as ag, type AgentVolumeSpec as ah, type AgentVolumeStatus as ai, type AgentWorkloadCompletionPolicy as aj, type AgentWorkloadCondition as ak, type AgentWorkloadCredentialPolicy as al, type AgentWorkloadManifest as am, type AgentWorkloadModelPolicy as an, type AgentWorkloadNetworkPolicy as ao, type AgentWorkloadPlacement as ap, type AgentWorkloadResource as aq, type AgentWorkloadResourceRequirements as ar, type AgentWorkloadSpec as as, type AgentWorkloadStatus as at, type AgentWorkloadStoragePolicy as au, type AgentWorkloadToolPolicy as av, type AgentWorkloadVolumeClaim as aw, type ArtifactDestination as ax, type ArtifactRecordManifest as ay, type ArtifactRecordResource as az, type AgentInstanceLatestStatus as b, type RuntimeClassSpec as b$, type ControlStoreVerb as b0, type CreateAgentRunOptions as b1, type CreateAgentWorkloadOptions as b2, type CredentialGrantManifest as b3, type CredentialGrantResource as b4, type CredentialGrantSpec as b5, type CredentialGrantStatus as b6, DRIVER_MANIFEST_API_VERSION as b7, DRIVER_MANIFEST_KIND as b8, type DataClassification as b9, type ModelEndpointStatus as bA, type ModelModality as bB, NETWORK_ATTACHMENT_API_VERSION as bC, NETWORK_ATTACHMENT_KIND as bD, NETWORK_CLASS_API_VERSION as bE, NETWORK_CLASS_KIND as bF, type NetworkAttachmentManifest as bG, type NetworkAttachmentResource as bH, type NetworkAttachmentSpec as bI, type NetworkAttachmentStatus as bJ, type NetworkClassManifest as bK, type NetworkClassResource as bL, type NetworkClassSpec as bM, type NetworkClassStatus as bN, type NetworkEgressRule as bO, type NodeTrustClass as bP, POLICY_DECISION_API_VERSION as bQ, POLICY_DECISION_KIND as bR, type PersistedPolicyDecisionKind as bS, type PolicyDecisionManifest as bT, type PolicyDecisionResource as bU, type PolicyDecisionSpec as bV, type PolicyDecisionStatus as bW, type RemoteDeploymentRequest as bX, type RemoteDeploymentResult as bY, type RemoteDeploymentWorkloadOptions as bZ, type RuntimeClassResource as b_, type DriverManifestConformance as ba, type DriverManifestManifest as bb, type DriverManifestResource as bc, type DriverManifestSpec as bd, type DriverManifestStatus as be, type FrameworkPluginToolConfig as bf, type HookSlot as bg, type InfrastructureDriverType as bh, MODEL_CALL_RECORD_API_VERSION as bi, MODEL_CALL_RECORD_KIND as bj, MODEL_CLASS_API_VERSION as bk, MODEL_CLASS_KIND as bl, MODEL_ENDPOINT_API_VERSION as bm, MODEL_ENDPOINT_KIND as bn, type ModelCallRecordManifest as bo, type ModelCallRecordResource as bp, type ModelCallRecordSpec as bq, type ModelCallRecordStatus as br, type ModelClassCapabilities as bs, type ModelClassManifest as bt, type ModelClassResource as bu, type ModelClassSpec as bv, type ModelClassStatus as bw, type ModelEndpointManifest as bx, type ModelEndpointResource as by, type ModelEndpointSpec as bz, type AgentInstanceState as c, VOLUME_CLAIM_API_VERSION as c$, SECURITY_PROFILE_API_VERSION as c0, SECURITY_PROFILE_KIND as c1, SNAPSHOT_API_VERSION as c2, SNAPSHOT_KIND as c3, STORAGE_CLASS_API_VERSION as c4, STORAGE_CLASS_KIND as c5, type SandboxSelectionResult as c6, type ScriptAdmissionDecision as c7, type ScriptAdmissionRequest as c8, type ScriptArtifactReference as c9, type ToolAdmissionAction as cA, type ToolAdmissionPolicy as cB, type ToolAdmissionRule as cC, type ToolApprovalMode as cD, type ToolClassManifest as cE, type ToolClassResource as cF, type ToolClassSchema as cG, type ToolClassSpec as cH, type ToolClassStatus as cI, type ToolExecutionContext as cJ, type ToolExecutorCapability as cK, type ToolExecutorManifest as cL, type ToolExecutorResource as cM, type ToolExecutorSpec as cN, type ToolExecutorStatus as cO, type ToolOperationApprovalEvidence as cP, type ToolOperationManifest as cQ, type ToolOperationPolicy as cR, type ToolOperationResource as cS, type ToolOperationResult as cT, type ToolOperationRetryPolicy as cU, type ToolOperationSpec as cV, type ToolOperationStatus as cW, type ToolOperationToolReference as cX, type ToolRiskLevel as cY, type UserMessageContext as cZ, VOLUME_API_VERSION as c_, type ScriptArtifactStore as ca, type ScriptDeploymentClientConfig as cb, type ScriptDeploymentClientRequest as cc, type ScriptDeploymentPipelineOptions as cd, type ScriptDeploymentRequest as ce, type ScriptDeploymentResult as cf, type ScriptLoadGateConfig as cg, type ScriptTrustClass as ch, type ScriptValidationResult as ci, type SecurityProfileManifest as cj, type SecurityProfileResource as ck, type SecurityProfileSpec as cl, type SecurityProfileStatus as cm, SessionStorage as cn, type StorageClassManifest as co, type StorageClassResource as cp, type StorageClassSpec as cq, type StorageClassStatus as cr, TOOL_CLASS_API_VERSION as cs, TOOL_CLASS_KIND as ct, TOOL_EXECUTOR_API_VERSION as cu, TOOL_EXECUTOR_KIND as cv, TOOL_OPERATION_API_VERSION as cw, TOOL_OPERATION_KIND as cx, type TapAsyncHandler as cy, type ToolActions as cz, type AgentLoopDefinition as d, selectRuntimeClass as d$, VOLUME_CLAIM_KIND as d0, VOLUME_KIND as d1, type VolumeAccessMode as d2, type WaitForConditionOptions as d3, type YieldNextRoundTarget as d4, admitScript as d5, agentRunReference as d6, agentWorkloadReference as d7, canonicalControlStoreValue as d8, controlStoreApplyMatches as d9, deployGeneratedScript as dA, digestNormalizedScript as dB, isAgentRun as dC, isAgentWorkload as dD, isArtifactRecord as dE, isAuditRecord as dF, isCredentialGrant as dG, isDriverManifest as dH, isDriverManifestAdmitted as dI, isModelCallRecord as dJ, isModelClass as dK, isModelEndpoint as dL, isNetworkAttachment as dM, isNetworkClass as dN, isPolicyDecision as dO, isSecurityProfile as dP, isSnapshot as dQ, isStorageClass as dR, isToolClass as dS, isToolExecutor as dT, isToolOperation as dU, isVolume as dV, isVolumeClaim as dW, maxScriptBytesForTrustClass as dX, normalizeScript as dY, parseCheckpointRecord as dZ, remoteDeploymentToWorkloadManifest as d_, createAgentClient as da, createAgentRunManifest as db, createAgentWorkloadManifest as dc, createArtifactRecordManifest as dd, createAuditRecordManifest as de, createCheckpointRecord as df, createCredentialGrantManifest as dg, createDriverManifestManifest as dh, createModelCallRecordManifest as di, createModelClassManifest as dj, createModelEndpointManifest as dk, createNetworkAttachmentManifest as dl, createNetworkClassManifest as dm, createPolicyDecisionManifest as dn, createScriptDeploymentClient as dp, createScriptLoadGate as dq, createSecurityProfileManifest as dr, createSnapshotManifest as ds, createStorageClassManifest as dt, createToolClassManifest as du, createToolExecutorManifest as dv, createToolOperationManifest as dw, createVolumeClaimManifest as dx, createVolumeManifest as dy, defaultRequestedInterfacesForTrustClass as dz, type AgentLoopGenerator as e, serializeCheckpointRecord as e0, validateScript as e1, waitForCondition as e2, InMemoryCheckpointStore as e3, type SessionStorageOptions as e4, type AgentLoopInput as f, type AgentLoopRuntime as g, type AgentLoopScriptPolicy as h, type AgentLoopStep as i, type AgentToolLoopOptions as j, type ILLMProvider as k, type INetworkService as l, type IToolRegistry as m, type LoopProfile as n, type LoopProfilePluginEntry as o, type LoopProfilePrompt as p, type LoopProfileScriptReference as q, type LoopScriptCheckpointStore as r, type ScriptLoadGateDecision as s, type ScriptLoadGateRequest as t, createInstanceDeltaFromDefinition as u, isUserInitiatedConversation as v, type ToolCallingMatch as w, matchAllToolCallings as x, matchToolCalling as y, type ToolOperationEffect as z };