@reyemtech/nimbus 1.3.0 → 2.0.2

package/dist/esm/argocd/index.js

@@ -0,0 +1,27 @@
+"use strict";
+/**
+ * ArgoCD module — fluent API for managing ArgoCD Applications.
+ *
+ * @module argocd
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createExternalSecrets = exports.createAppSecrets = exports.ArgoApp = exports.ArgoProject = exports.ArgoCD = void 0;
+exports.createArgoCD = createArgoCD;
+const argocd_1 = require("./argocd");
+var argocd_2 = require("./argocd");
+Object.defineProperty(exports, "ArgoCD", { enumerable: true, get: function () { return argocd_2.ArgoCD; } });
+var project_1 = require("./project");
+Object.defineProperty(exports, "ArgoProject", { enumerable: true, get: function () { return project_1.ArgoProject; } });
+var app_1 = require("./app");
+Object.defineProperty(exports, "ArgoApp", { enumerable: true, get: function () { return app_1.ArgoApp; } });
+var secrets_1 = require("./secrets");
+Object.defineProperty(exports, "createAppSecrets", { enumerable: true, get: function () { return secrets_1.createAppSecrets; } });
+var external_secrets_1 = require("./external-secrets");
+Object.defineProperty(exports, "createExternalSecrets", { enumerable: true, get: function () { return external_secrets_1.createExternalSecrets; } });
+/**
+ * Create an ArgoCD management instance.
+ */
+function createArgoCD(name, config) {
+    return new argocd_1.ArgoCD(name, config);
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/argocd/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/argocd/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAqCH,oCAEC;AApCD,qCAAkC;AAElC,mCAAkC;AAAzB,gGAAA,MAAM,OAAA;AACf,qCAAwC;AAA/B,sGAAA,WAAW,OAAA;AACpB,6BAAgC;AAAvB,8FAAA,OAAO,OAAA;AAChB,qCAA6C;AAApC,2GAAA,gBAAgB,OAAA;AACzB,uDAA2D;AAAlD,yHAAA,qBAAqB,OAAA;AAyB9B;;GAEG;AACH,SAAgB,YAAY,CAAC,IAAY,EAAE,MAAqB;IAC9D,OAAO,IAAI,eAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAClC,CAAC"}

package/dist/esm/argocd/interfaces.d.ts

@@ -0,0 +1,144 @@
+/**
+ * ArgoCD module interfaces for @reyemtech/nimbus.
+ *
+ * @module argocd/interfaces
+ */
+import type * as pulumi from "@pulumi/pulumi";
+import type * as k8s from "@pulumi/kubernetes";
+import type { ICluster } from "../cluster";
+/** Repository credential types. */
+export type ArgoRepoType = "git" | "helm" | "oci";
+/** Git repo via SSH. */
+export interface IArgoGitSshRepoConfig {
+    readonly type: "git";
+    readonly url: string;
+    readonly sshPrivateKey: pulumi.Input<string>;
+}
+/** Git repo via HTTPS. */
+export interface IArgoGitHttpsRepoConfig {
+    readonly type: "git";
+    readonly url: string;
+    readonly username: pulumi.Input<string>;
+    readonly password: pulumi.Input<string>;
+}
+/** Helm repo with optional auth. */
+export interface IArgoHelmRepoConfig {
+    readonly type: "helm";
+    readonly url: string;
+    readonly username?: pulumi.Input<string>;
+    readonly password?: pulumi.Input<string>;
+}
+/** OCI registry with auth. */
+export interface IArgoOciRepoConfig {
+    readonly type: "oci";
+    readonly url: string;
+    readonly username: pulumi.Input<string>;
+    readonly password: pulumi.Input<string>;
+}
+export type IArgoRepoConfig = IArgoGitSshRepoConfig | IArgoGitHttpsRepoConfig | IArgoHelmRepoConfig | IArgoOciRepoConfig;
+/** Source using a registered repo — type inferred from repo. */
+export interface IArgoRepoSource {
+    readonly repo: IArgoRepoRef;
+    readonly chart?: string;
+    readonly path?: string;
+    readonly version?: string;
+    readonly revision?: string;
+    readonly values?: Record<string, unknown>;
+    readonly releaseName?: string;
+}
+/** Source using a public repo URL — no addRepo() needed. */
+export interface IArgoPublicSource {
+    readonly repoURL: string;
+    readonly chart?: string;
+    readonly path?: string;
+    readonly version?: string;
+    readonly revision?: string;
+    readonly values?: Record<string, unknown>;
+    readonly releaseName?: string;
+}
+/** Inline App-of-Apps children. */
+export interface IArgoChildrenSource {
+    readonly children: ReadonlyArray<{
+        readonly name: string;
+        readonly source: IArgoAppSource;
+        readonly namespace: string;
+        readonly syncPolicy?: IArgoSyncPolicy;
+    }>;
+}
+export type IArgoAppSource = IArgoRepoSource | IArgoPublicSource | IArgoChildrenSource;
+export interface IArgoSyncPolicy {
+    readonly automated?: boolean;
+    readonly selfHeal?: boolean;
+    readonly prune?: boolean;
+    readonly syncOptions?: ReadonlyArray<string>;
+}
+export interface IArgoProjectConfig {
+    readonly description?: string;
+    readonly allowedNamespaces?: ReadonlyArray<string>;
+    readonly sourceRepos?: ReadonlyArray<string>;
+    readonly destinations?: ReadonlyArray<{
+        readonly server: string;
+        readonly namespace: string;
+    }>;
+    readonly clusterResourceBlacklist?: ReadonlyArray<{
+        readonly group: string;
+        readonly kind: string;
+    }>;
+}
+export interface IArgoAppConfig {
+    readonly project?: string;
+    readonly source: IArgoAppSource;
+    readonly namespace: string;
+    readonly syncPolicy?: IArgoSyncPolicy;
+    readonly dashboard?: boolean;
+    readonly notifications?: {
+        readonly onSyncSucceeded?: boolean;
+        readonly onSyncFailed?: boolean;
+        readonly onHealthDegraded?: boolean;
+    };
+}
+export interface IArgoSecretField {
+    readonly random?: number;
+    readonly value?: pulumi.Input<string>;
+}
+export type IArgoSecretsConfig = Record<string, IArgoSecretField>;
+export interface IArgoAppSecrets {
+    readonly name: string;
+    ref(key: string): {
+        secretKeyRef: {
+            name: string;
+            key: string;
+        };
+    };
+}
+/** Individual secret key mapping: Vault path + property → K8s Secret key. */
+export interface IExternalSecretDataRef {
+    readonly key: string;
+    readonly property?: string;
+}
+/** Bulk pull: all keys from a Vault path. */
+export interface IExternalSecretDataFromRef {
+    readonly key: string;
+}
+/** ExternalSecret configuration. */
+export interface IExternalSecretsConfig {
+    /** Individual key mappings (K8s Secret key → Vault remoteRef). */
+    readonly data?: Record<string, IExternalSecretDataRef>;
+    /** Bulk pull all keys from Vault paths. */
+    readonly dataFrom?: ReadonlyArray<IExternalSecretDataFromRef>;
+    /** ClusterSecretStore name. Default: "vault-backend". */
+    readonly store?: string;
+    /** Refresh interval. Default: "1h". */
+    readonly refreshInterval?: string;
+}
+/** Reference to a registered repo — carries type + URL for source inference. */
+export interface IArgoRepoRef {
+    readonly name: string;
+    readonly type: ArgoRepoType;
+    readonly url: string;
+}
+export interface IArgoCDConfig {
+    readonly cluster: ICluster;
+    readonly helmRelease: k8s.helm.v3.Release;
+}
+//# sourceMappingURL=interfaces.d.ts.map

package/dist/esm/argocd/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../../src/argocd/interfaces.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAM3C,mCAAmC;AACnC,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;AAElD,wBAAwB;AACxB,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED,0BAA0B;AAC1B,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CACzC;AAED,oCAAoC;AACpC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CAC1C;AAED,8BAA8B;AAC9B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CACzC;AAED,MAAM,MAAM,eAAe,GACvB,qBAAqB,GACrB,uBAAuB,GACvB,mBAAmB,GACnB,kBAAkB,CAAC;AAMvB,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;KACvC,CAAC,CAAC;CACJ;AAED,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;AAMvF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAMD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;QACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC,CAAC;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,aAAa,CAAC;QAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;CACJ;AAMD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAChC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;KACrC,CAAC;CACH;AAMD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAElE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,YAAY,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CACnE;AAMD,6EAA6E;AAC7E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,6CAA6C;AAC7C,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,oCAAoC;AACpC,MAAM,WAAW,sBAAsB;IACrC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACvD,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,0BAA0B,CAAC,CAAC;IAC9D,yDAAyD;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,uCAAuC;IACvC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAMD,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;CAC3C"}

package/dist/esm/argocd/interfaces.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * ArgoCD module interfaces for @reyemtech/nimbus.
+ *
+ * @module argocd/interfaces
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=interfaces.js.map

package/dist/esm/argocd/interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../../src/argocd/interfaces.ts"],"names":[],"mappings":";AAAA;;;;GAIG"}

package/dist/esm/argocd/project.d.ts

@@ -0,0 +1,23 @@
+/**
+ * ArgoCD AppProject management.
+ *
+ * @module argocd/project
+ */
+import * as k8s from "@pulumi/kubernetes";
+import type * as pulumi from "@pulumi/pulumi";
+import type { IArgoProjectConfig, IArgoAppConfig } from "./interfaces";
+import type { ArgoApp } from "./app";
+export declare class ArgoProject {
+    readonly name: string;
+    readonly resource: k8s.apiextensions.CustomResource;
+    private readonly appRegistry;
+    private readonly createAppFn;
+    constructor(resourceName: string, name: string, config: IArgoProjectConfig, provider: k8s.Provider, dependsOn: pulumi.Resource[], createAppFn: (name: string, config: IArgoAppConfig, project: ArgoProject) => ArgoApp);
+    /** Create an app in this project. */
+    createApp(name: string, config: IArgoAppConfig): ArgoApp;
+    /** Look up an existing app in this project. */
+    app(name: string): ArgoApp;
+    /** All apps in this project. */
+    apps(): ReadonlyArray<ArgoApp>;
+}
+//# sourceMappingURL=project.d.ts.map

package/dist/esm/argocd/project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../../src/argocd/project.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,qBAAa,WAAW;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,cAAc,CAAC;IACpD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8B;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAIf;gBAGX,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,kBAAkB,EAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,EACtB,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,EAC5B,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO;IAiCtF,qCAAqC;IACrC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO;IAOxD,+CAA+C;IAC/C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAQ1B,gCAAgC;IAChC,IAAI,IAAI,aAAa,CAAC,OAAO,CAAC;CAG/B"}

package/dist/esm/argocd/project.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * ArgoCD AppProject management.
+ *
+ * @module argocd/project
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArgoProject = void 0;
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const ARGOCD_NAMESPACE = "argocd";
+class ArgoProject {
+    name;
+    resource;
+    appRegistry = new Map();
+    createAppFn;
+    constructor(resourceName, name, config, provider, dependsOn, createAppFn) {
+        this.name = name;
+        this.createAppFn = createAppFn;
+        // Build project spec
+        const destinations = config.destinations ?? [
+            { server: "https://kubernetes.default.svc", namespace: "*" },
+        ];
+        const sourceRepos = config.sourceRepos ?? ["*"];
+        const spec = {
+            description: config.description ?? "",
+            sourceRepos,
+            destinations,
+        };
+        if (config.clusterResourceBlacklist) {
+            spec["clusterResourceBlacklist"] = config.clusterResourceBlacklist;
+        }
+        this.resource = new k8s.apiextensions.CustomResource(`${resourceName}-project-${name}`, {
+            apiVersion: "argoproj.io/v1alpha1",
+            kind: "AppProject",
+            metadata: { name, namespace: ARGOCD_NAMESPACE },
+            spec,
+        }, { provider, dependsOn });
+    }
+    /** Create an app in this project. */
+    createApp(name, config) {
+        const appConfig = { ...config, project: this.name };
+        const app = this.createAppFn(name, appConfig, this);
+        this.appRegistry.set(name, app);
+        return app;
+    }
+    /** Look up an existing app in this project. */
+    app(name) {
+        const app = this.appRegistry.get(name);
+        if (!app) {
+            throw new Error(`App "${name}" not found in project "${this.name}"`);
+        }
+        return app;
+    }
+    /** All apps in this project. */
+    apps() {
+        return [...this.appRegistry.values()];
+    }
+}
+exports.ArgoProject = ArgoProject;
+//# sourceMappingURL=project.js.map

package/dist/esm/argocd/project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../../../src/argocd/project.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,wDAA0C;AAK1C,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC,MAAa,WAAW;IACb,IAAI,CAAS;IACb,QAAQ,CAAmC;IACnC,WAAW,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,WAAW,CAIf;IAEb,YACE,YAAoB,EACpB,IAAY,EACZ,MAA0B,EAC1B,QAAsB,EACtB,SAA4B,EAC5B,WAAoF;QAEpF,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAE/B,qBAAqB;QACrB,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI;YAC1C,EAAE,MAAM,EAAE,gCAAgC,EAAE,SAAS,EAAE,GAAG,EAAE;SAC7D,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhD,MAAM,IAAI,GAA4B;YACpC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;YACrC,WAAW;YACX,YAAY;SACb,CAAC;QAEF,IAAI,MAAM,CAAC,wBAAwB,EAAE,CAAC;YACpC,IAAI,CAAC,0BAA0B,CAAC,GAAG,MAAM,CAAC,wBAAwB,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,cAAc,CAClD,GAAG,YAAY,YAAY,IAAI,EAAE,EACjC;YACE,UAAU,EAAE,sBAAsB;YAClC,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE;YAC/C,IAAI;SACL,EACD,EAAE,QAAQ,EAAE,SAAS,EAAE,CACxB,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,SAAS,CAAC,IAAY,EAAE,MAAsB;QAC5C,MAAM,SAAS,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,+CAA+C;IAC/C,GAAG,CAAC,IAAY;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,2BAA2B,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gCAAgC;IAChC,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC;CACF;AAtED,kCAsEC"}

package/dist/esm/argocd/repo.d.ts

@@ -0,0 +1,15 @@
+/**
+ * ArgoCD repository credential management.
+ *
+ * Creates K8s Secrets with argocd.argoproj.io/secret-type: repository label.
+ *
+ * @module argocd/repo
+ */
+import * as k8s from "@pulumi/kubernetes";
+import type * as pulumi from "@pulumi/pulumi";
+import type { IArgoRepoConfig, IArgoRepoRef } from "./interfaces";
+/**
+ * Create an ArgoCD repository credential secret.
+ */
+export declare function createArgoRepo(resourceName: string, name: string, config: IArgoRepoConfig, provider: k8s.Provider, dependsOn?: pulumi.Resource[]): IArgoRepoRef;
+//# sourceMappingURL=repo.d.ts.map

package/dist/esm/argocd/repo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../../src/argocd/repo.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAIlE;;GAEG;AACH,wBAAgB,cAAc,CAC5B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,GAAG,CAAC,QAAQ,EACtB,SAAS,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,GAC5B,YAAY,CAyCd"}

package/dist/esm/argocd/repo.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * ArgoCD repository credential management.
+ *
+ * Creates K8s Secrets with argocd.argoproj.io/secret-type: repository label.
+ *
+ * @module argocd/repo
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createArgoRepo = createArgoRepo;
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const ARGOCD_NAMESPACE = "argocd";
+/**
+ * Create an ArgoCD repository credential secret.
+ */
+function createArgoRepo(resourceName, name, config, provider, dependsOn) {
+    const secretData = {
+        type: config.type === "oci" ? "helm" : config.type,
+        url: config.url,
+    };
+    if (config.type === "oci") {
+        secretData["enableOCI"] = "true";
+    }
+    if (config.type === "git" && "sshPrivateKey" in config) {
+        secretData["sshPrivateKey"] = config.sshPrivateKey;
+    }
+    else if ("username" in config && config.username) {
+        secretData["username"] = config.username;
+    }
+    if ("password" in config && config.password) {
+        secretData["password"] = config.password;
+    }
+    new k8s.core.v1.Secret(`${resourceName}-repo-${name}`, {
+        metadata: {
+            name: `argocd-repo-${name}`,
+            namespace: ARGOCD_NAMESPACE,
+            labels: {
+                "argocd.argoproj.io/secret-type": "repository",
+                "app.kubernetes.io/managed-by": "nimbus",
+            },
+        },
+        stringData: secretData,
+    }, { provider, dependsOn });
+    return {
+        name,
+        type: config.type,
+        url: config.url,
+    };
+}
+//# sourceMappingURL=repo.js.map

package/dist/esm/argocd/repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo.js","sourceRoot":"","sources":["../../../src/argocd/repo.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWH,wCA+CC;AAxDD,wDAA0C;AAI1C,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC;;GAEG;AACH,SAAgB,cAAc,CAC5B,YAAoB,EACpB,IAAY,EACZ,MAAuB,EACvB,QAAsB,EACtB,SAA6B;IAE7B,MAAM,UAAU,GAAyC;QACvD,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;QAClD,GAAG,EAAE,MAAM,CAAC,GAAG;KAChB,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,UAAU,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC;IACnC,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;QACvD,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC;IACrD,CAAC;SAAM,IAAI,UAAU,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnD,UAAU,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3C,CAAC;IAED,IAAI,UAAU,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC5C,UAAU,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3C,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CACpB,GAAG,YAAY,SAAS,IAAI,EAAE,EAC9B;QACE,QAAQ,EAAE;YACR,IAAI,EAAE,eAAe,IAAI,EAAE;YAC3B,SAAS,EAAE,gBAAgB;YAC3B,MAAM,EAAE;gBACN,gCAAgC,EAAE,YAAY;gBAC9C,8BAA8B,EAAE,QAAQ;aACzC;SACF;QACD,UAAU,EAAE,UAAU;KACvB,EACD,EAAE,QAAQ,EAAE,SAAS,EAAE,CACxB,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG;KAChB,CAAC;AACJ,CAAC"}

package/dist/esm/argocd/secrets.d.ts

@@ -0,0 +1,23 @@
+/**
+ * ArgoCD app secrets — generate K8s Secrets with typed references.
+ *
+ * Standalone utility + wrapper for ArgoApp.createSecrets().
+ *
+ * @module argocd/secrets
+ */
+import type { IArgoSecretsConfig, IArgoAppSecrets } from "./interfaces";
+import type { ICluster } from "../cluster";
+/**
+ * Create a K8s Secret with generated and/or explicit values.
+ *
+ * @param name - K8s Secret name
+ * @param config.namespace - K8s namespace
+ * @param config.cluster - Cluster for the provider
+ * @param config.secrets - Map of key → { random: N } or { value: Output }
+ */
+export declare function createAppSecrets(name: string, config: {
+    namespace: string;
+    cluster: ICluster;
+    secrets: IArgoSecretsConfig;
+}): IArgoAppSecrets;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/esm/argocd/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../src/argocd/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE;IACN,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,QAAQ,CAAC;IAClB,OAAO,EAAE,kBAAkB,CAAC;CAC7B,GACA,eAAe,CAwCjB"}

package/dist/esm/argocd/secrets.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * ArgoCD app secrets — generate K8s Secrets with typed references.
+ *
+ * Standalone utility + wrapper for ArgoApp.createSecrets().
+ *
+ * @module argocd/secrets
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAppSecrets = createAppSecrets;
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const random = __importStar(require("@pulumi/random"));
+/**
+ * Create a K8s Secret with generated and/or explicit values.
+ *
+ * @param name - K8s Secret name
+ * @param config.namespace - K8s namespace
+ * @param config.cluster - Cluster for the provider
+ * @param config.secrets - Map of key → { random: N } or { value: Output }
+ */
+function createAppSecrets(name, config) {
+    const provider = config.cluster.provider;
+    const secretData = {};
+    for (const [key, field] of Object.entries(config.secrets)) {
+        if (field.random) {
+            const pw = new random.RandomPassword(`${name}-${key}`, {
+                length: field.random,
+                special: false,
+            });
+            secretData[key] = pw.result;
+        }
+        else if (field.value !== undefined) {
+            secretData[key] = field.value;
+        }
+    }
+    new k8s.core.v1.Secret(`argocd-secret-${name}`, {
+        metadata: {
+            name,
+            namespace: config.namespace,
+            labels: { "app.kubernetes.io/managed-by": "nimbus" },
+        },
+        stringData: secretData,
+    }, { provider });
+    return {
+        name,
+        ref(key) {
+            if (!(key in config.secrets)) {
+                throw new Error(`Secret key "${key}" not found in "${name}". Available: ${Object.keys(config.secrets).join(", ")}`);
+            }
+            return { secretKeyRef: { name, key } };
+        },
+    };
+}
+//# sourceMappingURL=secrets.js.map

package/dist/esm/argocd/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/argocd/secrets.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBH,4CA+CC;AA7DD,wDAA0C;AAE1C,uDAAyC;AAIzC;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAC9B,IAAY,EACZ,MAIC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzC,MAAM,UAAU,GAAyC,EAAE,CAAC;IAE5D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE;gBACrD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;QAC9B,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrC,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;QAChC,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CACpB,iBAAiB,IAAI,EAAE,EACvB;QACE,QAAQ,EAAE;YACR,IAAI;YACJ,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,EAAE,8BAA8B,EAAE,QAAQ,EAAE;SACrD;QACD,UAAU,EAAE,UAAU;KACvB,EACD,EAAE,QAAQ,EAAE,CACb,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,GAAG,CAAC,GAAW;YACb,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,mBAAmB,IAAI,iBAAiB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnG,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/backup/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Backup target module — S3-backed backup destinations with IAM credentials
+ * and optional cross-region replication.
+ *
+ * @module backup
+ */
+import type { IBackupTarget, IBackupTargetConfig } from "./interfaces";
+export type { IBackupReplicationConfig, IBackupTargetConfig, IBackupTarget } from "./interfaces";
+/**
+ * Create an S3-backed backup target with IAM credentials.
+ *
+ * Provisions an S3 bucket with versioning, an IAM user scoped to that bucket,
+ * and optionally a replica bucket in another region for cross-region replication.
+ *
+ * @param name - Logical name prefix for all created resources
+ * @param config - Backup target configuration
+ * @returns IBackupTarget with bucket name, credentials, and optional replica bucket
+ */
+export declare function createBackupTarget(name: string, config: IBackupTargetConfig): IBackupTarget;
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/backup/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backup/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEvE,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEjG;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,aAAa,CAsN3F"}