@kensio/yulin 1.20.11 → 1.20.13

package/dist/service/organizations/cfn/sim-cfn-organizations-policy-input.js

@@ -0,0 +1,33 @@
+import { SimCfnOrganizationsProperties } from "./sim-cfn-organizations-properties.js";
+const SERVICE_CONTROL_POLICY = "SERVICE_CONTROL_POLICY";
+/**
+ * What an `AWS::Organizations::Policy` Resource asks for.
+ *
+ * Every property is read here before the creator changes anything, so a
+ * Resource that cannot be satisfied fails with the organization untouched.
+ */
+export class SimCfnOrganizationsPolicyInput {
+    name;
+    document;
+    targetIds;
+    constructor(resource, properties) {
+        const values = new SimCfnOrganizationsProperties(resource, "AWS::Organizations::Policy");
+        const policyType = values.requiredString(properties["Type"], "Type");
+        if (policyType !== SERVICE_CONTROL_POLICY) {
+            throw new Error(`Unsupported sim Organizations CloudFormation Resource Policy of ` +
+                `type ${policyType}`);
+        }
+        values.ignore(properties["Tags"], "Tags", "Simulated Organizations reads no policy tags");
+        values.ignore(properties["Description"], "Description", "A policy description decides nothing");
+        this.name = values.requiredString(properties["Name"], "Name");
+        this.document = values.documentValue(properties["Content"], "Content");
+        this.targetIds = values.stringList(properties["TargetIds"]);
+    }
+    /**
+     * The policy type this Resource carries, which is the only one simulated
+     * Organizations evaluates.
+     */
+    get policyType() {
+        return SERVICE_CONTROL_POLICY;
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-properties.d.ts

@@ -0,0 +1,36 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValue } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+/**
+ * Reading the properties of an `AWS::Organizations::*` Resource.
+ *
+ * Each property is passed in by the caller under its own literal name, the way
+ * the other services read a template. A required one that is absent or of the
+ * wrong shape fails the Resource rather than quietly creating something else.
+ */
+export declare class SimCfnOrganizationsProperties {
+    #private;
+    constructor(resource: SimCfnResource, resourceType: string);
+    /**
+     * A property that has to be a string for the Resource to mean anything.
+     */
+    requiredString(value: SimCfnTemplateValue | undefined, name: string): string;
+    /**
+     * A property that is a string where a template gives one.
+     */
+    optionalString(value: SimCfnTemplateValue | undefined): string | undefined;
+    /**
+     * A list-valued property, read as the strings in it.
+     *
+     * A template may give one value where a list is allowed, which
+     * CloudFormation accepts, so a bare string reads as a list of one.
+     */
+    stringList(value: SimCfnTemplateValue | undefined): readonly string[];
+    /**
+     * A property holding an IAM policy document, given inline or as JSON text.
+     */
+    documentValue(value: SimCfnTemplateValue | undefined, name: string): Readonly<Record<string, unknown>>;
+    /**
+     * Record a property the simulation creates the Resource without acting on.
+     */
+    ignore(value: SimCfnTemplateValue | undefined, name: string, reason: string): void;
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-properties.js

@@ -0,0 +1,78 @@
+/**
+ * Reading the properties of an `AWS::Organizations::*` Resource.
+ *
+ * Each property is passed in by the caller under its own literal name, the way
+ * the other services read a template. A required one that is absent or of the
+ * wrong shape fails the Resource rather than quietly creating something else.
+ */
+export class SimCfnOrganizationsProperties {
+    #resource;
+    #resourceType;
+    constructor(resource, resourceType) {
+        this.#resource = resource;
+        this.#resourceType = resourceType;
+    }
+    /**
+     * A property that has to be a string for the Resource to mean anything.
+     */
+    requiredString(value, name) {
+        if (typeof value !== "string" || value.length === 0) {
+            throw new Error(`${this.#resourceType} ${this.#resource.logicalId} requires ${name}`);
+        }
+        return value;
+    }
+    /**
+     * A property that is a string where a template gives one.
+     */
+    optionalString(value) {
+        return typeof value === "string" ? value : undefined;
+    }
+    /**
+     * A list-valued property, read as the strings in it.
+     *
+     * A template may give one value where a list is allowed, which
+     * CloudFormation accepts, so a bare string reads as a list of one.
+     */
+    stringList(value) {
+        if (typeof value === "string") {
+            return [value];
+        }
+        if (!Array.isArray(value)) {
+            return [];
+        }
+        return value.filter((item) => typeof item === "string");
+    }
+    /**
+     * A property holding an IAM policy document, given inline or as JSON text.
+     */
+    documentValue(value, name) {
+        const document = typeof value === "string" ? this.#parse(value, name) : value;
+        if (typeof document !== "object" ||
+            document === null ||
+            Array.isArray(document)) {
+            throw new Error(`${this.#resourceType} ${this.#resource.logicalId} requires ${name} ` +
+                `to be a policy document`);
+        }
+        return document;
+    }
+    /**
+     * Record a property the simulation creates the Resource without acting on.
+     */
+    ignore(value, name, reason) {
+        if (value !== undefined) {
+            this.#resource.ignoreProperty(name, reason);
+        }
+    }
+    /**
+     * Read a document a template gave as JSON text.
+     */
+    #parse(value, name) {
+        try {
+            return JSON.parse(value);
+        }
+        catch {
+            throw new Error(`${this.#resourceType} ${this.#resource.logicalId} ${name} is not ` +
+                `valid JSON`);
+        }
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-record.d.ts

@@ -0,0 +1,40 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimOrganizationsNodeId, SimOrganizationsRootId } from "../tree/sim-organizations-node.js";
+/**
+ * What a template's `AWS::Organizations::Organization` produced.
+ *
+ * A simulated organization exists as soon as a SimAws does, so this records
+ * the one already there rather than making another. What the Resource is for
+ * is the values a template reads back off it, `RootId` above all, since that
+ * is how an organizational unit says where it hangs.
+ */
+export declare class SimCfnOrganization {
+    readonly rootId: SimOrganizationsRootId;
+    readonly featureSet: string;
+    readonly managementAccountId: SimAwsAccountId;
+    constructor(rootId: SimOrganizationsRootId, featureSet: string, managementAccountId: SimAwsAccountId);
+    /**
+     * AWS gives an organization an `o-` id of its own, apart from its root's.
+     */
+    get id(): string;
+}
+/**
+ * What a template's `AWS::Organizations::Account` produced.
+ */
+export declare class SimCfnOrganizationsAccount {
+    readonly accountId: SimAwsAccountId;
+    readonly accountName: string;
+    readonly email: string;
+    readonly joinedTimestamp: Date;
+    constructor(accountId: SimAwsAccountId, accountName: string, email: string, joinedTimestamp: Date);
+}
+/**
+ * What a template's `AWS::Organizations::Policy` produced.
+ */
+export declare class SimCfnOrganizationsPolicy {
+    readonly id: string;
+    readonly name: string;
+    readonly policyType: string;
+    readonly targetIds: readonly SimOrganizationsNodeId[];
+    constructor(id: string, name: string, policyType: string, targetIds: readonly SimOrganizationsNodeId[]);
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-record.js

@@ -0,0 +1,54 @@
+/**
+ * What a template's `AWS::Organizations::Organization` produced.
+ *
+ * A simulated organization exists as soon as a SimAws does, so this records
+ * the one already there rather than making another. What the Resource is for
+ * is the values a template reads back off it, `RootId` above all, since that
+ * is how an organizational unit says where it hangs.
+ */
+export class SimCfnOrganization {
+    rootId;
+    featureSet;
+    managementAccountId;
+    constructor(rootId, featureSet, managementAccountId) {
+        this.rootId = rootId;
+        this.featureSet = featureSet;
+        this.managementAccountId = managementAccountId;
+    }
+    /**
+     * AWS gives an organization an `o-` id of its own, apart from its root's.
+     */
+    get id() {
+        return `o-${this.rootId.slice(2)}`;
+    }
+}
+/**
+ * What a template's `AWS::Organizations::Account` produced.
+ */
+export class SimCfnOrganizationsAccount {
+    accountId;
+    accountName;
+    email;
+    joinedTimestamp;
+    constructor(accountId, accountName, email, joinedTimestamp) {
+        this.accountId = accountId;
+        this.accountName = accountName;
+        this.email = email;
+        this.joinedTimestamp = joinedTimestamp;
+    }
+}
+/**
+ * What a template's `AWS::Organizations::Policy` produced.
+ */
+export class SimCfnOrganizationsPolicy {
+    id;
+    name;
+    policyType;
+    targetIds;
+    constructor(id, name, policyType, targetIds) {
+        this.id = id;
+        this.name = name;
+        this.policyType = policyType;
+        this.targetIds = targetIds;
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-remover.d.ts

@@ -0,0 +1,17 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * Takes back what an `AWS::Organizations::*` Resource did.
+ *
+ * A Stack tears down in reverse dependency order, so a policy comes off before
+ * the unit it was attached to goes, and a unit goes before the root it hung
+ * on. Each Resource here undoes its own step and nothing else.
+ */
+export declare class SimCfnOrganizationsRemover {
+    #private;
+    constructor(simAws: SimAws);
+    /**
+     * Undo one Resource.
+     */
+    remove(resourceTypeName: string, resource: SimCfnResource): void;
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-remover.js

@@ -0,0 +1,40 @@
+import { SimCfnOrganizationsAccount, SimCfnOrganizationsPolicy, } from "./sim-cfn-organizations-record.js";
+import { SimOrganizationsOrganizationalUnit } from "../tree/sim-organizations-node.js";
+/**
+ * Takes back what an `AWS::Organizations::*` Resource did.
+ *
+ * A Stack tears down in reverse dependency order, so a policy comes off before
+ * the unit it was attached to goes, and a unit goes before the root it hung
+ * on. Each Resource here undoes its own step and nothing else.
+ */
+export class SimCfnOrganizationsRemover {
+    #simAws;
+    constructor(simAws) {
+        this.#simAws = simAws;
+    }
+    /**
+     * Undo one Resource.
+     */
+    remove(resourceTypeName, resource) {
+        const simResource = resource.simResource;
+        const organizations = this.#simAws.organizations();
+        if (simResource instanceof SimCfnOrganizationsPolicy) {
+            for (const targetId of simResource.targetIds) {
+                organizations.detachServiceControlPolicy(targetId, simResource.id);
+            }
+            return;
+        }
+        if (simResource instanceof SimCfnOrganizationsAccount) {
+            organizations.removeAccount(simResource.accountId);
+            return;
+        }
+        if (simResource instanceof SimOrganizationsOrganizationalUnit) {
+            organizations.removeOrganizationalUnit(simResource);
+            return;
+        }
+        if (resourceTypeName !== "Organization") {
+            throw new Error(`Unsupported sim Organizations CloudFormation Resource ` +
+                `${resourceTypeName} deletion`);
+        }
+    }
+}

package/dist/service/organizations/cfn/sim-organizations-cfn-resource-factory.d.ts

@@ -0,0 +1,24 @@
+import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * CloudFormation Resource factory for simulated Organizations resources.
+ *
+ * An organization belongs to a whole SimAws rather than to the Account and
+ * Region scope a Stack deploys into, so this reads the organization off the
+ * creation context instead of being handed one. That leaves the factory with
+ * no state and lets one serve every scope.
+ *
+ * `AWS::Organizations::ResourcePolicy` is left out, along with every policy
+ * type but `SERVICE_CONTROL_POLICY`, and a template declaring either is
+ * recorded as a skipped Resource.
+ */
+export declare class SimOrganizationsCfnResourceFactory implements SimCfnServiceResourceFactory {
+    /**
+     * Create a simulated Organizations resource from a CloudFormation Resource.
+     */
+    create(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceCreateContext): Promise<object | undefined>;
+    /**
+     * Remove a simulated Organizations resource a Stack created.
+     */
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
+}

package/dist/service/organizations/cfn/sim-organizations-cfn-resource-factory.js

@@ -0,0 +1,50 @@
+import { SimCfnOrganizationCreator } from "./sim-cfn-organization-creator.js";
+import { SimCfnOrganizationalUnitCreator } from "./sim-cfn-organizational-unit-creator.js";
+import { SimCfnOrganizationsAccountCreator } from "./sim-cfn-organizations-account-creator.js";
+import { SimCfnOrganizationsPolicyCreator } from "./sim-cfn-organizations-policy-creator.js";
+import { SimCfnOrganizationsRemover } from "./sim-cfn-organizations-remover.js";
+/**
+ * CloudFormation Resource factory for simulated Organizations resources.
+ *
+ * An organization belongs to a whole SimAws rather than to the Account and
+ * Region scope a Stack deploys into, so this reads the organization off the
+ * creation context instead of being handed one. That leaves the factory with
+ * no state and lets one serve every scope.
+ *
+ * `AWS::Organizations::ResourcePolicy` is left out, along with every policy
+ * type but `SERVICE_CONTROL_POLICY`, and a template declaring either is
+ * recorded as a skipped Resource.
+ */
+export class SimOrganizationsCfnResourceFactory {
+    /**
+     * Create a simulated Organizations resource from a CloudFormation Resource.
+     */
+    create(resourceTypeName, resource, context) {
+        const properties = context.resolvedProperties ?? resource.properties;
+        const { simAws } = context;
+        switch (resourceTypeName) {
+            case "Organization": {
+                return Promise.resolve(new SimCfnOrganizationCreator(simAws).create(resource, properties));
+            }
+            case "OrganizationalUnit": {
+                return Promise.resolve(new SimCfnOrganizationalUnitCreator(simAws).create(resource, properties));
+            }
+            case "Account": {
+                return Promise.resolve(new SimCfnOrganizationsAccountCreator(simAws).create(resource, properties));
+            }
+            case "Policy": {
+                return Promise.resolve(new SimCfnOrganizationsPolicyCreator(simAws).create(resource, properties));
+            }
+            default: {
+                throw new Error(`Unsupported sim Organizations CloudFormation Resource ${resourceTypeName}`);
+            }
+        }
+    }
+    /**
+     * Remove a simulated Organizations resource a Stack created.
+     */
+    delete(resourceTypeName, resource, context) {
+        new SimCfnOrganizationsRemover(context.simAws).remove(resourceTypeName, resource);
+        return Promise.resolve();
+    }
+}

package/dist/service/organizations/index.d.ts

@@ -0,0 +1,6 @@
+export { SimOrganizations, type SimOrganizationsAttachOptions, } from "./sim-organizations.js";
+export { SimOrganizationsStructure } from "./sim-organizations-structure.js";
+export { SIM_ORGANIZATIONS_FULL_AWS_ACCESS, SimOrganizationsScpStore, } from "./policy/sim-organizations-scp-store.js";
+export { SimOrganizationsEffectivePolicies } from "./policy/sim-organizations-effective-policies.js";
+export { makeSimOrganizationsOrganizationalUnitId, makeSimOrganizationsRootId, SimOrganizationsOrganizationalUnit, type SimOrganizationsNodeId, type SimOrganizationsOrganizationalUnitId, SimOrganizationsRoot, type SimOrganizationsRootId, type SimOrganizationsTarget, } from "./tree/sim-organizations-node.js";
+export { SimOrganizationsTree, SimOrganizationsUnknownNode, } from "./tree/sim-organizations-tree.js";

package/dist/service/organizations/index.js

@@ -0,0 +1,6 @@
+export { SimOrganizations, } from "./sim-organizations.js";
+export { SimOrganizationsStructure } from "./sim-organizations-structure.js";
+export { SIM_ORGANIZATIONS_FULL_AWS_ACCESS, SimOrganizationsScpStore, } from "./policy/sim-organizations-scp-store.js";
+export { SimOrganizationsEffectivePolicies } from "./policy/sim-organizations-effective-policies.js";
+export { makeSimOrganizationsOrganizationalUnitId, makeSimOrganizationsRootId, SimOrganizationsOrganizationalUnit, SimOrganizationsRoot, } from "./tree/sim-organizations-node.js";
+export { SimOrganizationsTree, SimOrganizationsUnknownNode, } from "./tree/sim-organizations-tree.js";

package/dist/service/organizations/policy/sim-organizations-effective-policies.d.ts

@@ -0,0 +1,43 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimIamServiceControlPolicySet } from "../../iam/authorize/scp/sim-iam-scp-resolver.js";
+import type { SimOrganizationsTree } from "../tree/sim-organizations-tree.js";
+import type { SimOrganizationsScpStore } from "./sim-organizations-scp-store.js";
+interface SimOrganizationsEffectivePoliciesProperties {
+    readonly tree: SimOrganizationsTree;
+    readonly scpStore: SimOrganizationsScpStore;
+}
+/**
+ * Works out which service control policies an Account is actually subject to.
+ *
+ * The tree says which nodes lie above an Account and the store says what hangs
+ * on each of them. Putting the two together is the whole of what sim IAM asks
+ * an organization, so it lives here rather than in the facade.
+ */
+export declare class SimOrganizationsEffectivePolicies {
+    private readonly tree;
+    private readonly scpStore;
+    private managementAccountId?;
+    constructor(properties: SimOrganizationsEffectivePoliciesProperties);
+    /**
+     * Name the Account AWS exempts from every service control policy.
+     */
+    setManagementAccount(accountId: SimAwsAccountId): void;
+    /**
+     * The policies in force for an Account, level by level, root first.
+     */
+    setFor(accountId: SimAwsAccountId): SimIamServiceControlPolicySet;
+    /**
+     * The nodes filtering an Account's requests.
+     *
+     * An Account placed in the organization is filtered by the path down to it.
+     * An Account only ever named by having a policy attached to it is filtered
+     * by that policy alone, which is what attaching to an Account meant before
+     * the organization had a shape.
+     */
+    private pathFor;
+    /**
+     * What one node contributes to an Account's decision.
+     */
+    private levelAt;
+}
+export {};

package/dist/service/organizations/policy/sim-organizations-effective-policies.js

@@ -0,0 +1,58 @@
+/**
+ * Works out which service control policies an Account is actually subject to.
+ *
+ * The tree says which nodes lie above an Account and the store says what hangs
+ * on each of them. Putting the two together is the whole of what sim IAM asks
+ * an organization, so it lives here rather than in the facade.
+ */
+export class SimOrganizationsEffectivePolicies {
+    tree;
+    scpStore;
+    managementAccountId;
+    constructor(properties) {
+        this.tree = properties.tree;
+        this.scpStore = properties.scpStore;
+    }
+    /**
+     * Name the Account AWS exempts from every service control policy.
+     */
+    setManagementAccount(accountId) {
+        this.managementAccountId = accountId;
+    }
+    /**
+     * The policies in force for an Account, level by level, root first.
+     */
+    setFor(accountId) {
+        if (accountId === this.managementAccountId) {
+            return { applies: false, levels: [] };
+        }
+        const path = this.pathFor(accountId);
+        if (path.length === 0) {
+            return { applies: false, levels: [] };
+        }
+        return { applies: true, levels: path.map((node) => this.levelAt(node)) };
+    }
+    /**
+     * The nodes filtering an Account's requests.
+     *
+     * An Account placed in the organization is filtered by the path down to it.
+     * An Account only ever named by having a policy attached to it is filtered
+     * by that policy alone, which is what attaching to an Account meant before
+     * the organization had a shape.
+     */
+    pathFor(accountId) {
+        if (this.tree.holds(accountId)) {
+            return this.tree.pathTo(accountId);
+        }
+        return this.scpStore.holds(accountId) ? [accountId] : [];
+    }
+    /**
+     * What one node contributes to an Account's decision.
+     */
+    levelAt(nodeId) {
+        return {
+            nodeName: this.tree.nameOf(nodeId),
+            policies: this.scpStore.policiesAt(nodeId),
+        };
+    }
+}

package/dist/service/organizations/policy/sim-organizations-scp-store.d.ts

@@ -0,0 +1,61 @@
+import type { SimIamServiceControlPolicy } from "../../iam/authorize/scp/sim-iam-scp-resolver.js";
+import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+import type { SimOrganizationsNodeId } from "../tree/sim-organizations-node.js";
+/**
+ * The AWS-managed policy attached to every organization node by default.
+ *
+ * Turning service control policies on in an organization leaves every
+ * account's permissions as they were, because this policy comes with them. A
+ * simulated node gets the same treatment, so attaching one Deny statement
+ * denies that one action and leaves the rest working.
+ */
+export declare const SIM_ORGANIZATIONS_FULL_AWS_ACCESS: SimIamServiceControlPolicy;
+/**
+ * The service control policies attached to each node of an organization.
+ *
+ * A node holds FullAWSAccess along with whatever was attached to it, until a
+ * test detaches FullAWSAccess to write an allow list at that node. A node
+ * nothing was attached to still holds FullAWSAccess, so an organizational unit
+ * a test never mentions allows everything through it.
+ */
+export declare class SimOrganizationsScpStore {
+    private readonly byNodeId;
+    /**
+     * Attach a service control policy to a node under an id of its own.
+     *
+     * The id is what takes the policy off again. One policy attached to several
+     * nodes carries the same id at each of them, the way an AWS policy attached
+     * to several targets is one policy.
+     */
+    attach(nodeId: SimOrganizationsNodeId, policyId: string, document: SimIamPolicyDocument, policyName?: string): void;
+    /**
+     * Take one service control policy off a node, leaving the rest.
+     *
+     * A node can hold policies from more than one source, so taking the wrong
+     * ones off would change what an Account may do behind the caller's back.
+     */
+    detach(nodeId: SimOrganizationsNodeId, policyId: string): void;
+    /**
+     * Take the AWS-managed FullAWSAccess policy off a node.
+     *
+     * What remains at that node has to allow an action for a request through it
+     * to go ahead, which is how a level is turned into an allow list.
+     */
+    detachFullAwsAccess(nodeId: SimOrganizationsNodeId): void;
+    /**
+     * Put a node back to holding FullAWSAccess and nothing else.
+     */
+    detachAll(nodeId: SimOrganizationsNodeId): void;
+    /**
+     * The policies in force at one node, FullAWSAccess first.
+     */
+    policiesAt(nodeId: SimOrganizationsNodeId): readonly SimIamServiceControlPolicy[];
+    /**
+     * Whether anything has been attached to or detached from a node.
+     */
+    holds(nodeId: SimOrganizationsNodeId): boolean;
+    /**
+     * The record for a node, created on first use.
+     */
+    private nodePolicies;
+}

package/dist/service/organizations/policy/sim-organizations-scp-store.js

@@ -0,0 +1,103 @@
+/**
+ * The AWS-managed policy attached to every organization node by default.
+ *
+ * Turning service control policies on in an organization leaves every
+ * account's permissions as they were, because this policy comes with them. A
+ * simulated node gets the same treatment, so attaching one Deny statement
+ * denies that one action and leaves the rest working.
+ */
+export const SIM_ORGANIZATIONS_FULL_AWS_ACCESS = {
+    policyName: "FullAWSAccess",
+    document: {
+        Version: "2012-10-17",
+        Statement: { Effect: "Allow", Action: "*", Resource: "*" },
+    },
+};
+/**
+ * The service control policies attached to each node of an organization.
+ *
+ * A node holds FullAWSAccess along with whatever was attached to it, until a
+ * test detaches FullAWSAccess to write an allow list at that node. A node
+ * nothing was attached to still holds FullAWSAccess, so an organizational unit
+ * a test never mentions allows everything through it.
+ */
+export class SimOrganizationsScpStore {
+    byNodeId = new Map();
+    /**
+     * Attach a service control policy to a node under an id of its own.
+     *
+     * The id is what takes the policy off again. One policy attached to several
+     * nodes carries the same id at each of them, the way an AWS policy attached
+     * to several targets is one policy.
+     */
+    attach(nodeId, policyId, document, policyName) {
+        this.nodePolicies(nodeId).attached.push({
+            policyId,
+            policy: { document, policyName },
+        });
+    }
+    /**
+     * Take one service control policy off a node, leaving the rest.
+     *
+     * A node can hold policies from more than one source, so taking the wrong
+     * ones off would change what an Account may do behind the caller's back.
+     */
+    detach(nodeId, policyId) {
+        const node = this.byNodeId.get(nodeId);
+        if (node === undefined) {
+            return;
+        }
+        const remaining = node.attached.filter((attached) => attached.policyId !== policyId);
+        node.attached.length = 0;
+        node.attached.push(...remaining);
+    }
+    /**
+     * Take the AWS-managed FullAWSAccess policy off a node.
+     *
+     * What remains at that node has to allow an action for a request through it
+     * to go ahead, which is how a level is turned into an allow list.
+     */
+    detachFullAwsAccess(nodeId) {
+        this.nodePolicies(nodeId).fullAwsAccess = false;
+    }
+    /**
+     * Put a node back to holding FullAWSAccess and nothing else.
+     */
+    detachAll(nodeId) {
+        this.byNodeId.delete(nodeId);
+    }
+    /**
+     * The policies in force at one node, FullAWSAccess first.
+     */
+    policiesAt(nodeId) {
+        const node = this.byNodeId.get(nodeId);
+        if (node === undefined) {
+            return [SIM_ORGANIZATIONS_FULL_AWS_ACCESS];
+        }
+        const attached = node.attached.map((entry) => entry.policy);
+        return node.fullAwsAccess
+            ? [SIM_ORGANIZATIONS_FULL_AWS_ACCESS, ...attached]
+            : attached;
+    }
+    /**
+     * Whether anything has been attached to or detached from a node.
+     */
+    holds(nodeId) {
+        return this.byNodeId.has(nodeId);
+    }
+    /**
+     * The record for a node, created on first use.
+     */
+    nodePolicies(nodeId) {
+        const existing = this.byNodeId.get(nodeId);
+        if (existing !== undefined) {
+            return existing;
+        }
+        const created = {
+            attached: [],
+            fullAwsAccess: true,
+        };
+        this.byNodeId.set(nodeId, created);
+        return created;
+    }
+}