kustodian 1.0.0

package/dist/schema/common.d.ts

@@ -0,0 +1,1059 @@
+import { z } from 'zod';
+/**
+ * Common API version for all Kustodian resources.
+ */
+export declare const api_version_schema: z.ZodLiteral<"kustodian.io/v1">;
+/**
+ * Standard metadata for all Kustodian resources.
+ */
+export declare const metadata_schema: z.ZodObject<{
+    name: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+}, {
+    name: string;
+}>;
+export type MetadataType = z.infer<typeof metadata_schema>;
+/**
+ * Health check configuration for waiting on resources.
+ */
+export declare const health_check_schema: z.ZodObject<{
+    kind: z.ZodString;
+    name: z.ZodString;
+    namespace: z.ZodOptional<z.ZodString>;
+    api_version: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    kind: string;
+    namespace?: string | undefined;
+    api_version?: string | undefined;
+}, {
+    name: string;
+    kind: string;
+    namespace?: string | undefined;
+    api_version?: string | undefined;
+}>;
+export type HealthCheckType = z.infer<typeof health_check_schema>;
+/**
+ * Health check expression configuration using CEL (Common Expression Language).
+ * Supports custom health check conditions via CEL expressions.
+ */
+export declare const health_check_expr_schema: z.ZodObject<{
+    api_version: z.ZodString;
+    kind: z.ZodString;
+    namespace: z.ZodOptional<z.ZodString>;
+    /** CEL expression for when resource is healthy/current */
+    current: z.ZodOptional<z.ZodString>;
+    /** CEL expression for when resource has failed */
+    failed: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    kind: string;
+    api_version: string;
+    namespace?: string | undefined;
+    current?: string | undefined;
+    failed?: string | undefined;
+}, {
+    kind: string;
+    api_version: string;
+    namespace?: string | undefined;
+    current?: string | undefined;
+    failed?: string | undefined;
+}>;
+export type HealthCheckExprType = z.infer<typeof health_check_expr_schema>;
+/**
+ * Registry configuration for version substitutions.
+ */
+export declare const registry_config_schema: z.ZodObject<{
+    /** Full image reference: registry/namespace/image or just namespace/image for Docker Hub */
+    image: z.ZodString;
+    /** Registry type for API selection */
+    type: z.ZodOptional<z.ZodEnum<["dockerhub", "ghcr"]>>;
+}, "strip", z.ZodTypeAny, {
+    image: string;
+    type?: "dockerhub" | "ghcr" | undefined;
+}, {
+    image: string;
+    type?: "dockerhub" | "ghcr" | undefined;
+}>;
+export type RegistryConfigType = z.infer<typeof registry_config_schema>;
+/**
+ * Helm repository configuration for helm chart version substitutions.
+ * Supports both traditional Helm repositories and OCI registries.
+ */
+export declare const helm_config_schema: z.ZodEffects<z.ZodObject<{
+    /** Helm chart repository URL (e.g., https://traefik.github.io/charts) */
+    repository: z.ZodOptional<z.ZodString>;
+    /** OCI registry URL for Helm charts (e.g., oci://ghcr.io/traefik/helm) */
+    oci: z.ZodOptional<z.ZodString>;
+    /** Chart name */
+    chart: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    chart: string;
+    repository?: string | undefined;
+    oci?: string | undefined;
+}, {
+    chart: string;
+    repository?: string | undefined;
+    oci?: string | undefined;
+}>, {
+    chart: string;
+    repository?: string | undefined;
+    oci?: string | undefined;
+}, {
+    chart: string;
+    repository?: string | undefined;
+    oci?: string | undefined;
+}>;
+export type HelmConfigType = z.infer<typeof helm_config_schema>;
+/**
+ * Image version entry - tracks container image versions.
+ * Used in template spec.versions for shared version tracking.
+ */
+export declare const image_version_entry_schema: z.ZodObject<{
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+    /** Semver constraint: ^1.0.0, ~2.3.0, >=1.0.0 <2.0.0 */
+    constraint: z.ZodOptional<z.ZodString>;
+    /** Regex pattern for filtering valid tags */
+    tag_pattern: z.ZodOptional<z.ZodString>;
+    /** Exclude pre-release versions (default: true) */
+    exclude_prerelease: z.ZodOptional<z.ZodBoolean>;
+} & {
+    registry: z.ZodObject<{
+        /** Full image reference: registry/namespace/image or just namespace/image for Docker Hub */
+        image: z.ZodString;
+        /** Registry type for API selection */
+        type: z.ZodOptional<z.ZodEnum<["dockerhub", "ghcr"]>>;
+    }, "strip", z.ZodTypeAny, {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    }, {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    registry: {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    };
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+}, {
+    name: string;
+    registry: {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    };
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+}>;
+export type ImageVersionEntryType = z.infer<typeof image_version_entry_schema>;
+/**
+ * Helm version entry - tracks Helm chart versions.
+ * Used in template spec.versions for shared version tracking.
+ */
+export declare const helm_version_entry_schema: z.ZodObject<{
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+    /** Semver constraint: ^1.0.0, ~2.3.0, >=1.0.0 <2.0.0 */
+    constraint: z.ZodOptional<z.ZodString>;
+    /** Regex pattern for filtering valid tags */
+    tag_pattern: z.ZodOptional<z.ZodString>;
+    /** Exclude pre-release versions (default: true) */
+    exclude_prerelease: z.ZodOptional<z.ZodBoolean>;
+} & {
+    helm: z.ZodEffects<z.ZodObject<{
+        /** Helm chart repository URL (e.g., https://traefik.github.io/charts) */
+        repository: z.ZodOptional<z.ZodString>;
+        /** OCI registry URL for Helm charts (e.g., oci://ghcr.io/traefik/helm) */
+        oci: z.ZodOptional<z.ZodString>;
+        /** Chart name */
+        chart: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }>, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    helm: {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    };
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+}, {
+    name: string;
+    helm: {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    };
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+}>;
+export type HelmVersionEntryType = z.infer<typeof helm_version_entry_schema>;
+/**
+ * Version entry - either an image or helm version.
+ * Discriminated by presence of `registry` (image) vs `helm` (chart) field.
+ */
+export declare const version_entry_schema: z.ZodUnion<[z.ZodObject<{
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+    /** Semver constraint: ^1.0.0, ~2.3.0, >=1.0.0 <2.0.0 */
+    constraint: z.ZodOptional<z.ZodString>;
+    /** Regex pattern for filtering valid tags */
+    tag_pattern: z.ZodOptional<z.ZodString>;
+    /** Exclude pre-release versions (default: true) */
+    exclude_prerelease: z.ZodOptional<z.ZodBoolean>;
+} & {
+    registry: z.ZodObject<{
+        /** Full image reference: registry/namespace/image or just namespace/image for Docker Hub */
+        image: z.ZodString;
+        /** Registry type for API selection */
+        type: z.ZodOptional<z.ZodEnum<["dockerhub", "ghcr"]>>;
+    }, "strip", z.ZodTypeAny, {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    }, {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    registry: {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    };
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+}, {
+    name: string;
+    registry: {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    };
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+}>, z.ZodObject<{
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+    /** Semver constraint: ^1.0.0, ~2.3.0, >=1.0.0 <2.0.0 */
+    constraint: z.ZodOptional<z.ZodString>;
+    /** Regex pattern for filtering valid tags */
+    tag_pattern: z.ZodOptional<z.ZodString>;
+    /** Exclude pre-release versions (default: true) */
+    exclude_prerelease: z.ZodOptional<z.ZodBoolean>;
+} & {
+    helm: z.ZodEffects<z.ZodObject<{
+        /** Helm chart repository URL (e.g., https://traefik.github.io/charts) */
+        repository: z.ZodOptional<z.ZodString>;
+        /** OCI registry URL for Helm charts (e.g., oci://ghcr.io/traefik/helm) */
+        oci: z.ZodOptional<z.ZodString>;
+        /** Chart name */
+        chart: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }>, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    helm: {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    };
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+}, {
+    name: string;
+    helm: {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    };
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+}>]>;
+export type VersionEntryType = z.infer<typeof version_entry_schema>;
+/**
+ * Type guard for image version entries.
+ */
+export declare function is_image_version_entry(entry: VersionEntryType): entry is ImageVersionEntryType;
+/**
+ * Type guard for helm version entries.
+ */
+export declare function is_helm_version_entry(entry: VersionEntryType): entry is HelmVersionEntryType;
+/**
+ * Generic substitution (backward compatible, default type).
+ */
+export declare const generic_substitution_schema: z.ZodObject<{
+    type: z.ZodOptional<z.ZodLiteral<"generic">>;
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+    secret: z.ZodOptional<z.ZodString>;
+    preserve_case: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type?: "generic" | undefined;
+    default?: string | undefined;
+    secret?: string | undefined;
+    preserve_case?: boolean | undefined;
+}, {
+    name: string;
+    type?: "generic" | undefined;
+    default?: string | undefined;
+    secret?: string | undefined;
+    preserve_case?: boolean | undefined;
+}>;
+export type GenericSubstitutionType = z.infer<typeof generic_substitution_schema>;
+/**
+ * Version substitution for tracking container image versions.
+ * Registry is optional for simple version substitutions that just use default values.
+ */
+export declare const version_substitution_schema: z.ZodObject<{
+    type: z.ZodLiteral<"version">;
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+    /** Semver constraint: ^1.0.0, ~2.3.0, >=1.0.0 <2.0.0 */
+    constraint: z.ZodOptional<z.ZodString>;
+    /** Registry configuration for fetching available versions (optional for simple substitutions) */
+    registry: z.ZodOptional<z.ZodObject<{
+        /** Full image reference: registry/namespace/image or just namespace/image for Docker Hub */
+        image: z.ZodString;
+        /** Registry type for API selection */
+        type: z.ZodOptional<z.ZodEnum<["dockerhub", "ghcr"]>>;
+    }, "strip", z.ZodTypeAny, {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    }, {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    }>>;
+    /** Regex pattern for filtering valid tags (default: semver-like) */
+    tag_pattern: z.ZodOptional<z.ZodString>;
+    /** Exclude pre-release versions (default: true) */
+    exclude_prerelease: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type: "version";
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+    registry?: {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    } | undefined;
+}, {
+    name: string;
+    type: "version";
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+    registry?: {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    } | undefined;
+}>;
+export type VersionSubstitutionType = z.infer<typeof version_substitution_schema>;
+/**
+ * Helm chart version substitution for tracking Helm chart versions.
+ * Helm config is optional for simple substitutions that just use default values.
+ */
+export declare const helm_substitution_schema: z.ZodObject<{
+    type: z.ZodLiteral<"helm">;
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+    /** Semver constraint: ^1.0.0, ~2.3.0, >=1.0.0 <2.0.0 */
+    constraint: z.ZodOptional<z.ZodString>;
+    /** Helm repository configuration for fetching available chart versions (optional for simple substitutions) */
+    helm: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        /** Helm chart repository URL (e.g., https://traefik.github.io/charts) */
+        repository: z.ZodOptional<z.ZodString>;
+        /** OCI registry URL for Helm charts (e.g., oci://ghcr.io/traefik/helm) */
+        oci: z.ZodOptional<z.ZodString>;
+        /** Chart name */
+        chart: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }>, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }>>;
+    /** Regex pattern for filtering valid tags (default: semver-like) */
+    tag_pattern: z.ZodOptional<z.ZodString>;
+    /** Exclude pre-release versions (default: true) */
+    exclude_prerelease: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type: "helm";
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+    helm?: {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    } | undefined;
+}, {
+    name: string;
+    type: "helm";
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+    helm?: {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    } | undefined;
+}>;
+export type HelmSubstitutionType = z.infer<typeof helm_substitution_schema>;
+/**
+ * Namespace substitution with Kubernetes naming validation.
+ */
+export declare const namespace_substitution_schema: z.ZodObject<{
+    type: z.ZodLiteral<"namespace">;
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type: "namespace";
+    default?: string | undefined;
+}, {
+    name: string;
+    type: "namespace";
+    default?: string | undefined;
+}>;
+export type NamespaceSubstitutionType = z.infer<typeof namespace_substitution_schema>;
+/**
+ * 1Password substitution for fetching secrets from 1Password vaults.
+ * Uses the op:// secret reference format, or shorthand with cluster defaults.
+ */
+export declare const onepassword_substitution_schema: z.ZodEffects<z.ZodObject<{
+    type: z.ZodLiteral<"1password">;
+    name: z.ZodString;
+    /** 1Password secret reference: op://vault/item[/section]/field, or shorthand item/field when vault is configured at cluster level */
+    ref: z.ZodOptional<z.ZodString>;
+    /** Item name (shorthand, requires cluster-level vault configuration) */
+    item: z.ZodOptional<z.ZodString>;
+    /** Field name (shorthand, requires cluster-level vault configuration) */
+    field: z.ZodOptional<z.ZodString>;
+    /** Section name (optional, for shorthand references) */
+    section: z.ZodOptional<z.ZodString>;
+    /** Optional default value if secret cannot be fetched */
+    default: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type: "1password";
+    default?: string | undefined;
+    ref?: string | undefined;
+    item?: string | undefined;
+    field?: string | undefined;
+    section?: string | undefined;
+}, {
+    name: string;
+    type: "1password";
+    default?: string | undefined;
+    ref?: string | undefined;
+    item?: string | undefined;
+    field?: string | undefined;
+    section?: string | undefined;
+}>, {
+    name: string;
+    type: "1password";
+    default?: string | undefined;
+    ref?: string | undefined;
+    item?: string | undefined;
+    field?: string | undefined;
+    section?: string | undefined;
+}, {
+    name: string;
+    type: "1password";
+    default?: string | undefined;
+    ref?: string | undefined;
+    item?: string | undefined;
+    field?: string | undefined;
+    section?: string | undefined;
+}>;
+export type OnePasswordSubstitutionType = z.infer<typeof onepassword_substitution_schema>;
+/**
+ * Doppler substitution for fetching secrets from Doppler projects.
+ * Project and config can be omitted if configured at cluster level.
+ */
+export declare const doppler_substitution_schema: z.ZodObject<{
+    type: z.ZodLiteral<"doppler">;
+    name: z.ZodString;
+    /** Doppler project name (optional if configured at cluster level) */
+    project: z.ZodOptional<z.ZodString>;
+    /** Doppler config name (optional if configured at cluster level, e.g., 'dev', 'stg', 'prd') */
+    config: z.ZodOptional<z.ZodString>;
+    /** Secret key name in Doppler */
+    secret: z.ZodString;
+    /** Optional default value if secret cannot be fetched */
+    default: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type: "doppler";
+    secret: string;
+    default?: string | undefined;
+    project?: string | undefined;
+    config?: string | undefined;
+}, {
+    name: string;
+    type: "doppler";
+    secret: string;
+    default?: string | undefined;
+    project?: string | undefined;
+    config?: string | undefined;
+}>;
+export type DopplerSubstitutionType = z.infer<typeof doppler_substitution_schema>;
+/**
+ * Core substitution types provided by Kustodian.
+ * These are always validated by the schema.
+ */
+export declare const core_substitution_schema: z.ZodUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"version">;
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+    /** Semver constraint: ^1.0.0, ~2.3.0, >=1.0.0 <2.0.0 */
+    constraint: z.ZodOptional<z.ZodString>;
+    /** Registry configuration for fetching available versions (optional for simple substitutions) */
+    registry: z.ZodOptional<z.ZodObject<{
+        /** Full image reference: registry/namespace/image or just namespace/image for Docker Hub */
+        image: z.ZodString;
+        /** Registry type for API selection */
+        type: z.ZodOptional<z.ZodEnum<["dockerhub", "ghcr"]>>;
+    }, "strip", z.ZodTypeAny, {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    }, {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    }>>;
+    /** Regex pattern for filtering valid tags (default: semver-like) */
+    tag_pattern: z.ZodOptional<z.ZodString>;
+    /** Exclude pre-release versions (default: true) */
+    exclude_prerelease: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type: "version";
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+    registry?: {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    } | undefined;
+}, {
+    name: string;
+    type: "version";
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+    registry?: {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    } | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"helm">;
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+    /** Semver constraint: ^1.0.0, ~2.3.0, >=1.0.0 <2.0.0 */
+    constraint: z.ZodOptional<z.ZodString>;
+    /** Helm repository configuration for fetching available chart versions (optional for simple substitutions) */
+    helm: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        /** Helm chart repository URL (e.g., https://traefik.github.io/charts) */
+        repository: z.ZodOptional<z.ZodString>;
+        /** OCI registry URL for Helm charts (e.g., oci://ghcr.io/traefik/helm) */
+        oci: z.ZodOptional<z.ZodString>;
+        /** Chart name */
+        chart: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }>, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }>>;
+    /** Regex pattern for filtering valid tags (default: semver-like) */
+    tag_pattern: z.ZodOptional<z.ZodString>;
+    /** Exclude pre-release versions (default: true) */
+    exclude_prerelease: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type: "helm";
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+    helm?: {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    } | undefined;
+}, {
+    name: string;
+    type: "helm";
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+    helm?: {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    } | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"namespace">;
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type: "namespace";
+    default?: string | undefined;
+}, {
+    name: string;
+    type: "namespace";
+    default?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodOptional<z.ZodLiteral<"generic">>;
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+    secret: z.ZodOptional<z.ZodString>;
+    preserve_case: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type?: "generic" | undefined;
+    default?: string | undefined;
+    secret?: string | undefined;
+    preserve_case?: boolean | undefined;
+}, {
+    name: string;
+    type?: "generic" | undefined;
+    default?: string | undefined;
+    secret?: string | undefined;
+    preserve_case?: boolean | undefined;
+}>]>;
+/**
+ * Plugin-provided substitution types.
+ * Plugins can register custom types (e.g., 'sops', 'vault', 'aws-secrets').
+ * Schema validation is delegated to the plugin's substitution provider.
+ */
+export declare const plugin_substitution_schema: z.ZodEffects<z.ZodObject<{
+    type: z.ZodString;
+    name: z.ZodString;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    type: z.ZodString;
+    name: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    type: z.ZodString;
+    name: z.ZodString;
+}, z.ZodTypeAny, "passthrough">>, z.objectOutputType<{
+    type: z.ZodString;
+    name: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    type: z.ZodString;
+    name: z.ZodString;
+}, z.ZodTypeAny, "passthrough">>;
+/**
+ * Union of all substitution types.
+ * Includes core types (version, helm, namespace, generic) plus plugin-provided types.
+ * Also includes Doppler and 1Password for backward compatibility (will be migrated to plugins).
+ *
+ * Supports backward compatibility: substitutions without 'type' are treated as generic.
+ */
+export declare const substitution_schema: z.ZodUnion<[z.ZodUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"version">;
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+    /** Semver constraint: ^1.0.0, ~2.3.0, >=1.0.0 <2.0.0 */
+    constraint: z.ZodOptional<z.ZodString>;
+    /** Registry configuration for fetching available versions (optional for simple substitutions) */
+    registry: z.ZodOptional<z.ZodObject<{
+        /** Full image reference: registry/namespace/image or just namespace/image for Docker Hub */
+        image: z.ZodString;
+        /** Registry type for API selection */
+        type: z.ZodOptional<z.ZodEnum<["dockerhub", "ghcr"]>>;
+    }, "strip", z.ZodTypeAny, {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    }, {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    }>>;
+    /** Regex pattern for filtering valid tags (default: semver-like) */
+    tag_pattern: z.ZodOptional<z.ZodString>;
+    /** Exclude pre-release versions (default: true) */
+    exclude_prerelease: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type: "version";
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+    registry?: {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    } | undefined;
+}, {
+    name: string;
+    type: "version";
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+    registry?: {
+        image: string;
+        type?: "dockerhub" | "ghcr" | undefined;
+    } | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"helm">;
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+    /** Semver constraint: ^1.0.0, ~2.3.0, >=1.0.0 <2.0.0 */
+    constraint: z.ZodOptional<z.ZodString>;
+    /** Helm repository configuration for fetching available chart versions (optional for simple substitutions) */
+    helm: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        /** Helm chart repository URL (e.g., https://traefik.github.io/charts) */
+        repository: z.ZodOptional<z.ZodString>;
+        /** OCI registry URL for Helm charts (e.g., oci://ghcr.io/traefik/helm) */
+        oci: z.ZodOptional<z.ZodString>;
+        /** Chart name */
+        chart: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }>, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }, {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    }>>;
+    /** Regex pattern for filtering valid tags (default: semver-like) */
+    tag_pattern: z.ZodOptional<z.ZodString>;
+    /** Exclude pre-release versions (default: true) */
+    exclude_prerelease: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type: "helm";
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+    helm?: {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    } | undefined;
+}, {
+    name: string;
+    type: "helm";
+    default?: string | undefined;
+    constraint?: string | undefined;
+    tag_pattern?: string | undefined;
+    exclude_prerelease?: boolean | undefined;
+    helm?: {
+        chart: string;
+        repository?: string | undefined;
+        oci?: string | undefined;
+    } | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"namespace">;
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type: "namespace";
+    default?: string | undefined;
+}, {
+    name: string;
+    type: "namespace";
+    default?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodOptional<z.ZodLiteral<"generic">>;
+    name: z.ZodString;
+    default: z.ZodOptional<z.ZodString>;
+    secret: z.ZodOptional<z.ZodString>;
+    preserve_case: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type?: "generic" | undefined;
+    default?: string | undefined;
+    secret?: string | undefined;
+    preserve_case?: boolean | undefined;
+}, {
+    name: string;
+    type?: "generic" | undefined;
+    default?: string | undefined;
+    secret?: string | undefined;
+    preserve_case?: boolean | undefined;
+}>]>, z.ZodEffects<z.ZodObject<{
+    type: z.ZodLiteral<"1password">;
+    name: z.ZodString;
+    /** 1Password secret reference: op://vault/item[/section]/field, or shorthand item/field when vault is configured at cluster level */
+    ref: z.ZodOptional<z.ZodString>;
+    /** Item name (shorthand, requires cluster-level vault configuration) */
+    item: z.ZodOptional<z.ZodString>;
+    /** Field name (shorthand, requires cluster-level vault configuration) */
+    field: z.ZodOptional<z.ZodString>;
+    /** Section name (optional, for shorthand references) */
+    section: z.ZodOptional<z.ZodString>;
+    /** Optional default value if secret cannot be fetched */
+    default: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type: "1password";
+    default?: string | undefined;
+    ref?: string | undefined;
+    item?: string | undefined;
+    field?: string | undefined;
+    section?: string | undefined;
+}, {
+    name: string;
+    type: "1password";
+    default?: string | undefined;
+    ref?: string | undefined;
+    item?: string | undefined;
+    field?: string | undefined;
+    section?: string | undefined;
+}>, {
+    name: string;
+    type: "1password";
+    default?: string | undefined;
+    ref?: string | undefined;
+    item?: string | undefined;
+    field?: string | undefined;
+    section?: string | undefined;
+}, {
+    name: string;
+    type: "1password";
+    default?: string | undefined;
+    ref?: string | undefined;
+    item?: string | undefined;
+    field?: string | undefined;
+    section?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"doppler">;
+    name: z.ZodString;
+    /** Doppler project name (optional if configured at cluster level) */
+    project: z.ZodOptional<z.ZodString>;
+    /** Doppler config name (optional if configured at cluster level, e.g., 'dev', 'stg', 'prd') */
+    config: z.ZodOptional<z.ZodString>;
+    /** Secret key name in Doppler */
+    secret: z.ZodString;
+    /** Optional default value if secret cannot be fetched */
+    default: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    type: "doppler";
+    secret: string;
+    default?: string | undefined;
+    project?: string | undefined;
+    config?: string | undefined;
+}, {
+    name: string;
+    type: "doppler";
+    secret: string;
+    default?: string | undefined;
+    project?: string | undefined;
+    config?: string | undefined;
+}>, z.ZodEffects<z.ZodObject<{
+    type: z.ZodString;
+    name: z.ZodString;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    type: z.ZodString;
+    name: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    type: z.ZodString;
+    name: z.ZodString;
+}, z.ZodTypeAny, "passthrough">>, z.objectOutputType<{
+    type: z.ZodString;
+    name: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    type: z.ZodString;
+    name: z.ZodString;
+}, z.ZodTypeAny, "passthrough">>]>;
+export type SubstitutionType = z.infer<typeof substitution_schema>;
+/**
+ * Type guard for version substitutions.
+ */
+export declare function is_version_substitution(sub: SubstitutionType): sub is VersionSubstitutionType;
+/**
+ * Type guard for helm substitutions.
+ */
+export declare function is_helm_substitution(sub: SubstitutionType): sub is HelmSubstitutionType;
+/**
+ * Type guard for namespace substitutions.
+ */
+export declare function is_namespace_substitution(sub: SubstitutionType): sub is NamespaceSubstitutionType;
+/**
+ * Type guard for generic substitutions.
+ */
+export declare function is_generic_substitution(sub: SubstitutionType): sub is GenericSubstitutionType;
+/**
+ * Type guard for 1Password substitutions.
+ */
+export declare function is_onepassword_substitution(sub: SubstitutionType): sub is OnePasswordSubstitutionType;
+/**
+ * Type guard for Doppler substitutions.
+ */
+export declare function is_doppler_substitution(sub: SubstitutionType): sub is DopplerSubstitutionType;
+/**
+ * Type guard for plugin-provided substitutions.
+ * Returns true if the substitution type is not a core type (version, helm, namespace, generic)
+ * and not a legacy type (1password, doppler).
+ */
+export declare function is_plugin_substitution(sub: SubstitutionType): boolean;
+/**
+ * Namespace configuration with fallback behavior.
+ */
+export declare const namespace_config_schema: z.ZodObject<{
+    default: z.ZodString;
+    create: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    default: string;
+    create: boolean;
+}, {
+    default: string;
+    create?: boolean | undefined;
+}>;
+export type NamespaceConfigType = z.infer<typeof namespace_config_schema>;
+/**
+ * Base auth configuration for kustomizations.
+ * This schema defines common fields that all auth providers share.
+ * Plugins (e.g., authelia, authentik) extend validation for provider-specific fields.
+ */
+export declare const auth_config_schema: z.ZodObject<{
+    /** Auth provider plugin name (e.g., 'authelia', 'authentik') */
+    provider: z.ZodString;
+    /** Provider-specific auth type (e.g., 'oidc', 'proxy', 'oauth2', 'saml') */
+    type: z.ZodString;
+    /** Application identifier (used for client_id, slug, etc.) */
+    app_name: z.ZodString;
+    /** Display name for the application */
+    app_display_name: z.ZodOptional<z.ZodString>;
+    /** Application description */
+    app_description: z.ZodOptional<z.ZodString>;
+    /** Application icon URL */
+    app_icon: z.ZodOptional<z.ZodString>;
+    /** Application group/category */
+    app_group: z.ZodOptional<z.ZodString>;
+    /** Application launch URL */
+    app_launch_url: z.ZodOptional<z.ZodString>;
+    /** External host for the application */
+    external_host: z.ZodOptional<z.ZodString>;
+    /** Internal service host (for proxy auth) */
+    internal_host: z.ZodOptional<z.ZodString>;
+    /** Provider-specific configuration (validated by auth plugins) */
+    config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    type: string;
+    provider: string;
+    app_name: string;
+    config?: Record<string, unknown> | undefined;
+    app_display_name?: string | undefined;
+    app_description?: string | undefined;
+    app_icon?: string | undefined;
+    app_group?: string | undefined;
+    app_launch_url?: string | undefined;
+    external_host?: string | undefined;
+    internal_host?: string | undefined;
+}, {
+    type: string;
+    provider: string;
+    app_name: string;
+    config?: Record<string, unknown> | undefined;
+    app_display_name?: string | undefined;
+    app_description?: string | undefined;
+    app_icon?: string | undefined;
+    app_group?: string | undefined;
+    app_launch_url?: string | undefined;
+    external_host?: string | undefined;
+    internal_host?: string | undefined;
+}>;
+export type AuthConfigType = z.infer<typeof auth_config_schema>;
+/**
+ * Key-value pairs for substitution values.
+ */
+export declare const values_schema: z.ZodRecord<z.ZodString, z.ZodString>;
+export type ValuesType = z.infer<typeof values_schema>;
+//# sourceMappingURL=common.d.ts.map