@reyemtech/nimbus 1.2.0 → 2.0.1

package/dist/cjs/azure/resource-group.js

@@ -0,0 +1,79 @@
+"use strict";
+/**
+ * Resource group abstraction — declare once, reuse across all Azure resources.
+ *
+ * Caches by name so multiple factories referencing the same resource group
+ * share a single Pulumi resource declaration. Idempotent by design:
+ * Pulumi handles create/update/no-op on each `pulumi up`.
+ *
+ * @module azure/resource-group
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureResourceGroup = ensureResourceGroup;
+const azure = __importStar(require("@pulumi/azure-native/resources"));
+/** Cache of declared resource groups, keyed by name. */
+const cache = new Map();
+/**
+ * Ensure a resource group is declared in the Pulumi stack.
+ *
+ * First call creates the Pulumi resource; subsequent calls with the
+ * same name return the cached reference. This is pure declaration —
+ * Pulumi decides whether to create, update, or skip at deploy time.
+ *
+ * @param name - Desired resource group name in Azure (e.g. "rg-myapp-canadacentral")
+ * @param opts - Optional tags and location override
+ * @returns The ResourceGroup's name as a Pulumi Output (for dependency chaining)
+ *
+ * @example
+ * ```typescript
+ * const rgName = ensureResourceGroup("rg-prod-canadacentral", {
+ *   tags: { environment: "production" },
+ * });
+ * ```
+ */
+function ensureResourceGroup(name, opts) {
+    const existing = cache.get(name);
+    if (existing)
+        return existing.name;
+    const rg = new azure.ResourceGroup(`nimbus-rg-${name}`, {
+        resourceGroupName: name,
+        location: opts?.location,
+        tags: opts?.tags,
+    });
+    cache.set(name, rg);
+    return rg.name;
+}
+//# sourceMappingURL=resource-group.js.map

package/dist/cjs/azure/resource-group.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-group.js","sourceRoot":"","sources":["../../../src/azure/resource-group.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCH,kDAeC;AA/CD,sEAAwD;AAGxD,wDAAwD;AACxD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;AAUrD;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,mBAAmB,CACjC,IAAY,EACZ,IAA4B;IAE5B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;IAEnC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,aAAa,CAAC,aAAa,IAAI,EAAE,EAAE;QACtD,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,IAAI,EAAE,QAAQ;QACxB,IAAI,EAAE,IAAI,EAAE,IAAI;KACjB,CAAC,CAAC;IAEH,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACpB,OAAO,EAAE,CAAC,IAAI,CAAC;AACjB,CAAC"}

package/dist/cjs/azure/secrets.d.ts

@@ -9,8 +9,8 @@ import type { ISecrets, ISecretsConfig } from "../secrets";
 export interface IAzureSecretsOptions {
     /** Resource group name. Required for Azure. */
     readonly resourceGroupName: pulumi.Input<string>;
-    /** Azure AD tenant ID. Required for Key Vault access policies. */
-    readonly tenantId: pulumi.Input<string>;
+    /** Azure AD tenant ID. Auto-detected via `getClientConfigOutput()` when omitted. */
+    readonly tenantId?: pulumi.Input<string>;
     /** Object ID of the principal that should have access to secrets. */
     readonly objectId?: pulumi.Input<string>;
     /** Key Vault SKU. Default: "standard". */
@@ -19,6 +19,10 @@ export interface IAzureSecretsOptions {
 /**
  * Create an Azure Key Vault for secret management.
  *
+ * When `tenantId` is omitted, it is auto-detected from the current Azure
+ * identity via `getClientConfigOutput()`. A Key Vault Secrets Officer RBAC
+ * role assignment is automatically created for the deploying principal.
+ *
  * @example
  * ```typescript
  * const secrets = createAzureSecrets("prod", {
@@ -26,7 +30,6 @@ export interface IAzureSecretsOptions {
  *   backend: "azure-key-vault",
  * }, {
  *   resourceGroupName: "my-rg",
- *   tenantId: "00000000-0000-0000-0000-000000000000",
  * });
  *
  * secrets.putSecret("database", { host: "db.example.com", password: dbPassword });

package/dist/cjs/azure/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../src/azure/secrets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,EAAc,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AASvE,sCAAsC;AACtC,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,0CAA0C;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,oBAAoB,GAC5B,QAAQ,CAqGV"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../src/azure/secrets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,EAAc,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAYvE,sCAAsC;AACtC,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,0CAA0C;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,oBAAoB,GAC5B,QAAQ,CAmHV"}

package/dist/cjs/azure/secrets.js

@@ -46,9 +46,15 @@ const types_1 = require("../types");
 const KEY_VAULT_NAME_MAX_LENGTH = 24;
 /** Default soft-delete retention period in days for Key Vault. */
 const SOFT_DELETE_RETENTION_DAYS = 90;
+/** Well-known role definition ID for Key Vault Secrets Officer. */
+const KEY_VAULT_SECRETS_OFFICER_ROLE_ID = "b86a8fe4-44ce-4948-aee5-eccb2c155cd7";
 /**
  * Create an Azure Key Vault for secret management.
  *
+ * When `tenantId` is omitted, it is auto-detected from the current Azure
+ * identity via `getClientConfigOutput()`. A Key Vault Secrets Officer RBAC
+ * role assignment is automatically created for the deploying principal.
+ *
  * @example
  * ```typescript
  * const secrets = createAzureSecrets("prod", {
@@ -56,7 +62,6 @@ const SOFT_DELETE_RETENTION_DAYS = 90;
  *   backend: "azure-key-vault",
  * }, {
  *   resourceGroupName: "my-rg",
- *   tenantId: "00000000-0000-0000-0000-000000000000",
  * });
  *
  * secrets.putSecret("database", { host: "db.example.com", password: dbPassword });
@@ -68,12 +73,15 @@ function createAzureSecrets(name, config, options) {
     const target = (0, types_1.resolveCloudTarget)(cloud);
     const tags = config.tags ?? {};
     const rgName = options.resourceGroupName;
+    // Auto-detect tenantId from current Azure identity when not provided
+    const clientConfig = azure.authorization.getClientConfigOutput();
+    const tenantId = options.tenantId ?? clientConfig.tenantId;
     // Key Vault names must be 3-24 chars, alphanumeric + hyphens
     const vaultName = name.replace(/[^a-zA-Z0-9-]/g, "-").substring(0, KEY_VAULT_NAME_MAX_LENGTH);
     const accessPolicies = [];
     if (options.objectId) {
         accessPolicies.push({
-            tenantId: options.tenantId,
+            tenantId,
             objectId: options.objectId,
             permissions: {
                 secrets: ["Get", "List", "Set", "Delete"],
@@ -84,7 +92,7 @@ function createAzureSecrets(name, config, options) {
         vaultName,
         resourceGroupName: rgName,
         properties: {
-            tenantId: options.tenantId,
+            tenantId,
             sku: {
                 family: "A",
                 name: options.sku === "premium"
@@ -98,6 +106,12 @@ function createAzureSecrets(name, config, options) {
         },
         tags: { ...tags, Name: `${name}-kv` },
     });
+    // Grant the deploying principal Key Vault Secrets Officer on this vault
+    new azure.authorization.RoleAssignment(`${name}-kv-secrets-officer`, {
+        principalId: clientConfig.objectId,
+        roleDefinitionId: clientConfig.subscriptionId.apply((sub) => `/subscriptions/${sub}/providers/Microsoft.Authorization/roleDefinitions/${KEY_VAULT_SECRETS_OFFICER_ROLE_ID}`),
+        scope: vault.id,
+    });
     // Track created secrets for getSecretRef lookups
     const secretResources = new Map();
     return {

package/dist/cjs/azure/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/azure/secrets.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0CH,gDAyGC;AAjJD,4DAA8C;AAC9C,uDAAyC;AAEzC,oCAA8C;AAE9C,qFAAqF;AACrF,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,kEAAkE;AAClE,MAAM,0BAA0B,GAAG,EAAE,CAAC;AActC;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,kBAAkB,CAChC,IAAY,EACZ,MAAsB,EACtB,OAA6B;IAE7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IACxF,MAAM,MAAM,GAAG,IAAA,0BAAkB,EAAC,KAAK,CAAC,CAAC;IAEzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAEzC,6DAA6D;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAE9F,MAAM,cAAc,GAAuD,EAAE,CAAC;IAC9E,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,cAAc,CAAC,IAAI,CAAC;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE;gBACX,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC;aAC1C;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,EAAE;QACnD,SAAS;QACT,iBAAiB,EAAE,MAAM;QACzB,UAAU,EAAE;YACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE;gBACH,MAAM,EAAE,GAAG;gBACX,IAAI,EACF,OAAO,CAAC,GAAG,KAAK,SAAS;oBACvB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;oBAChC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ;aACtC;YACD,gBAAgB,EAAE,IAAI;YACtB,yBAAyB,EAAE,0BAA0B;YACrD,uBAAuB,EAAE,IAAI;YAC7B,cAAc;SACf;QACD,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,KAAK,EAAE;KACtC,CAAC,CAAC;IAEH,iDAAiD;IACjD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEjE,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,iBAAiB;QAC1B,cAAc,EAAE,KAAK;QAErB,SAAS,CAAC,IAAY,EAAE,IAA0C;YAChE,gFAAgF;YAChF,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YACnF,iDAAiD;YACjD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAEvD,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,EAAE;gBAChE,UAAU;gBACV,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,iBAAiB,EAAE,MAAM;gBACzB,UAAU,EAAE;oBACV,KAAK,EAAE,WAAW;oBAClB,WAAW,EAAE,kBAAkB;iBAChC;gBACD,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QAED,YAAY,CAAC,GAAe;YAC1B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;YAEpB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,4CAA4C;gBAC5C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC;oBAC5C,UAAU;oBACV,SAAS,EAAE,KAAK,CAAC,IAAI;oBACrB,iBAAiB,EAAE,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;wBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAA2B,CAAC;wBACzE,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC3B,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAA2B,CAAC;oBACzE,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/azure/secrets.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDH,gDAuHC;AArKD,4DAA8C;AAC9C,uDAAyC;AAEzC,oCAA8C;AAE9C,qFAAqF;AACrF,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,kEAAkE;AAClE,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC,mEAAmE;AACnE,MAAM,iCAAiC,GAAG,sCAAsC,CAAC;AAcjF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,kBAAkB,CAChC,IAAY,EACZ,MAAsB,EACtB,OAA6B;IAE7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IACxF,MAAM,MAAM,GAAG,IAAA,0BAAkB,EAAC,KAAK,CAAC,CAAC;IAEzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAEzC,qEAAqE;IACrE,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC,qBAAqB,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC,QAAQ,CAAC;IAE3D,6DAA6D;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAE9F,MAAM,cAAc,GAAuD,EAAE,CAAC;IAC9E,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,cAAc,CAAC,IAAI,CAAC;YAClB,QAAQ;YACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE;gBACX,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC;aAC1C;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,EAAE;QACnD,SAAS;QACT,iBAAiB,EAAE,MAAM;QACzB,UAAU,EAAE;YACV,QAAQ;YACR,GAAG,EAAE;gBACH,MAAM,EAAE,GAAG;gBACX,IAAI,EACF,OAAO,CAAC,GAAG,KAAK,SAAS;oBACvB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;oBAChC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ;aACtC;YACD,gBAAgB,EAAE,IAAI;YACtB,yBAAyB,EAAE,0BAA0B;YACrD,uBAAuB,EAAE,IAAI;YAC7B,cAAc;SACf;QACD,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,KAAK,EAAE;KACtC,CAAC,CAAC;IAEH,wEAAwE;IACxE,IAAI,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,GAAG,IAAI,qBAAqB,EAAE;QACnE,WAAW,EAAE,YAAY,CAAC,QAAQ;QAClC,gBAAgB,EAAE,YAAY,CAAC,cAAc,CAAC,KAAK,CACjD,CAAC,GAAG,EAAE,EAAE,CACN,kBAAkB,GAAG,sDAAsD,iCAAiC,EAAE,CACjH;QACD,KAAK,EAAE,KAAK,CAAC,EAAE;KAChB,CAAC,CAAC;IAEH,iDAAiD;IACjD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEjE,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,iBAAiB;QAC1B,cAAc,EAAE,KAAK;QAErB,SAAS,CAAC,IAAY,EAAE,IAA0C;YAChE,gFAAgF;YAChF,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YACnF,iDAAiD;YACjD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAEvD,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,EAAE;gBAChE,UAAU;gBACV,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,iBAAiB,EAAE,MAAM;gBACzB,UAAU,EAAE;oBACV,KAAK,EAAE,WAAW;oBAClB,WAAW,EAAE,kBAAkB;iBAChC;gBACD,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QAED,YAAY,CAAC,GAAe;YAC1B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;YAEpB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,4CAA4C;gBAC5C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC;oBAC5C,UAAU;oBACV,SAAS,EAAE,KAAK,CAAC,IAAI;oBACrB,iBAAiB,EAAE,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;wBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAA2B,CAAC;wBACzE,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC3B,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAA2B,CAAC;oBACzE,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cjs/backup/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Backup target module — S3-backed backup destinations with IAM credentials
+ * and optional cross-region replication.
+ *
+ * @module backup
+ */
+import type { IBackupTarget, IBackupTargetConfig } from "./interfaces";
+export type { IBackupReplicationConfig, IBackupTargetConfig, IBackupTarget } from "./interfaces";
+/**
+ * Create an S3-backed backup target with IAM credentials.
+ *
+ * Provisions an S3 bucket with versioning, an IAM user scoped to that bucket,
+ * and optionally a replica bucket in another region for cross-region replication.
+ *
+ * @param name - Logical name prefix for all created resources
+ * @param config - Backup target configuration
+ * @returns IBackupTarget with bucket name, credentials, and optional replica bucket
+ */
+export declare function createBackupTarget(name: string, config: IBackupTargetConfig): IBackupTarget;
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/backup/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backup/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEvE,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEjG;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,aAAa,CAsN3F"}

package/dist/cjs/backup/index.js

@@ -0,0 +1,206 @@
+"use strict";
+/**
+ * Backup target module — S3-backed backup destinations with IAM credentials
+ * and optional cross-region replication.
+ *
+ * @module backup
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createBackupTarget = createBackupTarget;
+const aws = __importStar(require("@pulumi/aws"));
+const pulumi = __importStar(require("@pulumi/pulumi"));
+/**
+ * Create an S3-backed backup target with IAM credentials.
+ *
+ * Provisions an S3 bucket with versioning, an IAM user scoped to that bucket,
+ * and optionally a replica bucket in another region for cross-region replication.
+ *
+ * @param name - Logical name prefix for all created resources
+ * @param config - Backup target configuration
+ * @returns IBackupTarget with bucket name, credentials, and optional replica bucket
+ */
+function createBackupTarget(name, config) {
+    const bucketName = config.bucketPrefix ? `${config.bucketPrefix}-${name}` : name;
+    const providerOpts = config.awsProvider
+        ? { provider: config.awsProvider }
+        : {};
+    // Primary bucket
+    const bucket = new aws.s3.Bucket(`${name}-bucket`, {
+        bucket: bucketName,
+        tags: config.tags,
+    }, providerOpts);
+    // Enable versioning on the primary bucket
+    new aws.s3.BucketVersioning(`${name}-bucket-versioning`, {
+        bucket: bucket.bucket,
+        versioningConfiguration: {
+            status: "Enabled",
+        },
+    }, { ...providerOpts, dependsOn: [bucket] });
+    // IAM user for backup credentials
+    const iamUser = new aws.iam.User(`${name}-backup-user`, {
+        name: `nimbus-backup-${name}`,
+        path: "/nimbus/",
+        tags: config.tags,
+    }, providerOpts);
+    // IAM policy scoped to the bucket
+    const iamPolicy = new aws.iam.Policy(`${name}-backup-policy`, {
+        name: `nimbus-backup-${name}`,
+        description: `Nimbus backup policy for bucket ${bucketName}`,
+        policy: pulumi.all([bucket.arn]).apply(([bucketArn]) => JSON.stringify({
+            Version: "2012-10-17",
+            Statement: [
+                {
+                    Effect: "Allow",
+                    Action: ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
+                    Resource: `${bucketArn}/*`,
+                },
+                {
+                    Effect: "Allow",
+                    Action: ["s3:ListBucket"],
+                    Resource: bucketArn,
+                },
+            ],
+        })),
+        tags: config.tags,
+    }, providerOpts);
+    // Attach policy to user
+    new aws.iam.UserPolicyAttachment(`${name}-backup-policy-attachment`, {
+        user: iamUser.name,
+        policyArn: iamPolicy.arn,
+    }, { ...providerOpts, dependsOn: [iamUser, iamPolicy] });
+    // IAM access key
+    const accessKey = new aws.iam.AccessKey(`${name}-backup-access-key`, {
+        user: iamUser.name,
+    }, { ...providerOpts, dependsOn: [iamUser] });
+    // Optional: cross-region replication
+    let replicationBucket;
+    if (config.replication?.enabled) {
+        const replicaRegion = config.replication.targetRegion;
+        // Create a provider for the replica region
+        const replicaProvider = new aws.Provider(`${name}-replica-provider`, {
+            region: replicaRegion,
+        });
+        const replicaBucketName = `${bucketName}-replica`;
+        const replicaBucketResource = new aws.s3.Bucket(`${name}-replica-bucket`, {
+            bucket: replicaBucketName,
+            tags: config.tags,
+        }, { provider: replicaProvider });
+        // Enable versioning on replica (required for replication)
+        new aws.s3.BucketVersioning(`${name}-replica-bucket-versioning`, {
+            bucket: replicaBucketResource.bucket,
+            versioningConfiguration: {
+                status: "Enabled",
+            },
+        }, { provider: replicaProvider, dependsOn: [replicaBucketResource] });
+        // IAM role for replication
+        const replicationRole = new aws.iam.Role(`${name}-replication-role`, {
+            name: `nimbus-replication-${name}`,
+            assumeRolePolicy: JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Principal: { Service: "s3.amazonaws.com" },
+                        Action: "sts:AssumeRole",
+                    },
+                ],
+            }),
+            tags: config.tags,
+        }, providerOpts);
+        // Replication role policy
+        const replicationPolicy = new aws.iam.RolePolicy(`${name}-replication-policy`, {
+            role: replicationRole.name,
+            policy: pulumi.all([bucket.arn, replicaBucketResource.arn]).apply(([srcArn, dstArn]) => JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Action: ["s3:GetReplicationConfiguration", "s3:ListBucket"],
+                        Resource: srcArn,
+                    },
+                    {
+                        Effect: "Allow",
+                        Action: [
+                            "s3:GetObjectVersionForReplication",
+                            "s3:GetObjectVersionAcl",
+                            "s3:GetObjectVersionTagging",
+                        ],
+                        Resource: `${srcArn}/*`,
+                    },
+                    {
+                        Effect: "Allow",
+                        Action: ["s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags"],
+                        Resource: `${dstArn}/*`,
+                    },
+                ],
+            })),
+        }, { ...providerOpts, dependsOn: [replicationRole] });
+        // Bucket replication configuration
+        new aws.s3.BucketReplicationConfig(`${name}-replication-config`, {
+            bucket: bucket.bucket,
+            role: replicationRole.arn,
+            rules: [
+                {
+                    id: `${name}-replicate-all`,
+                    status: "Enabled",
+                    destination: {
+                        bucket: replicaBucketResource.arn,
+                        storageClass: "STANDARD",
+                    },
+                    filter: {
+                        prefix: "",
+                    },
+                    deleteMarkerReplication: {
+                        status: "Enabled",
+                    },
+                },
+            ],
+        }, { ...providerOpts, dependsOn: [bucket, replicaBucketResource, replicationPolicy] });
+        replicationBucket = replicaBucketResource.bucket;
+    }
+    return {
+        name,
+        bucket: bucket.bucket,
+        region: config.region,
+        credentials: {
+            accessKeyId: accessKey.id,
+            secretAccessKey: accessKey.secret,
+        },
+        replicationBucket,
+        nativeResource: bucket,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/cjs/backup/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backup/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBH,gDAsNC;AAtOD,iDAAmC;AACnC,uDAAyC;AAKzC;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAAC,IAAY,EAAE,MAA2B;IAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,MAAM,YAAY,GAAiC,MAAM,CAAC,WAAW;QACnE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE;QAClC,CAAC,CAAC,EAAE,CAAC;IAEP,iBAAiB;IACjB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,CAC9B,GAAG,IAAI,SAAS,EAChB;QACE,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,EACD,YAAY,CACb,CAAC;IAEF,0CAA0C;IAC1C,IAAI,GAAG,CAAC,EAAE,CAAC,gBAAgB,CACzB,GAAG,IAAI,oBAAoB,EAC3B;QACE,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,uBAAuB,EAAE;YACvB,MAAM,EAAE,SAAS;SAClB;KACF,EACD,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,CACzC,CAAC;IAEF,kCAAkC;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAC9B,GAAG,IAAI,cAAc,EACrB;QACE,IAAI,EAAE,iBAAiB,IAAI,EAAE;QAC7B,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,EACD,YAAY,CACb,CAAC;IAEF,kCAAkC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAClC,GAAG,IAAI,gBAAgB,EACvB;QACE,IAAI,EAAE,iBAAiB,IAAI,EAAE;QAC7B,WAAW,EAAE,mCAAmC,UAAU,EAAE;QAC5D,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CACrD,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,iBAAiB,CAAC;oBAC3D,QAAQ,EAAE,GAAG,SAAS,IAAI;iBAC3B;gBACD;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,CAAC,eAAe,CAAC;oBACzB,QAAQ,EAAE,SAAS;iBACpB;aACF;SACF,CAAC,CACH;QACD,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,EACD,YAAY,CACb,CAAC;IAEF,wBAAwB;IACxB,IAAI,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAC9B,GAAG,IAAI,2BAA2B,EAClC;QACE,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,SAAS,CAAC,GAAG;KACzB,EACD,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CACrD,CAAC;IAEF,iBAAiB;IACjB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CACrC,GAAG,IAAI,oBAAoB,EAC3B;QACE,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,EACD,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAC1C,CAAC;IAEF,qCAAqC;IACrC,IAAI,iBAAoD,CAAC;IAEzD,IAAI,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;QAChC,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC;QAEtD,2CAA2C;QAC3C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,mBAAmB,EAAE;YACnE,MAAM,EAAE,aAA2B;SACpC,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,GAAG,UAAU,UAAU,CAAC;QAClD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,CAC7C,GAAG,IAAI,iBAAiB,EACxB;YACE,MAAM,EAAE,iBAAiB;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,EACD,EAAE,QAAQ,EAAE,eAAe,EAAE,CAC9B,CAAC;QAEF,0DAA0D;QAC1D,IAAI,GAAG,CAAC,EAAE,CAAC,gBAAgB,CACzB,GAAG,IAAI,4BAA4B,EACnC;YACE,MAAM,EAAE,qBAAqB,CAAC,MAAM;YACpC,uBAAuB,EAAE;gBACvB,MAAM,EAAE,SAAS;aAClB;SACF,EACD,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAClE,CAAC;QAEF,2BAA2B;QAC3B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CACtC,GAAG,IAAI,mBAAmB,EAC1B;YACE,IAAI,EAAE,sBAAsB,IAAI,EAAE;YAClC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC/B,OAAO,EAAE,YAAY;gBACrB,SAAS,EAAE;oBACT;wBACE,MAAM,EAAE,OAAO;wBACf,SAAS,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE;wBAC1C,MAAM,EAAE,gBAAgB;qBACzB;iBACF;aACF,CAAC;YACF,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,EACD,YAAY,CACb,CAAC;QAEF,0BAA0B;QAC1B,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAC9C,GAAG,IAAI,qBAAqB,EAC5B;YACE,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CACrF,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,YAAY;gBACrB,SAAS,EAAE;oBACT;wBACE,MAAM,EAAE,OAAO;wBACf,MAAM,EAAE,CAAC,gCAAgC,EAAE,eAAe,CAAC;wBAC3D,QAAQ,EAAE,MAAM;qBACjB;oBACD;wBACE,MAAM,EAAE,OAAO;wBACf,MAAM,EAAE;4BACN,mCAAmC;4BACnC,wBAAwB;4BACxB,4BAA4B;yBAC7B;wBACD,QAAQ,EAAE,GAAG,MAAM,IAAI;qBACxB;oBACD;wBACE,MAAM,EAAE,OAAO;wBACf,MAAM,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,kBAAkB,CAAC;wBACxE,QAAQ,EAAE,GAAG,MAAM,IAAI;qBACxB;iBACF;aACF,CAAC,CACH;SACF,EACD,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC,eAAe,CAAC,EAAE,CAClD,CAAC;QAEF,mCAAmC;QACnC,IAAI,GAAG,CAAC,EAAE,CAAC,uBAAuB,CAChC,GAAG,IAAI,qBAAqB,EAC5B;YACE,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,eAAe,CAAC,GAAG;YACzB,KAAK,EAAE;gBACL;oBACE,EAAE,EAAE,GAAG,IAAI,gBAAgB;oBAC3B,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE;wBACX,MAAM,EAAE,qBAAqB,CAAC,GAAG;wBACjC,YAAY,EAAE,UAAU;qBACzB;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,EAAE;qBACX;oBACD,uBAAuB,EAAE;wBACvB,MAAM,EAAE,SAAS;qBAClB;iBACF;aACF;SACF,EACD,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,iBAAiB,CAAC,EAAE,CACnF,CAAC;QAEF,iBAAiB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACnD,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE;YACX,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,eAAe,EAAE,SAAS,CAAC,MAAM;SAClC;QACD,iBAAiB;QACjB,cAAc,EAAE,MAAM;KACvB,CAAC;AACJ,CAAC"}

package/dist/cjs/backup/interfaces.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Backup target interfaces for @reyemtech/nimbus.
+ * @module backup/interfaces
+ */
+import type * as pulumi from "@pulumi/pulumi";
+export interface IBackupReplicationConfig {
+    readonly enabled: boolean;
+    readonly targetRegion: string;
+}
+export interface IBackupTargetConfig {
+    readonly cloud: "aws";
+    readonly region: string;
+    readonly bucketPrefix?: string;
+    readonly replication?: IBackupReplicationConfig;
+    readonly tags?: Record<string, string>;
+    readonly awsProvider?: pulumi.ProviderResource;
+}
+export interface IBackupTarget {
+    readonly name: string;
+    readonly bucket: pulumi.Output<string>;
+    readonly region: string;
+    readonly credentials: {
+        readonly accessKeyId: pulumi.Output<string>;
+        readonly secretAccessKey: pulumi.Output<string>;
+    };
+    readonly replicationBucket?: pulumi.Output<string>;
+    readonly nativeResource: pulumi.Resource;
+}
+//# sourceMappingURL=interfaces.d.ts.map

package/dist/cjs/backup/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../../src/backup/interfaces.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAE9C,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;CAChD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KACjD,CAAC;IACF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC1C"}

package/dist/cjs/backup/interfaces.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=interfaces.js.map

package/dist/cjs/backup/interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../../src/backup/interfaces.ts"],"names":[],"mappings":""}

package/dist/cjs/cache/cache.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Cache implementation — deploys Bitnami Redis via Helm.
+ *
+ * Supports standalone and replication (Sentinel) architectures.
+ * Authentication is always enabled; Bitnami creates a `{releaseName}-redis`
+ * secret with a `redis-password` key.
+ *
+ * @module cache/cache
+ */
+import * as k8s from "@pulumi/kubernetes";
+import { type StorageTierMap } from "../types/storage-tiers";
+import type { ICacheConfig, ICache } from "./interfaces";
+/**
+ * Deploy a Redis cache using the Bitnami Redis Helm chart.
+ *
+ * Defaults to `replication` architecture with Sentinel for HA.
+ * Use `standalone` for single-node dev/test deployments.
+ *
+ * @example
+ * ```typescript
+ * const cache = createCache("session", {
+ *   cloud: "aws",
+ *   engine: "redis",
+ *   mode: "helm",
+ *   architecture: "replication",
+ *   replicas: 2,
+ *   storageGb: 5,
+ *   metrics: true,
+ * }, provider);
+ * ```
+ *
+ * @param name - Logical name for the cache resource (used as Helm release name prefix)
+ * @param config - Cache configuration
+ * @param provider - Kubernetes provider to deploy into
+ * @returns Deployed cache resource
+ */
+export declare function createCache(name: string, config: ICacheConfig, provider: k8s.Provider, storageTiers?: StorageTierMap): ICache;
+//# sourceMappingURL=cache.d.ts.map

package/dist/cjs/cache/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../src/cache/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAK1C,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAEjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAezD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ,EACtB,YAAY,CAAC,EAAE,cAAc,GAC5B,MAAM,CAgIR"}