alchemy 2.0.0-beta.cli-platform-split-2 → 2.0.0-beta.pkg-setup-rc

package/lib/AWS/Organizations/RootPolicyType.js

@@ -0,0 +1,77 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { collectPages, retryOrganizations } from "./common.js";
+/**
+ * Enables a policy type on an organization root.
+ */
+export const RootPolicyType = Resource("AWS.Organizations.RootPolicyType");
+export const RootPolicyTypeProvider = () => Provider.effect(RootPolicyType, Effect.gen(function* () {
+    return {
+        stables: ["rootId", "rootArn", "policyType"],
+        diff: Effect.fn(function* ({ olds, news }) {
+            if (!isResolved(news))
+                return;
+            if (olds?.rootId !== news.rootId ||
+                olds?.policyType !== news.policyType) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+            return yield* readRootPolicyType({
+                rootId: output?.rootId ?? olds.rootId,
+                policyType: output?.policyType ?? olds.policyType,
+            });
+        }),
+        create: Effect.fn(function* ({ news, session }) {
+            yield* retryOrganizations(organizations
+                .enablePolicyType({
+                RootId: news.rootId,
+                PolicyType: news.policyType,
+            })
+                .pipe(Effect.catchTag("PolicyTypeAlreadyEnabledException", () => Effect.void)));
+            const state = yield* readRootPolicyType(news);
+            if (!state) {
+                return {
+                    rootId: news.rootId,
+                    rootArn: undefined,
+                    policyType: news.policyType,
+                    status: "PENDING_ENABLE",
+                };
+            }
+            yield* session.note(state.rootArn ?? state.rootId);
+            return state;
+        }),
+        update: Effect.fn(function* ({ output, session }) {
+            yield* session.note(output.rootArn ?? output.rootId);
+            return output;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* retryOrganizations(organizations
+                .disablePolicyType({
+                RootId: output.rootId,
+                PolicyType: output.policyType,
+            })
+                .pipe(Effect.catchTags({
+                PolicyTypeNotEnabledException: () => Effect.void,
+                RootNotFoundException: () => Effect.void,
+            })));
+        }),
+    };
+}));
+const readRoot = (rootId) => collectPages((NextToken) => organizations.listRoots({ NextToken }), (page) => page.Roots).pipe(retryOrganizations, Effect.map((roots) => roots.find((root) => root.Id === rootId)));
+const readRootPolicyType = Effect.fn(function* ({ rootId, policyType, }) {
+    const root = yield* readRoot(rootId);
+    const summary = root?.PolicyTypes?.find((item) => item.Type === policyType);
+    return summary
+        ? {
+            rootId,
+            rootArn: root?.Arn,
+            policyType,
+            status: summary.Status,
+        }
+        : undefined;
+});
+//# sourceMappingURL=RootPolicyType.js.map

package/lib/AWS/Organizations/RootPolicyType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RootPolicyType.js","sourceRoot":"","sources":["../../../src/AWS/Organizations/RootPolicyType.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA0B/D;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CACpC,kCAAkC,CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACzC,QAAQ,CAAC,MAAM,CACb,cAAc,EACd,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,OAAO,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC;QAC5C,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IACE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,MAAM;gBAC5B,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC,UAAU,EACpC,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACzC,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC;gBAC/B,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,IAAK,CAAC,MAAM;gBACtC,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,IAAK,CAAC,UAAU;aACnD,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAC5C,KAAK,CAAC,CAAC,kBAAkB,CACvB,aAAa;iBACV,gBAAgB,CAAC;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,mCAAmC,EACnC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAClB,CACF,CACJ,CAAC;YAEF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,OAAO,EAAE,SAAS;oBAClB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,MAAM,EAAE,gBAAgB;iBACc,CAAC;YAC3C,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9C,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,kBAAkB,CACvB,aAAa;iBACV,iBAAiB,CAAC;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,SAAS,CAAC;gBACf,6BAA6B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;gBAChD,qBAAqB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;aACzC,CAAC,CACH,CACJ,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE,CAClC,YAAY,CACV,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,EACrD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CACrB,CAAC,IAAI,CACJ,kBAAkB,EAClB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAChE,CAAC;AAEJ,MAAM,kBAAkB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC9C,MAAM,EACN,UAAU,GACU;IACpB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC5E,OAAO,OAAO;QACZ,CAAC,CAAE;YACC,MAAM;YACN,OAAO,EAAE,IAAI,EAAE,GAAG;YAClB,UAAU;YACV,MAAM,EAAE,OAAO,CAAC,MAAM;SACiB;QAC3C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC,CAAC"}

package/lib/AWS/Organizations/TenantRoot.d.ts

@@ -0,0 +1,145 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import type { PolicyDocument } from "../IAM/Policy.ts";
+import * as IdentityCenter from "../IdentityCenter/index.ts";
+import type { Account, AccountProps } from "./Account.ts";
+import type { DelegatedAdministrator } from "./DelegatedAdministrator.ts";
+import type { Organization, OrganizationProps } from "./Organization.ts";
+import type { OrganizationalUnit, OrganizationalUnitProps } from "./OrganizationalUnit.ts";
+import type { Policy } from "./Policy.ts";
+import type { PolicyAttachment } from "./PolicyAttachment.ts";
+import type { Root, RootProps } from "./Root.ts";
+import type { RootPolicyType } from "./RootPolicyType.ts";
+import type { TrustedServiceAccess } from "./TrustedServiceAccess.ts";
+export type TenantTargetKey = "root" | string;
+export interface TenantAccountSpec extends Omit<AccountProps, "parentId" | "name" | "email"> {
+    key: string;
+    name: string;
+    email: string;
+}
+export interface TenantOrganizationalUnitSpec extends Omit<OrganizationalUnitProps, "parentId" | "name"> {
+    key: string;
+    name?: string;
+    accounts?: TenantAccountSpec[];
+    children?: TenantOrganizationalUnitSpec[];
+}
+export interface TenantPolicySpec {
+    key: string;
+    name?: string;
+    description?: string;
+    type?: organizations.PolicyType;
+    document: PolicyDocument;
+    targetKeys: TenantTargetKey[];
+    tags?: Record<string, string>;
+}
+export interface TenantIdentityCenterGroupSpec {
+    key: string;
+    displayName: string;
+    description?: string;
+}
+export interface TenantIdentityCenterPermissionSetSpec {
+    key: string;
+    name: string;
+    description?: string;
+    sessionDuration?: string;
+    relayState?: string;
+}
+export interface TenantIdentityCenterAssignmentSpec {
+    key?: string;
+    permissionSetKey: string;
+    accountKey: string;
+    principalType?: "USER" | "GROUP";
+    groupKey?: string;
+    principalId?: string;
+}
+export interface TenantIdentityCenterSpec {
+    mode?: "existing" | "account";
+    instanceArn?: string;
+    name?: string;
+    delegatedAdminAccountKey?: string;
+    groups?: TenantIdentityCenterGroupSpec[];
+    permissionSets?: TenantIdentityCenterPermissionSetSpec[];
+    assignments?: TenantIdentityCenterAssignmentSpec[];
+}
+export interface TenantRootProps {
+    organization?: OrganizationProps;
+    root?: RootProps;
+    policyTypes?: organizations.PolicyType[];
+    trustedServicePrincipals?: string[];
+    organizationalUnits?: TenantOrganizationalUnitSpec[];
+    policies?: TenantPolicySpec[];
+    identityCenter?: TenantIdentityCenterSpec;
+    tags?: Record<string, string>;
+}
+export interface TenantRootResult {
+    organization: Organization;
+    root: Root;
+    policyTypes: RootPolicyType[];
+    trustedServiceAccess: TrustedServiceAccess[];
+    delegatedAdministrators: DelegatedAdministrator[];
+    organizationalUnits: Record<string, OrganizationalUnit>;
+    accounts: Record<string, Account>;
+    policies: Record<string, Policy>;
+    policyAttachments: PolicyAttachment[];
+    identityCenter?: {
+        instance: IdentityCenter.Instance;
+        groups: Record<string, IdentityCenter.Group>;
+        permissionSets: Record<string, IdentityCenter.PermissionSet>;
+        assignments: Record<string, IdentityCenter.AccountAssignment>;
+    };
+}
+/**
+ * Compose an opinionated single-tenant landing zone inside the current AWS
+ * Organizations management account.
+ *
+ * This helper intentionally stays aligned to native AWS semantics:
+ * one real Organization, one root, nested OUs, and accounts beneath that
+ * tenant root. The broader `RootRoot` concept is an Alchemy control-plane
+ * abstraction over many such tenant roots deployed into separate management
+ * accounts, not a nested AWS Organizations feature.
+ *
+ * @section Creating A Tenant Root
+ * @example Tenant With Baseline Accounts
+ * ```typescript
+ * const tenant = yield* TenantRoot("CustomerA", {
+ *   identityCenter: {
+ *     mode: "existing",
+ *     groups: [
+ *       { key: "platform", displayName: "platform-engineers" },
+ *     ],
+ *     permissionSets: [
+ *       {
+ *         key: "admin",
+ *         name: "AdministratorAccess",
+ *         sessionDuration: "PT8H",
+ *       },
+ *     ],
+ *     assignments: [
+ *       {
+ *         permissionSetKey: "admin",
+ *         groupKey: "platform",
+ *         accountKey: "prod",
+ *       },
+ *     ],
+ *   },
+ * });
+ * ```
+ */
+export declare const TenantRoot: (id: string, props?: TenantRootProps | undefined) => Effect.Effect<{
+    organization: Organization;
+    root: Root;
+    policyTypes: RootPolicyType[];
+    trustedServiceAccess: TrustedServiceAccess[];
+    delegatedAdministrators: DelegatedAdministrator[];
+    organizationalUnits: Record<string, OrganizationalUnit>;
+    accounts: Record<string, Account>;
+    policies: Record<string, Policy>;
+    policyAttachments: PolicyAttachment[];
+    identityCenter: {
+        instance: IdentityCenter.Instance;
+        groups: Record<string, IdentityCenter.Group>;
+        permissionSets: Record<string, IdentityCenter.PermissionSet>;
+        assignments: Record<string, IdentityCenter.AccountAssignment>;
+    } | undefined;
+}, unknown, unknown>;
+//# sourceMappingURL=TenantRoot.d.ts.map

package/lib/AWS/Organizations/TenantRoot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantRoot.d.ts","sourceRoot":"","sources":["../../../src/AWS/Organizations/TenantRoot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAE1E,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAGtE,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9C,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,YAAY,EACZ,UAAU,GAAG,MAAM,GAAG,OAAO,CAC9B;IACC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,4BAA6B,SAAQ,IAAI,CACxD,uBAAuB,EACvB,UAAU,GAAG,MAAM,CACpB;IACC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,4BAA4B,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC;IAChC,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,6BAA6B;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qCAAqC;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,MAAM,CAAC,EAAE,6BAA6B,EAAE,CAAC;IACzC,cAAc,CAAC,EAAE,qCAAqC,EAAE,CAAC;IACzD,WAAW,CAAC,EAAE,kCAAkC,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,WAAW,CAAC,EAAE,aAAa,CAAC,UAAU,EAAE,CAAC;IACzC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,mBAAmB,CAAC,EAAE,4BAA4B,EAAE,CAAC;IACrD,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,YAAY,CAAC;IAC3B,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;IAC7C,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;IAClD,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;IACtC,cAAc,CAAC,EAAE;QACf,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;QAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;QAC7C,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;QAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,iBAAiB,CAAC,CAAC;KAC/D,CAAC;CACH;AAkDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;oBAqHrB,CAAC"}

package/lib/AWS/Organizations/TenantRoot.js

@@ -0,0 +1,277 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import * as IdentityCenter from "../IdentityCenter/index.js";
+import { Account as OrganizationAccount } from "./Account.js";
+import { DelegatedAdministrator as OrganizationsDelegatedAdministrator } from "./DelegatedAdministrator.js";
+import { Organization as AwsOrganization } from "./Organization.js";
+import { OrganizationalUnit as AwsOrganizationalUnit } from "./OrganizationalUnit.js";
+import { Policy as OrganizationsPolicy } from "./Policy.js";
+import { PolicyAttachment as OrganizationsPolicyAttachment } from "./PolicyAttachment.js";
+import { Root as OrganizationRoot } from "./Root.js";
+import { RootPolicyType as OrganizationsRootPolicyType } from "./RootPolicyType.js";
+import { TrustedServiceAccess as OrganizationsTrustedServiceAccess } from "./TrustedServiceAccess.js";
+const defaultTenantOrganizationalUnits = () => [
+    {
+        key: "security",
+        name: "security",
+        accounts: [
+            {
+                key: "security",
+                name: "security",
+                email: "security@example.com",
+            },
+            {
+                key: "log-archive",
+                name: "log-archive",
+                email: "log-archive@example.com",
+            },
+        ],
+    },
+    {
+        key: "infrastructure",
+        name: "infrastructure",
+        accounts: [
+            {
+                key: "shared-services",
+                name: "shared-services",
+                email: "shared-services@example.com",
+            },
+        ],
+    },
+    {
+        key: "workloads",
+        name: "workloads",
+        accounts: [
+            {
+                key: "prod",
+                name: "prod",
+                email: "prod@example.com",
+            },
+        ],
+    },
+];
+const toLogicalIdSegment = (value) => value
+    .split(/[^A-Za-z0-9]+/)
+    .filter(Boolean)
+    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+    .join("");
+/**
+ * Compose an opinionated single-tenant landing zone inside the current AWS
+ * Organizations management account.
+ *
+ * This helper intentionally stays aligned to native AWS semantics:
+ * one real Organization, one root, nested OUs, and accounts beneath that
+ * tenant root. The broader `RootRoot` concept is an Alchemy control-plane
+ * abstraction over many such tenant roots deployed into separate management
+ * accounts, not a nested AWS Organizations feature.
+ *
+ * @section Creating A Tenant Root
+ * @example Tenant With Baseline Accounts
+ * ```typescript
+ * const tenant = yield* TenantRoot("CustomerA", {
+ *   identityCenter: {
+ *     mode: "existing",
+ *     groups: [
+ *       { key: "platform", displayName: "platform-engineers" },
+ *     ],
+ *     permissionSets: [
+ *       {
+ *         key: "admin",
+ *         name: "AdministratorAccess",
+ *         sessionDuration: "PT8H",
+ *       },
+ *     ],
+ *     assignments: [
+ *       {
+ *         permissionSetKey: "admin",
+ *         groupKey: "platform",
+ *         accountKey: "prod",
+ *       },
+ *     ],
+ *   },
+ * });
+ * ```
+ */
+export const TenantRoot = Effect.fn(function* (id, props = {}) {
+    const sharedTags = props.tags ?? {};
+    const organization = yield* AwsOrganization(`${id}Organization`, {
+        featureSet: "ALL",
+        ...props.organization,
+    });
+    const root = yield* OrganizationRoot(`${id}Root`, {
+        ...props.root,
+        tags: mergeTags(sharedTags, props.root?.tags),
+    });
+    const policyTypes = yield* Effect.forEach(props.policyTypes ?? ["SERVICE_CONTROL_POLICY"], (policyType) => OrganizationsRootPolicyType(`${id}${toLogicalIdSegment(policyType)}PolicyType`, {
+        rootId: root.rootId,
+        policyType,
+    }), { concurrency: "unbounded" });
+    const trustedServicePrincipals = [
+        ...(props.trustedServicePrincipals ?? []),
+        ...(props.identityCenter ? ["sso.amazonaws.com"] : []),
+    ];
+    const trustedServiceAccess = yield* Effect.forEach([...new Set(trustedServicePrincipals)], (servicePrincipal) => OrganizationsTrustedServiceAccess(`${id}${toLogicalIdSegment(servicePrincipal)}TrustedAccess`, { servicePrincipal }), { concurrency: "unbounded" });
+    const organizationalUnits = {};
+    const accounts = {};
+    const targets = {
+        root: { targetId: root.rootId },
+    };
+    yield* createOrganizationalUnits({
+        id,
+        parentId: root.rootId,
+        sharedTags,
+        specs: props.organizationalUnits ?? defaultTenantOrganizationalUnits(),
+        organizationalUnits,
+        accounts,
+        targets,
+    });
+    const delegatedAdministrators = [];
+    const identityCenter = props.identityCenter
+        ? yield* createTenantIdentityCenter({
+            id,
+            spec: props.identityCenter,
+            accounts,
+            sharedTags,
+            delegatedAdministrators,
+        })
+        : undefined;
+    const policies = {};
+    const policyAttachments = [];
+    for (const policySpec of props.policies ?? []) {
+        const policy = yield* OrganizationsPolicy(`${id}${toLogicalIdSegment(policySpec.key)}Policy`, {
+            name: policySpec.name,
+            description: policySpec.description,
+            type: policySpec.type ?? "SERVICE_CONTROL_POLICY",
+            document: policySpec.document,
+            tags: mergeTags(sharedTags, policySpec.tags),
+        });
+        policies[policySpec.key] = policy;
+        for (const targetKey of policySpec.targetKeys) {
+            const target = targets[targetKey];
+            if (!target) {
+                return yield* Effect.fail(new Error(`Unknown tenant policy target '${targetKey}' for policy '${policySpec.key}'`));
+            }
+            policyAttachments.push(yield* OrganizationsPolicyAttachment(`${id}${toLogicalIdSegment(policySpec.key)}${toLogicalIdSegment(targetKey)}Attachment`, {
+                policyId: policy.policyId,
+                targetId: target.targetId,
+            }));
+        }
+    }
+    return {
+        organization,
+        root,
+        policyTypes,
+        trustedServiceAccess,
+        delegatedAdministrators,
+        organizationalUnits,
+        accounts,
+        policies,
+        policyAttachments,
+        identityCenter,
+    };
+});
+const createOrganizationalUnits = ({ id, parentId, sharedTags, specs, organizationalUnits, accounts, targets, }) => Effect.gen(function* () {
+    for (const spec of specs) {
+        const ou = yield* AwsOrganizationalUnit(`${id}${toLogicalIdSegment(spec.key)}Ou`, {
+            parentId,
+            name: spec.name ?? spec.key,
+            tags: mergeTags(sharedTags, spec.tags),
+        });
+        organizationalUnits[spec.key] = ou;
+        targets[spec.key] = { targetId: ou.ouId };
+        for (const accountSpec of spec.accounts ?? []) {
+            const account = yield* OrganizationAccount(`${id}${toLogicalIdSegment(accountSpec.key)}Account`, {
+                ...accountSpec,
+                parentId: ou.ouId,
+                tags: mergeTags(sharedTags, accountSpec.tags),
+            });
+            accounts[accountSpec.key] = account;
+            targets[accountSpec.key] = { targetId: account.accountId };
+        }
+        if (spec.children?.length) {
+            yield* createOrganizationalUnits({
+                id,
+                parentId: ou.ouId,
+                sharedTags,
+                specs: spec.children,
+                organizationalUnits,
+                accounts,
+                targets,
+            });
+        }
+    }
+});
+const createTenantIdentityCenter = Effect.fn(function* ({ id, spec, accounts, delegatedAdministrators, }) {
+    const instance = yield* IdentityCenter.Instance(`${id}IdentityCenter`, {
+        mode: spec.mode ?? "existing",
+        instanceArn: spec.instanceArn,
+        name: spec.name,
+    });
+    if (spec.delegatedAdminAccountKey) {
+        const account = accounts[spec.delegatedAdminAccountKey];
+        if (!account) {
+            return yield* Effect.fail(new Error(`Unknown delegated admin account '${spec.delegatedAdminAccountKey}'`));
+        }
+        delegatedAdministrators.push(yield* OrganizationsDelegatedAdministrator(`${id}${toLogicalIdSegment(spec.delegatedAdminAccountKey)}IdentityCenterDelegatedAdmin`, {
+            accountId: account.accountId,
+            servicePrincipal: "sso.amazonaws.com",
+        }));
+    }
+    const groups = {};
+    for (const groupSpec of spec.groups ?? []) {
+        groups[groupSpec.key] = yield* IdentityCenter.Group(`${id}${toLogicalIdSegment(groupSpec.key)}Group`, {
+            identityStoreId: instance.identityStoreId,
+            displayName: groupSpec.displayName,
+            description: groupSpec.description,
+        });
+    }
+    const permissionSets = {};
+    for (const permissionSetSpec of spec.permissionSets ?? []) {
+        permissionSets[permissionSetSpec.key] = yield* IdentityCenter.PermissionSet(`${id}${toLogicalIdSegment(permissionSetSpec.key)}PermissionSet`, {
+            instanceArn: instance.instanceArn,
+            name: permissionSetSpec.name,
+            description: permissionSetSpec.description,
+            sessionDuration: permissionSetSpec.sessionDuration,
+            relayState: permissionSetSpec.relayState,
+        });
+    }
+    const assignments = {};
+    for (const assignmentSpec of spec.assignments ?? []) {
+        const account = accounts[assignmentSpec.accountKey];
+        if (!account) {
+            return yield* Effect.fail(new Error(`Unknown assignment account '${assignmentSpec.accountKey}'`));
+        }
+        const permissionSet = permissionSets[assignmentSpec.permissionSetKey];
+        if (!permissionSet) {
+            return yield* Effect.fail(new Error(`Unknown assignment permission set '${assignmentSpec.permissionSetKey}'`));
+        }
+        const principalId = assignmentSpec.groupKey !== undefined
+            ? groups[assignmentSpec.groupKey]?.groupId
+            : assignmentSpec.principalId;
+        if (!principalId) {
+            return yield* Effect.fail(new Error(`Unable to resolve principal for assignment '${assignmentSpec.key ?? `${assignmentSpec.permissionSetKey}-${assignmentSpec.accountKey}`}'`));
+        }
+        const key = assignmentSpec.key ??
+            `${assignmentSpec.permissionSetKey}-${assignmentSpec.accountKey}-${assignmentSpec.groupKey ?? principalId}`;
+        assignments[key] = yield* IdentityCenter.AccountAssignment(`${id}${toLogicalIdSegment(key)}Assignment`, {
+            instanceArn: instance.instanceArn,
+            permissionSetArn: permissionSet.permissionSetArn,
+            principalId,
+            principalType: assignmentSpec.groupKey
+                ? "GROUP"
+                : (assignmentSpec.principalType ?? "USER"),
+            targetId: account.accountId,
+        });
+    }
+    return {
+        instance,
+        groups,
+        permissionSets,
+        assignments,
+    };
+});
+const mergeTags = (shared, tags) => ({
+    ...shared,
+    ...tags,
+});
+//# sourceMappingURL=TenantRoot.js.map

package/lib/AWS/Organizations/TenantRoot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantRoot.js","sourceRoot":"","sources":["../../../src/AWS/Organizations/TenantRoot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,EAAE,sBAAsB,IAAI,mCAAmC,EAAE,MAAM,6BAA6B,CAAC;AAE5G,OAAO,EAAE,YAAY,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAKpE,OAAO,EAAE,kBAAkB,IAAI,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,OAAO,EAAE,MAAM,IAAI,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,EAAE,gBAAgB,IAAI,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EAAE,IAAI,IAAI,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,cAAc,IAAI,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAEpF,OAAO,EAAE,oBAAoB,IAAI,iCAAiC,EAAE,MAAM,2BAA2B,CAAC;AA+FtG,MAAM,gCAAgC,GAAG,GAAmC,EAAE,CAAC;IAC7E;QACE,GAAG,EAAE,UAAU;QACf,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,UAAU;gBACf,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,sBAAsB;aAC9B;YACD;gBACE,GAAG,EAAE,aAAa;gBAClB,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,yBAAyB;aACjC;SACF;KACF;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,iBAAiB;gBACtB,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,6BAA6B;aACrC;SACF;KACF;IACD;QACE,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,kBAAkB;aAC1B;SACF;KACF;CACF,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAE,EAAE,CAC3C,KAAK;KACF,KAAK,CAAC,eAAe,CAAC;KACtB,MAAM,CAAC,OAAO,CAAC;KACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KAC3D,IAAI,CAAC,EAAE,CAAC,CAAC;AAEd;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC3C,EAAU,EACV,QAAyB,EAAE;IAE3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE;QAC/D,UAAU,EAAE,KAAK;QACjB,GAAG,KAAK,CAAC,YAAY;KACtB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE;QAChD,GAAG,KAAK,CAAC,IAAI;QACb,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;KAC9C,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACvC,KAAK,CAAC,WAAW,IAAI,CAAC,wBAAwB,CAAC,EAC/C,CAAC,UAAU,EAAE,EAAE,CACb,2BAA2B,CACzB,GAAG,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,YAAY,EAClD;QACE,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU;KACX,CACF,EACH,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;IAEF,MAAM,wBAAwB,GAAG;QAC/B,GAAG,CAAC,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC;QACzC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;IACF,MAAM,oBAAoB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAChD,CAAC,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC,CAAC,EACtC,CAAC,gBAAgB,EAAE,EAAE,CACnB,iCAAiC,CAC/B,GAAG,EAAE,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,eAAe,EAC3D,EAAE,gBAAgB,EAAE,CACrB,EACH,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;IAEF,MAAM,mBAAmB,GAAuC,EAAE,CAAC;IACnE,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,OAAO,GAA+C;QAC1D,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAa,EAAE;KACvC,CAAC;IAEF,KAAK,CAAC,CAAC,yBAAyB,CAAC;QAC/B,EAAE;QACF,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,UAAU;QACV,KAAK,EAAE,KAAK,CAAC,mBAAmB,IAAI,gCAAgC,EAAE;QACtE,mBAAmB;QACnB,QAAQ;QACR,OAAO;KACR,CAAC,CAAC;IAEH,MAAM,uBAAuB,GAA6B,EAAE,CAAC;IAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc;QACzC,CAAC,CAAC,KAAK,CAAC,CAAC,0BAA0B,CAAC;YAChC,EAAE;YACF,IAAI,EAAE,KAAK,CAAC,cAAc;YAC1B,QAAQ;YACR,UAAU;YACV,uBAAuB;SACxB,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,iBAAiB,GAAuB,EAAE,CAAC;IACjD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACvC,GAAG,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAClD;YACE,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,wBAAwB;YACjD,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC;SAC7C,CACF,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QAElC,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,iCAAiC,SAAS,iBAAiB,UAAU,CAAC,GAAG,GAAG,CAC7E,CACF,CAAC;YACJ,CAAC;YAED,iBAAiB,CAAC,IAAI,CACpB,KAAK,CAAC,CAAC,6BAA6B,CAClC,GAAG,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,YAAY,EACtF;gBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,YAAY;QACZ,IAAI;QACJ,WAAW;QACX,oBAAoB;QACpB,uBAAuB;QACvB,mBAAmB;QACnB,QAAQ;QACR,QAAQ;QACR,iBAAiB;QACjB,cAAc;KACY,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,EACjC,EAAE,EACF,QAAQ,EACR,UAAU,EACV,KAAK,EACL,mBAAmB,EACnB,QAAQ,EACR,OAAO,GASR,EAAyC,EAAE,CAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,qBAAqB,CACrC,GAAG,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EACxC;YACE,QAAQ;YACR,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG;YAC3B,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC;SACvC,CACF,CAAC;QACF,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAW,EAAE,CAAC;QAEjD,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACxC,GAAG,EAAE,GAAG,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EACpD;gBACE,GAAG,WAAW;gBACd,QAAQ,EAAE,EAAE,CAAC,IAAI;gBACjB,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC;aAC9C,CACF,CAAC;YACF,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;YACpC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAgB,EAAE,CAAC;QACpE,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC1B,KAAK,CAAC,CAAC,yBAAyB,CAAC;gBAC/B,EAAE;gBACF,QAAQ,EAAE,EAAE,CAAC,IAAW;gBACxB,UAAU;gBACV,KAAK,EAAE,IAAI,CAAC,QAAQ;gBACpB,mBAAmB;gBACnB,QAAQ;gBACR,OAAO;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,0BAA0B,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EACtD,EAAE,EACF,IAAI,EACJ,QAAQ,EACR,uBAAuB,GAOxB;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,EAAE;QACrE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,UAAU;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,oCAAoC,IAAI,CAAC,wBAAwB,GAAG,CACrE,CACF,CAAC;QACJ,CAAC;QACD,uBAAuB,CAAC,IAAI,CAC1B,KAAK,CAAC,CAAC,mCAAmC,CACxC,GAAG,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,EACvF;YACE,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,gBAAgB,EAAE,mBAAmB;SACtC,CACF,CACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAyC,EAAE,CAAC;IACxD,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CACjD,GAAG,EAAE,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAChD;YACE,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,WAAW,EAAE,SAAS,CAAC,WAAW;SACnC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAiD,EAAE,CAAC;IACxE,KAAK,MAAM,iBAAiB,IAAI,IAAI,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;QAC1D,cAAc,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,aAAa,CACzE,GAAG,EAAE,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,GAAG,CAAC,eAAe,EAChE;YACE,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,iBAAiB,CAAC,IAAI;YAC5B,WAAW,EAAE,iBAAiB,CAAC,WAAW;YAC1C,eAAe,EAAE,iBAAiB,CAAC,eAAe;YAClD,UAAU,EAAE,iBAAiB,CAAC,UAAU;SACzC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAqD,EAAE,CAAC;IACzE,KAAK,MAAM,cAAc,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,+BAA+B,cAAc,CAAC,UAAU,GAAG,CAAC,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,cAAc,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,sCAAsC,cAAc,CAAC,gBAAgB,GAAG,CACzE,CACF,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,cAAc,CAAC,QAAQ,KAAK,SAAS;YACnC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,OAAO;YAC1C,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC;QACjC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,+CAA+C,cAAc,CAAC,GAAG,IAAI,GAAG,cAAc,CAAC,gBAAgB,IAAI,cAAc,CAAC,UAAU,EAAE,GAAG,CAC1I,CACF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GACP,cAAc,CAAC,GAAG;YAClB,GAAG,cAAc,CAAC,gBAAgB,IAAI,cAAc,CAAC,UAAU,IAAI,cAAc,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;QAE9G,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,iBAAiB,CACxD,GAAG,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAC3C;YACE,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;YAChD,WAAW;YACX,aAAa,EAAE,cAAc,CAAC,QAAQ;gBACpC,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,CAAC,cAAc,CAAC,aAAa,IAAI,MAAM,CAAC;YAC5C,QAAQ,EAAE,OAAO,CAAC,SAAS;SAC5B,CACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,MAAM;QACN,cAAc;QACd,WAAW;KACZ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAChB,MAA8B,EAC9B,IAAwC,EACxC,EAAE,CAAC,CAAC;IACJ,GAAG,MAAM;IACT,GAAG,IAAI;CACR,CAAC,CAAC"}

package/lib/AWS/Organizations/TrustedServiceAccess.d.ts

@@ -0,0 +1,20 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export interface TrustedServiceAccessProps {
+    /**
+     * Service principal granted trusted access to the organization.
+     */
+    servicePrincipal: string;
+}
+export interface TrustedServiceAccess extends Resource<"AWS.Organizations.TrustedServiceAccess", TrustedServiceAccessProps, {
+    servicePrincipal: string;
+    dateEnabled: Date | undefined;
+}, never, Providers> {
+}
+/**
+ * Enables trusted access for an AWS service principal.
+ */
+export declare const TrustedServiceAccess: import("../../Resource.ts").ResourceClass<TrustedServiceAccess>;
+export declare const TrustedServiceAccessProvider: () => import("effect/Layer").Layer<Provider.Provider<TrustedServiceAccess>, never, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=TrustedServiceAccess.d.ts.map

package/lib/AWS/Organizations/TrustedServiceAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustedServiceAccess.d.ts","sourceRoot":"","sources":["../../../src/AWS/Organizations/TrustedServiceAccess.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAqB,SAAQ,QAAQ,CACpD,wCAAwC,EACxC,yBAAyB,EACzB;IACE,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,IAAI,GAAG,SAAS,CAAC;CAC/B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;GAEG;AACH,eAAO,MAAM,oBAAoB,iEAEhC,CAAC;AAEF,eAAO,MAAM,4BAA4B,kPAuDtC,CAAC"}

package/lib/AWS/Organizations/TrustedServiceAccess.js

@@ -0,0 +1,61 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { collectPages, retryOrganizations } from "./common.js";
+/**
+ * Enables trusted access for an AWS service principal.
+ */
+export const TrustedServiceAccess = Resource("AWS.Organizations.TrustedServiceAccess");
+export const TrustedServiceAccessProvider = () => Provider.effect(TrustedServiceAccess, Effect.gen(function* () {
+    return {
+        stables: ["servicePrincipal"],
+        diff: Effect.fn(function* ({ olds, news }) {
+            if (!isResolved(news))
+                return;
+            if (olds?.servicePrincipal !== news.servicePrincipal) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+            return yield* readTrustedServiceAccess(output?.servicePrincipal ?? olds.servicePrincipal);
+        }),
+        create: Effect.fn(function* ({ news, session }) {
+            if (!(yield* readTrustedServiceAccess(news.servicePrincipal))) {
+                yield* retryOrganizations(organizations.enableAWSServiceAccess({
+                    ServicePrincipal: news.servicePrincipal,
+                }));
+            }
+            const state = yield* readTrustedServiceAccess(news.servicePrincipal);
+            if (!state) {
+                return yield* Effect.fail(new Error(`trusted service access '${news.servicePrincipal}' not found after create`));
+            }
+            yield* session.note(state.servicePrincipal);
+            return state;
+        }),
+        update: Effect.fn(function* ({ output, session }) {
+            yield* session.note(output.servicePrincipal);
+            return output;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            if (!(yield* readTrustedServiceAccess(output.servicePrincipal))) {
+                return;
+            }
+            yield* retryOrganizations(organizations.disableAWSServiceAccess({
+                ServicePrincipal: output.servicePrincipal,
+            }));
+        }),
+    };
+}));
+const readTrustedServiceAccess = Effect.fn(function* (servicePrincipal) {
+    const principals = yield* retryOrganizations(collectPages((NextToken) => organizations.listAWSServiceAccessForOrganization({ NextToken }), (page) => page.EnabledServicePrincipals));
+    const match = principals.find((candidate) => candidate.ServicePrincipal === servicePrincipal);
+    return match
+        ? {
+            servicePrincipal,
+            dateEnabled: match.DateEnabled,
+        }
+        : undefined;
+});
+//# sourceMappingURL=TrustedServiceAccess.js.map

package/lib/AWS/Organizations/TrustedServiceAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustedServiceAccess.js","sourceRoot":"","sources":["../../../src/AWS/Organizations/TrustedServiceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAoB/D;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAC1C,wCAAwC,CACzC,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,EAAE,CAC/C,QAAQ,CAAC,MAAM,CACb,oBAAoB,EACpB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,OAAO,EAAE,CAAC,kBAAkB,CAAC;QAC7B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IAAI,IAAI,EAAE,gBAAgB,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACrD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACzC,OAAO,KAAK,CAAC,CAAC,wBAAwB,CACpC,MAAM,EAAE,gBAAgB,IAAI,IAAK,CAAC,gBAAgB,CACnD,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAC5C,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;gBAC9D,KAAK,CAAC,CAAC,kBAAkB,CACvB,aAAa,CAAC,sBAAsB,CAAC;oBACnC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;iBACxC,CAAC,CACH,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACrE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,2BAA2B,IAAI,CAAC,gBAAgB,0BAA0B,CAC3E,CACF,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9C,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;gBAChE,OAAO;YACT,CAAC;YAED,KAAK,CAAC,CAAC,kBAAkB,CACvB,aAAa,CAAC,uBAAuB,CAAC;gBACpC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;aAC1C,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,wBAAwB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAClD,gBAAwB;IAExB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAC1C,YAAY,CACV,CAAC,SAAS,EAAE,EAAE,CACZ,aAAa,CAAC,mCAAmC,CAAC,EAAE,SAAS,EAAE,CAAC,EAClE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CACxC,CACF,CAAC;IAEF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAC3B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,gBAAgB,KAAK,gBAAgB,CAC/D,CAAC;IAEF,OAAO,KAAK;QACV,CAAC,CAAE;YACC,gBAAgB;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;SACe;QACjD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC,CAAC"}

package/lib/AWS/Organizations/common.d.ts

@@ -0,0 +1,27 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+export type OrganizationsTags = Record<string, string>;
+export declare const createName: (id: string, providedName: string | undefined, maxLength: number) => Effect.Effect<string, never, import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("../../InstanceId.ts").InstanceId>;
+export declare const toTagRecord: (tags: organizations.Tag[] | undefined) => OrganizationsTags;
+export declare const collectPages: <Page extends {
+    NextToken?: string;
+}, Item, E, R>(fetch: (nextToken?: string) => Effect.Effect<Page, E, R>, select: (page: Page) => ReadonlyArray<Item> | undefined) => Effect.Effect<Item[], E, R>;
+export declare const retryOrganizations: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+export declare const createManagedTags: (id: string, tags: Record<string, string> | undefined) => Effect.Effect<{
+    "alchemy::stack": string;
+    "alchemy::stage": string;
+    "alchemy::id": string;
+}, never, import("../../Stage.ts").Stage | import("../../Stack.ts").Stack>;
+export declare const readResourceTags: (resourceId: string) => Effect.Effect<OrganizationsTags, organizations.ListTagsForResourceError, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+export declare const ensureOwnedByAlchemy: (id: string, resourceId: string, tags: OrganizationsTags, resourceType: string) => Effect.Effect<undefined, Error, import("../../Stage.ts").Stage | import("../../Stack.ts").Stack>;
+export declare const updateResourceTags: (args_0: {
+    id: string;
+    resourceId: string;
+    olds: Record<string, string> | undefined;
+    news: Record<string, string> | undefined;
+}) => Effect.Effect<{
+    "alchemy::stack": string;
+    "alchemy::stage": string;
+    "alchemy::id": string;
+}, organizations.UntagResourceError, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=common.d.ts.map