typekro 0.33.9 → 0.34.0

package/dist/factories/gateway-api/types.d.ts

@@ -0,0 +1,1269 @@
+/**
+ * Shared upstream Gateway API type definitions.
+ *
+ * Extracted from `src/factories/envoy-ai-gateway` (see #176) so that every
+ * Gateway API implementation in TypeKro — Envoy Gateway, Traefik v3, and any
+ * future controller — describes `GatewayClass`, `Gateway`, `HTTPRoute`,
+ * `GRPCRoute`, `ReferenceGrant` and `BackendTLSPolicy` with one set of types.
+ *
+ * Vendor-specific policy CRDs (`BackendTrafficPolicy`, `AIGatewayRoute`,
+ * Traefik `Middleware`, ...) deliberately stay in their own factory packages.
+ *
+ * **ArkType is the single source of truth for the SPEC types here.** Every
+ * `*Spec` / config type below is inferred from the schema next to it
+ * (`typeof XSchema.infer`), which is the repository's integration contract: one
+ * definition validates at runtime, generates KRO SimpleSchema, and types the
+ * factory. The shapes were verified field-by-field against the CRDs installed
+ * by the Gateway API v1.2.1 experimental channel, read back from a live API
+ * server with `kubectl get crd <name> -o jsonpath='{.spec.versions[*].schema.openAPIV3Schema}'`.
+ *
+ * STATUS types stay hand-written interfaces: they describe what a controller
+ * publishes, never user input, so there is nothing to validate or generate.
+ *
+ * Where a schema is narrower than the CRD it is deliberate and noted inline
+ * (for example `listeners[].protocol`, which the CRD types as a bare string).
+ */
+/** A `metav1.Condition` as published by Gateway API controllers. */
+export interface KubernetesCondition {
+    readonly type: string;
+    readonly status: string;
+    readonly reason?: string;
+    readonly message?: string;
+    readonly observedGeneration?: number;
+}
+/** Status shape of any Gateway API resource that only publishes conditions. */
+export interface AcceptedResourceStatus {
+    readonly conditions?: readonly KubernetesCondition[];
+}
+/** `Gateway.status`: assigned addresses plus Accepted/Programmed conditions. */
+export interface GatewayObservedStatus {
+    readonly addresses?: readonly {
+        readonly type?: string;
+        readonly value: string;
+    }[];
+    readonly conditions?: readonly KubernetesCondition[];
+    readonly listeners?: readonly {
+        readonly name: string;
+        readonly attachedRoutes?: number;
+        readonly conditions?: readonly KubernetesCondition[];
+    }[];
+}
+/**
+ * Status of a Gateway API resource that reports per-parent conditions, i.e.
+ * routes (`parents`) — one entry per `parentRef` that a controller claimed.
+ */
+export interface RouteObservedStatus {
+    readonly parents?: readonly {
+        readonly controllerName?: string;
+        readonly parentRef?: ParentReference;
+        readonly conditions?: readonly KubernetesCondition[];
+    }[];
+}
+/**
+ * Status of a Gateway API policy attachment (`BackendTLSPolicy`, and the
+ * implementation-specific policies that follow the same convention), which
+ * reports conditions per ancestor rather than per parent.
+ */
+export interface GatewayPolicyObservedStatus {
+    readonly ancestors?: readonly {
+        readonly controllerName?: string;
+        readonly conditions?: readonly KubernetesCondition[];
+    }[];
+}
+/** An object reference restricted to Secrets (and, historically, ConfigMaps). */
+export declare const SecretObjectReferenceSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    group?: string;
+    kind?: string;
+    namespace?: string;
+}, {}>;
+/** A certificate or CA reference used by listener TLS configuration. */
+export type SecretObjectReference = typeof SecretObjectReferenceSchema.infer;
+/** `GatewayClass.spec`. */
+export declare const GatewayClassSpecSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    controllerName: string;
+    description?: string;
+    parametersRef?: {
+        group: string;
+        kind: string;
+        name: string;
+        namespace?: string;
+    };
+}, {}>;
+/**
+ * `GatewayClass.spec`.
+ *
+ * `TController` lets an implementation pin its own controller name as a literal
+ * type (e.g. `GatewayClassSpec<'traefik.io/gateway-controller'>`) while the
+ * unparameterized form stays usable for generic tooling. The shape is inferred
+ * from {@link GatewayClassSpecSchema}; only `controllerName` is re-typed,
+ * because ArkType has no generic-literal equivalent.
+ */
+export type GatewayClassSpec<TController extends string = string> = Omit<typeof GatewayClassSpecSchema.infer, 'controllerName'> & {
+    controllerName: TController;
+};
+/** Which namespaces a listener accepts routes from. */
+export declare const AllowedRoutesSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    namespaces?: {
+        from?: "All" | "Selector" | "Same";
+        selector?: {
+            matchLabels?: Record<string, string>;
+            matchExpressions?: {
+                key: string;
+                operator: string;
+                values?: string[];
+            }[];
+        };
+    };
+    kinds?: {
+        kind: string;
+        group?: string;
+    }[];
+}, {}>;
+/** Which namespaces a listener accepts routes from. */
+export type AllowedRoutes = typeof AllowedRoutesSchema.infer;
+/** `Gateway.spec.listeners[].tls`. */
+export declare const GatewayTLSConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    mode?: "Terminate" | "Passthrough";
+    certificateRefs?: {
+        name: string;
+        group?: string;
+        kind?: string;
+        namespace?: string;
+    }[];
+    frontendValidation?: {
+        caCertificateRefs?: {
+            group: string;
+            kind: string;
+            name: string;
+            namespace?: string;
+        }[];
+    };
+    options?: Record<string, string>;
+}, {}>;
+/** `Gateway.spec.listeners[].tls`. */
+export type GatewayTLSConfig = typeof GatewayTLSConfigSchema.infer;
+/**
+ * A single `Gateway.spec.listeners[]` entry.
+ *
+ * `protocol` is narrower than the CRD, which types it as a bare string: these
+ * five are the protocols the API defines, and an unknown protocol is rejected
+ * by every controller rather than doing something useful.
+ */
+export declare const GatewayListenerSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    protocol: "TCP" | "UDP" | "HTTP" | "HTTPS" | "TLS";
+    port: number;
+    hostname?: string;
+    tls?: {
+        mode?: "Terminate" | "Passthrough";
+        certificateRefs?: {
+            name: string;
+            group?: string;
+            kind?: string;
+            namespace?: string;
+        }[];
+        frontendValidation?: {
+            caCertificateRefs?: {
+                group: string;
+                kind: string;
+                name: string;
+                namespace?: string;
+            }[];
+        };
+        options?: Record<string, string>;
+    };
+    allowedRoutes?: {
+        namespaces?: {
+            from?: "All" | "Selector" | "Same";
+            selector?: {
+                matchLabels?: Record<string, string>;
+                matchExpressions?: {
+                    key: string;
+                    operator: string;
+                    values?: string[];
+                }[];
+            };
+        };
+        kinds?: {
+            kind: string;
+            group?: string;
+        }[];
+    };
+}, {}>;
+/** A single `Gateway.spec.listeners[]` entry. */
+export type GatewayListener = typeof GatewayListenerSchema.infer;
+/** `Gateway.spec`. */
+export declare const GatewaySpecSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    gatewayClassName: string;
+    listeners: {
+        name: string;
+        protocol: "TCP" | "UDP" | "HTTP" | "HTTPS" | "TLS";
+        port: number;
+        hostname?: string;
+        tls?: {
+            mode?: "Terminate" | "Passthrough";
+            certificateRefs?: {
+                name: string;
+                group?: string;
+                kind?: string;
+                namespace?: string;
+            }[];
+            frontendValidation?: {
+                caCertificateRefs?: {
+                    group: string;
+                    kind: string;
+                    name: string;
+                    namespace?: string;
+                }[];
+            };
+            options?: Record<string, string>;
+        };
+        allowedRoutes?: {
+            namespaces?: {
+                from?: "All" | "Selector" | "Same";
+                selector?: {
+                    matchLabels?: Record<string, string>;
+                    matchExpressions?: {
+                        key: string;
+                        operator: string;
+                        values?: string[];
+                    }[];
+                };
+            };
+            kinds?: {
+                kind: string;
+                group?: string;
+            }[];
+        };
+    }[];
+    addresses?: {
+        value: string;
+        type?: string;
+    }[];
+    infrastructure?: {
+        labels?: Record<string, string>;
+        annotations?: Record<string, string>;
+        parametersRef?: {
+            group: string;
+            kind: string;
+            name: string;
+        };
+    };
+    backendTLS?: {
+        clientCertificateRef?: {
+            name: string;
+            group?: string;
+            kind?: string;
+            namespace?: string;
+        };
+    };
+}, {}>;
+/** `Gateway.spec`. */
+export type GatewaySpec = typeof GatewaySpecSchema.infer;
+/**
+ * A route's reference to the Gateway (or listener) it attaches to.
+ *
+ * `kind` stays a plain string, matching the CRD: the mesh profile allows a
+ * `Service` parent, so pinning the literal `'Gateway'` would reject a valid
+ * upstream shape.
+ */
+export declare const ParentReferenceSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    group?: string;
+    kind?: string;
+    namespace?: string;
+    sectionName?: string;
+    port?: number;
+}, {}>;
+/** A route's reference to the Gateway (or listener) it attaches to. */
+export type ParentReference = typeof ParentReferenceSchema.infer;
+/** A backend a route rule forwards to. */
+export declare const BackendRefSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    group?: string;
+    kind?: string;
+    namespace?: string;
+    port?: number;
+    weight?: number;
+}, {}>;
+/** A backend a route rule forwards to. */
+export type BackendRef = typeof BackendRefSchema.infer;
+/**
+ * One `HTTPRoute.spec.rules[].matches[]` entry.
+ *
+ * `path.value` is optional exactly as the CRD has it — an omitted value means
+ * the `/` prefix — and `method` uses the CRD's enum rather than a bare string.
+ */
+export declare const HTTPRouteMatchSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    path?: {
+        type?: "Exact" | "RegularExpression" | "PathPrefix";
+        value?: string;
+    };
+    headers?: {
+        name: string;
+        value: string;
+        type?: "Exact" | "RegularExpression";
+    }[];
+    queryParams?: {
+        name: string;
+        value: string;
+        type?: "Exact" | "RegularExpression";
+    }[];
+    method?: "POST" | "PATCH" | "PUT" | "DELETE" | "GET" | "CONNECT" | "HEAD" | "OPTIONS" | "TRACE";
+}, {}>;
+/** One `HTTPRoute.spec.rules[].matches[]` entry. */
+export type HTTPRouteMatch = typeof HTTPRouteMatchSchema.infer;
+/** A header modification applied by an `HTTPRoute` filter. */
+export declare const HTTPHeaderFilterSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    set?: {
+        name: string;
+        value: string;
+    }[];
+    add?: {
+        name: string;
+        value: string;
+    }[];
+    remove?: string[];
+}, {}>;
+/** A header modification applied by an `HTTPRoute` filter. */
+export type HTTPHeaderFilter = typeof HTTPHeaderFilterSchema.infer;
+/**
+ * One `HTTPRoute.spec.rules[].filters[]` entry.
+ *
+ * `extensionRef` is how an implementation attaches its own middleware — Traefik
+ * uses it to reference a `traefik.io/v1alpha1` `Middleware`.
+ */
+export declare const HTTPRouteFilterSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    type: "RequestHeaderModifier" | "ResponseHeaderModifier" | "RequestMirror" | "RequestRedirect" | "URLRewrite" | "ExtensionRef";
+    requestHeaderModifier?: {
+        set?: {
+            name: string;
+            value: string;
+        }[];
+        add?: {
+            name: string;
+            value: string;
+        }[];
+        remove?: string[];
+    };
+    responseHeaderModifier?: {
+        set?: {
+            name: string;
+            value: string;
+        }[];
+        add?: {
+            name: string;
+            value: string;
+        }[];
+        remove?: string[];
+    };
+    requestRedirect?: {
+        scheme?: "http" | "https";
+        hostname?: string;
+        port?: number;
+        statusCode?: 301 | 302;
+        path?: {
+            type: "ReplaceFullPath" | "ReplacePrefixMatch";
+            replaceFullPath?: string;
+            replacePrefixMatch?: string;
+        };
+    };
+    urlRewrite?: {
+        hostname?: string;
+        path?: {
+            type: "ReplaceFullPath" | "ReplacePrefixMatch";
+            replaceFullPath?: string;
+            replacePrefixMatch?: string;
+        };
+    };
+    requestMirror?: {
+        backendRef: {
+            name: string;
+            group?: string;
+            kind?: string;
+            namespace?: string;
+            port?: number;
+            weight?: number;
+        };
+        percent?: number;
+        fraction?: {
+            numerator: number;
+            denominator?: number;
+        };
+    };
+    extensionRef?: {
+        group: string;
+        kind: string;
+        name: string;
+    };
+}, {}>;
+/** One `HTTPRoute.spec.rules[].filters[]` entry. */
+export type HTTPRouteFilter = typeof HTTPRouteFilterSchema.infer;
+/** One `HTTPRoute.spec.rules[]` entry. */
+export declare const HTTPRouteRuleSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name?: string;
+    matches?: {
+        path?: {
+            type?: "Exact" | "RegularExpression" | "PathPrefix";
+            value?: string;
+        };
+        headers?: {
+            name: string;
+            value: string;
+            type?: "Exact" | "RegularExpression";
+        }[];
+        queryParams?: {
+            name: string;
+            value: string;
+            type?: "Exact" | "RegularExpression";
+        }[];
+        method?: "POST" | "PATCH" | "PUT" | "DELETE" | "GET" | "CONNECT" | "HEAD" | "OPTIONS" | "TRACE";
+    }[];
+    filters?: {
+        type: "RequestHeaderModifier" | "ResponseHeaderModifier" | "RequestMirror" | "RequestRedirect" | "URLRewrite" | "ExtensionRef";
+        requestHeaderModifier?: {
+            set?: {
+                name: string;
+                value: string;
+            }[];
+            add?: {
+                name: string;
+                value: string;
+            }[];
+            remove?: string[];
+        };
+        responseHeaderModifier?: {
+            set?: {
+                name: string;
+                value: string;
+            }[];
+            add?: {
+                name: string;
+                value: string;
+            }[];
+            remove?: string[];
+        };
+        requestRedirect?: {
+            scheme?: "http" | "https";
+            hostname?: string;
+            port?: number;
+            statusCode?: 301 | 302;
+            path?: {
+                type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                replaceFullPath?: string;
+                replacePrefixMatch?: string;
+            };
+        };
+        urlRewrite?: {
+            hostname?: string;
+            path?: {
+                type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                replaceFullPath?: string;
+                replacePrefixMatch?: string;
+            };
+        };
+        requestMirror?: {
+            backendRef: {
+                name: string;
+                group?: string;
+                kind?: string;
+                namespace?: string;
+                port?: number;
+                weight?: number;
+            };
+            percent?: number;
+            fraction?: {
+                numerator: number;
+                denominator?: number;
+            };
+        };
+        extensionRef?: {
+            group: string;
+            kind: string;
+            name: string;
+        };
+    }[];
+    backendRefs?: {
+        name: string;
+        group?: string;
+        kind?: string;
+        namespace?: string;
+        port?: number;
+        weight?: number;
+        filters?: {
+            type: "RequestHeaderModifier" | "ResponseHeaderModifier" | "RequestMirror" | "RequestRedirect" | "URLRewrite" | "ExtensionRef";
+            requestHeaderModifier?: {
+                set?: {
+                    name: string;
+                    value: string;
+                }[];
+                add?: {
+                    name: string;
+                    value: string;
+                }[];
+                remove?: string[];
+            };
+            responseHeaderModifier?: {
+                set?: {
+                    name: string;
+                    value: string;
+                }[];
+                add?: {
+                    name: string;
+                    value: string;
+                }[];
+                remove?: string[];
+            };
+            requestRedirect?: {
+                scheme?: "http" | "https";
+                hostname?: string;
+                port?: number;
+                statusCode?: 301 | 302;
+                path?: {
+                    type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                    replaceFullPath?: string;
+                    replacePrefixMatch?: string;
+                };
+            };
+            urlRewrite?: {
+                hostname?: string;
+                path?: {
+                    type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                    replaceFullPath?: string;
+                    replacePrefixMatch?: string;
+                };
+            };
+            requestMirror?: {
+                backendRef: {
+                    name: string;
+                    group?: string;
+                    kind?: string;
+                    namespace?: string;
+                    port?: number;
+                    weight?: number;
+                };
+                percent?: number;
+                fraction?: {
+                    numerator: number;
+                    denominator?: number;
+                };
+            };
+            extensionRef?: {
+                group: string;
+                kind: string;
+                name: string;
+            };
+        }[];
+    }[];
+    timeouts?: {
+        request?: string;
+        backendRequest?: string;
+    };
+    retry?: {
+        codes?: number[];
+        attempts?: number;
+        backoff?: string;
+    };
+    sessionPersistence?: {
+        sessionName?: string;
+        absoluteTimeout?: string;
+        idleTimeout?: string;
+        type?: "Cookie" | "Header";
+        cookieConfig?: {
+            lifetimeType?: "Permanent" | "Session";
+        };
+    };
+}, {}>;
+/** One `HTTPRoute.spec.rules[]` entry. */
+export type HTTPRouteRule = typeof HTTPRouteRuleSchema.infer;
+/**
+ * `HTTPRoute.spec`.
+ *
+ * `parentRefs` is required here although the CRD allows it to be absent: a
+ * route attached to nothing serves no traffic, and TypeKro would have no
+ * resource to order it against.
+ */
+export declare const HTTPRouteSpecSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    parentRefs: {
+        name: string;
+        group?: string;
+        kind?: string;
+        namespace?: string;
+        sectionName?: string;
+        port?: number;
+    }[];
+    hostnames?: string[];
+    rules?: {
+        name?: string;
+        matches?: {
+            path?: {
+                type?: "Exact" | "RegularExpression" | "PathPrefix";
+                value?: string;
+            };
+            headers?: {
+                name: string;
+                value: string;
+                type?: "Exact" | "RegularExpression";
+            }[];
+            queryParams?: {
+                name: string;
+                value: string;
+                type?: "Exact" | "RegularExpression";
+            }[];
+            method?: "POST" | "PATCH" | "PUT" | "DELETE" | "GET" | "CONNECT" | "HEAD" | "OPTIONS" | "TRACE";
+        }[];
+        filters?: {
+            type: "RequestHeaderModifier" | "ResponseHeaderModifier" | "RequestMirror" | "RequestRedirect" | "URLRewrite" | "ExtensionRef";
+            requestHeaderModifier?: {
+                set?: {
+                    name: string;
+                    value: string;
+                }[];
+                add?: {
+                    name: string;
+                    value: string;
+                }[];
+                remove?: string[];
+            };
+            responseHeaderModifier?: {
+                set?: {
+                    name: string;
+                    value: string;
+                }[];
+                add?: {
+                    name: string;
+                    value: string;
+                }[];
+                remove?: string[];
+            };
+            requestRedirect?: {
+                scheme?: "http" | "https";
+                hostname?: string;
+                port?: number;
+                statusCode?: 301 | 302;
+                path?: {
+                    type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                    replaceFullPath?: string;
+                    replacePrefixMatch?: string;
+                };
+            };
+            urlRewrite?: {
+                hostname?: string;
+                path?: {
+                    type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                    replaceFullPath?: string;
+                    replacePrefixMatch?: string;
+                };
+            };
+            requestMirror?: {
+                backendRef: {
+                    name: string;
+                    group?: string;
+                    kind?: string;
+                    namespace?: string;
+                    port?: number;
+                    weight?: number;
+                };
+                percent?: number;
+                fraction?: {
+                    numerator: number;
+                    denominator?: number;
+                };
+            };
+            extensionRef?: {
+                group: string;
+                kind: string;
+                name: string;
+            };
+        }[];
+        backendRefs?: {
+            name: string;
+            group?: string;
+            kind?: string;
+            namespace?: string;
+            port?: number;
+            weight?: number;
+            filters?: {
+                type: "RequestHeaderModifier" | "ResponseHeaderModifier" | "RequestMirror" | "RequestRedirect" | "URLRewrite" | "ExtensionRef";
+                requestHeaderModifier?: {
+                    set?: {
+                        name: string;
+                        value: string;
+                    }[];
+                    add?: {
+                        name: string;
+                        value: string;
+                    }[];
+                    remove?: string[];
+                };
+                responseHeaderModifier?: {
+                    set?: {
+                        name: string;
+                        value: string;
+                    }[];
+                    add?: {
+                        name: string;
+                        value: string;
+                    }[];
+                    remove?: string[];
+                };
+                requestRedirect?: {
+                    scheme?: "http" | "https";
+                    hostname?: string;
+                    port?: number;
+                    statusCode?: 301 | 302;
+                    path?: {
+                        type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                        replaceFullPath?: string;
+                        replacePrefixMatch?: string;
+                    };
+                };
+                urlRewrite?: {
+                    hostname?: string;
+                    path?: {
+                        type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                        replaceFullPath?: string;
+                        replacePrefixMatch?: string;
+                    };
+                };
+                requestMirror?: {
+                    backendRef: {
+                        name: string;
+                        group?: string;
+                        kind?: string;
+                        namespace?: string;
+                        port?: number;
+                        weight?: number;
+                    };
+                    percent?: number;
+                    fraction?: {
+                        numerator: number;
+                        denominator?: number;
+                    };
+                };
+                extensionRef?: {
+                    group: string;
+                    kind: string;
+                    name: string;
+                };
+            }[];
+        }[];
+        timeouts?: {
+            request?: string;
+            backendRequest?: string;
+        };
+        retry?: {
+            codes?: number[];
+            attempts?: number;
+            backoff?: string;
+        };
+        sessionPersistence?: {
+            sessionName?: string;
+            absoluteTimeout?: string;
+            idleTimeout?: string;
+            type?: "Cookie" | "Header";
+            cookieConfig?: {
+                lifetimeType?: "Permanent" | "Session";
+            };
+        };
+    }[];
+}, {}>;
+/** `HTTPRoute.spec`. */
+export type HTTPRouteSpec = typeof HTTPRouteSpecSchema.infer;
+/** One `GRPCRoute.spec.rules[].matches[]` entry. */
+export declare const GRPCRouteMatchSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    method?: {
+        type?: "Exact" | "RegularExpression";
+        service?: string;
+        method?: string;
+    };
+    headers?: {
+        name: string;
+        value: string;
+        type?: "Exact" | "RegularExpression";
+    }[];
+}, {}>;
+/** One `GRPCRoute.spec.rules[].matches[]` entry. */
+export type GRPCRouteMatch = typeof GRPCRouteMatchSchema.infer;
+/**
+ * One `GRPCRoute.spec.rules[]` entry.
+ *
+ * The CRD accepts only the four filter types that make sense for gRPC
+ * (`RequestHeaderModifier`, `ResponseHeaderModifier`, `RequestMirror`,
+ * `ExtensionRef`) but reuses the HTTP filter shape, which is what
+ * {@link HTTPRouteFilterSchema} models.
+ */
+export declare const GRPCRouteRuleSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name?: string;
+    matches?: {
+        method?: {
+            type?: "Exact" | "RegularExpression";
+            service?: string;
+            method?: string;
+        };
+        headers?: {
+            name: string;
+            value: string;
+            type?: "Exact" | "RegularExpression";
+        }[];
+    }[];
+    filters?: {
+        type: "RequestHeaderModifier" | "ResponseHeaderModifier" | "RequestMirror" | "RequestRedirect" | "URLRewrite" | "ExtensionRef";
+        requestHeaderModifier?: {
+            set?: {
+                name: string;
+                value: string;
+            }[];
+            add?: {
+                name: string;
+                value: string;
+            }[];
+            remove?: string[];
+        };
+        responseHeaderModifier?: {
+            set?: {
+                name: string;
+                value: string;
+            }[];
+            add?: {
+                name: string;
+                value: string;
+            }[];
+            remove?: string[];
+        };
+        requestRedirect?: {
+            scheme?: "http" | "https";
+            hostname?: string;
+            port?: number;
+            statusCode?: 301 | 302;
+            path?: {
+                type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                replaceFullPath?: string;
+                replacePrefixMatch?: string;
+            };
+        };
+        urlRewrite?: {
+            hostname?: string;
+            path?: {
+                type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                replaceFullPath?: string;
+                replacePrefixMatch?: string;
+            };
+        };
+        requestMirror?: {
+            backendRef: {
+                name: string;
+                group?: string;
+                kind?: string;
+                namespace?: string;
+                port?: number;
+                weight?: number;
+            };
+            percent?: number;
+            fraction?: {
+                numerator: number;
+                denominator?: number;
+            };
+        };
+        extensionRef?: {
+            group: string;
+            kind: string;
+            name: string;
+        };
+    }[];
+    backendRefs?: {
+        name: string;
+        group?: string;
+        kind?: string;
+        namespace?: string;
+        port?: number;
+        weight?: number;
+        filters?: {
+            type: "RequestHeaderModifier" | "ResponseHeaderModifier" | "RequestMirror" | "RequestRedirect" | "URLRewrite" | "ExtensionRef";
+            requestHeaderModifier?: {
+                set?: {
+                    name: string;
+                    value: string;
+                }[];
+                add?: {
+                    name: string;
+                    value: string;
+                }[];
+                remove?: string[];
+            };
+            responseHeaderModifier?: {
+                set?: {
+                    name: string;
+                    value: string;
+                }[];
+                add?: {
+                    name: string;
+                    value: string;
+                }[];
+                remove?: string[];
+            };
+            requestRedirect?: {
+                scheme?: "http" | "https";
+                hostname?: string;
+                port?: number;
+                statusCode?: 301 | 302;
+                path?: {
+                    type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                    replaceFullPath?: string;
+                    replacePrefixMatch?: string;
+                };
+            };
+            urlRewrite?: {
+                hostname?: string;
+                path?: {
+                    type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                    replaceFullPath?: string;
+                    replacePrefixMatch?: string;
+                };
+            };
+            requestMirror?: {
+                backendRef: {
+                    name: string;
+                    group?: string;
+                    kind?: string;
+                    namespace?: string;
+                    port?: number;
+                    weight?: number;
+                };
+                percent?: number;
+                fraction?: {
+                    numerator: number;
+                    denominator?: number;
+                };
+            };
+            extensionRef?: {
+                group: string;
+                kind: string;
+                name: string;
+            };
+        }[];
+    }[];
+    sessionPersistence?: {
+        sessionName?: string;
+        absoluteTimeout?: string;
+        idleTimeout?: string;
+        type?: "Cookie" | "Header";
+        cookieConfig?: {
+            lifetimeType?: "Permanent" | "Session";
+        };
+    };
+}, {}>;
+/** One `GRPCRoute.spec.rules[]` entry. */
+export type GRPCRouteRule = typeof GRPCRouteRuleSchema.infer;
+/** `GRPCRoute.spec`. */
+export declare const GRPCRouteSpecSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    parentRefs: {
+        name: string;
+        group?: string;
+        kind?: string;
+        namespace?: string;
+        sectionName?: string;
+        port?: number;
+    }[];
+    hostnames?: string[];
+    rules?: {
+        name?: string;
+        matches?: {
+            method?: {
+                type?: "Exact" | "RegularExpression";
+                service?: string;
+                method?: string;
+            };
+            headers?: {
+                name: string;
+                value: string;
+                type?: "Exact" | "RegularExpression";
+            }[];
+        }[];
+        filters?: {
+            type: "RequestHeaderModifier" | "ResponseHeaderModifier" | "RequestMirror" | "RequestRedirect" | "URLRewrite" | "ExtensionRef";
+            requestHeaderModifier?: {
+                set?: {
+                    name: string;
+                    value: string;
+                }[];
+                add?: {
+                    name: string;
+                    value: string;
+                }[];
+                remove?: string[];
+            };
+            responseHeaderModifier?: {
+                set?: {
+                    name: string;
+                    value: string;
+                }[];
+                add?: {
+                    name: string;
+                    value: string;
+                }[];
+                remove?: string[];
+            };
+            requestRedirect?: {
+                scheme?: "http" | "https";
+                hostname?: string;
+                port?: number;
+                statusCode?: 301 | 302;
+                path?: {
+                    type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                    replaceFullPath?: string;
+                    replacePrefixMatch?: string;
+                };
+            };
+            urlRewrite?: {
+                hostname?: string;
+                path?: {
+                    type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                    replaceFullPath?: string;
+                    replacePrefixMatch?: string;
+                };
+            };
+            requestMirror?: {
+                backendRef: {
+                    name: string;
+                    group?: string;
+                    kind?: string;
+                    namespace?: string;
+                    port?: number;
+                    weight?: number;
+                };
+                percent?: number;
+                fraction?: {
+                    numerator: number;
+                    denominator?: number;
+                };
+            };
+            extensionRef?: {
+                group: string;
+                kind: string;
+                name: string;
+            };
+        }[];
+        backendRefs?: {
+            name: string;
+            group?: string;
+            kind?: string;
+            namespace?: string;
+            port?: number;
+            weight?: number;
+            filters?: {
+                type: "RequestHeaderModifier" | "ResponseHeaderModifier" | "RequestMirror" | "RequestRedirect" | "URLRewrite" | "ExtensionRef";
+                requestHeaderModifier?: {
+                    set?: {
+                        name: string;
+                        value: string;
+                    }[];
+                    add?: {
+                        name: string;
+                        value: string;
+                    }[];
+                    remove?: string[];
+                };
+                responseHeaderModifier?: {
+                    set?: {
+                        name: string;
+                        value: string;
+                    }[];
+                    add?: {
+                        name: string;
+                        value: string;
+                    }[];
+                    remove?: string[];
+                };
+                requestRedirect?: {
+                    scheme?: "http" | "https";
+                    hostname?: string;
+                    port?: number;
+                    statusCode?: 301 | 302;
+                    path?: {
+                        type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                        replaceFullPath?: string;
+                        replacePrefixMatch?: string;
+                    };
+                };
+                urlRewrite?: {
+                    hostname?: string;
+                    path?: {
+                        type: "ReplaceFullPath" | "ReplacePrefixMatch";
+                        replaceFullPath?: string;
+                        replacePrefixMatch?: string;
+                    };
+                };
+                requestMirror?: {
+                    backendRef: {
+                        name: string;
+                        group?: string;
+                        kind?: string;
+                        namespace?: string;
+                        port?: number;
+                        weight?: number;
+                    };
+                    percent?: number;
+                    fraction?: {
+                        numerator: number;
+                        denominator?: number;
+                    };
+                };
+                extensionRef?: {
+                    group: string;
+                    kind: string;
+                    name: string;
+                };
+            }[];
+        }[];
+        sessionPersistence?: {
+            sessionName?: string;
+            absoluteTimeout?: string;
+            idleTimeout?: string;
+            type?: "Cookie" | "Header";
+            cookieConfig?: {
+                lifetimeType?: "Permanent" | "Session";
+            };
+        };
+    }[];
+}, {}>;
+/** `GRPCRoute.spec`. */
+export type GRPCRouteSpec = typeof GRPCRouteSpecSchema.infer;
+/**
+ * `ReferenceGrant.spec` — the opt-in a namespace publishes so resources in
+ * `from` namespaces may reference the listed `to` resources in this namespace.
+ */
+export declare const ReferenceGrantSpecSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    from: {
+        group: string;
+        kind: string;
+        namespace: string;
+    }[];
+    to: {
+        group: string;
+        kind: string;
+        name?: string;
+    }[];
+}, {}>;
+/** `ReferenceGrant.spec`. */
+export type ReferenceGrantSpec = typeof ReferenceGrantSpecSchema.infer;
+/**
+ * `BackendTLSPolicy.spec`.
+ *
+ * Kept general on purpose: Envoy Gateway targets its own `Backend` kind while
+ * other controllers target `Service`, so `targetRefs[].group`/`kind` are plain
+ * strings rather than one vendor's literals.
+ */
+export declare const BackendTLSPolicySpecSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    targetRefs: {
+        group: string;
+        kind: string;
+        name: string;
+        sectionName?: string;
+    }[];
+    validation: {
+        hostname: string;
+        wellKnownCACertificates?: "System";
+        caCertificateRefs?: {
+            group: string;
+            kind: string;
+            name: string;
+        }[];
+        subjectAltNames?: {
+            type: "Hostname" | "URI";
+            hostname?: string;
+            uri?: string;
+        }[];
+    };
+    options?: Record<string, string>;
+}, {}>;
+/** `BackendTLSPolicy.spec`. */
+export type BackendTLSPolicySpec = typeof BackendTLSPolicySpecSchema.infer;
+/**
+ * Identity fields every Gateway API resource factory accepts.
+ *
+ * These schemas are the source of truth for the TYPES and the target of the
+ * schema tests; the factories do not run them over their input, because inside
+ * a composition `name` may be a `KubernetesRef` proxy rather than a string and
+ * every constraint here would reject it.
+ */
+export declare const gatewayApiClusterResourceMetadataShape: {
+    readonly name: import("arktype/internal/variants/string.ts").StringType<string, {}>;
+    /** Extra labels merged onto `metadata.labels`. */
+    readonly 'labels?': "Record<string, string>";
+    /** Extra annotations merged onto `metadata.annotations`. */
+    readonly 'annotations?': "Record<string, string>";
+    /** Resource graph id. Required when `name` is a schema reference. */
+    readonly 'id?': "string > 0";
+};
+/** Identity fields every namespaced Gateway API resource factory accepts. */
+export declare const gatewayApiNamespacedResourceMetadataShape: {
+    readonly namespace: import("arktype/internal/variants/string.ts").StringType<string, {}>;
+    readonly name: import("arktype/internal/variants/string.ts").StringType<string, {}>;
+    /** Extra labels merged onto `metadata.labels`. */
+    readonly 'labels?': "Record<string, string>";
+    /** Extra annotations merged onto `metadata.annotations`. */
+    readonly 'annotations?': "Record<string, string>";
+    /** Resource graph id. Required when `name` is a schema reference. */
+    readonly 'id?': "string > 0";
+};
+/** Identity of a cluster-scoped Gateway API resource, without its spec. */
+export declare const GatewayApiClusterResourceMetadataSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+    id?: string;
+}, {}>;
+/** Identity of a cluster-scoped Gateway API resource, without its spec. */
+export type GatewayApiClusterResourceMetadata = typeof GatewayApiClusterResourceMetadataSchema.infer;
+/** Identity of a namespaced Gateway API resource, without its spec. */
+export declare const GatewayApiNamespacedResourceMetadataSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    namespace: string;
+    name: string;
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+    id?: string;
+}, {}>;
+/** Identity of a namespaced Gateway API resource, without its spec. */
+export type GatewayApiNamespacedResourceMetadata = typeof GatewayApiNamespacedResourceMetadataSchema.infer;
+/**
+ * Configuration for `backendTLSPolicy`.
+ *
+ * Fully inferred rather than generic: a `BackendTLSPolicy` has exactly one
+ * spec shape, so there is nothing for a type parameter to vary.
+ */
+export declare const BackendTLSPolicyConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    controllerName: string;
+    spec: {
+        targetRefs: {
+            group: string;
+            kind: string;
+            name: string;
+            sectionName?: string;
+        }[];
+        validation: {
+            hostname: string;
+            wellKnownCACertificates?: "System";
+            caCertificateRefs?: {
+                group: string;
+                kind: string;
+                name: string;
+            }[];
+            subjectAltNames?: {
+                type: "Hostname" | "URI";
+                hostname?: string;
+                uri?: string;
+            }[];
+        };
+        options?: Record<string, string>;
+    };
+    namespace: string;
+    name: string;
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+    id?: string;
+}, {}>;
+/** Configuration for `backendTLSPolicy`. */
+export type BackendTLSPolicyConfig = typeof BackendTLSPolicyConfigSchema.infer;
+//# sourceMappingURL=types.d.ts.map