typekro 0.4.0 → 0.7.0

package/dist/alchemy/utilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../../src/alchemy/utilities.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAG5D;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAClE,QAAQ,EAAE,CAAC,EACX,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAKR"}
+{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../../src/alchemy/utilities.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAE5D;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAClE,QAAQ,EAAE,CAAC,EACX,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAKR"}

package/dist/alchemy/utilities.js

@@ -4,7 +4,7 @@
  * This module provides utility functions for alchemy integration
  * with TypeKro resources.
  */
-import { generateDeterministicResourceId } from '../utils/helpers.js';
+import { generateDeterministicResourceId } from '../core/resources/id.js';
 /**
  * Utility function to create deterministic resource IDs for alchemy resources
  */

package/dist/alchemy/utilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"utilities.js","sourceRoot":"","sources":["../../src/alchemy/utilities.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AAEtE;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAW,EACX,SAAkB;IAElB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,UAAU,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,CAAC;IAElD,OAAO,+BAA+B,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"utilities.js","sourceRoot":"","sources":["../../src/alchemy/utilities.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAG1E;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAW,EACX,SAAkB;IAElB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,UAAU,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,CAAC;IAElD,OAAO,+BAA+B,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC"}

package/dist/alchemy/wrapper.d.ts

@@ -4,11 +4,13 @@
  * This file contains utility functions that align with the dynamic registration approach.
  * Static resource registration functions have been removed to avoid conflicts.
  */
-import { generateDeterministicResourceId as _generateDeterministicResourceId } from '../utils/helpers.js';
+import { generateDeterministicResourceId as _generateDeterministicResourceId } from '../core/resources/id.js';
 /**
  * Utility to check if a factory is alchemy-managed
  */
-export declare function isAlchemyWrapped(factory: any): boolean;
+export declare function isAlchemyWrapped(factory: unknown): factory is {
+    isAlchemyManaged: true;
+};
 /**
  * Re-export utility function for deterministic resource ID generation
  */

package/dist/alchemy/wrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wrapper.d.ts","sourceRoot":"","sources":["../../src/alchemy/wrapper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,+BAA+B,IAAI,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAE1G;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAOtD;AAED;;GAEG;AACH,eAAO,MAAM,+BAA+B,yCAAmC,CAAC"}
+{"version":3,"file":"wrapper.d.ts","sourceRoot":"","sources":["../../src/alchemy/wrapper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,+BAA+B,IAAI,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAE9G;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI;IAAE,gBAAgB,EAAE,IAAI,CAAA;CAAE,CAQxF;AAED;;GAEG;AACH,eAAO,MAAM,+BAA+B,yCAAmC,CAAC"}

package/dist/alchemy/wrapper.js

@@ -4,7 +4,7 @@
  * This file contains utility functions that align with the dynamic registration approach.
  * Static resource registration functions have been removed to avoid conflicts.
  */
-import { generateDeterministicResourceId as _generateDeterministicResourceId } from '../utils/helpers.js';
+import { generateDeterministicResourceId as _generateDeterministicResourceId } from '../core/resources/id.js';
 /**
  * Utility to check if a factory is alchemy-managed
  */
@@ -12,6 +12,7 @@ export function isAlchemyWrapped(factory) {
     return (factory !== null &&
         factory !== undefined &&
         typeof factory === 'object' &&
+        'isAlchemyManaged' in factory &&
         factory.isAlchemyManaged === true);
 }
 /**

package/dist/alchemy/wrapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"wrapper.js","sourceRoot":"","sources":["../../src/alchemy/wrapper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,+BAA+B,IAAI,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAE1G;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAY;IAC3C,OAAO,CACL,OAAO,KAAK,IAAI;QAChB,OAAO,KAAK,SAAS;QACrB,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAClC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,gCAAgC,CAAC;AAEhF,6EAA6E;AAC7E,yEAAyE"}
+{"version":3,"file":"wrapper.js","sourceRoot":"","sources":["../../src/alchemy/wrapper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,+BAA+B,IAAI,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAE9G;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,CACL,OAAO,KAAK,IAAI;QAChB,OAAO,KAAK,SAAS;QACrB,OAAO,OAAO,KAAK,QAAQ;QAC3B,kBAAkB,IAAI,OAAO;QAC7B,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAClC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,gCAAgC,CAAC;AAEhF,6EAA6E;AAC7E,yEAAyE"}

package/dist/compositions/typekro-runtime/index.d.ts

@@ -0,0 +1,3 @@
+export { typeKroRuntimeBootstrap } from './typekro-runtime.js';
+export type { RbacMode, TypeKroRuntimeConfig, TypeKroRuntimeSpec, TypeKroRuntimeStatus, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/compositions/typekro-runtime/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/compositions/typekro-runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,YAAY,EACV,QAAQ,EACR,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,YAAY,CAAC"}

package/dist/compositions/typekro-runtime/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/compositions/typekro-runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/{core/composition → compositions}/typekro-runtime/typekro-runtime.d.ts

@@ -5,6 +5,11 @@ import { type TypeKroRuntimeConfig } from './types.js';
  * Deploys Flux CD controllers and Kro using HelmRelease.
  * This replaces kubectl commands in bootstrap scripts with TypeKro-native deployments.
  *
+ * @security This function creates a ClusterRoleBinding with `cluster-admin` privileges for
+ * Flux controllers (kustomize-controller, helm-controller, source-controller, etc.).
+ * This grants unrestricted cluster access to those service accounts. Ensure the target
+ * namespace is trusted and review RBAC policies before deploying to production.
+ *
  * @param config - Configuration for the runtime bootstrap
  *
  * @example
@@ -13,7 +18,7 @@ import { type TypeKroRuntimeConfig } from './types.js';
  * const bootstrap = typeKroRuntimeBootstrap({
  *   namespace: 'flux-system',
  *   fluxVersion: 'v2.4.0',
- *   kroVersion: '0.3.0'
+ *   kroVersion: '0.8.5'
  * });
  *
  * const factory = await bootstrap.factory('direct', {
@@ -27,5 +32,5 @@ import { type TypeKroRuntimeConfig } from './types.js';
  * });
  * ```
  */
-export declare function typeKroRuntimeBootstrap(config?: TypeKroRuntimeConfig): import("../../types.js").CallableComposition<import("./types.js").TypeKroRuntimeSpecType, import("./types.js").TypeKroRuntimeStatusType>;
+export declare function typeKroRuntimeBootstrap(config?: TypeKroRuntimeConfig): import("../../index.js").CallableComposition<import("./types.js").TypeKroRuntimeSpecType, import("./types.js").TypeKroRuntimeStatusType>;
 //# sourceMappingURL=typekro-runtime.d.ts.map

package/dist/compositions/typekro-runtime/typekro-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typekro-runtime.d.ts","sourceRoot":"","sources":["../../../src/compositions/typekro-runtime/typekro-runtime.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,KAAK,oBAAoB,EAG1B,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,GAAE,oBAAyB,4IA4HxE"}

package/dist/compositions/typekro-runtime/typekro-runtime.js

@@ -0,0 +1,404 @@
+import { kubernetesComposition } from '../../core/composition/imperative.js';
+import { DEFAULT_FLUX_NAMESPACE } from '../../core/config/defaults.js';
+import { Cel } from '../../core/references/cel.js';
+import { fixCRDSchemaForK8s133 } from '../../core/runtime-patches/crd-schema-fix.js';
+import { helmRelease } from '../../factories/helm/helm-release.js';
+import { helmRepository } from '../../factories/helm/helm-repository.js';
+import { namespace } from '../../factories/kubernetes/core/namespace.js';
+import { clusterRole, clusterRoleBinding } from '../../factories/kubernetes/rbac/index.js';
+import { yamlFile } from '../../factories/kubernetes/yaml/yaml-file.js';
+import { TypeKroRuntimeSpec, TypeKroRuntimeStatus, } from './types.js';
+/**
+ * Bootstrap TypeKro runtime with essential components
+ *
+ * Deploys Flux CD controllers and Kro using HelmRelease.
+ * This replaces kubectl commands in bootstrap scripts with TypeKro-native deployments.
+ *
+ * @security This function creates a ClusterRoleBinding with `cluster-admin` privileges for
+ * Flux controllers (kustomize-controller, helm-controller, source-controller, etc.).
+ * This grants unrestricted cluster access to those service accounts. Ensure the target
+ * namespace is trusted and review RBAC policies before deploying to production.
+ *
+ * @param config - Configuration for the runtime bootstrap
+ *
+ * @example
+ * Basic usage:
+ * ```typescript
+ * const bootstrap = typeKroRuntimeBootstrap({
+ *   namespace: 'flux-system',
+ *   fluxVersion: 'v2.4.0',
+ *   kroVersion: '0.8.5'
+ * });
+ *
+ * const factory = await bootstrap.factory('direct', {
+ *   namespace: 'flux-system',
+ *   waitForReady: true,
+ *   timeout: 300000
+ * });
+ *
+ * const instance = await factory.deploy({
+ *   namespace: 'flux-system'
+ * });
+ * ```
+ */
+export function typeKroRuntimeBootstrap(config = {}) {
+    // Use a specific stable Flux version by default to avoid schema validation issues
+    // that can occur with 'latest' (e.g., 422 errors on CRD validation)
+    // v2.7.5 is the latest stable version with fixes for schema validation issues
+    const fluxVersion = config.fluxVersion || 'v2.7.5';
+    const kroVersion = config.kroVersion || '0.8.5';
+    const targetNamespace = config.namespace || DEFAULT_FLUX_NAMESPACE;
+    const rbacMode = config.rbac || 'cluster-admin';
+    return kubernetesComposition({
+        name: 'typekro-runtime-bootstrap',
+        apiVersion: 'typekro.dev/v1alpha1',
+        kind: 'TypeKroRuntime',
+        spec: TypeKroRuntimeSpec,
+        status: TypeKroRuntimeStatus,
+    }, (_spec) => {
+        // System namespace for Flux
+        const _systemNamespace = namespace({
+            metadata: {
+                name: targetNamespace,
+            },
+            id: 'systemNamespace',
+        });
+        // Kro system namespace - must be 'kro-system' to match the ClusterRoleBinding
+        // that the Kro Helm chart creates (it references namespace: kro-system)
+        const _kroNamespace = namespace({
+            metadata: {
+                name: 'kro-system',
+            },
+            id: 'kroNamespace',
+        });
+        // Flux CD system using yamlFile (matches integration test pattern)
+        // Apply CRD schema fix for Kubernetes 1.33+ compatibility
+        // (Flux CRDs use x-kubernetes-preserve-unknown-fields without type, which K8s 1.33 rejects)
+        //
+        // IMPORTANT: Using 'serverSideApply' strategy to merge CRD schema fixes with existing CRDs.
+        // This is necessary because:
+        // 1. Kubernetes 1.33+ requires the x-kubernetes-preserve-unknown-fields annotation
+        // 2. CRDs may have stored versions that can't be removed until data is migrated
+        // 3. Server-side apply merges changes without requiring full replacement
+        //
+        // forceConflicts: true is needed to take ownership of fields that may have been
+        // modified by other field managers (e.g., kubectl-patch for manual CRD fixes)
+        yamlFile({
+            name: 'flux-system-install',
+            path: fluxVersion === 'latest'
+                ? 'https://github.com/fluxcd/flux2/releases/latest/download/install.yaml'
+                : `https://github.com/fluxcd/flux2/releases/download/${fluxVersion}/install.yaml`,
+            deploymentStrategy: 'serverSideApply',
+            fieldManager: 'typekro-bootstrap',
+            forceConflicts: true,
+            manifestTransform: fixCRDSchemaForK8s133,
+            // Idempotent bootstrap: if the Flux install YAML can't be downloaded (e.g., DNS
+            // failure, air-gapped environment) but Flux is already running on the cluster,
+            // skip the download and proceed. This prevents bootstrap from failing when
+            // re-running against a cluster that already has Flux installed.
+            skipIfFetchFails: async (k8sApi) => {
+                try {
+                    await k8sApi.read({
+                        apiVersion: 'apiextensions.k8s.io/v1',
+                        kind: 'CustomResourceDefinition',
+                        metadata: { name: 'helmreleases.helm.toolkit.fluxcd.io' },
+                    });
+                    return true; // Flux CRDs exist — already installed
+                }
+                catch {
+                    return false; // CRDs not found — need the download
+                }
+            },
+        });
+        // RBAC for Flux controllers.
+        // Configurable via config.rbac: 'cluster-admin' (default), 'scoped', or { clusterRoleRef }.
+        createFluxRbac(rbacMode, targetNamespace);
+        // Helm Repository for Kro OCI charts
+        helmRepository({
+            name: 'kro-helm-repo',
+            namespace: DEFAULT_FLUX_NAMESPACE,
+            url: 'oci://registry.k8s.io/kro/charts',
+            interval: '5m',
+            type: 'oci',
+            id: 'kroHelmRepo',
+        });
+        // Kro using HelmRelease with OCI chart - Flux will manage the lifecycle
+        // IMPORTANT: Must deploy to 'kro-system' namespace to match the ClusterRoleBinding
+        // that the Kro Helm chart creates (it references namespace: kro-system for the service account)
+        const kroHelmRelease = helmRelease({
+            name: 'kro',
+            namespace: 'kro-system',
+            chart: {
+                name: 'kro',
+                repository: `oci://registry.k8s.io/kro/charts`,
+                version: kroVersion,
+            },
+            interval: '5m',
+            id: 'kroHelmRelease',
+        });
+        // Use CEL expressions with actual HelmRelease conditions (Flux v2 pattern).
+        // HelmReleaseStatus has a conditions array, not a phase field.
+        // We use CEL .exists() to check for the Ready condition, matching the
+        // cert-manager-bootstrap and cilium-bootstrap patterns.
+        return {
+            phase: Cel.expr(kroHelmRelease.status.conditions, '.exists(c, c.type == "Ready" && c.status == "True") ? "Ready" : "Installing"'),
+            components: {
+                fluxSystem: true,
+                // Kro system readiness based on HelmRelease conditions
+                kroSystem: Cel.expr(kroHelmRelease.status.conditions, '.exists(c, c.type == "Ready" && c.status == "True")'),
+            },
+        };
+    });
+}
+// ---------------------------------------------------------------------------
+// RBAC helpers
+// ---------------------------------------------------------------------------
+/** The six Flux CD controller service accounts that need cluster-level permissions. */
+const FLUX_SERVICE_ACCOUNTS = [
+    'kustomize-controller',
+    'helm-controller',
+    'source-controller',
+    'notification-controller',
+    'image-reflector-controller',
+    'image-automation-controller',
+];
+/**
+ * Create RBAC resources for Flux controllers based on the chosen mode.
+ *
+ * - `cluster-admin`: Single ClusterRoleBinding → built-in `cluster-admin`.
+ * - `scoped`: Creates a dedicated ClusterRole with Flux-minimum permissions,
+ *   then binds all controllers to it.
+ * - `{ clusterRoleRef }`: Single ClusterRoleBinding → user-provided ClusterRole.
+ */
+function createFluxRbac(mode, targetNamespace) {
+    const roleName = resolveClusterRoleName(mode);
+    if (mode === 'scoped') {
+        createScopedFluxClusterRole();
+    }
+    clusterRoleBinding({
+        metadata: {
+            name: 'cluster-reconciler',
+            labels: {
+                // Flux's own label value — not the namespace; do not replace with DEFAULT_FLUX_NAMESPACE
+                'app.kubernetes.io/instance': 'flux-system',
+                'app.kubernetes.io/part-of': 'flux',
+            },
+        },
+        roleRef: {
+            apiGroup: 'rbac.authorization.k8s.io',
+            kind: 'ClusterRole',
+            name: roleName,
+        },
+        subjects: FLUX_SERVICE_ACCOUNTS.map((sa) => ({
+            kind: 'ServiceAccount',
+            name: sa,
+            namespace: targetNamespace,
+        })),
+    });
+}
+/** Determine which ClusterRole to bind to based on the RBAC mode. */
+function resolveClusterRoleName(mode) {
+    if (mode === 'cluster-admin')
+        return 'cluster-admin';
+    if (mode === 'scoped')
+        return 'typekro-flux-controllers';
+    return mode.clusterRoleRef;
+}
+/**
+ * Create a scoped ClusterRole with the minimum permissions required for Flux
+ * controllers to manage HelmReleases, Kustomizations, GitRepositories,
+ * HelmRepositories, and their target resources.
+ *
+ * This covers the core Flux reconciliation loop but may NOT cover every
+ * possible resource type that a Helm chart could create. Users deploying
+ * charts that create CRDs or other cluster-scoped resources may need to
+ * use `cluster-admin` or a custom ClusterRole with additional permissions.
+ */
+function createScopedFluxClusterRole() {
+    clusterRole({
+        metadata: {
+            name: 'typekro-flux-controllers',
+            labels: {
+                // Flux's own label value — not the namespace; do not replace with DEFAULT_FLUX_NAMESPACE
+                'app.kubernetes.io/instance': 'flux-system',
+                'app.kubernetes.io/part-of': 'flux',
+                'app.kubernetes.io/managed-by': 'typekro',
+            },
+        },
+        rules: [
+            // Core Kubernetes resources that Helm charts commonly create
+            {
+                apiGroups: [''],
+                resources: [
+                    'namespaces',
+                    'pods',
+                    'services',
+                    'configmaps',
+                    'secrets',
+                    'serviceaccounts',
+                    'persistentvolumeclaims',
+                    'events',
+                ],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+            // Apps API (Deployments, StatefulSets, DaemonSets, ReplicaSets)
+            {
+                apiGroups: ['apps'],
+                resources: ['deployments', 'statefulsets', 'daemonsets', 'replicasets'],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+            // Batch API (Jobs, CronJobs)
+            {
+                apiGroups: ['batch'],
+                resources: ['jobs', 'cronjobs'],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+            // RBAC resources
+            {
+                apiGroups: ['rbac.authorization.k8s.io'],
+                resources: ['roles', 'rolebindings', 'clusterroles', 'clusterrolebindings'],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+            // Networking
+            {
+                apiGroups: ['networking.k8s.io'],
+                resources: ['ingresses', 'networkpolicies'],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+            // Autoscaling
+            {
+                apiGroups: ['autoscaling'],
+                resources: ['horizontalpodautoscalers'],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+            // Policy
+            {
+                apiGroups: ['policy'],
+                resources: ['poddisruptionbudgets'],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+            // Flux source-controller CRDs
+            {
+                apiGroups: ['source.toolkit.fluxcd.io'],
+                resources: [
+                    'gitrepositories',
+                    'helmrepositories',
+                    'helmcharts',
+                    'ocirepositories',
+                    'buckets',
+                ],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+            // Flux source-controller status and finalizers
+            {
+                apiGroups: ['source.toolkit.fluxcd.io'],
+                resources: [
+                    'gitrepositories/status',
+                    'helmrepositories/status',
+                    'helmcharts/status',
+                    'ocirepositories/status',
+                    'buckets/status',
+                    'gitrepositories/finalizers',
+                    'helmrepositories/finalizers',
+                    'helmcharts/finalizers',
+                    'ocirepositories/finalizers',
+                    'buckets/finalizers',
+                ],
+                verbs: ['get', 'update', 'patch'],
+            },
+            // Flux helm-controller CRDs
+            {
+                apiGroups: ['helm.toolkit.fluxcd.io'],
+                resources: ['helmreleases'],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+            // Flux helm-controller status and finalizers
+            {
+                apiGroups: ['helm.toolkit.fluxcd.io'],
+                resources: ['helmreleases/status', 'helmreleases/finalizers'],
+                verbs: ['get', 'update', 'patch'],
+            },
+            // Flux kustomize-controller CRDs
+            {
+                apiGroups: ['kustomize.toolkit.fluxcd.io'],
+                resources: ['kustomizations'],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+            // Flux kustomize-controller status and finalizers
+            {
+                apiGroups: ['kustomize.toolkit.fluxcd.io'],
+                resources: ['kustomizations/status', 'kustomizations/finalizers'],
+                verbs: ['get', 'update', 'patch'],
+            },
+            // Flux notification-controller CRDs
+            {
+                apiGroups: ['notification.toolkit.fluxcd.io'],
+                resources: ['providers', 'alerts', 'receivers'],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+            // Flux notification-controller status and finalizers
+            {
+                apiGroups: ['notification.toolkit.fluxcd.io'],
+                resources: [
+                    'providers/status',
+                    'alerts/status',
+                    'receivers/status',
+                    'providers/finalizers',
+                    'alerts/finalizers',
+                    'receivers/finalizers',
+                ],
+                verbs: ['get', 'update', 'patch'],
+            },
+            // Flux image-reflector-controller CRDs
+            {
+                apiGroups: ['image.toolkit.fluxcd.io'],
+                resources: ['imagepolicies', 'imagerepositories'],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+            // Flux image-automation-controller CRDs
+            {
+                apiGroups: ['image.toolkit.fluxcd.io'],
+                resources: ['imageupdateautomations'],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+            // Flux image CRDs status and finalizers
+            {
+                apiGroups: ['image.toolkit.fluxcd.io'],
+                resources: [
+                    'imagepolicies/status',
+                    'imagerepositories/status',
+                    'imageupdateautomations/status',
+                    'imagepolicies/finalizers',
+                    'imagerepositories/finalizers',
+                    'imageupdateautomations/finalizers',
+                ],
+                verbs: ['get', 'update', 'patch'],
+            },
+            // Kro CRDs (needed for kro-system management)
+            {
+                apiGroups: ['kro.run'],
+                resources: ['resourcegraphdefinitions', 'resourcegraphdefinitions/status'],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+            // CRD management (needed for Helm charts that install CRDs)
+            {
+                apiGroups: ['apiextensions.k8s.io'],
+                resources: ['customresourcedefinitions'],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch'],
+            },
+            // Events (for controllers to post events)
+            {
+                apiGroups: ['events.k8s.io'],
+                resources: ['events'],
+                verbs: ['create', 'patch'],
+            },
+            // Coordination (leader election)
+            {
+                apiGroups: ['coordination.k8s.io'],
+                resources: ['leases'],
+                verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+            },
+        ],
+    });
+}
+//# sourceMappingURL=typekro-runtime.js.map

package/dist/compositions/typekro-runtime/typekro-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typekro-runtime.js","sourceRoot":"","sources":["../../../src/compositions/typekro-runtime/typekro-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,GAAG,EAAE,MAAM,8BAA8B,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,8CAA8C,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,8CAA8C,CAAC;AACxE,OAAO,EAGL,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA+B,EAAE;IACvE,kFAAkF;IAClF,oEAAoE;IACpE,8EAA8E;IAC9E,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC;IAChD,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,IAAI,sBAAsB,CAAC;IACnE,MAAM,QAAQ,GAAa,MAAM,CAAC,IAAI,IAAI,eAAe,CAAC;IAE1D,OAAO,qBAAqB,CAC1B;QACE,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,sBAAsB;QAClC,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,oBAAoB;KAC7B,EACD,CAAC,KAAK,EAAE,EAAE;QACR,4BAA4B;QAC5B,MAAM,gBAAgB,GAAG,SAAS,CAAC;YACjC,QAAQ,EAAE;gBACR,IAAI,EAAE,eAAe;aACtB;YACD,EAAE,EAAE,iBAAiB;SACtB,CAAC,CAAC;QAEH,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,aAAa,GAAG,SAAS,CAAC;YAC9B,QAAQ,EAAE;gBACR,IAAI,EAAE,YAAY;aACnB;YACD,EAAE,EAAE,cAAc;SACnB,CAAC,CAAC;QAEH,mEAAmE;QACnE,0DAA0D;QAC1D,4FAA4F;QAC5F,EAAE;QACF,4FAA4F;QAC5F,6BAA6B;QAC7B,mFAAmF;QACnF,gFAAgF;QAChF,yEAAyE;QACzE,EAAE;QACF,gFAAgF;QAChF,8EAA8E;QAC9E,QAAQ,CAAC;YACP,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EACF,WAAW,KAAK,QAAQ;gBACtB,CAAC,CAAC,uEAAuE;gBACzE,CAAC,CAAC,qDAAqD,WAAW,eAAe;YACrF,kBAAkB,EAAE,iBAAiB;YACrC,YAAY,EAAE,mBAAmB;YACjC,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,qBAAqB;YACxC,gFAAgF;YAChF,+EAA+E;YAC/E,2EAA2E;YAC3E,gEAAgE;YAChE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACjC,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,IAAI,CAAC;wBAChB,UAAU,EAAE,yBAAyB;wBACrC,IAAI,EAAE,0BAA0B;wBAChC,QAAQ,EAAE,EAAE,IAAI,EAAE,qCAAqC,EAAE;qBAC1D,CAAC,CAAC;oBACH,OAAO,IAAI,CAAC,CAAC,sCAAsC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC,CAAC,qCAAqC;gBACrD,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,6BAA6B;QAC7B,4FAA4F;QAC5F,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAE1C,qCAAqC;QACrC,cAAc,CAAC;YACb,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,sBAAsB;YACjC,GAAG,EAAE,kCAAkC;YACvC,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,KAAK;YACX,EAAE,EAAE,aAAa;SAClB,CAAC,CAAC;QAEH,wEAAwE;QACxE,mFAAmF;QACnF,gGAAgG;QAChG,MAAM,cAAc,GAAG,WAAW,CAAC;YACjC,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,YAAY;YACvB,KAAK,EAAE;gBACL,IAAI,EAAE,KAAK;gBACX,UAAU,EAAE,kCAAkC;gBAC9C,OAAO,EAAE,UAAU;aACpB;YACD,QAAQ,EAAE,IAAI;YACd,EAAE,EAAE,gBAAgB;SACrB,CAAC,CAAC;QAEH,4EAA4E;QAC5E,+DAA+D;QAC/D,sEAAsE;QACtE,wDAAwD;QACxD,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,IAAI,CACb,cAAc,CAAC,MAAM,CAAC,UAAU,EAChC,8EAA8E,CAC/E;YACD,UAAU,EAAE;gBACV,UAAU,EAAE,IAAI;gBAChB,uDAAuD;gBACvD,SAAS,EAAE,GAAG,CAAC,IAAI,CACjB,cAAc,CAAC,MAAM,CAAC,UAAU,EAChC,qDAAqD,CACtD;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,uFAAuF;AACvF,MAAM,qBAAqB,GAAG;IAC5B,sBAAsB;IACtB,iBAAiB;IACjB,mBAAmB;IACnB,yBAAyB;IACzB,4BAA4B;IAC5B,6BAA6B;CACrB,CAAC;AAEX;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,IAAc,EAAE,eAAuB;IAC7D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE9C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,2BAA2B,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB,CAAC;QACjB,QAAQ,EAAE;YACR,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE;gBACN,yFAAyF;gBACzF,4BAA4B,EAAE,aAAa;gBAC3C,2BAA2B,EAAE,MAAM;aACpC;SACF;QACD,OAAO,EAAE;YACP,QAAQ,EAAE,2BAA2B;YACrC,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,QAAQ;SACf;QACD,QAAQ,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,gBAAyB;YAC/B,IAAI,EAAE,EAAE;YACR,SAAS,EAAE,eAAe;SAC3B,CAAC,CAAC;KACJ,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,SAAS,sBAAsB,CAAC,IAAc;IAC5C,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,eAAe,CAAC;IACrD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,0BAA0B,CAAC;IACzD,OAAO,IAAI,CAAC,cAAc,CAAC;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,2BAA2B;IAClC,WAAW,CAAC;QACV,QAAQ,EAAE;YACR,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE;gBACN,yFAAyF;gBACzF,4BAA4B,EAAE,aAAa;gBAC3C,2BAA2B,EAAE,MAAM;gBACnC,8BAA8B,EAAE,SAAS;aAC1C;SACF;QACD,KAAK,EAAE;YACL,6DAA6D;YAC7D;gBACE,SAAS,EAAE,CAAC,EAAE,CAAC;gBACf,SAAS,EAAE;oBACT,YAAY;oBACZ,MAAM;oBACN,UAAU;oBACV,YAAY;oBACZ,SAAS;oBACT,iBAAiB;oBACjB,wBAAwB;oBACxB,QAAQ;iBACT;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;YACD,gEAAgE;YAChE;gBACE,SAAS,EAAE,CAAC,MAAM,CAAC;gBACnB,SAAS,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,CAAC;gBACvE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;YACD,6BAA6B;YAC7B;gBACE,SAAS,EAAE,CAAC,OAAO,CAAC;gBACpB,SAAS,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;gBAC/B,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;YACD,iBAAiB;YACjB;gBACE,SAAS,EAAE,CAAC,2BAA2B,CAAC;gBACxC,SAAS,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,qBAAqB,CAAC;gBAC3E,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;YACD,aAAa;YACb;gBACE,SAAS,EAAE,CAAC,mBAAmB,CAAC;gBAChC,SAAS,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC;gBAC3C,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;YACD,cAAc;YACd;gBACE,SAAS,EAAE,CAAC,aAAa,CAAC;gBAC1B,SAAS,EAAE,CAAC,0BAA0B,CAAC;gBACvC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;YACD,SAAS;YACT;gBACE,SAAS,EAAE,CAAC,QAAQ,CAAC;gBACrB,SAAS,EAAE,CAAC,sBAAsB,CAAC;gBACnC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;YACD,8BAA8B;YAC9B;gBACE,SAAS,EAAE,CAAC,0BAA0B,CAAC;gBACvC,SAAS,EAAE;oBACT,iBAAiB;oBACjB,kBAAkB;oBAClB,YAAY;oBACZ,iBAAiB;oBACjB,SAAS;iBACV;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;YACD,+CAA+C;YAC/C;gBACE,SAAS,EAAE,CAAC,0BAA0B,CAAC;gBACvC,SAAS,EAAE;oBACT,wBAAwB;oBACxB,yBAAyB;oBACzB,mBAAmB;oBACnB,wBAAwB;oBACxB,gBAAgB;oBAChB,4BAA4B;oBAC5B,6BAA6B;oBAC7B,uBAAuB;oBACvB,4BAA4B;oBAC5B,oBAAoB;iBACrB;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;aAClC;YACD,4BAA4B;YAC5B;gBACE,SAAS,EAAE,CAAC,wBAAwB,CAAC;gBACrC,SAAS,EAAE,CAAC,cAAc,CAAC;gBAC3B,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;YACD,6CAA6C;YAC7C;gBACE,SAAS,EAAE,CAAC,wBAAwB,CAAC;gBACrC,SAAS,EAAE,CAAC,qBAAqB,EAAE,yBAAyB,CAAC;gBAC7D,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;aAClC;YACD,iCAAiC;YACjC;gBACE,SAAS,EAAE,CAAC,6BAA6B,CAAC;gBAC1C,SAAS,EAAE,CAAC,gBAAgB,CAAC;gBAC7B,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;YACD,kDAAkD;YAClD;gBACE,SAAS,EAAE,CAAC,6BAA6B,CAAC;gBAC1C,SAAS,EAAE,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;gBACjE,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;aAClC;YACD,oCAAoC;YACpC;gBACE,SAAS,EAAE,CAAC,gCAAgC,CAAC;gBAC7C,SAAS,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC;gBAC/C,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;YACD,qDAAqD;YACrD;gBACE,SAAS,EAAE,CAAC,gCAAgC,CAAC;gBAC7C,SAAS,EAAE;oBACT,kBAAkB;oBAClB,eAAe;oBACf,kBAAkB;oBAClB,sBAAsB;oBACtB,mBAAmB;oBACnB,sBAAsB;iBACvB;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;aAClC;YACD,uCAAuC;YACvC;gBACE,SAAS,EAAE,CAAC,yBAAyB,CAAC;gBACtC,SAAS,EAAE,CAAC,eAAe,EAAE,mBAAmB,CAAC;gBACjD,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;YACD,wCAAwC;YACxC;gBACE,SAAS,EAAE,CAAC,yBAAyB,CAAC;gBACtC,SAAS,EAAE,CAAC,wBAAwB,CAAC;gBACrC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;YACD,wCAAwC;YACxC;gBACE,SAAS,EAAE,CAAC,yBAAyB,CAAC;gBACtC,SAAS,EAAE;oBACT,sBAAsB;oBACtB,0BAA0B;oBAC1B,+BAA+B;oBAC/B,0BAA0B;oBAC1B,8BAA8B;oBAC9B,mCAAmC;iBACpC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;aAClC;YACD,8CAA8C;YAC9C;gBACE,SAAS,EAAE,CAAC,SAAS,CAAC;gBACtB,SAAS,EAAE,CAAC,0BAA0B,EAAE,iCAAiC,CAAC;gBAC1E,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;YACD,4DAA4D;YAC5D;gBACE,SAAS,EAAE,CAAC,sBAAsB,CAAC;gBACnC,SAAS,EAAE,CAAC,2BAA2B,CAAC;gBACxC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC;aAC7D;YACD,0CAA0C;YAC1C;gBACE,SAAS,EAAE,CAAC,eAAe,CAAC;gBAC5B,SAAS,EAAE,CAAC,QAAQ,CAAC;gBACrB,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;aAC3B;YACD,iCAAiC;YACjC;gBACE,SAAS,EAAE,CAAC,qBAAqB,CAAC;gBAClC,SAAS,EAAE,CAAC,QAAQ,CAAC;gBACrB,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aACvE;SACF;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/compositions/typekro-runtime/types.d.ts

@@ -0,0 +1,45 @@
+import { type Type } from 'arktype';
+export interface TypeKroRuntimeSpecType {
+    namespace: string;
+}
+export interface TypeKroRuntimeStatusType {
+    phase: 'Pending' | 'Installing' | 'Ready' | 'Failed' | 'Upgrading';
+    components: {
+        fluxSystem: boolean;
+        kroSystem: boolean;
+    };
+}
+export declare const TypeKroRuntimeSpec: Type<TypeKroRuntimeSpecType>;
+export declare const TypeKroRuntimeStatus: Type<TypeKroRuntimeStatusType>;
+/**
+ * RBAC configuration for the TypeKro runtime bootstrap.
+ *
+ * - `'cluster-admin'` (default): Binds all Flux controllers to the built-in `cluster-admin`
+ *   ClusterRole. This is the simplest option and works with any Helm chart, but grants
+ *   unrestricted cluster access.
+ *
+ * - `'scoped'`: Creates a dedicated ClusterRole with the minimum permissions required by
+ *   Flux controllers (Helm, Kustomize, Source, Notification, Image). This is more secure
+ *   but may fail if a deployed Helm chart creates CRDs or cluster-scoped resources that
+ *   require additional permissions not covered by the scoped role.
+ *
+ * - `{ clusterRoleRef: string }`: Binds Flux controllers to a user-provided ClusterRole.
+ *   The ClusterRole must already exist in the cluster. Use this when you need precise
+ *   control over permissions.
+ */
+export type RbacMode = 'cluster-admin' | 'scoped' | {
+    clusterRoleRef: string;
+};
+export interface TypeKroRuntimeConfig {
+    namespace?: string;
+    fluxVersion?: string;
+    kroVersion?: string;
+    /**
+     * RBAC mode for Flux controller permissions.
+     *
+     * @default 'cluster-admin'
+     * @see {@link RbacMode} for details on each mode.
+     */
+    rbac?: RbacMode;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/compositions/typekro-runtime/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/compositions/typekro-runtime/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,EAAQ,MAAM,SAAS,CAAC;AAE1C,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IACnE,UAAU,EAAE;QACV,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;CACH;AAED,eAAO,MAAM,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAE1D,CAAC;AAEH,eAAO,MAAM,oBAAoB,EAAE,IAAI,CAAC,wBAAwB,CAM9D,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,QAAQ,GAAG,eAAe,GAAG,QAAQ,GAAG;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB"}

package/dist/compositions/typekro-runtime/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/compositions/typekro-runtime/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,IAAI,EAAE,MAAM,SAAS,CAAC;AAc1C,MAAM,CAAC,MAAM,kBAAkB,GAAiC,IAAI,CAAC;IACnE,SAAS,EAAE,QAAQ;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAmC,IAAI,CAAC;IACvE,KAAK,EAAE,6DAA6D;IACpE,UAAU,EAAE;QACV,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,SAAS;KACrB;CACF,CAAC,CAAC"}