@reyemtech/nimbus 0.1.0

package/dist/esm/platform/stack.js

@@ -0,0 +1,258 @@
+"use strict";
+/**
+ * Platform stack implementation — deploys Helm-based platform components
+ * to any ICluster.
+ *
+ * Components: Traefik, cert-manager, External DNS, ArgoCD, Vault,
+ * External Secrets Operator.
+ *
+ * @module platform/stack
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPlatformStack = createPlatformStack;
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const pulumi = __importStar(require("@pulumi/pulumi"));
+/** Default Helm chart versions — pinned for reproducibility. */
+const DEFAULT_VERSIONS = {
+    traefik: "34.3.0",
+    certManager: "v1.17.2",
+    externalDns: "1.16.1",
+    argocd: "7.8.26",
+    vault: "0.29.1",
+    externalSecrets: "0.14.4",
+};
+/**
+ * Deploy a platform stack to one or more clusters.
+ *
+ * Installs cloud-agnostic Helm releases for ingress, TLS, DNS, GitOps,
+ * secrets management, and more. Each component can be individually
+ * enabled/disabled and configured.
+ *
+ * @example
+ * ```typescript
+ * const platform = createPlatformStack("prod", {
+ *   cluster,
+ *   domain: "reyem.tech",
+ *   externalDns: {
+ *     dnsProvider: "route53",
+ *     domainFilters: ["reyem.tech"],
+ *   },
+ *   vault: { enabled: true, ingressHost: "vault.reyem.tech" },
+ * });
+ * ```
+ */
+function createPlatformStack(name, config) {
+    const clusters = Array.isArray(config.cluster) ? config.cluster : [config.cluster];
+    if (clusters.length === 1) {
+        return deployToCluster(name, config, clusters[0]);
+    }
+    return clusters.map((cluster, i) => deployToCluster(`${name}-${cluster.name || i}`, config, cluster));
+}
+function deployToCluster(name, config, cluster) {
+    const components = {};
+    const provider = cluster.provider;
+    // 1. Traefik (ingress controller) — enabled by default
+    if (config.traefik?.enabled !== false) {
+        components["traefik"] = deployTraefik(name, config.traefik, provider);
+    }
+    // 2. cert-manager (TLS certificates) — enabled by default
+    if (config.certManager?.enabled !== false) {
+        components["cert-manager"] = deployCertManager(name, config.certManager, provider);
+    }
+    // 3. External DNS — enabled if configured
+    if (config.externalDns && config.externalDns.enabled !== false) {
+        components["external-dns"] = deployExternalDns(name, config.externalDns, provider);
+    }
+    // 4. ArgoCD (GitOps) — optional
+    if (config.argocd?.enabled) {
+        components["argocd"] = deployArgocd(name, config.argocd, config.domain, provider);
+    }
+    // 5. Vault (secrets) — optional
+    if (config.vault?.enabled) {
+        components["vault"] = deployVault(name, config.vault, provider);
+    }
+    // 6. External Secrets Operator — optional
+    if (config.externalSecrets?.enabled) {
+        components["external-secrets"] = deployExternalSecrets(name, config.externalSecrets, provider);
+    }
+    const traefikEndpoint = components["traefik"]
+        ? components["traefik"].status.apply((s) => {
+            const lb = s?.namespace ?? "";
+            return lb;
+        })
+        : pulumi.output("pending");
+    return {
+        name,
+        cluster,
+        components,
+        traefikEndpoint,
+    };
+}
+function deployTraefik(name, config, provider) {
+    return new k8s.helm.v3.Release(`${name}-traefik`, {
+        chart: "traefik",
+        repositoryOpts: { repo: "https://traefik.github.io/charts" },
+        version: config?.version ?? DEFAULT_VERSIONS.traefik,
+        namespace: "traefik",
+        createNamespace: true,
+        values: {
+            ingressRoute: {
+                dashboard: { enabled: false },
+            },
+            ports: {
+                web: { redirectTo: { port: "websecure" } },
+                websecure: { tls: { enabled: true } },
+            },
+            providers: {
+                kubernetesIngress: { publishedService: { enabled: true } },
+            },
+            ...config?.values,
+        },
+    }, { provider });
+}
+function deployCertManager(name, config, provider) {
+    return new k8s.helm.v3.Release(`${name}-cert-manager`, {
+        chart: "cert-manager",
+        repositoryOpts: { repo: "https://charts.jetstack.io" },
+        version: config?.version ?? DEFAULT_VERSIONS.certManager,
+        namespace: "cert-manager",
+        createNamespace: true,
+        values: {
+            crds: { enabled: true },
+            ...config?.values,
+        },
+    }, { provider });
+}
+function deployExternalDns(name, config, provider) {
+    const providerValues = {};
+    switch (config.dnsProvider) {
+        case "route53":
+            providerValues["provider"] = { name: "aws" };
+            break;
+        case "azure-dns":
+            providerValues["provider"] = { name: "azure" };
+            break;
+        case "cloud-dns":
+            providerValues["provider"] = { name: "google" };
+            break;
+        case "cloudflare":
+            providerValues["provider"] = { name: "cloudflare" };
+            break;
+    }
+    return new k8s.helm.v3.Release(`${name}-external-dns`, {
+        chart: "external-dns",
+        repositoryOpts: { repo: "https://kubernetes-sigs.github.io/external-dns" },
+        version: config.version ?? DEFAULT_VERSIONS.externalDns,
+        namespace: "external-dns",
+        createNamespace: true,
+        values: {
+            ...providerValues,
+            domainFilters: config.domainFilters ?? [],
+            policy: "sync",
+            sources: ["ingress", "service"],
+            ...config.values,
+        },
+    }, { provider });
+}
+function deployArgocd(name, config, domain, provider) {
+    return new k8s.helm.v3.Release(`${name}-argocd`, {
+        chart: "argo-cd",
+        repositoryOpts: { repo: "https://argoproj.github.io/argo-helm" },
+        version: config.version ?? DEFAULT_VERSIONS.argocd,
+        namespace: "argocd",
+        createNamespace: true,
+        values: {
+            server: {
+                ingress: {
+                    enabled: true,
+                    ingressClassName: "traefik",
+                    hostname: `argocd.${domain}`,
+                    tls: true,
+                },
+            },
+            ...config.values,
+        },
+    }, { provider });
+}
+function deployVault(name, config, provider) {
+    const ha = config.ha ?? false;
+    const storageSize = config.storageSize ?? "5Gi";
+    const serverValues = {
+        standalone: { enabled: !ha },
+        ha: ha
+            ? {
+                enabled: true,
+                replicas: 3,
+                raft: { enabled: true },
+            }
+            : { enabled: false },
+        dataStorage: { size: storageSize },
+    };
+    if (config.ingressHost) {
+        serverValues["ingress"] = {
+            enabled: true,
+            ingressClassName: "traefik",
+            hosts: [{ host: config.ingressHost }],
+            tls: [{ hosts: [config.ingressHost], secretName: "vault-tls" }],
+        };
+    }
+    return new k8s.helm.v3.Release(`${name}-vault`, {
+        chart: "vault",
+        repositoryOpts: { repo: "https://helm.releases.hashicorp.com" },
+        version: config.version ?? DEFAULT_VERSIONS.vault,
+        namespace: "vault",
+        createNamespace: true,
+        values: {
+            server: serverValues,
+            injector: { enabled: true },
+            ...config.values,
+        },
+    }, { provider });
+}
+function deployExternalSecrets(name, config, provider) {
+    return new k8s.helm.v3.Release(`${name}-external-secrets`, {
+        chart: "external-secrets",
+        repositoryOpts: { repo: "https://charts.external-secrets.io" },
+        version: config.version ?? DEFAULT_VERSIONS.externalSecrets,
+        namespace: "external-secrets",
+        createNamespace: true,
+        values: {
+            crds: { createClusterExternalSecret: true, createClusterSecretStore: true },
+            ...config.values,
+        },
+    }, { provider });
+}
+//# sourceMappingURL=stack.js.map

package/dist/esm/platform/stack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack.js","sourceRoot":"","sources":["../../../src/platform/stack.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CH,kDAaC;AAtDD,wDAA0C;AAC1C,uDAAyC;AAUzC,gEAAgE;AAChE,MAAM,gBAAgB,GAAG;IACvB,OAAO,EAAE,QAAQ;IACjB,WAAW,EAAE,SAAS;IACtB,WAAW,EAAE,QAAQ;IACrB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,QAAQ;IACf,eAAe,EAAE,QAAQ;CACjB,CAAC;AAEX;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,mBAAmB,CACjC,IAAY,EACZ,MAA4B;IAE5B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAa,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CACjC,eAAe,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,MAA4B,EAC5B,OAAiB;IAEjB,MAAM,UAAU,GAAwC,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,uDAAuD;IACvD,IAAI,MAAM,CAAC,OAAO,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QACtC,UAAU,CAAC,SAAS,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC;IAED,0DAA0D;IAC1D,IAAI,MAAM,CAAC,WAAW,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QAC1C,UAAU,CAAC,cAAc,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;IAED,0CAA0C;IAC1C,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC/D,UAAU,CAAC,cAAc,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;IAED,gCAAgC;IAChC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC3B,UAAU,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpF,CAAC;IAED,gCAAgC;IAChC,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QAC1B,UAAU,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClE,CAAC;IAED,0CAA0C;IAC1C,IAAI,MAAM,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC;QACpC,UAAU,CAAC,kBAAkB,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,eAAe,GAAG,UAAU,CAAC,SAAS,CAAC;QAC3C,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YACvC,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACJ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAE7B,OAAO;QACL,IAAI;QACJ,OAAO;QACP,UAAU;QACV,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,MAA4C,EAC5C,QAAsB;IAEtB,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,GAAG,IAAI,UAAU,EACjB;QACE,KAAK,EAAE,SAAS;QAChB,cAAc,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE;QAC5D,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,gBAAgB,CAAC,OAAO;QACpD,SAAS,EAAE,SAAS;QACpB,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE;YACN,YAAY,EAAE;gBACZ,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;aAC9B;YACD,KAAK,EAAE;gBACL,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;gBAC1C,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;aACtC;YACD,SAAS,EAAE;gBACT,iBAAiB,EAAE,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;aAC3D;YACD,GAAG,MAAM,EAAE,MAAM;SAClB;KACF,EACD,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,MAA4C,EAC5C,QAAsB;IAEtB,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,GAAG,IAAI,eAAe,EACtB;QACE,KAAK,EAAE,cAAc;QACrB,cAAc,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE;QACtD,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,gBAAgB,CAAC,WAAW;QACxD,SAAS,EAAE,cAAc;QACzB,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE;YACN,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACvB,GAAG,MAAM,EAAE,MAAM;SAClB;KACF,EACD,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,MAA0B,EAC1B,QAAsB;IAEtB,MAAM,cAAc,GAA4B,EAAE,CAAC;IAEnD,QAAQ,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3B,KAAK,SAAS;YACZ,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC7C,MAAM;QACR,KAAK,WAAW;YACd,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC/C,MAAM;QACR,KAAK,WAAW;YACd,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAChD,MAAM;QACR,KAAK,YAAY;YACf,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YACpD,MAAM;IACV,CAAC;IAED,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,GAAG,IAAI,eAAe,EACtB;QACE,KAAK,EAAE,cAAc;QACrB,cAAc,EAAE,EAAE,IAAI,EAAE,gDAAgD,EAAE;QAC1E,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,WAAW;QACvD,SAAS,EAAE,cAAc;QACzB,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE;YACN,GAAG,cAAc;YACjB,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;YAC/B,GAAG,MAAM,CAAC,MAAM;SACjB;KACF,EACD,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,IAAY,EACZ,MAAgC,EAChC,MAAc,EACd,QAAsB;IAEtB,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,GAAG,IAAI,SAAS,EAChB;QACE,KAAK,EAAE,SAAS;QAChB,cAAc,EAAE,EAAE,IAAI,EAAE,sCAAsC,EAAE;QAChE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,MAAM;QAClD,SAAS,EAAE,QAAQ;QACnB,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,OAAO,EAAE;oBACP,OAAO,EAAE,IAAI;oBACb,gBAAgB,EAAE,SAAS;oBAC3B,QAAQ,EAAE,UAAU,MAAM,EAAE;oBAC5B,GAAG,EAAE,IAAI;iBACV;aACF;YACD,GAAG,MAAM,CAAC,MAAM;SACjB;KACF,EACD,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,IAAY,EACZ,MAAoB,EACpB,QAAsB;IAEtB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,KAAK,CAAC;IAC9B,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC;IAEhD,MAAM,YAAY,GAA4B;QAC5C,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE;QAC5B,EAAE,EAAE,EAAE;YACJ,CAAC,CAAC;gBACE,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,CAAC;gBACX,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;aACxB;YACH,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;QACtB,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;KACnC,CAAC;IAEF,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,YAAY,CAAC,SAAS,CAAC,GAAG;YACxB,OAAO,EAAE,IAAI;YACb,gBAAgB,EAAE,SAAS;YAC3B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YACrC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,GAAG,IAAI,QAAQ,EACf;QACE,KAAK,EAAE,OAAO;QACd,cAAc,EAAE,EAAE,IAAI,EAAE,qCAAqC,EAAE;QAC/D,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,KAAK;QACjD,SAAS,EAAE,OAAO;QAClB,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE;YACN,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC3B,GAAG,MAAM,CAAC,MAAM;SACjB;KACF,EACD,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAY,EACZ,MAAgC,EAChC,QAAsB;IAEtB,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,GAAG,IAAI,mBAAmB,EAC1B;QACE,KAAK,EAAE,kBAAkB;QACzB,cAAc,EAAE,EAAE,IAAI,EAAE,oCAAoC,EAAE;QAC9D,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,eAAe;QAC3D,SAAS,EAAE,kBAAkB;QAC7B,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE;YACN,IAAI,EAAE,EAAE,2BAA2B,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE;YAC3E,GAAG,MAAM,CAAC,MAAM;SACjB;KACF,EACD,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC"}

package/dist/esm/queue/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Queue module — message queue provisioning abstraction.
+ *
+ * @module queue
+ */
+export type { QueueEngine, QueueMode, QueueType, IQueueConfig, IQueue } from "./interfaces";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/queue/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/queue/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC"}

package/dist/esm/queue/index.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * Queue module — message queue provisioning abstraction.
+ *
+ * @module queue
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=index.js.map

package/dist/esm/queue/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/queue/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG"}

package/dist/esm/queue/interfaces.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Message queue interfaces for @reyemtech/nimbus.
+ *
+ * Abstracts managed queues (SQS, Service Bus, Pub/Sub) and
+ * operator-based queues (NATS, RabbitMQ, Kafka).
+ *
+ * @module queue/interfaces
+ */
+import type * as pulumi from "@pulumi/pulumi";
+import type { CloudArg, ResolvedCloudTarget } from "../types";
+/** Supported queue engines. */
+export type QueueEngine = "sqs" | "service-bus" | "pub-sub" | "nats" | "rabbitmq" | "kafka";
+/** Queue deployment mode. */
+export type QueueMode = "managed" | "operator";
+/** Queue type (delivery semantics). */
+export type QueueType = "standard" | "fifo" | "streaming";
+/**
+ * Queue configuration input.
+ *
+ * @example
+ * ```typescript
+ * const config: IQueueConfig = {
+ *   cloud: "aws",
+ *   engine: "sqs",
+ *   queueType: "fifo",
+ * };
+ * ```
+ */
+export interface IQueueConfig {
+    readonly cloud: CloudArg;
+    /** Auto-selected based on cloud if omitted. */
+    readonly engine?: QueueEngine;
+    readonly mode?: QueueMode;
+    readonly queueType?: QueueType;
+    readonly tags?: Readonly<Record<string, string>>;
+}
+/** Queue output — the created queue resource. */
+export interface IQueue {
+    readonly name: string;
+    readonly cloud: ResolvedCloudTarget;
+    readonly engine: QueueEngine;
+    readonly endpoint: pulumi.Output<string>;
+    /** Escape hatch: cloud-native or operator queue resource. */
+    readonly nativeResource: pulumi.Resource;
+}
+//# sourceMappingURL=interfaces.d.ts.map

package/dist/esm/queue/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../../src/queue/interfaces.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAE9D,+BAA+B;AAC/B,MAAM,MAAM,WAAW,GACnB,KAAK,GACL,aAAa,GACb,SAAS,GACT,MAAM,GACN,UAAU,GACV,OAAO,CAAC;AAEZ,6BAA6B;AAC7B,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAE/C,uCAAuC;AACvC,MAAM,MAAM,SAAS,GACjB,UAAU,GACV,MAAM,GACN,WAAW,CAAC;AAEhB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED,iDAAiD;AACjD,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEzC,6DAA6D;IAC7D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC1C"}

package/dist/esm/queue/interfaces.js

@@ -0,0 +1,11 @@
+"use strict";
+/**
+ * Message queue interfaces for @reyemtech/nimbus.
+ *
+ * Abstracts managed queues (SQS, Service Bus, Pub/Sub) and
+ * operator-based queues (NATS, RabbitMQ, Kafka).
+ *
+ * @module queue/interfaces
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=interfaces.js.map

package/dist/esm/queue/interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../../src/queue/interfaces.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG"}

package/dist/esm/secrets/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Secrets module — secret management abstraction.
+ *
+ * @module secrets
+ */
+export type { SecretBackend, ISecretRef, ISecretsConfig, ISecrets } from "./interfaces";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC"}

package/dist/esm/secrets/index.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * Secrets module — secret management abstraction.
+ *
+ * @module secrets
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=index.js.map

package/dist/esm/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/secrets/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG"}

package/dist/esm/secrets/interfaces.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Secrets interfaces for @reyemtech/nimbus.
+ *
+ * Abstracts secret management across HashiCorp Vault (in-cluster),
+ * AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager.
+ *
+ * @module secrets/interfaces
+ */
+import type * as pulumi from "@pulumi/pulumi";
+import type { CloudArg, ResolvedCloudTarget } from "../types";
+/** Supported secret backends. */
+export type SecretBackend = "vault" | "aws-secrets-manager" | "azure-key-vault" | "gcp-secret-manager";
+/** Reference to a secret (path + optional key within the secret). */
+export interface ISecretRef {
+    /** Secret path (e.g., "operators/mysql" or "production"). */
+    readonly path: string;
+    /** Specific key within the secret (e.g., "root" for the root password). */
+    readonly key?: string;
+}
+/**
+ * Secrets configuration input.
+ *
+ * @example
+ * ```typescript
+ * // Vault (default for in-cluster)
+ * const config: ISecretsConfig = {
+ *   cloud: "aws",
+ *   backend: "vault",
+ *   vaultAddress: "https://vault.reyem.tech",
+ * };
+ *
+ * // Azure Key Vault
+ * const config: ISecretsConfig = {
+ *   cloud: "azure",
+ *   backend: "azure-key-vault",
+ * };
+ * ```
+ */
+export interface ISecretsConfig {
+    readonly cloud: CloudArg;
+    /** Default: "vault" if Vault is in the platform stack, cloud-native otherwise. */
+    readonly backend?: SecretBackend;
+    /** Vault address (required if backend is "vault"). */
+    readonly vaultAddress?: string;
+    readonly tags?: Readonly<Record<string, string>>;
+}
+/**
+ * Secrets output — the created secret store.
+ *
+ * Provides unified put/get operations regardless of backend.
+ */
+export interface ISecrets {
+    readonly name: string;
+    readonly cloud: ResolvedCloudTarget;
+    readonly backend: SecretBackend;
+    /**
+     * Store a secret.
+     *
+     * @param path - Secret path
+     * @param data - Key-value pairs to store
+     */
+    putSecret(path: string, data: Record<string, pulumi.Input<string>>): void;
+    /**
+     * Get a reference to a secret value (for use in other resources).
+     *
+     * @param ref - Secret reference (path + optional key)
+     * @returns The secret value as a Pulumi Output
+     */
+    getSecretRef(ref: ISecretRef): pulumi.Output<string>;
+    /** Escape hatch: cloud-native secret store resource. */
+    readonly nativeResource: pulumi.Resource;
+}
+//# sourceMappingURL=interfaces.d.ts.map

package/dist/esm/secrets/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../../src/secrets/interfaces.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAE9D,iCAAiC;AACjC,MAAM,MAAM,aAAa,GACrB,OAAO,GACP,qBAAqB,GACrB,iBAAiB,GACjB,oBAAoB,CAAC;AAEzB,qEAAqE;AACrE,MAAM,WAAW,UAAU;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAEhC;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC;IAE1E;;;;;OAKG;IACH,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAErD,wDAAwD;IACxD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC1C"}

package/dist/esm/secrets/interfaces.js

@@ -0,0 +1,11 @@
+"use strict";
+/**
+ * Secrets interfaces for @reyemtech/nimbus.
+ *
+ * Abstracts secret management across HashiCorp Vault (in-cluster),
+ * AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager.
+ *
+ * @module secrets/interfaces
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=interfaces.js.map

package/dist/esm/secrets/interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../../src/secrets/interfaces.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG"}

package/dist/esm/storage/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Object storage module — S3/Blob/GCS bucket abstraction.
+ *
+ * @module storage
+ */
+export type { ILifecycleRule, ICorsRule, IObjectStorageConfig, IObjectStorage } from "./interfaces";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/storage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/storage/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/esm/storage/index.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * Object storage module — S3/Blob/GCS bucket abstraction.
+ *
+ * @module storage
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=index.js.map

package/dist/esm/storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/storage/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG"}

package/dist/esm/storage/interfaces.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Object storage interfaces for @reyemtech/nimbus.
+ *
+ * Abstracts S3 (AWS), Blob Storage (Azure), and GCS (GCP)
+ * bucket management with versioning, encryption, and lifecycle policies.
+ *
+ * @module storage/interfaces
+ */
+import type * as pulumi from "@pulumi/pulumi";
+import type { CloudArg, ResolvedCloudTarget } from "../types";
+/** Lifecycle rule for object expiration/transition. */
+export interface ILifecycleRule {
+    readonly prefix?: string;
+    readonly expirationDays?: number;
+    readonly transitionDays?: number;
+    readonly transitionStorageClass?: string;
+}
+/** CORS rule for cross-origin access. */
+export interface ICorsRule {
+    readonly allowedOrigins: ReadonlyArray<string>;
+    readonly allowedMethods: ReadonlyArray<string>;
+    readonly allowedHeaders?: ReadonlyArray<string>;
+    readonly maxAgeSeconds?: number;
+}
+/**
+ * Object storage configuration input.
+ *
+ * @example
+ * ```typescript
+ * const config: IObjectStorageConfig = {
+ *   cloud: "aws",
+ *   versioning: true,
+ *   encryption: true,
+ *   lifecycleRules: [
+ *     { prefix: "logs/", expirationDays: 90 },
+ *     { prefix: "backups/", transitionDays: 30, transitionStorageClass: "GLACIER" },
+ *   ],
+ * };
+ * ```
+ */
+export interface IObjectStorageConfig {
+    readonly cloud: CloudArg;
+    readonly versioning?: boolean;
+    /** Enable server-side encryption. Default: true. */
+    readonly encryption?: boolean;
+    readonly lifecycleRules?: ReadonlyArray<ILifecycleRule>;
+    /** Allow public access. Default: false. */
+    readonly publicAccess?: boolean;
+    readonly corsRules?: ReadonlyArray<ICorsRule>;
+    readonly tags?: Readonly<Record<string, string>>;
+}
+/** Object storage output — the created bucket. */
+export interface IObjectStorage {
+    readonly name: string;
+    readonly cloud: ResolvedCloudTarget;
+    readonly bucketName: pulumi.Output<string>;
+    /** AWS-specific: bucket ARN. */
+    readonly bucketArn?: pulumi.Output<string>;
+    readonly endpoint: pulumi.Output<string>;
+    /** Escape hatch: cloud-native bucket resource. */
+    readonly nativeResource: pulumi.Resource;
+}
+//# sourceMappingURL=interfaces.d.ts.map

package/dist/esm/storage/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../../src/storage/interfaces.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAE9D,uDAAuD;AACvD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,oDAAoD;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACxD,2CAA2C;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,gCAAgC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEzC,kDAAkD;IAClD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC1C"}

package/dist/esm/storage/interfaces.js

@@ -0,0 +1,11 @@
+"use strict";
+/**
+ * Object storage interfaces for @reyemtech/nimbus.
+ *
+ * Abstracts S3 (AWS), Blob Storage (Azure), and GCS (GCP)
+ * bucket management with versioning, encryption, and lifecycle policies.
+ *
+ * @module storage/interfaces
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=interfaces.js.map

package/dist/esm/storage/interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../../src/storage/interfaces.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG"}