@happyvertical/directory 0.76.2 → 0.77.0

package/AGENT.md

@@ -28,7 +28,7 @@ pnpm --filter @happyvertical/directory clean
 ## Ecosystem Relationships
 - Provides: Unified directory services with adapter-based architecture (Kanidm, Stalwart, PostgreSQL, AWS)
 - Implements: none
-- Requires: @happyvertical/utils, @aws-sdk/client-iam, @aws-sdk/client-organizations, pg
+- Requires: @happyvertical/utils, @aws-sdk/client-iam, @aws-sdk/client-organizations, @aws-sdk/client-sts, pg
 - Stability: stable (Primary package surface is described as implemented and production-oriented.)
 <!-- END AGENT:GENERATED -->
 

package/dist/adapters/aws.d.ts

@@ -1,8 +1,9 @@
-import { AwsAccessKey, AwsAccount, AwsAccountCreationStatus, AwsDirectoryAdapter, AwsIamUser, AwsOptions, AwsOrganizationalUnit, CreateAwsAccountInput, CreateAwsIamUserInput, CreateAwsOuInput, CreateGroupInput, CreateUserInput, DirectoryGroup, DirectoryUser, UpdateGroupInput, UpdateUserInput } from '../shared/types.js';
+import { AwsAccessKey, AwsAccount, AwsAccountCreationStatus, AwsAccountCreationWaitOptions, AwsAccountParent, AwsAssumeRoleInput, AwsDirectoryAdapter, AwsIamRole, AwsIamUser, AwsOptions, AwsOrganizationalUnit, AwsTemporaryCredentials, CreateAwsAccountInput, CreateAwsIamUserInput, CreateAwsOuInput, CreateGroupInput, CreateUserInput, DirectoryGroup, DirectoryUser, EnsureAwsAccountInput, EnsureAwsIamRoleInput, EnsureAwsOuInput, PutAwsIamRolePolicyInput, UpdateGroupInput, UpdateUserInput } from '../shared/types.js';
 export declare class AwsAdapter implements AwsDirectoryAdapter {
     readonly options: AwsOptions;
     private readonly orgs;
     private readonly iam;
+    private readonly sts;
     constructor(options: AwsOptions);
     testConnection(): Promise<boolean>;
     disconnect(): Promise<void>;
@@ -23,10 +24,22 @@ export declare class AwsAdapter implements AwsDirectoryAdapter {
     createOrganizationalUnit(input: CreateAwsOuInput): Promise<AwsOrganizationalUnit>;
     getOrganizationalUnit(id: string): Promise<AwsOrganizationalUnit>;
     listOrganizationalUnits(parentId: string): Promise<AwsOrganizationalUnit[]>;
+    findOrganizationalUnitByName(parentId: string, name: string): Promise<AwsOrganizationalUnit | null>;
+    ensureOrganizationalUnit(input: EnsureAwsOuInput): Promise<AwsOrganizationalUnit>;
     createAccount(input: CreateAwsAccountInput): Promise<AwsAccountCreationStatus>;
     getAccountCreationStatus(id: string): Promise<AwsAccountCreationStatus>;
     listAccounts(): Promise<AwsAccount[]>;
+    findAccountByEmail(email: string): Promise<AwsAccount | null>;
+    ensureAccount(input: EnsureAwsAccountInput): Promise<AwsAccount>;
+    waitForAccountCreation(id: string, options?: AwsAccountCreationWaitOptions): Promise<AwsAccountCreationStatus>;
+    getAccountParent(accountId: string): Promise<AwsAccountParent | null>;
+    ensureAccountInOrganizationalUnit(accountId: string, destinationParentId: string): Promise<void>;
     moveAccount(accountId: string, sourceParentId: string, destParentId: string): Promise<void>;
+    tagAwsOrganizationsResource(resourceId: string, tags: Record<string, string>): Promise<void>;
+    assumeAwsRole(input: AwsAssumeRoleInput): Promise<AwsTemporaryCredentials>;
+    getIamRole(roleName: string): Promise<AwsIamRole>;
+    ensureIamRole(input: EnsureAwsIamRoleInput): Promise<AwsIamRole>;
+    putIamRolePolicy(input: PutAwsIamRolePolicyInput): Promise<void>;
     createIamUser(input: CreateAwsIamUserInput): Promise<AwsIamUser>;
     getIamUser(username: string): Promise<AwsIamUser>;
     deleteIamUser(username: string): Promise<void>;

package/dist/adapters/aws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/adapters/aws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAsCH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,UAAU,EACV,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AA2G5B,qBAAa,UAAW,YAAW,mBAAmB;IAIxC,QAAQ,CAAC,OAAO,EAAE,UAAU;IAHxC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;gBAEX,OAAO,EAAE,UAAU;IAclC,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IASlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3B,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;IA0B1D,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAS3C,UAAU,CACd,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,aAAa,CAAC;IAgBnB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQrC,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAarC,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;IAqB7D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAe7C,WAAW,CACf,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,cAAc,CAAC;IAOpB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtC,UAAU,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAavC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa9D,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAanE,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAW1D,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAexD,wBAAwB,CAC5B,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,qBAAqB,CAAC;IAqB3B,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAmBjE,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAuB7B,aAAa,CACjB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,wBAAwB,CAAC;IAyB9B,wBAAwB,CAC5B,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,wBAAwB,CAAC;IAuB9B,YAAY,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAerC,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAqBV,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC;IAehE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAWjD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ9C,YAAY,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAarC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAapE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBpE,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAkBxD,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAY5E"}
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/adapters/aws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA+CH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,wBAAwB,EACxB,6BAA6B,EAC7B,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,UAAU,EACV,UAAU,EACV,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAiK5B,qBAAa,UAAW,YAAW,mBAAmB;IAKxC,QAAQ,CAAC,OAAO,EAAE,UAAU;IAJxC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;gBAEX,OAAO,EAAE,UAAU;IAelC,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IASlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3B,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;IA0B1D,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAS3C,UAAU,CACd,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,aAAa,CAAC;IAgBnB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQrC,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAarC,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;IAqB7D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAe7C,WAAW,CACf,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,cAAc,CAAC;IAOpB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtC,UAAU,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAavC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa9D,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAanE,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAW1D,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAexD,wBAAwB,CAC5B,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,qBAAqB,CAAC;IAsB3B,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAmBjE,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,qBAAqB,EAAE,CAAC;IA8B7B,4BAA4B,CAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAKlC,wBAAwB,CAC5B,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,qBAAqB,CAAC;IAoB3B,aAAa,CACjB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,wBAAwB,CAAC;IAkC9B,wBAAwB,CAC5B,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,wBAAwB,CAAC;IAuB9B,YAAY,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAmBrC,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAS7D,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC;IAoChE,sBAAsB,CAC1B,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,6BAAkC,GAC1C,OAAO,CAAC,wBAAwB,CAAC;IAwB9B,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAmBrE,iCAAiC,CACrC,SAAS,EAAE,MAAM,EACjB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAiBV,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAiBV,2BAA2B,CAC/B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,OAAO,CAAC,IAAI,CAAC;IAsBV,aAAa,CACjB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,uBAAuB,CAAC;IA2C7B,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAWjD,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC;IAoDhE,gBAAgB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBhE,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC;IAehE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAWjD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ9C,YAAY,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAarC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAapE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBpE,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAkBxD,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAY5E"}

package/dist/index.d.ts

@@ -10,5 +10,5 @@ export { PostgresAdapter } from './adapters/postgres.js';
 export { StalwartAdapter } from './adapters/stalwart.js';
 export { AuthenticationError, ConflictError, ConnectionError, DirectoryError, NotFoundError, RateLimitError, ValidationError, } from './shared/errors.js';
 export { getAwsAdapter, getDirectoryAdapter, getKanidmAdapter, getPostgresAdapter, getStalwartAdapter, isAwsOptions, isKanidmOptions, isPostgresOptions, isStalwartOptions, } from './shared/factory.js';
-export type { AwsAccessKey, AwsAccount, AwsAccountCreationStatus, AwsDirectoryAdapter, AwsIamUser, AwsOptions, AwsOrganizationalUnit, CreateAwsAccountInput, CreateAwsIamUserInput, CreateAwsOuInput, CreateDkimKeyInput, CreateGroupInput, CreateMailboxInput, CreateMailDomainInput, CreateOAuth2ClientInput, CreatePgDatabaseInput, CreatePgRoleInput, CreateUserInput, CredentialResetIntent, DirectoryAdapter, DirectoryAdapterType, DirectoryGroup, DirectoryOrchestrator, DirectoryUser, DkimKey, DnsRecord, GetDirectoryAdapterOptions, KanidmDirectoryAdapter, KanidmOptions, Mailbox, MailDomain, OAuth2Client, PgDatabase, PgRole, PostgresDirectoryAdapter, PostgresOptions, StalwartDirectoryAdapter, StalwartOptions, TenantProvisioningInput, TenantProvisioningResult, UpdateGroupInput, UpdateMailboxInput, UpdateOAuth2ClientInput, UpdateUserInput, } from './shared/types.js';
+export type { AwsAccessKey, AwsAccount, AwsAccountCreationStatus, AwsAccountCreationWaitOptions, AwsAccountParent, AwsAssumeRoleInput, AwsDirectoryAdapter, AwsIamRole, AwsIamUser, AwsOptions, AwsOrganizationalUnit, AwsTemporaryCredentials, CreateAwsAccountInput, CreateAwsIamUserInput, CreateAwsOuInput, CreateDkimKeyInput, CreateGroupInput, CreateMailboxInput, CreateMailDomainInput, CreateOAuth2ClientInput, CreatePgDatabaseInput, CreatePgRoleInput, CreateUserInput, CredentialResetIntent, DirectoryAdapter, DirectoryAdapterType, DirectoryGroup, DirectoryOrchestrator, DirectoryUser, DkimKey, DnsRecord, EnsureAwsAccountInput, EnsureAwsIamRoleInput, EnsureAwsOuInput, GetDirectoryAdapterOptions, KanidmDirectoryAdapter, KanidmOptions, Mailbox, MailDomain, OAuth2Client, PgDatabase, PgRole, PostgresDirectoryAdapter, PostgresOptions, PutAwsIamRolePolicyInput, StalwartDirectoryAdapter, StalwartOptions, TenantProvisioningInput, TenantProvisioningResult, UpdateGroupInput, UpdateMailboxInput, UpdateOAuth2ClientInput, UpdateUserInput, } from './shared/types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,cAAc,EACd,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EACV,YAAY,EACZ,UAAU,EACV,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,UAAU,EACV,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,OAAO,EACP,SAAS,EACT,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,EACb,OAAO,EACP,UAAU,EACV,YAAY,EACZ,UAAU,EACV,MAAM,EACN,wBAAwB,EACxB,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,GAChB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,cAAc,EACd,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EACV,YAAY,EACZ,UAAU,EACV,wBAAwB,EACxB,6BAA6B,EAC7B,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,UAAU,EACV,UAAU,EACV,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,OAAO,EACP,SAAS,EACT,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,EACb,OAAO,EACP,UAAU,EACV,YAAY,EACZ,UAAU,EACV,MAAM,EACN,wBAAwB,EACxB,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,GAChB,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -1,5 +1,6 @@
-import { IAMClient, ListUsersCommand, CreateUserCommand, GetUserCommand, UpdateUserCommand, DeleteUserCommand, CreateGroupCommand, GetGroupCommand, DeleteGroupCommand, ListGroupsCommand, AddUserToGroupCommand, RemoveUserFromGroupCommand, ListGroupsForUserCommand, AttachUserPolicyCommand, DetachUserPolicyCommand, CreateAccessKeyCommand, DeleteAccessKeyCommand } from "@aws-sdk/client-iam";
-import { OrganizationsClient, CreateOrganizationalUnitCommand, DescribeOrganizationalUnitCommand, ListOrganizationalUnitsForParentCommand, CreateAccountCommand, DescribeCreateAccountStatusCommand, ListAccountsCommand, MoveAccountCommand } from "@aws-sdk/client-organizations";
+import { IAMClient, ListUsersCommand, CreateUserCommand, GetUserCommand, UpdateUserCommand, DeleteUserCommand, CreateGroupCommand, GetGroupCommand, DeleteGroupCommand, ListGroupsCommand, AddUserToGroupCommand, RemoveUserFromGroupCommand, ListGroupsForUserCommand, GetRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand, TagRoleCommand, CreateRoleCommand, PutRolePolicyCommand, AttachUserPolicyCommand, DetachUserPolicyCommand, CreateAccessKeyCommand, DeleteAccessKeyCommand } from "@aws-sdk/client-iam";
+import { OrganizationsClient, CreateOrganizationalUnitCommand, DescribeOrganizationalUnitCommand, ListOrganizationalUnitsForParentCommand, CreateAccountCommand, DescribeCreateAccountStatusCommand, ListAccountsCommand, ListParentsCommand, MoveAccountCommand, TagResourceCommand } from "@aws-sdk/client-organizations";
+import { STSClient, AssumeRoleCommand } from "@aws-sdk/client-sts";
 import pg from "pg";
 class DirectoryError extends Error {
   code;
@@ -73,6 +74,8 @@ class RateLimitError extends DirectoryError {
     this.retryAfter = retryAfter;
   }
 }
+const DEFAULT_ACCOUNT_CREATION_TIMEOUT_MS = 10 * 60 * 1e3;
+const DEFAULT_ACCOUNT_CREATION_POLL_INTERVAL_MS = 5 * 1e3;
 function handleAwsError(error, context) {
   if (error instanceof AuthenticationError || error instanceof ConnectionError || error instanceof NotFoundError || error instanceof ConflictError || error instanceof DirectoryError) {
     throw error;
@@ -137,6 +140,35 @@ function mapIamUserToAwsIamUser(user) {
     createDate: user.CreateDate
   };
 }
+function mapAwsAccount(account) {
+  return {
+    id: account.Id ?? "",
+    name: account.Name ?? "",
+    email: account.Email ?? "",
+    arn: account.Arn,
+    status: account.Status ? String(account.Status) : void 0
+  };
+}
+function mapAwsIamRole(role) {
+  return {
+    roleName: role.RoleName ?? "",
+    arn: role.Arn,
+    roleId: role.RoleId,
+    path: role.Path,
+    createDate: role.CreateDate,
+    assumeRolePolicyDocument: role.AssumeRolePolicyDocument
+  };
+}
+function toAwsTags(tags) {
+  const entries = Object.entries(tags ?? {}).filter(([key]) => key.length > 0);
+  if (entries.length === 0) {
+    return void 0;
+  }
+  return entries.map(([Key, Value]) => ({ Key, Value }));
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 class AwsAdapter {
   constructor(options) {
     this.options = options;
@@ -146,9 +178,11 @@ class AwsAdapter {
     };
     this.orgs = new OrganizationsClient(clientConfig);
     this.iam = new IAMClient(clientConfig);
+    this.sts = new STSClient(clientConfig);
   }
   orgs;
   iam;
+  sts;
   // ==========================================================================
   // Connection
   // ==========================================================================
@@ -323,7 +357,8 @@ class AwsAdapter {
       const result = await this.orgs.send(
         new CreateOrganizationalUnitCommand({
           ParentId: input.parentId,
-          Name: input.name
+          Name: input.name,
+          Tags: toAwsTags(input.tags)
         })
       );
       const ou = result.OrganizationalUnit;
@@ -356,21 +391,47 @@ class AwsAdapter {
   }
   async listOrganizationalUnits(parentId) {
     try {
-      const result = await this.orgs.send(
-        new ListOrganizationalUnitsForParentCommand({
-          ParentId: parentId
-        })
-      );
-      return (result.OrganizationalUnits ?? []).map((ou) => ({
-        id: ou.Id ?? "",
-        name: ou.Name ?? "",
-        arn: ou.Arn,
-        parentId
-      }));
+      const organizationalUnits = [];
+      let nextToken;
+      do {
+        const result = await this.orgs.send(
+          new ListOrganizationalUnitsForParentCommand({
+            ParentId: parentId,
+            NextToken: nextToken
+          })
+        );
+        organizationalUnits.push(
+          ...(result.OrganizationalUnits ?? []).map((ou) => ({
+            id: ou.Id ?? "",
+            name: ou.Name ?? "",
+            arn: ou.Arn,
+            parentId
+          }))
+        );
+        nextToken = result.NextToken;
+      } while (nextToken);
+      return organizationalUnits;
     } catch (error) {
       handleAwsError(error, `listOrganizationalUnits(${parentId})`);
     }
   }
+  async findOrganizationalUnitByName(parentId, name) {
+    const organizationalUnits = await this.listOrganizationalUnits(parentId);
+    return organizationalUnits.find((ou) => ou.name === name) ?? null;
+  }
+  async ensureOrganizationalUnit(input) {
+    const existing = await this.findOrganizationalUnitByName(
+      input.parentId,
+      input.name
+    );
+    if (existing) {
+      if (input.tags) {
+        await this.tagAwsOrganizationsResource(existing.id, input.tags);
+      }
+      return existing;
+    }
+    return this.createOrganizationalUnit(input);
+  }
   // ==========================================================================
   // Accounts (AwsDirectoryAdapter)
   // ==========================================================================
@@ -380,12 +441,20 @@ class AwsAdapter {
         new CreateAccountCommand({
           AccountName: input.name,
           Email: input.email,
-          ...input.roleName ? { RoleName: input.roleName } : {}
+          ...input.roleName ? { RoleName: input.roleName } : {},
+          Tags: toAwsTags(input.tags)
         })
       );
       const status = result.CreateAccountStatus;
+      if (!status?.Id) {
+        throw new DirectoryError(
+          `createAccount(${input.name}) did not return a create account request id`,
+          "AWS_ACCOUNT_CREATION_REQUEST_ID_MISSING",
+          "aws"
+        );
+      }
       return {
-        id: status?.Id ?? "",
+        id: status.Id,
         accountId: status?.AccountId,
         state: status?.State ?? "IN_PROGRESS",
         failureReason: status?.FailureReason ? String(status.FailureReason) : void 0
@@ -414,18 +483,107 @@ class AwsAdapter {
   }
   async listAccounts() {
     try {
-      const result = await this.orgs.send(new ListAccountsCommand({}));
-      return (result.Accounts ?? []).map((a) => ({
-        id: a.Id ?? "",
-        name: a.Name ?? "",
-        email: a.Email ?? "",
-        arn: a.Arn,
-        status: a.Status ? String(a.Status) : void 0
-      }));
+      const accounts = [];
+      let nextToken;
+      do {
+        const result = await this.orgs.send(
+          new ListAccountsCommand({ NextToken: nextToken })
+        );
+        accounts.push(...(result.Accounts ?? []).map((a) => mapAwsAccount(a)));
+        nextToken = result.NextToken;
+      } while (nextToken);
+      return accounts;
     } catch (error) {
       handleAwsError(error, "listAccounts");
     }
   }
+  async findAccountByEmail(email) {
+    const accounts = await this.listAccounts();
+    return accounts.find(
+      (account) => account.email.toLowerCase() === email.toLowerCase()
+    ) ?? null;
+  }
+  async ensureAccount(input) {
+    const existing = await this.findAccountByEmail(input.email);
+    if (existing) {
+      if (input.tags) {
+        await this.tagAwsOrganizationsResource(existing.id, input.tags);
+      }
+      return existing;
+    }
+    const createStatus = await this.createAccount(input);
+    const finalStatus = await this.waitForAccountCreation(
+      createStatus.id,
+      input.wait
+    );
+    if (finalStatus.state !== "SUCCEEDED" || !finalStatus.accountId) {
+      throw new DirectoryError(
+        `ensureAccount(${input.email}) failed: ${finalStatus.failureReason ?? finalStatus.state}`,
+        "AWS_ACCOUNT_CREATION_FAILED",
+        "aws"
+      );
+    }
+    const created = await this.findAccountByEmail(input.email);
+    if (created) {
+      return created;
+    }
+    return {
+      id: finalStatus.accountId,
+      name: input.name,
+      email: input.email,
+      status: "ACTIVE"
+    };
+  }
+  async waitForAccountCreation(id, options = {}) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_ACCOUNT_CREATION_TIMEOUT_MS;
+    const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_ACCOUNT_CREATION_POLL_INTERVAL_MS;
+    const startedAt = Date.now();
+    while (true) {
+      const status = await this.getAccountCreationStatus(id);
+      if (status.state !== "IN_PROGRESS") {
+        return status;
+      }
+      if (Date.now() - startedAt >= timeoutMs) {
+        throw new DirectoryError(
+          `waitForAccountCreation(${id}) timed out after ${timeoutMs}ms`,
+          "AWS_ACCOUNT_CREATION_TIMEOUT",
+          "aws"
+        );
+      }
+      await sleep(pollIntervalMs);
+    }
+  }
+  async getAccountParent(accountId) {
+    try {
+      const result = await this.orgs.send(
+        new ListParentsCommand({ ChildId: accountId })
+      );
+      const parent = result.Parents?.[0];
+      if (!parent?.Id) {
+        return null;
+      }
+      return {
+        id: parent.Id,
+        type: parent.Type ? String(parent.Type) : ""
+      };
+    } catch (error) {
+      handleAwsError(error, `getAccountParent(${accountId})`);
+    }
+  }
+  async ensureAccountInOrganizationalUnit(accountId, destinationParentId) {
+    const currentParent = await this.getAccountParent(accountId);
+    if (currentParent?.id === destinationParentId) {
+      return;
+    }
+    if (!currentParent?.id) {
+      throw new DirectoryError(
+        `ensureAccountInOrganizationalUnit(${accountId}) could not determine the current account parent`,
+        "AWS_ACCOUNT_PARENT_MISSING",
+        "aws"
+      );
+    }
+    await this.moveAccount(accountId, currentParent.id, destinationParentId);
+  }
   async moveAccount(accountId, sourceParentId, destParentId) {
     try {
       await this.orgs.send(
@@ -442,6 +600,128 @@ class AwsAdapter {
       );
     }
   }
+  async tagAwsOrganizationsResource(resourceId, tags) {
+    const awsTags = toAwsTags(tags);
+    if (!awsTags) {
+      return;
+    }
+    try {
+      await this.orgs.send(
+        new TagResourceCommand({
+          ResourceId: resourceId,
+          Tags: awsTags
+        })
+      );
+    } catch (error) {
+      handleAwsError(error, `tagAwsOrganizationsResource(${resourceId})`);
+    }
+  }
+  // ==========================================================================
+  // STS (AwsDirectoryAdapter)
+  // ==========================================================================
+  async assumeAwsRole(input) {
+    try {
+      const result = await this.sts.send(
+        new AssumeRoleCommand({
+          RoleArn: input.roleArn,
+          RoleSessionName: input.sessionName,
+          ...input.externalId ? { ExternalId: input.externalId } : {},
+          ...input.durationSeconds ? { DurationSeconds: input.durationSeconds } : {}
+        })
+      );
+      const credentials = result.Credentials;
+      if (!credentials?.AccessKeyId || !credentials.SecretAccessKey || !credentials.SessionToken) {
+        throw new DirectoryError(
+          `assumeAwsRole(${input.roleArn}) returned incomplete credentials`,
+          "AWS_ASSUME_ROLE_INCOMPLETE_CREDENTIALS",
+          "aws"
+        );
+      }
+      return {
+        accessKeyId: credentials.AccessKeyId,
+        secretAccessKey: credentials.SecretAccessKey,
+        sessionToken: credentials.SessionToken,
+        expiration: credentials.Expiration,
+        assumedRoleArn: result.AssumedRoleUser?.Arn,
+        assumedRoleId: result.AssumedRoleUser?.AssumedRoleId
+      };
+    } catch (error) {
+      handleAwsError(error, `assumeAwsRole(${input.roleArn})`);
+    }
+  }
+  // ==========================================================================
+  // IAM Roles (AwsDirectoryAdapter)
+  // ==========================================================================
+  async getIamRole(roleName) {
+    try {
+      const result = await this.iam.send(
+        new GetRoleCommand({ RoleName: roleName })
+      );
+      return mapAwsIamRole(result.Role ?? {});
+    } catch (error) {
+      handleAwsError(error, `getIamRole(${roleName})`);
+    }
+  }
+  async ensureIamRole(input) {
+    try {
+      await this.getIamRole(input.roleName);
+      await this.iam.send(
+        new UpdateAssumeRolePolicyCommand({
+          RoleName: input.roleName,
+          PolicyDocument: input.assumeRolePolicyDocument
+        })
+      );
+      if (input.description !== void 0) {
+        await this.iam.send(
+          new UpdateRoleCommand({
+            RoleName: input.roleName,
+            Description: input.description
+          })
+        );
+      }
+      const tags = toAwsTags(input.tags);
+      if (tags) {
+        await this.iam.send(
+          new TagRoleCommand({
+            RoleName: input.roleName,
+            Tags: tags
+          })
+        );
+      }
+      return this.getIamRole(input.roleName);
+    } catch (error) {
+      if (!(error instanceof NotFoundError)) {
+        throw error;
+      }
+    }
+    try {
+      const result = await this.iam.send(
+        new CreateRoleCommand({
+          RoleName: input.roleName,
+          AssumeRolePolicyDocument: input.assumeRolePolicyDocument,
+          ...input.description ? { Description: input.description } : {},
+          ...input.path ? { Path: input.path } : {},
+          Tags: toAwsTags(input.tags)
+        })
+      );
+      return mapAwsIamRole(result.Role ?? {});
+    } catch (error) {
+      handleAwsError(error, `ensureIamRole(${input.roleName})`);
+    }
+  }
+  async putIamRolePolicy(input) {
+    try {
+      await this.iam.send(
+        new PutRolePolicyCommand({
+          RoleName: input.roleName,
+          PolicyName: input.policyName,
+          PolicyDocument: input.policyDocument
+        })
+      );
+    } catch (error) {
+      handleAwsError(error, `putIamRolePolicy(${input.roleName})`);
+    }
+  }
   // ==========================================================================
   // IAM Users (AwsDirectoryAdapter)
   // ==========================================================================