typekro 0.33.10 → 0.35.0

package/dist/factories/traefik/types.d.ts

@@ -0,0 +1,2690 @@
+/**
+ * Traefik type definitions.
+ *
+ * **ArkType is the single source of truth.** Every configuration type in this
+ * file — the `traefik.io/v1alpha1` CRD specs, the middleware set, and the
+ * bootstrap composition's spec — is INFERRED from the ArkType schema declared
+ * next to it (`typeof XSchema.infer`), per `docs/advanced/integration-skill.md`
+ * Step 2. One declaration then validates at runtime, generates the KRO
+ * SimpleSchema, and types the factory, so the three cannot drift. Only STATUS
+ * types stay hand-written: they describe what a controller publishes rather
+ * than user input.
+ *
+ * Three layers live here:
+ *
+ * 1. **CRD spec schemas** — verified field-by-field against the
+ *    `traefik.io/v1alpha1` CRDs shipped by chart 41.5.0 (Traefik v3.7.13), read
+ *    back from a live API server with
+ *    `kubectl get crd middlewares.traefik.io -o jsonpath='{.spec.versions[0].schema.openAPIV3Schema.properties.spec}'`.
+ *    None of the Traefik CRDs has a `status` subresource, which is why the
+ *    resource factories register an always-ready evaluator (see
+ *    `resources/routing.ts`). Where a schema is stricter than the CRD it is
+ *    deliberate and noted inline.
+ * 2. **Helm chart values** — {@link TraefikManagedHelmValues} is a CLOSED,
+ *    precise description of the chart paths this factory maps, pins or reads
+ *    back (verified against chart 41.5.0's `values.schema.json`). It carries no
+ *    index signatures at any depth; {@link TraefikRawHelmValues} is the single,
+ *    explicitly named raw-passthrough boundary for the rest of the chart.
+ * 3. **Bootstrap contract** — the runtime spec/status of the bootstrap
+ *    composition. Following the ClickStack convention these carry only
+ *    proxy-safe VALUES (names, namespaces, versions, ports, endpoints) that
+ *    serialize cleanly as CEL refs in KRO mode. Choices that decide WHICH
+ *    resources exist are build-time options on `makeTraefikBootstrap(...)`.
+ *
+ * @see https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/crd/
+ */
+import type { TypeKroChartValues } from '../../core/types/common.js';
+import type { Affinity, EnvVar, LabelSelector, SecurityContext, Toleration } from '../cert-manager/types.js';
+import type { HelmReleaseCrdsPolicy } from '../helm/types.js';
+/**
+ * Longest `name` this factory accepts, derived from {@link TRAEFIK_GENERATED_NAMES}.
+ *
+ * Exported so the schema test can assert the derivation rather than a number
+ * copied out of it.
+ */
+export declare const TRAEFIK_NAME_LIMIT: import("../../core/kubernetes/naming.js").DerivedNameLimit;
+/** Make every key of an inferred all-optional schema present and non-nullable. */
+type AllPresent<T> = {
+    [K in keyof T]-?: NonNullable<T[K]>;
+};
+/** A Traefik duration: a Go duration string, or an integer of nanoseconds. */
+export type TraefikDuration = string | number;
+/** A Kubernetes Service port: a number or a named port. */
+export type TraefikPortValue = string | number;
+/** How Traefik derives the client IP from proxy headers. */
+export declare const TraefikIpStrategySchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    depth?: number;
+    excludedIPs?: string[];
+    ipv6Subnet?: number;
+}, {}>;
+/** How Traefik derives the client IP from proxy headers. */
+export type TraefikIpStrategy = typeof TraefikIpStrategySchema.infer;
+/**
+ * What a `rateLimit` / `inFlightReq` middleware keys its counters on.
+ *
+ * Exactly one of these should be set; Traefik falls back to the client IP when
+ * none is given.
+ */
+export declare const TraefikSourceCriterionSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    requestHeaderName?: string;
+    requestHost?: boolean;
+    ipStrategy?: {
+        depth?: number;
+        excludedIPs?: string[];
+        ipv6Subnet?: number;
+    };
+}, {}>;
+/** What a `rateLimit` / `inFlightReq` middleware keys its counters on. */
+export type TraefikSourceCriterion = typeof TraefikSourceCriterionSchema.infer;
+/** Sticky-session cookie configuration for a load-balanced service. */
+export declare const TraefikStickyCookieSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    cookie?: {
+        name?: string;
+        secure?: boolean;
+        httpOnly?: boolean;
+        sameSite?: "none" | "strict" | "None" | "lax" | "Lax" | "Strict";
+        maxAge?: number;
+        path?: string;
+        domain?: string;
+    };
+}, {}>;
+/** Sticky-session cookie configuration for a load-balanced service. */
+export type TraefikStickyCookie = typeof TraefikStickyCookieSchema.infer;
+/**
+ * Active health check performed by Traefik against a service's servers.
+ *
+ * The CRD spells the Host override `hostname`; there is no `host` field.
+ */
+export declare const TraefikHealthCheckSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    path?: string;
+    hostname?: string;
+    scheme?: string;
+    mode?: string;
+    method?: string;
+    status?: number;
+    port?: number;
+    interval?: string | number;
+    unhealthyInterval?: string | number;
+    timeout?: string | number;
+    headers?: Record<string, string>;
+    followRedirects?: boolean;
+}, {}>;
+/** Active health check performed by Traefik against a service's servers. */
+export type TraefikHealthCheck = typeof TraefikHealthCheckSchema.infer;
+/** A reference to a `Middleware` resource. */
+export declare const TraefikMiddlewareRefSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    namespace?: string;
+}, {}>;
+/** A reference to a `Middleware` resource. */
+export type TraefikMiddlewareRef = typeof TraefikMiddlewareRefSchema.infer;
+/** Load-balancing strategy across a service's servers. */
+export type TraefikLoadBalancerStrategy = 'wrr' | 'p2c' | 'hrw' | 'leasttime' | 'RoundRobin';
+/** One backend of an `IngressRoute` route or a `TraefikService`. */
+export declare const TraefikServiceRefSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    namespace?: string;
+    kind?: "Service" | "TraefikService";
+    port?: string | number;
+    scheme?: string;
+    weight?: number;
+    strategy?: "wrr" | "p2c" | "hrw" | "leasttime" | "RoundRobin";
+    passHostHeader?: boolean;
+    nativeLB?: boolean;
+    nodePortLB?: boolean;
+    serversTransport?: string;
+    sticky?: {
+        cookie?: {
+            name?: string;
+            secure?: boolean;
+            httpOnly?: boolean;
+            sameSite?: "none" | "strict" | "None" | "lax" | "Lax" | "Strict";
+            maxAge?: number;
+            path?: string;
+            domain?: string;
+        };
+    };
+    healthCheck?: {
+        path?: string;
+        hostname?: string;
+        scheme?: string;
+        mode?: string;
+        method?: string;
+        status?: number;
+        port?: number;
+        interval?: string | number;
+        unhealthyInterval?: string | number;
+        timeout?: string | number;
+        headers?: Record<string, string>;
+        followRedirects?: boolean;
+    };
+    passiveHealthCheck?: {
+        failureWindow?: string | number;
+        maxFailedAttempts?: number;
+    };
+    responseForwarding?: {
+        flushInterval?: string;
+    };
+    middlewares?: {
+        name: string;
+        namespace?: string;
+    }[];
+}, {}>;
+/** One backend of an `IngressRoute` route or a `TraefikService`. */
+export type TraefikServiceRef = typeof TraefikServiceRefSchema.infer;
+/** TLS configuration attached to a router. */
+export declare const TraefikRouterTLSSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    secretName?: string;
+    options?: {
+        name: string;
+        namespace?: string;
+    };
+    store?: {
+        name: string;
+        namespace?: string;
+    };
+    certResolver?: string;
+    domains?: {
+        main?: string;
+        sans?: string[];
+    }[];
+}, {}>;
+/** TLS configuration attached to a router. */
+export type TraefikRouterTLS = typeof TraefikRouterTLSSchema.infer;
+/** Per-route observability overrides. */
+export declare const TraefikRouteObservabilitySchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    accessLogs?: boolean;
+    metrics?: boolean;
+    tracing?: boolean;
+    traceVerbosity?: "minimal" | "detailed";
+}, {}>;
+/** Per-route observability overrides. */
+export type TraefikRouteObservability = typeof TraefikRouteObservabilitySchema.infer;
+/** One `IngressRoute.spec.routes[]` entry. */
+export declare const TraefikIngressRouteRuleSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    match: string;
+    kind?: "Rule";
+    priority?: number;
+    syntax?: string;
+    services?: {
+        name: string;
+        namespace?: string;
+        kind?: "Service" | "TraefikService";
+        port?: string | number;
+        scheme?: string;
+        weight?: number;
+        strategy?: "wrr" | "p2c" | "hrw" | "leasttime" | "RoundRobin";
+        passHostHeader?: boolean;
+        nativeLB?: boolean;
+        nodePortLB?: boolean;
+        serversTransport?: string;
+        sticky?: {
+            cookie?: {
+                name?: string;
+                secure?: boolean;
+                httpOnly?: boolean;
+                sameSite?: "none" | "strict" | "None" | "lax" | "Lax" | "Strict";
+                maxAge?: number;
+                path?: string;
+                domain?: string;
+            };
+        };
+        healthCheck?: {
+            path?: string;
+            hostname?: string;
+            scheme?: string;
+            mode?: string;
+            method?: string;
+            status?: number;
+            port?: number;
+            interval?: string | number;
+            unhealthyInterval?: string | number;
+            timeout?: string | number;
+            headers?: Record<string, string>;
+            followRedirects?: boolean;
+        };
+        passiveHealthCheck?: {
+            failureWindow?: string | number;
+            maxFailedAttempts?: number;
+        };
+        responseForwarding?: {
+            flushInterval?: string;
+        };
+        middlewares?: {
+            name: string;
+            namespace?: string;
+        }[];
+    }[];
+    middlewares?: {
+        name: string;
+        namespace?: string;
+    }[];
+    observability?: {
+        accessLogs?: boolean;
+        metrics?: boolean;
+        tracing?: boolean;
+        traceVerbosity?: "minimal" | "detailed";
+    };
+}, {}>;
+/** One `IngressRoute.spec.routes[]` entry. */
+export type TraefikIngressRouteRule = typeof TraefikIngressRouteRuleSchema.infer;
+/** `IngressRoute.spec`. */
+export declare const TraefikIngressRouteSpecSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    routes: {
+        match: string;
+        kind?: "Rule";
+        priority?: number;
+        syntax?: string;
+        services?: {
+            name: string;
+            namespace?: string;
+            kind?: "Service" | "TraefikService";
+            port?: string | number;
+            scheme?: string;
+            weight?: number;
+            strategy?: "wrr" | "p2c" | "hrw" | "leasttime" | "RoundRobin";
+            passHostHeader?: boolean;
+            nativeLB?: boolean;
+            nodePortLB?: boolean;
+            serversTransport?: string;
+            sticky?: {
+                cookie?: {
+                    name?: string;
+                    secure?: boolean;
+                    httpOnly?: boolean;
+                    sameSite?: "none" | "strict" | "None" | "lax" | "Lax" | "Strict";
+                    maxAge?: number;
+                    path?: string;
+                    domain?: string;
+                };
+            };
+            healthCheck?: {
+                path?: string;
+                hostname?: string;
+                scheme?: string;
+                mode?: string;
+                method?: string;
+                status?: number;
+                port?: number;
+                interval?: string | number;
+                unhealthyInterval?: string | number;
+                timeout?: string | number;
+                headers?: Record<string, string>;
+                followRedirects?: boolean;
+            };
+            passiveHealthCheck?: {
+                failureWindow?: string | number;
+                maxFailedAttempts?: number;
+            };
+            responseForwarding?: {
+                flushInterval?: string;
+            };
+            middlewares?: {
+                name: string;
+                namespace?: string;
+            }[];
+        }[];
+        middlewares?: {
+            name: string;
+            namespace?: string;
+        }[];
+        observability?: {
+            accessLogs?: boolean;
+            metrics?: boolean;
+            tracing?: boolean;
+            traceVerbosity?: "minimal" | "detailed";
+        };
+    }[];
+    entryPoints?: string[];
+    ingressClassName?: string;
+    tls?: {
+        secretName?: string;
+        options?: {
+            name: string;
+            namespace?: string;
+        };
+        store?: {
+            name: string;
+            namespace?: string;
+        };
+        certResolver?: string;
+        domains?: {
+            main?: string;
+            sans?: string[];
+        }[];
+    };
+    parentRefs?: {
+        name: string;
+        namespace?: string;
+    }[];
+}, {}>;
+/** `IngressRoute.spec`. */
+export type TraefikIngressRouteSpec = typeof TraefikIngressRouteSpecSchema.infer;
+/** One backend of an `IngressRouteTCP` route. */
+export declare const TraefikTCPServiceRefSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    port: string | number;
+    namespace?: string;
+    weight?: number;
+    tls?: boolean;
+    nativeLB?: boolean;
+    nodePortLB?: boolean;
+    serversTransport?: string;
+    proxyProtocol?: {
+        version?: number;
+    };
+}, {}>;
+/** One backend of an `IngressRouteTCP` route. */
+export type TraefikTCPServiceRef = typeof TraefikTCPServiceRefSchema.infer;
+/** One `IngressRouteTCP.spec.routes[]` entry. */
+export declare const TraefikIngressRouteTCPRuleSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    match: string;
+    priority?: number;
+    syntax?: "v3" | "v2";
+    services?: {
+        name: string;
+        port: string | number;
+        namespace?: string;
+        weight?: number;
+        tls?: boolean;
+        nativeLB?: boolean;
+        nodePortLB?: boolean;
+        serversTransport?: string;
+        proxyProtocol?: {
+            version?: number;
+        };
+    }[];
+    middlewares?: {
+        name: string;
+        namespace?: string;
+    }[];
+}, {}>;
+/** One `IngressRouteTCP.spec.routes[]` entry. */
+export type TraefikIngressRouteTCPRule = typeof TraefikIngressRouteTCPRuleSchema.infer;
+/** `IngressRouteTCP.spec`. */
+export declare const TraefikIngressRouteTCPSpecSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    routes: {
+        match: string;
+        priority?: number;
+        syntax?: "v3" | "v2";
+        services?: {
+            name: string;
+            port: string | number;
+            namespace?: string;
+            weight?: number;
+            tls?: boolean;
+            nativeLB?: boolean;
+            nodePortLB?: boolean;
+            serversTransport?: string;
+            proxyProtocol?: {
+                version?: number;
+            };
+        }[];
+        middlewares?: {
+            name: string;
+            namespace?: string;
+        }[];
+    }[];
+    entryPoints?: string[];
+    ingressClassName?: string;
+    tls?: {
+        secretName?: string;
+        options?: {
+            name: string;
+            namespace?: string;
+        };
+        store?: {
+            name: string;
+            namespace?: string;
+        };
+        certResolver?: string;
+        domains?: {
+            main?: string;
+            sans?: string[];
+        }[];
+        passthrough?: boolean;
+    };
+}, {}>;
+/** `IngressRouteTCP.spec`. */
+export type TraefikIngressRouteTCPSpec = typeof TraefikIngressRouteTCPSpecSchema.infer;
+/**
+ * `TraefikService.spec` — exactly one composition mode should be set.
+ *
+ * `failover.errors` is required because the CRD requires it alongside
+ * `service` and `fallback`.
+ */
+export declare const TraefikServiceSpecSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    weighted?: {
+        services?: {
+            name: string;
+            namespace?: string;
+            kind?: "Service" | "TraefikService";
+            port?: string | number;
+            scheme?: string;
+            weight?: number;
+            strategy?: "wrr" | "p2c" | "hrw" | "leasttime" | "RoundRobin";
+            passHostHeader?: boolean;
+            nativeLB?: boolean;
+            nodePortLB?: boolean;
+            serversTransport?: string;
+            sticky?: {
+                cookie?: {
+                    name?: string;
+                    secure?: boolean;
+                    httpOnly?: boolean;
+                    sameSite?: "none" | "strict" | "None" | "lax" | "Lax" | "Strict";
+                    maxAge?: number;
+                    path?: string;
+                    domain?: string;
+                };
+            };
+            healthCheck?: {
+                path?: string;
+                hostname?: string;
+                scheme?: string;
+                mode?: string;
+                method?: string;
+                status?: number;
+                port?: number;
+                interval?: string | number;
+                unhealthyInterval?: string | number;
+                timeout?: string | number;
+                headers?: Record<string, string>;
+                followRedirects?: boolean;
+            };
+            passiveHealthCheck?: {
+                failureWindow?: string | number;
+                maxFailedAttempts?: number;
+            };
+            responseForwarding?: {
+                flushInterval?: string;
+            };
+            middlewares?: {
+                name: string;
+                namespace?: string;
+            }[];
+        }[];
+        sticky?: {
+            cookie?: {
+                name?: string;
+                secure?: boolean;
+                httpOnly?: boolean;
+                sameSite?: "none" | "strict" | "None" | "lax" | "Lax" | "Strict";
+                maxAge?: number;
+                path?: string;
+                domain?: string;
+            };
+        };
+    };
+    mirroring?: {
+        name: string;
+        namespace?: string;
+        kind?: "Service" | "TraefikService";
+        port?: string | number;
+        scheme?: string;
+        weight?: number;
+        strategy?: "wrr" | "p2c" | "hrw" | "leasttime" | "RoundRobin";
+        passHostHeader?: boolean;
+        nativeLB?: boolean;
+        nodePortLB?: boolean;
+        serversTransport?: string;
+        sticky?: {
+            cookie?: {
+                name?: string;
+                secure?: boolean;
+                httpOnly?: boolean;
+                sameSite?: "none" | "strict" | "None" | "lax" | "Lax" | "Strict";
+                maxAge?: number;
+                path?: string;
+                domain?: string;
+            };
+        };
+        healthCheck?: {
+            path?: string;
+            hostname?: string;
+            scheme?: string;
+            mode?: string;
+            method?: string;
+            status?: number;
+            port?: number;
+            interval?: string | number;
+            unhealthyInterval?: string | number;
+            timeout?: string | number;
+            headers?: Record<string, string>;
+            followRedirects?: boolean;
+        };
+        passiveHealthCheck?: {
+            failureWindow?: string | number;
+            maxFailedAttempts?: number;
+        };
+        responseForwarding?: {
+            flushInterval?: string;
+        };
+        middlewares?: {
+            name: string;
+            namespace?: string;
+        }[];
+        maxBodySize?: number;
+        mirrorBody?: boolean;
+        mirrors?: {
+            name: string;
+            namespace?: string;
+            kind?: "Service" | "TraefikService";
+            port?: string | number;
+            scheme?: string;
+            weight?: number;
+            strategy?: "wrr" | "p2c" | "hrw" | "leasttime" | "RoundRobin";
+            passHostHeader?: boolean;
+            nativeLB?: boolean;
+            nodePortLB?: boolean;
+            serversTransport?: string;
+            sticky?: {
+                cookie?: {
+                    name?: string;
+                    secure?: boolean;
+                    httpOnly?: boolean;
+                    sameSite?: "none" | "strict" | "None" | "lax" | "Lax" | "Strict";
+                    maxAge?: number;
+                    path?: string;
+                    domain?: string;
+                };
+            };
+            healthCheck?: {
+                path?: string;
+                hostname?: string;
+                scheme?: string;
+                mode?: string;
+                method?: string;
+                status?: number;
+                port?: number;
+                interval?: string | number;
+                unhealthyInterval?: string | number;
+                timeout?: string | number;
+                headers?: Record<string, string>;
+                followRedirects?: boolean;
+            };
+            passiveHealthCheck?: {
+                failureWindow?: string | number;
+                maxFailedAttempts?: number;
+            };
+            responseForwarding?: {
+                flushInterval?: string;
+            };
+            middlewares?: {
+                name: string;
+                namespace?: string;
+            }[];
+            percent?: number;
+        }[];
+    };
+    failover?: {
+        service: {
+            name: string;
+            namespace?: string;
+            kind?: "Service" | "TraefikService";
+            port?: string | number;
+            scheme?: string;
+            weight?: number;
+            strategy?: "wrr" | "p2c" | "hrw" | "leasttime" | "RoundRobin";
+            passHostHeader?: boolean;
+            nativeLB?: boolean;
+            nodePortLB?: boolean;
+            serversTransport?: string;
+            sticky?: {
+                cookie?: {
+                    name?: string;
+                    secure?: boolean;
+                    httpOnly?: boolean;
+                    sameSite?: "none" | "strict" | "None" | "lax" | "Lax" | "Strict";
+                    maxAge?: number;
+                    path?: string;
+                    domain?: string;
+                };
+            };
+            healthCheck?: {
+                path?: string;
+                hostname?: string;
+                scheme?: string;
+                mode?: string;
+                method?: string;
+                status?: number;
+                port?: number;
+                interval?: string | number;
+                unhealthyInterval?: string | number;
+                timeout?: string | number;
+                headers?: Record<string, string>;
+                followRedirects?: boolean;
+            };
+            passiveHealthCheck?: {
+                failureWindow?: string | number;
+                maxFailedAttempts?: number;
+            };
+            responseForwarding?: {
+                flushInterval?: string;
+            };
+            middlewares?: {
+                name: string;
+                namespace?: string;
+            }[];
+        };
+        fallback: {
+            name: string;
+            namespace?: string;
+            kind?: "Service" | "TraefikService";
+            port?: string | number;
+            scheme?: string;
+            weight?: number;
+            strategy?: "wrr" | "p2c" | "hrw" | "leasttime" | "RoundRobin";
+            passHostHeader?: boolean;
+            nativeLB?: boolean;
+            nodePortLB?: boolean;
+            serversTransport?: string;
+            sticky?: {
+                cookie?: {
+                    name?: string;
+                    secure?: boolean;
+                    httpOnly?: boolean;
+                    sameSite?: "none" | "strict" | "None" | "lax" | "Lax" | "Strict";
+                    maxAge?: number;
+                    path?: string;
+                    domain?: string;
+                };
+            };
+            healthCheck?: {
+                path?: string;
+                hostname?: string;
+                scheme?: string;
+                mode?: string;
+                method?: string;
+                status?: number;
+                port?: number;
+                interval?: string | number;
+                unhealthyInterval?: string | number;
+                timeout?: string | number;
+                headers?: Record<string, string>;
+                followRedirects?: boolean;
+            };
+            passiveHealthCheck?: {
+                failureWindow?: string | number;
+                maxFailedAttempts?: number;
+            };
+            responseForwarding?: {
+                flushInterval?: string;
+            };
+            middlewares?: {
+                name: string;
+                namespace?: string;
+            }[];
+        };
+        errors: {
+            status?: string[];
+            maxRequestBodyBytes?: number;
+        };
+    };
+    highestRandomWeight?: {
+        services?: {
+            name: string;
+            namespace?: string;
+            kind?: "Service" | "TraefikService";
+            port?: string | number;
+            scheme?: string;
+            weight?: number;
+            strategy?: "wrr" | "p2c" | "hrw" | "leasttime" | "RoundRobin";
+            passHostHeader?: boolean;
+            nativeLB?: boolean;
+            nodePortLB?: boolean;
+            serversTransport?: string;
+            sticky?: {
+                cookie?: {
+                    name?: string;
+                    secure?: boolean;
+                    httpOnly?: boolean;
+                    sameSite?: "none" | "strict" | "None" | "lax" | "Lax" | "Strict";
+                    maxAge?: number;
+                    path?: string;
+                    domain?: string;
+                };
+            };
+            healthCheck?: {
+                path?: string;
+                hostname?: string;
+                scheme?: string;
+                mode?: string;
+                method?: string;
+                status?: number;
+                port?: number;
+                interval?: string | number;
+                unhealthyInterval?: string | number;
+                timeout?: string | number;
+                headers?: Record<string, string>;
+                followRedirects?: boolean;
+            };
+            passiveHealthCheck?: {
+                failureWindow?: string | number;
+                maxFailedAttempts?: number;
+            };
+            responseForwarding?: {
+                flushInterval?: string;
+            };
+            middlewares?: {
+                name: string;
+                namespace?: string;
+            }[];
+        }[];
+    };
+}, {}>;
+/** `TraefikService.spec`. */
+export type TraefikServiceSpec = typeof TraefikServiceSpecSchema.infer;
+/** `ServersTransport.spec` — how Traefik dials upstream servers. */
+export declare const TraefikServersTransportSpecSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    serverName?: string;
+    insecureSkipVerify?: boolean;
+    rootCAsSecrets?: string[];
+    rootCAs?: {
+        secret?: string;
+        configMap?: string;
+    }[];
+    certificatesSecrets?: string[];
+    maxIdleConnsPerHost?: number;
+    disableHTTP2?: boolean;
+    peerCertURI?: string;
+    minVersion?: string;
+    maxVersion?: string;
+    cipherSuites?: string[];
+    spiffe?: {
+        ids?: string[];
+        trustDomain?: string;
+    };
+    forwardingTimeouts?: {
+        dialTimeout?: string | number;
+        responseHeaderTimeout?: string | number;
+        idleConnTimeout?: string | number;
+        readIdleTimeout?: string | number;
+        pingTimeout?: string | number;
+    };
+}, {}>;
+/** `ServersTransport.spec`. */
+export type TraefikServersTransportSpec = typeof TraefikServersTransportSpecSchema.infer;
+/** Mutual-TLS behavior of a `TLSOption`. */
+export declare const TraefikClientAuthSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    secretNames?: string[];
+    clientAuthType?: "NoClientCert" | "RequestClientCert" | "RequireAnyClientCert" | "VerifyClientCertIfGiven" | "RequireAndVerifyClientCert";
+}, {}>;
+/** Mutual-TLS behavior of a `TLSOption`. */
+export type TraefikClientAuth = typeof TraefikClientAuthSchema.infer;
+/**
+ * `TLSOption.spec`.
+ *
+ * `minVersion`/`maxVersion` are narrower than the CRD's bare string: those four
+ * are the values Traefik accepts, so a typo is caught here instead of by the
+ * proxy at runtime. The CRD's deprecated `preferServerCipherSuites` is
+ * deliberately absent — Traefik v3 ignores it.
+ */
+export declare const TraefikTLSOptionSpecSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    minVersion?: "VersionTLS10" | "VersionTLS11" | "VersionTLS12" | "VersionTLS13";
+    maxVersion?: "VersionTLS10" | "VersionTLS11" | "VersionTLS12" | "VersionTLS13";
+    cipherSuites?: string[];
+    curvePreferences?: string[];
+    sniStrict?: boolean;
+    alpnProtocols?: string[];
+    disableSessionTickets?: boolean;
+    clientAuth?: {
+        secretNames?: string[];
+        clientAuthType?: "NoClientCert" | "RequestClientCert" | "RequireAnyClientCert" | "VerifyClientCertIfGiven" | "RequireAndVerifyClientCert";
+    };
+}, {}>;
+/** `TLSOption.spec`. */
+export type TraefikTLSOptionSpec = typeof TraefikTLSOptionSpecSchema.infer;
+/** `TLSStore.spec`. */
+export declare const TraefikTLSStoreSpecSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    defaultCertificate?: {
+        secretName: string;
+    };
+    defaultGeneratedCert?: {
+        resolver?: string;
+        domain?: {
+            main?: string;
+            sans?: string[];
+        };
+    };
+    certificates?: {
+        secretName: string;
+    }[];
+}, {}>;
+/** `TLSStore.spec`. */
+export type TraefikTLSStoreSpec = typeof TraefikTLSStoreSpecSchema.infer;
+/**
+ * Delegate authentication and authorization to an in-cluster authorizer.
+ *
+ * `address` is required although the CRD allows it to be absent: a
+ * `forwardAuth` with no authorizer fails every request.
+ *
+ * @security `trustForwardHeader` defaults to `false` in
+ * {@link TRAEFIK_FORWARD_AUTH_SECURE_DEFAULTS}: trusting `X-Forwarded-*` from
+ * an untrusted client lets a caller spoof its own identity. `authResponseHeaders`
+ * is an explicit allowlist — only the listed headers are copied from the
+ * authorizer response onto the upstream request.
+ */
+export declare const TraefikForwardAuthMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    address: string;
+    trustForwardHeader?: boolean;
+    authResponseHeaders?: string[];
+    authResponseHeadersRegex?: string;
+    authRequestHeaders?: string[];
+    addAuthCookiesToResponse?: string[];
+    authSigninURL?: string;
+    forwardBody?: boolean;
+    maxBodySize?: number;
+    maxResponseBodySize?: number;
+    headerField?: string;
+    preserveLocationHeader?: boolean;
+    preserveRequestMethod?: boolean;
+    tls?: {
+        caSecret?: string;
+        certSecret?: string;
+        insecureSkipVerify?: boolean;
+    };
+}, {}>;
+/** Delegate authentication and authorization to an in-cluster authorizer. */
+export type TraefikForwardAuthMiddleware = typeof TraefikForwardAuthMiddlewareSchema.infer;
+/** Redis (or Valkey) backend making a rate limit shared across Traefik replicas. */
+export declare const TraefikRateLimitRedisSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    endpoints: string[];
+    secret?: string;
+    db?: number;
+    poolSize?: number;
+    minIdleConns?: number;
+    maxActiveConns?: number;
+    dialTimeout?: string | number;
+    readTimeout?: string | number;
+    writeTimeout?: string | number;
+    tls?: {
+        caSecret?: string;
+        certSecret?: string;
+        insecureSkipVerify?: boolean;
+    };
+}, {}>;
+/** Redis (or Valkey) backend making a rate limit shared across Traefik replicas. */
+export type TraefikRateLimitRedis = typeof TraefikRateLimitRedisSchema.infer;
+/**
+ * Token-bucket rate limit.
+ *
+ * Without `redis` each Traefik replica keeps its own counters, so the effective
+ * limit is `average × replicas`. Supply the Redis backend whenever the budget
+ * must hold for the whole edge.
+ */
+export declare const TraefikRateLimitMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    average?: number;
+    burst?: number;
+    period?: string | number;
+    sourceCriterion?: {
+        requestHeaderName?: string;
+        requestHost?: boolean;
+        ipStrategy?: {
+            depth?: number;
+            excludedIPs?: string[];
+            ipv6Subnet?: number;
+        };
+    };
+    redis?: {
+        endpoints: string[];
+        secret?: string;
+        db?: number;
+        poolSize?: number;
+        minIdleConns?: number;
+        maxActiveConns?: number;
+        dialTimeout?: string | number;
+        readTimeout?: string | number;
+        writeTimeout?: string | number;
+        tls?: {
+            caSecret?: string;
+            certSecret?: string;
+            insecureSkipVerify?: boolean;
+        };
+    };
+}, {}>;
+/** Token-bucket rate limit. */
+export type TraefikRateLimitMiddleware = typeof TraefikRateLimitMiddlewareSchema.infer;
+/** Cap on requests being handled concurrently, per source. */
+export declare const TraefikInFlightReqMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    amount?: number;
+    sourceCriterion?: {
+        requestHeaderName?: string;
+        requestHost?: boolean;
+        ipStrategy?: {
+            depth?: number;
+            excludedIPs?: string[];
+            ipv6Subnet?: number;
+        };
+    };
+}, {}>;
+/** Cap on requests being handled concurrently, per source. */
+export type TraefikInFlightReqMiddleware = typeof TraefikInFlightReqMiddlewareSchema.infer;
+/**
+ * CORS and browser security headers.
+ *
+ * The CRD's `sslRedirect`, `sslTemporaryRedirect`, `sslHost` and `sslForceHost`
+ * are deliberately absent: Traefik v3 dropped them in favour of the
+ * `redirectScheme` middleware, and the CRD keeps them only for v2 manifests.
+ */
+export declare const TraefikHeadersMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    customRequestHeaders?: Record<string, string>;
+    customResponseHeaders?: Record<string, string>;
+    accessControlAllowCredentials?: boolean;
+    accessControlAllowHeaders?: string[];
+    accessControlAllowMethods?: string[];
+    accessControlAllowOriginList?: string[];
+    accessControlAllowOriginListRegex?: string[];
+    accessControlExposeHeaders?: string[];
+    accessControlMaxAge?: number;
+    addVaryHeader?: boolean;
+    allowedHosts?: string[];
+    hostsProxyHeaders?: string[];
+    sslProxyHeaders?: Record<string, string>;
+    stsSeconds?: number;
+    stsIncludeSubdomains?: boolean;
+    stsPreload?: boolean;
+    forceSTSHeader?: boolean;
+    frameDeny?: boolean;
+    customFrameOptionsValue?: string;
+    contentTypeNosniff?: boolean;
+    browserXssFilter?: boolean;
+    customBrowserXSSValue?: string;
+    contentSecurityPolicy?: string;
+    contentSecurityPolicyReportOnly?: string;
+    publicKey?: string;
+    referrerPolicy?: string;
+    permissionsPolicy?: string;
+    featurePolicy?: string;
+    isDevelopment?: boolean;
+}, {}>;
+/** CORS and browser security headers. */
+export type TraefikHeadersMiddleware = typeof TraefikHeadersMiddlewareSchema.infer;
+/** Redirect a request to another scheme, e.g. `web` → `websecure`. */
+export declare const TraefikRedirectSchemeMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    scheme: "http" | "https";
+    port?: string;
+    permanent?: boolean;
+}, {}>;
+/** Redirect a request to another scheme. */
+export type TraefikRedirectSchemeMiddleware = typeof TraefikRedirectSchemeMiddlewareSchema.infer;
+/** Regex-based redirect. */
+export declare const TraefikRedirectRegexMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    regex: string;
+    replacement: string;
+    permanent?: boolean;
+}, {}>;
+/** Regex-based redirect. */
+export type TraefikRedirectRegexMiddleware = typeof TraefikRedirectRegexMiddlewareSchema.infer;
+/** Remove one of `prefixes` from the request path before forwarding. */
+export declare const TraefikStripPrefixMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    prefixes: string[];
+    forceSlash?: boolean;
+}, {}>;
+/** Remove one of `prefixes` from the request path before forwarding. */
+export type TraefikStripPrefixMiddleware = typeof TraefikStripPrefixMiddlewareSchema.infer;
+/** Remove a regex-matched prefix from the request path. */
+export declare const TraefikStripPrefixRegexMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    regex: string[];
+}, {}>;
+/** Remove a regex-matched prefix from the request path. */
+export type TraefikStripPrefixRegexMiddleware = typeof TraefikStripPrefixRegexMiddlewareSchema.infer;
+/** Prepend a prefix to the request path. */
+export declare const TraefikAddPrefixMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    prefix: string;
+}, {}>;
+/** Prepend a prefix to the request path. */
+export type TraefikAddPrefixMiddleware = typeof TraefikAddPrefixMiddlewareSchema.infer;
+/** Replace the whole request path. */
+export declare const TraefikReplacePathMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    path: string;
+}, {}>;
+/** Replace the whole request path. */
+export type TraefikReplacePathMiddleware = typeof TraefikReplacePathMiddlewareSchema.infer;
+/** Replace a regex-matched request path. */
+export declare const TraefikReplacePathRegexMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    regex: string;
+    replacement: string;
+}, {}>;
+/** Replace a regex-matched request path. */
+export type TraefikReplacePathRegexMiddleware = typeof TraefikReplacePathRegexMiddlewareSchema.infer;
+/**
+ * Body buffering and size limits.
+ *
+ * `maxRequestBodyBytes` is the request-size cap an edge needs so an upstream
+ * cannot be flooded; a `retryExpression` requires buffering to be able to
+ * replay the body.
+ */
+export declare const TraefikBufferingMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    maxRequestBodyBytes?: number;
+    memRequestBodyBytes?: number;
+    maxResponseBodyBytes?: number;
+    memResponseBodyBytes?: number;
+    retryExpression?: string;
+}, {}>;
+/** Body buffering and size limits. */
+export type TraefikBufferingMiddleware = typeof TraefikBufferingMiddlewareSchema.infer;
+/** Retry a request against the next available server. */
+export declare const TraefikRetryMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    attempts?: number;
+    initialInterval?: string | number;
+    timeout?: string | number;
+    status?: string[];
+    maxRequestBodyBytes?: number;
+    disableRetryOnNetworkError?: boolean;
+    retryNonIdempotentMethod?: boolean;
+}, {}>;
+/** Retry a request against the next available server. */
+export type TraefikRetryMiddleware = typeof TraefikRetryMiddlewareSchema.infer;
+/** Trip a circuit when the guard expression evaluates true. */
+export declare const TraefikCircuitBreakerMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    expression?: string;
+    checkPeriod?: string | number;
+    fallbackDuration?: string | number;
+    recoveryDuration?: string | number;
+    responseCode?: number;
+}, {}>;
+/** Trip a circuit when the guard expression evaluates true. */
+export type TraefikCircuitBreakerMiddleware = typeof TraefikCircuitBreakerMiddlewareSchema.infer;
+/** Allow only the listed source ranges. */
+export declare const TraefikIpAllowListMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    sourceRange: string[];
+    ipStrategy?: {
+        depth?: number;
+        excludedIPs?: string[];
+        ipv6Subnet?: number;
+    };
+    rejectStatusCode?: number;
+}, {}>;
+/** Allow only the listed source ranges. */
+export type TraefikIpAllowListMiddleware = typeof TraefikIpAllowListMiddlewareSchema.infer;
+/** HTTP basic or digest auth backed by a Secret of htpasswd users. */
+export declare const TraefikCredentialAuthMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    secret: string;
+    realm?: string;
+    removeHeader?: boolean;
+    headerField?: string;
+}, {}>;
+/** HTTP basic or digest auth backed by a Secret of htpasswd users. */
+export type TraefikCredentialAuthMiddleware = typeof TraefikCredentialAuthMiddlewareSchema.infer;
+/** Response compression. */
+export declare const TraefikCompressMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    encodings?: string[];
+    defaultEncoding?: string;
+    includedContentTypes?: string[];
+    excludedContentTypes?: string[];
+    minResponseBodyBytes?: number;
+}, {}>;
+/** Response compression. */
+export type TraefikCompressMiddleware = typeof TraefikCompressMiddlewareSchema.infer;
+/**
+ * Serve custom error pages from another service.
+ *
+ * `service` is required although the CRD allows it to be absent: without a
+ * backend there is nothing to serve the error page from.
+ */
+export declare const TraefikErrorsMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    service: {
+        name: string;
+        namespace?: string;
+        kind?: "Service" | "TraefikService";
+        port?: string | number;
+        scheme?: string;
+        weight?: number;
+        strategy?: "wrr" | "p2c" | "hrw" | "leasttime" | "RoundRobin";
+        passHostHeader?: boolean;
+        nativeLB?: boolean;
+        nodePortLB?: boolean;
+        serversTransport?: string;
+        sticky?: {
+            cookie?: {
+                name?: string;
+                secure?: boolean;
+                httpOnly?: boolean;
+                sameSite?: "none" | "strict" | "None" | "lax" | "Lax" | "Strict";
+                maxAge?: number;
+                path?: string;
+                domain?: string;
+            };
+        };
+        healthCheck?: {
+            path?: string;
+            hostname?: string;
+            scheme?: string;
+            mode?: string;
+            method?: string;
+            status?: number;
+            port?: number;
+            interval?: string | number;
+            unhealthyInterval?: string | number;
+            timeout?: string | number;
+            headers?: Record<string, string>;
+            followRedirects?: boolean;
+        };
+        passiveHealthCheck?: {
+            failureWindow?: string | number;
+            maxFailedAttempts?: number;
+        };
+        responseForwarding?: {
+            flushInterval?: string;
+        };
+        middlewares?: {
+            name: string;
+            namespace?: string;
+        }[];
+    };
+    status?: string[];
+    statusRewrites?: Record<string, number>;
+    query?: string;
+    errorRequestHeaders?: string[];
+}, {}>;
+/** Serve custom error pages from another service. */
+export type TraefikErrorsMiddleware = typeof TraefikErrorsMiddlewareSchema.infer;
+/** Apply an ordered list of other middlewares. */
+export declare const TraefikChainMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    middlewares: {
+        name: string;
+        namespace?: string;
+    }[];
+}, {}>;
+/** Apply an ordered list of other middlewares. */
+export type TraefikChainMiddleware = typeof TraefikChainMiddlewareSchema.infer;
+/** Forward client-certificate information to the upstream. */
+export declare const TraefikPassTLSClientCertMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    pem?: boolean;
+    info?: {
+        notAfter?: boolean;
+        notBefore?: boolean;
+        sans?: boolean;
+        serialNumber?: boolean;
+        subject?: {
+            commonName?: boolean;
+            country?: boolean;
+            domainComponent?: boolean;
+            locality?: boolean;
+            organization?: boolean;
+            organizationalUnit?: boolean;
+            province?: boolean;
+            serialNumber?: boolean;
+        };
+        issuer?: {
+            commonName?: boolean;
+            country?: boolean;
+            domainComponent?: boolean;
+            locality?: boolean;
+            organization?: boolean;
+            province?: boolean;
+            serialNumber?: boolean;
+        };
+    };
+}, {}>;
+/** Forward client-certificate information to the upstream. */
+export type TraefikPassTLSClientCertMiddleware = typeof TraefikPassTLSClientCertMiddlewareSchema.infer;
+/** Auto-detect the response `Content-Type` when the upstream omits it. */
+export declare const TraefikContentTypeMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    autoDetect?: boolean;
+}, {}>;
+/** Auto-detect the response `Content-Type` when the upstream omits it. */
+export type TraefikContentTypeMiddleware = typeof TraefikContentTypeMiddlewareSchema.infer;
+/** Allow otherwise-rejected percent-encoded characters in the request path. */
+export declare const TraefikEncodedCharactersMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    allowEncodedSlash?: boolean;
+    allowEncodedBackSlash?: boolean;
+    allowEncodedNullCharacter?: boolean;
+    allowEncodedSemicolon?: boolean;
+    allowEncodedPercent?: boolean;
+    allowEncodedQuestionMark?: boolean;
+    allowEncodedHash?: boolean;
+}, {}>;
+/** Allow otherwise-rejected percent-encoded characters in the request path. */
+export type TraefikEncodedCharactersMiddleware = typeof TraefikEncodedCharactersMiddlewareSchema.infer;
+/** Bridge gRPC-Web clients to a gRPC upstream. */
+export declare const TraefikGrpcWebMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    allowOrigins?: string[];
+}, {}>;
+/** Bridge gRPC-Web clients to a gRPC upstream. */
+export type TraefikGrpcWebMiddleware = typeof TraefikGrpcWebMiddlewareSchema.infer;
+/**
+ * A Traefik plugin middleware.
+ *
+ * Keyed by the plugin name declared in `experimental.plugins`; the value shape
+ * belongs to the plugin itself. This is one of the boundaries where `unknown`
+ * is correct rather than lazy — the CRD marks it
+ * `x-kubernetes-preserve-unknown-fields`, so there is no schema to model.
+ */
+export declare const TraefikPluginMiddlewareSchema: import("arktype/internal/variants/object.ts").ObjectType<Record<string, unknown>, {}>;
+/** A Traefik plugin middleware, keyed by plugin name. */
+export type TraefikPluginMiddleware = typeof TraefikPluginMiddlewareSchema.infer;
+/**
+ * Every OSS middleware keyed by its CRD field name, all keys optional.
+ *
+ * A `Middleware` object carries exactly one of them, which
+ * {@link TraefikMiddlewareSpecSchema} enforces with `.narrow()` while keeping
+ * this base object shape intact so KRO SimpleSchema generation can still
+ * discover the fields.
+ */
+declare const TraefikMiddlewareSpecMapSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    addPrefix?: {
+        prefix: string;
+    };
+    basicAuth?: {
+        secret: string;
+        realm?: string;
+        removeHeader?: boolean;
+        headerField?: string;
+    };
+    buffering?: {
+        maxRequestBodyBytes?: number;
+        memRequestBodyBytes?: number;
+        maxResponseBodyBytes?: number;
+        memResponseBodyBytes?: number;
+        retryExpression?: string;
+    };
+    chain?: {
+        middlewares: {
+            name: string;
+            namespace?: string;
+        }[];
+    };
+    circuitBreaker?: {
+        expression?: string;
+        checkPeriod?: string | number;
+        fallbackDuration?: string | number;
+        recoveryDuration?: string | number;
+        responseCode?: number;
+    };
+    compress?: {
+        encodings?: string[];
+        defaultEncoding?: string;
+        includedContentTypes?: string[];
+        excludedContentTypes?: string[];
+        minResponseBodyBytes?: number;
+    };
+    contentType?: {
+        autoDetect?: boolean;
+    };
+    digestAuth?: {
+        secret: string;
+        realm?: string;
+        removeHeader?: boolean;
+        headerField?: string;
+    };
+    encodedCharacters?: {
+        allowEncodedSlash?: boolean;
+        allowEncodedBackSlash?: boolean;
+        allowEncodedNullCharacter?: boolean;
+        allowEncodedSemicolon?: boolean;
+        allowEncodedPercent?: boolean;
+        allowEncodedQuestionMark?: boolean;
+        allowEncodedHash?: boolean;
+    };
+    errors?: {
+        service: {
+            name: string;
+            namespace?: string;
+            kind?: "Service" | "TraefikService";
+            port?: string | number;
+            scheme?: string;
+            weight?: number;
+            strategy?: "wrr" | "p2c" | "hrw" | "leasttime" | "RoundRobin";
+            passHostHeader?: boolean;
+            nativeLB?: boolean;
+            nodePortLB?: boolean;
+            serversTransport?: string;
+            sticky?: {
+                cookie?: {
+                    name?: string;
+                    secure?: boolean;
+                    httpOnly?: boolean;
+                    sameSite?: "none" | "strict" | "None" | "lax" | "Lax" | "Strict";
+                    maxAge?: number;
+                    path?: string;
+                    domain?: string;
+                };
+            };
+            healthCheck?: {
+                path?: string;
+                hostname?: string;
+                scheme?: string;
+                mode?: string;
+                method?: string;
+                status?: number;
+                port?: number;
+                interval?: string | number;
+                unhealthyInterval?: string | number;
+                timeout?: string | number;
+                headers?: Record<string, string>;
+                followRedirects?: boolean;
+            };
+            passiveHealthCheck?: {
+                failureWindow?: string | number;
+                maxFailedAttempts?: number;
+            };
+            responseForwarding?: {
+                flushInterval?: string;
+            };
+            middlewares?: {
+                name: string;
+                namespace?: string;
+            }[];
+        };
+        status?: string[];
+        statusRewrites?: Record<string, number>;
+        query?: string;
+        errorRequestHeaders?: string[];
+    };
+    forwardAuth?: {
+        address: string;
+        trustForwardHeader?: boolean;
+        authResponseHeaders?: string[];
+        authResponseHeadersRegex?: string;
+        authRequestHeaders?: string[];
+        addAuthCookiesToResponse?: string[];
+        authSigninURL?: string;
+        forwardBody?: boolean;
+        maxBodySize?: number;
+        maxResponseBodySize?: number;
+        headerField?: string;
+        preserveLocationHeader?: boolean;
+        preserveRequestMethod?: boolean;
+        tls?: {
+            caSecret?: string;
+            certSecret?: string;
+            insecureSkipVerify?: boolean;
+        };
+    };
+    grpcWeb?: {
+        allowOrigins?: string[];
+    };
+    headers?: {
+        customRequestHeaders?: Record<string, string>;
+        customResponseHeaders?: Record<string, string>;
+        accessControlAllowCredentials?: boolean;
+        accessControlAllowHeaders?: string[];
+        accessControlAllowMethods?: string[];
+        accessControlAllowOriginList?: string[];
+        accessControlAllowOriginListRegex?: string[];
+        accessControlExposeHeaders?: string[];
+        accessControlMaxAge?: number;
+        addVaryHeader?: boolean;
+        allowedHosts?: string[];
+        hostsProxyHeaders?: string[];
+        sslProxyHeaders?: Record<string, string>;
+        stsSeconds?: number;
+        stsIncludeSubdomains?: boolean;
+        stsPreload?: boolean;
+        forceSTSHeader?: boolean;
+        frameDeny?: boolean;
+        customFrameOptionsValue?: string;
+        contentTypeNosniff?: boolean;
+        browserXssFilter?: boolean;
+        customBrowserXSSValue?: string;
+        contentSecurityPolicy?: string;
+        contentSecurityPolicyReportOnly?: string;
+        publicKey?: string;
+        referrerPolicy?: string;
+        permissionsPolicy?: string;
+        featurePolicy?: string;
+        isDevelopment?: boolean;
+    };
+    inFlightReq?: {
+        amount?: number;
+        sourceCriterion?: {
+            requestHeaderName?: string;
+            requestHost?: boolean;
+            ipStrategy?: {
+                depth?: number;
+                excludedIPs?: string[];
+                ipv6Subnet?: number;
+            };
+        };
+    };
+    ipAllowList?: {
+        sourceRange: string[];
+        ipStrategy?: {
+            depth?: number;
+            excludedIPs?: string[];
+            ipv6Subnet?: number;
+        };
+        rejectStatusCode?: number;
+    };
+    passTLSClientCert?: {
+        pem?: boolean;
+        info?: {
+            notAfter?: boolean;
+            notBefore?: boolean;
+            sans?: boolean;
+            serialNumber?: boolean;
+            subject?: {
+                commonName?: boolean;
+                country?: boolean;
+                domainComponent?: boolean;
+                locality?: boolean;
+                organization?: boolean;
+                organizationalUnit?: boolean;
+                province?: boolean;
+                serialNumber?: boolean;
+            };
+            issuer?: {
+                commonName?: boolean;
+                country?: boolean;
+                domainComponent?: boolean;
+                locality?: boolean;
+                organization?: boolean;
+                province?: boolean;
+                serialNumber?: boolean;
+            };
+        };
+    };
+    plugin?: Record<string, unknown>;
+    rateLimit?: {
+        average?: number;
+        burst?: number;
+        period?: string | number;
+        sourceCriterion?: {
+            requestHeaderName?: string;
+            requestHost?: boolean;
+            ipStrategy?: {
+                depth?: number;
+                excludedIPs?: string[];
+                ipv6Subnet?: number;
+            };
+        };
+        redis?: {
+            endpoints: string[];
+            secret?: string;
+            db?: number;
+            poolSize?: number;
+            minIdleConns?: number;
+            maxActiveConns?: number;
+            dialTimeout?: string | number;
+            readTimeout?: string | number;
+            writeTimeout?: string | number;
+            tls?: {
+                caSecret?: string;
+                certSecret?: string;
+                insecureSkipVerify?: boolean;
+            };
+        };
+    };
+    redirectRegex?: {
+        regex: string;
+        replacement: string;
+        permanent?: boolean;
+    };
+    redirectScheme?: {
+        scheme: "http" | "https";
+        port?: string;
+        permanent?: boolean;
+    };
+    replacePath?: {
+        path: string;
+    };
+    replacePathRegex?: {
+        regex: string;
+        replacement: string;
+    };
+    retry?: {
+        attempts?: number;
+        initialInterval?: string | number;
+        timeout?: string | number;
+        status?: string[];
+        maxRequestBodyBytes?: number;
+        disableRetryOnNetworkError?: boolean;
+        retryNonIdempotentMethod?: boolean;
+    };
+    stripPrefix?: {
+        prefixes: string[];
+        forceSlash?: boolean;
+    };
+    stripPrefixRegex?: {
+        regex: string[];
+    };
+}, {}>;
+/** Every OSS middleware keyed by its CRD field name. */
+export type TraefikMiddlewareSpecMap = AllPresent<typeof TraefikMiddlewareSpecMapSchema.infer>;
+/** The name of one middleware kind. */
+export type TraefikMiddlewareKind = keyof TraefikMiddlewareSpecMap;
+/**
+ * `Middleware.spec` — exactly one middleware kind.
+ *
+ * The exactly-one invariant is a schema-level `.narrow()` rather than only a
+ * factory guard, per `integration-skill.md` ("Schema invariants"): two keys in
+ * one object is not a merge — Traefik applies one and silently drops the other.
+ * The narrow delegates to {@link validateTraefikMiddlewareSpec} so the rule has
+ * exactly one runtime implementation.
+ */
+export declare const TraefikMiddlewareSpecSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    addPrefix?: {
+        prefix: string;
+    };
+    basicAuth?: {
+        secret: string;
+        realm?: string;
+        removeHeader?: boolean;
+        headerField?: string;
+    };
+    buffering?: {
+        maxRequestBodyBytes?: number;
+        memRequestBodyBytes?: number;
+        maxResponseBodyBytes?: number;
+        memResponseBodyBytes?: number;
+        retryExpression?: string;
+    };
+    chain?: {
+        middlewares: {
+            name: string;
+            namespace?: string;
+        }[];
+    };
+    circuitBreaker?: {
+        expression?: string;
+        checkPeriod?: string | number;
+        fallbackDuration?: string | number;
+        recoveryDuration?: string | number;
+        responseCode?: number;
+    };
+    compress?: {
+        encodings?: string[];
+        defaultEncoding?: string;
+        includedContentTypes?: string[];
+        excludedContentTypes?: string[];
+        minResponseBodyBytes?: number;
+    };
+    contentType?: {
+        autoDetect?: boolean;
+    };
+    digestAuth?: {
+        secret: string;
+        realm?: string;
+        removeHeader?: boolean;
+        headerField?: string;
+    };
+    encodedCharacters?: {
+        allowEncodedSlash?: boolean;
+        allowEncodedBackSlash?: boolean;
+        allowEncodedNullCharacter?: boolean;
+        allowEncodedSemicolon?: boolean;
+        allowEncodedPercent?: boolean;
+        allowEncodedQuestionMark?: boolean;
+        allowEncodedHash?: boolean;
+    };
+    errors?: {
+        service: {
+            name: string;
+            namespace?: string;
+            kind?: "Service" | "TraefikService";
+            port?: string | number;
+            scheme?: string;
+            weight?: number;
+            strategy?: "wrr" | "p2c" | "hrw" | "leasttime" | "RoundRobin";
+            passHostHeader?: boolean;
+            nativeLB?: boolean;
+            nodePortLB?: boolean;
+            serversTransport?: string;
+            sticky?: {
+                cookie?: {
+                    name?: string;
+                    secure?: boolean;
+                    httpOnly?: boolean;
+                    sameSite?: "none" | "strict" | "None" | "lax" | "Lax" | "Strict";
+                    maxAge?: number;
+                    path?: string;
+                    domain?: string;
+                };
+            };
+            healthCheck?: {
+                path?: string;
+                hostname?: string;
+                scheme?: string;
+                mode?: string;
+                method?: string;
+                status?: number;
+                port?: number;
+                interval?: string | number;
+                unhealthyInterval?: string | number;
+                timeout?: string | number;
+                headers?: Record<string, string>;
+                followRedirects?: boolean;
+            };
+            passiveHealthCheck?: {
+                failureWindow?: string | number;
+                maxFailedAttempts?: number;
+            };
+            responseForwarding?: {
+                flushInterval?: string;
+            };
+            middlewares?: {
+                name: string;
+                namespace?: string;
+            }[];
+        };
+        status?: string[];
+        statusRewrites?: Record<string, number>;
+        query?: string;
+        errorRequestHeaders?: string[];
+    };
+    forwardAuth?: {
+        address: string;
+        trustForwardHeader?: boolean;
+        authResponseHeaders?: string[];
+        authResponseHeadersRegex?: string;
+        authRequestHeaders?: string[];
+        addAuthCookiesToResponse?: string[];
+        authSigninURL?: string;
+        forwardBody?: boolean;
+        maxBodySize?: number;
+        maxResponseBodySize?: number;
+        headerField?: string;
+        preserveLocationHeader?: boolean;
+        preserveRequestMethod?: boolean;
+        tls?: {
+            caSecret?: string;
+            certSecret?: string;
+            insecureSkipVerify?: boolean;
+        };
+    };
+    grpcWeb?: {
+        allowOrigins?: string[];
+    };
+    headers?: {
+        customRequestHeaders?: Record<string, string>;
+        customResponseHeaders?: Record<string, string>;
+        accessControlAllowCredentials?: boolean;
+        accessControlAllowHeaders?: string[];
+        accessControlAllowMethods?: string[];
+        accessControlAllowOriginList?: string[];
+        accessControlAllowOriginListRegex?: string[];
+        accessControlExposeHeaders?: string[];
+        accessControlMaxAge?: number;
+        addVaryHeader?: boolean;
+        allowedHosts?: string[];
+        hostsProxyHeaders?: string[];
+        sslProxyHeaders?: Record<string, string>;
+        stsSeconds?: number;
+        stsIncludeSubdomains?: boolean;
+        stsPreload?: boolean;
+        forceSTSHeader?: boolean;
+        frameDeny?: boolean;
+        customFrameOptionsValue?: string;
+        contentTypeNosniff?: boolean;
+        browserXssFilter?: boolean;
+        customBrowserXSSValue?: string;
+        contentSecurityPolicy?: string;
+        contentSecurityPolicyReportOnly?: string;
+        publicKey?: string;
+        referrerPolicy?: string;
+        permissionsPolicy?: string;
+        featurePolicy?: string;
+        isDevelopment?: boolean;
+    };
+    inFlightReq?: {
+        amount?: number;
+        sourceCriterion?: {
+            requestHeaderName?: string;
+            requestHost?: boolean;
+            ipStrategy?: {
+                depth?: number;
+                excludedIPs?: string[];
+                ipv6Subnet?: number;
+            };
+        };
+    };
+    ipAllowList?: {
+        sourceRange: string[];
+        ipStrategy?: {
+            depth?: number;
+            excludedIPs?: string[];
+            ipv6Subnet?: number;
+        };
+        rejectStatusCode?: number;
+    };
+    passTLSClientCert?: {
+        pem?: boolean;
+        info?: {
+            notAfter?: boolean;
+            notBefore?: boolean;
+            sans?: boolean;
+            serialNumber?: boolean;
+            subject?: {
+                commonName?: boolean;
+                country?: boolean;
+                domainComponent?: boolean;
+                locality?: boolean;
+                organization?: boolean;
+                organizationalUnit?: boolean;
+                province?: boolean;
+                serialNumber?: boolean;
+            };
+            issuer?: {
+                commonName?: boolean;
+                country?: boolean;
+                domainComponent?: boolean;
+                locality?: boolean;
+                organization?: boolean;
+                province?: boolean;
+                serialNumber?: boolean;
+            };
+        };
+    };
+    plugin?: Record<string, unknown>;
+    rateLimit?: {
+        average?: number;
+        burst?: number;
+        period?: string | number;
+        sourceCriterion?: {
+            requestHeaderName?: string;
+            requestHost?: boolean;
+            ipStrategy?: {
+                depth?: number;
+                excludedIPs?: string[];
+                ipv6Subnet?: number;
+            };
+        };
+        redis?: {
+            endpoints: string[];
+            secret?: string;
+            db?: number;
+            poolSize?: number;
+            minIdleConns?: number;
+            maxActiveConns?: number;
+            dialTimeout?: string | number;
+            readTimeout?: string | number;
+            writeTimeout?: string | number;
+            tls?: {
+                caSecret?: string;
+                certSecret?: string;
+                insecureSkipVerify?: boolean;
+            };
+        };
+    };
+    redirectRegex?: {
+        regex: string;
+        replacement: string;
+        permanent?: boolean;
+    };
+    redirectScheme?: {
+        scheme: "http" | "https";
+        port?: string;
+        permanent?: boolean;
+    };
+    replacePath?: {
+        path: string;
+    };
+    replacePathRegex?: {
+        regex: string;
+        replacement: string;
+    };
+    retry?: {
+        attempts?: number;
+        initialInterval?: string | number;
+        timeout?: string | number;
+        status?: string[];
+        maxRequestBodyBytes?: number;
+        disableRetryOnNetworkError?: boolean;
+        retryNonIdempotentMethod?: boolean;
+    };
+    stripPrefix?: {
+        prefixes: string[];
+        forceSlash?: boolean;
+    };
+    stripPrefixRegex?: {
+        regex: string[];
+    };
+}, {}>;
+/**
+ * Exactly one key of `TMap`, with every other key typed `never`.
+ *
+ * The compile-time counterpart to the schema's `.narrow()`: this is what makes
+ * `{ forwardAuth: ..., rateLimit: ... }` a compile error.
+ */
+type ExactlyOne<TMap> = {
+    [K in keyof TMap]: {
+        readonly [P in K]: TMap[P];
+    } & {
+        readonly [P in Exclude<keyof TMap, K>]?: never;
+    };
+}[keyof TMap];
+/** `Middleware.spec` — exactly one middleware kind. */
+export type TraefikMiddlewareSpec = ExactlyOne<TraefikMiddlewareSpecMap>;
+/**
+ * Secure `forwardAuth` defaults applied by
+ * `traefikForwardAuthMiddleware` (#172).
+ *
+ * @security `trustForwardHeader: false` means Traefik does not pass the
+ * client's own `X-Forwarded-*` headers to the authorizer, so a caller cannot
+ * assert its own identity or source address.
+ */
+export declare const TRAEFIK_FORWARD_AUTH_SECURE_DEFAULTS: {
+    readonly trustForwardHeader: false;
+};
+/**
+ * Identity of a namespaced Traefik CRD, without its behaviour.
+ *
+ * Extracted as a shape rather than re-declared per factory so the middleware
+ * builders' configs and {@link TraefikResourceConfig} cannot drift apart.
+ *
+ * These schemas are the source of truth for the TYPES and the target of the
+ * schema tests; the factories do not run them over their input, because inside
+ * a composition `name` may be a `KubernetesRef` proxy rather than a string and
+ * every one of these constraints would reject it.
+ */
+export declare const traefikResourceMetadataShape: {
+    readonly name: import("arktype/internal/variants/string.ts").StringType<string, {}>;
+    readonly namespace: import("arktype/internal/variants/string.ts").StringType<string, {}>;
+    /** Extra labels merged onto the managed label set. */
+    readonly 'labels?': "Record<string, string>";
+    readonly 'annotations?': "Record<string, string>";
+    /** Resource graph id. Required when `name` is a schema reference. */
+    readonly 'id?': "string > 0";
+};
+/** Identity of a namespaced Traefik CRD, without its behaviour. */
+export declare const TraefikResourceMetadataSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    namespace: string;
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+    id?: string;
+}, {}>;
+/** Identity of a namespaced Traefik CRD, without its behaviour. */
+export type TraefikResourceMetadata = typeof TraefikResourceMetadataSchema.infer;
+/**
+ * Configuration for `traefikGatewayClass`.
+ *
+ * A `GatewayClass` is cluster-scoped, and its spec is pinned to Traefik's
+ * controller by the factory rather than supplied by the caller, so this config
+ * is the shared Gateway API identity shape plus one Traefik-specific field —
+ * fully inferred, with no `spec` to parameterise.
+ */
+export declare const TraefikGatewayClassConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    description?: string;
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+    id?: string;
+}, {}>;
+/** Configuration for `traefikGatewayClass`. */
+export type TraefikGatewayClassConfig = typeof TraefikGatewayClassConfigSchema.infer;
+/** Identity of a `Middleware`, without its behavior. */
+export declare const TraefikMiddlewareMetadataSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    namespace: string;
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+    id?: string;
+}, {}>;
+/** Identity of a `Middleware`, without its behavior. */
+export type TraefikMiddlewareMetadata = TraefikResourceMetadata;
+/**
+ * Configuration for `traefikForwardAuthMiddleware`.
+ *
+ * `authResponseHeaders` is REQUIRED here although the CRD leaves it optional:
+ * an implicit "copy everything" would let an authorizer bug leak headers to
+ * the upstream, and a route with no allowlist silently drops the principal the
+ * upstream expects.
+ */
+export declare const TraefikForwardAuthMiddlewareConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    address: string;
+    authResponseHeaders: string[];
+    name: string;
+    namespace: string;
+    authRequestHeaders?: string[];
+    trustForwardHeader?: boolean;
+    forwardBody?: boolean;
+    maxBodySize?: number;
+    tls?: {
+        caSecret?: string;
+        certSecret?: string;
+        insecureSkipVerify?: boolean;
+    };
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+    id?: string;
+}, {}>;
+/** Configuration for `traefikForwardAuthMiddleware`. */
+export type TraefikForwardAuthMiddlewareConfig = typeof TraefikForwardAuthMiddlewareConfigSchema.infer;
+/** Configuration for `traefikRateLimitMiddleware`. */
+export declare const TraefikRateLimitMiddlewareConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    average: number;
+    burst: number;
+    name: string;
+    namespace: string;
+    period?: string;
+    redis?: {
+        endpoints: string[];
+        secret?: string;
+        db?: number;
+        poolSize?: number;
+        minIdleConns?: number;
+        maxActiveConns?: number;
+        dialTimeout?: string | number;
+        readTimeout?: string | number;
+        writeTimeout?: string | number;
+        tls?: {
+            caSecret?: string;
+            certSecret?: string;
+            insecureSkipVerify?: boolean;
+        };
+    };
+    requestHeaderName?: string;
+    sourceCriterion?: {
+        requestHeaderName?: string;
+        requestHost?: boolean;
+        ipStrategy?: {
+            depth?: number;
+            excludedIPs?: string[];
+            ipv6Subnet?: number;
+        };
+    };
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+    id?: string;
+}, {}>;
+/** Configuration for `traefikRateLimitMiddleware`. */
+export type TraefikRateLimitMiddlewareConfig = typeof TraefikRateLimitMiddlewareConfigSchema.infer;
+/** Configuration for `traefikInFlightReqMiddleware`. */
+export declare const TraefikInFlightReqMiddlewareConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    amount: number;
+    name: string;
+    namespace: string;
+    requestHeaderName?: string;
+    sourceCriterion?: {
+        requestHeaderName?: string;
+        requestHost?: boolean;
+        ipStrategy?: {
+            depth?: number;
+            excludedIPs?: string[];
+            ipv6Subnet?: number;
+        };
+    };
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+    id?: string;
+}, {}>;
+/** Configuration for `traefikInFlightReqMiddleware`. */
+export type TraefikInFlightReqMiddlewareConfig = typeof TraefikInFlightReqMiddlewareConfigSchema.infer;
+/** Configuration for `traefikHeadersMiddleware`. */
+export declare const TraefikHeadersMiddlewareConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    headers: {
+        customRequestHeaders?: Record<string, string>;
+        customResponseHeaders?: Record<string, string>;
+        accessControlAllowCredentials?: boolean;
+        accessControlAllowHeaders?: string[];
+        accessControlAllowMethods?: string[];
+        accessControlAllowOriginList?: string[];
+        accessControlAllowOriginListRegex?: string[];
+        accessControlExposeHeaders?: string[];
+        accessControlMaxAge?: number;
+        addVaryHeader?: boolean;
+        allowedHosts?: string[];
+        hostsProxyHeaders?: string[];
+        sslProxyHeaders?: Record<string, string>;
+        stsSeconds?: number;
+        stsIncludeSubdomains?: boolean;
+        stsPreload?: boolean;
+        forceSTSHeader?: boolean;
+        frameDeny?: boolean;
+        customFrameOptionsValue?: string;
+        contentTypeNosniff?: boolean;
+        browserXssFilter?: boolean;
+        customBrowserXSSValue?: string;
+        contentSecurityPolicy?: string;
+        contentSecurityPolicyReportOnly?: string;
+        publicKey?: string;
+        referrerPolicy?: string;
+        permissionsPolicy?: string;
+        featurePolicy?: string;
+        isDevelopment?: boolean;
+    };
+    name: string;
+    namespace: string;
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+    id?: string;
+}, {}>;
+/** Configuration for `traefikHeadersMiddleware`. */
+export type TraefikHeadersMiddlewareConfig = typeof TraefikHeadersMiddlewareConfigSchema.infer;
+/** Configuration for `traefikRedirectSchemeMiddleware`. */
+export declare const TraefikRedirectSchemeMiddlewareConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    namespace: string;
+    scheme?: "http" | "https";
+    permanent?: boolean;
+    port?: string;
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+    id?: string;
+}, {}>;
+/** Configuration for `traefikRedirectSchemeMiddleware`. */
+export type TraefikRedirectSchemeMiddlewareConfig = typeof TraefikRedirectSchemeMiddlewareConfigSchema.infer;
+/** Configuration for `traefikBufferingMiddleware`. */
+export declare const TraefikBufferingMiddlewareConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    buffering: {
+        maxRequestBodyBytes?: number;
+        memRequestBodyBytes?: number;
+        maxResponseBodyBytes?: number;
+        memResponseBodyBytes?: number;
+        retryExpression?: string;
+    };
+    name: string;
+    namespace: string;
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+    id?: string;
+}, {}>;
+/** Configuration for `traefikBufferingMiddleware`. */
+export type TraefikBufferingMiddlewareConfig = typeof TraefikBufferingMiddlewareConfigSchema.infer;
+/** Configuration for `traefikChainMiddleware`. */
+export declare const TraefikChainMiddlewareConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    middlewares: {
+        name: string;
+        namespace?: string;
+    }[];
+    name: string;
+    namespace: string;
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+    id?: string;
+}, {}>;
+/** Configuration for `traefikChainMiddleware`. */
+export type TraefikChainMiddlewareConfig = typeof TraefikChainMiddlewareConfigSchema.infer;
+/** Kubernetes Service type usable for the Traefik entrypoint Service. */
+export type TraefikServiceType = 'LoadBalancer' | 'NodePort' | 'ClusterIP';
+/** A pod or container seccomp profile. */
+export interface TraefikSeccompProfile {
+    type: 'RuntimeDefault' | 'Unconfined' | 'Localhost';
+    localhostProfile?: string;
+}
+/**
+ * Pod-level security context (chart `podSecurityContext`).
+ *
+ * Extends the repository's shared {@link SecurityContext} with the seccomp
+ * profile the chart exposes and this factory pins.
+ */
+export interface TraefikPodSecurityContext extends SecurityContext {
+    seccompProfile?: TraefikSeccompProfile;
+}
+/**
+ * Container-level security context (chart `securityContext`).
+ *
+ * Extends the shared {@link SecurityContext} with the container-only fields
+ * this factory pins: no privilege escalation, a read-only root filesystem, and
+ * all capabilities dropped.
+ */
+export interface TraefikContainerSecurityContext extends SecurityContext {
+    allowPrivilegeEscalation?: boolean;
+    readOnlyRootFilesystem?: boolean;
+    privileged?: boolean;
+    capabilities?: {
+        add?: string[];
+        drop?: string[];
+    };
+    seccompProfile?: TraefikSeccompProfile;
+}
+/** One `topologySpreadConstraints[]` entry as the chart forwards it. */
+export interface TraefikTopologySpreadConstraint {
+    maxSkew: number;
+    topologyKey: string;
+    whenUnsatisfiable: 'DoNotSchedule' | 'ScheduleAnyway';
+    labelSelector?: LabelSelector;
+    minDomains?: number;
+    matchLabelKeys?: string[];
+    nodeAffinityPolicy?: 'Honor' | 'Ignore';
+    nodeTaintsPolicy?: 'Honor' | 'Ignore';
+}
+/** TLS material an OTLP exporter presents to the collector. */
+export interface TraefikOtlpTlsValues {
+    ca?: string;
+    cert?: string;
+    key?: string;
+    insecureSkipVerify?: boolean;
+}
+/** OTLP exporter shape shared by the chart's log/accessLog/metrics/tracing keys. */
+export interface TraefikOtlpValues {
+    enabled?: boolean;
+    serviceName?: string;
+    resourceAttributes?: Record<string, string>;
+    http?: {
+        enabled?: boolean;
+        endpoint?: string;
+        headers?: Record<string, string>;
+        tls?: TraefikOtlpTlsValues;
+    };
+    grpc?: {
+        enabled?: boolean;
+        endpoint?: string;
+        insecure?: boolean;
+        tls?: TraefikOtlpTlsValues;
+    };
+}
+/** One entry of the chart's `ports` map (an entrypoint). */
+export interface TraefikPortValues {
+    port?: number;
+    exposedPort?: number;
+    containerPort?: number;
+    targetPort?: TraefikPortValue;
+    nodePort?: number;
+    protocol?: 'TCP' | 'UDP';
+    asDefault?: boolean;
+    expose?: {
+        default?: boolean;
+    };
+    http?: {
+        redirections?: {
+            entryPoint?: {
+                to?: string;
+                scheme?: 'http' | 'https';
+                permanent?: boolean;
+                priority?: number;
+            };
+        };
+        middlewares?: string[];
+        maxHeaderBytes?: number;
+        sanitizePath?: boolean;
+        /**
+         * TLS termination for the entrypoint. Nested under `http`, which is where
+         * chart 41.5.0's `values.schema.json` puts it — `ports.<name>.tls` is
+         * rejected by the schema (`additionalProperties 'tls' not allowed`).
+         */
+        tls?: {
+            enabled?: boolean;
+            options?: string;
+            certResolver?: string;
+            domains?: {
+                main?: string;
+                sans?: string[];
+            }[];
+        };
+    };
+    forwardedHeaders?: {
+        trustedIPs?: string[];
+        insecure?: boolean;
+        notAppendXForwardedFor?: boolean;
+    };
+    proxyProtocol?: {
+        trustedIPs?: string[];
+        insecure?: boolean;
+    };
+    /** Entrypoint-level timeouts. Raise these for requests longer than 60s. */
+    transport?: {
+        respondingTimeouts?: {
+            readTimeout?: TraefikDuration;
+            writeTimeout?: TraefikDuration;
+            idleTimeout?: TraefikDuration;
+        };
+        lifeCycle?: {
+            requestAcceptGraceTimeout?: TraefikDuration;
+            graceTimeOut?: TraefikDuration;
+        };
+        keepAliveMaxRequests?: number;
+        keepAliveMaxTime?: TraefikDuration;
+    };
+}
+/**
+ * Plugin declarations for `experimental.plugins`.
+ *
+ * Each plugin owns its own value shape, so this stays an `unknown` map by
+ * necessity — the same boundary as {@link TraefikPluginMiddleware}.
+ */
+export declare const TraefikPluginChartConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<Record<string, unknown>, {}>;
+/** Plugin declarations for `experimental.plugins`, keyed by plugin name. */
+export type TraefikPluginChartConfig = typeof TraefikPluginChartConfigSchema.infer;
+/**
+ * The chart values this factory maps, pins, or reads back — a CLOSED type.
+ *
+ * Nothing here has an index signature: if a chart path is not listed, this
+ * factory does not model it and it belongs in {@link TraefikRawHelmValues}.
+ * That is what makes `applyTraefikSecurityPins`' precedence auditable — every
+ * pinned path is a named field with a known type, so a pin that stopped
+ * matching the chart would be a compile error rather than a silent no-op.
+ *
+ * Note the shapes that changed in the 3x chart line and are easy to get wrong:
+ * the Service type lives under `service.spec.type` (not `service.type`), and
+ * the Gateway API provider is `providers.kubernetesGateway`.
+ */
+export interface TraefikManagedHelmValues {
+    image?: {
+        registry?: string;
+        repository?: string;
+        tag?: string;
+        pullPolicy?: string;
+    };
+    commonLabels?: Record<string, string>;
+    deployment?: {
+        enabled?: boolean;
+        kind?: 'Deployment' | 'DaemonSet';
+        replicas?: number;
+        annotations?: Record<string, string>;
+        labels?: Record<string, string>;
+        podAnnotations?: Record<string, string>;
+        podLabels?: Record<string, string>;
+        terminationGracePeriodSeconds?: number;
+        minReadySeconds?: number;
+        revisionHistoryLimit?: number;
+    };
+    /** @security Pinned off by the values mapper. */
+    api?: {
+        dashboard?: boolean;
+        insecure?: boolean;
+        debug?: boolean;
+        basePath?: string;
+        disableDashboardAd?: boolean;
+    };
+    /** @security Pinned off by the values mapper. */
+    ingressRoute?: {
+        dashboard?: {
+            enabled?: boolean;
+        };
+        healthcheck?: {
+            enabled?: boolean;
+        };
+    };
+    ingressClass?: {
+        enabled?: boolean;
+        isDefaultClass?: boolean;
+        name?: string;
+    };
+    providers?: {
+        kubernetesCRD?: {
+            enabled?: boolean;
+            ingressClass?: string;
+            namespaces?: string[];
+            allowCrossNamespace?: boolean;
+            allowExternalNameServices?: boolean;
+            allowEmptyServices?: boolean;
+            nativeLBByDefault?: boolean;
+            defaultTLSResourcesNamespace?: string;
+        };
+        kubernetesIngress?: {
+            enabled?: boolean;
+            ingressClass?: string;
+            namespaces?: string[];
+            allowExternalNameServices?: boolean;
+            allowEmptyServices?: boolean;
+            /**
+             * Service whose address Traefik copies onto `Ingress.status`. The chart
+             * emits the flag only when it created the Service itself OR when
+             * `pathOverride` names one — this factory owns the Service, so the mapper
+             * always sets `pathOverride`.
+             */
+            publishedService?: {
+                enabled?: boolean;
+                pathOverride?: string;
+            };
+        };
+        kubernetesGateway?: {
+            enabled?: boolean;
+            experimentalChannel?: boolean;
+            namespaces?: string[];
+            statusAddress?: {
+                service?: {
+                    name?: string;
+                    namespace?: string;
+                };
+                ip?: string;
+                hostname?: string;
+            };
+        };
+        file?: {
+            enabled?: boolean;
+            watch?: boolean;
+            content?: string;
+        };
+    };
+    gateway?: {
+        enabled?: boolean;
+        name?: string;
+        namespace?: string;
+    };
+    gatewayClass?: {
+        enabled?: boolean;
+        name?: string;
+        labels?: Record<string, string>;
+    };
+    log?: {
+        level?: string;
+        format?: string;
+        filePath?: string;
+        otlp?: TraefikOtlpValues;
+    };
+    accessLog?: {
+        enabled?: boolean;
+        format?: string;
+        filePath?: string;
+        addInternals?: boolean;
+        bufferingSize?: number;
+        otlp?: TraefikOtlpValues;
+    };
+    metrics?: {
+        addInternals?: boolean;
+        otlp?: TraefikOtlpValues;
+    };
+    tracing?: {
+        addInternals?: boolean;
+        serviceName?: string;
+        sampleRate?: number;
+        otlp?: TraefikOtlpValues;
+    };
+    experimental?: {
+        otlpLogs?: boolean;
+        plugins?: TraefikPluginChartConfig;
+    };
+    ports?: Record<string, TraefikPortValues>;
+    service?: {
+        /**
+         * Pinned OFF by the values mapper: the bootstrap composition OWNS the
+         * entrypoint Service so its address can be projected without reading an
+         * unmanaged resource before anything has been applied.
+         */
+        enabled?: boolean;
+        single?: boolean;
+        nameOverride?: string;
+        annotations?: Record<string, string>;
+        labels?: Record<string, string>;
+        /** The Service type lives here in chart 3x, not at `service.type`. */
+        spec?: {
+            type?: TraefikServiceType;
+        };
+    };
+    rbac?: {
+        enabled?: boolean;
+        namespaced?: boolean;
+    };
+    /**
+     * Pinned to the release name by the values mapper so the resource-name anchor
+     * — and therefore the name of the Service this factory owns — is
+     * deterministic instead of depending on the chart's fullname template.
+     */
+    fullnameOverride?: string;
+    /**
+     * Pinned to `TRAEFIK_POD_NAME_LABEL_VALUE`. Feeds the chart's
+     * `app.kubernetes.io/name` pod label, which the owned Service selects on.
+     */
+    nameOverride?: string;
+    /**
+     * Pinned to the release name. Feeds the chart's `app.kubernetes.io/instance`
+     * pod label — otherwise derived from the Helm release name — so the owned
+     * Service's selector is exact and stable regardless of how the release is
+     * named.
+     */
+    instanceLabelOverride?: string;
+    serviceAccount?: {
+        name?: string;
+    };
+    serviceAccountAnnotations?: Record<string, string>;
+    resources?: {
+        requests?: Record<string, string>;
+        limits?: Record<string, string>;
+    };
+    /** @security Pinned to a non-root, read-only-root-filesystem profile. */
+    securityContext?: TraefikContainerSecurityContext;
+    /** @security Pinned to a non-root profile. */
+    podSecurityContext?: TraefikPodSecurityContext;
+    additionalArguments?: string[];
+    env?: EnvVar[];
+    nodeSelector?: Record<string, string>;
+    tolerations?: Toleration[];
+    affinity?: Affinity;
+    topologySpreadConstraints?: TraefikTopologySpreadConstraint[];
+    priorityClassName?: string;
+    global?: {
+        checkNewVersion?: boolean;
+        sendAnonymousUsage?: boolean;
+    };
+}
+/**
+ * The single raw Helm-values escape hatch.
+ *
+ * Chart surface this factory does not model reaches Helm through here
+ * unchanged. `unknown` is correct at this boundary and nowhere else in the
+ * values types: the shape belongs to whichever chart version is installed, so
+ * TypeKro has nothing to validate it against.
+ */
+export type TraefikRawHelmValues = Record<string, unknown>;
+/**
+ * Chart values as they leave the mapper: the closed managed surface plus the
+ * one raw passthrough boundary.
+ *
+ * Reading a managed path (`values.api?.dashboard`, `values.ports?.web`) is
+ * fully typed; an unmodelled chart key is accepted but carries no type, which
+ * is precisely the trade this split makes explicit.
+ */
+export type TraefikHelmValues = TraefikManagedHelmValues & TraefikRawHelmValues;
+/** Chart values accepted by {@link TraefikHelmReleaseConfig}. */
+export type TraefikMappedHelmValues = TypeKroChartValues<TraefikHelmValues>;
+/** Configuration for the Traefik `HelmRepository`. */
+export declare const TraefikHelmRepositoryConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    namespace?: string;
+    url?: string;
+    interval?: string;
+    id?: string;
+}, {}>;
+/** Configuration for the Traefik `HelmRepository`. */
+export type TraefikHelmRepositoryConfig = typeof TraefikHelmRepositoryConfigSchema.infer;
+/**
+ * Configuration for the Traefik `HelmRelease`, minus `values`.
+ *
+ * @see TraefikHelmReleaseConfig for why `values` is declared separately.
+ */
+export declare const TraefikHelmReleaseConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    namespace?: string;
+    targetNamespace?: string;
+    version?: string;
+    repositoryName?: string;
+    repositoryNamespace?: string;
+    interval?: string;
+    timeout?: string;
+    createNamespace?: boolean;
+    crds?: "Skip" | "Create" | "CreateReplace";
+    id?: string;
+}, {}>;
+/**
+ * Configuration for the Traefik `HelmRelease`.
+ *
+ * **Accepted exception to schema-first inference, for `values` only.** Every
+ * other field is inferred from {@link TraefikHelmReleaseConfigSchema}. `values`
+ * is typed {@link TraefikMappedHelmValues}, which is
+ * `TypeKroChartValues<TraefikHelmValues>` — a union of the chart values with
+ * `KubernetesRef`/`CelExpression` PROXY types. Those describe graph wiring
+ * that exists only at build time, not data an ArkType schema could validate at
+ * runtime: by the time this object reaches Flux the refs are resolved, and
+ * while it is being built the tree is deliberately not plain JSON. A schema
+ * field here could only be `unknown`, which would erase the typed chart
+ * surface the mapper exists to provide. The values themselves ARE schema-
+ * checked — one level down, by {@link TraefikManagedHelmValues} and the
+ * mapper's own tests.
+ */
+export type TraefikHelmReleaseConfig = typeof TraefikHelmReleaseConfigSchema.infer & {
+    readonly values?: TraefikMappedHelmValues;
+};
+/**
+ * Runtime spec of the `traefikBootstrap` composition.
+ *
+ * Only proxy-safe values live here. `dashboard` is typed as the literal
+ * `false`: the dashboard and the insecure API are not switchable through this
+ * contract, and the values mapper pins them off regardless (#172).
+ */
+export declare const TraefikBootstrapConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    namespace?: string;
+    chartVersion?: string;
+    replicas?: number;
+    ingressClass?: string;
+    service?: {
+        type?: "ClusterIP" | "NodePort" | "LoadBalancer";
+        annotations?: Record<string, string>;
+    };
+    entrypoints?: {
+        web?: {
+            exposedPort?: number;
+        };
+        websecure?: {
+            exposedPort?: number;
+            readTimeout?: string;
+            writeTimeout?: string;
+            idleTimeout?: string;
+        };
+    };
+    providers?: {
+        crd?: boolean;
+        gatewayApi?: boolean;
+        kubernetesIngress?: boolean;
+    };
+    accessLogs?: boolean;
+    logLevel?: "ERROR" | "TRACE" | "WARN" | "INFO" | "DEBUG" | "FATAL" | "PANIC";
+    otlp?: {
+        endpoint: string;
+        insecure?: boolean;
+        serviceName?: string;
+    };
+    dashboard?: false;
+}, {}>;
+/** Inferred runtime spec of {@link TraefikBootstrapConfigSchema}. */
+export type TraefikBootstrapConfig = typeof TraefikBootstrapConfigSchema.infer;
+/**
+ * Status contract of the `traefikBootstrap` composition.
+ *
+ * `loadBalancer` mirrors the entrypoint Service's
+ * `status.loadBalancer.ingress[0]` and stays empty for `ClusterIP` /
+ * `NodePort` services or while a cloud controller is still provisioning an
+ * address.
+ *
+ * `version` is the chart version Flux actually installed, read back from the
+ * owned `HelmRelease`'s `status.history[]` — an OBSERVED value rather than the
+ * requested one, so a pinned-but-unavailable version can never be reported as
+ * though it were live. It is empty until Flux records its first release.
+ *
+ * EVERY field here is a projection of a resource this composition owns, so it
+ * hydrates identically in direct and KRO mode. That rules out literals: KRO
+ * drops literal status fields, so declaring one would require a field the
+ * instance never carries (#188). The entrypoint NAMES are therefore not in
+ * this contract — they are fixed by this composition and exported as
+ * `TRAEFIK_WEB_ENTRYPOINT` / `TRAEFIK_WEBSECURE_ENTRYPOINT` instead. Read the
+ * live port names off the Service named by `serviceName` if a consumer needs
+ * them at runtime.
+ */
+export declare const TraefikBootstrapStatusSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    ready: boolean;
+    failed: boolean;
+    phase: "Ready" | "Failed" | "Installing";
+    loadBalancer: {
+        hostname: string;
+        ip: string;
+    };
+    serviceName: string;
+    version: string;
+}, {}>;
+/** Inferred status of {@link TraefikBootstrapStatusSchema}. */
+export type TraefikBootstrapStatus = typeof TraefikBootstrapStatusSchema.infer;
+/** Spec of the shared `HelmRepository` singleton composition. */
+export declare const TraefikHelmRepositorySingletonSpecSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    namespace: string;
+    url: string;
+}, {}>;
+/** Status of the shared `HelmRepository` singleton composition. */
+export declare const TraefikHelmRepositorySingletonStatusSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    ready: boolean;
+}, {}>;
+/** A default `TLSOption` owned by the bootstrap composition. */
+export interface TraefikDefaultTlsOptionOptions {
+    /** @default TRAEFIK_DEFAULT_TLS_OPTION_NAME */
+    readonly name?: string;
+    /** @default 'VersionTLS12' */
+    readonly minVersion?: TraefikTLSOptionSpec['minVersion'];
+    /** @default true */
+    readonly sniStrict?: boolean;
+    readonly cipherSuites?: readonly string[];
+    readonly curvePreferences?: readonly string[];
+    readonly clientAuth?: TraefikClientAuth;
+}
+/**
+ * A default `TLSStore` owned by the bootstrap composition, so a cert-manager
+ * `Certificate` can supply the certificate served when SNI matches nothing.
+ */
+export interface TraefikDefaultTlsStoreOptions {
+    /** Secret written by a cert-manager `Certificate`. */
+    readonly defaultCertificateSecretName: string;
+    /** @default TRAEFIK_DEFAULT_TLS_STORE_NAME */
+    readonly name?: string;
+}
+/**
+ * Build-time options for {@link makeTraefikBootstrap}.
+ *
+ * These decide WHICH resources the graph contains or how the values tree is
+ * shaped, so they must be concrete at construction time. Plain JavaScript
+ * branches on them are safe; branching on the runtime spec is not.
+ */
+export interface TraefikBootstrapBuildOptions {
+    /** Composition name. @default 'traefik-bootstrap' */
+    readonly name?: string;
+    /** KRO kind. @default 'TraefikBootstrap' */
+    readonly kind?: string;
+    /**
+     * Lifecycle of the install namespace. Use `external` when a parent graph
+     * already establishes it. @default 'owned'
+     */
+    readonly namespaceOwnership?: 'owned' | 'external';
+    /**
+     * Emit a permanent `web` → `websecure` redirect on the `web` entrypoint.
+     *
+     * Build-time rather than runtime spec because the chart disables the
+     * redirect by the ABSENCE of `ports.web.http.redirections.entryPoint`, not by
+     * a boolean — so it decides which configuration exists rather than what a
+     * value is, and a schema reference could not express "no redirect".
+     *
+     * @default true
+     */
+    readonly redirectWebToWebsecure?: boolean;
+    /** Create a cluster-default `TLSOption` alongside the release. */
+    readonly defaultTlsOption?: TraefikDefaultTlsOptionOptions;
+    /** Create a cluster-default `TLSStore` fed by a cert-manager Secret. */
+    readonly defaultTlsStore?: TraefikDefaultTlsStoreOptions;
+    /**
+     * Flux CRD policy for the release, applied to `install.crds` AND
+     * `upgrade.crds`.
+     *
+     * The default replaces the chart's `crds/` on every reconcile, which is what
+     * keeps the `traefik.io/v1alpha1` CRDs in lockstep with the chart version.
+     * Set `'Skip'` only when the CRDs are managed by something else — a
+     * cluster-wide CRD pipeline, say — and accept that a chart bump then needs a
+     * separate CRD rollout.
+     *
+     * @default DEFAULT_TRAEFIK_CRDS_POLICY (`'CreateReplace'`)
+     */
+    readonly crds?: HelmReleaseCrdsPolicy;
+    /**
+     * Raw chart values, merged BEFORE the mapped values and the security pins —
+     * both of which win.
+     *
+     * This is the raw boundary, so it is typed as {@link TraefikRawHelmValues}
+     * rather than as the managed surface: an override often has to reach a
+     * SIBLING of a path TypeKro maps (`metrics.prometheus` next to the mapped
+     * `metrics.otlp`, say), which a closed type would reject. Type safety on
+     * this side of the boundary would be a fiction anyway — the shape belongs to
+     * whichever chart version is installed. What TypeKro writes is checked
+     * precisely; what a caller passes through is not, and the security pins
+     * still overwrite it.
+     *
+     * **Build-time only, on purpose.** The guide's per-instance passthrough
+     * pattern (a `spec.values` field serialized as
+     * `json.unmarshal(json.marshal(schema.spec.values))` and merged last) does
+     * not apply to this composition, because KRO's `map.merge()` is SHALLOW:
+     * - merging raw values LAST would let any KRO instance re-enable
+     *   `api.dashboard` / `api.insecure` or hand the entrypoint Service back to
+     *   the chart, which this factory's contract (#172) forbids; and
+     * - merging the pins last to prevent that would replace whole top-level
+     *   sections, silently discarding a user's sibling keys under `api`,
+     *   `ingressRoute`, `securityContext`, `podSecurityContext`, `service` and
+     *   `global`.
+     *
+     * A values contract with non-negotiable pins therefore has to resolve
+     * precedence at build time, where the merge can be deep and auditable. Pass
+     * chart surface this factory does not model here, at construction.
+     */
+    readonly values?: TraefikRawHelmValues;
+}
+export {};
+//# sourceMappingURL=types.d.ts.map