alchemy 2.0.0-beta.4 → 2.0.0-beta.41

package/lib/AWS/Organizations/OrganizationalUnit.d.ts

@@ -0,0 +1,42 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export type OrganizationalUnitId = string;
+export type OrganizationalUnitArn = string;
+export interface OrganizationalUnitProps {
+    /**
+     * Parent root or OU ID.
+     */
+    parentId: string;
+    /**
+     * OU name. If omitted, Alchemy generates one.
+     */
+    name?: string;
+    /**
+     * Optional tags applied to the OU.
+     */
+    tags?: Record<string, string>;
+}
+export interface OrganizationalUnit extends Resource<"AWS.Organizations.OrganizationalUnit", OrganizationalUnitProps, {
+    ouId: OrganizationalUnitId;
+    ouArn: OrganizationalUnitArn;
+    name: string;
+    parentId: string | undefined;
+    tags: Record<string, string>;
+}, never, Providers> {
+}
+/**
+ * An AWS Organizations organizational unit.
+ *
+ * @section Creating OUs
+ * @example Nested OU
+ * ```typescript
+ * const workloads = yield* OrganizationalUnit("Workloads", {
+ *   parentId: root.rootId,
+ *   name: "workloads",
+ * });
+ * ```
+ */
+export declare const OrganizationalUnit: import("../../Resource.ts").ResourceClass<OrganizationalUnit>;
+export declare const OrganizationalUnitProvider: () => import("effect/Layer").Layer<Provider.Provider<OrganizationalUnit>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=OrganizationalUnit.d.ts.map

package/lib/AWS/Organizations/OrganizationalUnit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OrganizationalUnit.d.ts","sourceRoot":"","sources":["../../../src/AWS/Organizations/OrganizationalUnit.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AASjD,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC1C,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE3C,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,sCAAsC,EACtC,uBAAuB,EACvB;IACE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,+DAE9B,CAAC;AAEF,eAAO,MAAM,0BAA0B,kTAgIpC,CAAC"}

package/lib/AWS/Organizations/OrganizationalUnit.js

@@ -0,0 +1,148 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.js";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { hasAlchemyTags } from "../../Tags.js";
+import { collectPages, createName, readResourceTags, retryOrganizations, updateResourceTags, } from "./common.js";
+/**
+ * An AWS Organizations organizational unit.
+ *
+ * @section Creating OUs
+ * @example Nested OU
+ * ```typescript
+ * const workloads = yield* OrganizationalUnit("Workloads", {
+ *   parentId: root.rootId,
+ *   name: "workloads",
+ * });
+ * ```
+ */
+export const OrganizationalUnit = Resource("AWS.Organizations.OrganizationalUnit");
+export const OrganizationalUnitProvider = () => Provider.effect(OrganizationalUnit, Effect.gen(function* () {
+    return {
+        stables: ["ouId", "ouArn"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+            if (!isResolved(news))
+                return;
+            const oldName = yield* toName(id, olds ?? {});
+            const newName = yield* toName(id, news ?? {});
+            if (olds?.parentId !== news?.parentId) {
+                return { action: "replace" };
+            }
+            if (oldName !== newName) {
+                return { action: "update" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            const state = output?.ouId
+                ? yield* readOUById(output.ouId)
+                : olds?.parentId
+                    ? yield* readOUByParentAndName({
+                        parentId: olds.parentId,
+                        name: yield* toName(id, olds ?? {}),
+                    })
+                    : undefined;
+            if (!state)
+                return undefined;
+            return (yield* hasAlchemyTags(id, state.tags))
+                ? state
+                : Unowned(state);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+            const name = yield* toName(id, news);
+            // Observe — locate the OU by ID if known, else by parent+name.
+            // We fetch fresh so the reconciler converges over drift, adoption,
+            // and partial prior runs. `output.ouId` is treated only as a
+            // cache.
+            let state = output?.ouId
+                ? yield* readOUById(output.ouId)
+                : yield* readOUByParentAndName({
+                    parentId: news.parentId,
+                    name,
+                });
+            // Ensure — create the OU if missing. Tolerate
+            // `DuplicateOrganizationalUnitException` as adoption when a peer
+            // reconciler created it concurrently.
+            if (!state) {
+                yield* retryOrganizations(organizations
+                    .createOrganizationalUnit({
+                    ParentId: news.parentId,
+                    Name: name,
+                })
+                    .pipe(Effect.catchTag("DuplicateOrganizationalUnitException", () => Effect.void)));
+                state = yield* readOUByParentAndName({
+                    parentId: news.parentId,
+                    name,
+                });
+                if (!state) {
+                    return yield* Effect.fail(new Error(`organizational unit '${name}' not found after create`));
+                }
+            }
+            // Sync name — observed ↔ desired. `parentId` is replacement-only,
+            // so the diff has handled any cross-parent move.
+            if (state.name !== name) {
+                yield* retryOrganizations(organizations.updateOrganizationalUnit({
+                    OrganizationalUnitId: state.ouId,
+                    Name: name,
+                }));
+            }
+            // Sync tags — diff observed cloud tags against desired so
+            // adoption and drift converge correctly without trusting `olds`.
+            const tags = yield* updateResourceTags({
+                id,
+                resourceId: state.ouId,
+                olds: state.tags,
+                news: news.tags,
+            });
+            const updated = yield* readOUById(state.ouId);
+            if (!updated) {
+                return yield* Effect.fail(new Error(`organizational unit '${state.ouId}' not found after reconcile`));
+            }
+            yield* session.note(updated.ouArn);
+            return {
+                ...updated,
+                tags,
+            };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* retryOrganizations(organizations
+                .deleteOrganizationalUnit({
+                OrganizationalUnitId: output.ouId,
+            })
+                .pipe(Effect.catchTag("OrganizationalUnitNotFoundException", () => Effect.void)));
+        }),
+    };
+}));
+const toName = (id, props = {}) => createName(id, props.name, 128);
+const listOUsForParent = (parentId) => collectPages((NextToken) => organizations.listOrganizationalUnitsForParent({
+    ParentId: parentId,
+    NextToken,
+}), (page) => page.OrganizationalUnits).pipe(retryOrganizations);
+const readParentId = (childId) => collectPages((NextToken) => organizations.listParents({ ChildId: childId, NextToken }), (page) => page.Parents).pipe(retryOrganizations, Effect.map((parents) => parents[0]?.Id));
+const readOUById = Effect.fn(function* (ouId) {
+    const described = yield* retryOrganizations(organizations
+        .describeOrganizationalUnit({
+        OrganizationalUnitId: ouId,
+    })
+        .pipe(Effect.map((response) => response.OrganizationalUnit), Effect.catchTag("OrganizationalUnitNotFoundException", () => Effect.succeed(undefined))));
+    if (!described?.Id || !described.Arn || !described.Name) {
+        return undefined;
+    }
+    const [parentId, tags] = yield* Effect.all([
+        readParentId(described.Id).pipe(Effect.catchTag("ChildNotFoundException", () => Effect.succeed(undefined))),
+        readResourceTags(described.Id).pipe(Effect.catchTag("TargetNotFoundException", () => Effect.succeed({}))),
+    ]);
+    return {
+        ouId: described.Id,
+        ouArn: described.Arn,
+        name: described.Name,
+        parentId,
+        tags,
+    };
+});
+const readOUByParentAndName = Effect.fn(function* ({ parentId, name, }) {
+    const match = (yield* listOUsForParent(parentId)).find((ou) => ou.Name === name);
+    return match?.Id ? yield* readOUById(match.Id) : undefined;
+});
+//# sourceMappingURL=OrganizationalUnit.js.map

package/lib/AWS/Organizations/OrganizationalUnit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OrganizationalUnit.js","sourceRoot":"","sources":["../../../src/AWS/Organizations/OrganizationalUnit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAkCrB;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CACxC,sCAAsC,CACvC,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,EAAE,CAC7C,QAAQ,CAAC,MAAM,CACb,kBAAkB,EAClB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAE9C,IAAI,IAAI,EAAE,QAAQ,KAAK,IAAI,EAAE,QAAQ,EAAE,CAAC;gBACtC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAW,CAAC;YACvC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,MAAM,KAAK,GAAG,MAAM,EAAE,IAAI;gBACxB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;gBAChC,CAAC,CAAC,IAAI,EAAE,QAAQ;oBACd,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;wBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC;qBACpC,CAAC;oBACJ,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5C,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAErC,+DAA+D;YAC/D,mEAAmE;YACnE,6DAA6D;YAC7D,SAAS;YACT,IAAI,KAAK,GAAG,MAAM,EAAE,IAAI;gBACtB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;gBAChC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;oBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI;iBACL,CAAC,CAAC;YAEP,8CAA8C;YAC9C,iEAAiE;YACjE,sCAAsC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,CAAC,CAAC,kBAAkB,CACvB,aAAa;qBACV,wBAAwB,CAAC;oBACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,IAAI;iBACX,CAAC;qBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,sCAAsC,EACtC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAClB,CACF,CACJ,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;oBACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI;iBACL,CAAC,CAAC;gBACH,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,wBAAwB,IAAI,0BAA0B,CACvD,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,iDAAiD;YACjD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACxB,KAAK,CAAC,CAAC,kBAAkB,CACvB,aAAa,CAAC,wBAAwB,CAAC;oBACrC,oBAAoB,EAAE,KAAK,CAAC,IAAI;oBAChC,IAAI,EAAE,IAAI;iBACX,CAAC,CACH,CAAC;YACJ,CAAC;YAED,0DAA0D;YAC1D,iEAAiE;YACjE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;gBACrC,EAAE;gBACF,UAAU,EAAE,KAAK,CAAC,IAAI;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,wBAAwB,KAAK,CAAC,IAAI,6BAA6B,CAChE,CACF,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACnC,OAAO;gBACL,GAAG,OAAO;gBACV,IAAI;aACL,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,kBAAkB,CACvB,aAAa;iBACV,wBAAwB,CAAC;gBACxB,oBAAoB,EAAE,MAAM,CAAC,IAAI;aAClC,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,qCAAqC,EACrC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAClB,CACF,CACJ,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,QAA2B,EAAE,EAAE,EAAE,CAC3D,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAElC,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,EAAE,CAC5C,YAAY,CACV,CAAC,SAAS,EAAE,EAAE,CACZ,aAAa,CAAC,gCAAgC,CAAC;IAC7C,QAAQ,EAAE,QAAQ;IAClB,SAAS;CACV,CAAC,EACJ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CACnC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAE7B,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,EAAE,CACvC,YAAY,CACV,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EACzE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CACvB,CAAC,IAAI,CACJ,kBAAkB,EAClB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACxC,CAAC;AAEJ,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAY;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,kBAAkB,CACzC,aAAa;SACV,0BAA0B,CAAC;QAC1B,oBAAoB,EAAE,IAAI;KAC3B,CAAC;SACD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EACrD,MAAM,CAAC,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE,CAC1D,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CACJ,CAAC;IAEF,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACzC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAC7B,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAC7C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF;QACD,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CACjC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACrE;KACF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,EAAE;QAClB,KAAK,EAAE,SAAS,CAAC,GAAG;QACpB,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,QAAQ;QACR,IAAI;KACsC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EACjD,QAAQ,EACR,IAAI,GAIL;IACC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CACpD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CACzB,CAAC;IACF,OAAO,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC,CAAC,CAAC"}

package/lib/AWS/Organizations/Policy.d.ts

@@ -0,0 +1,47 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { PolicyDocument } from "../IAM/Policy.ts";
+export type PolicyId = string;
+export type PolicyArn = string;
+export interface PolicyProps {
+    /**
+     * Policy name. If omitted, Alchemy generates one.
+     */
+    name?: string;
+    /**
+     * Policy description.
+     * @default ""
+     */
+    description?: string;
+    /**
+     * Organizations policy type.
+     */
+    type: organizations.PolicyType;
+    /**
+     * Typed policy document.
+     */
+    document: PolicyDocument;
+    /**
+     * Optional tags applied to the policy.
+     */
+    tags?: Record<string, string>;
+}
+export interface Policy extends Resource<"AWS.Organizations.Policy", PolicyProps, {
+    policyId: PolicyId;
+    policyArn: PolicyArn;
+    name: string;
+    description: string | undefined;
+    type: organizations.PolicyType | undefined;
+    awsManaged: boolean | undefined;
+    document: PolicyDocument;
+    tags: Record<string, string>;
+}, never, Providers> {
+}
+/**
+ * An AWS Organizations policy such as an SCP or tag policy.
+ */
+export declare const Policy: import("../../Resource.ts").ResourceClass<Policy>;
+export declare const PolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<Policy>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=Policy.d.ts.map

package/lib/AWS/Organizations/Policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Policy.d.ts","sourceRoot":"","sources":["../../../src/AWS/Organizations/Policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AAIpE,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AASvD,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAC9B,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC;IAC/B;;OAEG;IACH,QAAQ,EAAE,cAAc,CAAC;IACzB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,MAAO,SAAQ,QAAQ,CACtC,0BAA0B,EAC1B,WAAW,EACX;IACE,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,IAAI,EAAE,aAAa,CAAC,UAAU,GAAG,SAAS,CAAC;IAC3C,UAAU,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;GAEG;AACH,eAAO,MAAM,MAAM,mDAA+C,CAAC;AAEnE,eAAO,MAAM,cAAc,sSAkIxB,CAAC"}

package/lib/AWS/Organizations/Policy.js

@@ -0,0 +1,140 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.js";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { hasAlchemyTags } from "../../Tags.js";
+import { collectPages, createName, readResourceTags, retryOrganizations, updateResourceTags, } from "./common.js";
+/**
+ * An AWS Organizations policy such as an SCP or tag policy.
+ */
+export const Policy = Resource("AWS.Organizations.Policy");
+export const PolicyProvider = () => Provider.effect(Policy, Effect.gen(function* () {
+    return {
+        stables: ["policyId", "policyArn"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+            if (!isResolved(news))
+                return;
+            if (olds?.type !== news.type) {
+                return { action: "replace" };
+            }
+            const oldName = yield* toName(id, olds ?? {});
+            const newName = yield* toName(id, news);
+            if (oldName !== newName) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            const state = output?.policyId
+                ? yield* readPolicyById(output.policyId)
+                : olds
+                    ? yield* readPolicyByName({
+                        type: olds.type,
+                        name: yield* toName(id, olds),
+                    })
+                    : undefined;
+            if (!state)
+                return undefined;
+            return (yield* hasAlchemyTags(id, state.tags))
+                ? state
+                : Unowned(state);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+            const name = yield* toName(id, news);
+            const desiredDescription = news.description ?? "";
+            const desiredContent = JSON.stringify(news.document);
+            // Observe — locate the policy by ID if known, else by type+name.
+            // Both `name` (after generation) and `type` are stable, so `diff`
+            // handles renames as a replacement; here we just look up.
+            let state = output?.policyId
+                ? yield* readPolicyById(output.policyId)
+                : yield* readPolicyByName({
+                    type: news.type,
+                    name,
+                });
+            // Ensure — create the policy if missing. Tolerate
+            // `DuplicatePolicyException` as adoption (a peer reconciler beat
+            // us, or our observation lost a race).
+            if (!state) {
+                yield* retryOrganizations(organizations
+                    .createPolicy({
+                    Name: name,
+                    Description: desiredDescription,
+                    Type: news.type,
+                    Content: desiredContent,
+                })
+                    .pipe(Effect.catchTag("DuplicatePolicyException", () => Effect.void)));
+                state = yield* readPolicyByName({
+                    type: news.type,
+                    name,
+                });
+                if (!state) {
+                    return yield* Effect.fail(new Error(`policy '${name}' not found after create`));
+                }
+            }
+            // Sync description + content — diff observed cloud state against
+            // desired. `updatePolicy` requires `Name`; we keep the existing
+            // policy name (rename triggers replacement at the diff level).
+            const observedDescription = state.description ?? "";
+            const observedContent = JSON.stringify(state.document);
+            if (observedDescription !== desiredDescription ||
+                observedContent !== desiredContent) {
+                yield* retryOrganizations(organizations.updatePolicy({
+                    PolicyId: state.policyId,
+                    Name: state.name,
+                    Description: desiredDescription,
+                    Content: desiredContent,
+                }));
+            }
+            // Sync tags — diff observed cloud tags against desired. Using
+            // `state.tags` (fetched fresh) keeps the reconciler convergent on
+            // adoption and drift.
+            const tags = yield* updateResourceTags({
+                id,
+                resourceId: state.policyId,
+                olds: state.tags,
+                news: news.tags,
+            });
+            const updated = yield* readPolicyById(state.policyId);
+            if (!updated) {
+                return yield* Effect.fail(new Error(`policy '${state.policyId}' not found after reconcile`));
+            }
+            yield* session.note(updated.policyArn);
+            return {
+                ...updated,
+                tags,
+            };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* retryOrganizations(organizations
+                .deletePolicy({ PolicyId: output.policyId })
+                .pipe(Effect.catchTag("PolicyNotFoundException", () => Effect.void)));
+        }),
+    };
+}));
+const toName = (id, props = {}) => createName(id, props.name, 128);
+const readPolicyById = Effect.fn(function* (policyId) {
+    const described = yield* retryOrganizations(organizations.describePolicy({ PolicyId: policyId }).pipe(Effect.map((response) => response.Policy), Effect.catchTag("PolicyNotFoundException", () => Effect.succeed(undefined))));
+    const summary = described?.PolicySummary;
+    if (!summary?.Id || !summary.Arn || !summary.Name) {
+        return undefined;
+    }
+    const tags = yield* readResourceTags(summary.Id).pipe(Effect.catchTag("TargetNotFoundException", () => Effect.succeed({})));
+    return {
+        policyId: summary.Id,
+        policyArn: summary.Arn,
+        name: summary.Name,
+        description: summary.Description,
+        type: summary.Type,
+        awsManaged: summary.AwsManaged,
+        document: JSON.parse(described?.Content ?? "{}"),
+        tags,
+    };
+});
+const readPolicyByName = Effect.fn(function* ({ type, name, }) {
+    const policies = yield* retryOrganizations(collectPages((NextToken) => organizations.listPolicies({ Filter: type, NextToken }), (page) => page.Policies));
+    const match = policies.find((policy) => policy.Name === name);
+    return match?.Id ? yield* readPolicyById(match.Id) : undefined;
+});
+//# sourceMappingURL=Policy.js.map

package/lib/AWS/Organizations/Policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Policy.js","sourceRoot":"","sources":["../../../src/AWS/Organizations/Policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AA8CrB;;GAEG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAS,0BAA0B,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CACjC,QAAQ,CAAC,MAAM,CACb,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,OAAO,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;QAClC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IAAI,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC7B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,MAAM,KAAK,GAAG,MAAM,EAAE,QAAQ;gBAC5B,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACxC,CAAC,CAAC,IAAI;oBACJ,CAAC,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC;wBACtB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC;qBAC9B,CAAC;oBACJ,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5C,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACrC,MAAM,kBAAkB,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YAClD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAErD,iEAAiE;YACjE,kEAAkE;YAClE,0DAA0D;YAC1D,IAAI,KAAK,GAAG,MAAM,EAAE,QAAQ;gBAC1B,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACxC,CAAC,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC;oBACtB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI;iBACL,CAAC,CAAC;YAEP,kDAAkD;YAClD,iEAAiE;YACjE,uCAAuC;YACvC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,CAAC,CAAC,kBAAkB,CACvB,aAAa;qBACV,YAAY,CAAC;oBACZ,IAAI,EAAE,IAAI;oBACV,WAAW,EAAE,kBAAkB;oBAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,cAAc;iBACxB,CAAC;qBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,0BAA0B,EAC1B,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAClB,CACF,CACJ,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;oBAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI;iBACL,CAAC,CAAC;gBACH,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,WAAW,IAAI,0BAA0B,CAAC,CACrD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,iEAAiE;YACjE,gEAAgE;YAChE,+DAA+D;YAC/D,MAAM,mBAAmB,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;YACpD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACvD,IACE,mBAAmB,KAAK,kBAAkB;gBAC1C,eAAe,KAAK,cAAc,EAClC,CAAC;gBACD,KAAK,CAAC,CAAC,kBAAkB,CACvB,aAAa,CAAC,YAAY,CAAC;oBACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,WAAW,EAAE,kBAAkB;oBAC/B,OAAO,EAAE,cAAc;iBACxB,CAAC,CACH,CAAC;YACJ,CAAC;YAED,8DAA8D;YAC9D,kEAAkE;YAClE,sBAAsB;YACtB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;gBACrC,EAAE;gBACF,UAAU,EAAE,KAAK,CAAC,QAAQ;gBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC,QAAQ,6BAA6B,CAAC,CAClE,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO;gBACL,GAAG,OAAO;gBACV,IAAI;aACL,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,kBAAkB,CACvB,aAAa;iBACV,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;iBAC3C,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC9D,CACJ,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,QAA2B,EAAE,EAAE,EAAE,CAC3D,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAElC,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAgB;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,kBAAkB,CACzC,aAAa,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EACzC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAC9C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CACF,CAAC;IAEF,MAAM,OAAO,GAAG,SAAS,EAAE,aAAa,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACrE,CAAC;IAEF,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,EAAE;QACpB,SAAS,EAAE,OAAO,CAAC,GAAG;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,IAAI,IAAI,CAAmB;QAClE,IAAI;KAC0B,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC5C,IAAI,EACJ,IAAI,GAIL;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,kBAAkB,CACxC,YAAY,CACV,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EACtE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CACxB,CACF,CAAC;IAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC9D,OAAO,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC,CAAC,CAAC"}

package/lib/AWS/Organizations/PolicyAttachment.d.ts

@@ -0,0 +1,28 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export interface PolicyAttachmentProps {
+    /**
+     * Policy to attach.
+     */
+    policyId: string;
+    /**
+     * Target root, OU, or account ID.
+     */
+    targetId: string;
+}
+export interface PolicyAttachment extends Resource<"AWS.Organizations.PolicyAttachment", PolicyAttachmentProps, {
+    policyId: string;
+    targetId: string;
+    targetArn: string | undefined;
+    targetName: string | undefined;
+    targetType: organizations.TargetType | undefined;
+}, never, Providers> {
+}
+/**
+ * Attaches an Organizations policy to a root, OU, or account.
+ */
+export declare const PolicyAttachment: import("../../Resource.ts").ResourceClass<PolicyAttachment>;
+export declare const PolicyAttachmentProvider: () => import("effect/Layer").Layer<Provider.Provider<PolicyAttachment>, never, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=PolicyAttachment.d.ts.map

package/lib/AWS/Organizations/PolicyAttachment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PolicyAttachment.d.ts","sourceRoot":"","sources":["../../../src/AWS/Organizations/PolicyAttachment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AAGpE,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,oCAAoC,EACpC,qBAAqB,EACrB;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,UAAU,EAAE,aAAa,CAAC,UAAU,GAAG,SAAS,CAAC;CAClD,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;GAEG;AACH,eAAO,MAAM,gBAAgB,6DAE5B,CAAC;AAEF,eAAO,MAAM,wBAAwB,8OA2ElC,CAAC"}

package/lib/AWS/Organizations/PolicyAttachment.js

@@ -0,0 +1,78 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { collectPages, retryOrganizations } from "./common.js";
+/**
+ * Attaches an Organizations policy to a root, OU, or account.
+ */
+export const PolicyAttachment = Resource("AWS.Organizations.PolicyAttachment");
+export const PolicyAttachmentProvider = () => Provider.effect(PolicyAttachment, Effect.gen(function* () {
+    return {
+        stables: ["policyId", "targetId"],
+        diff: Effect.fn(function* ({ olds, news }) {
+            if (!isResolved(news))
+                return;
+            if (olds?.policyId !== news.policyId ||
+                olds?.targetId !== news.targetId) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+            return yield* readAttachment({
+                policyId: output?.policyId ?? olds.policyId,
+                targetId: output?.targetId ?? olds.targetId,
+            });
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+            // Observe — list current attachments to see whether ours is present.
+            // The attachment is identity-only; both `policyId` and `targetId`
+            // are stable, so `diff` handles any change as a replacement.
+            let state = yield* readAttachment(news);
+            // Ensure — attach if missing. `DuplicatePolicyAttachmentException`
+            // is treated as success (e.g. a peer reconciler attached
+            // concurrently, or our observation lost a race).
+            if (!state) {
+                yield* retryOrganizations(organizations
+                    .attachPolicy({
+                    PolicyId: news.policyId,
+                    TargetId: news.targetId,
+                })
+                    .pipe(Effect.catchTag("DuplicatePolicyAttachmentException", () => Effect.void)));
+                state = yield* readAttachment(news);
+                if (!state) {
+                    return yield* Effect.fail(new Error(`policy attachment '${news.policyId}' -> '${news.targetId}' not found after create`));
+                }
+            }
+            yield* session.note(`${state.policyId}:${state.targetId}`);
+            return state;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* retryOrganizations(organizations
+                .detachPolicy({
+                PolicyId: output.policyId,
+                TargetId: output.targetId,
+            })
+                .pipe(Effect.catchTags({
+                PolicyNotAttachedException: () => Effect.void,
+                PolicyNotFoundException: () => Effect.void,
+                TargetNotFoundException: () => Effect.void,
+            })));
+        }),
+    };
+}));
+const readAttachment = Effect.fn(function* ({ policyId, targetId, }) {
+    const targets = yield* retryOrganizations(collectPages((NextToken) => organizations.listTargetsForPolicy({ PolicyId: policyId, NextToken }), (page) => page.Targets));
+    const target = targets.find((candidate) => candidate.TargetId === targetId);
+    return target
+        ? {
+            policyId,
+            targetId,
+            targetArn: target.Arn,
+            targetName: target.Name,
+            targetType: target.Type,
+        }
+        : undefined;
+});
+//# sourceMappingURL=PolicyAttachment.js.map

package/lib/AWS/Organizations/PolicyAttachment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PolicyAttachment.js","sourceRoot":"","sources":["../../../src/AWS/Organizations/PolicyAttachment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA2B/D;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CACtC,oCAAoC,CACrC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,EAAE,CAC3C,QAAQ,CAAC,MAAM,CACb,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;QACjC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IACE,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAChC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAChC,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACzC,OAAO,KAAK,CAAC,CAAC,cAAc,CAAC;gBAC3B,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAK,CAAC,QAAQ;gBAC5C,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAK,CAAC,QAAQ;aAC7C,CAAC,CAAC;QACL,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAC/C,qEAAqE;YACrE,kEAAkE;YAClE,6DAA6D;YAC7D,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAExC,mEAAmE;YACnE,yDAAyD;YACzD,iDAAiD;YACjD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,CAAC,CAAC,kBAAkB,CACvB,aAAa;qBACV,YAAY,CAAC;oBACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC;qBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,oCAAoC,EACpC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAClB,CACF,CACJ,CAAC;gBACF,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,sBAAsB,IAAI,CAAC,QAAQ,SAAS,IAAI,CAAC,QAAQ,0BAA0B,CACpF,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,kBAAkB,CACvB,aAAa;iBACV,YAAY,CAAC;gBACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,SAAS,CAAC;gBACf,0BAA0B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;gBAC7C,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;gBAC1C,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;aAC3C,CAAC,CACH,CACJ,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC1C,QAAQ,EACR,QAAQ,GACc;IACtB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,kBAAkB,CACvC,YAAY,CACV,CAAC,SAAS,EAAE,EAAE,CACZ,aAAa,CAAC,oBAAoB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EACvE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CACvB,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC5E,OAAO,MAAM;QACX,CAAC,CAAE;YACC,QAAQ;YACR,QAAQ;YACR,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,UAAU,EAAE,MAAM,CAAC,IAAI;SACkB;QAC7C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC,CAAC"}

package/lib/AWS/Organizations/Root.d.ts

@@ -0,0 +1,38 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export type RootId = string;
+export type RootArn = string;
+export interface RootProps {
+    /**
+     * Optional root ID to import explicitly.
+     * If omitted, Alchemy adopts the single organization root.
+     */
+    rootId?: string;
+    /**
+     * Optional root name to match when multiple roots are ever supported.
+     */
+    name?: string;
+    /**
+     * Optional tags to apply to the imported root.
+     */
+    tags?: Record<string, string>;
+}
+export interface Root extends Resource<"AWS.Organizations.Root", RootProps, {
+    rootId: RootId;
+    rootArn: RootArn;
+    rootName: string;
+    policyTypes: organizations.PolicyTypeSummary[];
+    tags: Record<string, string>;
+}, never, Providers> {
+}
+/**
+ * The organization root.
+ *
+ * `Root` is an import-style resource. It discovers the existing root returned by
+ * AWS Organizations and can reconcile root tags.
+ */
+export declare const Root: import("../../Resource.ts").ResourceClass<Root>;
+export declare const RootProvider: () => import("effect/Layer").Layer<Provider.Provider<Root>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=Root.d.ts.map

package/lib/AWS/Organizations/Root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Root.d.ts","sourceRoot":"","sources":["../../../src/AWS/Organizations/Root.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AAGpE,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAQjD,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC;AAC5B,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,MAAM,WAAW,SAAS;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,IAAK,SAAQ,QAAQ,CACpC,wBAAwB,EACxB,SAAS,EACT;IACE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,aAAa,CAAC,iBAAiB,EAAE,CAAC;IAC/C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,IAAI,iDAA2C,CAAC;AAE7D,eAAO,MAAM,YAAY,oSA0DtB,CAAC"}