alchemy 2.0.0-beta.4 → 2.0.0-beta.41

package/lib/AWS/Organizations/Root.js

@@ -0,0 +1,81 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { collectPages, readResourceTags, retryOrganizations, updateResourceTags, } from "./common.js";
+/**
+ * The organization root.
+ *
+ * `Root` is an import-style resource. It discovers the existing root returned by
+ * AWS Organizations and can reconcile root tags.
+ */
+export const Root = Resource("AWS.Organizations.Root");
+export const RootProvider = () => Provider.effect(Root, Effect.gen(function* () {
+    return {
+        stables: ["rootId", "rootArn"],
+        diff: Effect.fn(function* ({ olds, news }) {
+            if (!isResolved(news))
+                return;
+            if (olds?.rootId !== news?.rootId) {
+                return { action: "replace" };
+            }
+            if (olds?.name !== news?.name) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+            return yield* readRoot({
+                rootId: output?.rootId ?? olds?.rootId,
+                name: olds?.name,
+            });
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+            // Observe — discover the live root. `Root` is import-only: AWS
+            // creates the root for us when the organization is created, and we
+            // never create or delete it. We always look it up fresh.
+            const root = yield* readRoot({
+                rootId: output?.rootId ?? news.rootId,
+                name: news.name,
+            });
+            if (!root) {
+                return yield* Effect.fail(new Error(output?.rootId
+                    ? `organization root '${output.rootId}' not found`
+                    : "organization root not found"));
+            }
+            // Sync tags — diff observed cloud tags against desired. Using
+            // `root.tags` as the baseline (instead of stale `olds.tags`) keeps
+            // the reconciler convergent even on adoption or after drift.
+            const tags = yield* updateResourceTags({
+                id,
+                resourceId: root.rootId,
+                olds: root.tags,
+                news: news.tags,
+            });
+            yield* session.note(root.rootArn);
+            return {
+                ...root,
+                tags,
+            };
+        }),
+        delete: Effect.fn(function* () { }),
+    };
+}));
+const listRoots = () => collectPages((NextToken) => organizations.listRoots({ NextToken }), (page) => page.Roots);
+const readRoot = Effect.fn(function* ({ rootId, name, }) {
+    const roots = yield* retryOrganizations(listRoots());
+    const root = roots.find((candidate) => (rootId ? candidate.Id === rootId : true) &&
+        (name ? candidate.Name === name : true));
+    if (!root?.Id || !root.Arn || !root.Name) {
+        return undefined;
+    }
+    const tags = yield* readResourceTags(root.Id).pipe(Effect.catchTag("TargetNotFoundException", () => Effect.succeed({})));
+    return {
+        rootId: root.Id,
+        rootArn: root.Arn,
+        rootName: root.Name,
+        policyTypes: root.PolicyTypes ?? [],
+        tags,
+    };
+});
+//# sourceMappingURL=Root.js.map

package/lib/AWS/Organizations/Root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Root.js","sourceRoot":"","sources":["../../../src/AWS/Organizations/Root.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAmCrB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAO,wBAAwB,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,EAAE,CAC/B,QAAQ,CAAC,MAAM,CACb,IAAI,EACJ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,OAAO,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC9B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IAAI,IAAI,EAAE,MAAM,KAAK,IAAI,EAAE,MAAM,EAAE,CAAC;gBAClC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,IAAI,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,EAAE,CAAC;gBAC9B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACzC,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC;gBACrB,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM;gBACtC,IAAI,EAAE,IAAI,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC3D,+DAA+D;YAC/D,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;gBAC3B,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM;gBACrC,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,MAAM,EAAE,MAAM;oBACZ,CAAC,CAAC,sBAAsB,MAAM,CAAC,MAAM,aAAa;oBAClD,CAAC,CAAC,6BAA6B,CAClC,CACF,CAAC;YACJ,CAAC;YAED,8DAA8D;YAC9D,mEAAmE;YACnE,6DAA6D;YAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;gBACrC,EAAE;gBACF,UAAU,EAAE,IAAI,CAAC,MAAM;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO;gBACL,GAAG,IAAI;gBACP,IAAI;aACL,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAK,CAAC,CAAC;KACnC,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,YAAY,CACV,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,EACrD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CACrB,CAAC;AAEJ,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EACpC,MAAM,EACN,IAAI,GAIL;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CACrB,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAC1C,CAAC;IAEF,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACrE,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,OAAO,EAAE,IAAI,CAAC,GAAG;QACjB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;QACnC,IAAI;KACwB,CAAC;AACjC,CAAC,CAAC,CAAC"}

package/lib/AWS/Organizations/RootPolicyType.d.ts

@@ -0,0 +1,27 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export interface RootPolicyTypeProps {
+    /**
+     * Root that owns the enabled policy type.
+     */
+    rootId: string;
+    /**
+     * Policy type to enable on the root.
+     */
+    policyType: organizations.PolicyType;
+}
+export interface RootPolicyType extends Resource<"AWS.Organizations.RootPolicyType", RootPolicyTypeProps, {
+    rootId: string;
+    rootArn: string | undefined;
+    policyType: organizations.PolicyType;
+    status: organizations.PolicyTypeStatus | undefined;
+}, never, Providers> {
+}
+/**
+ * Enables a policy type on an organization root.
+ */
+export declare const RootPolicyType: import("../../Resource.ts").ResourceClass<RootPolicyType>;
+export declare const RootPolicyTypeProvider: () => import("effect/Layer").Layer<Provider.Provider<RootPolicyType>, never, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=RootPolicyType.d.ts.map

package/lib/AWS/Organizations/RootPolicyType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RootPolicyType.d.ts","sourceRoot":"","sources":["../../../src/AWS/Organizations/RootPolicyType.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AAGpE,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC;CACtC;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,kCAAkC,EAClC,mBAAmB,EACnB;IACE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC;IACrC,MAAM,EAAE,aAAa,CAAC,gBAAgB,GAAG,SAAS,CAAC;CACpD,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;GAEG;AACH,eAAO,MAAM,cAAc,2DAE1B,CAAC;AAEF,eAAO,MAAM,sBAAsB,4OA6EhC,CAAC"}

package/lib/AWS/Organizations/RootPolicyType.js

@@ -0,0 +1,83 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { collectPages, retryOrganizations } from "./common.js";
+/**
+ * Enables a policy type on an organization root.
+ */
+export const RootPolicyType = Resource("AWS.Organizations.RootPolicyType");
+export const RootPolicyTypeProvider = () => Provider.effect(RootPolicyType, Effect.gen(function* () {
+    return {
+        stables: ["rootId", "rootArn", "policyType"],
+        diff: Effect.fn(function* ({ olds, news }) {
+            if (!isResolved(news))
+                return;
+            if (olds?.rootId !== news.rootId ||
+                olds?.policyType !== news.policyType) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+            return yield* readRootPolicyType({
+                rootId: output?.rootId ?? olds.rootId,
+                policyType: output?.policyType ?? olds.policyType,
+            });
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+            // Observe — read the root's policy-type list to see whether our
+            // type is already enabled. Both `rootId` and `policyType` are
+            // stable identifiers, so `diff` replaces on any change.
+            let state = yield* readRootPolicyType(news);
+            // Ensure — enable if missing. Tolerate
+            // `PolicyTypeAlreadyEnabledException` for idempotency. The list
+            // can lag behind the enable call, so we fall back to a
+            // `PENDING_ENABLE` synthetic state when read still returns nothing.
+            if (!state) {
+                yield* retryOrganizations(organizations
+                    .enablePolicyType({
+                    RootId: news.rootId,
+                    PolicyType: news.policyType,
+                })
+                    .pipe(Effect.catchTag("PolicyTypeAlreadyEnabledException", () => Effect.void)));
+                state = yield* readRootPolicyType(news);
+                if (!state) {
+                    return {
+                        rootId: news.rootId,
+                        rootArn: undefined,
+                        policyType: news.policyType,
+                        status: "PENDING_ENABLE",
+                    };
+                }
+            }
+            yield* session.note(state.rootArn ?? state.rootId);
+            return state;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* retryOrganizations(organizations
+                .disablePolicyType({
+                RootId: output.rootId,
+                PolicyType: output.policyType,
+            })
+                .pipe(Effect.catchTags({
+                PolicyTypeNotEnabledException: () => Effect.void,
+                RootNotFoundException: () => Effect.void,
+            })));
+        }),
+    };
+}));
+const readRoot = (rootId) => collectPages((NextToken) => organizations.listRoots({ NextToken }), (page) => page.Roots).pipe(retryOrganizations, Effect.map((roots) => roots.find((root) => root.Id === rootId)));
+const readRootPolicyType = Effect.fn(function* ({ rootId, policyType, }) {
+    const root = yield* readRoot(rootId);
+    const summary = root?.PolicyTypes?.find((item) => item.Type === policyType);
+    return summary
+        ? {
+            rootId,
+            rootArn: root?.Arn,
+            policyType,
+            status: summary.Status,
+        }
+        : undefined;
+});
+//# sourceMappingURL=RootPolicyType.js.map

package/lib/AWS/Organizations/RootPolicyType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RootPolicyType.js","sourceRoot":"","sources":["../../../src/AWS/Organizations/RootPolicyType.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA0B/D;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CACpC,kCAAkC,CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACzC,QAAQ,CAAC,MAAM,CACb,cAAc,EACd,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,OAAO,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC;QAC5C,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IACE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,MAAM;gBAC5B,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC,UAAU,EACpC,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACzC,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC;gBAC/B,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,IAAK,CAAC,MAAM;gBACtC,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,IAAK,CAAC,UAAU;aACnD,CAAC,CAAC;QACL,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAC/C,gEAAgE;YAChE,8DAA8D;YAC9D,wDAAwD;YACxD,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAE5C,uCAAuC;YACvC,gEAAgE;YAChE,uDAAuD;YACvD,oEAAoE;YACpE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,CAAC,CAAC,kBAAkB,CACvB,aAAa;qBACV,gBAAgB,CAAC;oBAChB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC;qBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,mCAAmC,EACnC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAClB,CACF,CACJ,CAAC;gBAEF,KAAK,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO;wBACL,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,OAAO,EAAE,SAAS;wBAClB,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,MAAM,EAAE,gBAAgB;qBACc,CAAC;gBAC3C,CAAC;YACH,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,kBAAkB,CACvB,aAAa;iBACV,iBAAiB,CAAC;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,SAAS,CAAC;gBACf,6BAA6B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;gBAChD,qBAAqB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;aACzC,CAAC,CACH,CACJ,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE,CAClC,YAAY,CACV,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,EACrD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CACrB,CAAC,IAAI,CACJ,kBAAkB,EAClB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAChE,CAAC;AAEJ,MAAM,kBAAkB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC9C,MAAM,EACN,UAAU,GACU;IACpB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC5E,OAAO,OAAO;QACZ,CAAC,CAAE;YACC,MAAM;YACN,OAAO,EAAE,IAAI,EAAE,GAAG;YAClB,UAAU;YACV,MAAM,EAAE,OAAO,CAAC,MAAM;SACiB;QAC3C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC,CAAC"}

package/lib/AWS/Organizations/TenantRoot.d.ts

@@ -0,0 +1,145 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import type { PolicyDocument } from "../IAM/Policy.ts";
+import * as IdentityCenter from "../IdentityCenter/index.ts";
+import type { Account, AccountProps } from "./Account.ts";
+import type { DelegatedAdministrator } from "./DelegatedAdministrator.ts";
+import type { Organization, OrganizationProps } from "./Organization.ts";
+import type { OrganizationalUnit, OrganizationalUnitProps } from "./OrganizationalUnit.ts";
+import type { Policy } from "./Policy.ts";
+import type { PolicyAttachment } from "./PolicyAttachment.ts";
+import type { Root, RootProps } from "./Root.ts";
+import type { RootPolicyType } from "./RootPolicyType.ts";
+import type { TrustedServiceAccess } from "./TrustedServiceAccess.ts";
+export type TenantTargetKey = "root" | string;
+export interface TenantAccountSpec extends Omit<AccountProps, "parentId" | "name" | "email"> {
+    key: string;
+    name: string;
+    email: string;
+}
+export interface TenantOrganizationalUnitSpec extends Omit<OrganizationalUnitProps, "parentId" | "name"> {
+    key: string;
+    name?: string;
+    accounts?: TenantAccountSpec[];
+    children?: TenantOrganizationalUnitSpec[];
+}
+export interface TenantPolicySpec {
+    key: string;
+    name?: string;
+    description?: string;
+    type?: organizations.PolicyType;
+    document: PolicyDocument;
+    targetKeys: TenantTargetKey[];
+    tags?: Record<string, string>;
+}
+export interface TenantIdentityCenterGroupSpec {
+    key: string;
+    displayName: string;
+    description?: string;
+}
+export interface TenantIdentityCenterPermissionSetSpec {
+    key: string;
+    name: string;
+    description?: string;
+    sessionDuration?: string;
+    relayState?: string;
+}
+export interface TenantIdentityCenterAssignmentSpec {
+    key?: string;
+    permissionSetKey: string;
+    accountKey: string;
+    principalType?: "USER" | "GROUP";
+    groupKey?: string;
+    principalId?: string;
+}
+export interface TenantIdentityCenterSpec {
+    mode?: "existing" | "account";
+    instanceArn?: string;
+    name?: string;
+    delegatedAdminAccountKey?: string;
+    groups?: TenantIdentityCenterGroupSpec[];
+    permissionSets?: TenantIdentityCenterPermissionSetSpec[];
+    assignments?: TenantIdentityCenterAssignmentSpec[];
+}
+export interface TenantRootProps {
+    organization?: OrganizationProps;
+    root?: RootProps;
+    policyTypes?: organizations.PolicyType[];
+    trustedServicePrincipals?: string[];
+    organizationalUnits?: TenantOrganizationalUnitSpec[];
+    policies?: TenantPolicySpec[];
+    identityCenter?: TenantIdentityCenterSpec;
+    tags?: Record<string, string>;
+}
+export interface TenantRootResult {
+    organization: Organization;
+    root: Root;
+    policyTypes: RootPolicyType[];
+    trustedServiceAccess: TrustedServiceAccess[];
+    delegatedAdministrators: DelegatedAdministrator[];
+    organizationalUnits: Record<string, OrganizationalUnit>;
+    accounts: Record<string, Account>;
+    policies: Record<string, Policy>;
+    policyAttachments: PolicyAttachment[];
+    identityCenter?: {
+        instance: IdentityCenter.Instance;
+        groups: Record<string, IdentityCenter.Group>;
+        permissionSets: Record<string, IdentityCenter.PermissionSet>;
+        assignments: Record<string, IdentityCenter.AccountAssignment>;
+    };
+}
+/**
+ * Compose an opinionated single-tenant landing zone inside the current AWS
+ * Organizations management account.
+ *
+ * This helper intentionally stays aligned to native AWS semantics:
+ * one real Organization, one root, nested OUs, and accounts beneath that
+ * tenant root. The broader `RootRoot` concept is an Alchemy control-plane
+ * abstraction over many such tenant roots deployed into separate management
+ * accounts, not a nested AWS Organizations feature.
+ *
+ * @section Creating A Tenant Root
+ * @example Tenant With Baseline Accounts
+ * ```typescript
+ * const tenant = yield* TenantRoot("CustomerA", {
+ *   identityCenter: {
+ *     mode: "existing",
+ *     groups: [
+ *       { key: "platform", displayName: "platform-engineers" },
+ *     ],
+ *     permissionSets: [
+ *       {
+ *         key: "admin",
+ *         name: "AdministratorAccess",
+ *         sessionDuration: "PT8H",
+ *       },
+ *     ],
+ *     assignments: [
+ *       {
+ *         permissionSetKey: "admin",
+ *         groupKey: "platform",
+ *         accountKey: "prod",
+ *       },
+ *     ],
+ *   },
+ * });
+ * ```
+ */
+export declare const TenantRoot: (id: string, props?: TenantRootProps | undefined) => Effect.Effect<{
+    organization: Organization;
+    root: Root;
+    policyTypes: RootPolicyType[];
+    trustedServiceAccess: TrustedServiceAccess[];
+    delegatedAdministrators: DelegatedAdministrator[];
+    organizationalUnits: Record<string, OrganizationalUnit>;
+    accounts: Record<string, Account>;
+    policies: Record<string, Policy>;
+    policyAttachments: PolicyAttachment[];
+    identityCenter: {
+        instance: IdentityCenter.Instance;
+        groups: Record<string, IdentityCenter.Group>;
+        permissionSets: Record<string, IdentityCenter.PermissionSet>;
+        assignments: Record<string, IdentityCenter.AccountAssignment>;
+    } | undefined;
+}, unknown, unknown>;
+//# sourceMappingURL=TenantRoot.d.ts.map

package/lib/AWS/Organizations/TenantRoot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantRoot.d.ts","sourceRoot":"","sources":["../../../src/AWS/Organizations/TenantRoot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAE1E,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAGtE,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9C,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,YAAY,EACZ,UAAU,GAAG,MAAM,GAAG,OAAO,CAC9B;IACC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,4BAA6B,SAAQ,IAAI,CACxD,uBAAuB,EACvB,UAAU,GAAG,MAAM,CACpB;IACC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,4BAA4B,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC;IAChC,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,6BAA6B;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qCAAqC;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,MAAM,CAAC,EAAE,6BAA6B,EAAE,CAAC;IACzC,cAAc,CAAC,EAAE,qCAAqC,EAAE,CAAC;IACzD,WAAW,CAAC,EAAE,kCAAkC,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,WAAW,CAAC,EAAE,aAAa,CAAC,UAAU,EAAE,CAAC;IACzC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,mBAAmB,CAAC,EAAE,4BAA4B,EAAE,CAAC;IACrD,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,YAAY,CAAC;IAC3B,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;IAC7C,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;IAClD,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;IACtC,cAAc,CAAC,EAAE;QACf,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;QAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;QAC7C,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;QAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,iBAAiB,CAAC,CAAC;KAC/D,CAAC;CACH;AAkDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;oBAqHrB,CAAC"}

package/lib/AWS/Organizations/TenantRoot.js

@@ -0,0 +1,277 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import * as IdentityCenter from "../IdentityCenter/index.js";
+import { Account as OrganizationAccount } from "./Account.js";
+import { DelegatedAdministrator as OrganizationsDelegatedAdministrator } from "./DelegatedAdministrator.js";
+import { Organization as AwsOrganization } from "./Organization.js";
+import { OrganizationalUnit as AwsOrganizationalUnit } from "./OrganizationalUnit.js";
+import { Policy as OrganizationsPolicy } from "./Policy.js";
+import { PolicyAttachment as OrganizationsPolicyAttachment } from "./PolicyAttachment.js";
+import { Root as OrganizationRoot } from "./Root.js";
+import { RootPolicyType as OrganizationsRootPolicyType } from "./RootPolicyType.js";
+import { TrustedServiceAccess as OrganizationsTrustedServiceAccess } from "./TrustedServiceAccess.js";
+const defaultTenantOrganizationalUnits = () => [
+    {
+        key: "security",
+        name: "security",
+        accounts: [
+            {
+                key: "security",
+                name: "security",
+                email: "security@example.com",
+            },
+            {
+                key: "log-archive",
+                name: "log-archive",
+                email: "log-archive@example.com",
+            },
+        ],
+    },
+    {
+        key: "infrastructure",
+        name: "infrastructure",
+        accounts: [
+            {
+                key: "shared-services",
+                name: "shared-services",
+                email: "shared-services@example.com",
+            },
+        ],
+    },
+    {
+        key: "workloads",
+        name: "workloads",
+        accounts: [
+            {
+                key: "prod",
+                name: "prod",
+                email: "prod@example.com",
+            },
+        ],
+    },
+];
+const toLogicalIdSegment = (value) => value
+    .split(/[^A-Za-z0-9]+/)
+    .filter(Boolean)
+    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+    .join("");
+/**
+ * Compose an opinionated single-tenant landing zone inside the current AWS
+ * Organizations management account.
+ *
+ * This helper intentionally stays aligned to native AWS semantics:
+ * one real Organization, one root, nested OUs, and accounts beneath that
+ * tenant root. The broader `RootRoot` concept is an Alchemy control-plane
+ * abstraction over many such tenant roots deployed into separate management
+ * accounts, not a nested AWS Organizations feature.
+ *
+ * @section Creating A Tenant Root
+ * @example Tenant With Baseline Accounts
+ * ```typescript
+ * const tenant = yield* TenantRoot("CustomerA", {
+ *   identityCenter: {
+ *     mode: "existing",
+ *     groups: [
+ *       { key: "platform", displayName: "platform-engineers" },
+ *     ],
+ *     permissionSets: [
+ *       {
+ *         key: "admin",
+ *         name: "AdministratorAccess",
+ *         sessionDuration: "PT8H",
+ *       },
+ *     ],
+ *     assignments: [
+ *       {
+ *         permissionSetKey: "admin",
+ *         groupKey: "platform",
+ *         accountKey: "prod",
+ *       },
+ *     ],
+ *   },
+ * });
+ * ```
+ */
+export const TenantRoot = Effect.fn(function* (id, props = {}) {
+    const sharedTags = props.tags ?? {};
+    const organization = yield* AwsOrganization(`${id}Organization`, {
+        featureSet: "ALL",
+        ...props.organization,
+    });
+    const root = yield* OrganizationRoot(`${id}Root`, {
+        ...props.root,
+        tags: mergeTags(sharedTags, props.root?.tags),
+    });
+    const policyTypes = yield* Effect.forEach(props.policyTypes ?? ["SERVICE_CONTROL_POLICY"], (policyType) => OrganizationsRootPolicyType(`${id}${toLogicalIdSegment(policyType)}PolicyType`, {
+        rootId: root.rootId,
+        policyType,
+    }), { concurrency: "unbounded" });
+    const trustedServicePrincipals = [
+        ...(props.trustedServicePrincipals ?? []),
+        ...(props.identityCenter ? ["sso.amazonaws.com"] : []),
+    ];
+    const trustedServiceAccess = yield* Effect.forEach([...new Set(trustedServicePrincipals)], (servicePrincipal) => OrganizationsTrustedServiceAccess(`${id}${toLogicalIdSegment(servicePrincipal)}TrustedAccess`, { servicePrincipal }), { concurrency: "unbounded" });
+    const organizationalUnits = {};
+    const accounts = {};
+    const targets = {
+        root: { targetId: root.rootId },
+    };
+    yield* createOrganizationalUnits({
+        id,
+        parentId: root.rootId,
+        sharedTags,
+        specs: props.organizationalUnits ?? defaultTenantOrganizationalUnits(),
+        organizationalUnits,
+        accounts,
+        targets,
+    });
+    const delegatedAdministrators = [];
+    const identityCenter = props.identityCenter
+        ? yield* createTenantIdentityCenter({
+            id,
+            spec: props.identityCenter,
+            accounts,
+            sharedTags,
+            delegatedAdministrators,
+        })
+        : undefined;
+    const policies = {};
+    const policyAttachments = [];
+    for (const policySpec of props.policies ?? []) {
+        const policy = yield* OrganizationsPolicy(`${id}${toLogicalIdSegment(policySpec.key)}Policy`, {
+            name: policySpec.name,
+            description: policySpec.description,
+            type: policySpec.type ?? "SERVICE_CONTROL_POLICY",
+            document: policySpec.document,
+            tags: mergeTags(sharedTags, policySpec.tags),
+        });
+        policies[policySpec.key] = policy;
+        for (const targetKey of policySpec.targetKeys) {
+            const target = targets[targetKey];
+            if (!target) {
+                return yield* Effect.fail(new Error(`Unknown tenant policy target '${targetKey}' for policy '${policySpec.key}'`));
+            }
+            policyAttachments.push(yield* OrganizationsPolicyAttachment(`${id}${toLogicalIdSegment(policySpec.key)}${toLogicalIdSegment(targetKey)}Attachment`, {
+                policyId: policy.policyId,
+                targetId: target.targetId,
+            }));
+        }
+    }
+    return {
+        organization,
+        root,
+        policyTypes,
+        trustedServiceAccess,
+        delegatedAdministrators,
+        organizationalUnits,
+        accounts,
+        policies,
+        policyAttachments,
+        identityCenter,
+    };
+});
+const createOrganizationalUnits = ({ id, parentId, sharedTags, specs, organizationalUnits, accounts, targets, }) => Effect.gen(function* () {
+    for (const spec of specs) {
+        const ou = yield* AwsOrganizationalUnit(`${id}${toLogicalIdSegment(spec.key)}Ou`, {
+            parentId,
+            name: spec.name ?? spec.key,
+            tags: mergeTags(sharedTags, spec.tags),
+        });
+        organizationalUnits[spec.key] = ou;
+        targets[spec.key] = { targetId: ou.ouId };
+        for (const accountSpec of spec.accounts ?? []) {
+            const account = yield* OrganizationAccount(`${id}${toLogicalIdSegment(accountSpec.key)}Account`, {
+                ...accountSpec,
+                parentId: ou.ouId,
+                tags: mergeTags(sharedTags, accountSpec.tags),
+            });
+            accounts[accountSpec.key] = account;
+            targets[accountSpec.key] = { targetId: account.accountId };
+        }
+        if (spec.children?.length) {
+            yield* createOrganizationalUnits({
+                id,
+                parentId: ou.ouId,
+                sharedTags,
+                specs: spec.children,
+                organizationalUnits,
+                accounts,
+                targets,
+            });
+        }
+    }
+});
+const createTenantIdentityCenter = Effect.fn(function* ({ id, spec, accounts, delegatedAdministrators, }) {
+    const instance = yield* IdentityCenter.Instance(`${id}IdentityCenter`, {
+        mode: spec.mode ?? "existing",
+        instanceArn: spec.instanceArn,
+        name: spec.name,
+    });
+    if (spec.delegatedAdminAccountKey) {
+        const account = accounts[spec.delegatedAdminAccountKey];
+        if (!account) {
+            return yield* Effect.fail(new Error(`Unknown delegated admin account '${spec.delegatedAdminAccountKey}'`));
+        }
+        delegatedAdministrators.push(yield* OrganizationsDelegatedAdministrator(`${id}${toLogicalIdSegment(spec.delegatedAdminAccountKey)}IdentityCenterDelegatedAdmin`, {
+            accountId: account.accountId,
+            servicePrincipal: "sso.amazonaws.com",
+        }));
+    }
+    const groups = {};
+    for (const groupSpec of spec.groups ?? []) {
+        groups[groupSpec.key] = yield* IdentityCenter.Group(`${id}${toLogicalIdSegment(groupSpec.key)}Group`, {
+            identityStoreId: instance.identityStoreId,
+            displayName: groupSpec.displayName,
+            description: groupSpec.description,
+        });
+    }
+    const permissionSets = {};
+    for (const permissionSetSpec of spec.permissionSets ?? []) {
+        permissionSets[permissionSetSpec.key] = yield* IdentityCenter.PermissionSet(`${id}${toLogicalIdSegment(permissionSetSpec.key)}PermissionSet`, {
+            instanceArn: instance.instanceArn,
+            name: permissionSetSpec.name,
+            description: permissionSetSpec.description,
+            sessionDuration: permissionSetSpec.sessionDuration,
+            relayState: permissionSetSpec.relayState,
+        });
+    }
+    const assignments = {};
+    for (const assignmentSpec of spec.assignments ?? []) {
+        const account = accounts[assignmentSpec.accountKey];
+        if (!account) {
+            return yield* Effect.fail(new Error(`Unknown assignment account '${assignmentSpec.accountKey}'`));
+        }
+        const permissionSet = permissionSets[assignmentSpec.permissionSetKey];
+        if (!permissionSet) {
+            return yield* Effect.fail(new Error(`Unknown assignment permission set '${assignmentSpec.permissionSetKey}'`));
+        }
+        const principalId = assignmentSpec.groupKey !== undefined
+            ? groups[assignmentSpec.groupKey]?.groupId
+            : assignmentSpec.principalId;
+        if (!principalId) {
+            return yield* Effect.fail(new Error(`Unable to resolve principal for assignment '${assignmentSpec.key ?? `${assignmentSpec.permissionSetKey}-${assignmentSpec.accountKey}`}'`));
+        }
+        const key = assignmentSpec.key ??
+            `${assignmentSpec.permissionSetKey}-${assignmentSpec.accountKey}-${assignmentSpec.groupKey ?? principalId}`;
+        assignments[key] = yield* IdentityCenter.AccountAssignment(`${id}${toLogicalIdSegment(key)}Assignment`, {
+            instanceArn: instance.instanceArn,
+            permissionSetArn: permissionSet.permissionSetArn,
+            principalId,
+            principalType: assignmentSpec.groupKey
+                ? "GROUP"
+                : (assignmentSpec.principalType ?? "USER"),
+            targetId: account.accountId,
+        });
+    }
+    return {
+        instance,
+        groups,
+        permissionSets,
+        assignments,
+    };
+});
+const mergeTags = (shared, tags) => ({
+    ...shared,
+    ...tags,
+});
+//# sourceMappingURL=TenantRoot.js.map

package/lib/AWS/Organizations/TenantRoot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantRoot.js","sourceRoot":"","sources":["../../../src/AWS/Organizations/TenantRoot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,EAAE,sBAAsB,IAAI,mCAAmC,EAAE,MAAM,6BAA6B,CAAC;AAE5G,OAAO,EAAE,YAAY,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAKpE,OAAO,EAAE,kBAAkB,IAAI,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,OAAO,EAAE,MAAM,IAAI,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,EAAE,gBAAgB,IAAI,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EAAE,IAAI,IAAI,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,cAAc,IAAI,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAEpF,OAAO,EAAE,oBAAoB,IAAI,iCAAiC,EAAE,MAAM,2BAA2B,CAAC;AA+FtG,MAAM,gCAAgC,GAAG,GAAmC,EAAE,CAAC;IAC7E;QACE,GAAG,EAAE,UAAU;QACf,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,UAAU;gBACf,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,sBAAsB;aAC9B;YACD;gBACE,GAAG,EAAE,aAAa;gBAClB,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,yBAAyB;aACjC;SACF;KACF;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,iBAAiB;gBACtB,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,6BAA6B;aACrC;SACF;KACF;IACD;QACE,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,kBAAkB;aAC1B;SACF;KACF;CACF,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAE,EAAE,CAC3C,KAAK;KACF,KAAK,CAAC,eAAe,CAAC;KACtB,MAAM,CAAC,OAAO,CAAC;KACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KAC3D,IAAI,CAAC,EAAE,CAAC,CAAC;AAEd;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC3C,EAAU,EACV,QAAyB,EAAE;IAE3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE;QAC/D,UAAU,EAAE,KAAK;QACjB,GAAG,KAAK,CAAC,YAAY;KACtB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE;QAChD,GAAG,KAAK,CAAC,IAAI;QACb,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;KAC9C,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACvC,KAAK,CAAC,WAAW,IAAI,CAAC,wBAAwB,CAAC,EAC/C,CAAC,UAAU,EAAE,EAAE,CACb,2BAA2B,CACzB,GAAG,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,YAAY,EAClD;QACE,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU;KACX,CACF,EACH,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;IAEF,MAAM,wBAAwB,GAAG;QAC/B,GAAG,CAAC,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC;QACzC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;IACF,MAAM,oBAAoB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAChD,CAAC,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC,CAAC,EACtC,CAAC,gBAAgB,EAAE,EAAE,CACnB,iCAAiC,CAC/B,GAAG,EAAE,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,eAAe,EAC3D,EAAE,gBAAgB,EAAE,CACrB,EACH,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;IAEF,MAAM,mBAAmB,GAAuC,EAAE,CAAC;IACnE,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,OAAO,GAA+C;QAC1D,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAa,EAAE;KACvC,CAAC;IAEF,KAAK,CAAC,CAAC,yBAAyB,CAAC;QAC/B,EAAE;QACF,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,UAAU;QACV,KAAK,EAAE,KAAK,CAAC,mBAAmB,IAAI,gCAAgC,EAAE;QACtE,mBAAmB;QACnB,QAAQ;QACR,OAAO;KACR,CAAC,CAAC;IAEH,MAAM,uBAAuB,GAA6B,EAAE,CAAC;IAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc;QACzC,CAAC,CAAC,KAAK,CAAC,CAAC,0BAA0B,CAAC;YAChC,EAAE;YACF,IAAI,EAAE,KAAK,CAAC,cAAc;YAC1B,QAAQ;YACR,UAAU;YACV,uBAAuB;SACxB,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,iBAAiB,GAAuB,EAAE,CAAC;IACjD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACvC,GAAG,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAClD;YACE,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,wBAAwB;YACjD,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC;SAC7C,CACF,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QAElC,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,iCAAiC,SAAS,iBAAiB,UAAU,CAAC,GAAG,GAAG,CAC7E,CACF,CAAC;YACJ,CAAC;YAED,iBAAiB,CAAC,IAAI,CACpB,KAAK,CAAC,CAAC,6BAA6B,CAClC,GAAG,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,YAAY,EACtF;gBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,YAAY;QACZ,IAAI;QACJ,WAAW;QACX,oBAAoB;QACpB,uBAAuB;QACvB,mBAAmB;QACnB,QAAQ;QACR,QAAQ;QACR,iBAAiB;QACjB,cAAc;KACY,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,EACjC,EAAE,EACF,QAAQ,EACR,UAAU,EACV,KAAK,EACL,mBAAmB,EACnB,QAAQ,EACR,OAAO,GASR,EAAyC,EAAE,CAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,qBAAqB,CACrC,GAAG,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EACxC;YACE,QAAQ;YACR,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG;YAC3B,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC;SACvC,CACF,CAAC;QACF,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAW,EAAE,CAAC;QAEjD,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACxC,GAAG,EAAE,GAAG,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EACpD;gBACE,GAAG,WAAW;gBACd,QAAQ,EAAE,EAAE,CAAC,IAAI;gBACjB,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC;aAC9C,CACF,CAAC;YACF,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;YACpC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAgB,EAAE,CAAC;QACpE,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC1B,KAAK,CAAC,CAAC,yBAAyB,CAAC;gBAC/B,EAAE;gBACF,QAAQ,EAAE,EAAE,CAAC,IAAW;gBACxB,UAAU;gBACV,KAAK,EAAE,IAAI,CAAC,QAAQ;gBACpB,mBAAmB;gBACnB,QAAQ;gBACR,OAAO;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,0BAA0B,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EACtD,EAAE,EACF,IAAI,EACJ,QAAQ,EACR,uBAAuB,GAOxB;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,EAAE;QACrE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,UAAU;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,oCAAoC,IAAI,CAAC,wBAAwB,GAAG,CACrE,CACF,CAAC;QACJ,CAAC;QACD,uBAAuB,CAAC,IAAI,CAC1B,KAAK,CAAC,CAAC,mCAAmC,CACxC,GAAG,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,EACvF;YACE,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,gBAAgB,EAAE,mBAAmB;SACtC,CACF,CACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAyC,EAAE,CAAC;IACxD,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CACjD,GAAG,EAAE,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAChD;YACE,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,WAAW,EAAE,SAAS,CAAC,WAAW;SACnC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAiD,EAAE,CAAC;IACxE,KAAK,MAAM,iBAAiB,IAAI,IAAI,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;QAC1D,cAAc,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,aAAa,CACzE,GAAG,EAAE,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,GAAG,CAAC,eAAe,EAChE;YACE,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,iBAAiB,CAAC,IAAI;YAC5B,WAAW,EAAE,iBAAiB,CAAC,WAAW;YAC1C,eAAe,EAAE,iBAAiB,CAAC,eAAe;YAClD,UAAU,EAAE,iBAAiB,CAAC,UAAU;SACzC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAqD,EAAE,CAAC;IACzE,KAAK,MAAM,cAAc,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,+BAA+B,cAAc,CAAC,UAAU,GAAG,CAAC,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,cAAc,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,sCAAsC,cAAc,CAAC,gBAAgB,GAAG,CACzE,CACF,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,cAAc,CAAC,QAAQ,KAAK,SAAS;YACnC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,OAAO;YAC1C,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC;QACjC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,+CAA+C,cAAc,CAAC,GAAG,IAAI,GAAG,cAAc,CAAC,gBAAgB,IAAI,cAAc,CAAC,UAAU,EAAE,GAAG,CAC1I,CACF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GACP,cAAc,CAAC,GAAG;YAClB,GAAG,cAAc,CAAC,gBAAgB,IAAI,cAAc,CAAC,UAAU,IAAI,cAAc,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;QAE9G,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,iBAAiB,CACxD,GAAG,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAC3C;YACE,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;YAChD,WAAW;YACX,aAAa,EAAE,cAAc,CAAC,QAAQ;gBACpC,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,CAAC,cAAc,CAAC,aAAa,IAAI,MAAM,CAAC;YAC5C,QAAQ,EAAE,OAAO,CAAC,SAAS;SAC5B,CACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,MAAM;QACN,cAAc;QACd,WAAW;KACZ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAChB,MAA8B,EAC9B,IAAwC,EACxC,EAAE,CAAC,CAAC;IACJ,GAAG,MAAM;IACT,GAAG,IAAI;CACR,CAAC,CAAC"}