alchemy 2.0.0-beta.4 → 2.0.0-beta.41

package/lib/AWS/IAM/VirtualMFADevice.js

@@ -0,0 +1,197 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.js";
+import { toRedactedBytes, toTagRecord } from "./common.js";
+/**
+ * An IAM virtual MFA device.
+ *
+ * `VirtualMFADevice` creates a software MFA device and can optionally activate
+ * it for a user during creation when the initial authentication codes are
+ * provided.
+ *
+ * @section Managing MFA Devices
+ * @example Create and Activate a Virtual MFA Device
+ * ```typescript
+ * const user = yield* User("AdminUser", {
+ *   userName: "admin-user",
+ * });
+ *
+ * const device = yield* VirtualMFADevice("AdminMfa", {
+ *   userName: user.userName,
+ *   authenticationCode1: "123456",
+ *   authenticationCode2: "654321",
+ * });
+ * ```
+ */
+export const VirtualMFADevice = Resource("AWS.IAM.VirtualMFADevice");
+export const VirtualMFADeviceProvider = () => Provider.effect(VirtualMFADevice, Effect.gen(function* () {
+    const toName = (id, props) => props.virtualMFADeviceName
+        ? Effect.succeed(props.virtualMFADeviceName)
+        : createPhysicalName({ id, maxLength: 226 });
+    const readDevice = Effect.fn(function* ({ serialNumber, userName, }) {
+        if (!userName) {
+            const listed = yield* iam.listVirtualMFADevices({
+                AssignmentStatus: "Unassigned",
+            });
+            const device = listed.VirtualMFADevices.find((entry) => entry.SerialNumber === serialNumber);
+            return device
+                ? {
+                    SerialNumber: device.SerialNumber,
+                    UserName: device.User?.UserName,
+                    EnableDate: device.EnableDate,
+                }
+                : undefined;
+        }
+        return yield* iam
+            .getMFADevice({
+            SerialNumber: serialNumber,
+            UserName: userName,
+        })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)));
+    });
+    return {
+        stables: ["serialNumber"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+            if (!isResolved(news))
+                return;
+            if ((yield* toName(id, olds ?? {})) !==
+                (yield* toName(id, news)) ||
+                (olds.path ?? "/") !== (news.path ?? "/") ||
+                (olds.userName ?? undefined) !== (news.userName ?? undefined) ||
+                (olds.authenticationCode1 ?? undefined) !==
+                    (news.authenticationCode1 ?? undefined) ||
+                (olds.authenticationCode2 ?? undefined) !==
+                    (news.authenticationCode2 ?? undefined)) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ output }) {
+            if (!output) {
+                return undefined;
+            }
+            const response = yield* readDevice({
+                serialNumber: output.serialNumber,
+                userName: output.userName,
+            });
+            if (!response?.SerialNumber) {
+                return undefined;
+            }
+            const tags = yield* iam.listMFADeviceTags({
+                SerialNumber: output.serialNumber,
+            });
+            return {
+                serialNumber: response.SerialNumber,
+                userName: response.UserName ?? output.userName,
+                enableDate: response.EnableDate,
+                base32StringSeed: output.base32StringSeed,
+                qrCodePNG: output.qrCodePNG,
+                tags: toTagRecord(tags.Tags),
+            };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+            const desiredTags = {
+                ...(yield* createInternalTags(id)),
+                ...news.tags,
+            };
+            // Observe — virtual MFA devices have AWS-generated serial
+            // numbers, so we can only locate the existing device when we
+            // already have its serial from a prior output.
+            const observed = output
+                ? yield* readDevice({
+                    serialNumber: output.serialNumber,
+                    userName: output.userName,
+                })
+                : undefined;
+            // Ensure — create the device when missing. The seed and QR
+            // code are only returned on creation, so on adoption the best
+            // we can do is preserve the existing redacted values.
+            let serialNumber = observed?.SerialNumber ?? output?.serialNumber;
+            let base32StringSeed = output?.base32StringSeed;
+            let qrCodePNG = output?.qrCodePNG;
+            if (!observed?.SerialNumber) {
+                const deviceName = yield* toName(id, news);
+                const created = yield* iam.createVirtualMFADevice({
+                    Path: news.path,
+                    VirtualMFADeviceName: deviceName,
+                    Tags: createTagsList(desiredTags),
+                });
+                if (!created.VirtualMFADevice.SerialNumber) {
+                    return yield* Effect.fail(new Error(`createVirtualMFADevice returned no serial number`));
+                }
+                serialNumber = created.VirtualMFADevice.SerialNumber;
+                base32StringSeed = toRedactedBytes(created.VirtualMFADevice.Base32StringSeed);
+                qrCodePNG = toRedactedBytes(created.VirtualMFADevice.QRCodePNG);
+                // The device was just created, so it is unassigned. Activate
+                // it for the user when activation codes are provided. After
+                // first activation the codes lose their meaning (`diff`
+                // triggers replacement on code change).
+                if (news.userName &&
+                    news.authenticationCode1 &&
+                    news.authenticationCode2) {
+                    yield* iam.enableMFADevice({
+                        UserName: news.userName,
+                        SerialNumber: serialNumber,
+                        AuthenticationCode1: news.authenticationCode1,
+                        AuthenticationCode2: news.authenticationCode2,
+                    });
+                }
+            }
+            if (!serialNumber) {
+                return yield* Effect.fail(new Error(`Virtual MFA device has no serial number`));
+            }
+            // Sync tags against the cloud's actual tags.
+            const observedTagsResp = yield* iam.listMFADeviceTags({
+                SerialNumber: serialNumber,
+            });
+            const observedTags = toTagRecord(observedTagsResp.Tags);
+            const { removed, upsert } = diffTags(observedTags, desiredTags);
+            if (upsert.length > 0) {
+                yield* iam.tagMFADevice({
+                    SerialNumber: serialNumber,
+                    Tags: upsert,
+                });
+            }
+            if (removed.length > 0) {
+                yield* iam.untagMFADevice({
+                    SerialNumber: serialNumber,
+                    TagKeys: removed,
+                });
+            }
+            // Re-read for fresh `EnableDate` / `UserName` after activation.
+            const fresh = yield* readDevice({
+                serialNumber,
+                userName: news.userName ?? output?.userName,
+            });
+            yield* session.note(serialNumber);
+            return {
+                serialNumber,
+                userName: fresh?.UserName ?? news.userName ?? output?.userName,
+                enableDate: fresh?.EnableDate ?? output?.enableDate,
+                base32StringSeed,
+                qrCodePNG,
+                tags: desiredTags,
+            };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            if (output.userName) {
+                yield* iam
+                    .deactivateMFADevice({
+                    UserName: output.userName,
+                    SerialNumber: output.serialNumber,
+                })
+                    .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+            }
+            yield* iam
+                .deleteVirtualMFADevice({
+                SerialNumber: output.serialNumber,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+    };
+}));
+//# sourceMappingURL=VirtualMFADevice.js.map

package/lib/AWS/IAM/VirtualMFADevice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VirtualMFADevice.js","sourceRoot":"","sources":["../../../src/AWS/IAM/VirtualMFADevice.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA+C3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CACtC,0BAA0B,CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,EAAE,CAC3C,QAAQ,CAAC,MAAM,CACb,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,KAA4B,EAAE,EAAE,CAC1D,KAAK,CAAC,oBAAoB;QACxB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC;QAC5C,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAEjD,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EACtC,YAAY,EACZ,QAAQ,GAIT;QACC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBAC9C,gBAAgB,EAAE,YAAY;aAC/B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAC1C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,YAAY,CAC/C,CAAC;YACF,OAAO,MAAM;gBACX,CAAC,CAAC;oBACE,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ;oBAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B;gBACH,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,GAAG;aACd,YAAY,CAAC;YACZ,YAAY,EAAE,YAAY;YAC1B,QAAQ,EAAE,QAAQ;SACnB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,cAAc,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IACE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAK,EAA4B,CAAC,CAAC;gBACxD,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;gBAC3B,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;gBACzC,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;gBAC7D,CAAC,IAAI,CAAC,mBAAmB,IAAI,SAAS,CAAC;oBACrC,CAAC,IAAI,CAAC,mBAAmB,IAAI,SAAS,CAAC;gBACzC,CAAC,IAAI,CAAC,mBAAmB,IAAI,SAAS,CAAC;oBACrC,CAAC,IAAI,CAAC,mBAAmB,IAAI,SAAS,CAAC,EACzC,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACnC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;gBACjC,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;gBAC5B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBACxC,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC,CAAC;YACH,OAAO;gBACL,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;gBAC9C,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;aAC7B,CAAC;QACJ,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC3D,MAAM,WAAW,GAAG;gBAClB,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YAEF,0DAA0D;YAC1D,6DAA6D;YAC7D,+CAA+C;YAC/C,MAAM,QAAQ,GAAG,MAAM;gBACrB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;oBAChB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAC;YAEd,2DAA2D;YAC3D,8DAA8D;YAC9D,sDAAsD;YACtD,IAAI,YAAY,GAAG,QAAQ,EAAE,YAAY,IAAI,MAAM,EAAE,YAAY,CAAC;YAClE,IAAI,gBAAgB,GAAG,MAAM,EAAE,gBAAgB,CAAC;YAChD,IAAI,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;YAElC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;gBAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;oBAChD,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,oBAAoB,EAAE,UAAU;oBAChC,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC;iBAClC,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;oBAC3C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAC9D,CAAC;gBACJ,CAAC;gBACD,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,YAAY,CAAC;gBACrD,gBAAgB,GAAG,eAAe,CAChC,OAAO,CAAC,gBAAgB,CAAC,gBAAgB,CAC1C,CAAC;gBACF,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBAEhE,6DAA6D;gBAC7D,4DAA4D;gBAC5D,wDAAwD;gBACxD,wCAAwC;gBACxC,IACE,IAAI,CAAC,QAAQ;oBACb,IAAI,CAAC,mBAAmB;oBACxB,IAAI,CAAC,mBAAmB,EACxB,CAAC;oBACD,KAAK,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;wBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,YAAY,EAAE,YAAY;wBAC1B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;wBAC7C,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;qBAC9C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,yCAAyC,CAAC,CACrD,CAAC;YACJ,CAAC;YAED,6CAA6C;YAC7C,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBACpD,YAAY,EAAE,YAAY;aAC3B,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;oBACtB,YAAY,EAAE,YAAY;oBAC1B,IAAI,EAAE,MAAM;iBACb,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;oBACxB,YAAY,EAAE,YAAY;oBAC1B,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,gEAAgE;YAChE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;gBAC9B,YAAY;gBACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE,QAAQ;aAC5C,CAAC,CAAC;YAEH,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAClC,OAAO;gBACL,YAAY;gBACZ,QAAQ,EAAE,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE,QAAQ;gBAC9D,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU;gBACnD,gBAAgB;gBAChB,SAAS;gBACT,IAAI,EAAE,WAAW;aAClB,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,KAAK,CAAC,CAAC,GAAG;qBACP,mBAAmB,CAAC;oBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;iBAClC,CAAC;qBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC5D,CAAC;YACN,CAAC;YACD,KAAK,CAAC,CAAC,GAAG;iBACP,sBAAsB,CAAC;gBACtB,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/AWS/IAM/common.d.ts

@@ -0,0 +1,20 @@
+import type * as iam from "@distilled.cloud/aws/iam";
+import * as Redacted from "effect/Redacted";
+import type { PolicyDocument } from "./Policy.ts";
+export declare const toTagRecord: (tags: Array<{
+    Key?: string;
+    Value?: string;
+}> | undefined) => Record<string, string>;
+export declare const parsePolicyDocument: (value: string | undefined) => PolicyDocument | undefined;
+export declare const stringifyPolicyDocument: (value: PolicyDocument) => string;
+export declare const normalizeIamPath: (value: string | undefined) => string;
+export declare const policyArnFromParts: ({ accountId, path, policyName, }: {
+    accountId: string;
+    path: string | undefined;
+    policyName: string;
+}) => string;
+export declare const oldestNondefaultPolicyVersion: (versions: iam.PolicyVersion[] | undefined) => iam.PolicyVersion;
+export declare const toRedactedString: (value: string | Redacted.Redacted<string> | undefined) => Redacted.Redacted<string> | undefined;
+export declare const toRedactedBytes: (value: Uint8Array<ArrayBufferLike> | Redacted.Redacted<Uint8Array<ArrayBufferLike>> | undefined) => Redacted.Redacted<Uint8Array<ArrayBufferLike>> | undefined;
+export declare const unwrapRedactedString: (value: string | Redacted.Redacted<string>) => string;
+//# sourceMappingURL=common.d.ts.map

package/lib/AWS/IAM/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/AWS/IAM/common.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,GAAG,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,eAAO,MAAM,WAAW,GACtB,MAAM,KAAK,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,KACxD,MAAM,CAAC,MAAM,EAAE,MAAM,CAQrB,CAAC;AAUJ,eAAO,MAAM,mBAAmB,GAC9B,OAAO,MAAM,GAAG,SAAS,KACxB,cAAc,GAAG,SAOnB,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAAI,OAAO,cAAc,WACtC,CAAC;AAExB,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,GAAG,SAAS,WAMzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,kCAIhC;IACD,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,WAA6E,CAAC;AAE/E,eAAO,MAAM,6BAA6B,GACxC,UAAU,GAAG,CAAC,aAAa,EAAE,GAAG,SAAS,sBAMnC,CAAC;AAET,eAAO,MAAM,gBAAgB,GAC3B,OAAO,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,KACpD,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAKlB,CAAC;AAEd,eAAO,MAAM,eAAe,GAC1B,OACI,UAAU,CAAC,eAAe,CAAC,GAC3B,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,GAC9C,SAAS,KACZ,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,GAAG,SAKvC,CAAC;AAEd,eAAO,MAAM,oBAAoB,GAC/B,OAAO,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KACxC,MAAqE,CAAC"}

package/lib/AWS/IAM/common.js

@@ -0,0 +1,43 @@
+import * as Redacted from "effect/Redacted";
+export const toTagRecord = (tags) => Object.fromEntries((tags ?? [])
+    .filter((tag) => typeof tag.Key === "string" && typeof tag.Value === "string")
+    .map((tag) => [tag.Key, tag.Value]));
+const decodePolicyString = (value) => {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+};
+export const parsePolicyDocument = (value) => {
+    if (!value) {
+        return undefined;
+    }
+    const decoded = decodePolicyString(value);
+    return JSON.parse(decoded);
+};
+export const stringifyPolicyDocument = (value) => JSON.stringify(value);
+export const normalizeIamPath = (value) => {
+    const path = value ?? "/";
+    const withLeadingSlash = path.startsWith("/") ? path : `/${path}`;
+    return withLeadingSlash.endsWith("/")
+        ? withLeadingSlash
+        : `${withLeadingSlash}/`;
+};
+export const policyArnFromParts = ({ accountId, path, policyName, }) => `arn:aws:iam::${accountId}:policy${normalizeIamPath(path)}${policyName}`;
+export const oldestNondefaultPolicyVersion = (versions) => [...(versions ?? [])]
+    .filter((version) => !version.IsDefaultVersion && version.VersionId)
+    .sort((a, b) => (a.CreateDate?.getTime() ?? 0) - (b.CreateDate?.getTime() ?? 0))[0];
+export const toRedactedString = (value) => value === undefined
+    ? undefined
+    : typeof value === "string"
+        ? Redacted.make(value)
+        : value;
+export const toRedactedBytes = (value) => value === undefined
+    ? undefined
+    : value instanceof Uint8Array
+        ? Redacted.make(value)
+        : value;
+export const unwrapRedactedString = (value) => (typeof value === "string" ? value : Redacted.value(value));
+//# sourceMappingURL=common.js.map

package/lib/AWS/IAM/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../src/AWS/IAM/common.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,IAAyD,EACjC,EAAE,CAC1B,MAAM,CAAC,WAAW,CAChB,CAAC,IAAI,IAAI,EAAE,CAAC;KACT,MAAM,CACL,CAAC,GAAG,EAAyC,EAAE,CAC7C,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAC/D;KACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CACtC,CAAC;AAEJ,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAE,EAAE;IAC3C,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,KAAyB,EACG,EAAE;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;AAC/C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAqB,EAAE,EAAE,CAC/D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAAE,EAAE;IAC5D,MAAM,IAAI,GAAG,KAAK,IAAI,GAAG,CAAC;IAC1B,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAClE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,GAAG,gBAAgB,GAAG,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,EACjC,SAAS,EACT,IAAI,EACJ,UAAU,GAKX,EAAE,EAAE,CAAC,gBAAgB,SAAS,UAAU,gBAAgB,CAAC,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC;AAE/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,QAAyC,EACzC,EAAE,CACF,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;KAClB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,SAAS,CAAC;KACnE,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAC1E,CAAC,CAAC,CAAC,CAAC;AAET,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,KAAqD,EACd,EAAE,CACzC,KAAK,KAAK,SAAS;IACjB,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QACtB,CAAC,CAAC,KAAK,CAAC;AAEd,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,KAGa,EAC+C,EAAE,CAC9D,KAAK,KAAK,SAAS;IACjB,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,KAAK,YAAY,UAAU;QAC3B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QACtB,CAAC,CAAC,KAAK,CAAC;AAEd,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,KAAyC,EACjC,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC"}

package/lib/AWS/IAM/index.d.ts

@@ -0,0 +1,18 @@
+export { AccessKey, AccessKeyProvider } from "./AccessKey.ts";
+export { AccountAlias, AccountAliasProvider } from "./AccountAlias.ts";
+export { AccountPasswordPolicy, AccountPasswordPolicyProvider, } from "./AccountPasswordPolicy.ts";
+export { Group, GroupProvider } from "./Group.ts";
+export { GroupMembership, GroupMembershipProvider } from "./GroupMembership.ts";
+export { InstanceProfile, InstanceProfileProvider } from "./InstanceProfile.ts";
+export { LoginProfile, LoginProfileProvider } from "./LoginProfile.ts";
+export { OpenIDConnectProvider, OpenIDConnectProviderProvider, } from "./OpenIDConnectProvider.ts";
+export { Policy, PolicyProvider, type PolicyDocument, type PolicyStatement, } from "./Policy.ts";
+export { Role, RoleProvider } from "./Role.ts";
+export { SAMLProvider, SAMLProviderProvider } from "./SAMLProvider.ts";
+export { ServerCertificate, ServerCertificateProvider, } from "./ServerCertificate.ts";
+export { ServiceSpecificCredential, ServiceSpecificCredentialProvider, } from "./ServiceSpecificCredential.ts";
+export { SigningCertificate, SigningCertificateProvider, } from "./SigningCertificate.ts";
+export { SSHPublicKey, SSHPublicKeyProvider } from "./SSHPublicKey.ts";
+export { User, UserProvider } from "./User.ts";
+export { VirtualMFADevice, VirtualMFADeviceProvider, } from "./VirtualMFADevice.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/AWS/IAM/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/AWS/IAM/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,MAAM,EACN,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC"}

package/lib/AWS/IAM/index.js

@@ -0,0 +1,18 @@
+export { AccessKey, AccessKeyProvider } from "./AccessKey.js";
+export { AccountAlias, AccountAliasProvider } from "./AccountAlias.js";
+export { AccountPasswordPolicy, AccountPasswordPolicyProvider, } from "./AccountPasswordPolicy.js";
+export { Group, GroupProvider } from "./Group.js";
+export { GroupMembership, GroupMembershipProvider } from "./GroupMembership.js";
+export { InstanceProfile, InstanceProfileProvider } from "./InstanceProfile.js";
+export { LoginProfile, LoginProfileProvider } from "./LoginProfile.js";
+export { OpenIDConnectProvider, OpenIDConnectProviderProvider, } from "./OpenIDConnectProvider.js";
+export { Policy, PolicyProvider, } from "./Policy.js";
+export { Role, RoleProvider } from "./Role.js";
+export { SAMLProvider, SAMLProviderProvider } from "./SAMLProvider.js";
+export { ServerCertificate, ServerCertificateProvider, } from "./ServerCertificate.js";
+export { ServiceSpecificCredential, ServiceSpecificCredentialProvider, } from "./ServiceSpecificCredential.js";
+export { SigningCertificate, SigningCertificateProvider, } from "./SigningCertificate.js";
+export { SSHPublicKey, SSHPublicKeyProvider } from "./SSHPublicKey.js";
+export { User, UserProvider } from "./User.js";
+export { VirtualMFADevice, VirtualMFADeviceProvider, } from "./VirtualMFADevice.js";
+//# sourceMappingURL=index.js.map

package/lib/AWS/IAM/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/AWS/IAM/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,MAAM,EACN,cAAc,GAGf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC"}

package/lib/AWS/IdentityCenter/AccountAssignment.d.ts

@@ -0,0 +1,53 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export interface AccountAssignmentProps {
+    /**
+     * Explicit Identity Center instance ARN.
+     * If omitted, Alchemy adopts the only visible instance.
+     */
+    instanceArn?: string;
+    /**
+     * Permission set ARN to assign.
+     */
+    permissionSetArn: string;
+    /**
+     * Principal ID from the IAM Identity Center identity store.
+     */
+    principalId: string;
+    /**
+     * Principal type.
+     */
+    principalType: "USER" | "GROUP";
+    /**
+     * Target AWS account ID.
+     */
+    targetId: string;
+}
+export interface AccountAssignment extends Resource<"AWS.IdentityCenter.AccountAssignment", AccountAssignmentProps, {
+    instanceArn: string;
+    permissionSetArn: string;
+    principalId: string;
+    principalType: "USER" | "GROUP";
+    targetId: string;
+    targetType: "AWS_ACCOUNT";
+}, never, Providers> {
+}
+/**
+ * Assigns an IAM Identity Center permission set to a user or group in an AWS
+ * account.
+ *
+ * @section Creating Assignments
+ * @example Assign A Group To A Workload Account
+ * ```typescript
+ * const assignment = yield* AccountAssignment("ProdAdminAssignment", {
+ *   permissionSetArn: admin.permissionSetArn,
+ *   principalType: "GROUP",
+ *   principalId: engineers.groupId,
+ *   targetId: prod.accountId,
+ * });
+ * ```
+ */
+export declare const AccountAssignment: import("../../Resource.ts").ResourceClass<AccountAssignment>;
+export declare const AccountAssignmentProvider: () => import("effect/Layer").Layer<Provider.Provider<AccountAssignment>, never, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=AccountAssignment.d.ts.map

package/lib/AWS/IdentityCenter/AccountAssignment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountAssignment.d.ts","sourceRoot":"","sources":["../../../src/AWS/IdentityCenter/AccountAssignment.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,sCAAsC,EACtC,sBAAsB,EACtB;IACE,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,aAAa,CAAC;CAC3B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,8DAE7B,CAAC;AAEF,eAAO,MAAM,yBAAyB,+OA0HnC,CAAC"}

package/lib/AWS/IdentityCenter/AccountAssignment.js

@@ -0,0 +1,180 @@
+import * as ssoAdmin from "@distilled.cloud/aws/sso-admin";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { resolveInstance, retryIdentityCenter } from "./common.js";
+/**
+ * Assigns an IAM Identity Center permission set to a user or group in an AWS
+ * account.
+ *
+ * @section Creating Assignments
+ * @example Assign A Group To A Workload Account
+ * ```typescript
+ * const assignment = yield* AccountAssignment("ProdAdminAssignment", {
+ *   permissionSetArn: admin.permissionSetArn,
+ *   principalType: "GROUP",
+ *   principalId: engineers.groupId,
+ *   targetId: prod.accountId,
+ * });
+ * ```
+ */
+export const AccountAssignment = Resource("AWS.IdentityCenter.AccountAssignment");
+export const AccountAssignmentProvider = () => Provider.effect(AccountAssignment, Effect.gen(function* () {
+    return {
+        stables: [
+            "instanceArn",
+            "permissionSetArn",
+            "principalId",
+            "principalType",
+            "targetId",
+            "targetType",
+        ],
+        diff: Effect.fn(function* ({ olds, news }) {
+            if (!isResolved(news))
+                return;
+            if (olds?.instanceArn !== news.instanceArn ||
+                olds?.permissionSetArn !== news.permissionSetArn ||
+                olds?.principalId !== news.principalId ||
+                olds?.principalType !== news.principalType ||
+                olds?.targetId !== news.targetId) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+            if (output?.instanceArn) {
+                return yield* readAssignment({
+                    instanceArn: output.instanceArn,
+                    permissionSetArn: output.permissionSetArn,
+                    principalId: output.principalId,
+                    principalType: output.principalType,
+                    targetId: output.targetId,
+                });
+            }
+            if (!olds) {
+                return undefined;
+            }
+            return yield* readAssignment(olds);
+        }),
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+            // Observe — look up the assignment between (principal,
+            // permissionSet, target). All identifying fields are stable;
+            // diff() forces a replace on any change, so this reconcile is
+            // existence-only.
+            const existing = yield* readAssignment({
+                ...news,
+                instanceArn: output?.instanceArn ?? news.instanceArn,
+            });
+            if (existing) {
+                yield* session.note(`${existing.targetId}:${existing.permissionSetArn}:${existing.principalId}`);
+                return existing;
+            }
+            // Ensure — create the assignment if missing.
+            const instance = yield* resolveInstance(news.instanceArn);
+            const response = yield* retryIdentityCenter(ssoAdmin.createAccountAssignment({
+                InstanceArn: instance.InstanceArn,
+                PermissionSetArn: news.permissionSetArn,
+                PrincipalId: news.principalId,
+                PrincipalType: news.principalType,
+                TargetId: news.targetId,
+                TargetType: "AWS_ACCOUNT",
+            }));
+            const requestId = response.AccountAssignmentCreationStatus?.RequestId ?? undefined;
+            if (requestId) {
+                yield* waitForAssignmentCreation(instance.InstanceArn, requestId);
+            }
+            const created = yield* readAssignment({
+                ...news,
+                instanceArn: instance.InstanceArn,
+            });
+            if (!created) {
+                return yield* Effect.fail(new Error("account assignment not found after create"));
+            }
+            yield* session.note(`${created.targetId}:${created.permissionSetArn}:${created.principalId}`);
+            return created;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            if (!(yield* readAssignment(output))) {
+                return;
+            }
+            const response = yield* retryIdentityCenter(ssoAdmin
+                .deleteAccountAssignment({
+                InstanceArn: output.instanceArn,
+                PermissionSetArn: output.permissionSetArn,
+                PrincipalId: output.principalId,
+                PrincipalType: output.principalType,
+                TargetId: output.targetId,
+                TargetType: "AWS_ACCOUNT",
+            })
+                .pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.succeed(undefined))));
+            const requestId = response?.AccountAssignmentDeletionStatus?.RequestId ?? undefined;
+            if (requestId) {
+                yield* waitForAssignmentDeletion(output.instanceArn, requestId);
+            }
+        }),
+    };
+}));
+const readAssignment = Effect.fn(function* ({ instanceArn, permissionSetArn, principalId, principalType, targetId, }) {
+    const instance = yield* resolveInstance(instanceArn);
+    const assignments = yield* ssoAdmin.listAccountAssignments
+        .items({
+        InstanceArn: instance.InstanceArn,
+        AccountId: targetId,
+        PermissionSetArn: permissionSetArn,
+        MaxResults: 100,
+    })
+        .pipe(Stream.runCollect, Effect.map((items) => Array.from(items)));
+    const match = assignments.find((assignment) => assignment.PrincipalId === principalId &&
+        assignment.PrincipalType === principalType);
+    return match
+        ? {
+            instanceArn: instance.InstanceArn,
+            permissionSetArn,
+            principalId,
+            principalType,
+            targetId,
+            targetType: "AWS_ACCOUNT",
+        }
+        : undefined;
+});
+const waitForAssignmentCreation = (instanceArn, requestId) => Effect.gen(function* () {
+    const response = yield* retryIdentityCenter(ssoAdmin.describeAccountAssignmentCreationStatus({
+        InstanceArn: instanceArn,
+        AccountAssignmentCreationRequestId: requestId,
+    }));
+    const status = response.AccountAssignmentCreationStatus;
+    if (!status?.Status || status.Status === "IN_PROGRESS") {
+        return yield* Effect.fail({
+            _tag: "AssignmentCreationInProgress",
+        });
+    }
+    if (status.Status === "FAILED") {
+        return yield* Effect.fail(new Error(`account assignment creation failed: ${status.FailureReason ?? "unknown failure"}`));
+    }
+    return status;
+}).pipe(Effect.retry({
+    while: (error) => error?._tag === "AssignmentCreationInProgress",
+    schedule: Schedule.spaced("2 seconds").pipe(Schedule.both(Schedule.recurs(120))),
+}));
+const waitForAssignmentDeletion = (instanceArn, requestId) => Effect.gen(function* () {
+    const response = yield* retryIdentityCenter(ssoAdmin.describeAccountAssignmentDeletionStatus({
+        InstanceArn: instanceArn,
+        AccountAssignmentDeletionRequestId: requestId,
+    }));
+    const status = response.AccountAssignmentDeletionStatus;
+    if (!status?.Status || status.Status === "IN_PROGRESS") {
+        return yield* Effect.fail({
+            _tag: "AssignmentDeletionInProgress",
+        });
+    }
+    if (status.Status === "FAILED") {
+        return yield* Effect.fail(new Error(`account assignment deletion failed: ${status.FailureReason ?? "unknown failure"}`));
+    }
+    return status;
+}).pipe(Effect.retry({
+    while: (error) => error?._tag === "AssignmentDeletionInProgress",
+    schedule: Schedule.spaced("2 seconds").pipe(Schedule.both(Schedule.recurs(120))),
+}));
+//# sourceMappingURL=AccountAssignment.js.map

package/lib/AWS/IdentityCenter/AccountAssignment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountAssignment.js","sourceRoot":"","sources":["../../../src/AWS/IdentityCenter/AccountAssignment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gCAAgC,CAAC;AAC3D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAyCnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CACvC,sCAAsC,CACvC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,EAAE,CAC5C,QAAQ,CAAC,MAAM,CACb,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,OAAO,EAAE;YACP,aAAa;YACb,kBAAkB;YAClB,aAAa;YACb,eAAe;YACf,UAAU;YACV,YAAY;SACb;QACD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IACE,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC,WAAW;gBACtC,IAAI,EAAE,gBAAgB,KAAK,IAAI,CAAC,gBAAgB;gBAChD,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC,WAAW;gBACtC,IAAI,EAAE,aAAa,KAAK,IAAI,CAAC,aAAa;gBAC1C,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAChC,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACzC,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC,CAAC,cAAc,CAAC;oBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,OAAO,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YACvD,uDAAuD;YACvD,6DAA6D;YAC7D,8DAA8D;YAC9D,kBAAkB;YAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;gBACrC,GAAG,IAAI;gBACP,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,IAAI,CAAC,WAAW;aACrD,CAAC,CAAC;YACH,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CACjB,GAAG,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,WAAW,EAAE,CAC5E,CAAC;gBACF,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,6CAA6C;YAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACzC,QAAQ,CAAC,uBAAuB,CAAC;gBAC/B,WAAW,EAAE,QAAQ,CAAC,WAAY;gBAClC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,aAAa;aAC1B,CAAC,CACH,CAAC;YAEF,MAAM,SAAS,GACb,QAAQ,CAAC,+BAA+B,EAAE,SAAS,IAAI,SAAS,CAAC;YACnE,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC,WAAY,EAAE,SAAS,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;gBACpC,GAAG,IAAI;gBACP,WAAW,EAAE,QAAQ,CAAC,WAAW;aAClC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,2CAA2C,CAAC,CACvD,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CACjB,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,WAAW,EAAE,CACzE,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACrC,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACzC,QAAQ;iBACL,uBAAuB,CAAC;gBACvB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,aAAa;aAC1B,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CACJ,CAAC;YAEF,MAAM,SAAS,GACb,QAAQ,EAAE,+BAA+B,EAAE,SAAS,IAAI,SAAS,CAAC;YACpE,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAClE,CAAC;QACH,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC1C,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,QAAQ,GACe;IACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,sBAAsB;SACvD,KAAK,CAAC;QACL,WAAW,EAAE,QAAQ,CAAC,WAAY;QAClC,SAAS,EAAE,QAAQ;QACnB,gBAAgB,EAAE,gBAAgB;QAClC,UAAU,EAAE,GAAG;KAChB,CAAC;SACD,IAAI,CACH,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAiC,CAAC,CACzE,CAAC;IAEJ,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAC5B,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,WAAW,KAAK,WAAW;QACtC,UAAU,CAAC,aAAa,KAAK,aAAa,CAC7C,CAAC;IAEF,OAAO,KAAK;QACV,CAAC,CAAE;YACC,WAAW,EAAE,QAAQ,CAAC,WAAY;YAClC,gBAAgB;YAChB,WAAW;YACX,aAAa;YACb,QAAQ;YACR,UAAU,EAAE,aAAa;SACiB;QAC9C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,WAAmB,EAAE,SAAiB,EAAE,EAAE,CAC3E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACzC,QAAQ,CAAC,uCAAuC,CAAC;QAC/C,WAAW,EAAE,WAAW;QACxB,kCAAkC,EAAE,SAAS;KAC9C,CAAC,CACH,CAAC;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,+BAA+B,CAAC;IAExD,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YACxB,IAAI,EAAE,8BAAuC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,uCAAuC,MAAM,CAAC,aAAa,IAAI,iBAAiB,EAAE,CACnF,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC;IACX,KAAK,EAAE,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,KAAK,8BAA8B;IACrE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CACzC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACpC;CACF,CAAC,CACH,CAAC;AAEJ,MAAM,yBAAyB,GAAG,CAAC,WAAmB,EAAE,SAAiB,EAAE,EAAE,CAC3E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACzC,QAAQ,CAAC,uCAAuC,CAAC;QAC/C,WAAW,EAAE,WAAW;QACxB,kCAAkC,EAAE,SAAS;KAC9C,CAAC,CACH,CAAC;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,+BAA+B,CAAC;IAExD,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YACxB,IAAI,EAAE,8BAAuC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,uCAAuC,MAAM,CAAC,aAAa,IAAI,iBAAiB,EAAE,CACnF,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC;IACX,KAAK,EAAE,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,KAAK,8BAA8B;IACrE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CACzC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACpC;CACF,CAAC,CACH,CAAC"}

package/lib/AWS/IdentityCenter/Group.d.ts

@@ -0,0 +1,46 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export interface GroupProps {
+    /**
+     * Explicit identity store ID.
+     * If omitted, Alchemy resolves it from the selected Identity Center instance.
+     */
+    identityStoreId?: string;
+    /**
+     * Optional instance ARN used to discover the identity store ID.
+     */
+    instanceArn?: string;
+    /**
+     * Group display name.
+     */
+    displayName: string;
+    /**
+     * Optional group description.
+     */
+    description?: string;
+}
+export interface Group extends Resource<"AWS.IdentityCenter.Group", GroupProps, {
+    identityStoreId: string;
+    groupId: string;
+    displayName: string | undefined;
+    description: string | undefined;
+    createdAt: Date | undefined;
+    updatedAt: Date | undefined;
+}, never, Providers> {
+}
+/**
+ * A group in the IAM Identity Center identity store.
+ *
+ * @section Creating Groups
+ * @example Platform Engineers
+ * ```typescript
+ * const engineers = yield* Group("PlatformEngineers", {
+ *   displayName: "platform-engineers",
+ *   description: "Platform engineering team",
+ * });
+ * ```
+ */
+export declare const Group: import("../../Resource.ts").ResourceClass<Group>;
+export declare const GroupProvider: () => import("effect/Layer").Layer<Provider.Provider<Group>, never, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=Group.d.ts.map

package/lib/AWS/IdentityCenter/Group.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Group.d.ts","sourceRoot":"","sources":["../../../src/AWS/IdentityCenter/Group.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAOjD,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,KAAM,SAAQ,QAAQ,CACrC,0BAA0B,EAC1B,UAAU,EACV;IACE,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,EAAE,IAAI,GAAG,SAAS,CAAC;IAC5B,SAAS,EAAE,IAAI,GAAG,SAAS,CAAC;CAC7B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,KAAK,kDAA8C,CAAC;AAEjE,eAAO,MAAM,aAAa,mOAgIvB,CAAC"}