typekro 0.33.9 → 0.34.0

package/dist/factories/traefik/types.js

@@ -0,0 +1,1084 @@
+/**
+ * Traefik type definitions.
+ *
+ * **ArkType is the single source of truth.** Every configuration type in this
+ * file — the `traefik.io/v1alpha1` CRD specs, the middleware set, and the
+ * bootstrap composition's spec — is INFERRED from the ArkType schema declared
+ * next to it (`typeof XSchema.infer`), per `docs/advanced/integration-skill.md`
+ * Step 2. One declaration then validates at runtime, generates the KRO
+ * SimpleSchema, and types the factory, so the three cannot drift. Only STATUS
+ * types stay hand-written: they describe what a controller publishes rather
+ * than user input.
+ *
+ * Three layers live here:
+ *
+ * 1. **CRD spec schemas** — verified field-by-field against the
+ *    `traefik.io/v1alpha1` CRDs shipped by chart 41.5.0 (Traefik v3.7.13), read
+ *    back from a live API server with
+ *    `kubectl get crd middlewares.traefik.io -o jsonpath='{.spec.versions[0].schema.openAPIV3Schema.properties.spec}'`.
+ *    None of the Traefik CRDs has a `status` subresource, which is why the
+ *    resource factories register an always-ready evaluator (see
+ *    `resources/routing.ts`). Where a schema is stricter than the CRD it is
+ *    deliberate and noted inline.
+ * 2. **Helm chart values** — {@link TraefikManagedHelmValues} is a CLOSED,
+ *    precise description of the chart paths this factory maps, pins or reads
+ *    back (verified against chart 41.5.0's `values.schema.json`). It carries no
+ *    index signatures at any depth; {@link TraefikRawHelmValues} is the single,
+ *    explicitly named raw-passthrough boundary for the rest of the chart.
+ * 3. **Bootstrap contract** — the runtime spec/status of the bootstrap
+ *    composition. Following the ClickStack convention these carry only
+ *    proxy-safe VALUES (names, namespaces, versions, ports, endpoints) that
+ *    serialize cleanly as CEL refs in KRO mode. Choices that decide WHICH
+ *    resources exist are build-time options on `makeTraefikBootstrap(...)`.
+ *
+ * @see https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/crd/
+ */
+import { type } from 'arktype';
+import { deriveNameLengthLimit, DNS_LABEL_MAX_LENGTH, DNS_SUBDOMAIN_MAX_LENGTH, HELM_RELEASE_NAME_MAX_LENGTH, } from '../../core/kubernetes/naming.js';
+import { gatewayApiClusterResourceMetadataShape } from '../gateway-api/types.js';
+import { validateTraefikMiddlewareSpec } from './utils/middleware-validation.js';
+/**
+ * Every Kubernetes name this factory derives from the `name` a caller supplies.
+ *
+ * The name is not used once: it names the Flux `HelmRelease` and is pinned as
+ * that release's `spec.releaseName`, it is pinned as the chart's
+ * `fullnameOverride` (so it
+ * names the ServiceAccount, RBAC, Deployment, IngressClass and the chart's own
+ * Services), and it names the entrypoint `Service` this factory owns. Each of
+ * those has a limit, and several of them append a suffix first — so the bound
+ * on `name` is whichever derived name runs out of room first, which is what
+ * {@link deriveNameLengthLimit} computes.
+ *
+ * Suffixes read off chart 41.5.0's templates rather than guessed; the chart
+ * itself carries the `-udp` case as a hard `len(fullname) < 60` check in
+ * `templates/_service.tpl`.
+ *
+ * Only names that a long `name` can actually make FAIL are listed, and each is
+ * held to the limit its own object kind is validated against:
+ *
+ * - **Services** (`<name>`, `<name>-udp`, `<name>-metrics`) are the real
+ *   constraints. A Service name is an RFC 1035 label, capped at 63 characters,
+ *   because it has to be resolvable as the first label of a cluster DNS name.
+ * - **The file-provider ConfigMap** is held to the DNS SUBDOMAIN limit, not the
+ *   label limit: `metadata.name` on a ConfigMap is validated as a DNS
+ *   subdomain (253). The same is true of the Deployment, ServiceAccount, RBAC
+ *   and IngressClass the chart names from `fullnameOverride`, which is why
+ *   none of them appears here — at 253 they cannot bind before the Services do.
+ * - **Pods are deliberately absent.** A Traefik Pod is named by the
+ *   API server through `metadata.generateName`, and the generator truncates
+ *   the base to `MaxGeneratedNameLength = 63 - 5` before appending its random
+ *   suffix (`staging/src/k8s.io/apiserver/pkg/storage/names/generate.go` in
+ *   kubernetes/kubernetes), so a generated Pod name can never exceed 63 and
+ *   never fails on a long prefix. Reserving for one only rejected names that
+ *   would have deployed fine. The truncation is not a functional concern
+ *   either: nothing in this factory — or in Traefik — addresses a Pod by its
+ *   hostname. The entrypoint Service selects Pods by the pinned
+ *   `app.kubernetes.io/name` / `app.kubernetes.io/instance` labels, and there
+ *   is no headless Service or `subdomain` giving these Pods per-Pod DNS.
+ *
+ * The Helm release name is the binding constraint, at Helm's own 53, and that
+ * 53 binds on `name` alone: `traefikHelmRelease` pins `spec.releaseName` to
+ * `name`, so the release name IS `name`. Left unset, Flux's
+ * `GetReleaseName()` would compose `<targetNamespace>-<name>` — this factory
+ * always sets `targetNamespace` — and the install namespace would eat into the
+ * 53, a term this derivation cannot express because the namespace is a runtime
+ * spec field (and a CEL reference in KRO mode) rather than something known when
+ * the schema is built.
+ */
+const TRAEFIK_GENERATED_NAMES = [
+    {
+        describedAs: "the HelmRelease's Helm release name",
+        limit: HELM_RELEASE_NAME_MAX_LENGTH,
+    },
+    {
+        describedAs: 'the entrypoint Service `<name>`',
+        limit: DNS_LABEL_MAX_LENGTH,
+    },
+    {
+        describedAs: "the chart's UDP Service `<name>-udp`",
+        suffix: '-udp',
+        limit: DNS_LABEL_MAX_LENGTH,
+    },
+    {
+        describedAs: "the chart's metrics Service `<name>-metrics`",
+        suffix: '-metrics',
+        limit: DNS_LABEL_MAX_LENGTH,
+    },
+    {
+        describedAs: "the chart's file-provider ConfigMap `<name>-file-provider`",
+        suffix: '-file-provider',
+        limit: DNS_SUBDOMAIN_MAX_LENGTH,
+    },
+];
+/**
+ * Longest `name` this factory accepts, derived from {@link TRAEFIK_GENERATED_NAMES}.
+ *
+ * Exported so the schema test can assert the derivation rather than a number
+ * copied out of it.
+ */
+export const TRAEFIK_NAME_LIMIT = deriveNameLengthLimit(TRAEFIK_GENERATED_NAMES);
+const kubernetesName = type(/^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/).and(
+// `.configure` on the length constraint alone, so a name that violates the
+// PATTERN still reports the pattern. The constraint itself stays a plain
+// `maxLength` in the ArkType AST, which is what KRO SimpleSchema serializes.
+type.string
+    .atMostLength(TRAEFIK_NAME_LIMIT.maxLength)
+    .configure({ message: TRAEFIK_NAME_LIMIT.message }));
+/** A namespace or other DNS-1123 label: the RFC's own 63-character limit. */
+const kubernetesDnsLabel = type(/^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/).and('string <= 63');
+/** A published port. Bounded as the Service/container port range, 1-65535. */
+const kubernetesPort = '1 <= number.integer <= 65535';
+// ============================================================================
+// Shared primitives
+// ============================================================================
+/**
+ * ArkType definition of a Traefik duration.
+ *
+ * The CRDs accept an integer (nanoseconds) or a Go duration string such as
+ * `'90s'`; prefer the string form for readability.
+ *
+ * The numeric branch is `number.integer`, not a bare `number`: these are
+ * `x-kubernetes-int-or-string` fields whose integer branch the API server
+ * enforces, so `interval: 1.5` is rejected at admission. KRO SimpleSchema
+ * collapses a union to `object`, so ArkType is where that integrality is
+ * caught — which is why it has to be declared here.
+ */
+const traefikDuration = 'string | number.integer';
+/**
+ * ArkType definition of a Traefik service port: a port number or a named port.
+ *
+ * Structurally identical to {@link traefikDuration} — both are
+ * `x-kubernetes-int-or-string` with an integral numeric branch — but named
+ * apart because a port and a duration are not interchangeable to a reader.
+ */
+const traefikPortValue = 'string | number.integer';
+/** How Traefik derives the client IP from proxy headers. */
+export const TraefikIpStrategySchema = type({
+    /** Depth position in `X-Forwarded-For`, counted from the right. */
+    'depth?': 'number.integer >= 0',
+    'excludedIPs?': 'string[]',
+    /** Group IPv6 clients into a shared subnet before keying. */
+    'ipv6Subnet?': 'number.integer',
+});
+/**
+ * What a `rateLimit` / `inFlightReq` middleware keys its counters on.
+ *
+ * Exactly one of these should be set; Traefik falls back to the client IP when
+ * none is given.
+ */
+export const TraefikSourceCriterionSchema = type({
+    /** Key on a request header, e.g. the principal emitted by `forwardAuth`. */
+    'requestHeaderName?': 'string',
+    'requestHost?': 'boolean',
+    'ipStrategy?': TraefikIpStrategySchema,
+});
+/** Sticky-session cookie configuration for a load-balanced service. */
+export const TraefikStickyCookieSchema = type({
+    'cookie?': {
+        'name?': 'string',
+        'secure?': 'boolean',
+        'httpOnly?': 'boolean',
+        'sameSite?': '"none" | "lax" | "strict" | "None" | "Lax" | "Strict"',
+        'maxAge?': 'number.integer',
+        'path?': 'string',
+        'domain?': 'string',
+    },
+});
+/**
+ * Active health check performed by Traefik against a service's servers.
+ *
+ * The CRD spells the Host override `hostname`; there is no `host` field.
+ */
+export const TraefikHealthCheckSchema = type({
+    'path?': 'string',
+    'hostname?': 'string',
+    'scheme?': 'string',
+    'mode?': 'string',
+    'method?': 'string',
+    'status?': 'number.integer',
+    'port?': 'number.integer',
+    'interval?': traefikDuration,
+    'unhealthyInterval?': traefikDuration,
+    'timeout?': traefikDuration,
+    'headers?': 'Record<string, string>',
+    'followRedirects?': 'boolean',
+});
+/** A reference to a `Middleware` resource. */
+export const TraefikMiddlewareRefSchema = type({
+    name: 'string',
+    'namespace?': 'string',
+});
+/** ArkType definition of the load-balancing strategies the CRD enumerates. */
+const traefikLoadBalancerStrategy = '"wrr" | "p2c" | "hrw" | "leasttime" | "RoundRobin"';
+/** One backend of an `IngressRoute` route or a `TraefikService`. */
+export const TraefikServiceRefSchema = type({
+    name: 'string',
+    'namespace?': 'string',
+    'kind?': '"Service" | "TraefikService"',
+    /** Port number or named port — the CRD accepts either. */
+    'port?': traefikPortValue,
+    'scheme?': 'string',
+    'weight?': 'number.integer >= 0',
+    'strategy?': traefikLoadBalancerStrategy,
+    'passHostHeader?': 'boolean',
+    'nativeLB?': 'boolean',
+    'nodePortLB?': 'boolean',
+    'serversTransport?': 'string',
+    'sticky?': TraefikStickyCookieSchema,
+    'healthCheck?': TraefikHealthCheckSchema,
+    'passiveHealthCheck?': {
+        'failureWindow?': traefikDuration,
+        'maxFailedAttempts?': 'number.integer',
+    },
+    'responseForwarding?': { 'flushInterval?': 'string' },
+    'middlewares?': TraefikMiddlewareRefSchema.array(),
+});
+/** TLS configuration attached to a router. */
+export const TraefikRouterTLSSchema = type({
+    /** Secret holding the certificate, e.g. one written by cert-manager. */
+    'secretName?': 'string',
+    'options?': { name: 'string', 'namespace?': 'string' },
+    'store?': { name: 'string', 'namespace?': 'string' },
+    'certResolver?': 'string',
+    'domains?': type({
+        'main?': 'string',
+        'sans?': 'string[]',
+    }).array(),
+});
+// ============================================================================
+// IngressRoute / IngressRouteTCP
+// ============================================================================
+/** Per-route observability overrides. */
+export const TraefikRouteObservabilitySchema = type({
+    'accessLogs?': 'boolean',
+    'metrics?': 'boolean',
+    'tracing?': 'boolean',
+    'traceVerbosity?': '"minimal" | "detailed"',
+});
+/** One `IngressRoute.spec.routes[]` entry. */
+export const TraefikIngressRouteRuleSchema = type({
+    /** Traefik v3 rule expression, e.g. ``Host(`api.example.com`)``. */
+    match: 'string',
+    'kind?': '"Rule"',
+    /** Higher priority wins; Traefik defaults to the rule length. */
+    'priority?': 'number.integer',
+    'syntax?': 'string',
+    'services?': TraefikServiceRefSchema.array(),
+    'middlewares?': TraefikMiddlewareRefSchema.array(),
+    'observability?': TraefikRouteObservabilitySchema,
+});
+/** `IngressRoute.spec`. */
+export const TraefikIngressRouteSpecSchema = type({
+    routes: TraefikIngressRouteRuleSchema.array(),
+    'entryPoints?': 'string[]',
+    'ingressClassName?': 'string',
+    'tls?': TraefikRouterTLSSchema,
+    'parentRefs?': type({ name: 'string', 'namespace?': 'string' }).array(),
+});
+/** One backend of an `IngressRouteTCP` route. */
+export const TraefikTCPServiceRefSchema = type({
+    name: 'string',
+    port: traefikPortValue,
+    'namespace?': 'string',
+    'weight?': 'number.integer >= 0',
+    'tls?': 'boolean',
+    'nativeLB?': 'boolean',
+    'nodePortLB?': 'boolean',
+    'serversTransport?': 'string',
+    /** PROXY protocol version. The CRD admits only 1 or 2. */
+    'proxyProtocol?': { 'version?': '1 <= number.integer <= 2' },
+});
+/** One `IngressRouteTCP.spec.routes[]` entry. */
+export const TraefikIngressRouteTCPRuleSchema = type({
+    /** TCP rule expression, e.g. ``HostSNI(`db.example.com`)``. */
+    match: 'string',
+    'priority?': 'number.integer',
+    'syntax?': '"v3" | "v2"',
+    'services?': TraefikTCPServiceRefSchema.array(),
+    'middlewares?': TraefikMiddlewareRefSchema.array(),
+});
+/** `IngressRouteTCP.spec`. */
+export const TraefikIngressRouteTCPSpecSchema = type({
+    routes: TraefikIngressRouteTCPRuleSchema.array(),
+    'entryPoints?': 'string[]',
+    'ingressClassName?': 'string',
+    'tls?': TraefikRouterTLSSchema.and({ 'passthrough?': 'boolean' }),
+});
+// ============================================================================
+// TraefikService / ServersTransport
+// ============================================================================
+/**
+ * `TraefikService.spec` — exactly one composition mode should be set.
+ *
+ * `failover.errors` is required because the CRD requires it alongside
+ * `service` and `fallback`.
+ */
+export const TraefikServiceSpecSchema = type({
+    'weighted?': {
+        'services?': TraefikServiceRefSchema.array(),
+        'sticky?': TraefikStickyCookieSchema,
+    },
+    'mirroring?': TraefikServiceRefSchema.and({
+        'maxBodySize?': 'number.integer',
+        'mirrorBody?': 'boolean',
+        'mirrors?': TraefikServiceRefSchema.and({ 'percent?': 'number.integer' }).array(),
+    }),
+    'failover?': {
+        service: TraefikServiceRefSchema,
+        fallback: TraefikServiceRefSchema,
+        errors: {
+            'status?': 'string[]',
+            'maxRequestBodyBytes?': 'number.integer',
+        },
+    },
+    'highestRandomWeight?': {
+        'services?': TraefikServiceRefSchema.array(),
+    },
+});
+/** `ServersTransport.spec` — how Traefik dials upstream servers. */
+export const TraefikServersTransportSpecSchema = type({
+    'serverName?': 'string',
+    'insecureSkipVerify?': 'boolean',
+    'rootCAsSecrets?': 'string[]',
+    'rootCAs?': type({
+        'secret?': 'string',
+        'configMap?': 'string',
+    }).array(),
+    'certificatesSecrets?': 'string[]',
+    /** `-1` disables the pool; the CRD's own minimum. */
+    'maxIdleConnsPerHost?': 'number.integer >= -1',
+    'disableHTTP2?': 'boolean',
+    'peerCertURI?': 'string',
+    'minVersion?': 'string',
+    'maxVersion?': 'string',
+    'cipherSuites?': 'string[]',
+    'spiffe?': {
+        'ids?': 'string[]',
+        'trustDomain?': 'string',
+    },
+    /**
+     * Upstream timeouts. An edge fronting long-running requests must raise
+     * `responseHeaderTimeout` above the default 60s alongside the entrypoint's
+     * `respondingTimeouts`.
+     */
+    'forwardingTimeouts?': {
+        'dialTimeout?': traefikDuration,
+        'responseHeaderTimeout?': traefikDuration,
+        'idleConnTimeout?': traefikDuration,
+        'readIdleTimeout?': traefikDuration,
+        'pingTimeout?': traefikDuration,
+    },
+});
+// ============================================================================
+// TLSOption / TLSStore
+// ============================================================================
+/** Mutual-TLS behavior of a `TLSOption`. */
+export const TraefikClientAuthSchema = type({
+    'secretNames?': 'string[]',
+    'clientAuthType?': '"NoClientCert" | "RequestClientCert" | "RequireAnyClientCert" | "VerifyClientCertIfGiven" | "RequireAndVerifyClientCert"',
+});
+/**
+ * `TLSOption.spec`.
+ *
+ * `minVersion`/`maxVersion` are narrower than the CRD's bare string: those four
+ * are the values Traefik accepts, so a typo is caught here instead of by the
+ * proxy at runtime. The CRD's deprecated `preferServerCipherSuites` is
+ * deliberately absent — Traefik v3 ignores it.
+ */
+export const TraefikTLSOptionSpecSchema = type({
+    'minVersion?': '"VersionTLS10" | "VersionTLS11" | "VersionTLS12" | "VersionTLS13"',
+    'maxVersion?': '"VersionTLS10" | "VersionTLS11" | "VersionTLS12" | "VersionTLS13"',
+    'cipherSuites?': 'string[]',
+    'curvePreferences?': 'string[]',
+    /** Reject connections whose SNI does not match a configured certificate. */
+    'sniStrict?': 'boolean',
+    'alpnProtocols?': 'string[]',
+    'disableSessionTickets?': 'boolean',
+    'clientAuth?': TraefikClientAuthSchema,
+});
+/** `TLSStore.spec`. */
+export const TraefikTLSStoreSpecSchema = type({
+    /**
+     * Default certificate served when SNI matches no router certificate. Point
+     * this at the Secret a cert-manager `Certificate` writes.
+     */
+    'defaultCertificate?': { secretName: 'string' },
+    /** ACME resolver used to generate the default certificate instead. */
+    'defaultGeneratedCert?': {
+        'resolver?': 'string',
+        'domain?': {
+            'main?': 'string',
+            'sans?': 'string[]',
+        },
+    },
+    'certificates?': type({ secretName: 'string' }).array(),
+});
+// ============================================================================
+// Middleware — the OSS middleware set as a discriminated union
+// ============================================================================
+/** TLS client config shared by `forwardAuth` and the `rateLimit` Redis backend. */
+const middlewareClientTlsShape = {
+    'caSecret?': 'string',
+    'certSecret?': 'string',
+    'insecureSkipVerify?': 'boolean',
+};
+/**
+ * Delegate authentication and authorization to an in-cluster authorizer.
+ *
+ * `address` is required although the CRD allows it to be absent: a
+ * `forwardAuth` with no authorizer fails every request.
+ *
+ * @security `trustForwardHeader` defaults to `false` in
+ * {@link TRAEFIK_FORWARD_AUTH_SECURE_DEFAULTS}: trusting `X-Forwarded-*` from
+ * an untrusted client lets a caller spoof its own identity. `authResponseHeaders`
+ * is an explicit allowlist — only the listed headers are copied from the
+ * authorizer response onto the upstream request.
+ */
+export const TraefikForwardAuthMiddlewareSchema = type({
+    /** URL of the authorizer, e.g. `http://authorizer.edge.svc.cluster.local:8080/auth`. */
+    address: 'string',
+    /** Copy `X-Forwarded-*` from the client to the authorizer. Keep `false` at an edge. */
+    'trustForwardHeader?': 'boolean',
+    /** Headers copied from the authorizer's response onto the upstream request. */
+    'authResponseHeaders?': 'string[]',
+    /** Regex alternative to `authResponseHeaders`. Prefer the explicit list. */
+    'authResponseHeadersRegex?': 'string',
+    /** Client headers forwarded to the authorizer. Empty means all of them. */
+    'authRequestHeaders?': 'string[]',
+    'addAuthCookiesToResponse?': 'string[]',
+    'authSigninURL?': 'string',
+    'forwardBody?': 'boolean',
+    'maxBodySize?': 'number.integer',
+    'maxResponseBodySize?': 'number.integer',
+    'headerField?': 'string',
+    'preserveLocationHeader?': 'boolean',
+    'preserveRequestMethod?': 'boolean',
+    'tls?': middlewareClientTlsShape,
+});
+/** Redis (or Valkey) backend making a rate limit shared across Traefik replicas. */
+export const TraefikRateLimitRedisSchema = type({
+    endpoints: 'string[]',
+    /** Secret holding `username` / `password` keys. */
+    'secret?': 'string',
+    'db?': 'number.integer',
+    'poolSize?': 'number.integer',
+    'minIdleConns?': 'number.integer',
+    'maxActiveConns?': 'number.integer',
+    'dialTimeout?': traefikDuration,
+    'readTimeout?': traefikDuration,
+    'writeTimeout?': traefikDuration,
+    'tls?': middlewareClientTlsShape,
+});
+/**
+ * Token-bucket rate limit.
+ *
+ * Without `redis` each Traefik replica keeps its own counters, so the effective
+ * limit is `average × replicas`. Supply the Redis backend whenever the budget
+ * must hold for the whole edge.
+ */
+export const TraefikRateLimitMiddlewareSchema = type({
+    /** Sustained requests allowed per `period`. */
+    'average?': 'number.integer >= 0',
+    /** Requests absorbed above `average` before Traefik answers 429. */
+    'burst?': 'number.integer >= 0',
+    /** Window `average` is measured over. Defaults to one second. */
+    'period?': traefikDuration,
+    'sourceCriterion?': TraefikSourceCriterionSchema,
+    'redis?': TraefikRateLimitRedisSchema,
+});
+/** Cap on requests being handled concurrently, per source. */
+export const TraefikInFlightReqMiddlewareSchema = type({
+    'amount?': 'number.integer >= 0',
+    'sourceCriterion?': TraefikSourceCriterionSchema,
+});
+/**
+ * CORS and browser security headers.
+ *
+ * The CRD's `sslRedirect`, `sslTemporaryRedirect`, `sslHost` and `sslForceHost`
+ * are deliberately absent: Traefik v3 dropped them in favour of the
+ * `redirectScheme` middleware, and the CRD keeps them only for v2 manifests.
+ */
+export const TraefikHeadersMiddlewareSchema = type({
+    'customRequestHeaders?': 'Record<string, string>',
+    'customResponseHeaders?': 'Record<string, string>',
+    'accessControlAllowCredentials?': 'boolean',
+    'accessControlAllowHeaders?': 'string[]',
+    'accessControlAllowMethods?': 'string[]',
+    'accessControlAllowOriginList?': 'string[]',
+    'accessControlAllowOriginListRegex?': 'string[]',
+    'accessControlExposeHeaders?': 'string[]',
+    'accessControlMaxAge?': 'number.integer',
+    'addVaryHeader?': 'boolean',
+    'allowedHosts?': 'string[]',
+    'hostsProxyHeaders?': 'string[]',
+    'sslProxyHeaders?': 'Record<string, string>',
+    'stsSeconds?': 'number.integer >= 0',
+    'stsIncludeSubdomains?': 'boolean',
+    'stsPreload?': 'boolean',
+    'forceSTSHeader?': 'boolean',
+    'frameDeny?': 'boolean',
+    'customFrameOptionsValue?': 'string',
+    'contentTypeNosniff?': 'boolean',
+    'browserXssFilter?': 'boolean',
+    'customBrowserXSSValue?': 'string',
+    'contentSecurityPolicy?': 'string',
+    'contentSecurityPolicyReportOnly?': 'string',
+    'publicKey?': 'string',
+    'referrerPolicy?': 'string',
+    'permissionsPolicy?': 'string',
+    'featurePolicy?': 'string',
+    /** Relaxes header enforcement for local development. Never enable in production. */
+    'isDevelopment?': 'boolean',
+});
+/** Redirect a request to another scheme, e.g. `web` → `websecure`. */
+export const TraefikRedirectSchemeMiddlewareSchema = type({
+    scheme: '"http" | "https"',
+    'port?': 'string',
+    'permanent?': 'boolean',
+});
+/** Regex-based redirect. */
+export const TraefikRedirectRegexMiddlewareSchema = type({
+    regex: 'string',
+    replacement: 'string',
+    'permanent?': 'boolean',
+});
+/** Remove one of `prefixes` from the request path before forwarding. */
+export const TraefikStripPrefixMiddlewareSchema = type({
+    prefixes: 'string[]',
+    'forceSlash?': 'boolean',
+});
+/** Remove a regex-matched prefix from the request path. */
+export const TraefikStripPrefixRegexMiddlewareSchema = type({
+    regex: 'string[]',
+});
+/** Prepend a prefix to the request path. */
+export const TraefikAddPrefixMiddlewareSchema = type({
+    prefix: 'string',
+});
+/** Replace the whole request path. */
+export const TraefikReplacePathMiddlewareSchema = type({
+    path: 'string',
+});
+/** Replace a regex-matched request path. */
+export const TraefikReplacePathRegexMiddlewareSchema = type({
+    regex: 'string',
+    replacement: 'string',
+});
+/**
+ * Body buffering and size limits.
+ *
+ * `maxRequestBodyBytes` is the request-size cap an edge needs so an upstream
+ * cannot be flooded; a `retryExpression` requires buffering to be able to
+ * replay the body.
+ */
+export const TraefikBufferingMiddlewareSchema = type({
+    'maxRequestBodyBytes?': 'number.integer',
+    'memRequestBodyBytes?': 'number.integer',
+    'maxResponseBodyBytes?': 'number.integer',
+    'memResponseBodyBytes?': 'number.integer',
+    'retryExpression?': 'string',
+});
+/** Retry a request against the next available server. */
+export const TraefikRetryMiddlewareSchema = type({
+    'attempts?': 'number.integer >= 0',
+    'initialInterval?': traefikDuration,
+    'timeout?': traefikDuration,
+    'status?': 'string[]',
+    /** `-1` means unlimited, which is the CRD's own minimum. */
+    'maxRequestBodyBytes?': 'number.integer >= -1',
+    'disableRetryOnNetworkError?': 'boolean',
+    'retryNonIdempotentMethod?': 'boolean',
+});
+/** Trip a circuit when the guard expression evaluates true. */
+export const TraefikCircuitBreakerMiddlewareSchema = type({
+    'expression?': 'string',
+    'checkPeriod?': traefikDuration,
+    'fallbackDuration?': traefikDuration,
+    'recoveryDuration?': traefikDuration,
+    'responseCode?': '100 <= number.integer <= 599',
+});
+/** Allow only the listed source ranges. */
+export const TraefikIpAllowListMiddlewareSchema = type({
+    sourceRange: 'string[]',
+    'ipStrategy?': TraefikIpStrategySchema,
+    'rejectStatusCode?': 'number.integer',
+});
+/** HTTP basic or digest auth backed by a Secret of htpasswd users. */
+export const TraefikCredentialAuthMiddlewareSchema = type({
+    /** Secret containing a `users` key in htpasswd format. */
+    secret: 'string',
+    'realm?': 'string',
+    'removeHeader?': 'boolean',
+    'headerField?': 'string',
+});
+/** Response compression. */
+export const TraefikCompressMiddlewareSchema = type({
+    'encodings?': 'string[]',
+    'defaultEncoding?': 'string',
+    'includedContentTypes?': 'string[]',
+    'excludedContentTypes?': 'string[]',
+    'minResponseBodyBytes?': 'number.integer >= 0',
+});
+/**
+ * Serve custom error pages from another service.
+ *
+ * `service` is required although the CRD allows it to be absent: without a
+ * backend there is nothing to serve the error page from.
+ */
+export const TraefikErrorsMiddlewareSchema = type({
+    'status?': 'string[]',
+    /** Rewrites are HTTP status codes, which the CRD types as integers. */
+    'statusRewrites?': 'Record<string, number.integer>',
+    'query?': 'string',
+    service: TraefikServiceRefSchema,
+    /** Client headers forwarded to the error-page service. */
+    'errorRequestHeaders?': 'string[]',
+});
+/** Apply an ordered list of other middlewares. */
+export const TraefikChainMiddlewareSchema = type({
+    middlewares: TraefikMiddlewareRefSchema.array(),
+});
+/** Forward client-certificate information to the upstream. */
+export const TraefikPassTLSClientCertMiddlewareSchema = type({
+    'pem?': 'boolean',
+    'info?': {
+        'notAfter?': 'boolean',
+        'notBefore?': 'boolean',
+        'sans?': 'boolean',
+        'serialNumber?': 'boolean',
+        'subject?': {
+            'commonName?': 'boolean',
+            'country?': 'boolean',
+            'domainComponent?': 'boolean',
+            'locality?': 'boolean',
+            'organization?': 'boolean',
+            'organizationalUnit?': 'boolean',
+            'province?': 'boolean',
+            'serialNumber?': 'boolean',
+        },
+        /** The CRD's issuer block has no `organizationalUnit`. */
+        'issuer?': {
+            'commonName?': 'boolean',
+            'country?': 'boolean',
+            'domainComponent?': 'boolean',
+            'locality?': 'boolean',
+            'organization?': 'boolean',
+            'province?': 'boolean',
+            'serialNumber?': 'boolean',
+        },
+    },
+});
+/** Auto-detect the response `Content-Type` when the upstream omits it. */
+export const TraefikContentTypeMiddlewareSchema = type({
+    'autoDetect?': 'boolean',
+});
+/** Allow otherwise-rejected percent-encoded characters in the request path. */
+export const TraefikEncodedCharactersMiddlewareSchema = type({
+    'allowEncodedSlash?': 'boolean',
+    'allowEncodedBackSlash?': 'boolean',
+    'allowEncodedNullCharacter?': 'boolean',
+    'allowEncodedSemicolon?': 'boolean',
+    'allowEncodedPercent?': 'boolean',
+    'allowEncodedQuestionMark?': 'boolean',
+    'allowEncodedHash?': 'boolean',
+});
+/** Bridge gRPC-Web clients to a gRPC upstream. */
+export const TraefikGrpcWebMiddlewareSchema = type({
+    'allowOrigins?': 'string[]',
+});
+/**
+ * A Traefik plugin middleware.
+ *
+ * Keyed by the plugin name declared in `experimental.plugins`; the value shape
+ * belongs to the plugin itself. This is one of the boundaries where `unknown`
+ * is correct rather than lazy — the CRD marks it
+ * `x-kubernetes-preserve-unknown-fields`, so there is no schema to model.
+ */
+export const TraefikPluginMiddlewareSchema = type('Record<string, unknown>');
+/**
+ * Every OSS middleware keyed by its CRD field name, all keys optional.
+ *
+ * A `Middleware` object carries exactly one of them, which
+ * {@link TraefikMiddlewareSpecSchema} enforces with `.narrow()` while keeping
+ * this base object shape intact so KRO SimpleSchema generation can still
+ * discover the fields.
+ */
+const TraefikMiddlewareSpecMapSchema = type({
+    'addPrefix?': TraefikAddPrefixMiddlewareSchema,
+    'basicAuth?': TraefikCredentialAuthMiddlewareSchema,
+    'buffering?': TraefikBufferingMiddlewareSchema,
+    'chain?': TraefikChainMiddlewareSchema,
+    'circuitBreaker?': TraefikCircuitBreakerMiddlewareSchema,
+    'compress?': TraefikCompressMiddlewareSchema,
+    'contentType?': TraefikContentTypeMiddlewareSchema,
+    'digestAuth?': TraefikCredentialAuthMiddlewareSchema,
+    'encodedCharacters?': TraefikEncodedCharactersMiddlewareSchema,
+    'errors?': TraefikErrorsMiddlewareSchema,
+    'forwardAuth?': TraefikForwardAuthMiddlewareSchema,
+    'grpcWeb?': TraefikGrpcWebMiddlewareSchema,
+    'headers?': TraefikHeadersMiddlewareSchema,
+    'inFlightReq?': TraefikInFlightReqMiddlewareSchema,
+    'ipAllowList?': TraefikIpAllowListMiddlewareSchema,
+    'passTLSClientCert?': TraefikPassTLSClientCertMiddlewareSchema,
+    'plugin?': TraefikPluginMiddlewareSchema,
+    'rateLimit?': TraefikRateLimitMiddlewareSchema,
+    'redirectRegex?': TraefikRedirectRegexMiddlewareSchema,
+    'redirectScheme?': TraefikRedirectSchemeMiddlewareSchema,
+    'replacePath?': TraefikReplacePathMiddlewareSchema,
+    'replacePathRegex?': TraefikReplacePathRegexMiddlewareSchema,
+    'retry?': TraefikRetryMiddlewareSchema,
+    'stripPrefix?': TraefikStripPrefixMiddlewareSchema,
+    'stripPrefixRegex?': TraefikStripPrefixRegexMiddlewareSchema,
+});
+/**
+ * `Middleware.spec` — exactly one middleware kind.
+ *
+ * The exactly-one invariant is a schema-level `.narrow()` rather than only a
+ * factory guard, per `integration-skill.md` ("Schema invariants"): two keys in
+ * one object is not a merge — Traefik applies one and silently drops the other.
+ * The narrow delegates to {@link validateTraefikMiddlewareSpec} so the rule has
+ * exactly one runtime implementation.
+ */
+export const TraefikMiddlewareSpecSchema = TraefikMiddlewareSpecMapSchema.narrow((data, ctx) => {
+    const issues = validateTraefikMiddlewareSpec(data);
+    return issues.length === 0 ? true : ctx.mustBe(issues.join(' '));
+});
+/**
+ * Secure `forwardAuth` defaults applied by
+ * `traefikForwardAuthMiddleware` (#172).
+ *
+ * @security `trustForwardHeader: false` means Traefik does not pass the
+ * client's own `X-Forwarded-*` headers to the authorizer, so a caller cannot
+ * assert its own identity or source address.
+ */
+export const TRAEFIK_FORWARD_AUTH_SECURE_DEFAULTS = {
+    trustForwardHeader: false,
+};
+// ============================================================================
+// Resource configuration
+//
+// The identity half of every namespaced Traefik CRD factory's config. `spec`
+// is the only part that varies by kind, so it stays a type parameter (see
+// `resources/common.ts`) while everything a caller actually types by hand is
+// declared once, here, and inferred from.
+// ============================================================================
+/**
+ * Identity of a namespaced Traefik CRD, without its behaviour.
+ *
+ * Extracted as a shape rather than re-declared per factory so the middleware
+ * builders' configs and {@link TraefikResourceConfig} cannot drift apart.
+ *
+ * These schemas are the source of truth for the TYPES and the target of the
+ * schema tests; the factories do not run them over their input, because inside
+ * a composition `name` may be a `KubernetesRef` proxy rather than a string and
+ * every one of these constraints would reject it.
+ */
+export const traefikResourceMetadataShape = {
+    name: kubernetesName,
+    namespace: kubernetesDnsLabel,
+    /** Extra labels merged onto the managed label set. */
+    'labels?': 'Record<string, string>',
+    'annotations?': 'Record<string, string>',
+    /** Resource graph id. Required when `name` is a schema reference. */
+    'id?': 'string > 0',
+};
+/** Identity of a namespaced Traefik CRD, without its behaviour. */
+export const TraefikResourceMetadataSchema = type(traefikResourceMetadataShape);
+/**
+ * Configuration for `traefikGatewayClass`.
+ *
+ * A `GatewayClass` is cluster-scoped, and its spec is pinned to Traefik's
+ * controller by the factory rather than supplied by the caller, so this config
+ * is the shared Gateway API identity shape plus one Traefik-specific field —
+ * fully inferred, with no `spec` to parameterise.
+ */
+export const TraefikGatewayClassConfigSchema = type({
+    ...gatewayApiClusterResourceMetadataShape,
+    /** Optional description recorded on the class. */
+    'description?': 'string > 0',
+});
+/** Identity of a `Middleware`, without its behavior. */
+export const TraefikMiddlewareMetadataSchema = TraefikResourceMetadataSchema;
+/**
+ * Configuration for `traefikForwardAuthMiddleware`.
+ *
+ * `authResponseHeaders` is REQUIRED here although the CRD leaves it optional:
+ * an implicit "copy everything" would let an authorizer bug leak headers to
+ * the upstream, and a route with no allowlist silently drops the principal the
+ * upstream expects.
+ */
+export const TraefikForwardAuthMiddlewareConfigSchema = type({
+    ...traefikResourceMetadataShape,
+    /** Authorizer URL, e.g. `http://authorizer.edge.svc.cluster.local:8080/authorize`. */
+    address: 'string > 0',
+    /** Headers copied from the authorizer's 2xx response onto the upstream request. */
+    authResponseHeaders: 'string[]',
+    /** Client headers forwarded to the authorizer. Omit to forward all of them. */
+    'authRequestHeaders?': 'string[]',
+    /**
+     * @security Defaults to `false`. Only enable when every client reaching this
+     * entrypoint is already behind a trusted proxy that rewrites
+     * `X-Forwarded-*`; otherwise a caller can assert its own source address.
+     */
+    'trustForwardHeader?': 'boolean',
+    'forwardBody?': 'boolean',
+    'maxBodySize?': 'number.integer',
+    'tls?': middlewareClientTlsShape,
+});
+/** Every way a rate/concurrency budget can be keyed. Exactly one, or none. */
+const middlewareBudgetKeyShape = {
+    /**
+     * Request header the budget is keyed on — typically the principal or tenant
+     * header a preceding `forwardAuth` produced. Mutually exclusive with
+     * `sourceCriterion`.
+     */
+    'requestHeaderName?': 'string > 0',
+    /** Full source-criterion form, for IP-strategy or host keying. */
+    'sourceCriterion?': TraefikSourceCriterionSchema,
+};
+/**
+ * Reject a config that keys its budget two ways at once.
+ *
+ * `requestHeaderName` is sugar for `sourceCriterion.requestHeaderName`, so
+ * setting both is not a merge: the builder keeps `sourceCriterion` and
+ * silently drops the header name, which is the kind of quiet substitution the
+ * exactly-one middleware narrow exists to prevent. The rule was prose until
+ * now; the schema is where it belongs.
+ */
+function narrowBudgetKey(data, ctx) {
+    if (data.requestHeaderName !== undefined && data.sourceCriterion !== undefined) {
+        return ctx.mustBe('keyed either by requestHeaderName or by sourceCriterion, not both ' +
+            '(requestHeaderName is shorthand for sourceCriterion.requestHeaderName)');
+    }
+    return true;
+}
+/** Configuration for `traefikRateLimitMiddleware`. */
+export const TraefikRateLimitMiddlewareConfigSchema = type({
+    ...traefikResourceMetadataShape,
+    ...middlewareBudgetKeyShape,
+    /** Sustained requests allowed per `period`. */
+    average: 'number.integer >= 0',
+    /** Requests absorbed above `average` before Traefik answers 429. */
+    burst: 'number.integer >= 0',
+    /** Window `average` is measured over. @default '1s' */
+    'period?': 'string > 0',
+    /**
+     * Shared Redis/Valkey backend. Without it each Traefik replica counts
+     * independently, so the effective budget is `average x replicas`.
+     */
+    'redis?': TraefikRateLimitRedisSchema,
+}).narrow(narrowBudgetKey);
+/** Configuration for `traefikInFlightReqMiddleware`. */
+export const TraefikInFlightReqMiddlewareConfigSchema = type({
+    ...traefikResourceMetadataShape,
+    ...middlewareBudgetKeyShape,
+    /** Maximum requests handled concurrently per source. */
+    amount: 'number.integer >= 0',
+}).narrow(narrowBudgetKey);
+/** Configuration for `traefikHeadersMiddleware`. */
+export const TraefikHeadersMiddlewareConfigSchema = type({
+    ...traefikResourceMetadataShape,
+    headers: TraefikHeadersMiddlewareSchema,
+});
+/** Configuration for `traefikRedirectSchemeMiddleware`. */
+export const TraefikRedirectSchemeMiddlewareConfigSchema = type({
+    ...traefikResourceMetadataShape,
+    /** @default 'https' */
+    'scheme?': '"http" | "https"',
+    /** @default true */
+    'permanent?': 'boolean',
+    'port?': 'string > 0',
+});
+/** Configuration for `traefikBufferingMiddleware`. */
+export const TraefikBufferingMiddlewareConfigSchema = type({
+    ...traefikResourceMetadataShape,
+    buffering: TraefikBufferingMiddlewareSchema,
+});
+/** Configuration for `traefikChainMiddleware`. */
+export const TraefikChainMiddlewareConfigSchema = type({
+    ...traefikResourceMetadataShape,
+    /** Middlewares applied in order. */
+    middlewares: TraefikMiddlewareRefSchema.array(),
+});
+/**
+ * Plugin declarations for `experimental.plugins`.
+ *
+ * Each plugin owns its own value shape, so this stays an `unknown` map by
+ * necessity — the same boundary as {@link TraefikPluginMiddleware}.
+ */
+export const TraefikPluginChartConfigSchema = type('Record<string, unknown>');
+// ============================================================================
+// Helm resource configuration
+// ============================================================================
+/**
+ * A Go duration as Flux's helm-controller parses it: one or more
+ * `<number><unit>` segments, e.g. `'1h'`, `'5m'`, `'90s'`, `'1h30m'`.
+ *
+ * Encoded as a schema constraint rather than a bare `string` because Flux
+ * rejects a malformed interval at ADMISSION — the HelmRelease is created and
+ * then never reconciles, which reads in the cluster as "Flux is broken"
+ * rather than as a typo.
+ */
+const fluxDuration = type(/^([0-9]+(\.[0-9]+)?(ns|us|ms|s|m|h))+$/);
+/**
+ * CRD policy accepted by the Flux helm-controller.
+ *
+ * Kept as a literal union in the schema and re-stated as
+ * {@link HelmReleaseCrdsPolicy} in `factories/helm/types.ts`; the assertion
+ * below is what keeps the two from drifting.
+ */
+const helmReleaseCrdsPolicy = '"Skip" | "Create" | "CreateReplace"';
+/** Configuration for the Traefik `HelmRepository`. */
+export const TraefikHelmRepositoryConfigSchema = type({
+    name: kubernetesName,
+    /** Flux namespace holding the repository. Defaults to the Flux namespace. */
+    'namespace?': kubernetesDnsLabel,
+    /** @default DEFAULT_TRAEFIK_REPOSITORY_URL */
+    'url?': 'string > 0',
+    /** @default '1h' */
+    'interval?': fluxDuration,
+    'id?': 'string > 0',
+});
+/**
+ * Configuration for the Traefik `HelmRelease`, minus `values`.
+ *
+ * @see TraefikHelmReleaseConfig for why `values` is declared separately.
+ */
+export const TraefikHelmReleaseConfigSchema = type({
+    name: kubernetesName,
+    /** Namespace of the HelmRelease object. Defaults to the Flux namespace. */
+    'namespace?': kubernetesDnsLabel,
+    /** Namespace Traefik itself is installed into. */
+    'targetNamespace?': kubernetesDnsLabel,
+    /** @default DEFAULT_TRAEFIK_CHART_VERSION */
+    'version?': 'string > 0',
+    /** @default DEFAULT_TRAEFIK_REPOSITORY_NAME */
+    'repositoryName?': kubernetesDnsLabel,
+    'repositoryNamespace?': kubernetesDnsLabel,
+    /** @default '5m' */
+    'interval?': fluxDuration,
+    /** @default '10m' */
+    'timeout?': fluxDuration,
+    /** Whether Flux should create `targetNamespace`. @default false */
+    'createNamespace?': 'boolean',
+    /**
+     * CRD policy applied to BOTH `install.crds` and `upgrade.crds`.
+     *
+     * Flux defaults `upgrade.crds` to `Skip`, which would leave the CRDs of the
+     * first-installed chart version in place across a chart bump.
+     *
+     * @default DEFAULT_TRAEFIK_CRDS_POLICY (`'CreateReplace'`)
+     */
+    'crds?': helmReleaseCrdsPolicy,
+    'id?': 'string > 0',
+});
+// ============================================================================
+// Bootstrap composition contract (ArkType)
+// ============================================================================
+const traefikServiceTypeSchema = '"LoadBalancer" | "NodePort" | "ClusterIP"';
+/**
+ * Runtime spec of the `traefikBootstrap` composition.
+ *
+ * Only proxy-safe values live here. `dashboard` is typed as the literal
+ * `false`: the dashboard and the insecure API are not switchable through this
+ * contract, and the values mapper pins them off regardless (#172).
+ */
+export const TraefikBootstrapConfigSchema = type({
+    name: kubernetesName,
+    'namespace?': kubernetesDnsLabel,
+    'chartVersion?': 'string > 0',
+    'replicas?': 'number.integer >= 1',
+    'ingressClass?': kubernetesDnsLabel,
+    'service?': {
+        'type?': traefikServiceTypeSchema,
+        /** Cloud load-balancer annotations. */
+        'annotations?': 'Record<string, string>',
+    },
+    /**
+     * Published ports and timeouts of the two entrypoints this edge exposes.
+     *
+     * Both are always published by the Service this composition owns: whether a
+     * port EXISTS is structural, so it cannot come from a runtime value that may
+     * be a schema reference. Use the build-time `values` passthrough for a
+     * chart-level entrypoint this factory does not model.
+     */
+    'entrypoints?': {
+        'web?': {
+            'exposedPort?': kubernetesPort,
+        },
+        'websecure?': {
+            'exposedPort?': kubernetesPort,
+            /** Entrypoint responding timeouts, for requests longer than 60s. */
+            'readTimeout?': 'string > 0',
+            'writeTimeout?': 'string > 0',
+            'idleTimeout?': 'string > 0',
+        },
+    },
+    'providers?': {
+        'crd?': 'boolean',
+        'gatewayApi?': 'boolean',
+        'kubernetesIngress?': 'boolean',
+    },
+    'accessLogs?': 'boolean',
+    'logLevel?': '"TRACE" | "DEBUG" | "INFO" | "WARN" | "ERROR" | "FATAL" | "PANIC"',
+    'otlp?': {
+        /**
+         * OTLP gRPC endpoint, `host:port`. Its presence is what enables metrics
+         * and tracing export; omit the whole block to disable both.
+         */
+        endpoint: 'string > 0',
+        /**
+         * Send OTLP without TLS. Defaults to `true` because the collector is
+         * normally a same-cluster Service reached over the pod network; set it to
+         * `false` for a collector that terminates TLS.
+         */
+        'insecure?': 'boolean',
+        'serviceName?': 'string > 0',
+    },
+    /** @security Only `false` is representable. */
+    'dashboard?': 'false',
+});
+/**
+ * Status contract of the `traefikBootstrap` composition.
+ *
+ * `loadBalancer` mirrors the entrypoint Service's
+ * `status.loadBalancer.ingress[0]` and stays empty for `ClusterIP` /
+ * `NodePort` services or while a cloud controller is still provisioning an
+ * address.
+ *
+ * `version` is the chart version Flux actually installed, read back from the
+ * owned `HelmRelease`'s `status.history[]` — an OBSERVED value rather than the
+ * requested one, so a pinned-but-unavailable version can never be reported as
+ * though it were live. It is empty until Flux records its first release.
+ *
+ * EVERY field here is a projection of a resource this composition owns, so it
+ * hydrates identically in direct and KRO mode. That rules out literals: KRO
+ * drops literal status fields, so declaring one would require a field the
+ * instance never carries (#188). The entrypoint NAMES are therefore not in
+ * this contract — they are fixed by this composition and exported as
+ * `TRAEFIK_WEB_ENTRYPOINT` / `TRAEFIK_WEBSECURE_ENTRYPOINT` instead. Read the
+ * live port names off the Service named by `serviceName` if a consumer needs
+ * them at runtime.
+ */
+export const TraefikBootstrapStatusSchema = type({
+    ready: 'boolean',
+    failed: 'boolean',
+    phase: '"Ready" | "Installing" | "Failed"',
+    loadBalancer: {
+        hostname: 'string',
+        ip: 'string',
+    },
+    serviceName: 'string',
+    version: 'string',
+});
+/** Spec of the shared `HelmRepository` singleton composition. */
+export const TraefikHelmRepositorySingletonSpecSchema = type({
+    name: kubernetesDnsLabel,
+    namespace: kubernetesDnsLabel,
+    url: 'string > 0',
+});
+/** Status of the shared `HelmRepository` singleton composition. */
+export const TraefikHelmRepositorySingletonStatusSchema = type({
+    ready: 'boolean',
+});
+//# sourceMappingURL=types.js.map