@vibesdotdev/infra-core 0.0.1 → 1.0.0-rc.11

package/dist/kinds/service-release.kind.d.ts

@@ -0,0 +1,771 @@
+/**
+ * Kind: infra/service-release
+ *
+ * A provider-neutral release unit for one public stateless gateway backed by
+ * one private, durable service. Provider adapters project this contract into
+ * their native workload, service, storage, and network-policy resources.
+ */
+import * as z from 'zod/v4';
+import { type RuntimeDescriptor } from '@vibesdotdev/kernel/schemas/descriptor';
+import type { KindContext } from '@vibesdotdev/kernel/schemas/kind';
+export declare const ServiceReleaseSecretRefSchema: z.ZodObject<{
+    name: z.ZodString;
+    key: z.ZodString;
+}, z.core.$strip>;
+export declare const ServiceReleaseSecretBindingSchema: z.ZodObject<{
+    source: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"secret-store">;
+        key: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"repository-file">;
+        path: z.ZodString;
+    }, z.core.$strip>], "kind">;
+    target: z.ZodObject<{
+        name: z.ZodString;
+        key: z.ZodString;
+    }, z.core.$strip>;
+    description: z.ZodString;
+}, z.core.$strip>;
+export declare const ServiceReleaseSecretBindingsSchema: z.ZodArray<z.ZodObject<{
+    source: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"secret-store">;
+        key: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"repository-file">;
+        path: z.ZodString;
+    }, z.core.$strip>], "kind">;
+    target: z.ZodObject<{
+        name: z.ZodString;
+        key: z.ZodString;
+    }, z.core.$strip>;
+    description: z.ZodString;
+}, z.core.$strip>>;
+export declare const ServiceReleaseEnvSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    source: z.ZodLiteral<"literal">;
+    name: z.ZodString;
+    value: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    source: z.ZodLiteral<"secret">;
+    name: z.ZodString;
+    secretRef: z.ZodObject<{
+        name: z.ZodString;
+        key: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>], "source">;
+export declare const ServiceReleaseSecretMountSchema: z.ZodObject<{
+    secretName: z.ZodString;
+    mountPath: z.ZodString;
+    keys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    readOnly: z.ZodDefault<z.ZodLiteral<true>>;
+}, z.core.$strip>;
+export declare const ServiceReleaseGatewaySchema: z.ZodObject<{
+    name: z.ZodString;
+    image: z.ZodString;
+    revision: z.ZodString;
+    replicas: z.ZodNumber;
+    port: z.ZodDefault<z.ZodLiteral<22>>;
+    listenPort: z.ZodDefault<z.ZodNumber>;
+    hostname: z.ZodString;
+    hostKeyAuthority: z.ZodObject<{
+        publicKey: z.ZodString;
+        fingerprint: z.ZodString;
+        source: z.ZodObject<{
+            repository: z.ZodString;
+            path: z.ZodString;
+        }, z.core.$strip>;
+        secretRef: z.ZodObject<{
+            name: z.ZodString;
+            privateKeyKey: z.ZodString;
+            publicKeyKey: z.ZodString;
+            mountPath: z.ZodString;
+        }, z.core.$strip>;
+        provisioning: z.ZodObject<{
+            owner: z.ZodLiteral<"secret-management">;
+            mode: z.ZodLiteral<"external-preprovisioned">;
+        }, z.core.$strip>;
+        rotation: z.ZodObject<{
+            generation: z.ZodNumber;
+            strategy: z.ZodLiteral<"preprovisioned-atomic">;
+            previousFingerprint: z.ZodOptional<z.ZodString>;
+            knownHostsOverlapUntil: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    env: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"literal">;
+        name: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        name: z.ZodString;
+        secretRef: z.ZodObject<{
+            name: z.ZodString;
+            key: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>], "source">>>;
+    secretMounts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        secretName: z.ZodString;
+        mountPath: z.ZodString;
+        keys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        readOnly: z.ZodDefault<z.ZodLiteral<true>>;
+    }, z.core.$strip>>>;
+    resources: z.ZodObject<{
+        requests: z.ZodObject<{
+            cpu: z.ZodString;
+            memory: z.ZodString;
+        }, z.core.$strip>;
+        limits: z.ZodObject<{
+            cpu: z.ZodString;
+            memory: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    maxUnavailable: z.ZodDefault<z.ZodLiteral<0>>;
+    maxSurge: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+export declare const ServiceReleaseControlPlaneRouterSchema: z.ZodObject<{
+    image: z.ZodString;
+    revision: z.ZodString;
+    publicPort: z.ZodLiteral<443>;
+    listenPort: z.ZodDefault<z.ZodNumber>;
+    tlsSecretRef: z.ZodObject<{
+        name: z.ZodString;
+        certificateKey: z.ZodDefault<z.ZodString>;
+        privateKeyKey: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>;
+    smartGit: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodLiteral<true>;
+        authorizationOwner: z.ZodLiteral<"stateful">;
+        pathContract: z.ZodLiteral<"owner/repo.git">;
+    }, z.core.$strip>>;
+    allowedPathPrefixes: z.ZodArray<z.ZodString>;
+    proxyRepoBrowse: z.ZodDefault<z.ZodBoolean>;
+    proxyMergeControl: z.ZodDefault<z.ZodBoolean>;
+    fallbackRedirect: z.ZodOptional<z.ZodURL>;
+    resources: z.ZodObject<{
+        requests: z.ZodObject<{
+            cpu: z.ZodString;
+            memory: z.ZodString;
+        }, z.core.$strip>;
+        limits: z.ZodObject<{
+            cpu: z.ZodString;
+            memory: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const ServiceReleaseRepositoryMigrationSchema: z.ZodObject<{
+    mode: z.ZodLiteral<"mirror-ssh">;
+    migrationId: z.ZodString;
+    source: z.ZodObject<{
+        origin: z.ZodURL;
+        inventoryUrl: z.ZodURL;
+        sshLeaseUrl: z.ZodURL;
+        inventoryAuthoritySecretRef: z.ZodObject<{
+            name: z.ZodString;
+            key: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    expected: z.ZodObject<{
+        repositoryCount: z.ZodNumber;
+        owners: z.ZodArray<z.ZodObject<{
+            ownerType: z.ZodEnum<{
+                user: "user";
+                organization: "organization";
+            }>;
+            ownerId: z.ZodString;
+            repositoryCount: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    receipt: z.ZodObject<{
+        configMapName: z.ZodString;
+    }, z.core.$strip>;
+    convergence: z.ZodObject<{
+        stablePasses: z.ZodLiteral<2>;
+    }, z.core.$strip>;
+    rollback: z.ZodObject<{
+        mode: z.ZodLiteral<"source-authoritative-until-public-cutover">;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const ServiceReleaseStatefulSchema: z.ZodObject<{
+    name: z.ZodString;
+    exposure: z.ZodDefault<z.ZodLiteral<"internal">>;
+    adminExposure: z.ZodDefault<z.ZodLiteral<"internal">>;
+    image: z.ZodString;
+    revision: z.ZodString;
+    replicas: z.ZodLiteral<1>;
+    port: z.ZodNumber;
+    storage: z.ZodObject<{
+        mountPath: z.ZodString;
+        size: z.ZodString;
+        accessMode: z.ZodLiteral<"ReadWriteOnce">;
+        storageClassName: z.ZodOptional<z.ZodString>;
+        schemaVersion: z.ZodNumber;
+        releaseCompatibility: z.ZodObject<{
+            readFrom: z.ZodNumber;
+            readThrough: z.ZodNumber;
+            writeVersion: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    backup: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"restic-s3">;
+        toolImage: z.ZodString;
+        repository: z.ZodString;
+        credentials: z.ZodObject<{
+            accessKeyId: z.ZodObject<{
+                store: z.ZodOptional<z.ZodString>;
+                key: z.ZodString;
+                env: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            secretAccessKey: z.ZodObject<{
+                store: z.ZodOptional<z.ZodString>;
+                key: z.ZodString;
+                env: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            encryptionKey: z.ZodObject<{
+                store: z.ZodOptional<z.ZodString>;
+                key: z.ZodString;
+                env: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        schedule: z.ZodString;
+        retention: z.ZodObject<{
+            keepDaily: z.ZodNumber;
+            keepWeekly: z.ZodNumber;
+            keepMonthly: z.ZodNumber;
+        }, z.core.$strip>;
+        restoreVerify: z.ZodObject<{
+            schedule: z.ZodString;
+            scratchSize: z.ZodString;
+            timeoutSeconds: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        mode: z.ZodLiteral<"csi-volume-snapshot">;
+        toolImage: z.ZodString;
+        snapshotClassName: z.ZodString;
+        deletionPolicy: z.ZodLiteral<"Delete">;
+        schedule: z.ZodString;
+        retention: z.ZodObject<{
+            verifiedGenerations: z.ZodNumber;
+        }, z.core.$strip>;
+        restoreVerify: z.ZodObject<{
+            schedule: z.ZodString;
+            scratchSize: z.ZodString;
+            timeoutSeconds: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>], "mode">;
+    repositoryMigration: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodLiteral<"mirror-ssh">;
+        migrationId: z.ZodString;
+        source: z.ZodObject<{
+            origin: z.ZodURL;
+            inventoryUrl: z.ZodURL;
+            sshLeaseUrl: z.ZodURL;
+            inventoryAuthoritySecretRef: z.ZodObject<{
+                name: z.ZodString;
+                key: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        expected: z.ZodObject<{
+            repositoryCount: z.ZodNumber;
+            owners: z.ZodArray<z.ZodObject<{
+                ownerType: z.ZodEnum<{
+                    user: "user";
+                    organization: "organization";
+                }>;
+                ownerId: z.ZodString;
+                repositoryCount: z.ZodNumber;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        receipt: z.ZodObject<{
+            configMapName: z.ZodString;
+        }, z.core.$strip>;
+        convergence: z.ZodObject<{
+            stablePasses: z.ZodLiteral<2>;
+        }, z.core.$strip>;
+        rollback: z.ZodObject<{
+            mode: z.ZodLiteral<"source-authoritative-until-public-cutover">;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    env: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"literal">;
+        name: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        name: z.ZodString;
+        secretRef: z.ZodObject<{
+            name: z.ZodString;
+            key: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>], "source">>>;
+    secretMounts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        secretName: z.ZodString;
+        mountPath: z.ZodString;
+        keys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        readOnly: z.ZodDefault<z.ZodLiteral<true>>;
+    }, z.core.$strip>>>;
+    resources: z.ZodObject<{
+        requests: z.ZodObject<{
+            cpu: z.ZodString;
+            memory: z.ZodString;
+        }, z.core.$strip>;
+        limits: z.ZodObject<{
+            cpu: z.ZodString;
+            memory: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const ServiceReleaseNetworkPolicySchema: z.ZodObject<{
+    defaultDenyIngress: z.ZodLiteral<true>;
+    allowGatewayToStateful: z.ZodLiteral<true>;
+    egress: z.ZodObject<{
+        defaultDeny: z.ZodLiteral<true>;
+        platformAuthCidrs: z.ZodArray<z.ZodString>;
+        objectBackupCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        objectBackupHostnames: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+/**
+ * The provider-neutral shape of a release target: an adapter id plus whatever
+ * that adapter's own integration package validates once it resolves the target.
+ */
+export declare const ServiceReleaseTargetSchema: z.ZodObject<{
+    adapter: z.ZodString;
+}, z.core.$loose>;
+export declare const ServiceReleaseNamespaceQuotaSchema: z.ZodObject<{
+    name: z.ZodString;
+    hard: z.ZodObject<{
+        'limits.cpu': z.ZodString;
+        'limits.memory': z.ZodString;
+        persistentvolumeclaims: z.ZodString;
+        pods: z.ZodString;
+        'requests.cpu': z.ZodString;
+        'requests.memory': z.ZodString;
+        'requests.storage': z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const ServiceReleaseBackupStorageSchema: z.ZodObject<{
+    adapter: z.ZodLiteral<"s3-compatible">;
+    authority: z.ZodObject<{
+        provider: z.ZodString;
+        name: z.ZodString;
+        requiredControlPlaneScopes: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    bucket: z.ZodString;
+    region: z.ZodString;
+    endpoint: z.ZodURL;
+    forcePathStyle: z.ZodLiteral<true>;
+    versioning: z.ZodLiteral<"Enabled">;
+    publicAccess: z.ZodLiteral<"private">;
+}, z.core.$strip>;
+/** The release config: an open adapter object plus the provider-neutral parts this kind checks across fields. */
+export declare const ServiceReleaseConfigSchema: z.ZodObject<{
+    adapter: z.ZodString;
+    dnsOwnerRef: z.ZodString;
+    namespaceQuota: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        hard: z.ZodObject<{
+            'limits.cpu': z.ZodString;
+            'limits.memory': z.ZodString;
+            persistentvolumeclaims: z.ZodString;
+            pods: z.ZodString;
+            'requests.cpu': z.ZodString;
+            'requests.memory': z.ZodString;
+            'requests.storage': z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    backupStorage: z.ZodOptional<z.ZodObject<{
+        adapter: z.ZodLiteral<"s3-compatible">;
+        authority: z.ZodObject<{
+            provider: z.ZodString;
+            name: z.ZodString;
+            requiredControlPlaneScopes: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>;
+        bucket: z.ZodString;
+        region: z.ZodString;
+        endpoint: z.ZodURL;
+        forcePathStyle: z.ZodLiteral<true>;
+        versioning: z.ZodLiteral<"Enabled">;
+        publicAccess: z.ZodLiteral<"private">;
+    }, z.core.$strip>>;
+    certificate: z.ZodOptional<z.ZodObject<{
+        manager: z.ZodLiteral<"cert-manager">;
+        issuerRef: z.ZodObject<{
+            kind: z.ZodUnion<readonly [z.ZodLiteral<"ClusterIssuer">, z.ZodLiteral<"Issuer">]>;
+            name: z.ZodString;
+        }, z.core.$strip>;
+        provisioning: z.ZodOptional<z.ZodObject<{
+            owner: z.ZodLiteral<"service-release">;
+            mode: z.ZodLiteral<"namespace-acme-dns01">;
+            server: z.ZodURL;
+            email: z.ZodEmail;
+            privateKeySecretRef: z.ZodObject<{
+                name: z.ZodString;
+            }, z.core.$strip>;
+            solver: z.ZodObject<{
+                provider: z.ZodString;
+                dnsZones: z.ZodArray<z.ZodString>;
+                apiToken: z.ZodObject<{
+                    environment: z.ZodLiteral<"local">;
+                    sourceKeys: z.ZodArray<z.ZodString>;
+                    target: z.ZodObject<{
+                        name: z.ZodString;
+                        key: z.ZodString;
+                    }, z.core.$strip>;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+        }, z.core.$strip>>;
+        duration: z.ZodDefault<z.ZodLiteral<"2160h">>;
+        renewBefore: z.ZodDefault<z.ZodLiteral<"360h">>;
+        privateKey: z.ZodDefault<z.ZodObject<{
+            algorithm: z.ZodDefault<z.ZodLiteral<"ECDSA">>;
+            size: z.ZodDefault<z.ZodLiteral<256>>;
+            rotationPolicy: z.ZodDefault<z.ZodLiteral<"Always">>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$loose>;
+export declare const ServiceReleaseDescriptorSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    id: z.ZodString;
+    kind: z.ZodLiteral<"infra/service-release">;
+    namespace: z.ZodString;
+    gateway: z.ZodObject<{
+        name: z.ZodString;
+        image: z.ZodString;
+        revision: z.ZodString;
+        replicas: z.ZodNumber;
+        port: z.ZodDefault<z.ZodLiteral<22>>;
+        listenPort: z.ZodDefault<z.ZodNumber>;
+        hostname: z.ZodString;
+        hostKeyAuthority: z.ZodObject<{
+            publicKey: z.ZodString;
+            fingerprint: z.ZodString;
+            source: z.ZodObject<{
+                repository: z.ZodString;
+                path: z.ZodString;
+            }, z.core.$strip>;
+            secretRef: z.ZodObject<{
+                name: z.ZodString;
+                privateKeyKey: z.ZodString;
+                publicKeyKey: z.ZodString;
+                mountPath: z.ZodString;
+            }, z.core.$strip>;
+            provisioning: z.ZodObject<{
+                owner: z.ZodLiteral<"secret-management">;
+                mode: z.ZodLiteral<"external-preprovisioned">;
+            }, z.core.$strip>;
+            rotation: z.ZodObject<{
+                generation: z.ZodNumber;
+                strategy: z.ZodLiteral<"preprovisioned-atomic">;
+                previousFingerprint: z.ZodOptional<z.ZodString>;
+                knownHostsOverlapUntil: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        env: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"literal">;
+            name: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            name: z.ZodString;
+            secretRef: z.ZodObject<{
+                name: z.ZodString;
+                key: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>], "source">>>;
+        secretMounts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            secretName: z.ZodString;
+            mountPath: z.ZodString;
+            keys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            readOnly: z.ZodDefault<z.ZodLiteral<true>>;
+        }, z.core.$strip>>>;
+        resources: z.ZodObject<{
+            requests: z.ZodObject<{
+                cpu: z.ZodString;
+                memory: z.ZodString;
+            }, z.core.$strip>;
+            limits: z.ZodObject<{
+                cpu: z.ZodString;
+                memory: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        maxUnavailable: z.ZodDefault<z.ZodLiteral<0>>;
+        maxSurge: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>;
+    controlPlaneRouter: z.ZodObject<{
+        image: z.ZodString;
+        revision: z.ZodString;
+        publicPort: z.ZodLiteral<443>;
+        listenPort: z.ZodDefault<z.ZodNumber>;
+        tlsSecretRef: z.ZodObject<{
+            name: z.ZodString;
+            certificateKey: z.ZodDefault<z.ZodString>;
+            privateKeyKey: z.ZodDefault<z.ZodString>;
+        }, z.core.$strip>;
+        smartGit: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodLiteral<true>;
+            authorizationOwner: z.ZodLiteral<"stateful">;
+            pathContract: z.ZodLiteral<"owner/repo.git">;
+        }, z.core.$strip>>;
+        allowedPathPrefixes: z.ZodArray<z.ZodString>;
+        proxyRepoBrowse: z.ZodDefault<z.ZodBoolean>;
+        proxyMergeControl: z.ZodDefault<z.ZodBoolean>;
+        fallbackRedirect: z.ZodOptional<z.ZodURL>;
+        resources: z.ZodObject<{
+            requests: z.ZodObject<{
+                cpu: z.ZodString;
+                memory: z.ZodString;
+            }, z.core.$strip>;
+            limits: z.ZodObject<{
+                cpu: z.ZodString;
+                memory: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    stateful: z.ZodObject<{
+        name: z.ZodString;
+        exposure: z.ZodDefault<z.ZodLiteral<"internal">>;
+        adminExposure: z.ZodDefault<z.ZodLiteral<"internal">>;
+        image: z.ZodString;
+        revision: z.ZodString;
+        replicas: z.ZodLiteral<1>;
+        port: z.ZodNumber;
+        storage: z.ZodObject<{
+            mountPath: z.ZodString;
+            size: z.ZodString;
+            accessMode: z.ZodLiteral<"ReadWriteOnce">;
+            storageClassName: z.ZodOptional<z.ZodString>;
+            schemaVersion: z.ZodNumber;
+            releaseCompatibility: z.ZodObject<{
+                readFrom: z.ZodNumber;
+                readThrough: z.ZodNumber;
+                writeVersion: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        backup: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            mode: z.ZodLiteral<"restic-s3">;
+            toolImage: z.ZodString;
+            repository: z.ZodString;
+            credentials: z.ZodObject<{
+                accessKeyId: z.ZodObject<{
+                    store: z.ZodOptional<z.ZodString>;
+                    key: z.ZodString;
+                    env: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>;
+                secretAccessKey: z.ZodObject<{
+                    store: z.ZodOptional<z.ZodString>;
+                    key: z.ZodString;
+                    env: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>;
+                encryptionKey: z.ZodObject<{
+                    store: z.ZodOptional<z.ZodString>;
+                    key: z.ZodString;
+                    env: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            schedule: z.ZodString;
+            retention: z.ZodObject<{
+                keepDaily: z.ZodNumber;
+                keepWeekly: z.ZodNumber;
+                keepMonthly: z.ZodNumber;
+            }, z.core.$strip>;
+            restoreVerify: z.ZodObject<{
+                schedule: z.ZodString;
+                scratchSize: z.ZodString;
+                timeoutSeconds: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>, z.ZodObject<{
+            mode: z.ZodLiteral<"csi-volume-snapshot">;
+            toolImage: z.ZodString;
+            snapshotClassName: z.ZodString;
+            deletionPolicy: z.ZodLiteral<"Delete">;
+            schedule: z.ZodString;
+            retention: z.ZodObject<{
+                verifiedGenerations: z.ZodNumber;
+            }, z.core.$strip>;
+            restoreVerify: z.ZodObject<{
+                schedule: z.ZodString;
+                scratchSize: z.ZodString;
+                timeoutSeconds: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>], "mode">;
+        repositoryMigration: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodLiteral<"mirror-ssh">;
+            migrationId: z.ZodString;
+            source: z.ZodObject<{
+                origin: z.ZodURL;
+                inventoryUrl: z.ZodURL;
+                sshLeaseUrl: z.ZodURL;
+                inventoryAuthoritySecretRef: z.ZodObject<{
+                    name: z.ZodString;
+                    key: z.ZodString;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            expected: z.ZodObject<{
+                repositoryCount: z.ZodNumber;
+                owners: z.ZodArray<z.ZodObject<{
+                    ownerType: z.ZodEnum<{
+                        user: "user";
+                        organization: "organization";
+                    }>;
+                    ownerId: z.ZodString;
+                    repositoryCount: z.ZodNumber;
+                }, z.core.$strip>>;
+            }, z.core.$strip>;
+            receipt: z.ZodObject<{
+                configMapName: z.ZodString;
+            }, z.core.$strip>;
+            convergence: z.ZodObject<{
+                stablePasses: z.ZodLiteral<2>;
+            }, z.core.$strip>;
+            rollback: z.ZodObject<{
+                mode: z.ZodLiteral<"source-authoritative-until-public-cutover">;
+            }, z.core.$strip>;
+        }, z.core.$strip>>;
+        env: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"literal">;
+            name: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            name: z.ZodString;
+            secretRef: z.ZodObject<{
+                name: z.ZodString;
+                key: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>], "source">>>;
+        secretMounts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            secretName: z.ZodString;
+            mountPath: z.ZodString;
+            keys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            readOnly: z.ZodDefault<z.ZodLiteral<true>>;
+        }, z.core.$strip>>>;
+        resources: z.ZodObject<{
+            requests: z.ZodObject<{
+                cpu: z.ZodString;
+                memory: z.ZodString;
+            }, z.core.$strip>;
+            limits: z.ZodObject<{
+                cpu: z.ZodString;
+                memory: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    secretBindings: z.ZodArray<z.ZodObject<{
+        source: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"secret-store">;
+            key: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"repository-file">;
+            path: z.ZodString;
+        }, z.core.$strip>], "kind">;
+        target: z.ZodObject<{
+            name: z.ZodString;
+            key: z.ZodString;
+        }, z.core.$strip>;
+        description: z.ZodString;
+    }, z.core.$strip>>;
+    networkPolicy: z.ZodObject<{
+        defaultDenyIngress: z.ZodLiteral<true>;
+        allowGatewayToStateful: z.ZodLiteral<true>;
+        egress: z.ZodObject<{
+            defaultDeny: z.ZodLiteral<true>;
+            platformAuthCidrs: z.ZodArray<z.ZodString>;
+            objectBackupCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            objectBackupHostnames: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    config: z.ZodObject<{
+        adapter: z.ZodString;
+        dnsOwnerRef: z.ZodString;
+        namespaceQuota: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            hard: z.ZodObject<{
+                'limits.cpu': z.ZodString;
+                'limits.memory': z.ZodString;
+                persistentvolumeclaims: z.ZodString;
+                pods: z.ZodString;
+                'requests.cpu': z.ZodString;
+                'requests.memory': z.ZodString;
+                'requests.storage': z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>>;
+        backupStorage: z.ZodOptional<z.ZodObject<{
+            adapter: z.ZodLiteral<"s3-compatible">;
+            authority: z.ZodObject<{
+                provider: z.ZodString;
+                name: z.ZodString;
+                requiredControlPlaneScopes: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>;
+            bucket: z.ZodString;
+            region: z.ZodString;
+            endpoint: z.ZodURL;
+            forcePathStyle: z.ZodLiteral<true>;
+            versioning: z.ZodLiteral<"Enabled">;
+            publicAccess: z.ZodLiteral<"private">;
+        }, z.core.$strip>>;
+        certificate: z.ZodOptional<z.ZodObject<{
+            manager: z.ZodLiteral<"cert-manager">;
+            issuerRef: z.ZodObject<{
+                kind: z.ZodUnion<readonly [z.ZodLiteral<"ClusterIssuer">, z.ZodLiteral<"Issuer">]>;
+                name: z.ZodString;
+            }, z.core.$strip>;
+            provisioning: z.ZodOptional<z.ZodObject<{
+                owner: z.ZodLiteral<"service-release">;
+                mode: z.ZodLiteral<"namespace-acme-dns01">;
+                server: z.ZodURL;
+                email: z.ZodEmail;
+                privateKeySecretRef: z.ZodObject<{
+                    name: z.ZodString;
+                }, z.core.$strip>;
+                solver: z.ZodObject<{
+                    provider: z.ZodString;
+                    dnsZones: z.ZodArray<z.ZodString>;
+                    apiToken: z.ZodObject<{
+                        environment: z.ZodLiteral<"local">;
+                        sourceKeys: z.ZodArray<z.ZodString>;
+                        target: z.ZodObject<{
+                            name: z.ZodString;
+                            key: z.ZodString;
+                        }, z.core.$strip>;
+                    }, z.core.$strip>;
+                }, z.core.$strip>;
+            }, z.core.$strip>>;
+            duration: z.ZodDefault<z.ZodLiteral<"2160h">>;
+            renewBefore: z.ZodDefault<z.ZodLiteral<"360h">>;
+            privateKey: z.ZodDefault<z.ZodObject<{
+                algorithm: z.ZodDefault<z.ZodLiteral<"ECDSA">>;
+                size: z.ZodDefault<z.ZodLiteral<256>>;
+                rotationPolicy: z.ZodDefault<z.ZodLiteral<"Always">>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$loose>;
+}, z.core.$strip>;
+export type ServiceReleaseDescriptor = z.infer<typeof ServiceReleaseDescriptorSchema>;
+export type ServiceReleaseTarget = z.infer<typeof ServiceReleaseTargetSchema>;
+export type ServiceReleaseOperation = 'create' | 'update' | 'scale' | 'rollback';
+declare class DefaultServiceReleaseImplementation {
+    readonly descriptor: RuntimeDescriptor;
+    readonly context: KindContext;
+    /** The descriptor as this kind's schema reads it. */
+    readonly config: ServiceReleaseDescriptor;
+    constructor(descriptor: RuntimeDescriptor, context: KindContext);
+}
+export declare const serviceReleaseKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<DefaultServiceReleaseImplementation>;
+export {};
+//# sourceMappingURL=service-release.kind.d.ts.map