@beesolve/aws-accounts 1.0.0

package/dist-lambda/handler.mjs

@@ -0,0 +1,3558 @@
+// src/lambda/handler.ts
+import {
+  GetObjectCommand,
+  PutObjectCommand,
+  S3Client,
+  S3ServiceException
+} from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { OrganizationsClient as OrganizationsClient3 } from "@aws-sdk/client-organizations";
+import { SSOAdminClient as SSOAdminClient3 } from "@aws-sdk/client-sso-admin";
+import { IdentitystoreClient as IdentitystoreClient3 } from "@aws-sdk/client-identitystore";
+import { AccountClient as AccountClient2 } from "@aws-sdk/client-account";
+
+// node_modules/valibot/dist/index.mjs
+var store$4;
+var DEFAULT_CONFIG = {
+  lang: void 0,
+  message: void 0,
+  abortEarly: void 0,
+  abortPipeEarly: void 0
+};
+// @__NO_SIDE_EFFECTS__
+function getGlobalConfig(config$1) {
+  if (!config$1 && !store$4) return DEFAULT_CONFIG;
+  return {
+    lang: config$1?.lang ?? store$4?.lang,
+    message: config$1?.message,
+    abortEarly: config$1?.abortEarly ?? store$4?.abortEarly,
+    abortPipeEarly: config$1?.abortPipeEarly ?? store$4?.abortPipeEarly
+  };
+}
+var store$3;
+// @__NO_SIDE_EFFECTS__
+function getGlobalMessage(lang) {
+  return store$3?.get(lang);
+}
+var store$2;
+// @__NO_SIDE_EFFECTS__
+function getSchemaMessage(lang) {
+  return store$2?.get(lang);
+}
+var store$1;
+// @__NO_SIDE_EFFECTS__
+function getSpecificMessage(reference, lang) {
+  return store$1?.get(reference)?.get(lang);
+}
+// @__NO_SIDE_EFFECTS__
+function _stringify(input) {
+  const type = typeof input;
+  if (type === "string") return `"${input}"`;
+  if (type === "number" || type === "bigint" || type === "boolean") return `${input}`;
+  if (type === "object" || type === "function") return (input && Object.getPrototypeOf(input)?.constructor?.name) ?? "null";
+  return type;
+}
+function _addIssue(context, label, dataset, config$1, other) {
+  const input = other && "input" in other ? other.input : dataset.value;
+  const expected = other?.expected ?? context.expects ?? null;
+  const received = other?.received ?? /* @__PURE__ */ _stringify(input);
+  const issue = {
+    kind: context.kind,
+    type: context.type,
+    input,
+    expected,
+    received,
+    message: `Invalid ${label}: ${expected ? `Expected ${expected} but r` : "R"}eceived ${received}`,
+    requirement: context.requirement,
+    path: other?.path,
+    issues: other?.issues,
+    lang: config$1.lang,
+    abortEarly: config$1.abortEarly,
+    abortPipeEarly: config$1.abortPipeEarly
+  };
+  const isSchema = context.kind === "schema";
+  const message$1 = other?.message ?? context.message ?? /* @__PURE__ */ getSpecificMessage(context.reference, issue.lang) ?? (isSchema ? /* @__PURE__ */ getSchemaMessage(issue.lang) : null) ?? config$1.message ?? /* @__PURE__ */ getGlobalMessage(issue.lang);
+  if (message$1 !== void 0) issue.message = typeof message$1 === "function" ? message$1(issue) : message$1;
+  if (isSchema) dataset.typed = false;
+  if (dataset.issues) dataset.issues.push(issue);
+  else dataset.issues = [issue];
+}
+var _standardCache = /* @__PURE__ */ new WeakMap();
+// @__NO_SIDE_EFFECTS__
+function _getStandardProps(context) {
+  let cached = _standardCache.get(context);
+  if (!cached) {
+    cached = {
+      version: 1,
+      vendor: "valibot",
+      validate(value$1) {
+        return context["~run"]({ value: value$1 }, /* @__PURE__ */ getGlobalConfig());
+      }
+    };
+    _standardCache.set(context, cached);
+  }
+  return cached;
+}
+// @__NO_SIDE_EFFECTS__
+function _isValidObjectKey(object$1, key) {
+  return Object.prototype.hasOwnProperty.call(object$1, key) && key !== "__proto__" && key !== "prototype" && key !== "constructor";
+}
+// @__NO_SIDE_EFFECTS__
+function _joinExpects(values$1, separator) {
+  const list = [...new Set(values$1)];
+  if (list.length > 1) return `(${list.join(` ${separator} `)})`;
+  return list[0] ?? "never";
+}
+var ValiError = class extends Error {
+  /**
+  * Creates a Valibot error with useful information.
+  *
+  * @param issues The error issues.
+  */
+  constructor(issues) {
+    super(issues[0].message);
+    this.name = "ValiError";
+    this.issues = issues;
+  }
+};
+var EMOJI_REGEX = new RegExp("^(?:[\\u{1F1E6}-\\u{1F1FF}]{2}|\\u{1F3F4}[\\u{E0061}-\\u{E007A}]{2}[\\u{E0030}-\\u{E0039}\\u{E0061}-\\u{E007A}]{1,3}\\u{E007F}|(?:\\p{Emoji}\\uFE0F\\u20E3?|\\p{Emoji_Modifier_Base}\\p{Emoji_Modifier}?|(?![\\p{Emoji_Modifier_Base}\\u{1F1E6}-\\u{1F1FF}])\\p{Emoji_Presentation})(?:\\u200D(?:\\p{Emoji}\\uFE0F\\u20E3?|\\p{Emoji_Modifier_Base}\\p{Emoji_Modifier}?|(?![\\p{Emoji_Modifier_Base}\\u{1F1E6}-\\u{1F1FF}])\\p{Emoji_Presentation}))*)+$", "u");
+// @__NO_SIDE_EFFECTS__
+function minLength(requirement, message$1) {
+  return {
+    kind: "validation",
+    type: "min_length",
+    reference: minLength,
+    async: false,
+    expects: `>=${requirement}`,
+    requirement,
+    message: message$1,
+    "~run"(dataset, config$1) {
+      if (dataset.typed && dataset.value.length < this.requirement) _addIssue(this, "length", dataset, config$1, { received: `${dataset.value.length}` });
+      return dataset;
+    }
+  };
+}
+var ABORT_EARLY_CONFIG = { abortEarly: true };
+// @__NO_SIDE_EFFECTS__
+function getFallback(schema, dataset, config$1) {
+  return typeof schema.fallback === "function" ? schema.fallback(dataset, config$1) : schema.fallback;
+}
+// @__NO_SIDE_EFFECTS__
+function getDefault(schema, dataset, config$1) {
+  return typeof schema.default === "function" ? schema.default(dataset, config$1) : schema.default;
+}
+// @__NO_SIDE_EFFECTS__
+function array(item, message$1) {
+  return {
+    kind: "schema",
+    type: "array",
+    reference: array,
+    expects: "Array",
+    async: false,
+    item,
+    message: message$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      const input = dataset.value;
+      if (Array.isArray(input)) {
+        dataset.typed = true;
+        dataset.value = [];
+        for (let key = 0; key < input.length; key++) {
+          const value$1 = input[key];
+          const itemDataset = this.item["~run"]({ value: value$1 }, config$1);
+          if (itemDataset.issues) {
+            const pathItem = {
+              type: "array",
+              origin: "value",
+              input,
+              key,
+              value: value$1
+            };
+            for (const issue of itemDataset.issues) {
+              if (issue.path) issue.path.unshift(pathItem);
+              else issue.path = [pathItem];
+              dataset.issues?.push(issue);
+            }
+            if (!dataset.issues) dataset.issues = itemDataset.issues;
+            if (config$1.abortEarly) {
+              dataset.typed = false;
+              break;
+            }
+          }
+          if (!itemDataset.typed) dataset.typed = false;
+          dataset.value.push(itemDataset.value);
+        }
+      } else _addIssue(this, "type", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
+function boolean(message$1) {
+  return {
+    kind: "schema",
+    type: "boolean",
+    reference: boolean,
+    expects: "boolean",
+    async: false,
+    message: message$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      if (typeof dataset.value === "boolean") dataset.typed = true;
+      else _addIssue(this, "type", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
+function literal(literal_, message$1) {
+  return {
+    kind: "schema",
+    type: "literal",
+    reference: literal,
+    expects: /* @__PURE__ */ _stringify(literal_),
+    async: false,
+    literal: literal_,
+    message: message$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      if (dataset.value === this.literal) dataset.typed = true;
+      else _addIssue(this, "type", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
+function nullable(wrapped, default_) {
+  return {
+    kind: "schema",
+    type: "nullable",
+    reference: nullable,
+    expects: `(${wrapped.expects} | null)`,
+    async: false,
+    wrapped,
+    default: default_,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      if (dataset.value === null) {
+        if (this.default !== void 0) dataset.value = /* @__PURE__ */ getDefault(this, dataset, config$1);
+        if (dataset.value === null) {
+          dataset.typed = true;
+          return dataset;
+        }
+      }
+      return this.wrapped["~run"](dataset, config$1);
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
+function number(message$1) {
+  return {
+    kind: "schema",
+    type: "number",
+    reference: number,
+    expects: "number",
+    async: false,
+    message: message$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      if (typeof dataset.value === "number" && !isNaN(dataset.value)) dataset.typed = true;
+      else _addIssue(this, "type", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
+function optional(wrapped, default_) {
+  return {
+    kind: "schema",
+    type: "optional",
+    reference: optional,
+    expects: `(${wrapped.expects} | undefined)`,
+    async: false,
+    wrapped,
+    default: default_,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      if (dataset.value === void 0) {
+        if (this.default !== void 0) dataset.value = /* @__PURE__ */ getDefault(this, dataset, config$1);
+        if (dataset.value === void 0) {
+          dataset.typed = true;
+          return dataset;
+        }
+      }
+      return this.wrapped["~run"](dataset, config$1);
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
+function picklist(options, message$1) {
+  return {
+    kind: "schema",
+    type: "picklist",
+    reference: picklist,
+    expects: /* @__PURE__ */ _joinExpects(options.map(_stringify), "|"),
+    async: false,
+    options,
+    message: message$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      if (this.options.includes(dataset.value)) dataset.typed = true;
+      else _addIssue(this, "type", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
+function record(key, value$1, message$1) {
+  return {
+    kind: "schema",
+    type: "record",
+    reference: record,
+    expects: "Object",
+    async: false,
+    key,
+    value: value$1,
+    message: message$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      const input = dataset.value;
+      if (input && typeof input === "object") {
+        dataset.typed = true;
+        dataset.value = {};
+        for (const entryKey in input) if (/* @__PURE__ */ _isValidObjectKey(input, entryKey)) {
+          const entryValue = input[entryKey];
+          const keyDataset = this.key["~run"]({ value: entryKey }, config$1);
+          if (keyDataset.issues) {
+            const pathItem = {
+              type: "object",
+              origin: "key",
+              input,
+              key: entryKey,
+              value: entryValue
+            };
+            for (const issue of keyDataset.issues) {
+              issue.path = [pathItem];
+              dataset.issues?.push(issue);
+            }
+            if (!dataset.issues) dataset.issues = keyDataset.issues;
+            if (config$1.abortEarly) {
+              dataset.typed = false;
+              break;
+            }
+          }
+          const valueDataset = this.value["~run"]({ value: entryValue }, config$1);
+          if (valueDataset.issues) {
+            const pathItem = {
+              type: "object",
+              origin: "value",
+              input,
+              key: entryKey,
+              value: entryValue
+            };
+            for (const issue of valueDataset.issues) {
+              if (issue.path) issue.path.unshift(pathItem);
+              else issue.path = [pathItem];
+              dataset.issues?.push(issue);
+            }
+            if (!dataset.issues) dataset.issues = valueDataset.issues;
+            if (config$1.abortEarly) {
+              dataset.typed = false;
+              break;
+            }
+          }
+          if (!keyDataset.typed || !valueDataset.typed) dataset.typed = false;
+          if (keyDataset.typed) dataset.value[keyDataset.value] = valueDataset.value;
+        }
+      } else _addIssue(this, "type", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
+function strictObject(entries$1, message$1) {
+  return {
+    kind: "schema",
+    type: "strict_object",
+    reference: strictObject,
+    expects: "Object",
+    async: false,
+    entries: entries$1,
+    message: message$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      const input = dataset.value;
+      if (input && typeof input === "object") {
+        dataset.typed = true;
+        dataset.value = {};
+        for (const key in this.entries) {
+          const valueSchema = this.entries[key];
+          if (key in input || (valueSchema.type === "exact_optional" || valueSchema.type === "optional" || valueSchema.type === "nullish") && valueSchema.default !== void 0) {
+            const value$1 = key in input ? input[key] : /* @__PURE__ */ getDefault(valueSchema);
+            const valueDataset = valueSchema["~run"]({ value: value$1 }, config$1);
+            if (valueDataset.issues) {
+              const pathItem = {
+                type: "object",
+                origin: "value",
+                input,
+                key,
+                value: value$1
+              };
+              for (const issue of valueDataset.issues) {
+                if (issue.path) issue.path.unshift(pathItem);
+                else issue.path = [pathItem];
+                dataset.issues?.push(issue);
+              }
+              if (!dataset.issues) dataset.issues = valueDataset.issues;
+              if (config$1.abortEarly) {
+                dataset.typed = false;
+                break;
+              }
+            }
+            if (!valueDataset.typed) dataset.typed = false;
+            dataset.value[key] = valueDataset.value;
+          } else if (valueSchema.fallback !== void 0) dataset.value[key] = /* @__PURE__ */ getFallback(valueSchema);
+          else if (valueSchema.type !== "exact_optional" && valueSchema.type !== "optional" && valueSchema.type !== "nullish") {
+            _addIssue(this, "key", dataset, config$1, {
+              input: void 0,
+              expected: `"${key}"`,
+              path: [{
+                type: "object",
+                origin: "key",
+                input,
+                key,
+                value: input[key]
+              }]
+            });
+            if (config$1.abortEarly) break;
+          }
+        }
+        if (!dataset.issues || !config$1.abortEarly) {
+          for (const key in input) if (!(key in this.entries)) {
+            _addIssue(this, "key", dataset, config$1, {
+              input: key,
+              expected: "never",
+              path: [{
+                type: "object",
+                origin: "key",
+                input,
+                key,
+                value: input[key]
+              }]
+            });
+            break;
+          }
+        }
+      } else _addIssue(this, "type", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
+function string(message$1) {
+  return {
+    kind: "schema",
+    type: "string",
+    reference: string,
+    expects: "string",
+    async: false,
+    message: message$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      if (typeof dataset.value === "string") dataset.typed = true;
+      else _addIssue(this, "type", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
+function _subIssues(datasets) {
+  let issues;
+  if (datasets) for (const dataset of datasets) if (issues) for (const issue of dataset.issues) issues.push(issue);
+  else issues = dataset.issues;
+  return issues;
+}
+// @__NO_SIDE_EFFECTS__
+function union(options, message$1) {
+  return {
+    kind: "schema",
+    type: "union",
+    reference: union,
+    expects: /* @__PURE__ */ _joinExpects(options.map((option) => option.expects), "|"),
+    async: false,
+    options,
+    message: message$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      let validDataset;
+      let typedDatasets;
+      let untypedDatasets;
+      for (const schema of this.options) {
+        const optionDataset = schema["~run"]({ value: dataset.value }, config$1);
+        if (optionDataset.typed) if (optionDataset.issues) if (typedDatasets) typedDatasets.push(optionDataset);
+        else typedDatasets = [optionDataset];
+        else {
+          validDataset = optionDataset;
+          break;
+        }
+        else if (untypedDatasets) untypedDatasets.push(optionDataset);
+        else untypedDatasets = [optionDataset];
+      }
+      if (validDataset) return validDataset;
+      if (typedDatasets) {
+        if (typedDatasets.length === 1) return typedDatasets[0];
+        _addIssue(this, "type", dataset, config$1, { issues: /* @__PURE__ */ _subIssues(typedDatasets) });
+        dataset.typed = true;
+      } else if (untypedDatasets?.length === 1) return untypedDatasets[0];
+      else _addIssue(this, "type", dataset, config$1, { issues: /* @__PURE__ */ _subIssues(untypedDatasets) });
+      return dataset;
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
+function variant(key, options, message$1) {
+  return {
+    kind: "schema",
+    type: "variant",
+    reference: variant,
+    expects: "Object",
+    async: false,
+    key,
+    options,
+    message: message$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      const input = dataset.value;
+      if (input && typeof input === "object") {
+        let outputDataset;
+        let maxDiscriminatorPriority = 0;
+        let invalidDiscriminatorKey = this.key;
+        let expectedDiscriminators = [];
+        const parseOptions = (variant$1, allKeys) => {
+          for (const schema of variant$1.options) {
+            if (schema.type === "variant") parseOptions(schema, new Set(allKeys).add(schema.key));
+            else {
+              let keysAreValid = true;
+              let currentPriority = 0;
+              for (const currentKey of allKeys) {
+                const discriminatorSchema = schema.entries[currentKey];
+                if (currentKey in input ? discriminatorSchema["~run"]({
+                  typed: false,
+                  value: input[currentKey]
+                }, ABORT_EARLY_CONFIG).issues : discriminatorSchema.type !== "exact_optional" && discriminatorSchema.type !== "optional" && discriminatorSchema.type !== "nullish") {
+                  keysAreValid = false;
+                  if (invalidDiscriminatorKey !== currentKey && (maxDiscriminatorPriority < currentPriority || maxDiscriminatorPriority === currentPriority && currentKey in input && !(invalidDiscriminatorKey in input))) {
+                    maxDiscriminatorPriority = currentPriority;
+                    invalidDiscriminatorKey = currentKey;
+                    expectedDiscriminators = [];
+                  }
+                  if (invalidDiscriminatorKey === currentKey) expectedDiscriminators.push(schema.entries[currentKey].expects);
+                  break;
+                }
+                currentPriority++;
+              }
+              if (keysAreValid) {
+                const optionDataset = schema["~run"]({ value: input }, config$1);
+                if (!outputDataset || !outputDataset.typed && optionDataset.typed) outputDataset = optionDataset;
+              }
+            }
+            if (outputDataset && !outputDataset.issues) break;
+          }
+        };
+        parseOptions(this, /* @__PURE__ */ new Set([this.key]));
+        if (outputDataset) return outputDataset;
+        _addIssue(this, "type", dataset, config$1, {
+          input: input[invalidDiscriminatorKey],
+          expected: /* @__PURE__ */ _joinExpects(expectedDiscriminators, "|"),
+          path: [{
+            type: "object",
+            origin: "value",
+            input,
+            key: invalidDiscriminatorKey,
+            value: input[invalidDiscriminatorKey]
+          }]
+        });
+      } else _addIssue(this, "type", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+function parse(schema, input, config$1) {
+  const dataset = schema["~run"]({ value: input }, /* @__PURE__ */ getGlobalConfig(config$1));
+  if (dataset.issues) throw new ValiError(dataset.issues);
+  return dataset.value;
+}
+// @__NO_SIDE_EFFECTS__
+function pipe(...pipe$1) {
+  return {
+    ...pipe$1[0],
+    pipe: pipe$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      for (const item of pipe$1) if (item.kind !== "metadata") {
+        if (dataset.issues && (item.kind === "schema" || item.kind === "transformation")) {
+          dataset.typed = false;
+          break;
+        }
+        if (!dataset.issues || !config$1.abortEarly && !config$1.abortPipeEarly) dataset = item["~run"](dataset, config$1);
+      }
+      return dataset;
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
+function safeParse(schema, input, config$1) {
+  const dataset = schema["~run"]({ value: input }, /* @__PURE__ */ getGlobalConfig(config$1));
+  return {
+    typed: dataset.typed,
+    success: !dataset.issues,
+    output: dataset.value,
+    issues: dataset.issues
+  };
+}
+
+// src/operations.ts
+var moveAccountOperationSchema = strictObject({
+  kind: literal("moveAccount"),
+  accountId: string(),
+  accountName: string(),
+  fromOuId: string(),
+  fromOuName: string(),
+  toOuId: string(),
+  toOuName: string()
+});
+var createOuOperationSchema = strictObject({
+  kind: literal("createOu"),
+  ouName: string(),
+  parentOuId: string(),
+  parentOuName: string()
+});
+var renameOuOperationSchema = strictObject({
+  kind: literal("renameOu"),
+  ouId: string(),
+  fromOuName: string(),
+  toOuName: string(),
+  parentOuId: string(),
+  parentOuName: string()
+});
+var deleteOuOperationSchema = strictObject({
+  kind: literal("deleteOu"),
+  ouId: string(),
+  ouName: string(),
+  parentOuId: string(),
+  parentOuName: string()
+});
+var createAccountOperationSchema = strictObject({
+  kind: literal("createAccount"),
+  accountName: string(),
+  accountEmail: string(),
+  targetOuId: string(),
+  targetOuName: string()
+});
+var updateAccountTagsOperationSchema = strictObject({
+  kind: literal("updateAccountTags"),
+  accountId: string(),
+  accountName: string(),
+  tags: record(string(), string())
+});
+var updateAccountNameOperationSchema = strictObject({
+  kind: literal("updateAccountName"),
+  accountId: string(),
+  fromAccountName: string(),
+  toAccountName: string()
+});
+var removeAccountOperationSchema = strictObject({
+  kind: literal("removeAccount"),
+  accountId: string(),
+  accountName: string(),
+  fromOuId: string(),
+  fromOuName: string(),
+  toOuId: string(),
+  toOuName: string()
+});
+var createIdcUserOperationSchema = strictObject({
+  kind: literal("createIdcUser"),
+  userName: string(),
+  displayName: string(),
+  email: string()
+});
+var updateIdcUserOperationSchema = strictObject({
+  kind: literal("updateIdcUser"),
+  userName: string(),
+  displayName: string(),
+  email: string()
+});
+var deleteIdcUserOperationSchema = strictObject({
+  kind: literal("deleteIdcUser"),
+  userName: string()
+});
+var createIdcGroupOperationSchema = strictObject({
+  kind: literal("createIdcGroup"),
+  groupDisplayName: string(),
+  description: string()
+});
+var updateIdcGroupDescriptionOperationSchema = strictObject({
+  kind: literal("updateIdcGroupDescription"),
+  groupDisplayName: string(),
+  description: string()
+});
+var deleteIdcGroupOperationSchema = strictObject({
+  kind: literal("deleteIdcGroup"),
+  groupDisplayName: string()
+});
+var addIdcGroupMembershipOperationSchema = strictObject({
+  kind: literal("addIdcGroupMembership"),
+  groupDisplayName: string(),
+  userName: string()
+});
+var removeIdcGroupMembershipOperationSchema = strictObject({
+  kind: literal("removeIdcGroupMembership"),
+  groupDisplayName: string(),
+  userName: string()
+});
+var createIdcPermissionSetOperationSchema = strictObject({
+  kind: literal("createIdcPermissionSet"),
+  permissionSetName: string(),
+  description: string()
+});
+var updateIdcPermissionSetDescriptionOperationSchema = strictObject({
+  kind: literal("updateIdcPermissionSetDescription"),
+  permissionSetName: string(),
+  description: string()
+});
+var deleteIdcPermissionSetOperationSchema = strictObject({
+  kind: literal("deleteIdcPermissionSet"),
+  permissionSetName: string()
+});
+var putIdcPermissionSetInlinePolicyOperationSchema = strictObject({
+  kind: literal("putIdcPermissionSetInlinePolicy"),
+  permissionSetName: string(),
+  inlinePolicy: string()
+});
+var deleteIdcPermissionSetInlinePolicyOperationSchema = strictObject({
+  kind: literal("deleteIdcPermissionSetInlinePolicy"),
+  permissionSetName: string()
+});
+var attachIdcManagedPolicyToPermissionSetOperationSchema = strictObject({
+  kind: literal("attachIdcManagedPolicyToPermissionSet"),
+  permissionSetName: string(),
+  managedPolicyArn: string()
+});
+var detachIdcManagedPolicyFromPermissionSetOperationSchema = strictObject({
+  kind: literal("detachIdcManagedPolicyFromPermissionSet"),
+  permissionSetName: string(),
+  managedPolicyArn: string()
+});
+var attachIdcCustomerManagedPolicyReferenceToPermissionSetOperationSchema = strictObject({
+  kind: literal("attachIdcCustomerManagedPolicyReferenceToPermissionSet"),
+  permissionSetName: string(),
+  customerManagedPolicyName: string(),
+  customerManagedPolicyPath: string()
+});
+var detachIdcCustomerManagedPolicyReferenceFromPermissionSetOperationSchema = strictObject({
+  kind: literal("detachIdcCustomerManagedPolicyReferenceFromPermissionSet"),
+  permissionSetName: string(),
+  customerManagedPolicyName: string(),
+  customerManagedPolicyPath: string()
+});
+var provisionIdcPermissionSetOperationSchema = strictObject({
+  kind: literal("provisionIdcPermissionSet"),
+  permissionSetName: string(),
+  targetScope: literal("ALL_PROVISIONED_ACCOUNTS")
+});
+var grantIdcAccountAssignmentOperationSchema = strictObject({
+  kind: literal("grantIdcAccountAssignment"),
+  accountName: string(),
+  permissionSetName: string(),
+  principalType: picklist(["GROUP", "USER"]),
+  principalName: string()
+});
+var revokeIdcAccountAssignmentOperationSchema = strictObject({
+  kind: literal("revokeIdcAccountAssignment"),
+  accountName: string(),
+  permissionSetName: string(),
+  principalType: picklist(["GROUP", "USER"]),
+  principalName: string()
+});
+var operationSchema = variant("kind", [
+  moveAccountOperationSchema,
+  createOuOperationSchema,
+  renameOuOperationSchema,
+  deleteOuOperationSchema,
+  createAccountOperationSchema,
+  updateAccountTagsOperationSchema,
+  updateAccountNameOperationSchema,
+  removeAccountOperationSchema,
+  createIdcUserOperationSchema,
+  updateIdcUserOperationSchema,
+  deleteIdcUserOperationSchema,
+  createIdcGroupOperationSchema,
+  updateIdcGroupDescriptionOperationSchema,
+  deleteIdcGroupOperationSchema,
+  addIdcGroupMembershipOperationSchema,
+  removeIdcGroupMembershipOperationSchema,
+  createIdcPermissionSetOperationSchema,
+  updateIdcPermissionSetDescriptionOperationSchema,
+  deleteIdcPermissionSetOperationSchema,
+  putIdcPermissionSetInlinePolicyOperationSchema,
+  deleteIdcPermissionSetInlinePolicyOperationSchema,
+  attachIdcManagedPolicyToPermissionSetOperationSchema,
+  detachIdcManagedPolicyFromPermissionSetOperationSchema,
+  attachIdcCustomerManagedPolicyReferenceToPermissionSetOperationSchema,
+  detachIdcCustomerManagedPolicyReferenceFromPermissionSetOperationSchema,
+  provisionIdcPermissionSetOperationSchema,
+  grantIdcAccountAssignmentOperationSchema,
+  revokeIdcAccountAssignmentOperationSchema
+]);
+var unsupportedDiffKindSchema = picklist([
+  "ambiguousOuRename",
+  "reparentedOu",
+  "newOuWithUnknownParent",
+  "newAccountWithUnknownOu",
+  "removedOu"
+]);
+var unsupportedDiffCategorySchema = picklist([
+  "destructive",
+  "unsupportedMutation"
+]);
+var unsupportedDiffSchema = strictObject({
+  kind: unsupportedDiffKindSchema,
+  category: unsupportedDiffCategorySchema,
+  description: string()
+});
+var planSchema = strictObject({
+  operations: array(operationSchema),
+  unsupported: array(unsupportedDiffSchema)
+});
+
+// src/helpers.ts
+function assertUnreachable(value, message = JSON.stringify(value)) {
+  throw Error("An unreachable state reached!\n" + message);
+}
+function toRecordByProperty(input, key, keyTransformer = (key2) => key2) {
+  return Object.fromEntries(
+    input.map((item) => [
+      keyTransformer(typeof key === "function" ? key(item) : item[key]),
+      item
+    ])
+  );
+}
+async function delay(ms) {
+  await new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+
+// src/state.ts
+var nonEmptyString = pipe(string(), minLength(1));
+var principalTypeSchema = picklist(["GROUP", "USER"]);
+var organizationalUnitSchema = strictObject({
+  id: nonEmptyString,
+  parentId: nonEmptyString,
+  arn: nonEmptyString,
+  name: nonEmptyString
+});
+var accountTagSchema = strictObject({
+  key: nonEmptyString,
+  value: string()
+});
+var accountSchema = strictObject({
+  id: nonEmptyString,
+  arn: nonEmptyString,
+  name: nonEmptyString,
+  email: nonEmptyString,
+  status: nonEmptyString,
+  parentId: nonEmptyString,
+  tags: array(accountTagSchema)
+});
+var userSchema = strictObject({
+  userId: nonEmptyString,
+  userName: nonEmptyString,
+  displayName: string(),
+  email: string()
+});
+var groupSchema = strictObject({
+  groupId: nonEmptyString,
+  displayName: nonEmptyString,
+  description: optional(string())
+});
+var groupMembershipSchema = strictObject({
+  membershipId: nonEmptyString,
+  groupId: nonEmptyString,
+  userId: nonEmptyString
+});
+var customerManagedPolicyReferenceSchema = strictObject({
+  name: nonEmptyString,
+  path: nonEmptyString
+});
+var permissionSetSchema = strictObject({
+  permissionSetArn: nonEmptyString,
+  name: nonEmptyString,
+  description: string(),
+  inlinePolicy: nullable(nonEmptyString),
+  awsManagedPolicies: array(nonEmptyString),
+  customerManagedPolicies: array(customerManagedPolicyReferenceSchema)
+});
+var accountAssignmentSchema = strictObject({
+  accountId: nonEmptyString,
+  permissionSetArn: nonEmptyString,
+  principalId: nonEmptyString,
+  principalType: principalTypeSchema
+});
+var accessRoleSchema = strictObject({
+  accountId: nonEmptyString,
+  permissionSetArn: nonEmptyString,
+  principalId: nonEmptyString,
+  principalType: principalTypeSchema,
+  roleName: nonEmptyString
+});
+var stateSchema = strictObject({
+  version: nonEmptyString,
+  generatedAt: nonEmptyString,
+  organization: strictObject({
+    rootId: nonEmptyString,
+    organizationalUnits: array(organizationalUnitSchema),
+    accounts: array(accountSchema)
+  }),
+  identityCenter: strictObject({
+    instanceArn: nonEmptyString,
+    identityStoreId: nonEmptyString,
+    users: array(userSchema),
+    groups: array(groupSchema),
+    groupMemberships: array(groupMembershipSchema),
+    permissionSets: array(permissionSetSchema),
+    accountAssignments: array(accountAssignmentSchema),
+    accessRoles: array(accessRoleSchema)
+  })
+});
+function createWorkingState(props) {
+  return {
+    version: props.state.version,
+    generatedAt: props.state.generatedAt,
+    organization: {
+      rootId: props.state.organization.rootId,
+      organizationalUnitsById: toRecordByProperty(
+        props.state.organization.organizationalUnits,
+        "id"
+      ),
+      accountsById: toRecordByProperty(props.state.organization.accounts, "id"),
+      accountsByName: toRecordByProperty(
+        props.state.organization.accounts,
+        "name"
+      )
+    },
+    identityCenter: createWorkingIdentityCenterState({
+      identityCenter: props.state.identityCenter
+    })
+  };
+}
+function materializeWorkingState(props) {
+  return {
+    version: props.workingState.version,
+    generatedAt: props.workingState.generatedAt,
+    organization: {
+      rootId: props.workingState.organization.rootId,
+      organizationalUnits: Object.values(
+        props.workingState.organization.organizationalUnitsById
+      ),
+      accounts: Object.values(props.workingState.organization.accountsById)
+    },
+    identityCenter: {
+      instanceArn: props.workingState.identityCenter.instanceArn,
+      identityStoreId: props.workingState.identityCenter.identityStoreId,
+      users: structuredClone(props.workingState.identityCenter.users),
+      groups: structuredClone(props.workingState.identityCenter.groups),
+      groupMemberships: structuredClone(
+        props.workingState.identityCenter.groupMemberships
+      ),
+      permissionSets: structuredClone(
+        props.workingState.identityCenter.permissionSets
+      ),
+      accountAssignments: structuredClone(
+        props.workingState.identityCenter.accountAssignments
+      ),
+      accessRoles: structuredClone(
+        props.workingState.identityCenter.accessRoles
+      )
+    }
+  };
+}
+function moveAccountInWorkingState(props) {
+  const currentAccount = props.workingState.organization.accountsById[props.accountId];
+  if (currentAccount == null || currentAccount.parentId === props.parentId) {
+    return props.workingState;
+  }
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      accountsById: {
+        ...props.workingState.organization.accountsById,
+        [props.accountId]: {
+          ...currentAccount,
+          parentId: props.parentId
+        }
+      },
+      accountsByName: {
+        ...props.workingState.organization.accountsByName,
+        [currentAccount.name]: {
+          ...currentAccount,
+          parentId: props.parentId
+        }
+      }
+    }
+  };
+}
+function upsertAccountInWorkingState(props) {
+  const currentAccount = props.workingState.organization.accountsById[props.account.id];
+  if (currentAccount != null && currentAccount.id === props.account.id && currentAccount.arn === props.account.arn && currentAccount.name === props.account.name && currentAccount.email === props.account.email && currentAccount.status === props.account.status && currentAccount.parentId === props.account.parentId && JSON.stringify(normalizeAccountTags(currentAccount.tags)) === JSON.stringify(normalizeAccountTags(props.account.tags))) {
+    return props.workingState;
+  }
+  let accountsByName = {
+    ...props.workingState.organization.accountsByName
+  };
+  if (currentAccount != null && currentAccount.name !== props.account.name) {
+    const { [currentAccount.name]: _removed, ...rest } = accountsByName;
+    accountsByName = rest;
+  }
+  accountsByName = {
+    ...accountsByName,
+    [props.account.name]: props.account
+  };
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      accountsById: {
+        ...props.workingState.organization.accountsById,
+        [props.account.id]: props.account
+      },
+      accountsByName
+    }
+  };
+}
+function upsertOrganizationalUnitInWorkingState(props) {
+  const currentOrganizationalUnit = props.workingState.organization.organizationalUnitsById[props.organizationalUnit.id];
+  if (currentOrganizationalUnit != null && currentOrganizationalUnit.id === props.organizationalUnit.id && currentOrganizationalUnit.parentId === props.organizationalUnit.parentId && currentOrganizationalUnit.arn === props.organizationalUnit.arn && currentOrganizationalUnit.name === props.organizationalUnit.name) {
+    return props.workingState;
+  }
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      organizationalUnitsById: {
+        ...props.workingState.organization.organizationalUnitsById,
+        [props.organizationalUnit.id]: props.organizationalUnit
+      }
+    }
+  };
+}
+function renameOrganizationalUnitInWorkingState(props) {
+  const currentOrganizationalUnit = props.workingState.organization.organizationalUnitsById[props.organizationalUnitId];
+  if (currentOrganizationalUnit == null || currentOrganizationalUnit.name === props.name) {
+    return props.workingState;
+  }
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      organizationalUnitsById: {
+        ...props.workingState.organization.organizationalUnitsById,
+        [props.organizationalUnitId]: {
+          ...currentOrganizationalUnit,
+          name: props.name
+        }
+      }
+    }
+  };
+}
+function removeOrganizationalUnitFromWorkingState(props) {
+  if (props.workingState.organization.organizationalUnitsById[props.organizationalUnitId] == null) {
+    return props.workingState;
+  }
+  const nextOrganizationalUnitsById = {
+    ...props.workingState.organization.organizationalUnitsById
+  };
+  delete nextOrganizationalUnitsById[props.organizationalUnitId];
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      organizationalUnitsById: nextOrganizationalUnitsById
+    }
+  };
+}
+function createAccountAssignmentKey(props) {
+  return [
+    props.accountId,
+    props.permissionSetArn,
+    props.principalId,
+    props.principalType
+  ].join("|");
+}
+function createGroupMembershipKey(props) {
+  return [props.groupId, props.userId].join("|");
+}
+function upsertIdcUserInWorkingState(props) {
+  const currentUser = props.workingState.identityCenter.usersByUserName[props.user.userName];
+  if (currentUser != null && currentUser.userId === props.user.userId && currentUser.displayName === props.user.displayName && currentUser.userName === props.user.userName && currentUser.email === props.user.email) {
+    return props.workingState;
+  }
+  const remainingUsers = props.workingState.identityCenter.users.filter(
+    (user) => user.userName !== props.user.userName
+  );
+  return {
+    ...props.workingState,
+    identityCenter: createWorkingIdentityCenterState({
+      identityCenter: {
+        ...materializeWorkingIdentityCenterState({
+          identityCenter: props.workingState.identityCenter
+        }),
+        users: [...remainingUsers, props.user]
+      }
+    })
+  };
+}
+function removeIdcUserFromWorkingState(props) {
+  const user = props.workingState.identityCenter.usersByUserName[props.userName];
+  if (user == null) {
+    return props.workingState;
+  }
+  return {
+    ...props.workingState,
+    identityCenter: createWorkingIdentityCenterState({
+      identityCenter: {
+        ...materializeWorkingIdentityCenterState({
+          identityCenter: props.workingState.identityCenter
+        }),
+        users: props.workingState.identityCenter.users.filter(
+          (currentUser) => currentUser.userName !== props.userName
+        ),
+        groupMemberships: props.workingState.identityCenter.groupMemberships.filter(
+          (groupMembership) => groupMembership.userId !== user.userId
+        ),
+        accountAssignments: props.workingState.identityCenter.accountAssignments.filter(
+          (accountAssignment) => accountAssignment.principalType !== "USER" || accountAssignment.principalId !== user.userId
+        )
+      }
+    })
+  };
+}
+function upsertIdcGroupInWorkingState(props) {
+  const currentGroup = props.workingState.identityCenter.groupsByDisplayName[props.group.displayName];
+  if (currentGroup != null && currentGroup.groupId === props.group.groupId && currentGroup.displayName === props.group.displayName && (currentGroup.description ?? "") === (props.group.description ?? "")) {
+    return props.workingState;
+  }
+  const remainingGroups = props.workingState.identityCenter.groups.filter(
+    (group) => group.displayName !== props.group.displayName
+  );
+  return {
+    ...props.workingState,
+    identityCenter: createWorkingIdentityCenterState({
+      identityCenter: {
+        ...materializeWorkingIdentityCenterState({
+          identityCenter: props.workingState.identityCenter
+        }),
+        groups: [...remainingGroups, props.group]
+      }
+    })
+  };
+}
+function removeIdcGroupFromWorkingState(props) {
+  const group = props.workingState.identityCenter.groupsByDisplayName[props.groupDisplayName];
+  if (group == null) {
+    return props.workingState;
+  }
+  return {
+    ...props.workingState,
+    identityCenter: createWorkingIdentityCenterState({
+      identityCenter: {
+        ...materializeWorkingIdentityCenterState({
+          identityCenter: props.workingState.identityCenter
+        }),
+        groups: props.workingState.identityCenter.groups.filter(
+          (currentGroup) => currentGroup.displayName !== props.groupDisplayName
+        ),
+        groupMemberships: props.workingState.identityCenter.groupMemberships.filter(
+          (groupMembership) => groupMembership.groupId !== group.groupId
+        ),
+        accountAssignments: props.workingState.identityCenter.accountAssignments.filter(
+          (accountAssignment) => accountAssignment.principalType !== "GROUP" || accountAssignment.principalId !== group.groupId
+        )
+      }
+    })
+  };
+}
+function upsertIdcPermissionSetInWorkingState(props) {
+  const currentPermissionSet = props.workingState.identityCenter.permissionSetsByName[props.permissionSet.name];
+  if (currentPermissionSet != null && currentPermissionSet.permissionSetArn === props.permissionSet.permissionSetArn && currentPermissionSet.name === props.permissionSet.name && currentPermissionSet.description === props.permissionSet.description && currentPermissionSet.inlinePolicy === props.permissionSet.inlinePolicy && JSON.stringify(currentPermissionSet.awsManagedPolicies) === JSON.stringify(props.permissionSet.awsManagedPolicies) && JSON.stringify(currentPermissionSet.customerManagedPolicies) === JSON.stringify(props.permissionSet.customerManagedPolicies)) {
+    return props.workingState;
+  }
+  const remainingPermissionSets = props.workingState.identityCenter.permissionSets.filter(
+    (permissionSet) => permissionSet.name !== props.permissionSet.name
+  );
+  return {
+    ...props.workingState,
+    identityCenter: createWorkingIdentityCenterState({
+      identityCenter: {
+        ...materializeWorkingIdentityCenterState({
+          identityCenter: props.workingState.identityCenter
+        }),
+        permissionSets: [...remainingPermissionSets, props.permissionSet]
+      }
+    })
+  };
+}
+function removeIdcPermissionSetFromWorkingState(props) {
+  const permissionSet = props.workingState.identityCenter.permissionSetsByName[props.permissionSetName];
+  if (permissionSet == null) {
+    return props.workingState;
+  }
+  return {
+    ...props.workingState,
+    identityCenter: createWorkingIdentityCenterState({
+      identityCenter: {
+        ...materializeWorkingIdentityCenterState({
+          identityCenter: props.workingState.identityCenter
+        }),
+        permissionSets: props.workingState.identityCenter.permissionSets.filter(
+          (currentPermissionSet) => currentPermissionSet.name !== props.permissionSetName
+        ),
+        accountAssignments: props.workingState.identityCenter.accountAssignments.filter(
+          (accountAssignment) => accountAssignment.permissionSetArn !== permissionSet.permissionSetArn
+        )
+      }
+    })
+  };
+}
+function addAccountAssignmentToWorkingState(props) {
+  const assignmentKey = createAccountAssignmentKey({
+    accountId: props.accountAssignment.accountId,
+    permissionSetArn: props.accountAssignment.permissionSetArn,
+    principalId: props.accountAssignment.principalId,
+    principalType: props.accountAssignment.principalType
+  });
+  if (props.workingState.identityCenter.accountAssignmentsByKey[assignmentKey] != null) {
+    return props.workingState;
+  }
+  return {
+    ...props.workingState,
+    identityCenter: createWorkingIdentityCenterState({
+      identityCenter: {
+        ...materializeWorkingIdentityCenterState({
+          identityCenter: props.workingState.identityCenter
+        }),
+        accountAssignments: [
+          ...props.workingState.identityCenter.accountAssignments,
+          props.accountAssignment
+        ]
+      }
+    })
+  };
+}
+function addGroupMembershipToWorkingState(props) {
+  const membershipKey = createGroupMembershipKey({
+    groupId: props.groupMembership.groupId,
+    userId: props.groupMembership.userId
+  });
+  if (props.workingState.identityCenter.groupMembershipsByKey[membershipKey] != null) {
+    return props.workingState;
+  }
+  return {
+    ...props.workingState,
+    identityCenter: createWorkingIdentityCenterState({
+      identityCenter: {
+        ...materializeWorkingIdentityCenterState({
+          identityCenter: props.workingState.identityCenter
+        }),
+        groupMemberships: [
+          ...props.workingState.identityCenter.groupMemberships,
+          props.groupMembership
+        ]
+      }
+    })
+  };
+}
+function removeGroupMembershipFromWorkingState(props) {
+  const membershipKey = createGroupMembershipKey({
+    groupId: props.groupMembership.groupId,
+    userId: props.groupMembership.userId
+  });
+  if (props.workingState.identityCenter.groupMembershipsByKey[membershipKey] == null) {
+    return props.workingState;
+  }
+  return {
+    ...props.workingState,
+    identityCenter: createWorkingIdentityCenterState({
+      identityCenter: {
+        ...materializeWorkingIdentityCenterState({
+          identityCenter: props.workingState.identityCenter
+        }),
+        groupMemberships: props.workingState.identityCenter.groupMemberships.filter(
+          (groupMembership) => createGroupMembershipKey({
+            groupId: groupMembership.groupId,
+            userId: groupMembership.userId
+          }) !== membershipKey
+        )
+      }
+    })
+  };
+}
+function removeAccountAssignmentFromWorkingState(props) {
+  const assignmentKey = createAccountAssignmentKey({
+    accountId: props.accountAssignment.accountId,
+    permissionSetArn: props.accountAssignment.permissionSetArn,
+    principalId: props.accountAssignment.principalId,
+    principalType: props.accountAssignment.principalType
+  });
+  if (props.workingState.identityCenter.accountAssignmentsByKey[assignmentKey] == null) {
+    return props.workingState;
+  }
+  return {
+    ...props.workingState,
+    identityCenter: createWorkingIdentityCenterState({
+      identityCenter: {
+        ...materializeWorkingIdentityCenterState({
+          identityCenter: props.workingState.identityCenter
+        }),
+        accountAssignments: props.workingState.identityCenter.accountAssignments.filter(
+          (accountAssignment) => createAccountAssignmentKey({
+            accountId: accountAssignment.accountId,
+            permissionSetArn: accountAssignment.permissionSetArn,
+            principalId: accountAssignment.principalId,
+            principalType: accountAssignment.principalType
+          }) !== assignmentKey
+        )
+      }
+    })
+  };
+}
+function createAccessRoleName(assignment) {
+  return `AWSReservedSSO_${assignment.permissionSetArn.split("/").at(-1) ?? "PermissionSet"}_${assignment.accountId}`;
+}
+function createWorkingIdentityCenterState(props) {
+  const users = structuredClone(props.identityCenter.users);
+  const groups = structuredClone(props.identityCenter.groups);
+  const groupMemberships = structuredClone(
+    props.identityCenter.groupMemberships
+  );
+  const permissionSets = structuredClone(props.identityCenter.permissionSets);
+  const accountAssignments = structuredClone(
+    props.identityCenter.accountAssignments
+  );
+  return {
+    instanceArn: props.identityCenter.instanceArn,
+    identityStoreId: props.identityCenter.identityStoreId,
+    users,
+    usersByUserName: toRecordByProperty(users, "userName"),
+    groups,
+    groupsByDisplayName: toRecordByProperty(groups, "displayName"),
+    groupMemberships,
+    groupMembershipsByKey: toRecordByProperty(
+      groupMemberships,
+      createGroupMembershipKey
+    ),
+    permissionSets,
+    permissionSetsByName: toRecordByProperty(permissionSets, "name"),
+    accountAssignments,
+    accountAssignmentsByKey: toRecordByProperty(
+      accountAssignments,
+      createAccountAssignmentKey
+    ),
+    accessRoles: createAccessRoles({
+      accountAssignments
+    })
+  };
+}
+function materializeWorkingIdentityCenterState(props) {
+  return {
+    instanceArn: props.identityCenter.instanceArn,
+    identityStoreId: props.identityCenter.identityStoreId,
+    users: structuredClone(props.identityCenter.users),
+    groups: structuredClone(props.identityCenter.groups),
+    groupMemberships: structuredClone(props.identityCenter.groupMemberships),
+    permissionSets: structuredClone(props.identityCenter.permissionSets),
+    accountAssignments: structuredClone(
+      props.identityCenter.accountAssignments
+    ),
+    accessRoles: structuredClone(props.identityCenter.accessRoles)
+  };
+}
+function createAccessRoles(props) {
+  return props.accountAssignments.map((accountAssignment) => ({
+    accountId: accountAssignment.accountId,
+    permissionSetArn: accountAssignment.permissionSetArn,
+    principalId: accountAssignment.principalId,
+    principalType: accountAssignment.principalType,
+    roleName: createAccessRoleName(accountAssignment)
+  }));
+}
+function compareByKeys(...values) {
+  for (let index = 0; index < values.length; index += 2) {
+    const left = values[index] ?? "";
+    const right = values[index + 1] ?? "";
+    const compared = left.localeCompare(right);
+    if (compared !== 0) {
+      return compared;
+    }
+  }
+  return 0;
+}
+function normalizeAccountTags(tags) {
+  if (tags == null || tags.length === 0) {
+    return [];
+  }
+  return [...tags].sort(
+    (left, right) => compareByKeys(left.key, right.key, left.value, right.value)
+  );
+}
+
+// src/scanLogic.ts
+import {
+  ListGroupMembershipsCommand,
+  ListGroupsCommand,
+  ListUsersCommand
+} from "@aws-sdk/client-identitystore";
+import {
+  ListAccountsCommand,
+  ListOrganizationalUnitsForParentCommand,
+  ListParentsCommand,
+  ListRootsCommand,
+  ListTagsForResourceCommand
+} from "@aws-sdk/client-organizations";
+import {
+  DescribePermissionSetCommand,
+  GetInlinePolicyForPermissionSetCommand,
+  ListAccountAssignmentsCommand,
+  ListAccountsForProvisionedPermissionSetCommand,
+  ListCustomerManagedPolicyReferencesInPermissionSetCommand,
+  ListInstancesCommand,
+  ListManagedPoliciesInPermissionSetCommand,
+  ListPermissionSetsCommand
+} from "@aws-sdk/client-sso-admin";
+async function scanOrganization(props) {
+  const roots = await props.organizationsClient.send(new ListRootsCommand({}));
+  const root = roots.Roots?.[0];
+  if (root?.Id == null) {
+    throw new Error("No organization root found.");
+  }
+  const organizationalUnits = await collectOrganizationalUnits({
+    organizationsClient: props.organizationsClient,
+    parentId: root.Id
+  });
+  const accounts = [];
+  let nextToken;
+  do {
+    const response = await props.organizationsClient.send(
+      new ListAccountsCommand({ NextToken: nextToken })
+    );
+    for (const account of response.Accounts ?? []) {
+      if (account.Id == null || account.Arn == null || account.Name == null || account.Email == null || account.Status == null) {
+        continue;
+      }
+      const parents = await props.organizationsClient.send(
+        new ListParentsCommand({ ChildId: account.Id })
+      );
+      const parentId = parents.Parents?.[0]?.Id ?? root.Id;
+      const tagsResponse = await props.organizationsClient.send(
+        new ListTagsForResourceCommand({
+          ResourceId: account.Id
+        })
+      );
+      accounts.push({
+        id: account.Id,
+        arn: account.Arn,
+        name: account.Name,
+        email: account.Email,
+        status: account.Status,
+        parentId,
+        tags: (tagsResponse.Tags ?? []).flatMap((tag) => {
+          if (tag.Key == null) {
+            return [];
+          }
+          return [
+            {
+              key: tag.Key,
+              value: tag.Value ?? ""
+            }
+          ];
+        })
+      });
+    }
+    nextToken = response.NextToken;
+  } while (nextToken != null);
+  return {
+    rootId: root.Id,
+    organizationalUnits,
+    accounts
+  };
+}
+async function collectOrganizationalUnits(props) {
+  const children = [];
+  let nextToken;
+  do {
+    const response = await props.organizationsClient.send(
+      new ListOrganizationalUnitsForParentCommand({
+        ParentId: props.parentId,
+        NextToken: nextToken
+      })
+    );
+    for (const ou of response.OrganizationalUnits ?? []) {
+      if (ou.Id == null || ou.Arn == null || ou.Name == null) {
+        continue;
+      }
+      children.push({
+        id: ou.Id,
+        parentId: props.parentId,
+        arn: ou.Arn,
+        name: ou.Name
+      });
+      const descendants = await collectOrganizationalUnits({
+        organizationsClient: props.organizationsClient,
+        parentId: ou.Id
+      });
+      children.push(...descendants);
+    }
+    nextToken = response.NextToken;
+  } while (nextToken != null);
+  return children;
+}
+async function scanIdentityCenter(props) {
+  const instancesResponse = await props.ssoAdminClient.send(
+    new ListInstancesCommand({})
+  );
+  const instances = instancesResponse.Instances ?? [];
+  if (instances.length === 0) {
+    throw new Error("No IAM Identity Center instance found.");
+  }
+  const instance = selectIdentityCenterInstance({
+    instances,
+    requestedInstanceArn: props.requestedInstanceArn
+  });
+  const [users, groups, permissionSets] = await Promise.all([
+    listIdentityStoreUsers({
+      identityStoreClient: props.identityStoreClient,
+      identityStoreId: instance.identityStoreId
+    }),
+    listIdentityStoreGroups({
+      identityStoreClient: props.identityStoreClient,
+      identityStoreId: instance.identityStoreId
+    }),
+    listPermissionSets({
+      ssoAdminClient: props.ssoAdminClient,
+      instanceArn: instance.instanceArn
+    })
+  ]);
+  const groupMemberships = await listGroupMemberships({
+    identityStoreClient: props.identityStoreClient,
+    identityStoreId: instance.identityStoreId,
+    groups
+  });
+  const accountAssignments = await listAccountAssignments({
+    ssoAdminClient: props.ssoAdminClient,
+    instanceArn: instance.instanceArn,
+    permissionSets
+  });
+  const accessRoles = accountAssignments.map((assignment) => ({
+    ...assignment,
+    roleName: createAccessRoleName(assignment)
+  }));
+  return {
+    instanceArn: instance.instanceArn,
+    identityStoreId: instance.identityStoreId,
+    users,
+    groups,
+    groupMemberships,
+    permissionSets,
+    accountAssignments,
+    accessRoles
+  };
+}
+function selectIdentityCenterInstance(props) {
+  if (props.requestedInstanceArn != null) {
+    const selected2 = props.instances.find(
+      (instance) => instance.InstanceArn === props.requestedInstanceArn
+    );
+    if (selected2?.InstanceArn == null || selected2.IdentityStoreId == null) {
+      throw new Error(
+        `Identity Center instance not found for --instance-arn: ${props.requestedInstanceArn}`
+      );
+    }
+    return {
+      instanceArn: selected2.InstanceArn,
+      identityStoreId: selected2.IdentityStoreId
+    };
+  }
+  if (props.instances.length > 1) {
+    const knownArns = props.instances.map((instance) => instance.InstanceArn).filter((value) => value != null).join(", ");
+    throw new Error(
+      `Multiple IAM Identity Center instances found. Re-run scan with --instance-arn. Available: ${knownArns}`
+    );
+  }
+  const selected = props.instances[0];
+  if (selected?.InstanceArn == null || selected.IdentityStoreId == null) {
+    throw new Error("IAM Identity Center instance is missing required fields.");
+  }
+  return {
+    instanceArn: selected.InstanceArn,
+    identityStoreId: selected.IdentityStoreId
+  };
+}
+async function listIdentityStoreUsers(props) {
+  const users = [];
+  let nextToken;
+  do {
+    const response = await props.identityStoreClient.send(
+      new ListUsersCommand({
+        IdentityStoreId: props.identityStoreId,
+        NextToken: nextToken
+      })
+    );
+    for (const user of response.Users ?? []) {
+      if (user.UserId == null || user.UserName == null) {
+        continue;
+      }
+      users.push({
+        userId: user.UserId,
+        userName: user.UserName,
+        displayName: user.DisplayName ?? "",
+        email: resolveIdentityStoreUserEmail({
+          emails: user.Emails ?? []
+        })
+      });
+    }
+    nextToken = response.NextToken;
+  } while (nextToken != null);
+  return users;
+}
+async function listIdentityStoreGroups(props) {
+  const groups = [];
+  let nextToken;
+  do {
+    const response = await props.identityStoreClient.send(
+      new ListGroupsCommand({
+        IdentityStoreId: props.identityStoreId,
+        NextToken: nextToken
+      })
+    );
+    for (const group of response.Groups ?? []) {
+      if (group.GroupId == null || group.DisplayName == null) {
+        continue;
+      }
+      groups.push({
+        groupId: group.GroupId,
+        displayName: group.DisplayName,
+        description: group.Description ?? ""
+      });
+    }
+    nextToken = response.NextToken;
+  } while (nextToken != null);
+  return groups;
+}
+async function listGroupMemberships(props) {
+  const groupMemberships = [];
+  for (const group of props.groups) {
+    let nextToken;
+    do {
+      const response = await props.identityStoreClient.send(
+        new ListGroupMembershipsCommand({
+          IdentityStoreId: props.identityStoreId,
+          GroupId: group.groupId,
+          NextToken: nextToken
+        })
+      );
+      for (const groupMembership of response.GroupMemberships ?? []) {
+        const userId = groupMembership.MemberId?.UserId;
+        if (groupMembership.MembershipId == null || groupMembership.GroupId == null || userId == null) {
+          continue;
+        }
+        groupMemberships.push({
+          membershipId: groupMembership.MembershipId,
+          groupId: groupMembership.GroupId,
+          userId
+        });
+      }
+      nextToken = response.NextToken;
+    } while (nextToken != null);
+  }
+  return groupMemberships;
+}
+function resolveIdentityStoreUserEmail(props) {
+  const primaryEmail = props.emails.find(
+    (email) => email.Primary === true && email.Value != null && email.Value.length > 0
+  );
+  if (primaryEmail?.Value != null) {
+    return primaryEmail.Value;
+  }
+  return props.emails.find((email) => email.Value != null && email.Value.length > 0)?.Value ?? "";
+}
+async function listPermissionSets(props) {
+  const permissionSetArns = [];
+  let nextToken;
+  do {
+    const response = await props.ssoAdminClient.send(
+      new ListPermissionSetsCommand({
+        InstanceArn: props.instanceArn,
+        NextToken: nextToken
+      })
+    );
+    permissionSetArns.push(...response.PermissionSets ?? []);
+    nextToken = response.NextToken;
+  } while (nextToken != null);
+  const describeResponses = await Promise.all(
+    permissionSetArns.map(
+      (permissionSetArn) => props.ssoAdminClient.send(
+        new DescribePermissionSetCommand({
+          InstanceArn: props.instanceArn,
+          PermissionSetArn: permissionSetArn
+        })
+      )
+    )
+  );
+  const permissionSets = await Promise.all(
+    describeResponses.map(async (response) => {
+      const permissionSet = response.PermissionSet;
+      if (permissionSet?.PermissionSetArn == null || permissionSet.Name == null) {
+        return void 0;
+      }
+      const [
+        inlinePolicy,
+        awsManagedPolicies,
+        customerManagedPolicies
+      ] = await Promise.all([
+        getInlinePolicyForPermissionSet({
+          ssoAdminClient: props.ssoAdminClient,
+          instanceArn: props.instanceArn,
+          permissionSetArn: permissionSet.PermissionSetArn
+        }),
+        listManagedPoliciesInPermissionSet({
+          ssoAdminClient: props.ssoAdminClient,
+          instanceArn: props.instanceArn,
+          permissionSetArn: permissionSet.PermissionSetArn
+        }),
+        listCustomerManagedPoliciesInPermissionSet({
+          ssoAdminClient: props.ssoAdminClient,
+          instanceArn: props.instanceArn,
+          permissionSetArn: permissionSet.PermissionSetArn
+        })
+      ]);
+      return {
+        permissionSetArn: permissionSet.PermissionSetArn,
+        name: permissionSet.Name,
+        description: permissionSet.Description ?? "",
+        inlinePolicy,
+        awsManagedPolicies,
+        customerManagedPolicies
+      };
+    })
+  );
+  return permissionSets.filter(
+    (permissionSet) => permissionSet != null
+  );
+}
+async function getInlinePolicyForPermissionSet(props) {
+  const response = await props.ssoAdminClient.send(
+    new GetInlinePolicyForPermissionSetCommand({
+      InstanceArn: props.instanceArn,
+      PermissionSetArn: props.permissionSetArn
+    })
+  );
+  const inlinePolicy = response.InlinePolicy?.trim();
+  return inlinePolicy != null && inlinePolicy.length > 0 ? inlinePolicy : null;
+}
+async function listManagedPoliciesInPermissionSet(props) {
+  const managedPolicies = [];
+  let nextToken;
+  do {
+    const response = await props.ssoAdminClient.send(
+      new ListManagedPoliciesInPermissionSetCommand({
+        InstanceArn: props.instanceArn,
+        PermissionSetArn: props.permissionSetArn,
+        NextToken: nextToken
+      })
+    );
+    for (const attachedManagedPolicy of response.AttachedManagedPolicies ?? []) {
+      if (attachedManagedPolicy.Arn == null) {
+        continue;
+      }
+      managedPolicies.push(attachedManagedPolicy.Arn);
+    }
+    nextToken = response.NextToken;
+  } while (nextToken != null);
+  return managedPolicies;
+}
+async function listCustomerManagedPoliciesInPermissionSet(props) {
+  const customerManagedPolicies = [];
+  let nextToken;
+  do {
+    const response = await props.ssoAdminClient.send(
+      new ListCustomerManagedPolicyReferencesInPermissionSetCommand({
+        InstanceArn: props.instanceArn,
+        PermissionSetArn: props.permissionSetArn,
+        NextToken: nextToken
+      })
+    );
+    for (const customerManagedPolicyReference of response.CustomerManagedPolicyReferences ?? []) {
+      if (customerManagedPolicyReference.Name == null || customerManagedPolicyReference.Path == null) {
+        continue;
+      }
+      customerManagedPolicies.push({
+        name: customerManagedPolicyReference.Name,
+        path: customerManagedPolicyReference.Path
+      });
+    }
+    nextToken = response.NextToken;
+  } while (nextToken != null);
+  return customerManagedPolicies;
+}
+async function listAccountAssignments(props) {
+  const assignments = [];
+  for (const permissionSet of props.permissionSets) {
+    const accountIds = await listAccountsForPermissionSet({
+      ssoAdminClient: props.ssoAdminClient,
+      instanceArn: props.instanceArn,
+      permissionSetArn: permissionSet.permissionSetArn
+    });
+    for (const accountId of accountIds) {
+      let nextToken;
+      do {
+        const response = await props.ssoAdminClient.send(
+          new ListAccountAssignmentsCommand({
+            InstanceArn: props.instanceArn,
+            AccountId: accountId,
+            PermissionSetArn: permissionSet.permissionSetArn,
+            NextToken: nextToken
+          })
+        );
+        for (const assignment of response.AccountAssignments ?? []) {
+          if (assignment.AccountId == null || assignment.PermissionSetArn == null || assignment.PrincipalId == null || assignment.PrincipalType == null) {
+            continue;
+          }
+          assignments.push({
+            accountId: assignment.AccountId,
+            permissionSetArn: assignment.PermissionSetArn,
+            principalId: assignment.PrincipalId,
+            principalType: assignment.PrincipalType
+          });
+        }
+        nextToken = response.NextToken;
+      } while (nextToken != null);
+    }
+  }
+  return assignments;
+}
+async function listAccountsForPermissionSet(props) {
+  const accountIds = [];
+  let nextToken;
+  do {
+    const response = await props.ssoAdminClient.send(
+      new ListAccountsForProvisionedPermissionSetCommand({
+        InstanceArn: props.instanceArn,
+        PermissionSetArn: props.permissionSetArn,
+        NextToken: nextToken
+      })
+    );
+    accountIds.push(...response.AccountIds ?? []);
+    nextToken = response.NextToken;
+  } while (nextToken != null);
+  return accountIds;
+}
+
+// src/applyLogic.ts
+import {
+  PutAccountNameCommand
+} from "@aws-sdk/client-account";
+import {
+  CreateOrganizationalUnitCommand,
+  DeleteOrganizationalUnitCommand,
+  ListAccountsForParentCommand,
+  ListOrganizationalUnitsForParentCommand as ListOrganizationalUnitsForParentCommand2,
+  MoveAccountCommand as MoveAccountCommand2,
+  TagResourceCommand,
+  UntagResourceCommand,
+  UpdateOrganizationalUnitCommand
+} from "@aws-sdk/client-organizations";
+import {
+  CreateGroupMembershipCommand,
+  CreateGroupCommand,
+  CreateUserCommand,
+  DeleteGroupCommand,
+  DeleteGroupMembershipCommand,
+  DeleteUserCommand,
+  GetGroupMembershipIdCommand,
+  UpdateGroupCommand,
+  UpdateUserCommand
+} from "@aws-sdk/client-identitystore";
+import {
+  CreateAccountAssignmentCommand,
+  AttachCustomerManagedPolicyReferenceToPermissionSetCommand,
+  AttachManagedPolicyToPermissionSetCommand,
+  CreatePermissionSetCommand,
+  DeleteAccountAssignmentCommand,
+  DeleteInlinePolicyFromPermissionSetCommand,
+  DeletePermissionSetCommand,
+  DescribeAccountAssignmentCreationStatusCommand,
+  DescribeAccountAssignmentDeletionStatusCommand,
+  DescribePermissionSetProvisioningStatusCommand,
+  DetachCustomerManagedPolicyReferenceFromPermissionSetCommand,
+  DetachManagedPolicyFromPermissionSetCommand,
+  ProvisionPermissionSetCommand,
+  PutInlinePolicyToPermissionSetCommand,
+  UpdatePermissionSetCommand
+} from "@aws-sdk/client-sso-admin";
+
+// src/accountCreation.ts
+import {
+  CreateAccountCommand,
+  DescribeCreateAccountStatusCommand,
+  ListAccountsCommand as ListAccountsCommand2,
+  MoveAccountCommand
+} from "@aws-sdk/client-organizations";
+async function createAccountAndMoveToOu(props) {
+  props.logger.log(
+    `Creating account "${props.accountName}" (${props.accountEmail})...`
+  );
+  const createResponse = await props.organizationsClient.send(
+    new CreateAccountCommand({
+      AccountName: props.accountName,
+      Email: props.accountEmail
+    })
+  );
+  const createRequestId = createResponse.CreateAccountStatus?.Id;
+  if (createRequestId == null) {
+    throw new Error("CreateAccount did not return a request id.");
+  }
+  const accountId = await pollCreateAccountStatusUntilTerminal({
+    organizationsClient: props.organizationsClient,
+    logger: props.logger,
+    createRequestId,
+    timeoutInMs: props.timeoutInMs,
+    pollIntervalInMs: props.pollIntervalInMs
+  });
+  props.logger.log(
+    `Moving account "${props.accountName}" (${accountId}) to destination OU (${props.destinationParentId})...`
+  );
+  await props.organizationsClient.send(
+    new MoveAccountCommand({
+      AccountId: accountId,
+      SourceParentId: props.sourceParentId,
+      DestinationParentId: props.destinationParentId
+    })
+  );
+  const account = await resolveCreatedAccountRecord({
+    organizationsClient: props.organizationsClient,
+    accountId,
+    destinationParentId: props.destinationParentId
+  });
+  return {
+    accountId,
+    account
+  };
+}
+async function pollCreateAccountStatusUntilTerminal(props) {
+  const startedAt = Date.now();
+  let lastStatus;
+  while (Date.now() - startedAt < props.timeoutInMs) {
+    const response = await props.organizationsClient.send(
+      new DescribeCreateAccountStatusCommand({
+        CreateAccountRequestId: props.createRequestId
+      })
+    );
+    const status = response.CreateAccountStatus;
+    const state = status?.State ?? "UNKNOWN";
+    if (state !== lastStatus) {
+      props.logger.log(`CreateAccount status: ${state}`);
+      lastStatus = state;
+    }
+    if (state === "SUCCEEDED") {
+      if (status?.AccountId == null) {
+        throw new Error(
+          "CreateAccount succeeded but response did not include AccountId."
+        );
+      }
+      return status.AccountId;
+    }
+    if (state === "FAILED") {
+      throw new Error(
+        `CreateAccount failed: ${status?.FailureReason ?? "unknown reason"}.`
+      );
+    }
+    await delay(props.pollIntervalInMs);
+  }
+  throw new Error(
+    `CreateAccount timed out after ${props.timeoutInMs}ms. Check AWS Organizations and retry.`
+  );
+}
+async function resolveCreatedAccountRecord(props) {
+  const account = await findAccountById({
+    organizationsClient: props.organizationsClient,
+    accountId: props.accountId
+  });
+  if (account == null) {
+    throw new Error(
+      `Created account "${props.accountId}" could not be resolved from AWS Organizations list.`
+    );
+  }
+  return {
+    id: account.id,
+    arn: account.arn,
+    name: account.name,
+    email: account.email,
+    status: account.status,
+    parentId: props.destinationParentId
+  };
+}
+async function findAccountById(props) {
+  let nextToken;
+  do {
+    const response = await props.organizationsClient.send(
+      new ListAccountsCommand2({ NextToken: nextToken })
+    );
+    const matched = (response.Accounts ?? []).find(
+      (account) => isCompleteAccountWithStatus(account, props.accountId)
+    );
+    if (matched?.Id != null && matched.Arn != null && matched.Name != null && matched.Email != null && matched.Status != null) {
+      return {
+        id: matched.Id,
+        arn: matched.Arn,
+        name: matched.Name,
+        email: matched.Email,
+        status: matched.Status
+      };
+    }
+    nextToken = response.NextToken;
+  } while (nextToken != null);
+  return void 0;
+}
+function isCompleteAccountWithStatus(account, expectedAccountId) {
+  if (account.Id == null || account.Arn == null || account.Name == null || account.Email == null || account.Status == null) {
+    return false;
+  }
+  if (expectedAccountId == null) {
+    return true;
+  }
+  return account.Id === expectedAccountId;
+}
+
+// src/applyLogic.ts
+async function executeOperation(props) {
+  const operation = props.operation;
+  if (operation.kind === "moveAccount") {
+    props.logger.log(
+      `Moving "${operation.accountName}" (${operation.accountId}): ${operation.fromOuName} -> ${operation.toOuName}`
+    );
+    await props.organizationsClient.send(
+      new MoveAccountCommand2({
+        AccountId: operation.accountId,
+        SourceParentId: operation.fromOuId,
+        DestinationParentId: operation.toOuId
+      })
+    );
+    props.logger.log(`Done: "${operation.accountName}"`);
+    return moveAccountInWorkingState({
+      workingState: props.state,
+      accountId: operation.accountId,
+      parentId: operation.toOuId
+    });
+  }
+  if (operation.kind === "createOu") {
+    props.logger.log(
+      `Creating OU "${operation.ouName}" under ${operation.parentOuName}...`
+    );
+    const response = await props.organizationsClient.send(
+      new CreateOrganizationalUnitCommand({
+        ParentId: operation.parentOuId,
+        Name: operation.ouName
+      })
+    );
+    const createdOu = response.OrganizationalUnit;
+    if (createdOu?.Id == null || createdOu.Arn == null || createdOu.Name == null) {
+      throw new Error(
+        `CreateOrganizationalUnit for "${operation.ouName}" returned incomplete OU data.`
+      );
+    }
+    props.logger.log(`Done: "${createdOu.Name}"`);
+    return upsertOrganizationalUnitInWorkingState({
+      workingState: props.state,
+      organizationalUnit: {
+        id: createdOu.Id,
+        parentId: operation.parentOuId,
+        arn: createdOu.Arn,
+        name: createdOu.Name
+      }
+    });
+  }
+  if (operation.kind === "renameOu") {
+    props.logger.log(
+      `Renaming OU "${operation.fromOuName}" -> "${operation.toOuName}"...`
+    );
+    await props.organizationsClient.send(
+      new UpdateOrganizationalUnitCommand({
+        OrganizationalUnitId: operation.ouId,
+        Name: operation.toOuName
+      })
+    );
+    props.logger.log(`Done: "${operation.toOuName}"`);
+    return renameOrganizationalUnitInWorkingState({
+      workingState: props.state,
+      organizationalUnitId: operation.ouId,
+      name: operation.toOuName
+    });
+  }
+  if (operation.kind === "deleteOu") {
+    props.logger.log(`Deleting OU "${operation.ouName}"...`);
+    await assertOrganizationalUnitIsEmpty({
+      organizationsClient: props.organizationsClient,
+      organizationalUnitId: operation.ouId,
+      organizationalUnitName: operation.ouName
+    });
+    await props.organizationsClient.send(
+      new DeleteOrganizationalUnitCommand({
+        OrganizationalUnitId: operation.ouId
+      })
+    );
+    props.logger.log(`Done: "${operation.ouName}"`);
+    return removeOrganizationalUnitFromWorkingState({
+      workingState: props.state,
+      organizationalUnitId: operation.ouId
+    });
+  }
+  if (operation.kind === "createAccount") {
+    const result = await createAccountAndMoveToOu({
+      organizationsClient: props.organizationsClient,
+      logger: props.logger,
+      accountName: operation.accountName,
+      accountEmail: operation.accountEmail,
+      sourceParentId: props.context.organization.rootId,
+      destinationParentId: operation.targetOuId,
+      timeoutInMs: props.runtime.createAccount.timeoutInMs,
+      pollIntervalInMs: props.runtime.createAccount.pollIntervalInMs
+    });
+    return upsertAccountInWorkingState({
+      workingState: props.state,
+      account: {
+        id: result.account.id,
+        arn: result.account.arn,
+        name: result.account.name,
+        email: result.account.email,
+        status: result.account.status,
+        parentId: operation.targetOuId,
+        tags: []
+      }
+    });
+  }
+  if (operation.kind === "updateAccountTags") {
+    const account = props.state.organization.accountsById[operation.accountId];
+    if (account == null) {
+      throw new Error(
+        `Could not resolve account "${operation.accountName}" (${operation.accountId}) in working state.`
+      );
+    }
+    const currentTags = new Map(
+      (account.tags ?? []).map((tag) => [tag.key, tag.value])
+    );
+    const desiredTags = new Map(Object.entries(operation.tags));
+    const tagsToApply = [...desiredTags.entries()].filter(([key, value]) => currentTags.get(key) !== value).map(([Key, Value]) => ({ Key, Value }));
+    const tagKeysToRemove = [...currentTags.keys()].filter(
+      (key) => desiredTags.has(key) === false
+    );
+    props.logger.log(
+      `Updating account tags "${operation.accountName}" (${operation.accountId})...`
+    );
+    if (tagsToApply.length > 0) {
+      await props.organizationsClient.send(
+        new TagResourceCommand({
+          ResourceId: operation.accountId,
+          Tags: tagsToApply
+        })
+      );
+    }
+    if (tagKeysToRemove.length > 0) {
+      await props.organizationsClient.send(
+        new UntagResourceCommand({
+          ResourceId: operation.accountId,
+          TagKeys: tagKeysToRemove
+        })
+      );
+    }
+    props.logger.log(`Done: tags updated for "${operation.accountName}"`);
+    return upsertAccountInWorkingState({
+      workingState: props.state,
+      account: {
+        ...account,
+        tags: Object.entries(operation.tags).map(([key, value]) => ({ key, value }))
+      }
+    });
+  }
+  if (operation.kind === "updateAccountName") {
+    props.logger.log(
+      `Renaming account (${operation.accountId}): "${operation.fromAccountName}" -> "${operation.toAccountName}"...`
+    );
+    await props.accountClient.send(
+      new PutAccountNameCommand({
+        AccountId: operation.accountId,
+        AccountName: operation.toAccountName
+      })
+    );
+    props.logger.log(
+      `Done: account "${operation.toAccountName}" (${operation.accountId})`
+    );
+    const account = props.state.organization.accountsById[operation.accountId];
+    if (account == null) {
+      throw new Error(
+        `Could not resolve account (${operation.accountId}) in working state after rename.`
+      );
+    }
+    return upsertAccountInWorkingState({
+      workingState: props.state,
+      account: {
+        ...account,
+        name: operation.toAccountName
+      }
+    });
+  }
+  if (operation.kind === "removeAccount") {
+    props.logger.log(
+      `Moving removed account "${operation.accountName}" (${operation.accountId}) to ${operation.toOuName}...`
+    );
+    await props.organizationsClient.send(
+      new MoveAccountCommand2({
+        AccountId: operation.accountId,
+        SourceParentId: operation.fromOuId,
+        DestinationParentId: operation.toOuId
+      })
+    );
+    props.logger.log(`Done: "${operation.accountName}" -> ${operation.toOuName}`);
+    return moveAccountInWorkingState({
+      workingState: props.state,
+      accountId: operation.accountId,
+      parentId: operation.toOuId
+    });
+  }
+  if (operation.kind === "createIdcUser") {
+    props.logger.log(`Creating IdC user "${operation.userName}"...`);
+    const response = await props.identityStoreClient.send(
+      new CreateUserCommand({
+        IdentityStoreId: props.state.identityCenter.identityStoreId,
+        UserName: operation.userName,
+        DisplayName: operation.displayName,
+        Name: buildIdentityStoreUserName({
+          userName: operation.userName,
+          displayName: operation.displayName
+        }),
+        Emails: operation.email.length > 0 ? [
+          {
+            Value: operation.email,
+            Type: "Work",
+            Primary: true
+          }
+        ] : void 0
+      })
+    );
+    if (response.UserId == null) {
+      throw new Error(
+        `CreateUser for "${operation.userName}" returned no user id.`
+      );
+    }
+    props.logger.log(`Done: "${operation.userName}"`);
+    return upsertIdcUserInWorkingState({
+      workingState: props.state,
+      user: {
+        userId: response.UserId,
+        userName: operation.userName,
+        displayName: operation.displayName,
+        email: operation.email
+      }
+    });
+  }
+  if (operation.kind === "updateIdcUser") {
+    const user = resolveUserByName({
+      state: props.state,
+      userName: operation.userName
+    });
+    const operations = [];
+    if (user.displayName !== operation.displayName) {
+      operations.push({
+        AttributePath: "displayName",
+        AttributeValue: operation.displayName
+      });
+      operations.push({
+        AttributePath: "name",
+        AttributeValue: buildIdentityStoreUserName({
+          userName: operation.userName,
+          displayName: operation.displayName
+        })
+      });
+    }
+    if (user.email !== operation.email && operation.email.length > 0) {
+      operations.push({
+        AttributePath: "emails",
+        AttributeValue: [
+          {
+            Value: operation.email,
+            Type: "Work",
+            Primary: true
+          }
+        ]
+      });
+    }
+    if (operations.length === 0) {
+      return props.state;
+    }
+    props.logger.log(`Updating IdC user "${operation.userName}"...`);
+    await props.identityStoreClient.send(
+      new UpdateUserCommand({
+        IdentityStoreId: props.state.identityCenter.identityStoreId,
+        UserId: user.userId,
+        Operations: operations
+      })
+    );
+    props.logger.log(`Done: "${operation.userName}"`);
+    return upsertIdcUserInWorkingState({
+      workingState: props.state,
+      user: {
+        ...user,
+        displayName: operation.displayName,
+        email: operation.email.length > 0 ? operation.email : user.email
+      }
+    });
+  }
+  if (operation.kind === "deleteIdcUser") {
+    const user = resolveUserByName({
+      state: props.state,
+      userName: operation.userName
+    });
+    props.logger.log(`Deleting IdC user "${operation.userName}"...`);
+    await props.identityStoreClient.send(
+      new DeleteUserCommand({
+        IdentityStoreId: props.state.identityCenter.identityStoreId,
+        UserId: user.userId
+      })
+    );
+    props.logger.log(`Done: "${operation.userName}"`);
+    return removeIdcUserFromWorkingState({
+      workingState: props.state,
+      userName: operation.userName
+    });
+  }
+  if (operation.kind === "createIdcGroup") {
+    props.logger.log(`Creating IdC group "${operation.groupDisplayName}"...`);
+    const response = await props.identityStoreClient.send(
+      new CreateGroupCommand({
+        IdentityStoreId: props.state.identityCenter.identityStoreId,
+        DisplayName: operation.groupDisplayName,
+        Description: operation.description.trim().length > 0 ? operation.description : void 0
+      })
+    );
+    if (response.GroupId == null) {
+      throw new Error(
+        `CreateGroup for "${operation.groupDisplayName}" returned no group id.`
+      );
+    }
+    props.logger.log(`Done: "${operation.groupDisplayName}"`);
+    return upsertIdcGroupInWorkingState({
+      workingState: props.state,
+      group: {
+        groupId: response.GroupId,
+        displayName: operation.groupDisplayName,
+        description: operation.description
+      }
+    });
+  }
+  if (operation.kind === "updateIdcGroupDescription") {
+    const group = resolveGroupByDisplayName({
+      state: props.state,
+      groupDisplayName: operation.groupDisplayName
+    });
+    props.logger.log(
+      `Updating IdC group description for "${operation.groupDisplayName}"...`
+    );
+    await props.identityStoreClient.send(
+      new UpdateGroupCommand({
+        IdentityStoreId: props.state.identityCenter.identityStoreId,
+        GroupId: group.groupId,
+        Operations: [
+          {
+            AttributePath: "description",
+            AttributeValue: operation.description
+          }
+        ]
+      })
+    );
+    props.logger.log(`Done: group "${operation.groupDisplayName}"`);
+    return upsertIdcGroupInWorkingState({
+      workingState: props.state,
+      group: {
+        ...group,
+        description: operation.description
+      }
+    });
+  }
+  if (operation.kind === "deleteIdcGroup") {
+    const group = resolveGroupByDisplayName({
+      state: props.state,
+      groupDisplayName: operation.groupDisplayName
+    });
+    props.logger.log(`Deleting IdC group "${operation.groupDisplayName}"...`);
+    await props.identityStoreClient.send(
+      new DeleteGroupCommand({
+        IdentityStoreId: props.state.identityCenter.identityStoreId,
+        GroupId: group.groupId
+      })
+    );
+    props.logger.log(`Done: "${operation.groupDisplayName}"`);
+    return removeIdcGroupFromWorkingState({
+      workingState: props.state,
+      groupDisplayName: operation.groupDisplayName
+    });
+  }
+  if (operation.kind === "addIdcGroupMembership") {
+    const resolvedMembership = resolveGroupMembershipDependencies({
+      state: props.state,
+      groupDisplayName: operation.groupDisplayName,
+      userName: operation.userName
+    });
+    props.logger.log(
+      `Adding user "${operation.userName}" to IdC group "${operation.groupDisplayName}"...`
+    );
+    const response = await props.identityStoreClient.send(
+      new CreateGroupMembershipCommand({
+        IdentityStoreId: props.state.identityCenter.identityStoreId,
+        GroupId: resolvedMembership.groupId,
+        MemberId: {
+          UserId: resolvedMembership.userId
+        }
+      })
+    );
+    if (response.MembershipId == null) {
+      throw new Error(
+        `CreateGroupMembership for group "${operation.groupDisplayName}" and user "${operation.userName}" returned no membership id.`
+      );
+    }
+    props.logger.log(
+      `Done: user "${operation.userName}" -> group "${operation.groupDisplayName}"`
+    );
+    return addGroupMembershipToWorkingState({
+      workingState: props.state,
+      groupMembership: {
+        membershipId: response.MembershipId,
+        groupId: resolvedMembership.groupId,
+        userId: resolvedMembership.userId
+      }
+    });
+  }
+  if (operation.kind === "createIdcPermissionSet") {
+    props.logger.log(
+      `Creating IdC permission set "${operation.permissionSetName}"...`
+    );
+    const response = await props.ssoAdminClient.send(
+      new CreatePermissionSetCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        Name: operation.permissionSetName,
+        Description: operation.description.length > 0 ? operation.description : void 0
+      })
+    );
+    const permissionSetArn = response.PermissionSet?.PermissionSetArn;
+    if (permissionSetArn == null) {
+      throw new Error(
+        `CreatePermissionSet for "${operation.permissionSetName}" returned no permission set arn.`
+      );
+    }
+    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    return upsertIdcPermissionSetInWorkingState({
+      workingState: props.state,
+      permissionSet: {
+        permissionSetArn,
+        name: operation.permissionSetName,
+        description: operation.description,
+        inlinePolicy: null,
+        awsManagedPolicies: [],
+        customerManagedPolicies: []
+      }
+    });
+  }
+  if (operation.kind === "updateIdcPermissionSetDescription") {
+    const permissionSet = resolvePermissionSetByName({
+      state: props.state,
+      permissionSetName: operation.permissionSetName
+    });
+    props.logger.log(
+      `Updating IdC permission set description for "${operation.permissionSetName}"...`
+    );
+    await props.ssoAdminClient.send(
+      new UpdatePermissionSetCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        PermissionSetArn: permissionSet.permissionSetArn,
+        Description: operation.description.trim().length > 0 ? operation.description : void 0
+      })
+    );
+    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    return upsertIdcPermissionSetInWorkingState({
+      workingState: props.state,
+      permissionSet: {
+        ...permissionSet,
+        description: operation.description
+      }
+    });
+  }
+  if (operation.kind === "deleteIdcPermissionSet") {
+    const permissionSet = resolvePermissionSetByName({
+      state: props.state,
+      permissionSetName: operation.permissionSetName
+    });
+    props.logger.log(
+      `Deleting IdC permission set "${operation.permissionSetName}"...`
+    );
+    await props.ssoAdminClient.send(
+      new DeletePermissionSetCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        PermissionSetArn: permissionSet.permissionSetArn
+      })
+    );
+    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    return removeIdcPermissionSetFromWorkingState({
+      workingState: props.state,
+      permissionSetName: operation.permissionSetName
+    });
+  }
+  if (operation.kind === "putIdcPermissionSetInlinePolicy") {
+    const permissionSet = resolvePermissionSetByName({
+      state: props.state,
+      permissionSetName: operation.permissionSetName
+    });
+    props.logger.log(
+      `Putting inline policy on IdC permission set "${operation.permissionSetName}"...`
+    );
+    await props.ssoAdminClient.send(
+      new PutInlinePolicyToPermissionSetCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        PermissionSetArn: permissionSet.permissionSetArn,
+        InlinePolicy: operation.inlinePolicy
+      })
+    );
+    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    return upsertPermissionSetPolicyState({
+      state: props.state,
+      permissionSetName: operation.permissionSetName,
+      update: (currentPermissionSet) => ({
+        ...currentPermissionSet,
+        inlinePolicy: operation.inlinePolicy
+      })
+    });
+  }
+  if (operation.kind === "deleteIdcPermissionSetInlinePolicy") {
+    const permissionSet = resolvePermissionSetByName({
+      state: props.state,
+      permissionSetName: operation.permissionSetName
+    });
+    props.logger.log(
+      `Deleting inline policy from IdC permission set "${operation.permissionSetName}"...`
+    );
+    await props.ssoAdminClient.send(
+      new DeleteInlinePolicyFromPermissionSetCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        PermissionSetArn: permissionSet.permissionSetArn
+      })
+    );
+    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    return upsertPermissionSetPolicyState({
+      state: props.state,
+      permissionSetName: operation.permissionSetName,
+      update: (currentPermissionSet) => ({
+        ...currentPermissionSet,
+        inlinePolicy: null
+      })
+    });
+  }
+  if (operation.kind === "attachIdcManagedPolicyToPermissionSet") {
+    const permissionSet = resolvePermissionSetByName({
+      state: props.state,
+      permissionSetName: operation.permissionSetName
+    });
+    props.logger.log(
+      `Attaching managed policy "${operation.managedPolicyArn}" to IdC permission set "${operation.permissionSetName}"...`
+    );
+    await props.ssoAdminClient.send(
+      new AttachManagedPolicyToPermissionSetCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        PermissionSetArn: permissionSet.permissionSetArn,
+        ManagedPolicyArn: operation.managedPolicyArn
+      })
+    );
+    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    return upsertPermissionSetPolicyState({
+      state: props.state,
+      permissionSetName: operation.permissionSetName,
+      update: (currentPermissionSet) => ({
+        ...currentPermissionSet,
+        awsManagedPolicies: [
+          ...currentPermissionSet.awsManagedPolicies,
+          operation.managedPolicyArn
+        ]
+      })
+    });
+  }
+  if (operation.kind === "detachIdcManagedPolicyFromPermissionSet") {
+    const permissionSet = resolvePermissionSetByName({
+      state: props.state,
+      permissionSetName: operation.permissionSetName
+    });
+    props.logger.log(
+      `Detaching managed policy "${operation.managedPolicyArn}" from IdC permission set "${operation.permissionSetName}"...`
+    );
+    await props.ssoAdminClient.send(
+      new DetachManagedPolicyFromPermissionSetCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        PermissionSetArn: permissionSet.permissionSetArn,
+        ManagedPolicyArn: operation.managedPolicyArn
+      })
+    );
+    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    return upsertPermissionSetPolicyState({
+      state: props.state,
+      permissionSetName: operation.permissionSetName,
+      update: (currentPermissionSet) => ({
+        ...currentPermissionSet,
+        awsManagedPolicies: currentPermissionSet.awsManagedPolicies.filter(
+          (managedPolicyArn) => managedPolicyArn !== operation.managedPolicyArn
+        )
+      })
+    });
+  }
+  if (operation.kind === "attachIdcCustomerManagedPolicyReferenceToPermissionSet") {
+    const permissionSet = resolvePermissionSetByName({
+      state: props.state,
+      permissionSetName: operation.permissionSetName
+    });
+    props.logger.log(
+      `Attaching customer-managed policy "${operation.customerManagedPolicyPath}${operation.customerManagedPolicyName}" to IdC permission set "${operation.permissionSetName}"...`
+    );
+    await props.ssoAdminClient.send(
+      new AttachCustomerManagedPolicyReferenceToPermissionSetCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        PermissionSetArn: permissionSet.permissionSetArn,
+        CustomerManagedPolicyReference: {
+          Name: operation.customerManagedPolicyName,
+          Path: operation.customerManagedPolicyPath
+        }
+      })
+    );
+    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    return upsertPermissionSetPolicyState({
+      state: props.state,
+      permissionSetName: operation.permissionSetName,
+      update: (currentPermissionSet) => ({
+        ...currentPermissionSet,
+        customerManagedPolicies: [
+          ...currentPermissionSet.customerManagedPolicies,
+          {
+            name: operation.customerManagedPolicyName,
+            path: operation.customerManagedPolicyPath
+          }
+        ]
+      })
+    });
+  }
+  if (operation.kind === "detachIdcCustomerManagedPolicyReferenceFromPermissionSet") {
+    const permissionSet = resolvePermissionSetByName({
+      state: props.state,
+      permissionSetName: operation.permissionSetName
+    });
+    props.logger.log(
+      `Detaching customer-managed policy "${operation.customerManagedPolicyPath}${operation.customerManagedPolicyName}" from IdC permission set "${operation.permissionSetName}"...`
+    );
+    await props.ssoAdminClient.send(
+      new DetachCustomerManagedPolicyReferenceFromPermissionSetCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        PermissionSetArn: permissionSet.permissionSetArn,
+        CustomerManagedPolicyReference: {
+          Name: operation.customerManagedPolicyName,
+          Path: operation.customerManagedPolicyPath
+        }
+      })
+    );
+    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    return upsertPermissionSetPolicyState({
+      state: props.state,
+      permissionSetName: operation.permissionSetName,
+      update: (currentPermissionSet) => ({
+        ...currentPermissionSet,
+        customerManagedPolicies: currentPermissionSet.customerManagedPolicies.filter(
+          (customerManagedPolicy) => customerManagedPolicy.name !== operation.customerManagedPolicyName || customerManagedPolicy.path !== operation.customerManagedPolicyPath
+        )
+      })
+    });
+  }
+  if (operation.kind === "provisionIdcPermissionSet") {
+    const permissionSet = resolvePermissionSetByName({
+      state: props.state,
+      permissionSetName: operation.permissionSetName
+    });
+    props.logger.log(
+      `Provisioning IdC permission set "${operation.permissionSetName}" to all provisioned accounts...`
+    );
+    const response = await props.ssoAdminClient.send(
+      new ProvisionPermissionSetCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        PermissionSetArn: permissionSet.permissionSetArn,
+        TargetType: operation.targetScope
+      })
+    );
+    const requestId = response.PermissionSetProvisioningStatus?.RequestId ?? void 0;
+    if (requestId == null) {
+      throw new Error(
+        `ProvisionPermissionSet for "${operation.permissionSetName}" returned no request id.`
+      );
+    }
+    await waitForPermissionSetProvisioningSuccess({
+      ssoAdminClient: props.ssoAdminClient,
+      logger: props.logger,
+      instanceArn: props.state.identityCenter.instanceArn,
+      requestId,
+      timeoutInMs: props.runtime.permissionSetProvisioning.timeoutInMs,
+      pollIntervalInMs: props.runtime.permissionSetProvisioning.pollIntervalInMs,
+      operationLabel: `"${operation.permissionSetName}"`
+    });
+    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    return props.state;
+  }
+  if (operation.kind === "removeIdcGroupMembership") {
+    const resolvedMembership = resolveGroupMembershipDependencies({
+      state: props.state,
+      groupDisplayName: operation.groupDisplayName,
+      userName: operation.userName
+    });
+    const membershipId = await resolveGroupMembershipId({
+      state: props.state,
+      identityStoreClient: props.identityStoreClient,
+      groupId: resolvedMembership.groupId,
+      userId: resolvedMembership.userId
+    });
+    props.logger.log(
+      `Removing user "${operation.userName}" from IdC group "${operation.groupDisplayName}"...`
+    );
+    await props.identityStoreClient.send(
+      new DeleteGroupMembershipCommand({
+        IdentityStoreId: props.state.identityCenter.identityStoreId,
+        MembershipId: membershipId
+      })
+    );
+    props.logger.log(
+      `Done: user "${operation.userName}" x group "${operation.groupDisplayName}"`
+    );
+    return removeGroupMembershipFromWorkingState({
+      workingState: props.state,
+      groupMembership: {
+        groupId: resolvedMembership.groupId,
+        userId: resolvedMembership.userId
+      }
+    });
+  }
+  if (operation.kind === "grantIdcAccountAssignment") {
+    const resolvedAssignment = resolveAssignmentDependencies({
+      state: props.state,
+      accountName: operation.accountName,
+      permissionSetName: operation.permissionSetName,
+      principalType: operation.principalType,
+      principalName: operation.principalName
+    });
+    props.logger.log(
+      `Granting IdC assignment "${operation.permissionSetName}" to ${formatPrincipalLabel(
+        {
+          principalType: operation.principalType,
+          principalName: operation.principalName
+        }
+      )} on "${operation.accountName}"...`
+    );
+    const response = await props.ssoAdminClient.send(
+      new CreateAccountAssignmentCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        TargetId: resolvedAssignment.accountId,
+        TargetType: "AWS_ACCOUNT",
+        PermissionSetArn: resolvedAssignment.permissionSetArn,
+        PrincipalType: resolvedAssignment.principalType,
+        PrincipalId: resolvedAssignment.principalId
+      })
+    );
+    const requestId = response.AccountAssignmentCreationStatus?.RequestId;
+    if (requestId == null) {
+      throw new Error(
+        `CreateAccountAssignment for "${operation.permissionSetName}" on "${operation.accountName}" returned no request id.`
+      );
+    }
+    await waitForAccountAssignmentCreationSuccess({
+      ssoAdminClient: props.ssoAdminClient,
+      logger: props.logger,
+      instanceArn: props.state.identityCenter.instanceArn,
+      requestId,
+      timeoutInMs: props.runtime.accountAssignment.timeoutInMs,
+      pollIntervalInMs: props.runtime.accountAssignment.pollIntervalInMs,
+      operationLabel: `"${operation.permissionSetName}" on "${operation.accountName}"`
+    });
+    props.logger.log(
+      `Done: "${operation.permissionSetName}" -> "${operation.accountName}"`
+    );
+    return addAccountAssignmentToWorkingState({
+      workingState: props.state,
+      accountAssignment: {
+        accountId: resolvedAssignment.accountId,
+        permissionSetArn: resolvedAssignment.permissionSetArn,
+        principalId: resolvedAssignment.principalId,
+        principalType: resolvedAssignment.principalType
+      }
+    });
+  }
+  if (operation.kind === "revokeIdcAccountAssignment") {
+    const resolvedAssignment = resolveAssignmentDependencies({
+      state: props.state,
+      accountName: operation.accountName,
+      permissionSetName: operation.permissionSetName,
+      principalType: operation.principalType,
+      principalName: operation.principalName
+    });
+    props.logger.log(
+      `Revoking IdC assignment "${operation.permissionSetName}" from ${formatPrincipalLabel(
+        {
+          principalType: operation.principalType,
+          principalName: operation.principalName
+        }
+      )} on "${operation.accountName}"...`
+    );
+    const response = await props.ssoAdminClient.send(
+      new DeleteAccountAssignmentCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        TargetId: resolvedAssignment.accountId,
+        TargetType: "AWS_ACCOUNT",
+        PermissionSetArn: resolvedAssignment.permissionSetArn,
+        PrincipalType: resolvedAssignment.principalType,
+        PrincipalId: resolvedAssignment.principalId
+      })
+    );
+    const requestId = response.AccountAssignmentDeletionStatus?.RequestId;
+    if (requestId == null) {
+      throw new Error(
+        `DeleteAccountAssignment for "${operation.permissionSetName}" on "${operation.accountName}" returned no request id.`
+      );
+    }
+    await waitForAccountAssignmentDeletionSuccess({
+      ssoAdminClient: props.ssoAdminClient,
+      logger: props.logger,
+      instanceArn: props.state.identityCenter.instanceArn,
+      requestId,
+      timeoutInMs: props.runtime.accountAssignment.timeoutInMs,
+      pollIntervalInMs: props.runtime.accountAssignment.pollIntervalInMs,
+      operationLabel: `"${operation.permissionSetName}" on "${operation.accountName}"`
+    });
+    props.logger.log(
+      `Done: "${operation.permissionSetName}" x "${operation.accountName}"`
+    );
+    return removeAccountAssignmentFromWorkingState({
+      workingState: props.state,
+      accountAssignment: {
+        accountId: resolvedAssignment.accountId,
+        permissionSetArn: resolvedAssignment.permissionSetArn,
+        principalId: resolvedAssignment.principalId,
+        principalType: resolvedAssignment.principalType
+      }
+    });
+  }
+  assertUnreachable(operation, "Unsupported operation kind in apply.");
+}
+function resolveAssignmentDependencies(props) {
+  const account = props.state.organization.accountsByName[props.accountName];
+  if (account == null) {
+    throw new Error(
+      `Could not resolve account "${props.accountName}" in working state.`
+    );
+  }
+  const permissionSet = props.state.identityCenter.permissionSetsByName[props.permissionSetName];
+  if (permissionSet == null) {
+    throw new Error(
+      `Could not resolve permission set "${props.permissionSetName}" in working state.`
+    );
+  }
+  if (props.principalType === "GROUP") {
+    const group = props.state.identityCenter.groupsByDisplayName[props.principalName];
+    if (group == null) {
+      throw new Error(
+        `Could not resolve group "${props.principalName}" in working state.`
+      );
+    }
+    return {
+      accountId: account.id,
+      permissionSetArn: permissionSet.permissionSetArn,
+      principalId: group.groupId,
+      principalType: props.principalType
+    };
+  }
+  const user = props.state.identityCenter.usersByUserName[props.principalName];
+  if (user == null) {
+    throw new Error(
+      `Could not resolve user "${props.principalName}" in working state.`
+    );
+  }
+  return {
+    accountId: account.id,
+    permissionSetArn: permissionSet.permissionSetArn,
+    principalId: user.userId,
+    principalType: props.principalType
+  };
+}
+function resolveUserByName(props) {
+  const user = props.state.identityCenter.usersByUserName[props.userName];
+  if (user == null) {
+    throw new Error(
+      `Could not resolve user "${props.userName}" in working state.`
+    );
+  }
+  return user;
+}
+function resolveGroupByDisplayName(props) {
+  const group = props.state.identityCenter.groupsByDisplayName[props.groupDisplayName];
+  if (group == null) {
+    throw new Error(
+      `Could not resolve group "${props.groupDisplayName}" in working state.`
+    );
+  }
+  return group;
+}
+function resolvePermissionSetByName(props) {
+  const permissionSet = props.state.identityCenter.permissionSetsByName[props.permissionSetName];
+  if (permissionSet == null) {
+    throw new Error(
+      `Could not resolve permission set "${props.permissionSetName}" in working state.`
+    );
+  }
+  return permissionSet;
+}
+function upsertPermissionSetPolicyState(props) {
+  const permissionSet = resolvePermissionSetByName({
+    state: props.state,
+    permissionSetName: props.permissionSetName
+  });
+  const nextPermissionSet = props.update(permissionSet);
+  return upsertIdcPermissionSetInWorkingState({
+    workingState: props.state,
+    permissionSet: {
+      ...nextPermissionSet,
+      awsManagedPolicies: [...new Set(nextPermissionSet.awsManagedPolicies)].sort(
+        (left, right) => left.localeCompare(right)
+      ),
+      customerManagedPolicies: [
+        ...nextPermissionSet.customerManagedPolicies
+      ].sort((left, right) => {
+        const pathComparison = left.path.localeCompare(right.path);
+        if (pathComparison !== 0) {
+          return pathComparison;
+        }
+        return left.name.localeCompare(right.name);
+      })
+    }
+  });
+}
+function buildIdentityStoreUserName(props) {
+  const normalizedDisplayName = props.displayName.trim();
+  const fallbackName = normalizedDisplayName.length > 0 ? normalizedDisplayName : props.userName;
+  const [givenName, ...familyNameParts] = fallbackName.split(/\s+/).filter((part) => part.length > 0);
+  const familyName = familyNameParts.join(" ");
+  return {
+    Formatted: fallbackName,
+    GivenName: givenName ?? fallbackName,
+    FamilyName: familyName.length > 0 ? familyName : fallbackName
+  };
+}
+async function assertOrganizationalUnitIsEmpty(props) {
+  const childOrganizationalUnit = await listFirstChildOrganizationalUnit({
+    organizationsClient: props.organizationsClient,
+    parentId: props.organizationalUnitId
+  });
+  if (childOrganizationalUnit != null) {
+    throw new Error(
+      `Refusing to delete OU "${props.organizationalUnitName}": live AWS preflight failed [child-ou-present]: ${formatLivePreflightResource({
+        resourceType: "child OU",
+        name: childOrganizationalUnit.Name,
+        id: childOrganizationalUnit.Id
+      })} is still attached.`
+    );
+  }
+  const account = await listFirstAccountForParent({
+    organizationsClient: props.organizationsClient,
+    parentId: props.organizationalUnitId
+  });
+  if (account != null) {
+    throw new Error(
+      `Refusing to delete OU "${props.organizationalUnitName}": live AWS preflight failed [account-present]: ${formatLivePreflightResource({
+        resourceType: "account",
+        name: account.Name,
+        id: account.Id
+      })} is still attached.`
+    );
+  }
+}
+function formatLivePreflightResource(props) {
+  const quotedName = props.name != null ? `"${props.name}"` : void 0;
+  if (quotedName != null && props.id != null) {
+    return `${props.resourceType} ${quotedName} (${props.id})`;
+  }
+  if (quotedName != null) {
+    return `${props.resourceType} ${quotedName}`;
+  }
+  if (props.id != null) {
+    return `${props.resourceType} (${props.id})`;
+  }
+  return `${props.resourceType} "unknown"`;
+}
+async function listFirstChildOrganizationalUnit(props) {
+  let nextToken;
+  do {
+    const response = await props.organizationsClient.send(
+      new ListOrganizationalUnitsForParentCommand2({
+        ParentId: props.parentId,
+        NextToken: nextToken
+      })
+    );
+    const organizationalUnit = response.OrganizationalUnits?.[0];
+    if (organizationalUnit != null) {
+      return organizationalUnit;
+    }
+    nextToken = response.NextToken;
+  } while (nextToken != null);
+  return void 0;
+}
+async function listFirstAccountForParent(props) {
+  let nextToken;
+  do {
+    const response = await props.organizationsClient.send(
+      new ListAccountsForParentCommand({
+        ParentId: props.parentId,
+        NextToken: nextToken
+      })
+    );
+    const account = response.Accounts?.[0];
+    if (account != null) {
+      return account;
+    }
+    nextToken = response.NextToken;
+  } while (nextToken != null);
+  return void 0;
+}
+async function waitForAccountAssignmentCreationSuccess(props) {
+  const startedAt = Date.now();
+  let lastStatus;
+  while (Date.now() - startedAt < props.timeoutInMs) {
+    const response = await props.ssoAdminClient.send(
+      new DescribeAccountAssignmentCreationStatusCommand({
+        InstanceArn: props.instanceArn,
+        AccountAssignmentCreationRequestId: props.requestId
+      })
+    );
+    const status = response.AccountAssignmentCreationStatus;
+    const state = status?.Status ?? "UNKNOWN";
+    if (state !== lastStatus) {
+      props.logger.log(`CreateAccountAssignment status: ${state}`);
+      lastStatus = state;
+    }
+    if (state === "SUCCEEDED") {
+      return;
+    }
+    if (state === "FAILED") {
+      throw new Error(
+        `CreateAccountAssignment failed for ${props.operationLabel}: ${status?.FailureReason ?? "unknown reason"}.`
+      );
+    }
+    await delay(props.pollIntervalInMs);
+  }
+  throw new Error(
+    `CreateAccountAssignment timed out after ${props.timeoutInMs}ms for ${props.operationLabel}.`
+  );
+}
+async function waitForAccountAssignmentDeletionSuccess(props) {
+  const startedAt = Date.now();
+  let lastStatus;
+  while (Date.now() - startedAt < props.timeoutInMs) {
+    const response = await props.ssoAdminClient.send(
+      new DescribeAccountAssignmentDeletionStatusCommand({
+        InstanceArn: props.instanceArn,
+        AccountAssignmentDeletionRequestId: props.requestId
+      })
+    );
+    const status = response.AccountAssignmentDeletionStatus;
+    const state = status?.Status ?? "UNKNOWN";
+    if (state !== lastStatus) {
+      props.logger.log(`DeleteAccountAssignment status: ${state}`);
+      lastStatus = state;
+    }
+    if (state === "SUCCEEDED") {
+      return;
+    }
+    if (state === "FAILED") {
+      throw new Error(
+        `DeleteAccountAssignment failed for ${props.operationLabel}: ${status?.FailureReason ?? "unknown reason"}.`
+      );
+    }
+    await delay(props.pollIntervalInMs);
+  }
+  throw new Error(
+    `DeleteAccountAssignment timed out after ${props.timeoutInMs}ms for ${props.operationLabel}.`
+  );
+}
+async function waitForPermissionSetProvisioningSuccess(props) {
+  const startedAt = Date.now();
+  let lastStatus;
+  while (Date.now() - startedAt < props.timeoutInMs) {
+    const response = await props.ssoAdminClient.send(
+      new DescribePermissionSetProvisioningStatusCommand({
+        InstanceArn: props.instanceArn,
+        ProvisionPermissionSetRequestId: props.requestId
+      })
+    );
+    const status = response.PermissionSetProvisioningStatus;
+    const state = status?.Status ?? "UNKNOWN";
+    if (state !== lastStatus) {
+      props.logger.log(`ProvisionPermissionSet status: ${state}`);
+      lastStatus = state;
+    }
+    if (state === "SUCCEEDED") {
+      return;
+    }
+    if (state === "FAILED") {
+      throw new Error(
+        `ProvisionPermissionSet failed for ${props.operationLabel}: ${status?.FailureReason ?? "unknown reason"}.`
+      );
+    }
+    await delay(props.pollIntervalInMs);
+  }
+  throw new Error(
+    `ProvisionPermissionSet timed out after ${props.timeoutInMs}ms for ${props.operationLabel}.`
+  );
+}
+function formatPrincipalLabel(props) {
+  if (props.principalType === "GROUP") {
+    return `group "${props.principalName}"`;
+  }
+  return `user "${props.principalName}"`;
+}
+function resolveGroupMembershipDependencies(props) {
+  const group = props.state.identityCenter.groupsByDisplayName[props.groupDisplayName];
+  if (group == null) {
+    throw new Error(
+      `Could not resolve group "${props.groupDisplayName}" in working state.`
+    );
+  }
+  const user = props.state.identityCenter.usersByUserName[props.userName];
+  if (user == null) {
+    throw new Error(
+      `Could not resolve user "${props.userName}" in working state.`
+    );
+  }
+  return {
+    groupId: group.groupId,
+    userId: user.userId
+  };
+}
+async function resolveGroupMembershipId(props) {
+  const existingMembership = props.state.identityCenter.groupMembershipsByKey[createGroupMembershipKey({
+    groupId: props.groupId,
+    userId: props.userId
+  })];
+  if (existingMembership?.membershipId != null) {
+    return existingMembership.membershipId;
+  }
+  const response = await props.identityStoreClient.send(
+    new GetGroupMembershipIdCommand({
+      IdentityStoreId: props.state.identityCenter.identityStoreId,
+      GroupId: props.groupId,
+      MemberId: {
+        UserId: props.userId
+      }
+    })
+  );
+  if (response.MembershipId == null) {
+    throw new Error(
+      `GetGroupMembershipId returned no membership id for group "${props.groupId}" and user "${props.userId}".`
+    );
+  }
+  return response.MembershipId;
+}
+
+// src/lambda/handler.ts
+var scanRequestSchema = strictObject({
+  action: literal("scan")
+});
+var getStateUrlRequestSchema = strictObject({
+  action: literal("getStateUrl")
+});
+var applyRequestSchema = strictObject({
+  action: literal("apply"),
+  operations: pipe(array(operationSchema), minLength(1)),
+  allowDestructive: boolean()
+});
+var lambdaRequestSchema = variant("action", [
+  scanRequestSchema,
+  getStateUrlRequestSchema,
+  applyRequestSchema
+]);
+var scanResponseSchema = strictObject({
+  action: literal("scan"),
+  success: literal(true),
+  summary: strictObject({
+    organizationalUnits: number(),
+    accounts: number(),
+    users: number(),
+    groups: number(),
+    permissionSets: number(),
+    accountAssignments: number()
+  }),
+  state: stateSchema
+});
+var getStateUrlResponseSchema = strictObject({
+  action: literal("getStateUrl"),
+  success: literal(true),
+  url: string(),
+  expiresInSeconds: number()
+});
+var applySuccessResponseSchema = strictObject({
+  action: literal("apply"),
+  success: literal(true),
+  operationsCompleted: number(),
+  state: stateSchema
+});
+var errorResponseSchema = strictObject({
+  success: literal(false),
+  error: strictObject({
+    kind: picklist([
+      "validation",
+      "concurrencyConflict",
+      "operationFailed",
+      "internal"
+    ]),
+    message: string(),
+    details: optional(
+      strictObject({
+        failedOperation: optional(number()),
+        operationsCompleted: optional(number()),
+        partialState: optional(stateSchema),
+        validationIssues: optional(array(string()))
+      })
+    )
+  })
+});
+var lambdaResponseSchema = union([
+  scanResponseSchema,
+  getStateUrlResponseSchema,
+  applySuccessResponseSchema,
+  errorResponseSchema
+]);
+var STATE_KEY = "state.json";
+var PRESIGNED_URL_EXPIRY_SECONDS = 3600;
+var RUNTIME_DEFAULTS = {
+  createAccount: {
+    timeoutInMs: 3e5,
+    pollIntervalInMs: 5e3
+  },
+  accountAssignment: {
+    timeoutInMs: 6e4,
+    pollIntervalInMs: 2e3
+  },
+  permissionSetProvisioning: {
+    timeoutInMs: 6e4,
+    pollIntervalInMs: 2e3
+  }
+};
+var lambdaLogger = {
+  log: (...args) => console.log(...args),
+  info: (...args) => console.info(...args),
+  warn: (...args) => console.warn(...args),
+  error: (...args) => console.error(...args),
+  debug: (...args) => console.debug(...args),
+  trace: (...args) => console.trace(...args)
+};
+var s3Client = new S3Client({});
+var organizationsClient = new OrganizationsClient3({});
+var ssoAdminClient = new SSOAdminClient3({});
+var identityStoreClient = new IdentitystoreClient3({});
+var accountClient = new AccountClient2({});
+async function handler(event) {
+  try {
+    const parseResult = safeParse(lambdaRequestSchema, event);
+    if (!parseResult.success) {
+      const issues = parseResult.issues.map(
+        (issue) => `${issue.path?.map((p) => p.key).join(".") ?? "root"}: ${issue.message}`
+      );
+      const response = buildErrorResponse(
+        "validation",
+        "Invalid request payload.",
+        { validationIssues: issues }
+      );
+      return validateResponse(response);
+    }
+    const request = parseResult.output;
+    const bucket = process.env.STATE_BUCKET_NAME;
+    if (bucket == null || bucket.length === 0) {
+      const response = buildErrorResponse(
+        "internal",
+        "STATE_BUCKET_NAME environment variable is not configured."
+      );
+      return validateResponse(response);
+    }
+    if (request.action === "scan") {
+      const response = await handleScan({ s3Client, bucket, organizationsClient, ssoAdminClient, identityStoreClient });
+      return validateResponse(response);
+    }
+    if (request.action === "getStateUrl") {
+      const response = await handleGetStateUrl({ s3Client, bucket });
+      return validateResponse(response);
+    }
+    if (request.action === "apply") {
+      const response = await handleApply({
+        s3Client,
+        bucket,
+        operations: request.operations,
+        allowDestructive: request.allowDestructive,
+        organizationsClient,
+        ssoAdminClient,
+        identityStoreClient,
+        accountClient
+      });
+      return validateResponse(response);
+    }
+    assertUnreachable(request, "Unsupported action in handler.");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "An unexpected error occurred.";
+    const response = buildErrorResponse("internal", message);
+    return validateResponse(response);
+  }
+}
+function buildErrorResponse(kind, message, details) {
+  return {
+    success: false,
+    error: {
+      kind,
+      message,
+      ...details != null ? { details } : {}
+    }
+  };
+}
+function validateResponse(response) {
+  const result = safeParse(lambdaResponseSchema, response);
+  if (!result.success) {
+    return {
+      success: false,
+      error: {
+        kind: "internal",
+        message: "Response validation failed before returning.",
+        details: {
+          validationIssues: result.issues.map(
+            (issue) => `${issue.path?.map((p) => p.key).join(".") ?? "root"}: ${issue.message}`
+          )
+        }
+      }
+    };
+  }
+  return result.output;
+}
+async function readStateFromS3(props) {
+  const response = await props.s3Client.send(
+    new GetObjectCommand({
+      Bucket: props.bucket,
+      Key: STATE_KEY
+    })
+  );
+  const body = await response.Body?.transformToString();
+  if (body == null) {
+    throw new Error("State not found. Run remote scan first.");
+  }
+  const parsed = JSON.parse(body);
+  const state = parse(stateSchema, parsed);
+  const etag = response.ETag ?? "";
+  return { state, etag };
+}
+async function writeStateToS3(props) {
+  await props.s3Client.send(new PutObjectCommand({
+    Bucket: props.bucket,
+    Key: STATE_KEY,
+    Body: JSON.stringify(props.state, null, 2),
+    ContentType: "application/json",
+    IfMatch: props.ifMatch
+  }));
+}
+function isS3PreconditionFailed(error) {
+  if (error instanceof S3ServiceException) {
+    return error.name === "PreconditionFailed" || error.$metadata?.httpStatusCode === 412;
+  }
+  return false;
+}
+async function handleScan(props) {
+  const identityCenterInstanceArn = process.env.IDENTITY_CENTER_INSTANCE_ARN || void 0;
+  const [organization, identityCenter] = await Promise.all([
+    scanOrganization({ organizationsClient: props.organizationsClient }),
+    scanIdentityCenter({
+      ssoAdminClient: props.ssoAdminClient,
+      identityStoreClient: props.identityStoreClient,
+      requestedInstanceArn: identityCenterInstanceArn
+    })
+  ]);
+  const state = {
+    version: "1",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    organization,
+    identityCenter
+  };
+  await writeStateToS3({
+    s3Client: props.s3Client,
+    bucket: props.bucket,
+    state
+  });
+  return {
+    action: "scan",
+    success: true,
+    summary: {
+      organizationalUnits: state.organization.organizationalUnits.length,
+      accounts: state.organization.accounts.length,
+      users: state.identityCenter.users.length,
+      groups: state.identityCenter.groups.length,
+      permissionSets: state.identityCenter.permissionSets.length,
+      accountAssignments: state.identityCenter.accountAssignments.length
+    },
+    state
+  };
+}
+async function handleGetStateUrl(props) {
+  const command = new GetObjectCommand({
+    Bucket: props.bucket,
+    Key: STATE_KEY
+  });
+  const url = await getSignedUrl(props.s3Client, command, {
+    expiresIn: PRESIGNED_URL_EXPIRY_SECONDS
+  });
+  return {
+    action: "getStateUrl",
+    success: true,
+    url,
+    expiresInSeconds: PRESIGNED_URL_EXPIRY_SECONDS
+  };
+}
+async function handleApply(props) {
+  const stateResult = await loadStateForApply({
+    s3Client: props.s3Client,
+    bucket: props.bucket
+  });
+  if (!stateResult.ok) {
+    return stateResult.response;
+  }
+  const { state: currentState, etag } = stateResult;
+  let workingState = createWorkingState({ state: currentState });
+  let operationsCompleted = 0;
+  for (let i = 0; i < props.operations.length; i++) {
+    const operation = props.operations[i];
+    try {
+      workingState = await executeOperation({
+        state: workingState,
+        organizationsClient: props.organizationsClient,
+        accountClient: props.accountClient,
+        ssoAdminClient: props.ssoAdminClient,
+        identityStoreClient: props.identityStoreClient,
+        logger: lambdaLogger,
+        context: {
+          organization: {
+            rootId: workingState.organization.rootId
+          }
+        },
+        runtime: RUNTIME_DEFAULTS,
+        operation
+      });
+      operationsCompleted++;
+    } catch (error) {
+      const partialState = materializeWorkingState({ workingState });
+      try {
+        await writeStateToS3({
+          s3Client: props.s3Client,
+          bucket: props.bucket,
+          state: partialState,
+          ifMatch: etag
+        });
+      } catch (writeError) {
+        if (isS3PreconditionFailed(writeError)) {
+          return buildErrorResponse(
+            "concurrencyConflict",
+            "Concurrent state modification detected while writing partial state."
+          );
+        }
+        lambdaLogger.error(
+          "Failed to write partial state after operation failure:",
+          writeError
+        );
+      }
+      const errorMessage = error instanceof Error ? error.message : "Unknown operation error";
+      return buildErrorResponse("operationFailed", errorMessage, {
+        failedOperation: i,
+        operationsCompleted,
+        partialState
+      });
+    }
+  }
+  const finalState = materializeWorkingState({ workingState });
+  try {
+    await writeStateToS3({
+      s3Client: props.s3Client,
+      bucket: props.bucket,
+      state: finalState,
+      ifMatch: etag
+    });
+  } catch (error) {
+    if (isS3PreconditionFailed(error)) {
+      return buildErrorResponse(
+        "concurrencyConflict",
+        "Concurrent state modification detected. Another apply may have completed while this one was running."
+      );
+    }
+    throw error;
+  }
+  return {
+    action: "apply",
+    success: true,
+    operationsCompleted,
+    state: finalState
+  };
+}
+async function loadStateForApply(props) {
+  try {
+    const result = await readStateFromS3({
+      s3Client: props.s3Client,
+      bucket: props.bucket
+    });
+    return { ok: true, state: result.state, etag: result.etag };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Failed to read state from S3.";
+    return { ok: false, response: buildErrorResponse("internal", message) };
+  }
+}
+export {
+  handler
+};