@intentius/chant-lexicon-aws 0.41.19 → 0.41.20

package/dist/composites/index.d.ts

@@ -1,3 +1,5 @@
+export { OrganizationRoot, GovernanceFoundation, RegionRestriction, OrganizationTrail } from "./landing-zone.js";
+export type { OrganizationRootProps, GovernanceFoundationProps, RegionRestrictionProps, OrganizationTrailProps, } from "./landing-zone.js";
 export { LambdaFunction, LambdaNode, LambdaPython, NodeLambda, PythonLambda } from "./lambda-function.js";
 export type { LambdaFunctionProps } from "./lambda-function.js";
 export { LambdaApi } from "./lambda-api.js";

package/dist/composites/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACvG,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,WAAW,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACzE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,IAAI,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC3D,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC9G,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACvG,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,WAAW,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACzE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,IAAI,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC3D,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/composites/landing-zone.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Landing-zone bootstrap composites (#791, epic #787 C1).
+ *
+ * Fixed-shape resources for greenfield creation of the recommended
+ * governance foundation through a management-account stack. The evaluability
+ * rules (EVL002/004) require composites to declare a fixed set of resources,
+ * so these carry the foundation only; arbitrary OU/account trees are
+ * authored as config with `landingZoneConfig()` (../governance.ts) and
+ * reconciled by the AWS cloud warden (#792), and further OUs/accounts are
+ * declared as ordinary resources referencing these members' ids.
+ *
+ * The pieces compose:
+ *   const org = OrganizationRoot({});                      // greenfield only
+ *   const lz  = GovernanceFoundation({ parentRootId: org.organization.RootId });
+ *   const rr  = RegionRestriction({ regions: ["eu-west-1"], targetIds: [org.organization.RootId] });
+ *   const at  = OrganizationTrail({ bucket: "acme-org-audit" });
+ * Brownfield skips OrganizationRoot and passes the existing root id
+ * ("r-...") to GovernanceFoundation.
+ */
+import { Organization, OrganizationalUnit, OrganizationsPolicy, Trail } from "../generated/index.js";
+export interface OrganizationRootProps {
+    featureSet?: "ALL" | "CONSOLIDATED_BILLING";
+}
+export type OrganizationRootResult = {
+    organization: InstanceType<typeof Organization>;
+};
+/** Creates the organization itself. Control Tower / existing orgs skip this. */
+export declare const OrganizationRoot: import("@intentius/chant").CompositeDefinition<OrganizationRootProps, OrganizationRootResult>;
+export interface GovernanceFoundationProps {
+    /** The organization root to hang the foundation off ("r-..." or `OrganizationRoot(...).organization.RootId`). */
+    parentRootId: string;
+}
+export type GovernanceFoundationResult = {
+    ouSecurity: InstanceType<typeof OrganizationalUnit>;
+    ouInfrastructure: InstanceType<typeof OrganizationalUnit>;
+    ouSandbox: InstanceType<typeof OrganizationalUnit>;
+    ouWorkloads: InstanceType<typeof OrganizationalUnit>;
+    scpDenyLeaveOrganization: InstanceType<typeof OrganizationsPolicy>;
+    scpDenyAuditTamper: InstanceType<typeof OrganizationsPolicy>;
+};
+/**
+ * Security / Infrastructure / Sandbox / Workloads OUs,
+ * `deny-leave-organization` attached at the root and `deny-audit-tamper`
+ * on the Security OU — the same baseline `landingZoneConfig()` declares.
+ */
+export declare const GovernanceFoundation: import("@intentius/chant").CompositeDefinition<GovernanceFoundationProps, GovernanceFoundationResult>;
+export interface RegionRestrictionProps {
+    /** The only regions requests may target (global services excepted). */
+    regions: string[];
+    /** Root/OU ids the SCP attaches to. */
+    targetIds: string[];
+}
+export type RegionRestrictionResult = {
+    scpRegionRestriction: InstanceType<typeof OrganizationsPolicy>;
+};
+export declare const RegionRestriction: import("@intentius/chant").CompositeDefinition<RegionRestrictionProps, RegionRestrictionResult>;
+export interface OrganizationTrailProps {
+    /** S3 bucket the organization trail delivers into. */
+    bucket: string;
+}
+export type OrganizationTrailResult = {
+    trail: InstanceType<typeof Trail>;
+};
+export declare const OrganizationTrail: import("@intentius/chant").CompositeDefinition<OrganizationTrailProps, OrganizationTrailResult>;
+//# sourceMappingURL=landing-zone.d.ts.map

package/dist/composites/landing-zone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"landing-zone.d.ts","sourceRoot":"","sources":["../../src/composites/landing-zone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,EACN,MAAM,cAAc,CAAC;AAOtB,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,KAAK,GAAG,sBAAsB,CAAC;CAC7C;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,YAAY,EAAE,YAAY,CAAC,OAAO,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,+FAGP,CAAC;AAMvB,MAAM,WAAW,yBAAyB;IACxC,iHAAiH;IACjH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,UAAU,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;IACpD,gBAAgB,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;IAC1D,SAAS,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;IACnD,WAAW,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;IACrD,wBAAwB,EAAE,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAAC;IACnE,kBAAkB,EAAE,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,uGA6BP,CAAC;AAM3B,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uCAAuC;IACvC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,oBAAoB,EAAE,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAAC;CAChE,CAAC;AAEF,eAAO,MAAM,iBAAiB,iGAUP,CAAC;AAMxB,MAAM,WAAW,sBAAsB;IACrC,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC;CACnC,CAAC;AAEF,eAAO,MAAM,iBAAiB,iGAQP,CAAC"}

package/dist/governance.d.ts

@@ -0,0 +1,92 @@
+/**
+ * AWS governance authoring (#791, epic #787 C1): the desired-state config
+ * shape the AWS cloud warden (#792) reconciles, and `landingZoneConfig()` —
+ * the typed authoring layer that emits it.
+ *
+ * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
+ * #916/#952) require composites to declare a fixed set of resources, so a
+ * data-driven OU tree walker cannot be one. The split mirrors the SCM
+ * wardens: authoring emits config (this module, arbitrary cardinality);
+ * resources for greenfield bootstrap are the fixed-shape composites in
+ * `composites/landing-zone.ts`; the warden consumes only the config.
+ *
+ * GCP (Folder/OrgPolicy/AuditConfig) and Azure (blocked on #1545)
+ * counterparts are tracked as #791 follow-ups.
+ */
+/** An SCP definition, keyed by name in `AwsGovernanceConfig.scps`. */
+export interface ScpConfig {
+    description?: string;
+    /** The policy document (SCP JSON). */
+    document: Record<string, unknown>;
+}
+/** A member account declared inside an OU. */
+export interface AccountConfig {
+    name: string;
+    email: string;
+}
+/** One OU: its guardrails, accounts, and child OUs, keyed by OU name. */
+export interface OuConfig {
+    /** Names of SCPs (from `scps`) attached to this OU. */
+    scps?: string[];
+    accounts?: AccountConfig[];
+    children?: Record<string, OuConfig>;
+}
+/**
+ * The desired-state governance tree for one AWS organization. This is the
+ * shape `wardens/aws` (#792) loads as config — the AWS counterpart of the
+ * SCM wardens' GovernanceConfig. Cycles map onto the governance verbs
+ * (#790): the OU/account tree is `org-unit`, SCPs are `policy-guardrail`,
+ * audit sinks are `audit-sink`.
+ */
+export interface AwsGovernanceConfig {
+    organization: {
+        /** SCP names attached at the organization root. */
+        scps?: string[];
+    };
+    /** Top-level OUs under the root, keyed by OU name. */
+    ous: Record<string, OuConfig>;
+    /** SCP definitions, keyed by the names the tree attaches. */
+    scps: Record<string, ScpConfig>;
+    /** Where audit evidence flows. */
+    auditSinks?: {
+        cloudtrail?: {
+            bucket: string;
+            multiRegion: boolean;
+        };
+    };
+}
+export declare const DENY_LEAVE_ORGANIZATION: ScpConfig;
+export declare const DENY_AUDIT_TAMPER: ScpConfig;
+/** Deny requests outside `regions`, excepting global services. */
+export declare function regionRestriction(regions: readonly string[]): ScpConfig;
+/**
+ * The recommended foundation OU structure. Exported so callers can extend it
+ * rather than restate it.
+ */
+export declare const FOUNDATION_OUS: Record<string, OuConfig>;
+export interface LandingZoneConfigProps {
+    /**
+     * Start from the recommended foundation: Security / Infrastructure /
+     * Sandbox / Workloads OUs, `deny-leave-organization` at the root, and
+     * `deny-audit-tamper` on Security. Default true; your `ous`/`scps` merge
+     * over it (same-name keys win).
+     */
+    foundation?: boolean;
+    /** Adds a region-restriction SCP at the root allowing only these regions. */
+    allowedRegions?: string[];
+    /** OU tree, merged over the foundation's. Greenfield (full tree) and brownfield (partial subtree) are both just this map. */
+    ous?: Record<string, OuConfig>;
+    /** SCP definitions, merged over the foundation's. */
+    scps?: Record<string, ScpConfig>;
+    /** Extra SCP names to attach at the organization root. */
+    rootScps?: string[];
+    /** Declare an organization CloudTrail flowing into this bucket. */
+    cloudtrailBucket?: string;
+}
+/**
+ * Author the desired-state tree the AWS cloud warden (#792) reconciles.
+ * Pure. Throws when the tree attaches an SCP name with no definition; only
+ * SCPs the tree actually attaches are included in the output.
+ */
+export declare function landingZoneConfig(props?: LandingZoneConfigProps): AwsGovernanceConfig;
+//# sourceMappingURL=governance.d.ts.map

package/dist/governance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../src/governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,sEAAsE;AACtE,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE;QACZ,mDAAmD;QACnD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IACF,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChC,kCAAkC;IAClC,UAAU,CAAC,EAAE;QACX,UAAU,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,OAAO,CAAA;SAAE,CAAC;KACvD,CAAC;CACH;AAMD,eAAO,MAAM,uBAAuB,EAAE,SAMrC,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,SAkB/B,CAAC;AAEF,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAuBvE;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAKnD,CAAC;AAMF,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,6HAA6H;IAC7H,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/B,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,sBAA2B,GAAG,mBAAmB,CAoCzF"}

package/dist/index.d.ts

@@ -23,10 +23,12 @@ export type { CFNSchema, SchemaProperty, SchemaDefinition } from "./spec/fetch.j
 export { parseCFNSchema, cfnShortName, cfnServiceName } from "./spec/parse.js";
 export type { SchemaParseResult, ParsedResource, ParsedProperty, ParsedAttribute, ParsedPropertyType, ParsedEnum, PropertyConstraints } from "./spec/parse.js";
 export { S3Actions, LambdaActions, DynamoDBActions, SQSActions, SNSActions, IAMActions, ECRActions, LogsActions, ECSActions } from "./actions/index.js";
-export { LambdaFunction, LambdaNode, LambdaPython, NodeLambda, PythonLambda, LambdaApi, LambdaScheduled, ScheduledLambda, LambdaSqs, LambdaEventBridge, LambdaDynamoDB, LambdaS3, LambdaSns, VpcDefault, FargateAlb, AlbShared, FargateService, RdsInstance, RdsPostgres, EfsWithAccessPoint, Ec2InstanceRole, MinimalVpc, EksCluster, SolrFargateService, MicrovmApp, MICROVM_LIMITS, AgentCoreAgent, } from "./composites/index.js";
-export type { LambdaFunctionProps, LambdaApiProps, ScheduledLambdaProps, LambdaSqsProps, LambdaEventBridgeProps, LambdaDynamoDBProps, LambdaS3Props, LambdaSnsProps, VpcDefaultProps, FargateAlbProps, AlbSharedProps, FargateServiceProps, RdsInstanceProps, RdsPostgresProps, EfsWithAccessPointProps, Ec2InstanceRoleProps, MinimalVpcProps, EksClusterProps, SolrFargateServiceProps, MicrovmAppProps, MicrovmAppResult, MicrovmAppBuildConnectorProps, MicrovmMemoryMiB, AgentCoreAgentProps, AgentCoreAgentResult, } from "./composites/index.js";
+export { LambdaFunction, LambdaNode, LambdaPython, NodeLambda, PythonLambda, LambdaApi, LambdaScheduled, ScheduledLambda, LambdaSqs, LambdaEventBridge, LambdaDynamoDB, LambdaS3, LambdaSns, VpcDefault, FargateAlb, AlbShared, FargateService, RdsInstance, RdsPostgres, EfsWithAccessPoint, Ec2InstanceRole, MinimalVpc, EksCluster, SolrFargateService, MicrovmApp, MICROVM_LIMITS, AgentCoreAgent, OrganizationRoot, GovernanceFoundation, RegionRestriction, OrganizationTrail, } from "./composites/index.js";
+export type { LambdaFunctionProps, LambdaApiProps, ScheduledLambdaProps, LambdaSqsProps, LambdaEventBridgeProps, LambdaDynamoDBProps, LambdaS3Props, LambdaSnsProps, VpcDefaultProps, FargateAlbProps, AlbSharedProps, FargateServiceProps, RdsInstanceProps, RdsPostgresProps, EfsWithAccessPointProps, Ec2InstanceRoleProps, MinimalVpcProps, EksClusterProps, SolrFargateServiceProps, MicrovmAppProps, MicrovmAppResult, MicrovmAppBuildConnectorProps, MicrovmMemoryMiB, AgentCoreAgentProps, AgentCoreAgentResult, OrganizationRootProps, GovernanceFoundationProps, RegionRestrictionProps, OrganizationTrailProps, } from "./composites/index.js";
 export { generate, writeGeneratedFiles } from "./codegen/generate.js";
 export { packageLexicon } from "./codegen/package.js";
 export type { PackageOptions, PackageResult } from "./codegen/package.js";
 export { awsCapabilityPlugin } from "./components/capability-plugin.js";
+export { landingZoneConfig, regionRestriction, DENY_AUDIT_TAMPER, DENY_LEAVE_ORGANIZATION, FOUNDATION_OUS } from "./governance.js";
+export type { AwsGovernanceConfig, LandingZoneConfigProps, OuConfig, ScpConfig, AccountConfig } from "./governance.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EACjE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAC3E,kBAAkB,EAClB,eAAe,EAAE,UAAU,EAAE,UAAU,EACvC,kBAAkB,EAClB,UAAU,EAAE,cAAc,EAC1B,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAC1F,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EACzG,uBAAuB,EACvB,oBAAoB,EAAE,eAAe,EAAE,eAAe,EACtD,uBAAuB,EACvB,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,gBAAgB,EAClF,mBAAmB,EAAE,oBAAoB,GAC1C,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EACjE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAC3E,kBAAkB,EAClB,eAAe,EAAE,UAAU,EAAE,UAAU,EACvC,kBAAkB,EAClB,UAAU,EAAE,cAAc,EAC1B,cAAc,EACd,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAC1F,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EACzG,uBAAuB,EACvB,oBAAoB,EAAE,eAAe,EAAE,eAAe,EACtD,uBAAuB,EACvB,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,gBAAgB,EAClF,mBAAmB,EAAE,oBAAoB,EACzC,qBAAqB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,GACjG,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChI,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "cebe01c742c2844aca5fd34dce088449c87d661d96ee72dd4ed6c02ca3c4acb1",
+    "manifest.json": "34e5cc07ea3f4ee6dc9f368d1439bbc43e8c5ef6a012ec0f7d03ce53816e08f6",
     "meta.json": "2e4cae67cbc2eb2962c3dd0aa57008ae96fb725dd0118af7b04b2b44eab7722a",
     "types/index.d.ts": "6d6b37bd14a9b40fb3ff5c66e1cb49be1ae1032de47a4e167cf5f411c943b7f5",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
@@ -59,5 +59,5 @@
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
     "skills/chant-aws-carve-terraform.md": "f4c6fe1c702250665f90d82b3bdaba5ea50ae75e380a8ae321dad6eb1c39683e"
   },
-  "composite": "325693aace617ceb31be814498702a442870b3af1aa42dc40eb965e49243893c"
+  "composite": "e0f1e5822bf0c7d39fa16c05f7e259344432b4eb815d7cc005714857a8d833b6"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.41.19",
+  "version": "0.41.20",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.41.19",
+  "version": "0.41.20",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.41.19",
+    "@intentius/chant": "^0.41.20",
     "typescript": "^5.9.3"
   }
 }

package/src/composites/index.ts

@@ -1,3 +1,10 @@
+export { OrganizationRoot, GovernanceFoundation, RegionRestriction, OrganizationTrail } from "./landing-zone";
+export type {
+  OrganizationRootProps,
+  GovernanceFoundationProps,
+  RegionRestrictionProps,
+  OrganizationTrailProps,
+} from "./landing-zone";
 export { LambdaFunction, LambdaNode, LambdaPython, NodeLambda, PythonLambda } from "./lambda-function";
 export type { LambdaFunctionProps } from "./lambda-function";
 export { LambdaApi } from "./lambda-api";

package/src/composites/landing-zone.test.ts

@@ -0,0 +1,53 @@
+import { describe, expect, test } from "vitest";
+import { expandComposite } from "@intentius/chant";
+import { AttrRef } from "@intentius/chant/attrref";
+import { GovernanceFoundation, OrganizationRoot, OrganizationTrail, RegionRestriction } from "./landing-zone";
+
+describe("GovernanceFoundation (#791)", () => {
+  test("declares the foundation OUs and baseline SCPs", () => {
+    const lz = GovernanceFoundation({ parentRootId: "r-abc1" });
+    expect(Object.keys(lz.members)).toEqual([
+      "ouSecurity",
+      "ouInfrastructure",
+      "ouSandbox",
+      "ouWorkloads",
+      "scpDenyLeaveOrganization",
+      "scpDenyAuditTamper",
+    ]);
+  });
+
+  test("deny-leave-organization targets the root; deny-audit-tamper targets the Security OU", () => {
+    const lz = GovernanceFoundation({ parentRootId: "r-abc1" });
+    expect((lz.scpDenyLeaveOrganization as any).props.TargetIds).toEqual(["r-abc1"]);
+    const tamperTargets = (lz.scpDenyAuditTamper as any).props.TargetIds;
+    expect(tamperTargets).toHaveLength(1);
+    expect(tamperTargets[0]).toBeInstanceOf(AttrRef);
+  });
+
+  test("brownfield and greenfield wire the same way", () => {
+    const org = OrganizationRoot({});
+    const green = GovernanceFoundation({ parentRootId: org.organization.RootId });
+    expect((green.ouSecurity as any).props.ParentId).toBeInstanceOf(AttrRef);
+    const brown = GovernanceFoundation({ parentRootId: "r-live" });
+    expect((brown.ouSecurity as any).props.ParentId).toBe("r-live");
+  });
+
+  test("expandComposite produces prefixed logical names", () => {
+    const expanded = expandComposite("lz", GovernanceFoundation({ parentRootId: "r-abc1" }));
+    expect([...expanded.keys()]).toContain("lzOuSecurity");
+    expect([...expanded.keys()]).toContain("lzScpDenyAuditTamper");
+    expect(expanded.size).toBe(6);
+  });
+
+  test("RegionRestriction and OrganizationTrail carry the optional guardrails", () => {
+    const rr = RegionRestriction({ regions: ["eu-west-1"], targetIds: ["r-abc1"] });
+    const doc = (rr.scpRegionRestriction as any).props.Content;
+    expect(JSON.stringify(doc)).toContain("eu-west-1");
+    const trail = OrganizationTrail({ bucket: "acme-audit" });
+    expect((trail.trail as any).props).toMatchObject({
+      S3BucketName: "acme-audit",
+      IsOrganizationTrail: true,
+      IsLogging: true,
+    });
+  });
+});

package/src/composites/landing-zone.ts

@@ -0,0 +1,150 @@
+/**
+ * Landing-zone bootstrap composites (#791, epic #787 C1).
+ *
+ * Fixed-shape resources for greenfield creation of the recommended
+ * governance foundation through a management-account stack. The evaluability
+ * rules (EVL002/004) require composites to declare a fixed set of resources,
+ * so these carry the foundation only; arbitrary OU/account trees are
+ * authored as config with `landingZoneConfig()` (../governance.ts) and
+ * reconciled by the AWS cloud warden (#792), and further OUs/accounts are
+ * declared as ordinary resources referencing these members' ids.
+ *
+ * The pieces compose:
+ *   const org = OrganizationRoot({});                      // greenfield only
+ *   const lz  = GovernanceFoundation({ parentRootId: org.organization.RootId });
+ *   const rr  = RegionRestriction({ regions: ["eu-west-1"], targetIds: [org.organization.RootId] });
+ *   const at  = OrganizationTrail({ bucket: "acme-org-audit" });
+ * Brownfield skips OrganizationRoot and passes the existing root id
+ * ("r-...") to GovernanceFoundation.
+ */
+
+import { Composite } from "@intentius/chant";
+import {
+  Organization,
+  OrganizationalUnit,
+  OrganizationsPolicy,
+  Trail,
+} from "../generated";
+import { DENY_AUDIT_TAMPER, DENY_LEAVE_ORGANIZATION, regionRestriction } from "../governance";
+
+// ---------------------------------------------------------------------------
+// OrganizationRoot — greenfield only
+// ---------------------------------------------------------------------------
+
+export interface OrganizationRootProps {
+  featureSet?: "ALL" | "CONSOLIDATED_BILLING";
+}
+
+export type OrganizationRootResult = {
+  organization: InstanceType<typeof Organization>;
+};
+
+/** Creates the organization itself. Control Tower / existing orgs skip this. */
+export const OrganizationRoot = Composite<OrganizationRootProps, OrganizationRootResult>((props) => {
+  const organization = new Organization({ FeatureSet: props.featureSet ?? "ALL" });
+  return { organization };
+}, "OrganizationRoot");
+
+// ---------------------------------------------------------------------------
+// GovernanceFoundation — the recommended foundation
+// ---------------------------------------------------------------------------
+
+export interface GovernanceFoundationProps {
+  /** The organization root to hang the foundation off ("r-..." or `OrganizationRoot(...).organization.RootId`). */
+  parentRootId: string;
+}
+
+export type GovernanceFoundationResult = {
+  ouSecurity: InstanceType<typeof OrganizationalUnit>;
+  ouInfrastructure: InstanceType<typeof OrganizationalUnit>;
+  ouSandbox: InstanceType<typeof OrganizationalUnit>;
+  ouWorkloads: InstanceType<typeof OrganizationalUnit>;
+  scpDenyLeaveOrganization: InstanceType<typeof OrganizationsPolicy>;
+  scpDenyAuditTamper: InstanceType<typeof OrganizationsPolicy>;
+};
+
+/**
+ * Security / Infrastructure / Sandbox / Workloads OUs,
+ * `deny-leave-organization` attached at the root and `deny-audit-tamper`
+ * on the Security OU — the same baseline `landingZoneConfig()` declares.
+ */
+export const GovernanceFoundation = Composite<GovernanceFoundationProps, GovernanceFoundationResult>((props) => {
+  const ouSecurity = new OrganizationalUnit({ Name: "Security", ParentId: props.parentRootId });
+  const ouInfrastructure = new OrganizationalUnit({ Name: "Infrastructure", ParentId: props.parentRootId });
+  const ouSandbox = new OrganizationalUnit({ Name: "Sandbox", ParentId: props.parentRootId });
+  const ouWorkloads = new OrganizationalUnit({ Name: "Workloads", ParentId: props.parentRootId });
+
+  const scpDenyLeaveOrganization = new OrganizationsPolicy({
+    Name: "deny-leave-organization",
+    Type: "SERVICE_CONTROL_POLICY",
+    Content: DENY_LEAVE_ORGANIZATION.document,
+    Description: DENY_LEAVE_ORGANIZATION.description,
+    TargetIds: [props.parentRootId],
+  });
+  const scpDenyAuditTamper = new OrganizationsPolicy({
+    Name: "deny-audit-tamper",
+    Type: "SERVICE_CONTROL_POLICY",
+    Content: DENY_AUDIT_TAMPER.document,
+    Description: DENY_AUDIT_TAMPER.description,
+    TargetIds: [ouSecurity.Id],
+  });
+
+  return {
+    ouSecurity,
+    ouInfrastructure,
+    ouSandbox,
+    ouWorkloads,
+    scpDenyLeaveOrganization,
+    scpDenyAuditTamper,
+  };
+}, "GovernanceFoundation");
+
+// ---------------------------------------------------------------------------
+// RegionRestriction — optional root guardrail
+// ---------------------------------------------------------------------------
+
+export interface RegionRestrictionProps {
+  /** The only regions requests may target (global services excepted). */
+  regions: string[];
+  /** Root/OU ids the SCP attaches to. */
+  targetIds: string[];
+}
+
+export type RegionRestrictionResult = {
+  scpRegionRestriction: InstanceType<typeof OrganizationsPolicy>;
+};
+
+export const RegionRestriction = Composite<RegionRestrictionProps, RegionRestrictionResult>((props) => {
+  const policy = regionRestriction(props.regions);
+  const scpRegionRestriction = new OrganizationsPolicy({
+    Name: "region-restriction",
+    Type: "SERVICE_CONTROL_POLICY",
+    Content: policy.document,
+    Description: policy.description,
+    TargetIds: props.targetIds,
+  });
+  return { scpRegionRestriction };
+}, "RegionRestriction");
+
+// ---------------------------------------------------------------------------
+// OrganizationTrail — the audit sink
+// ---------------------------------------------------------------------------
+
+export interface OrganizationTrailProps {
+  /** S3 bucket the organization trail delivers into. */
+  bucket: string;
+}
+
+export type OrganizationTrailResult = {
+  trail: InstanceType<typeof Trail>;
+};
+
+export const OrganizationTrail = Composite<OrganizationTrailProps, OrganizationTrailResult>((props) => {
+  const trail = new Trail({
+    IsLogging: true,
+    S3BucketName: props.bucket,
+    IsMultiRegionTrail: true,
+    IsOrganizationTrail: true,
+  });
+  return { trail };
+}, "OrganizationTrail");

package/src/governance.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, test } from "vitest";
+import { landingZoneConfig, FOUNDATION_OUS } from "./governance";
+
+describe("landingZoneConfig (#791)", () => {
+  test("the default is the recommended foundation", () => {
+    const cfg = landingZoneConfig();
+    expect(Object.keys(cfg.ous)).toEqual(["Security", "Infrastructure", "Sandbox", "Workloads"]);
+    expect(cfg.organization.scps).toEqual(["deny-leave-organization"]);
+    expect(cfg.ous.Security.scps).toEqual(["deny-audit-tamper"]);
+    expect(Object.keys(cfg.scps).sort()).toEqual(["deny-audit-tamper", "deny-leave-organization"]);
+    expect(cfg.auditSinks).toBeUndefined();
+  });
+
+  test("custom OUs and accounts merge over the foundation (brownfield: partial trees work)", () => {
+    const cfg = landingZoneConfig({
+      ous: {
+        Workloads: {
+          children: { Prod: { accounts: [{ name: "checkout", email: "aws+checkout@acme.dev" }] } },
+        },
+      },
+    });
+    // Same-name key wins over the foundation's Workloads…
+    expect(cfg.ous.Workloads.children?.Prod.accounts?.[0].name).toBe("checkout");
+    // …while the rest of the foundation persists.
+    expect(cfg.ous.Security).toEqual(FOUNDATION_OUS.Security);
+
+    const partial = landingZoneConfig({ foundation: false, ous: { Legacy: {} }, rootScps: [] });
+    expect(Object.keys(partial.ous)).toEqual(["Legacy"]);
+    expect(partial.organization.scps).toBeUndefined();
+    expect(partial.scps).toEqual({});
+  });
+
+  test("allowedRegions adds a root region-restriction SCP", () => {
+    const cfg = landingZoneConfig({ allowedRegions: ["eu-west-1", "eu-central-1"] });
+    expect(cfg.organization.scps).toContain("region-restriction");
+    expect(JSON.stringify(cfg.scps["region-restriction"].document)).toContain("eu-central-1");
+  });
+
+  test("cloudtrailBucket declares the audit sink", () => {
+    const cfg = landingZoneConfig({ cloudtrailBucket: "acme-audit" });
+    expect(cfg.auditSinks?.cloudtrail).toEqual({ bucket: "acme-audit", multiRegion: true });
+  });
+
+  test("only attached SCPs are emitted; attaching an undefined SCP throws", () => {
+    const cfg = landingZoneConfig({
+      scps: { unused: { document: { Version: "2012-10-17", Statement: [] } } },
+    });
+    expect(cfg.scps.unused).toBeUndefined();
+
+    expect(() => landingZoneConfig({ ous: { Security: { scps: ["nope"] } } })).toThrowError(
+      'SCP "nope" is attached but not defined',
+    );
+  });
+});

package/src/governance.ts

@@ -0,0 +1,198 @@
+/**
+ * AWS governance authoring (#791, epic #787 C1): the desired-state config
+ * shape the AWS cloud warden (#792) reconciles, and `landingZoneConfig()` —
+ * the typed authoring layer that emits it.
+ *
+ * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
+ * #916/#952) require composites to declare a fixed set of resources, so a
+ * data-driven OU tree walker cannot be one. The split mirrors the SCM
+ * wardens: authoring emits config (this module, arbitrary cardinality);
+ * resources for greenfield bootstrap are the fixed-shape composites in
+ * `composites/landing-zone.ts`; the warden consumes only the config.
+ *
+ * GCP (Folder/OrgPolicy/AuditConfig) and Azure (blocked on #1545)
+ * counterparts are tracked as #791 follow-ups.
+ */
+
+// ---------------------------------------------------------------------------
+// The desired-state config shape the AWS cloud warden consumes (#792)
+// ---------------------------------------------------------------------------
+
+/** An SCP definition, keyed by name in `AwsGovernanceConfig.scps`. */
+export interface ScpConfig {
+  description?: string;
+  /** The policy document (SCP JSON). */
+  document: Record<string, unknown>;
+}
+
+/** A member account declared inside an OU. */
+export interface AccountConfig {
+  name: string;
+  email: string;
+}
+
+/** One OU: its guardrails, accounts, and child OUs, keyed by OU name. */
+export interface OuConfig {
+  /** Names of SCPs (from `scps`) attached to this OU. */
+  scps?: string[];
+  accounts?: AccountConfig[];
+  children?: Record<string, OuConfig>;
+}
+
+/**
+ * The desired-state governance tree for one AWS organization. This is the
+ * shape `wardens/aws` (#792) loads as config — the AWS counterpart of the
+ * SCM wardens' GovernanceConfig. Cycles map onto the governance verbs
+ * (#790): the OU/account tree is `org-unit`, SCPs are `policy-guardrail`,
+ * audit sinks are `audit-sink`.
+ */
+export interface AwsGovernanceConfig {
+  organization: {
+    /** SCP names attached at the organization root. */
+    scps?: string[];
+  };
+  /** Top-level OUs under the root, keyed by OU name. */
+  ous: Record<string, OuConfig>;
+  /** SCP definitions, keyed by the names the tree attaches. */
+  scps: Record<string, ScpConfig>;
+  /** Where audit evidence flows. */
+  auditSinks?: {
+    cloudtrail?: { bucket: string; multiRegion: boolean };
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Baseline guardrails (shared with the bootstrap composites)
+// ---------------------------------------------------------------------------
+
+export const DENY_LEAVE_ORGANIZATION: ScpConfig = {
+  description: "Member accounts may not remove themselves from the organization.",
+  document: {
+    Version: "2012-10-17",
+    Statement: [{ Effect: "Deny", Action: "organizations:LeaveOrganization", Resource: "*" }],
+  },
+};
+
+export const DENY_AUDIT_TAMPER: ScpConfig = {
+  description: "Audit trails and recorders cannot be stopped or deleted from member accounts.",
+  document: {
+    Version: "2012-10-17",
+    Statement: [
+      {
+        Effect: "Deny",
+        Action: [
+          "cloudtrail:StopLogging",
+          "cloudtrail:DeleteTrail",
+          "config:StopConfigurationRecorder",
+          "config:DeleteConfigurationRecorder",
+          "config:DeleteDeliveryChannel",
+        ],
+        Resource: "*",
+      },
+    ],
+  },
+};
+
+/** Deny requests outside `regions`, excepting global services. */
+export function regionRestriction(regions: readonly string[]): ScpConfig {
+  return {
+    description: `Deny requests outside [${regions.join(", ")}] except global services.`,
+    document: {
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Deny",
+          NotAction: [
+            "iam:*",
+            "organizations:*",
+            "route53:*",
+            "cloudfront:*",
+            "sts:*",
+            "support:*",
+            "budgets:*",
+          ],
+          Resource: "*",
+          Condition: { StringNotEquals: { "aws:RequestedRegion": regions } },
+        },
+      ],
+    },
+  };
+}
+
+/**
+ * The recommended foundation OU structure. Exported so callers can extend it
+ * rather than restate it.
+ */
+export const FOUNDATION_OUS: Record<string, OuConfig> = {
+  Security: { scps: ["deny-audit-tamper"] },
+  Infrastructure: {},
+  Sandbox: {},
+  Workloads: {},
+};
+
+// ---------------------------------------------------------------------------
+// Authoring
+// ---------------------------------------------------------------------------
+
+export interface LandingZoneConfigProps {
+  /**
+   * Start from the recommended foundation: Security / Infrastructure /
+   * Sandbox / Workloads OUs, `deny-leave-organization` at the root, and
+   * `deny-audit-tamper` on Security. Default true; your `ous`/`scps` merge
+   * over it (same-name keys win).
+   */
+  foundation?: boolean;
+  /** Adds a region-restriction SCP at the root allowing only these regions. */
+  allowedRegions?: string[];
+  /** OU tree, merged over the foundation's. Greenfield (full tree) and brownfield (partial subtree) are both just this map. */
+  ous?: Record<string, OuConfig>;
+  /** SCP definitions, merged over the foundation's. */
+  scps?: Record<string, ScpConfig>;
+  /** Extra SCP names to attach at the organization root. */
+  rootScps?: string[];
+  /** Declare an organization CloudTrail flowing into this bucket. */
+  cloudtrailBucket?: string;
+}
+
+/**
+ * Author the desired-state tree the AWS cloud warden (#792) reconciles.
+ * Pure. Throws when the tree attaches an SCP name with no definition; only
+ * SCPs the tree actually attaches are included in the output.
+ */
+export function landingZoneConfig(props: LandingZoneConfigProps = {}): AwsGovernanceConfig {
+  const foundation = props.foundation ?? true;
+  const scps: Record<string, ScpConfig> = {
+    ...(foundation
+      ? { "deny-leave-organization": DENY_LEAVE_ORGANIZATION, "deny-audit-tamper": DENY_AUDIT_TAMPER }
+      : {}),
+    ...(props.allowedRegions?.length ? { "region-restriction": regionRestriction(props.allowedRegions) } : {}),
+    ...props.scps,
+  };
+  const ous = { ...(foundation ? FOUNDATION_OUS : {}), ...props.ous };
+  const rootScps = [
+    ...(foundation ? ["deny-leave-organization"] : []),
+    ...(props.allowedRegions?.length ? ["region-restriction"] : []),
+    ...(props.rootScps ?? []),
+  ];
+
+  const attached = new Set(rootScps);
+  const collect = (tree: Record<string, OuConfig>): void => {
+    for (const node of Object.values(tree)) {
+      for (const s of node.scps ?? []) attached.add(s);
+      if (node.children) collect(node.children);
+    }
+  };
+  collect(ous);
+  for (const name of attached) {
+    if (!scps[name]) throw new Error(`landingZoneConfig: SCP "${name}" is attached but not defined in scps`);
+  }
+
+  return {
+    organization: rootScps.length ? { scps: rootScps } : {},
+    ous,
+    scps: Object.fromEntries(Object.entries(scps).filter(([n]) => attached.has(n))),
+    ...(props.cloudtrailBucket
+      ? { auditSinks: { cloudtrail: { bucket: props.cloudtrailBucket, multiRegion: true } } }
+      : {}),
+  };
+}

package/src/index.ts

@@ -114,6 +114,7 @@ export {
   SolrFargateService,
   MicrovmApp, MICROVM_LIMITS,
   AgentCoreAgent,
+  OrganizationRoot, GovernanceFoundation, RegionRestriction, OrganizationTrail,
 } from "./composites/index";
 export type {
   LambdaFunctionProps, LambdaApiProps, ScheduledLambdaProps,
@@ -124,6 +125,7 @@ export type {
   SolrFargateServiceProps,
   MicrovmAppProps, MicrovmAppResult, MicrovmAppBuildConnectorProps, MicrovmMemoryMiB,
   AgentCoreAgentProps, AgentCoreAgentResult,
+  OrganizationRootProps, GovernanceFoundationProps, RegionRestrictionProps, OrganizationTrailProps,
 } from "./composites/index";
 
 // Code generation pipeline
@@ -135,3 +137,8 @@ export type { PackageOptions, PackageResult } from "./codegen/package";
 // emr-*, code-deploy, …) contributed to core's capability-plugin seam. Core
 // loads `awsCapabilityPlugin` when a project's chant.config lists this lexicon.
 export { awsCapabilityPlugin } from "./components/capability-plugin";
+
+// AWS governance authoring (#791): the desired-state config the AWS cloud
+// warden (#792) reconciles, and the typed landing-zone authoring layer.
+export { landingZoneConfig, regionRestriction, DENY_AUDIT_TAMPER, DENY_LEAVE_ORGANIZATION, FOUNDATION_OUS } from "./governance";
+export type { AwsGovernanceConfig, LandingZoneConfigProps, OuConfig, ScpConfig, AccountConfig } from "./governance";