@kensio/yulin 1.20.12 → 1.20.13

package/dist/service/organizations/cfn/sim-cfn-organization-creator.js

@@ -0,0 +1,25 @@
+import { SimCfnOrganization } from "./sim-cfn-organizations-record.js";
+import { SimCfnOrganizationsProperties } from "./sim-cfn-organizations-properties.js";
+/**
+ * Records the organization an `AWS::Organizations::Organization` declares.
+ *
+ * A SimAws already has one organization, so this brings nothing into being.
+ * The Resource earns its place by answering `RootId`, which is what the rest
+ * of a template hangs off.
+ */
+export class SimCfnOrganizationCreator {
+    #simAws;
+    constructor(simAws) {
+        this.#simAws = simAws;
+    }
+    /**
+     * Record the organization a template declares.
+     */
+    create(resource, properties) {
+        const values = new SimCfnOrganizationsProperties(resource, "AWS::Organizations::Organization");
+        const featureSet = properties["FeatureSet"];
+        values.ignore(featureSet, "FeatureSet", "Simulated Organizations evaluates service control policies whatever " +
+            "the feature set says");
+        return new SimCfnOrganization(this.#simAws.organizations().root().id, values.optionalString(featureSet) ?? "ALL", this.#simAws.defaultAccountId);
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizational-unit-creator.d.ts

@@ -0,0 +1,16 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimOrganizationsOrganizationalUnit } from "../tree/sim-organizations-node.js";
+/**
+ * Creates organizational units from
+ * `AWS::Organizations::OrganizationalUnit` Resources.
+ */
+export declare class SimCfnOrganizationalUnitCreator {
+    #private;
+    constructor(simAws: SimAws);
+    /**
+     * Create a unit under the node its `ParentId` names.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimOrganizationsOrganizationalUnit;
+}

package/dist/service/organizations/cfn/sim-cfn-organizational-unit-creator.js

@@ -0,0 +1,21 @@
+import { SimCfnOrganizationsProperties } from "./sim-cfn-organizations-properties.js";
+/**
+ * Creates organizational units from
+ * `AWS::Organizations::OrganizationalUnit` Resources.
+ */
+export class SimCfnOrganizationalUnitCreator {
+    #simAws;
+    constructor(simAws) {
+        this.#simAws = simAws;
+    }
+    /**
+     * Create a unit under the node its `ParentId` names.
+     */
+    create(resource, properties) {
+        const values = new SimCfnOrganizationsProperties(resource, "AWS::Organizations::OrganizationalUnit");
+        values.ignore(properties["Tags"], "Tags", "Simulated Organizations reads no unit tags");
+        return this.#simAws
+            .organizations()
+            .createOrganizationalUnit(values.requiredString(properties["Name"], "Name"), values.requiredString(properties["ParentId"], "ParentId"));
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-account-creator.d.ts

@@ -0,0 +1,20 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+import { SimCfnOrganizationsAccount } from "./sim-cfn-organizations-record.js";
+/**
+ * Puts Accounts in the organization from `AWS::Organizations::Account`
+ * Resources.
+ *
+ * AWS creates a new account here and gives it an id nobody chose, so this does
+ * the same. A template reads that id back with `Ref` or with
+ * `Fn::GetAtt AccountId`.
+ */
+export declare class SimCfnOrganizationsAccountCreator {
+    #private;
+    constructor(simAws: SimAws);
+    /**
+     * Create an Account under the first node its `ParentIds` names.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCfnOrganizationsAccount;
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-account-creator.js

@@ -0,0 +1,34 @@
+import { makeSimAwsAccountId } from "../../aws/sim-aws-account.js";
+import { SimCfnOrganizationsAccount } from "./sim-cfn-organizations-record.js";
+import { SimCfnOrganizationsProperties } from "./sim-cfn-organizations-properties.js";
+/**
+ * Puts Accounts in the organization from `AWS::Organizations::Account`
+ * Resources.
+ *
+ * AWS creates a new account here and gives it an id nobody chose, so this does
+ * the same. A template reads that id back with `Ref` or with
+ * `Fn::GetAtt AccountId`.
+ */
+export class SimCfnOrganizationsAccountCreator {
+    #simAws;
+    constructor(simAws) {
+        this.#simAws = simAws;
+    }
+    /**
+     * Create an Account under the first node its `ParentIds` names.
+     */
+    create(resource, properties) {
+        const values = new SimCfnOrganizationsProperties(resource, "AWS::Organizations::Account");
+        values.ignore(properties["Tags"], "Tags", "Simulated Organizations reads no Account tags");
+        values.ignore(properties["RoleName"], "RoleName", "Simulated Organizations creates no cross-account access Role");
+        // Everything the Resource needs is read before the organization changes.
+        // A property that fails after the Account was placed would leave it in the
+        // organization with no record for a teardown to take it out again.
+        const accountName = values.requiredString(properties["AccountName"], "AccountName");
+        const email = values.requiredString(properties["Email"], "Email");
+        const parentId = values.stringList(properties["ParentIds"])[0];
+        const accountId = makeSimAwsAccountId();
+        this.#simAws.organizations().moveAccount(accountId, parentId);
+        return new SimCfnOrganizationsAccount(accountId, accountName, email, this.#simAws.now());
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-policy-creator.d.ts

@@ -0,0 +1,21 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+import { SimCfnOrganizationsPolicy } from "./sim-cfn-organizations-record.js";
+/**
+ * Attaches service control policies from `AWS::Organizations::Policy`
+ * Resources to the nodes they target.
+ *
+ * A policy of any other type is refused as an unsupported Resource, so the
+ * Stack records it and deploys on. Simulated Organizations evaluates service
+ * control policies and nothing else, and a tag policy stored here would look
+ * like one that does something.
+ */
+export declare class SimCfnOrganizationsPolicyCreator {
+    #private;
+    constructor(simAws: SimAws);
+    /**
+     * Attach a policy to every node its `TargetIds` names.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCfnOrganizationsPolicy;
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-policy-creator.js

@@ -0,0 +1,40 @@
+import { makeSimOrganizationsPolicyId, } from "../tree/sim-organizations-node.js";
+import { SimCfnOrganizationsPolicy } from "./sim-cfn-organizations-record.js";
+import { SimCfnOrganizationsPolicyInput } from "./sim-cfn-organizations-policy-input.js";
+/**
+ * Attaches service control policies from `AWS::Organizations::Policy`
+ * Resources to the nodes they target.
+ *
+ * A policy of any other type is refused as an unsupported Resource, so the
+ * Stack records it and deploys on. Simulated Organizations evaluates service
+ * control policies and nothing else, and a tag policy stored here would look
+ * like one that does something.
+ */
+export class SimCfnOrganizationsPolicyCreator {
+    #simAws;
+    constructor(simAws) {
+        this.#simAws = simAws;
+    }
+    /**
+     * Attach a policy to every node its `TargetIds` names.
+     */
+    create(resource, properties) {
+        const input = new SimCfnOrganizationsPolicyInput(resource, properties);
+        const organizations = this.#simAws.organizations();
+        // Every target is resolved before any of them is attached to. Refusing one
+        // partway through would leave the earlier targets holding a policy no
+        // teardown knows about.
+        organizations.requireTargets(input.targetIds);
+        // An id of its own, rather than one derived from the logical id. Two
+        // Stacks can each declare a Policy called the same thing, and a shared id
+        // would let one Stack's teardown take the other's policy off.
+        const policyId = makeSimOrganizationsPolicyId();
+        for (const targetId of input.targetIds) {
+            organizations.attachServiceControlPolicy(targetId, input.document, {
+                policyName: input.name,
+                policyId,
+            });
+        }
+        return new SimCfnOrganizationsPolicy(policyId, input.name, input.policyType, input.targetIds);
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-policy-input.d.ts

@@ -0,0 +1,20 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+/**
+ * What an `AWS::Organizations::Policy` Resource asks for.
+ *
+ * Every property is read here before the creator changes anything, so a
+ * Resource that cannot be satisfied fails with the organization untouched.
+ */
+export declare class SimCfnOrganizationsPolicyInput {
+    readonly name: string;
+    readonly document: SimIamPolicyDocument;
+    readonly targetIds: readonly string[];
+    constructor(resource: SimCfnResource, properties: SimCfnTemplateValueRecord);
+    /**
+     * The policy type this Resource carries, which is the only one simulated
+     * Organizations evaluates.
+     */
+    get policyType(): string;
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-policy-input.js

@@ -0,0 +1,33 @@
+import { SimCfnOrganizationsProperties } from "./sim-cfn-organizations-properties.js";
+const SERVICE_CONTROL_POLICY = "SERVICE_CONTROL_POLICY";
+/**
+ * What an `AWS::Organizations::Policy` Resource asks for.
+ *
+ * Every property is read here before the creator changes anything, so a
+ * Resource that cannot be satisfied fails with the organization untouched.
+ */
+export class SimCfnOrganizationsPolicyInput {
+    name;
+    document;
+    targetIds;
+    constructor(resource, properties) {
+        const values = new SimCfnOrganizationsProperties(resource, "AWS::Organizations::Policy");
+        const policyType = values.requiredString(properties["Type"], "Type");
+        if (policyType !== SERVICE_CONTROL_POLICY) {
+            throw new Error(`Unsupported sim Organizations CloudFormation Resource Policy of ` +
+                `type ${policyType}`);
+        }
+        values.ignore(properties["Tags"], "Tags", "Simulated Organizations reads no policy tags");
+        values.ignore(properties["Description"], "Description", "A policy description decides nothing");
+        this.name = values.requiredString(properties["Name"], "Name");
+        this.document = values.documentValue(properties["Content"], "Content");
+        this.targetIds = values.stringList(properties["TargetIds"]);
+    }
+    /**
+     * The policy type this Resource carries, which is the only one simulated
+     * Organizations evaluates.
+     */
+    get policyType() {
+        return SERVICE_CONTROL_POLICY;
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-properties.d.ts

@@ -0,0 +1,36 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValue } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+/**
+ * Reading the properties of an `AWS::Organizations::*` Resource.
+ *
+ * Each property is passed in by the caller under its own literal name, the way
+ * the other services read a template. A required one that is absent or of the
+ * wrong shape fails the Resource rather than quietly creating something else.
+ */
+export declare class SimCfnOrganizationsProperties {
+    #private;
+    constructor(resource: SimCfnResource, resourceType: string);
+    /**
+     * A property that has to be a string for the Resource to mean anything.
+     */
+    requiredString(value: SimCfnTemplateValue | undefined, name: string): string;
+    /**
+     * A property that is a string where a template gives one.
+     */
+    optionalString(value: SimCfnTemplateValue | undefined): string | undefined;
+    /**
+     * A list-valued property, read as the strings in it.
+     *
+     * A template may give one value where a list is allowed, which
+     * CloudFormation accepts, so a bare string reads as a list of one.
+     */
+    stringList(value: SimCfnTemplateValue | undefined): readonly string[];
+    /**
+     * A property holding an IAM policy document, given inline or as JSON text.
+     */
+    documentValue(value: SimCfnTemplateValue | undefined, name: string): Readonly<Record<string, unknown>>;
+    /**
+     * Record a property the simulation creates the Resource without acting on.
+     */
+    ignore(value: SimCfnTemplateValue | undefined, name: string, reason: string): void;
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-properties.js

@@ -0,0 +1,78 @@
+/**
+ * Reading the properties of an `AWS::Organizations::*` Resource.
+ *
+ * Each property is passed in by the caller under its own literal name, the way
+ * the other services read a template. A required one that is absent or of the
+ * wrong shape fails the Resource rather than quietly creating something else.
+ */
+export class SimCfnOrganizationsProperties {
+    #resource;
+    #resourceType;
+    constructor(resource, resourceType) {
+        this.#resource = resource;
+        this.#resourceType = resourceType;
+    }
+    /**
+     * A property that has to be a string for the Resource to mean anything.
+     */
+    requiredString(value, name) {
+        if (typeof value !== "string" || value.length === 0) {
+            throw new Error(`${this.#resourceType} ${this.#resource.logicalId} requires ${name}`);
+        }
+        return value;
+    }
+    /**
+     * A property that is a string where a template gives one.
+     */
+    optionalString(value) {
+        return typeof value === "string" ? value : undefined;
+    }
+    /**
+     * A list-valued property, read as the strings in it.
+     *
+     * A template may give one value where a list is allowed, which
+     * CloudFormation accepts, so a bare string reads as a list of one.
+     */
+    stringList(value) {
+        if (typeof value === "string") {
+            return [value];
+        }
+        if (!Array.isArray(value)) {
+            return [];
+        }
+        return value.filter((item) => typeof item === "string");
+    }
+    /**
+     * A property holding an IAM policy document, given inline or as JSON text.
+     */
+    documentValue(value, name) {
+        const document = typeof value === "string" ? this.#parse(value, name) : value;
+        if (typeof document !== "object" ||
+            document === null ||
+            Array.isArray(document)) {
+            throw new Error(`${this.#resourceType} ${this.#resource.logicalId} requires ${name} ` +
+                `to be a policy document`);
+        }
+        return document;
+    }
+    /**
+     * Record a property the simulation creates the Resource without acting on.
+     */
+    ignore(value, name, reason) {
+        if (value !== undefined) {
+            this.#resource.ignoreProperty(name, reason);
+        }
+    }
+    /**
+     * Read a document a template gave as JSON text.
+     */
+    #parse(value, name) {
+        try {
+            return JSON.parse(value);
+        }
+        catch {
+            throw new Error(`${this.#resourceType} ${this.#resource.logicalId} ${name} is not ` +
+                `valid JSON`);
+        }
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-record.d.ts

@@ -0,0 +1,40 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimOrganizationsNodeId, SimOrganizationsRootId } from "../tree/sim-organizations-node.js";
+/**
+ * What a template's `AWS::Organizations::Organization` produced.
+ *
+ * A simulated organization exists as soon as a SimAws does, so this records
+ * the one already there rather than making another. What the Resource is for
+ * is the values a template reads back off it, `RootId` above all, since that
+ * is how an organizational unit says where it hangs.
+ */
+export declare class SimCfnOrganization {
+    readonly rootId: SimOrganizationsRootId;
+    readonly featureSet: string;
+    readonly managementAccountId: SimAwsAccountId;
+    constructor(rootId: SimOrganizationsRootId, featureSet: string, managementAccountId: SimAwsAccountId);
+    /**
+     * AWS gives an organization an `o-` id of its own, apart from its root's.
+     */
+    get id(): string;
+}
+/**
+ * What a template's `AWS::Organizations::Account` produced.
+ */
+export declare class SimCfnOrganizationsAccount {
+    readonly accountId: SimAwsAccountId;
+    readonly accountName: string;
+    readonly email: string;
+    readonly joinedTimestamp: Date;
+    constructor(accountId: SimAwsAccountId, accountName: string, email: string, joinedTimestamp: Date);
+}
+/**
+ * What a template's `AWS::Organizations::Policy` produced.
+ */
+export declare class SimCfnOrganizationsPolicy {
+    readonly id: string;
+    readonly name: string;
+    readonly policyType: string;
+    readonly targetIds: readonly SimOrganizationsNodeId[];
+    constructor(id: string, name: string, policyType: string, targetIds: readonly SimOrganizationsNodeId[]);
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-record.js

@@ -0,0 +1,54 @@
+/**
+ * What a template's `AWS::Organizations::Organization` produced.
+ *
+ * A simulated organization exists as soon as a SimAws does, so this records
+ * the one already there rather than making another. What the Resource is for
+ * is the values a template reads back off it, `RootId` above all, since that
+ * is how an organizational unit says where it hangs.
+ */
+export class SimCfnOrganization {
+    rootId;
+    featureSet;
+    managementAccountId;
+    constructor(rootId, featureSet, managementAccountId) {
+        this.rootId = rootId;
+        this.featureSet = featureSet;
+        this.managementAccountId = managementAccountId;
+    }
+    /**
+     * AWS gives an organization an `o-` id of its own, apart from its root's.
+     */
+    get id() {
+        return `o-${this.rootId.slice(2)}`;
+    }
+}
+/**
+ * What a template's `AWS::Organizations::Account` produced.
+ */
+export class SimCfnOrganizationsAccount {
+    accountId;
+    accountName;
+    email;
+    joinedTimestamp;
+    constructor(accountId, accountName, email, joinedTimestamp) {
+        this.accountId = accountId;
+        this.accountName = accountName;
+        this.email = email;
+        this.joinedTimestamp = joinedTimestamp;
+    }
+}
+/**
+ * What a template's `AWS::Organizations::Policy` produced.
+ */
+export class SimCfnOrganizationsPolicy {
+    id;
+    name;
+    policyType;
+    targetIds;
+    constructor(id, name, policyType, targetIds) {
+        this.id = id;
+        this.name = name;
+        this.policyType = policyType;
+        this.targetIds = targetIds;
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-remover.d.ts

@@ -0,0 +1,17 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * Takes back what an `AWS::Organizations::*` Resource did.
+ *
+ * A Stack tears down in reverse dependency order, so a policy comes off before
+ * the unit it was attached to goes, and a unit goes before the root it hung
+ * on. Each Resource here undoes its own step and nothing else.
+ */
+export declare class SimCfnOrganizationsRemover {
+    #private;
+    constructor(simAws: SimAws);
+    /**
+     * Undo one Resource.
+     */
+    remove(resourceTypeName: string, resource: SimCfnResource): void;
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-remover.js

@@ -0,0 +1,40 @@
+import { SimCfnOrganizationsAccount, SimCfnOrganizationsPolicy, } from "./sim-cfn-organizations-record.js";
+import { SimOrganizationsOrganizationalUnit } from "../tree/sim-organizations-node.js";
+/**
+ * Takes back what an `AWS::Organizations::*` Resource did.
+ *
+ * A Stack tears down in reverse dependency order, so a policy comes off before
+ * the unit it was attached to goes, and a unit goes before the root it hung
+ * on. Each Resource here undoes its own step and nothing else.
+ */
+export class SimCfnOrganizationsRemover {
+    #simAws;
+    constructor(simAws) {
+        this.#simAws = simAws;
+    }
+    /**
+     * Undo one Resource.
+     */
+    remove(resourceTypeName, resource) {
+        const simResource = resource.simResource;
+        const organizations = this.#simAws.organizations();
+        if (simResource instanceof SimCfnOrganizationsPolicy) {
+            for (const targetId of simResource.targetIds) {
+                organizations.detachServiceControlPolicy(targetId, simResource.id);
+            }
+            return;
+        }
+        if (simResource instanceof SimCfnOrganizationsAccount) {
+            organizations.removeAccount(simResource.accountId);
+            return;
+        }
+        if (simResource instanceof SimOrganizationsOrganizationalUnit) {
+            organizations.removeOrganizationalUnit(simResource);
+            return;
+        }
+        if (resourceTypeName !== "Organization") {
+            throw new Error(`Unsupported sim Organizations CloudFormation Resource ` +
+                `${resourceTypeName} deletion`);
+        }
+    }
+}

package/dist/service/organizations/cfn/sim-organizations-cfn-resource-factory.d.ts

@@ -0,0 +1,24 @@
+import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * CloudFormation Resource factory for simulated Organizations resources.
+ *
+ * An organization belongs to a whole SimAws rather than to the Account and
+ * Region scope a Stack deploys into, so this reads the organization off the
+ * creation context instead of being handed one. That leaves the factory with
+ * no state and lets one serve every scope.
+ *
+ * `AWS::Organizations::ResourcePolicy` is left out, along with every policy
+ * type but `SERVICE_CONTROL_POLICY`, and a template declaring either is
+ * recorded as a skipped Resource.
+ */
+export declare class SimOrganizationsCfnResourceFactory implements SimCfnServiceResourceFactory {
+    /**
+     * Create a simulated Organizations resource from a CloudFormation Resource.
+     */
+    create(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceCreateContext): Promise<object | undefined>;
+    /**
+     * Remove a simulated Organizations resource a Stack created.
+     */
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
+}

package/dist/service/organizations/cfn/sim-organizations-cfn-resource-factory.js

@@ -0,0 +1,50 @@
+import { SimCfnOrganizationCreator } from "./sim-cfn-organization-creator.js";
+import { SimCfnOrganizationalUnitCreator } from "./sim-cfn-organizational-unit-creator.js";
+import { SimCfnOrganizationsAccountCreator } from "./sim-cfn-organizations-account-creator.js";
+import { SimCfnOrganizationsPolicyCreator } from "./sim-cfn-organizations-policy-creator.js";
+import { SimCfnOrganizationsRemover } from "./sim-cfn-organizations-remover.js";
+/**
+ * CloudFormation Resource factory for simulated Organizations resources.
+ *
+ * An organization belongs to a whole SimAws rather than to the Account and
+ * Region scope a Stack deploys into, so this reads the organization off the
+ * creation context instead of being handed one. That leaves the factory with
+ * no state and lets one serve every scope.
+ *
+ * `AWS::Organizations::ResourcePolicy` is left out, along with every policy
+ * type but `SERVICE_CONTROL_POLICY`, and a template declaring either is
+ * recorded as a skipped Resource.
+ */
+export class SimOrganizationsCfnResourceFactory {
+    /**
+     * Create a simulated Organizations resource from a CloudFormation Resource.
+     */
+    create(resourceTypeName, resource, context) {
+        const properties = context.resolvedProperties ?? resource.properties;
+        const { simAws } = context;
+        switch (resourceTypeName) {
+            case "Organization": {
+                return Promise.resolve(new SimCfnOrganizationCreator(simAws).create(resource, properties));
+            }
+            case "OrganizationalUnit": {
+                return Promise.resolve(new SimCfnOrganizationalUnitCreator(simAws).create(resource, properties));
+            }
+            case "Account": {
+                return Promise.resolve(new SimCfnOrganizationsAccountCreator(simAws).create(resource, properties));
+            }
+            case "Policy": {
+                return Promise.resolve(new SimCfnOrganizationsPolicyCreator(simAws).create(resource, properties));
+            }
+            default: {
+                throw new Error(`Unsupported sim Organizations CloudFormation Resource ${resourceTypeName}`);
+            }
+        }
+    }
+    /**
+     * Remove a simulated Organizations resource a Stack created.
+     */
+    delete(resourceTypeName, resource, context) {
+        new SimCfnOrganizationsRemover(context.simAws).remove(resourceTypeName, resource);
+        return Promise.resolve();
+    }
+}

package/dist/service/organizations/index.d.ts

@@ -0,0 +1,6 @@
+export { SimOrganizations, type SimOrganizationsAttachOptions, } from "./sim-organizations.js";
+export { SimOrganizationsStructure } from "./sim-organizations-structure.js";
+export { SIM_ORGANIZATIONS_FULL_AWS_ACCESS, SimOrganizationsScpStore, } from "./policy/sim-organizations-scp-store.js";
+export { SimOrganizationsEffectivePolicies } from "./policy/sim-organizations-effective-policies.js";
+export { makeSimOrganizationsOrganizationalUnitId, makeSimOrganizationsRootId, SimOrganizationsOrganizationalUnit, type SimOrganizationsNodeId, type SimOrganizationsOrganizationalUnitId, SimOrganizationsRoot, type SimOrganizationsRootId, type SimOrganizationsTarget, } from "./tree/sim-organizations-node.js";
+export { SimOrganizationsTree, SimOrganizationsUnknownNode, } from "./tree/sim-organizations-tree.js";

package/dist/service/organizations/index.js

@@ -0,0 +1,6 @@
+export { SimOrganizations, } from "./sim-organizations.js";
+export { SimOrganizationsStructure } from "./sim-organizations-structure.js";
+export { SIM_ORGANIZATIONS_FULL_AWS_ACCESS, SimOrganizationsScpStore, } from "./policy/sim-organizations-scp-store.js";
+export { SimOrganizationsEffectivePolicies } from "./policy/sim-organizations-effective-policies.js";
+export { makeSimOrganizationsOrganizationalUnitId, makeSimOrganizationsRootId, SimOrganizationsOrganizationalUnit, SimOrganizationsRoot, } from "./tree/sim-organizations-node.js";
+export { SimOrganizationsTree, SimOrganizationsUnknownNode, } from "./tree/sim-organizations-tree.js";

package/dist/service/organizations/policy/sim-organizations-effective-policies.d.ts

@@ -0,0 +1,43 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimIamServiceControlPolicySet } from "../../iam/authorize/scp/sim-iam-scp-resolver.js";
+import type { SimOrganizationsTree } from "../tree/sim-organizations-tree.js";
+import type { SimOrganizationsScpStore } from "./sim-organizations-scp-store.js";
+interface SimOrganizationsEffectivePoliciesProperties {
+    readonly tree: SimOrganizationsTree;
+    readonly scpStore: SimOrganizationsScpStore;
+}
+/**
+ * Works out which service control policies an Account is actually subject to.
+ *
+ * The tree says which nodes lie above an Account and the store says what hangs
+ * on each of them. Putting the two together is the whole of what sim IAM asks
+ * an organization, so it lives here rather than in the facade.
+ */
+export declare class SimOrganizationsEffectivePolicies {
+    private readonly tree;
+    private readonly scpStore;
+    private managementAccountId?;
+    constructor(properties: SimOrganizationsEffectivePoliciesProperties);
+    /**
+     * Name the Account AWS exempts from every service control policy.
+     */
+    setManagementAccount(accountId: SimAwsAccountId): void;
+    /**
+     * The policies in force for an Account, level by level, root first.
+     */
+    setFor(accountId: SimAwsAccountId): SimIamServiceControlPolicySet;
+    /**
+     * The nodes filtering an Account's requests.
+     *
+     * An Account placed in the organization is filtered by the path down to it.
+     * An Account only ever named by having a policy attached to it is filtered
+     * by that policy alone, which is what attaching to an Account meant before
+     * the organization had a shape.
+     */
+    private pathFor;
+    /**
+     * What one node contributes to an Account's decision.
+     */
+    private levelAt;
+}
+export {};