AdaptiveWorX iac-core

Open-source Pulumi infrastructure libraries for multi-cloud infrastructure-as-code, written in TypeScript.

This is a publish-focused Nx monorepo that produces the @adaptiveworx/iac-* family of npm packages. Every directory under packages/ is a separately-versioned npm artifact, released independently via Nx Release from conventional commits.

Packages

Package	Purpose
@adaptiveworx/iac-core	Cross-cloud primitives: organization config, secret management, region utils, CIDR allocation, validation, schemas
@adaptiveworx/iac-schemas	Zod-derived JSON schemas for configuration contracts
@adaptiveworx/iac-policies	Pulumi policy packs for security, compliance, cost
@adaptiveworx/iac-aws	AWS Pulumi components: VPC, IAM, OIDC
@adaptiveworx/iac-azure	Azure Pulumi components (Fabric, OneLake, secure storage, networking)

Status (2026-04): iac-aws is restructured and tests passing. iac-core, iac-schemas, iac-policies migration from iac-worx is in progress. iac-azure is an empty skeleton. See docs/migration-plan.md for sequencing.

Install (consumers)

# AWS-only
pnpm add @adaptiveworx/iac-core @adaptiveworx/iac-aws \
  @pulumi/aws @pulumi/pulumi

# Azure-only
pnpm add @adaptiveworx/iac-core @adaptiveworx/iac-schemas \
  @pulumi/azure-native @pulumi/pulumi

@pulumi/* SDKs are peer dependencies — bring your own version. Node 26+ required.

Quickstart (AWS)

import { SharedVpc, GitHubActionsOIDC } from "@adaptiveworx/iac-aws";

const vpc = new SharedVpc("dev-use1", {
  environment: "dev",
  region: "us-east-1",
  accountId: "123456789012",
  orgPrefix: "worx",
  vpcCidr: "10.10.0.0/16",
  availabilityZones: ["us-east-1a", "us-east-1b", "us-east-1c"],
  natGatewayCount: 3,
  enableIpv6: true,
  subnetTiers: [
    { name: "public",  role: "load-balancers", routeToInternet: true,  shareWith: [],              ipv6Slot: 0 },
    { name: "private", role: "app-services",   routeToInternet: false, shareWith: ["worx-app-dev"], ipv6Slot: 1 },
    { name: "data",    role: "data-stores",    routeToInternet: false, shareWith: ["worx-app-dev"], ipv6Slot: 2 },
  ],
  flowLogs: { enabled: true, trafficType: "ALL" },
  sharedAccounts: { "111111111111": "worx-app-dev" },
  tags: {},
});

const oidc = new GitHubActionsOIDC("github-actions", {
  awsRegion: "us-east-1",
  githubOrg: "AdaptiveWorX",
  environments: [
    {
      name: "prod",
      accountId: "436083577402",
      roleName: "worx-prod-github-actions-deploy",
      policyArn: "arn:aws:iam::aws:policy/PowerUserAccess",
    },
  ],
});

See each package's README for full options.

Development (contributors)

# One-time
pnpm install

# Common tasks
pnpm build              # Build every package
pnpm test               # Run vitest across every package
pnpm lint               # Biome check across every package
pnpm typecheck          # tsc --noEmit across every package
pnpm graph              # Open Nx project graph in browser

# Affected (uses Nx graph; only what changed)
pnpm build:affected
pnpm test:affected
pnpm lint:affected

# Single package
pnpm nx build @adaptiveworx/iac-aws
pnpm nx test @adaptiveworx/iac-aws

# Format
pnpm format             # Write
pnpm format:check       # Check only

Tooling

• Node 26 (.nvmrc) and a pnpm 12 workspace (settings in pnpm-workspace.yaml: a strict 3-day minimumReleaseAge, an explicit allowBuilds map)
• Nx 23 for build orchestration, caching, affected graph, releases
• TypeScript 6 builds the packages, with @tsconfig/strictest, until Nx supports TypeScript 7 (Nx 23 reads tsconfigs through the TypeScript JS API, which 7 dropped). Consumers may use TypeScript 6 or 7: the typescript peer is ^6.0.0 || ^7.0.0, and tools/ts7-consumer (part of every typecheck run) type-checks each package's emitted .d.ts with TypeScript 7.0.2, skipLibCheck off
• Vitest 5 for unit + integration tests
• Biome 2 for lint + format; Renovate for dependency updates

Architecture & docs

• docs/architecture.md — producer/consumer model, package boundaries, dependency graph, release model, tooling
• docs/migration-plan.md — transient plan for the iac-worx → iac-core package migration (delete on completion)
• docs/compliance-framework.md
• docs/security-implementation.md
• docs/testing-strategy.md
• CONTRIBUTING.md — how to contribute, conventional commits, release process

Versioning

Each package ships independent semver. Nx Release reads conventional commits to bump versions, generate changelogs, tag, and publish. See CONTRIBUTING.md#releases for the end-to-end flow.

License

Apache 2.0 © 2023-2026 Adaptive Intelligence, LLC. See LICENSE.

Each package also ships its own LICENSE and NOTICE files for distribution clarity.