memeloop 0.0.1 → 0.1.1

package/dist/chunk-BGPU4RR7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/orchestration/resources.ts"],"sourcesContent":["import type { OrchestrationObjectMetadata, OrchestrationOwnerReference, OrchestrationResourceManifest, OrchestrationResourceStatus, OrchestrationTypeMeta } from './client.js';\nimport type { OrchestrationErrorData } from './errors.js';\n\nexport const AGENT_WORKLOAD_API_VERSION = 'workload.memeloop.io/v1alpha1';\nexport const AGENT_WORKLOAD_KIND = 'AgentWorkload';\n\nexport const AGENT_RUN_API_VERSION = 'run.memeloop.io/v1alpha1';\nexport const AGENT_RUN_KIND = 'AgentRun';\n\n/**\n * Host-asserted trust classification of a node or workload. The trust class\n * is bound by the host; it is never self-reported by the workload, the model,\n * or a `.mjs` script.\n */\nexport type NodeTrustClass = 'trusted' | 'restricted' | 'quarantine';\n\nexport type AgentTrustLevel = NodeTrustClass;\n\n/** Ordered data classifications; higher ranks are more sensitive. */\nexport type DataClassification = 'public' | 'internal' | 'confidential' | 'restricted';\n\nexport type ToolAdmissionAction = 'allow' | 'deny' | 'require-approval';\n\n/**\n * Declarative trusted-admission rule. Rules are evaluated in order; the first\n * matching rule wins (firewall semantics). A rule matches when `toolPattern`\n * matches the tool reference name and either `effects` is omitted (all\n * effects) or contains the operation effect.\n */\nexport interface ToolAdmissionRule {\n  toolPattern: string;\n  effects?: ToolOperationEffect[];\n  action: ToolAdmissionAction;\n  reason?: string;\n}\n\nexport interface ToolAdmissionPolicy {\n  /** Applied when no rule matches. Restricted/quarantine profiles resolve to `deny` regardless of this field. */\n  defaultAction: ToolAdmissionAction;\n  rules?: ToolAdmissionRule[];\n}\n\nexport interface AgentWorkloadModelPolicy {\n  modelClass?: string;\n  allowedModelNames?: string[];\n  budget?: {\n    maxTokens?: number;\n    maxCost?: number;\n  };\n}\n\nexport interface AgentWorkloadToolPolicy {\n  allowedToolClasses?: string[];\n  /** Tool classes that must have a healthy executor on the selected node. */\n  requiredToolClasses?: string[];\n  allowedToolIds?: string[];\n  defaultAction?: 'allow' | 'ask' | 'deny';\n  rules?: Array<{ pattern: string; action: 'allow' | 'ask' | 'deny' }>;\n}\n\nexport interface AgentWorkloadNetworkPolicy {\n  networkClass?: string;\n  egress?: 'none' | 'same-node' | 'restricted' | 'open';\n  /** Minimum boundary that must enforce this policy before the workload binds. */\n  minimumEnforcement?: 'none' | 'process' | 'namespace' | 'host' | 'external';\n}\n\nexport interface AgentWorkloadVolumeClaim {\n  name: string;\n  claimRef: string;\n}\n\nexport interface AgentWorkloadStoragePolicy {\n  storageClass?: string;\n  volumes?: AgentWorkloadVolumeClaim[];\n}\n\nexport interface AgentWorkloadCredentialPolicy {\n  /** Credential broker class required on the selected node. */\n  brokerClass?: string;\n  /** Audiences for which the node must be able to request scoped grants. */\n  audiences?: string[];\n  /** Target classes for which scoped grants may be issued. */\n  targets?: string[];\n}\n\nexport interface AgentWorkloadResourceRequirements {\n  cpuMillicores?: number;\n  memoryBytes?: number;\n  gpuCount?: number;\n  diskBytes?: number;\n  bandwidthKbps?: number;\n}\n\nexport interface AgentWorkloadPlacement {\n  /**\n   * Registered external-orchestrator driver name. When set, the external\n   * orchestration controller owns placement and the local node binder skips\n   * this workload. External placement is always explicit; there is no silent\n   * spillover from the local runtime.\n   */\n  orchestrator?: string;\n  nodeSelector?: Record<string, string>;\n  requiredNode?: string;\n  antiAffinity?: string[];\n  /** Soft co-location preference; never overrides a hard security filter. */\n  preferredNode?: string;\n  /** Taints the workload tolerates. Nodes with taints not listed here are filtered out. */\n  tolerations?: string[];\n  /**\n   * Maximum data classification the workload may carry. Nodes with a lower\n   * `maxDataClassification` than the workload's effective classification are\n   * filtered out. Quarantine nodes are always treated as `public`-only.\n   */\n  dataClassification?: DataClassification;\n  /** Allowed residency labels (for example `local`, `cn`, or `eu-west`). */\n  dataResidency?: string[];\n  /** Require a currently verified node attestation. */\n  requireAttestation?: boolean;\n  /** Fleet batch constraints enforced before a target binds. */\n  rollout?: {\n    batchId: string;\n    excludedFaultDomains?: string[];\n    maxConcurrentPerFaultDomain?: number;\n  };\n}\n\nexport type AgentWorkloadCompletionPolicy = 'complete' | 'detach' | 'daemon';\n\nexport interface AgentWorkloadSpec {\n  profileId?: string;\n  scriptReference?: string;\n  promptReference?: string;\n  trust?: AgentTrustLevel;\n  /** RuntimeClass selected for script workloads (plan 24.18); declarative only. */\n  runtimeClass?: string;\n  /**\n   * Non-secret environment variables for the workload (plan 24.14 `env`).\n   * Secret-shaped values are rejected at admission (deployGeneratedScript)\n   * and stripped again at launch (plan 24.35), so specs persisted in the\n   * ControlStore never carry provider keys.\n   */\n  env?: Record<string, string>;\n  /** Name of a SecurityProfile resource governing admission and model access. */\n  securityProfileRef?: string;\n  placement?: AgentWorkloadPlacement;\n  modelPolicy?: AgentWorkloadModelPolicy;\n  toolPolicy?: AgentWorkloadToolPolicy;\n  networkPolicy?: AgentWorkloadNetworkPolicy;\n  storagePolicy?: AgentWorkloadStoragePolicy;\n  credentialPolicy?: AgentWorkloadCredentialPolicy;\n  resources?: AgentWorkloadResourceRequirements;\n  /** Content-addressed artifacts whose locality may influence placement. */\n  artifactReferences?: string[];\n  /** Durable checkpoint whose locality may influence placement. */\n  checkpointReference?: string;\n  completionPolicy?: AgentWorkloadCompletionPolicy;\n  ownerReferences?: OrchestrationOwnerReference[];\n}\n\nexport interface AgentWorkloadStatus extends OrchestrationResourceStatus {\n  phase?: 'Pending' | 'Scheduling' | 'Running' | 'Completed' | 'Failed';\n  /** Node the binding controller scheduled this workload onto. */\n  assignedNode?: string;\n  /** Durable trusted policy decision that authorized the current binding. */\n  placementDecisionRef?: string;\n  /** Policy snapshot digest bound to placementDecisionRef. */\n  placementPolicyDigest?: string;\n  /** External driver selected for this workload, when any. */\n  assignedDriver?: string;\n  /** Opaque native workload identifier returned by the external driver. */\n  externalId?: string;\n  /** Non-secret, string-only backend metadata used for diagnostics/adoption. */\n  externalMetadata?: Record<string, string>;\n  runs?: Array<{\n    apiVersion: string;\n    kind: string;\n    name?: string;\n    namespace?: string;\n    uid?: string;\n  }>;\n  lastRunResult?: string;\n}\n\nexport interface AgentWorkloadCondition {\n  type: string;\n  status: 'True' | 'False' | 'Unknown';\n}\n\nexport type AgentWorkloadManifest = OrchestrationResourceManifest<AgentWorkloadSpec>;\n\nexport interface AgentWorkloadResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: AgentWorkloadSpec;\n  status?: AgentWorkloadStatus;\n}\n\nexport interface AgentRunSpec {\n  workloadRef: {\n    apiVersion: string;\n    kind: string;\n    name?: string;\n    namespace?: string;\n    uid?: string;\n  };\n  promptReference?: string;\n  retry?: number;\n  timeoutMs?: number;\n}\n\nexport interface AgentRunStatus extends OrchestrationResourceStatus {\n  phase?: 'Pending' | 'Starting' | 'Running' | 'Completed' | 'Failed' | 'Cancelled';\n  /**\n   * Durable claim written before invoking a LoopRuntimeDriver. A different\n   * daemon instance that observes Starting/Running must adopt through a\n   * managed driver or fail UNKNOWN_EFFECT; it must never blindly start again.\n   */\n  runtimeExecutionClaim?: {\n    controllerInstanceId: string;\n    claimedAt: string;\n  };\n  /** Independently selected serving endpoint for this run's model calls. */\n  assignedModelEndpoint?: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n    namespace?: string;\n    uid: string;\n  };\n  /** Fences the model binding decision to the controller leadership epoch. */\n  modelBinding?: {\n    leaseEpoch: string;\n    endpointResourceVersion: string;\n    boundAt: string;\n  };\n  /** NetworkAttachment that must reach Attached before this run starts. */\n  networkAttachmentRef?: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n    namespace?: string;\n    uid: string;\n  };\n  volumePhase?: 'Pending' | 'Publishing' | 'Ready' | 'Releasing' | 'Released' | 'Failed';\n  volumePublishClaim?: {\n    leaseEpoch: string;\n    claimedAt: string;\n  };\n  volumeBindings?: Array<{\n    name: string;\n    claimRef: { name: string; uid: string };\n    volumeRef: { name: string; uid: string };\n    assignedDriver: string;\n    assignedNode: string;\n    /** Managed node-stage handle used for ordered publish cleanup. */\n    stageHandle?: string;\n    publishHandle: string;\n    readOnly: boolean;\n  }>;\n  volumeReleaseRequestedAt?: string;\n  volumeError?: OrchestrationErrorData;\n  outputReference?: string;\n  summary?: string;\n  exitCode?: number;\n}\n\nexport interface AgentRunCondition {\n  type: string;\n  status: 'True' | 'False' | 'Unknown';\n}\n\nexport type AgentRunManifest = OrchestrationResourceManifest<AgentRunSpec>;\n\nexport interface AgentRunResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: AgentRunSpec;\n  status?: AgentRunStatus;\n}\n\nexport function createAgentWorkloadManifest(name: string, spec: AgentWorkloadSpec): AgentWorkloadManifest {\n  return {\n    apiVersion: AGENT_WORKLOAD_API_VERSION,\n    kind: AGENT_WORKLOAD_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function createAgentRunManifest(name: string, spec: AgentRunSpec): AgentRunManifest {\n  return {\n    apiVersion: AGENT_RUN_API_VERSION,\n    kind: AGENT_RUN_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isAgentWorkload(resource: { apiVersion?: string; kind?: string }): resource is AgentWorkloadResource {\n  return resource.apiVersion === AGENT_WORKLOAD_API_VERSION && resource.kind === AGENT_WORKLOAD_KIND;\n}\n\nexport function isAgentRun(resource: { apiVersion?: string; kind?: string }): resource is AgentRunResource {\n  return resource.apiVersion === AGENT_RUN_API_VERSION && resource.kind === AGENT_RUN_KIND;\n}\n\nexport function agentWorkloadReference(name: string, namespace?: string): {\n  apiVersion: string;\n  kind: string;\n  name: string;\n  namespace?: string;\n} {\n  return {\n    apiVersion: AGENT_WORKLOAD_API_VERSION,\n    kind: AGENT_WORKLOAD_KIND,\n    name,\n    namespace,\n  };\n}\n\nexport const TOOL_OPERATION_API_VERSION = 'execution.memeloop.io/v1alpha1';\nexport const TOOL_OPERATION_KIND = 'ToolOperation';\n\nexport type ToolOperationEffect = 'read' | 'create' | 'update' | 'delete' | 'execute' | 'unknown';\n\nexport interface ToolOperationToolReference {\n  apiVersion?: string;\n  kind: string;\n  name: string;\n  namespace?: string;\n  /** Expected input/output schema digest; executors with another digest are rejected. */\n  schemaDigest?: string;\n}\n\nexport interface ToolOperationRetryPolicy {\n  maxAttempts?: number;\n  nonRetryable?: boolean;\n  fencingToken?: string;\n}\n\nexport interface ToolOperationPolicy {\n  requireApproval?: boolean;\n  auditLevel?: 'none' | 'metadata' | 'payload';\n}\n\nexport interface ToolOperationSpec {\n  toolRef: ToolOperationToolReference;\n  arguments?: Record<string, unknown>;\n  effect: ToolOperationEffect;\n  idempotencyKey?: string;\n  timeoutMs?: number;\n  retry?: ToolOperationRetryPolicy;\n  policy?: ToolOperationPolicy;\n  /** Explicit registered external-orchestrator driver selection. */\n  placement?: {\n    orchestrator?: string;\n    requiredNode?: string;\n    preferredNode?: string;\n    nodeSelector?: Record<string, string>;\n    minimumTrust?: NodeTrustClass;\n  };\n}\n\nexport interface ToolOperationResult {\n  value?: unknown;\n  error?: OrchestrationErrorData;\n  evidenceRef?: string;\n}\n\nexport interface ToolOperationApprovalEvidence {\n  approvalId: string;\n  decision: 'allow' | 'deny';\n  /** Trusted human/service identity. Model-provided identities are invalid. */\n  actor: string;\n  decidedAt: string;\n  reason?: string;\n}\n\nexport interface ToolOperationStatus extends OrchestrationResourceStatus {\n  phase?: 'Pending' | 'Running' | 'Completed' | 'Failed' | 'Cancelled';\n  result?: ToolOperationResult;\n  attempts?: number;\n  startedAt?: string;\n  completedAt?: string;\n  /** Trusted approval evidence returned by the host-bound approval driver. */\n  approval?: ToolOperationApprovalEvidence;\n  assignedDriver?: string;\n  assignedNode?: string;\n  assignedExecutor?: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n    namespace?: string;\n    uid?: string;\n  };\n  /**\n   * Durable claim written before a local effect starts. A different fencing\n   * epoch observing Running must reconcile unknown effect instead of blindly\n   * repeating the operation.\n   */\n  executionClaim?: {\n    leaseEpoch: string;\n    claimedAt: string;\n  };\n  externalId?: string;\n  externalMetadata?: Record<string, string>;\n}\n\nexport type ToolOperationManifest = OrchestrationResourceManifest<ToolOperationSpec>;\n\nexport interface ToolOperationResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: ToolOperationSpec;\n  status?: ToolOperationStatus;\n}\n\nexport function createToolOperationManifest(name: string, spec: ToolOperationSpec): ToolOperationManifest {\n  return {\n    apiVersion: TOOL_OPERATION_API_VERSION,\n    kind: TOOL_OPERATION_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isToolOperation(resource: { apiVersion?: string; kind?: string }): resource is ToolOperationResource {\n  return resource.apiVersion === TOOL_OPERATION_API_VERSION && resource.kind === TOOL_OPERATION_KIND;\n}\n\nexport function agentRunReference(name: string, namespace?: string): {\n  apiVersion: string;\n  kind: string;\n  name: string;\n  namespace?: string;\n} {\n  return {\n    apiVersion: AGENT_RUN_API_VERSION,\n    kind: AGENT_RUN_KIND,\n    name,\n    namespace,\n  };\n}\n\nexport const TOOL_CLASS_API_VERSION = 'tool.memeloop.io/v1alpha1';\nexport const TOOL_CLASS_KIND = 'ToolClass';\n\nexport const TOOL_EXECUTOR_API_VERSION = 'tool.memeloop.io/v1alpha1';\nexport const TOOL_EXECUTOR_KIND = 'ToolExecutor';\n\nexport type ToolRiskLevel = 'none' | 'low' | 'medium' | 'high' | 'critical';\n\nexport interface ToolClassSchema {\n  input: Record<string, unknown>;\n  output?: Record<string, unknown>;\n  required?: string[];\n}\n\nexport interface ToolClassSpec {\n  description?: string;\n  version?: string;\n  schema: ToolClassSchema;\n  schemaDigest?: string;\n  risk?: ToolRiskLevel;\n  effects?: ToolOperationEffect[];\n  allowedTargets?: string[];\n  categories?: string[];\n}\n\nexport interface ToolClassStatus extends OrchestrationResourceStatus {\n  endpointCount?: number;\n  healthyEndpointCount?: number;\n}\n\nexport type ToolClassManifest = OrchestrationResourceManifest<ToolClassSpec>;\n\nexport interface ToolClassResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: ToolClassSpec;\n  status?: ToolClassStatus;\n}\n\nexport interface ToolExecutorCapability {\n  toolClassRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n  };\n  schemaDigest: string;\n  effects?: ToolOperationEffect[];\n  endpoint: string;\n  capacity?: {\n    maxConcurrent?: number;\n    queueDepth?: number;\n  };\n  health?: {\n    lastHeartbeat?: string;\n    healthy: boolean;\n  };\n}\n\nexport interface ToolExecutorSpec {\n  nodeId?: string;\n  selectors?: Record<string, string>;\n  capabilities: ToolExecutorCapability[];\n  trust?: 'trusted' | 'restricted' | 'quarantine';\n}\n\nexport interface ToolExecutorStatus extends OrchestrationResourceStatus {\n  heartbeat?: string;\n  healthy?: boolean;\n}\n\nexport type ToolExecutorManifest = OrchestrationResourceManifest<ToolExecutorSpec>;\n\nexport interface ToolExecutorResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: ToolExecutorSpec;\n  status?: ToolExecutorStatus;\n}\n\nexport function createToolClassManifest(name: string, spec: ToolClassSpec): ToolClassManifest {\n  return {\n    apiVersion: TOOL_CLASS_API_VERSION,\n    kind: TOOL_CLASS_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function createToolExecutorManifest(name: string, spec: ToolExecutorSpec): ToolExecutorManifest {\n  return {\n    apiVersion: TOOL_EXECUTOR_API_VERSION,\n    kind: TOOL_EXECUTOR_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isToolClass(resource: { apiVersion?: string; kind?: string }): resource is ToolClassResource {\n  return resource.apiVersion === TOOL_CLASS_API_VERSION && resource.kind === TOOL_CLASS_KIND;\n}\n\nexport function isToolExecutor(resource: { apiVersion?: string; kind?: string }): resource is ToolExecutorResource {\n  return resource.apiVersion === TOOL_EXECUTOR_API_VERSION && resource.kind === TOOL_EXECUTOR_KIND;\n}\n\nexport const MODEL_CLASS_API_VERSION = 'models.memeloop.io/v1alpha1';\nexport const MODEL_CLASS_KIND = 'ModelClass';\n\nexport const MODEL_ENDPOINT_API_VERSION = 'models.memeloop.io/v1alpha1';\nexport const MODEL_ENDPOINT_KIND = 'ModelEndpoint';\n\nexport const MODEL_CALL_RECORD_API_VERSION = 'models.memeloop.io/v1alpha1';\nexport const MODEL_CALL_RECORD_KIND = 'ModelCallRecord';\n\nexport type ModelModality = 'text' | 'vision' | 'audio' | 'embedding';\n\nexport interface ModelClassCapabilities {\n  streaming?: boolean;\n  toolUse?: boolean;\n  jsonMode?: boolean;\n  systemPrompt?: boolean;\n}\n\n/**\n * Declarative model catalog entry. Carries identity, digest, capabilities,\n * residency, and cost metadata only — raw provider SDK clients, base URLs with\n * embedded credentials, and API keys must never appear here.\n */\nexport interface ModelClassSpec {\n  description?: string;\n  /** Provider family identifier, e.g. `openai`, `anthropic`, `ollama`. */\n  provider: string;\n  /** Provider model name, e.g. `gpt-4o-mini`, `qwen2.5:7b`. */\n  model: string;\n  version?: string;\n  /** Content digest: local weights hash or provider snapshot identifier. */\n  digest?: string;\n  modalities?: ModelModality[];\n  contextWindow?: number;\n  maxOutputTokens?: number;\n  capabilities?: ModelClassCapabilities;\n  /** `local`, `cloud`, or a region/zone label constraining data residency. */\n  dataResidency?: string;\n  cost?: {\n    inputPerMillion?: number;\n    outputPerMillion?: number;\n    currency?: string;\n  };\n}\n\nexport interface ModelClassStatus extends OrchestrationResourceStatus {\n  endpointCount?: number;\n  healthyEndpointCount?: number;\n}\n\nexport type ModelClassManifest = OrchestrationResourceManifest<ModelClassSpec>;\n\nexport interface ModelClassResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: ModelClassSpec;\n  status?: ModelClassStatus;\n}\n\n/**\n * Schedulable model serving endpoint. The endpoint string is an opaque driver\n * handle (e.g. `ollama://node-1/qwen2.5:7b` or `gateway://default`) and must\n * not embed credentials.\n */\nexport interface ModelEndpointSpec {\n  modelClassRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n  };\n  /** Must match the referenced ModelClass digest for schedulability. */\n  modelDigest?: string;\n  nodeId?: string;\n  trust?: 'trusted' | 'restricted' | 'quarantine';\n  endpoint: string;\n  capacity?: {\n    maxConcurrent?: number;\n    tokensPerMinute?: number;\n  };\n  dataPolicy?: {\n    classification?: string;\n    retention?: string;\n  };\n}\n\nexport interface ModelEndpointStatus extends OrchestrationResourceStatus {\n  healthy?: boolean;\n  heartbeat?: string;\n  activeCalls?: number;\n}\n\nexport type ModelEndpointManifest = OrchestrationResourceManifest<ModelEndpointSpec>;\n\nexport interface ModelEndpointResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: ModelEndpointSpec;\n  status?: ModelEndpointStatus;\n}\n\n/**\n * Audit and usage record for a single model call. Records carry usage and\n * classification metadata, never raw prompts, completions, or credentials.\n */\nexport interface ModelCallRecordSpec {\n  modelClassRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n  };\n  /** Immutable model artifact/provider snapshot selected for this call. */\n  modelDigest?: string;\n  endpointRef?: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n  };\n  runRef?: OrchestrationOwnerReference;\n  /** Immutable attempt number from the authorizing ModelAccessHandle. */\n  runAttempt?: number;\n  /** Bound actor identity asserted by the host, not self-reported. */\n  caller?: string;\n  /** Name of the ModelAccessHandle authorizing this call. */\n  accessHandleRef?: string;\n  /** Admission/policy snapshot bound into the authorizing handle. */\n  policyDigest?: string;\n  inputClassification?: string;\n  outputClassification?: string;\n}\n\nexport interface ModelCallRecordStatus extends OrchestrationResourceStatus {\n  phase?: 'Running' | 'Completed' | 'Failed' | 'Cancelled';\n  usage?: {\n    inputTokens?: number;\n    outputTokens?: number;\n    cost?: number;\n    currency?: string;\n  };\n  latencyMs?: number;\n  startedAt?: string;\n  completedAt?: string;\n  error?: OrchestrationErrorData;\n}\n\nexport type ModelCallRecordManifest = OrchestrationResourceManifest<ModelCallRecordSpec>;\n\nexport interface ModelCallRecordResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: ModelCallRecordSpec;\n  status?: ModelCallRecordStatus;\n}\n\nexport function createModelClassManifest(name: string, spec: ModelClassSpec): ModelClassManifest {\n  return {\n    apiVersion: MODEL_CLASS_API_VERSION,\n    kind: MODEL_CLASS_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function createModelEndpointManifest(name: string, spec: ModelEndpointSpec): ModelEndpointManifest {\n  return {\n    apiVersion: MODEL_ENDPOINT_API_VERSION,\n    kind: MODEL_ENDPOINT_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function createModelCallRecordManifest(name: string, spec: ModelCallRecordSpec): ModelCallRecordManifest {\n  return {\n    apiVersion: MODEL_CALL_RECORD_API_VERSION,\n    kind: MODEL_CALL_RECORD_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isModelClass(resource: { apiVersion?: string; kind?: string }): resource is ModelClassResource {\n  return resource.apiVersion === MODEL_CLASS_API_VERSION && resource.kind === MODEL_CLASS_KIND;\n}\n\nexport function isModelEndpoint(resource: { apiVersion?: string; kind?: string }): resource is ModelEndpointResource {\n  return resource.apiVersion === MODEL_ENDPOINT_API_VERSION && resource.kind === MODEL_ENDPOINT_KIND;\n}\n\nexport function isModelCallRecord(resource: { apiVersion?: string; kind?: string }): resource is ModelCallRecordResource {\n  return resource.apiVersion === MODEL_CALL_RECORD_API_VERSION && resource.kind === MODEL_CALL_RECORD_KIND;\n}\n\nexport const SECURITY_PROFILE_API_VERSION = 'security.memeloop.io/v1alpha1';\nexport const SECURITY_PROFILE_KIND = 'SecurityProfile';\n\n/**\n * Reusable security posture referenced by workloads. The profile is applied\n * by trusted admission, never by the workload itself: for restricted and\n * quarantine trust classes the resolved tool-admission default is forced to\n * `deny` regardless of `toolAdmission.defaultAction`.\n */\nexport interface SecurityProfileSpec {\n  description?: string;\n  /** Trust class this profile applies to. */\n  trustClass: NodeTrustClass;\n  /** Tool admission overlay merged over the trust-class default policy. */\n  toolAdmission?: ToolAdmissionPolicy;\n  /** Model access constraints for workloads under this profile. */\n  modelPolicy?: {\n    allowedModelClasses?: string[];\n    maxInputClassification?: DataClassification;\n  };\n}\n\nexport interface SecurityProfileStatus extends OrchestrationResourceStatus {\n  /** Number of workloads currently referencing this profile. */\n  workloadCount?: number;\n}\n\nexport type SecurityProfileManifest = OrchestrationResourceManifest<SecurityProfileSpec>;\n\nexport interface SecurityProfileResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: SecurityProfileSpec;\n  status?: SecurityProfileStatus;\n}\n\nexport function createSecurityProfileManifest(name: string, spec: SecurityProfileSpec): SecurityProfileManifest {\n  return {\n    apiVersion: SECURITY_PROFILE_API_VERSION,\n    kind: SECURITY_PROFILE_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isSecurityProfile(resource: { apiVersion?: string; kind?: string }): resource is SecurityProfileResource {\n  return resource.apiVersion === SECURITY_PROFILE_API_VERSION && resource.kind === SECURITY_PROFILE_KIND;\n}\n\nexport const POLICY_DECISION_API_VERSION = 'security.memeloop.io/v1alpha1';\nexport const POLICY_DECISION_KIND = 'PolicyDecision';\n\nexport type PersistedPolicyDecisionKind =\n  | 'resource-admission'\n  | 'placement'\n  | 'tool-operation'\n  | 'approval'\n  | 'transition';\n\n/** Immutable decision evidence; only a pending approval's status may resolve. */\nexport interface PolicyDecisionSpec {\n  subjectRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n    namespace?: string;\n    uid: string;\n    generation: number;\n  };\n  decisionKind: PersistedPolicyDecisionKind;\n  policyDigest: string;\n  inputDigest: string;\n  requestFingerprint: string;\n  idempotencyKey: string;\n  fencingEpoch: number;\n  requestedBy: string;\n  reasons: string[];\n  obligations: string[];\n  decidedAt: string;\n  initialOutcome: 'allow' | 'deny' | 'pending';\n  approval?: {\n    subjectDigest: string;\n    requestedBy: string;\n    requestedAt: string;\n    expiresAt: string;\n  };\n}\n\nexport interface PolicyDecisionStatus extends OrchestrationResourceStatus {\n  outcome: 'allow' | 'deny' | 'pending';\n  decidedBy: string;\n  decidedAt: string;\n  reasons: string[];\n  resolutionInputDigest?: string;\n}\n\nexport type PolicyDecisionManifest = OrchestrationResourceManifest<PolicyDecisionSpec>;\n\nexport interface PolicyDecisionResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: PolicyDecisionSpec;\n  status?: PolicyDecisionStatus;\n}\n\nexport function createPolicyDecisionManifest(\n  name: string,\n  spec: PolicyDecisionSpec,\n): PolicyDecisionManifest {\n  return {\n    apiVersion: POLICY_DECISION_API_VERSION,\n    kind: POLICY_DECISION_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isPolicyDecision(\n  resource: { apiVersion?: string; kind?: string },\n): resource is PolicyDecisionResource {\n  return resource.apiVersion === POLICY_DECISION_API_VERSION &&\n    resource.kind === POLICY_DECISION_KIND;\n}\n\nexport const AUDIT_RECORD_API_VERSION = 'audit.memeloop.io/v1alpha1';\nexport const AUDIT_RECORD_KIND = 'AuditRecord';\n\n/**\n * Immutable, metadata-only audit/telemetry evidence. The record digest covers\n * every field except itself and links to the preceding record in the named\n * stream. Raw request/response bodies and credentials have no representation.\n */\nexport interface AuditRecordSpec {\n  stream: string;\n  sequence: number;\n  resourceUid: string;\n  recordKind: 'audit' | 'event' | 'metric' | 'trace';\n  receivedAt: string;\n  actor: {\n    id: string;\n    kind: 'controller' | 'verifier' | 'admin';\n  };\n  policyDigest: string;\n  capabilityDigest: string;\n  effect: 'read' | 'create' | 'update' | 'delete' | 'execute' | 'decision' | 'security';\n  provenance: {\n    source: 'controller' | 'gateway' | 'driver' | 'worker' | 'operator';\n    producer: string;\n    subject?: string;\n  };\n  attributes: Record<string, string>;\n  data:\n    | {\n      kind: 'audit';\n      action: string;\n      outcome: 'success' | 'denied' | 'failure';\n      reasonCode?: string;\n    }\n    | {\n      kind: 'event';\n      name: string;\n      severity: 'debug' | 'info' | 'warning' | 'error' | 'critical';\n    }\n    | {\n      kind: 'metric';\n      name: string;\n      value: number;\n      unit: string;\n    }\n    | {\n      kind: 'trace';\n      name: string;\n      traceId: string;\n      spanId: string;\n      durationMs: number;\n      status: 'ok' | 'error';\n    };\n  previousDigest?: string;\n  recordDigest: string;\n  requestFingerprint: string;\n  idempotencyDigest: string;\n  fencingEpoch: number;\n}\n\nexport type AuditRecordManifest = OrchestrationResourceManifest<AuditRecordSpec>;\n\nexport interface AuditRecordResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: AuditRecordSpec;\n  status?: OrchestrationResourceStatus;\n}\n\nexport function createAuditRecordManifest(\n  name: string,\n  spec: AuditRecordSpec,\n): AuditRecordManifest {\n  return {\n    apiVersion: AUDIT_RECORD_API_VERSION,\n    kind: AUDIT_RECORD_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isAuditRecord(\n  resource: { apiVersion?: string; kind?: string },\n): resource is AuditRecordResource {\n  return resource.apiVersion === AUDIT_RECORD_API_VERSION &&\n    resource.kind === AUDIT_RECORD_KIND;\n}\n\nexport const NETWORK_CLASS_API_VERSION = 'network.memeloop.io/v1alpha1';\nexport const NETWORK_CLASS_KIND = 'NetworkClass';\n\nexport const NETWORK_ATTACHMENT_API_VERSION = 'network.memeloop.io/v1alpha1';\nexport const NETWORK_ATTACHMENT_KIND = 'NetworkAttachment';\n\nexport interface NetworkEgressRule {\n  /** Host, domain suffix, or CIDR, e.g. `api.openai.com` or `10.0.0.0/8`. */\n  target: string;\n  ports?: number[];\n  protocol?: 'tcp' | 'udp' | 'http' | 'https' | 'any';\n  action: 'allow' | 'deny';\n}\n\n/**\n * CNI-like network desired state. `enforcement: required` means the workload\n * must not start unless the driver can enforce every configured feature;\n * `best-effort` allows partial enforcement with recorded degradation.\n */\nexport interface NetworkClassSpec {\n  description?: string;\n  /** NetworkDriver name responsible for this class. */\n  driver: string;\n  dns?: {\n    policy?: 'default' | 'none' | 'custom';\n    servers?: string[];\n    searchDomains?: string[];\n  };\n  proxy?: {\n    httpProxy?: string;\n    httpsProxy?: string;\n    noProxy?: string[];\n    /** When true, traffic bypassing the proxy must be blocked. */\n    mandatory?: boolean;\n  };\n  ingress?: {\n    defaultAction?: 'allow' | 'deny';\n    allow?: Array<{\n      from?: string;\n      ports?: number[];\n    }>;\n  };\n  egress?: {\n    defaultAction: 'allow' | 'deny';\n    rules?: NetworkEgressRule[];\n  };\n  serviceAccess?: {\n    allowControlPlane?: boolean;\n    allowClusterServices?: boolean;\n    allowModelGateway?: boolean;\n  };\n  bandwidth?: {\n    ingressKbps?: number;\n    egressKbps?: number;\n  };\n  dataPolicy?: {\n    classification?: DataClassification;\n    retention?: string;\n  };\n  enforcement: 'required' | 'best-effort';\n}\n\nexport interface NetworkClassStatus extends OrchestrationResourceStatus {\n  attachmentCount?: number;\n}\n\nexport type NetworkClassManifest = OrchestrationResourceManifest<NetworkClassSpec>;\n\nexport interface NetworkClassResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: NetworkClassSpec;\n  status?: NetworkClassStatus;\n}\n\nexport interface NetworkAttachmentSpec {\n  networkClassRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n  };\n  workloadRef?: OrchestrationOwnerReference;\n  /** Exact AgentRun whose sandbox and authority this attachment belongs to. */\n  runRef?: OrchestrationOwnerReference;\n  nodeId?: string;\n}\n\nexport interface NetworkAttachmentStatus extends OrchestrationResourceStatus {\n  phase?: 'Pending' | 'Preparing' | 'Attached' | 'Failed' | 'Detached';\n  /** Node and driver selected independently from workload execution. */\n  assignedNode?: string;\n  assignedDriver?: string;\n  /** Fences the placement decision and the NetworkClass version it validated. */\n  binding?: {\n    leaseEpoch: string;\n    networkClassResourceVersion: string;\n    boundAt: string;\n  };\n  /**\n   * Durable claim written before prepare() may create host-side state.\n   * A new lease epoch must not blindly repeat an unconfirmed prepare.\n   */\n  executionClaim?: {\n    leaseEpoch: string;\n    claimedAt: string;\n  };\n  /** Opaque driver handle; consumers must never parse it. */\n  handle?: string;\n  addresses?: string[];\n  routes?: string[];\n  dns?: {\n    servers?: string[];\n  };\n  /** Features the driver could not enforce under a best-effort class. */\n  degraded?: string[];\n  attachedAt?: string;\n  /** Set by the workload owner after execution; the node driver must release before Detached. */\n  releaseRequestedAt?: string;\n  detachedAt?: string;\n  error?: OrchestrationErrorData;\n}\n\nexport type NetworkAttachmentManifest = OrchestrationResourceManifest<NetworkAttachmentSpec>;\n\nexport interface NetworkAttachmentResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: NetworkAttachmentSpec;\n  status?: NetworkAttachmentStatus;\n}\n\nexport function createNetworkClassManifest(name: string, spec: NetworkClassSpec): NetworkClassManifest {\n  return {\n    apiVersion: NETWORK_CLASS_API_VERSION,\n    kind: NETWORK_CLASS_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function createNetworkAttachmentManifest(name: string, spec: NetworkAttachmentSpec): NetworkAttachmentManifest {\n  return {\n    apiVersion: NETWORK_ATTACHMENT_API_VERSION,\n    kind: NETWORK_ATTACHMENT_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isNetworkClass(resource: { apiVersion?: string; kind?: string }): resource is NetworkClassResource {\n  return resource.apiVersion === NETWORK_CLASS_API_VERSION && resource.kind === NETWORK_CLASS_KIND;\n}\n\nexport function isNetworkAttachment(resource: { apiVersion?: string; kind?: string }): resource is NetworkAttachmentResource {\n  return resource.apiVersion === NETWORK_ATTACHMENT_API_VERSION && resource.kind === NETWORK_ATTACHMENT_KIND;\n}\n\nexport const STORAGE_CLASS_API_VERSION = 'storage.memeloop.io/v1alpha1';\nexport const STORAGE_CLASS_KIND = 'StorageClass';\nexport const VOLUME_CLAIM_API_VERSION = 'storage.memeloop.io/v1alpha1';\nexport const VOLUME_CLAIM_KIND = 'AgentVolumeClaim';\nexport const VOLUME_API_VERSION = 'storage.memeloop.io/v1alpha1';\nexport const VOLUME_KIND = 'AgentVolume';\nexport const SNAPSHOT_API_VERSION = 'storage.memeloop.io/v1alpha1';\nexport const SNAPSHOT_KIND = 'AgentSnapshot';\n\nexport type VolumeAccessMode = 'ReadWriteOnce' | 'ReadOnlyMany' | 'ReadWriteMany';\n\n/** CSI-like storage class: provisioning and replication policy. */\nexport interface StorageClassSpec {\n  description?: string;\n  /** StorageDriver name responsible for this class. */\n  driver: string;\n  replication?: {\n    /** Desired replica count across fault domains (1 = no replication). */\n    factor?: number;\n    /** Fault-domain labels replicas must be spread across (e.g. `node`, `zone`). */\n    faultDomains?: string[];\n    /** Rebuild replicas automatically after loss. */\n    autoRebuild?: boolean;\n  };\n  encryption?: {\n    enabled?: boolean;\n    /** Reference to a key in the credential domain (never key material). */\n    keyRef?: string;\n  };\n  allowedAccessModes?: VolumeAccessMode[];\n  snapshotSupport?: boolean;\n  backup?: {\n    /** Cron-like schedule expression evaluated by the backup controller. */\n    schedule?: string;\n    retentionCount?: number;\n  };\n  dataPolicy?: {\n    classification?: DataClassification;\n    retention?: string;\n  };\n}\n\nexport interface StorageClassStatus extends OrchestrationResourceStatus {\n  volumeCount?: number;\n  healthyVolumeCount?: number;\n}\n\nexport type StorageClassManifest = OrchestrationResourceManifest<StorageClassSpec>;\n\nexport interface StorageClassResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: StorageClassSpec;\n  status?: StorageClassStatus;\n}\n\n/** PVC-like claim: a workload's request for storage. */\nexport interface AgentVolumeClaimSpec {\n  storageClassRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n  };\n  accessMode: VolumeAccessMode;\n  sizeBytes?: number;\n  selector?: Record<string, string>;\n  /** Restore from a snapshot when provisioning. */\n  dataSourceRef?: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n  };\n}\n\nexport interface AgentVolumeClaimStatus extends OrchestrationResourceStatus {\n  phase?: 'Pending' | 'Provisioning' | 'Bound' | 'Lost' | 'Failed';\n  assignedNode?: string;\n  assignedDriver?: string;\n  binding?: {\n    leaseEpoch: string;\n    storageClassResourceVersion: string;\n    boundAt: string;\n  };\n  provisionClaim?: {\n    leaseEpoch: string;\n    claimedAt: string;\n  };\n  volumeRef?: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n    uid?: string;\n  };\n  error?: OrchestrationErrorData;\n}\n\nexport type AgentVolumeClaimManifest = OrchestrationResourceManifest<AgentVolumeClaimSpec>;\n\nexport interface AgentVolumeClaimResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: AgentVolumeClaimSpec;\n  status?: AgentVolumeClaimStatus;\n}\n\nexport interface AgentVolumeReplicaStatus {\n  nodeId: string;\n  state: 'healthy' | 'degraded' | 'rebuilding' | 'offline';\n  /** Verified content hash of this replica (must equal the volume contentHash). */\n  contentHash?: string;\n  updatedAt?: string;\n}\n\n/** PV-like provisioned volume. `driverHandle` is opaque and never parsed by consumers. */\nexport interface AgentVolumeSpec {\n  storageClassRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n  };\n  claimRef?: OrchestrationOwnerReference;\n  /** Opaque driver handle for the provisioned volume. */\n  driverHandle: string;\n  capacityBytes?: number;\n  topology?: {\n    nodeId?: string;\n    zone?: string;\n  };\n  accessModes?: VolumeAccessMode[];\n}\n\nexport interface AgentVolumeStatus extends OrchestrationResourceStatus {\n  phase?: 'Pending' | 'Available' | 'Bound' | 'Published' | 'Failed';\n  replicas?: AgentVolumeReplicaStatus[];\n  /** Last verified content hash; the replication source of truth. */\n  contentHash?: string;\n  /** Current primary replica node; transfers originate only from the primary. */\n  primaryNodeId?: string;\n  /** Monotonically increasing fencing epoch, bumped on every primary change. */\n  primaryEpoch?: number;\n  publishedTo?: Array<{\n    nodeId?: string;\n    workloadRef?: OrchestrationOwnerReference;\n  }>;\n  health?: 'healthy' | 'degraded' | 'rebuilding' | 'failed';\n}\n\nexport type AgentVolumeManifest = OrchestrationResourceManifest<AgentVolumeSpec>;\n\nexport interface AgentVolumeResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: AgentVolumeSpec;\n  status?: AgentVolumeStatus;\n}\n\n/** Point-in-time snapshot of a volume; restorable into new claims. */\nexport interface AgentSnapshotSpec {\n  sourceVolumeRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n  };\n  snapshotClass?: string;\n}\n\nexport interface AgentSnapshotStatus extends OrchestrationResourceStatus {\n  phase?: 'Pending' | 'Ready' | 'Failed';\n  readyToUse?: boolean;\n  restoreSizeBytes?: number;\n  /** Opaque driver handle for the snapshot. */\n  driverHandle?: string;\n  createdAt?: string;\n}\n\nexport type AgentSnapshotManifest = OrchestrationResourceManifest<AgentSnapshotSpec>;\n\nexport interface AgentSnapshotResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: AgentSnapshotSpec;\n  status?: AgentSnapshotStatus;\n}\n\nexport function createStorageClassManifest(name: string, spec: StorageClassSpec): StorageClassManifest {\n  return {\n    apiVersion: STORAGE_CLASS_API_VERSION,\n    kind: STORAGE_CLASS_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function createVolumeClaimManifest(name: string, spec: AgentVolumeClaimSpec): AgentVolumeClaimManifest {\n  return {\n    apiVersion: VOLUME_CLAIM_API_VERSION,\n    kind: VOLUME_CLAIM_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function createVolumeManifest(name: string, spec: AgentVolumeSpec): AgentVolumeManifest {\n  return {\n    apiVersion: VOLUME_API_VERSION,\n    kind: VOLUME_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function createSnapshotManifest(name: string, spec: AgentSnapshotSpec): AgentSnapshotManifest {\n  return {\n    apiVersion: SNAPSHOT_API_VERSION,\n    kind: SNAPSHOT_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isStorageClass(resource: { apiVersion?: string; kind?: string }): resource is StorageClassResource {\n  return resource.apiVersion === STORAGE_CLASS_API_VERSION && resource.kind === STORAGE_CLASS_KIND;\n}\n\nexport function isVolumeClaim(resource: { apiVersion?: string; kind?: string }): resource is AgentVolumeClaimResource {\n  return resource.apiVersion === VOLUME_CLAIM_API_VERSION && resource.kind === VOLUME_CLAIM_KIND;\n}\n\nexport function isVolume(resource: { apiVersion?: string; kind?: string }): resource is AgentVolumeResource {\n  return resource.apiVersion === VOLUME_API_VERSION && resource.kind === VOLUME_KIND;\n}\n\nexport function isSnapshot(resource: { apiVersion?: string; kind?: string }): resource is AgentSnapshotResource {\n  return resource.apiVersion === SNAPSHOT_API_VERSION && resource.kind === SNAPSHOT_KIND;\n}\n\nexport const CREDENTIAL_GRANT_API_VERSION = 'security.memeloop.io/v1alpha1';\nexport const CREDENTIAL_GRANT_KIND = 'CredentialGrant';\n\n/**\n * JIT credential authorization (plan 24.46). The resource records grant\n * metadata only — the opaque handle lives in the credential domain and raw\n * secret material never appears in spec or status.\n */\nexport interface CredentialGrantSpec {\n  runRef: {\n    apiVersion: string;\n    kind: string;\n    name: string;\n    uid: string;\n  };\n  attempt: number;\n  /** Fingerprint of the worker's ephemeral public key. */\n  workerKey: string;\n  /** Target system the credential acts on (e.g. `ssh://node-7`, `model:openai/gpt-4o`). */\n  target: string;\n  /** Operation the credential authorizes (e.g. `exec`, `generate`, `read`). */\n  method: string;\n  /** Audience the resulting handle is valid for. */\n  audience: string;\n  policyDigest: string;\n  budget?: {\n    maxCalls?: number;\n    maxCost?: number;\n    currency?: string;\n  };\n  /** Requested TTL in milliseconds; the broker caps it. */\n  ttlMs?: number;\n}\n\nexport interface CredentialGrantStatus extends OrchestrationResourceStatus {\n  phase?: 'Pending' | 'Issuing' | 'Issued' | 'Renewed' | 'Revoked' | 'Expired' | 'Failed';\n  assignedNode?: string;\n  assignedBroker?: string;\n  binding?: {\n    leaseEpoch: string;\n    boundAt: string;\n  };\n  issuanceClaim?: {\n    leaseEpoch: string;\n    claimedAt: string;\n  };\n  /** Opaque handle reference in the credential domain — never the handle itself. */\n  handleRef?: string;\n  issuedAt?: string;\n  expiresAt?: string;\n  renewedAt?: string;\n  revokedAt?: string;\n  /** Exposure assessment used to decide post-task rotation. */\n  exposure?: 'none' | 'worker-visible' | 'potentially-exposed';\n  rotationRequired?: boolean;\n  rotationReason?: string;\n  error?: OrchestrationErrorData;\n}\n\nexport type CredentialGrantManifest = OrchestrationResourceManifest<CredentialGrantSpec>;\n\nexport interface CredentialGrantResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: CredentialGrantSpec;\n  status?: CredentialGrantStatus;\n}\n\nexport function createCredentialGrantManifest(name: string, spec: CredentialGrantSpec): CredentialGrantManifest {\n  return {\n    apiVersion: CREDENTIAL_GRANT_API_VERSION,\n    kind: CREDENTIAL_GRANT_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isCredentialGrant(resource: { apiVersion?: string; kind?: string }): resource is CredentialGrantResource {\n  return resource.apiVersion === CREDENTIAL_GRANT_API_VERSION && resource.kind === CREDENTIAL_GRANT_KIND;\n}\n\nexport const ARTIFACT_RECORD_API_VERSION = 'artifacts.memeloop.io/v1alpha1';\nexport const ARTIFACT_RECORD_KIND = 'ArtifactRecord';\n\nexport type ArtifactTrust = 'trusted' | 'restricted' | 'quarantine' | 'untrusted';\n\nexport type ArtifactDestination = 'prompt' | 'volume' | 'backup' | 'knowledge';\n\nexport type ArtifactReviewKind = 'scan' | 'sanitize' | 'verify';\n\nexport interface ArtifactReviewEvidence {\n  kind: ArtifactReviewKind;\n  outcome: 'passed' | 'failed';\n  reviewer: string;\n  contentHash: string;\n  policyDigest: string;\n  destinations: ArtifactDestination[];\n  /** Narrow properties certified by the reviewer; never implies general trust. */\n  properties?: string[];\n  recordedAt: string;\n}\n\n/**\n * Content-addressed artifact with provenance and trust (plan 24.47). Derived\n * content inherits the lowest trust of its inputs; untrusted or unverified\n * content cannot enter trusted prompts, volumes, backups, or knowledge\n * ingestion without explicit policy and a verifier pass.\n */\nexport interface ArtifactRecordSpec {\n  /** Content hash (e.g. `sha256:...`); the storage address. */\n  contentHash: string;\n  sizeBytes?: number;\n  mimeType?: string;\n  /** Producing run and its trust at production time. */\n  producer?: {\n    runRef?: OrchestrationOwnerReference;\n    trust: ArtifactTrust;\n  };\n  /** Parent artifacts this one derives from. */\n  parents?: Array<{\n    apiVersion: string;\n    kind: string;\n    name: string;\n  }>;\n  trust: ArtifactTrust;\n}\n\nexport interface ArtifactRecordStatus extends OrchestrationResourceStatus {\n  /** Append-only evidence written only by the trusted artifact review actor. */\n  reviews?: ArtifactReviewEvidence[];\n  quarantined?: boolean;\n  quarantineReason?: string;\n  /** Downstream artifact names derived from this one (lineage). */\n  derivedBy?: string[];\n}\n\nexport type ArtifactRecordManifest = OrchestrationResourceManifest<ArtifactRecordSpec>;\n\nexport interface ArtifactRecordResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: ArtifactRecordSpec;\n  status?: ArtifactRecordStatus;\n}\n\nexport function createArtifactRecordManifest(name: string, spec: ArtifactRecordSpec): ArtifactRecordManifest {\n  return {\n    apiVersion: ARTIFACT_RECORD_API_VERSION,\n    kind: ARTIFACT_RECORD_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isArtifactRecord(resource: { apiVersion?: string; kind?: string }): resource is ArtifactRecordResource {\n  return resource.apiVersion === ARTIFACT_RECORD_API_VERSION && resource.kind === ARTIFACT_RECORD_KIND;\n}\n\n// ─── DriverManifest (drivers.memeloop.io/v1alpha1) ────────────────────\n\nexport const DRIVER_MANIFEST_API_VERSION = 'drivers.memeloop.io/v1alpha1';\nexport const DRIVER_MANIFEST_KIND = 'DriverManifest';\n\nexport type InfrastructureDriverType =\n  | 'control-store'\n  | 'loop-runtime'\n  | 'tool-catalog'\n  | 'tool-execution'\n  | 'model-provider'\n  | 'network'\n  | 'storage'\n  | 'credential'\n  | 'artifact'\n  | 'identity-attestation'\n  | 'policy-approval'\n  | 'audit-telemetry'\n  | 'external-orchestrator';\n\nexport type DriverManifestConformance =\n  | {\n    suiteVersion: string;\n    status: 'not-run';\n  }\n  | {\n    suiteVersion: string;\n    status: 'failed';\n    failedAt: string;\n    failure: string;\n  }\n  | {\n    suiteVersion: string;\n    status: 'passed';\n    passedAt: string;\n    /** Content digest of the exact golden fixture/result bundle. */\n    fixtureDigest: string;\n  };\n\n/**\n * Control-plane representation of a registered driver (plan §11, 24.62).\n * A RuntimeClass/NetworkClass/ModelClass/scheduler can only reference a\n * driver whose manifest is registered and conformance-checked; external\n * orchestrator drivers register through the CLI discovery loader.\n */\nexport interface DriverManifestSpec {\n  driverType: InfrastructureDriverType;\n  /** Driver package version (from getCapabilities or the package manifest). */\n  version: string;\n  execution: {\n    location: 'controller' | 'node' | 'worker' | 'external';\n    transport: 'in-process' | 'stdio' | 'utility-process' | 'http' | 'peer-rpc' | 'container-api' | 'other';\n  };\n  supportedTrustClasses: NodeTrustClass[];\n  resourceKinds: string[];\n  capabilities: Record<string, boolean | string | number>;\n  downgradeBehavior: 'reject' | 'explicit-degrade';\n  requiredHostPrivileges: string[];\n  isolation: {\n    boundary: 'none' | 'process' | 'namespace' | 'host' | 'external';\n    threatAssumptions: string[];\n  };\n  configuration: {\n    /** Stable reference to the schema used to validate non-secret configuration. */\n    schemaRef: string;\n    /** Names of opaque SecretRef fields; never secret values. */\n    secretRefs: string[];\n  };\n  health: {\n    mode: 'method' | 'endpoint';\n    endpoint?: string;\n  };\n  lifecycle: {\n    discoverable: boolean;\n    hotReload: boolean;\n    gracefulShutdown: boolean;\n  };\n  conformance: DriverManifestConformance;\n  supportsCancellation: boolean;\n  supportsBackpressure: boolean;\n  supportsAdoption: boolean;\n  supportsFencing: boolean;\n  /** External orchestrators: the resource kinds this driver manages. */\n  manages?: Array<'AgentWorkload' | 'ToolOperation'>;\n  /** External orchestrators: co-located scheduling support. */\n  supportsColocation?: boolean;\n}\n\nexport interface DriverManifestStatus extends OrchestrationResourceStatus {\n  phase?: 'Pending' | 'Ready' | 'Failed';\n  registeredAt?: string;\n  error?: OrchestrationErrorData;\n}\n\nexport type DriverManifestManifest = OrchestrationResourceManifest<DriverManifestSpec>;\n\nexport interface DriverManifestResource extends OrchestrationTypeMeta {\n  metadata: OrchestrationObjectMetadata;\n  spec: DriverManifestSpec;\n  status?: DriverManifestStatus;\n}\n\nexport function createDriverManifestManifest(name: string, spec: DriverManifestSpec): DriverManifestManifest {\n  return {\n    apiVersion: DRIVER_MANIFEST_API_VERSION,\n    kind: DRIVER_MANIFEST_KIND,\n    metadata: { name },\n    spec,\n  };\n}\n\nexport function isDriverManifest(resource: { apiVersion?: string; kind?: string }): resource is DriverManifestResource {\n  return resource.apiVersion === DRIVER_MANIFEST_API_VERSION && resource.kind === DRIVER_MANIFEST_KIND;\n}\n\n/** A class may only select a manifest whose current conformance evidence passed. */\nexport function isDriverManifestAdmitted(resource: DriverManifestResource): boolean {\n  return resource.status?.phase === 'Ready' && resource.spec.conformance.status === 'passed';\n}\n"],"mappings":";AAGO,IAAM,6BAA6B;AACnC,IAAM,sBAAsB;AAE5B,IAAM,wBAAwB;AAC9B,IAAM,iBAAiB;AAgRvB,SAAS,4BAA4B,MAAc,MAAgD;AACxG,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,uBAAuB,MAAc,MAAsC;AACzF,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,gBAAgB,UAAqF;AACnH,SAAO,SAAS,eAAe,8BAA8B,SAAS,SAAS;AACjF;AAEO,SAAS,WAAW,UAAgF;AACzG,SAAO,SAAS,eAAe,yBAAyB,SAAS,SAAS;AAC5E;AAEO,SAAS,uBAAuB,MAAc,WAKnD;AACA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACF;AAEO,IAAM,6BAA6B;AACnC,IAAM,sBAAsB;AA+F5B,SAAS,4BAA4B,MAAc,MAAgD;AACxG,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,gBAAgB,UAAqF;AACnH,SAAO,SAAS,eAAe,8BAA8B,SAAS,SAAS;AACjF;AAEO,SAAS,kBAAkB,MAAc,WAK9C;AACA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACF;AAEO,IAAM,yBAAyB;AAC/B,IAAM,kBAAkB;AAExB,IAAM,4BAA4B;AAClC,IAAM,qBAAqB;AAyE3B,SAAS,wBAAwB,MAAc,MAAwC;AAC5F,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,2BAA2B,MAAc,MAA8C;AACrG,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,YAAY,UAAiF;AAC3G,SAAO,SAAS,eAAe,0BAA0B,SAAS,SAAS;AAC7E;AAEO,SAAS,eAAe,UAAoF;AACjH,SAAO,SAAS,eAAe,6BAA6B,SAAS,SAAS;AAChF;AAEO,IAAM,0BAA0B;AAChC,IAAM,mBAAmB;AAEzB,IAAM,6BAA6B;AACnC,IAAM,sBAAsB;AAE5B,IAAM,gCAAgC;AACtC,IAAM,yBAAyB;AA+I/B,SAAS,yBAAyB,MAAc,MAA0C;AAC/F,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,4BAA4B,MAAc,MAAgD;AACxG,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,8BAA8B,MAAc,MAAoD;AAC9G,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,aAAa,UAAkF;AAC7G,SAAO,SAAS,eAAe,2BAA2B,SAAS,SAAS;AAC9E;AAEO,SAAS,gBAAgB,UAAqF;AACnH,SAAO,SAAS,eAAe,8BAA8B,SAAS,SAAS;AACjF;AAEO,SAAS,kBAAkB,UAAuF;AACvH,SAAO,SAAS,eAAe,iCAAiC,SAAS,SAAS;AACpF;AAEO,IAAM,+BAA+B;AACrC,IAAM,wBAAwB;AAkC9B,SAAS,8BAA8B,MAAc,MAAoD;AAC9G,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,kBAAkB,UAAuF;AACvH,SAAO,SAAS,eAAe,gCAAgC,SAAS,SAAS;AACnF;AAEO,IAAM,8BAA8B;AACpC,IAAM,uBAAuB;AAsD7B,SAAS,6BACd,MACA,MACwB;AACxB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,iBACd,UACoC;AACpC,SAAO,SAAS,eAAe,+BAC7B,SAAS,SAAS;AACtB;AAEO,IAAM,2BAA2B;AACjC,IAAM,oBAAoB;AAmE1B,SAAS,0BACd,MACA,MACqB;AACrB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,cACd,UACiC;AACjC,SAAO,SAAS,eAAe,4BAC7B,SAAS,SAAS;AACtB;AAEO,IAAM,4BAA4B;AAClC,IAAM,qBAAqB;AAE3B,IAAM,iCAAiC;AACvC,IAAM,0BAA0B;AA6HhC,SAAS,2BAA2B,MAAc,MAA8C;AACrG,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,gCAAgC,MAAc,MAAwD;AACpH,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,eAAe,UAAoF;AACjH,SAAO,SAAS,eAAe,6BAA6B,SAAS,SAAS;AAChF;AAEO,SAAS,oBAAoB,UAAyF;AAC3H,SAAO,SAAS,eAAe,kCAAkC,SAAS,SAAS;AACrF;AAEO,IAAM,4BAA4B;AAClC,IAAM,qBAAqB;AAC3B,IAAM,2BAA2B;AACjC,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB;AAC3B,IAAM,cAAc;AACpB,IAAM,uBAAuB;AAC7B,IAAM,gBAAgB;AA6KtB,SAAS,2BAA2B,MAAc,MAA8C;AACrG,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,0BAA0B,MAAc,MAAsD;AAC5G,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,MAAc,MAA4C;AAC7F,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,uBAAuB,MAAc,MAAgD;AACnG,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,eAAe,UAAoF;AACjH,SAAO,SAAS,eAAe,6BAA6B,SAAS,SAAS;AAChF;AAEO,SAAS,cAAc,UAAwF;AACpH,SAAO,SAAS,eAAe,4BAA4B,SAAS,SAAS;AAC/E;AAEO,SAAS,SAAS,UAAmF;AAC1G,SAAO,SAAS,eAAe,sBAAsB,SAAS,SAAS;AACzE;AAEO,SAAS,WAAW,UAAqF;AAC9G,SAAO,SAAS,eAAe,wBAAwB,SAAS,SAAS;AAC3E;AAEO,IAAM,+BAA+B;AACrC,IAAM,wBAAwB;AAkE9B,SAAS,8BAA8B,MAAc,MAAoD;AAC9G,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,kBAAkB,UAAuF;AACvH,SAAO,SAAS,eAAe,gCAAgC,SAAS,SAAS;AACnF;AAEO,IAAM,8BAA8B;AACpC,IAAM,uBAAuB;AA8D7B,SAAS,6BAA6B,MAAc,MAAkD;AAC3G,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,UAAsF;AACrH,SAAO,SAAS,eAAe,+BAA+B,SAAS,SAAS;AAClF;AAIO,IAAM,8BAA8B;AACpC,IAAM,uBAAuB;AAmG7B,SAAS,6BAA6B,MAAc,MAAkD;AAC3G,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,EAAE,KAAK;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,UAAsF;AACrH,SAAO,SAAS,eAAe,+BAA+B,SAAS,SAAS;AAClF;AAGO,SAAS,yBAAyB,UAA2C;AAClF,SAAO,SAAS,QAAQ,UAAU,WAAW,SAAS,KAAK,YAAY,WAAW;AACpF;","names":[]}

package/dist/chunk-CCEFAOSH.js

@@ -0,0 +1,496 @@
+import {
+  OrchestrationError
+} from "./chunk-FWSY5HOA.js";
+
+// src/orchestration/remoteClient.ts
+var REMOTE_ORCHESTRATION_PROTOCOL = "memeloop.resource.v1";
+var REMOTE_OPERATIONS = /* @__PURE__ */ new Set([
+  "capabilities",
+  "apply",
+  "get",
+  "list",
+  "watch",
+  "delete"
+]);
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function errorData(error) {
+  if (error instanceof OrchestrationError) {
+    return {
+      code: error.code,
+      message: error.message,
+      retryable: error.retryable,
+      ...error.retryAfterMs !== void 0 ? { retryAfterMs: error.retryAfterMs } : {},
+      ...error.reason !== void 0 ? { reason: error.reason } : {},
+      ...error.details !== void 0 ? { details: error.details } : {}
+    };
+  }
+  return {
+    code: "INTERNAL",
+    message: error instanceof Error ? error.message : String(error),
+    retryable: false
+  };
+}
+function throwResponseError(response) {
+  throw new OrchestrationError(response.error);
+}
+function assertResponse(request, response) {
+  if (!isRecord(response) || response.protocol !== REMOTE_ORCHESTRATION_PROTOCOL || response.requestId !== request.requestId || typeof response.ok !== "boolean" || response.ok && !("result" in response) || !response.ok && (!isRecord(response.error) || typeof response.error.code !== "string" || typeof response.error.message !== "string" || typeof response.error.retryable !== "boolean")) {
+    throw new OrchestrationError({
+      code: "INVALID",
+      message: "remote orchestration response correlation or protocol mismatch",
+      retryable: false
+    });
+  }
+}
+var requestSequence = 0;
+function createRemoteOrchestrationClient(transport, options = {}) {
+  const createRequestId = options.createRequestId ?? (() => `resource-${Date.now().toString(36)}-${(++requestSequence).toString(36)}`);
+  function makeRequest(operation, payload) {
+    return {
+      protocol: REMOTE_ORCHESTRATION_PROTOCOL,
+      requestId: createRequestId(),
+      operation,
+      payload
+    };
+  }
+  async function request(operation, payload, signal) {
+    const envelope = makeRequest(operation, payload);
+    const response = await transport.request(envelope, { signal });
+    assertResponse(envelope, response);
+    if (!response.ok) throwResponseError(response);
+    return response.result;
+  }
+  return {
+    getCapabilities() {
+      return request("capabilities", {});
+    },
+    apply(resource, applyOptions) {
+      return request("apply", {
+        resource,
+        ...applyOptions ? { options: applyOptions } : {}
+      });
+    },
+    get(reference, getOptions) {
+      return request("get", {
+        reference,
+        ...getOptions ? { options: getOptions } : {}
+      });
+    },
+    list(query, listOptions) {
+      return request("list", {
+        query,
+        ...listOptions ? { options: listOptions } : {}
+      });
+    },
+    async *watch(query, watchOptions) {
+      const envelope = makeRequest("watch", {
+        query,
+        ...watchOptions ? {
+          options: {
+            ...watchOptions,
+            signal: void 0
+          }
+        } : {}
+      });
+      for await (const response of transport.watch(envelope, {
+        signal: watchOptions?.signal
+      })) {
+        assertResponse(envelope, response);
+        if (!response.ok) throwResponseError(response);
+        yield response.result;
+      }
+    },
+    delete(reference, deleteOptions) {
+      return request("delete", {
+        reference,
+        ...deleteOptions ? { options: deleteOptions } : {}
+      });
+    }
+  };
+}
+function createReadOnlyOrchestrationClient(client, options = {}) {
+  const allowedKinds = options.allowedResourceKinds ? new Set(options.allowedResourceKinds) : void 0;
+  function assertAllowedKind(kind) {
+    if (!allowedKinds || allowedKinds.has(kind)) return;
+    throw new OrchestrationError({
+      code: "FORBIDDEN",
+      message: `remote orchestration access to resource kind '${kind}' is forbidden`,
+      retryable: false
+    });
+  }
+  function forbidden(operation) {
+    throw new OrchestrationError({
+      code: "FORBIDDEN",
+      message: `remote orchestration operation '${operation}' is read-only`,
+      retryable: false
+    });
+  }
+  return {
+    async getCapabilities() {
+      const capabilities = await client.getCapabilities();
+      return {
+        operations: ["get", "list", "watch"],
+        resourceKinds: capabilities.resourceKinds.filter((kind) => allowedKinds ? allowedKinds.has(kind) : true),
+        interfaces: capabilities.interfaces.includes("resource") ? ["resource"] : []
+      };
+    },
+    async apply() {
+      forbidden("apply");
+    },
+    async get(reference, getOptions) {
+      assertAllowedKind(reference.kind);
+      return await client.get(reference, getOptions);
+    },
+    async list(query, listOptions) {
+      assertAllowedKind(query.kind);
+      return await client.list(query, listOptions);
+    },
+    async *watch(query, watchOptions) {
+      assertAllowedKind(query.kind);
+      yield* client.watch(query, watchOptions);
+    },
+    async delete() {
+      forbidden("delete");
+    }
+  };
+}
+function createNamespacedOrchestrationClient(client, options) {
+  const namespace = options.namespace.trim();
+  if (!namespace || namespace.length > 253) {
+    throw new TypeError("namespace must contain between 1 and 253 characters");
+  }
+  const allowedKinds = new Set(options.allowedResourceKinds);
+  const mutableKinds = new Set(options.mutableResourceKinds ?? options.allowedResourceKinds);
+  for (const kind of mutableKinds) {
+    if (!allowedKinds.has(kind)) {
+      throw new TypeError(`mutable resource kind '${kind}' must also be allowed`);
+    }
+  }
+  function assertAllowedKind(kind) {
+    if (allowedKinds.has(kind)) return;
+    throw new OrchestrationError({
+      code: "FORBIDDEN",
+      message: `remote orchestration access to resource kind '${kind}' is forbidden`,
+      retryable: false
+    });
+  }
+  function bindNamespace(metadata) {
+    if (metadata.namespace !== void 0 && metadata.namespace !== namespace) {
+      throw new OrchestrationError({
+        code: "FORBIDDEN",
+        message: `remote orchestration access outside namespace '${namespace}' is forbidden`,
+        retryable: false
+      });
+    }
+    return { ...metadata, namespace };
+  }
+  function assertMutableKind(kind) {
+    assertAllowedKind(kind);
+    if (mutableKinds.has(kind)) return;
+    throw new OrchestrationError({
+      code: "FORBIDDEN",
+      message: `remote orchestration mutation of resource kind '${kind}' is forbidden`,
+      retryable: false
+    });
+  }
+  return {
+    async getCapabilities() {
+      const capabilities = await client.getCapabilities();
+      const resourceKinds = capabilities.resourceKinds.filter((kind) => allowedKinds.has(kind));
+      const resourceOperations = Object.fromEntries(
+        resourceKinds.map((kind) => {
+          const sourceOperations = capabilities.resourceOperations?.[kind] ?? capabilities.operations;
+          return [
+            kind,
+            sourceOperations.filter((operation) => mutableKinds.has(kind) || operation !== "apply" && operation !== "delete")
+          ];
+        })
+      );
+      return {
+        operations: capabilities.operations,
+        resourceKinds,
+        resourceOperations,
+        interfaces: capabilities.interfaces.includes("resource") ? ["resource"] : []
+      };
+    },
+    async apply(resource, applyOptions) {
+      assertMutableKind(resource.kind);
+      return await client.apply(
+        {
+          ...resource,
+          metadata: bindNamespace(resource.metadata)
+        },
+        applyOptions
+      );
+    },
+    async get(reference, getOptions) {
+      assertAllowedKind(reference.kind);
+      return await client.get(bindNamespace(reference), getOptions);
+    },
+    async list(query, listOptions) {
+      assertAllowedKind(query.kind);
+      return await client.list(bindNamespace(query), listOptions);
+    },
+    watch(query, watchOptions) {
+      assertAllowedKind(query.kind);
+      return client.watch(bindNamespace(query), watchOptions);
+    },
+    async delete(reference, deleteOptions) {
+      assertMutableKind(reference.kind);
+      return await client.delete(bindNamespace(reference), deleteOptions);
+    }
+  };
+}
+function requirePayload(payload, key) {
+  if (!(key in payload)) {
+    throw new OrchestrationError({
+      code: "INVALID",
+      message: `remote orchestration request is missing payload.${key}`,
+      retryable: false
+    });
+  }
+  return payload[key];
+}
+function success(request, result) {
+  return {
+    protocol: REMOTE_ORCHESTRATION_PROTOCOL,
+    requestId: request.requestId,
+    ok: true,
+    result
+  };
+}
+function failure(request, error) {
+  const requestRecord = isRecord(request) ? request : void 0;
+  return {
+    protocol: REMOTE_ORCHESTRATION_PROTOCOL,
+    requestId: typeof requestRecord?.requestId === "string" ? requestRecord.requestId : "invalid",
+    ok: false,
+    error: errorData(error)
+  };
+}
+function createRemoteOrchestrationHandler(client) {
+  function validate(request) {
+    if (!isRecord(request) || request.protocol !== REMOTE_ORCHESTRATION_PROTOCOL || typeof request.requestId !== "string" || !request.requestId || request.requestId.length > 256 || !REMOTE_OPERATIONS.has(request.operation) || !isRecord(request.payload)) {
+      throw new OrchestrationError({
+        code: "INVALID",
+        message: "invalid remote orchestration request envelope",
+        retryable: false
+      });
+    }
+  }
+  return {
+    async request(request) {
+      try {
+        validate(request);
+        const payload = request.payload;
+        switch (request.operation) {
+          case "capabilities":
+            return success(request, await client.getCapabilities());
+          case "apply":
+            return success(
+              request,
+              await client.apply(
+                requirePayload(payload, "resource"),
+                payload.options
+              )
+            );
+          case "get":
+            return success(
+              request,
+              await client.get(
+                requirePayload(payload, "reference"),
+                payload.options
+              )
+            );
+          case "list":
+            return success(
+              request,
+              await client.list(
+                requirePayload(payload, "query"),
+                payload.options
+              )
+            );
+          case "delete":
+            return success(
+              request,
+              await client.delete(
+                requirePayload(payload, "reference"),
+                payload.options
+              )
+            );
+          case "watch":
+            throw new OrchestrationError({
+              code: "INVALID",
+              message: "watch requests require the streaming protocol method",
+              retryable: false
+            });
+          default:
+            throw new OrchestrationError({
+              code: "UNSUPPORTED",
+              message: `unsupported remote orchestration operation '${String(request.operation)}'`,
+              retryable: false
+            });
+        }
+      } catch (error) {
+        return failure(request, error);
+      }
+    },
+    async *watch(request, options = {}) {
+      try {
+        validate(request);
+        if (request.operation !== "watch") {
+          throw new OrchestrationError({
+            code: "INVALID",
+            message: "streaming protocol accepts only watch operations",
+            retryable: false
+          });
+        }
+        const watchOptions = request.payload.options;
+        for await (const event of client.watch(
+          requirePayload(request.payload, "query"),
+          {
+            ...watchOptions,
+            signal: options.signal
+          }
+        )) {
+          yield success(request, event);
+        }
+      } catch (error) {
+        yield failure(request, error);
+      }
+    }
+  };
+}
+function createFetchOrchestrationTransport(options) {
+  const fetch_ = options.fetch ?? globalThis.fetch;
+  const maxResponseBytes = options.maxResponseBytes ?? 1024 * 1024;
+  const maxWatchLineBytes = options.maxWatchLineBytes ?? 1024 * 1024;
+  function assertWatchLineSize(line) {
+    if (new TextEncoder().encode(line).byteLength > maxWatchLineBytes) {
+      throw new OrchestrationError({
+        code: "EXHAUSTED",
+        message: `remote orchestration watch line exceeds ${maxWatchLineBytes} bytes`,
+        retryable: false
+      });
+    }
+  }
+  async function headers(accept) {
+    const additional = typeof options.headers === "function" ? await options.headers() : options.headers ?? {};
+    return {
+      Accept: accept,
+      "Content-Type": "application/json",
+      ...additional
+    };
+  }
+  async function post(request, accept, signal) {
+    const response = await fetch_(options.endpoint, {
+      method: "POST",
+      headers: await headers(accept),
+      body: JSON.stringify(request),
+      signal,
+      ...options.credentials ? { credentials: options.credentials } : {}
+    });
+    if (!response.ok) {
+      throw new OrchestrationError({
+        code: response.status === 401 || response.status === 403 ? "FORBIDDEN" : "UNAVAILABLE",
+        message: `remote orchestration endpoint returned HTTP ${response.status}`,
+        retryable: response.status >= 500
+      });
+    }
+    return response;
+  }
+  async function readBoundedText(response, limit) {
+    if (!response.body) return "";
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let size = 0;
+    let text = "";
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > limit) {
+          await reader.cancel();
+          throw new OrchestrationError({
+            code: "EXHAUSTED",
+            message: `remote orchestration response exceeds ${limit} bytes`,
+            retryable: false
+          });
+        }
+        text += decoder.decode(value, { stream: true });
+      }
+      return text + decoder.decode();
+    } finally {
+      reader.releaseLock();
+    }
+  }
+  return {
+    async request(request, transportOptions = {}) {
+      const response = await post(request, "application/json", transportOptions.signal);
+      const text = await readBoundedText(response, maxResponseBytes);
+      return JSON.parse(text);
+    },
+    async *watch(request, transportOptions = {}) {
+      const response = await post(request, "application/x-ndjson", transportOptions.signal);
+      if (!response.body) {
+        throw new OrchestrationError({
+          code: "UNAVAILABLE",
+          message: "remote orchestration watch response has no body",
+          retryable: true
+        });
+      }
+      const reader = response.body.getReader();
+      const decoder = new TextDecoder();
+      let pending = "";
+      let streamCompleted = false;
+      try {
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) {
+            streamCompleted = true;
+            break;
+          }
+          pending += decoder.decode(value, { stream: true });
+          let newline = pending.indexOf("\n");
+          while (newline >= 0) {
+            const line = pending.slice(0, newline).trim();
+            pending = pending.slice(newline + 1);
+            assertWatchLineSize(line);
+            if (line) yield JSON.parse(line);
+            newline = pending.indexOf("\n");
+          }
+          if (pending.length > maxWatchLineBytes) {
+            throw new OrchestrationError({
+              code: "EXHAUSTED",
+              message: `remote orchestration watch line exceeds ${maxWatchLineBytes} bytes`,
+              retryable: false
+            });
+          }
+        }
+        pending += decoder.decode();
+        if (pending.trim()) {
+          assertWatchLineSize(pending.trim());
+          yield JSON.parse(pending);
+        }
+      } finally {
+        if (!streamCompleted) {
+          await reader.cancel().catch(() => void 0);
+        }
+        reader.releaseLock();
+      }
+    }
+  };
+}
+
+export {
+  REMOTE_ORCHESTRATION_PROTOCOL,
+  createRemoteOrchestrationClient,
+  createReadOnlyOrchestrationClient,
+  createNamespacedOrchestrationClient,
+  createRemoteOrchestrationHandler,
+  createFetchOrchestrationTransport
+};
+//# sourceMappingURL=chunk-CCEFAOSH.js.map