@kensio/yulin 1.20.12 → 1.20.14

package/dist/service/organizations/cfn/sim-cfn-organizations-record.d.ts

@@ -0,0 +1,40 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimOrganizationsNodeId, SimOrganizationsRootId } from "../tree/sim-organizations-node.js";
+/**
+ * What a template's `AWS::Organizations::Organization` produced.
+ *
+ * A simulated organization exists as soon as a SimAws does, so this records
+ * the one already there rather than making another. What the Resource is for
+ * is the values a template reads back off it, `RootId` above all, since that
+ * is how an organizational unit says where it hangs.
+ */
+export declare class SimCfnOrganization {
+    readonly rootId: SimOrganizationsRootId;
+    readonly featureSet: string;
+    readonly managementAccountId: SimAwsAccountId;
+    constructor(rootId: SimOrganizationsRootId, featureSet: string, managementAccountId: SimAwsAccountId);
+    /**
+     * AWS gives an organization an `o-` id of its own, apart from its root's.
+     */
+    get id(): string;
+}
+/**
+ * What a template's `AWS::Organizations::Account` produced.
+ */
+export declare class SimCfnOrganizationsAccount {
+    readonly accountId: SimAwsAccountId;
+    readonly accountName: string;
+    readonly email: string;
+    readonly joinedTimestamp: Date;
+    constructor(accountId: SimAwsAccountId, accountName: string, email: string, joinedTimestamp: Date);
+}
+/**
+ * What a template's `AWS::Organizations::Policy` produced.
+ */
+export declare class SimCfnOrganizationsPolicy {
+    readonly id: string;
+    readonly name: string;
+    readonly policyType: string;
+    readonly targetIds: readonly SimOrganizationsNodeId[];
+    constructor(id: string, name: string, policyType: string, targetIds: readonly SimOrganizationsNodeId[]);
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-record.js

@@ -0,0 +1,54 @@
+/**
+ * What a template's `AWS::Organizations::Organization` produced.
+ *
+ * A simulated organization exists as soon as a SimAws does, so this records
+ * the one already there rather than making another. What the Resource is for
+ * is the values a template reads back off it, `RootId` above all, since that
+ * is how an organizational unit says where it hangs.
+ */
+export class SimCfnOrganization {
+    rootId;
+    featureSet;
+    managementAccountId;
+    constructor(rootId, featureSet, managementAccountId) {
+        this.rootId = rootId;
+        this.featureSet = featureSet;
+        this.managementAccountId = managementAccountId;
+    }
+    /**
+     * AWS gives an organization an `o-` id of its own, apart from its root's.
+     */
+    get id() {
+        return `o-${this.rootId.slice(2)}`;
+    }
+}
+/**
+ * What a template's `AWS::Organizations::Account` produced.
+ */
+export class SimCfnOrganizationsAccount {
+    accountId;
+    accountName;
+    email;
+    joinedTimestamp;
+    constructor(accountId, accountName, email, joinedTimestamp) {
+        this.accountId = accountId;
+        this.accountName = accountName;
+        this.email = email;
+        this.joinedTimestamp = joinedTimestamp;
+    }
+}
+/**
+ * What a template's `AWS::Organizations::Policy` produced.
+ */
+export class SimCfnOrganizationsPolicy {
+    id;
+    name;
+    policyType;
+    targetIds;
+    constructor(id, name, policyType, targetIds) {
+        this.id = id;
+        this.name = name;
+        this.policyType = policyType;
+        this.targetIds = targetIds;
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-remover.d.ts

@@ -0,0 +1,17 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * Takes back what an `AWS::Organizations::*` Resource did.
+ *
+ * A Stack tears down in reverse dependency order, so a policy comes off before
+ * the unit it was attached to goes, and a unit goes before the root it hung
+ * on. Each Resource here undoes its own step and nothing else.
+ */
+export declare class SimCfnOrganizationsRemover {
+    #private;
+    constructor(simAws: SimAws);
+    /**
+     * Undo one Resource.
+     */
+    remove(resourceTypeName: string, resource: SimCfnResource): void;
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-remover.js

@@ -0,0 +1,40 @@
+import { SimCfnOrganizationsAccount, SimCfnOrganizationsPolicy, } from "./sim-cfn-organizations-record.js";
+import { SimOrganizationsOrganizationalUnit } from "../tree/sim-organizations-node.js";
+/**
+ * Takes back what an `AWS::Organizations::*` Resource did.
+ *
+ * A Stack tears down in reverse dependency order, so a policy comes off before
+ * the unit it was attached to goes, and a unit goes before the root it hung
+ * on. Each Resource here undoes its own step and nothing else.
+ */
+export class SimCfnOrganizationsRemover {
+    #simAws;
+    constructor(simAws) {
+        this.#simAws = simAws;
+    }
+    /**
+     * Undo one Resource.
+     */
+    remove(resourceTypeName, resource) {
+        const simResource = resource.simResource;
+        const organizations = this.#simAws.organizations();
+        if (simResource instanceof SimCfnOrganizationsPolicy) {
+            for (const targetId of simResource.targetIds) {
+                organizations.detachServiceControlPolicy(targetId, simResource.id);
+            }
+            return;
+        }
+        if (simResource instanceof SimCfnOrganizationsAccount) {
+            organizations.removeAccount(simResource.accountId);
+            return;
+        }
+        if (simResource instanceof SimOrganizationsOrganizationalUnit) {
+            organizations.removeOrganizationalUnit(simResource);
+            return;
+        }
+        if (resourceTypeName !== "Organization") {
+            throw new Error(`Unsupported sim Organizations CloudFormation Resource ` +
+                `${resourceTypeName} deletion`);
+        }
+    }
+}

package/dist/service/organizations/cfn/sim-organizations-cfn-resource-factory.d.ts

@@ -0,0 +1,24 @@
+import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * CloudFormation Resource factory for simulated Organizations resources.
+ *
+ * An organization belongs to a whole SimAws rather than to the Account and
+ * Region scope a Stack deploys into, so this reads the organization off the
+ * creation context instead of being handed one. That leaves the factory with
+ * no state and lets one serve every scope.
+ *
+ * `AWS::Organizations::ResourcePolicy` is left out, along with every policy
+ * type but `SERVICE_CONTROL_POLICY`, and a template declaring either is
+ * recorded as a skipped Resource.
+ */
+export declare class SimOrganizationsCfnResourceFactory implements SimCfnServiceResourceFactory {
+    /**
+     * Create a simulated Organizations resource from a CloudFormation Resource.
+     */
+    create(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceCreateContext): Promise<object | undefined>;
+    /**
+     * Remove a simulated Organizations resource a Stack created.
+     */
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
+}

package/dist/service/organizations/cfn/sim-organizations-cfn-resource-factory.js

@@ -0,0 +1,50 @@
+import { SimCfnOrganizationCreator } from "./sim-cfn-organization-creator.js";
+import { SimCfnOrganizationalUnitCreator } from "./sim-cfn-organizational-unit-creator.js";
+import { SimCfnOrganizationsAccountCreator } from "./sim-cfn-organizations-account-creator.js";
+import { SimCfnOrganizationsPolicyCreator } from "./sim-cfn-organizations-policy-creator.js";
+import { SimCfnOrganizationsRemover } from "./sim-cfn-organizations-remover.js";
+/**
+ * CloudFormation Resource factory for simulated Organizations resources.
+ *
+ * An organization belongs to a whole SimAws rather than to the Account and
+ * Region scope a Stack deploys into, so this reads the organization off the
+ * creation context instead of being handed one. That leaves the factory with
+ * no state and lets one serve every scope.
+ *
+ * `AWS::Organizations::ResourcePolicy` is left out, along with every policy
+ * type but `SERVICE_CONTROL_POLICY`, and a template declaring either is
+ * recorded as a skipped Resource.
+ */
+export class SimOrganizationsCfnResourceFactory {
+    /**
+     * Create a simulated Organizations resource from a CloudFormation Resource.
+     */
+    create(resourceTypeName, resource, context) {
+        const properties = context.resolvedProperties ?? resource.properties;
+        const { simAws } = context;
+        switch (resourceTypeName) {
+            case "Organization": {
+                return Promise.resolve(new SimCfnOrganizationCreator(simAws).create(resource, properties));
+            }
+            case "OrganizationalUnit": {
+                return Promise.resolve(new SimCfnOrganizationalUnitCreator(simAws).create(resource, properties));
+            }
+            case "Account": {
+                return Promise.resolve(new SimCfnOrganizationsAccountCreator(simAws).create(resource, properties));
+            }
+            case "Policy": {
+                return Promise.resolve(new SimCfnOrganizationsPolicyCreator(simAws).create(resource, properties));
+            }
+            default: {
+                throw new Error(`Unsupported sim Organizations CloudFormation Resource ${resourceTypeName}`);
+            }
+        }
+    }
+    /**
+     * Remove a simulated Organizations resource a Stack created.
+     */
+    delete(resourceTypeName, resource, context) {
+        new SimCfnOrganizationsRemover(context.simAws).remove(resourceTypeName, resource);
+        return Promise.resolve();
+    }
+}

package/dist/service/organizations/index.d.ts

@@ -0,0 +1,6 @@
+export { SimOrganizations, type SimOrganizationsAttachOptions, } from "./sim-organizations.js";
+export { SimOrganizationsStructure } from "./sim-organizations-structure.js";
+export { SIM_ORGANIZATIONS_FULL_AWS_ACCESS, SimOrganizationsScpStore, } from "./policy/sim-organizations-scp-store.js";
+export { SimOrganizationsEffectivePolicies } from "./policy/sim-organizations-effective-policies.js";
+export { makeSimOrganizationsOrganizationalUnitId, makeSimOrganizationsRootId, SimOrganizationsOrganizationalUnit, type SimOrganizationsNodeId, type SimOrganizationsOrganizationalUnitId, SimOrganizationsRoot, type SimOrganizationsRootId, type SimOrganizationsTarget, } from "./tree/sim-organizations-node.js";
+export { SimOrganizationsTree, SimOrganizationsUnknownNode, } from "./tree/sim-organizations-tree.js";

package/dist/service/organizations/index.js

@@ -0,0 +1,6 @@
+export { SimOrganizations, } from "./sim-organizations.js";
+export { SimOrganizationsStructure } from "./sim-organizations-structure.js";
+export { SIM_ORGANIZATIONS_FULL_AWS_ACCESS, SimOrganizationsScpStore, } from "./policy/sim-organizations-scp-store.js";
+export { SimOrganizationsEffectivePolicies } from "./policy/sim-organizations-effective-policies.js";
+export { makeSimOrganizationsOrganizationalUnitId, makeSimOrganizationsRootId, SimOrganizationsOrganizationalUnit, SimOrganizationsRoot, } from "./tree/sim-organizations-node.js";
+export { SimOrganizationsTree, SimOrganizationsUnknownNode, } from "./tree/sim-organizations-tree.js";

package/dist/service/organizations/policy/sim-organizations-effective-policies.d.ts

@@ -0,0 +1,43 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimIamServiceControlPolicySet } from "../../iam/authorize/scp/sim-iam-scp-resolver.js";
+import type { SimOrganizationsTree } from "../tree/sim-organizations-tree.js";
+import type { SimOrganizationsScpStore } from "./sim-organizations-scp-store.js";
+interface SimOrganizationsEffectivePoliciesProperties {
+    readonly tree: SimOrganizationsTree;
+    readonly scpStore: SimOrganizationsScpStore;
+}
+/**
+ * Works out which service control policies an Account is actually subject to.
+ *
+ * The tree says which nodes lie above an Account and the store says what hangs
+ * on each of them. Putting the two together is the whole of what sim IAM asks
+ * an organization, so it lives here rather than in the facade.
+ */
+export declare class SimOrganizationsEffectivePolicies {
+    private readonly tree;
+    private readonly scpStore;
+    private managementAccountId?;
+    constructor(properties: SimOrganizationsEffectivePoliciesProperties);
+    /**
+     * Name the Account AWS exempts from every service control policy.
+     */
+    setManagementAccount(accountId: SimAwsAccountId): void;
+    /**
+     * The policies in force for an Account, level by level, root first.
+     */
+    setFor(accountId: SimAwsAccountId): SimIamServiceControlPolicySet;
+    /**
+     * The nodes filtering an Account's requests.
+     *
+     * An Account placed in the organization is filtered by the path down to it.
+     * An Account only ever named by having a policy attached to it is filtered
+     * by that policy alone, which is what attaching to an Account meant before
+     * the organization had a shape.
+     */
+    private pathFor;
+    /**
+     * What one node contributes to an Account's decision.
+     */
+    private levelAt;
+}
+export {};

package/dist/service/organizations/policy/sim-organizations-effective-policies.js

@@ -0,0 +1,58 @@
+/**
+ * Works out which service control policies an Account is actually subject to.
+ *
+ * The tree says which nodes lie above an Account and the store says what hangs
+ * on each of them. Putting the two together is the whole of what sim IAM asks
+ * an organization, so it lives here rather than in the facade.
+ */
+export class SimOrganizationsEffectivePolicies {
+    tree;
+    scpStore;
+    managementAccountId;
+    constructor(properties) {
+        this.tree = properties.tree;
+        this.scpStore = properties.scpStore;
+    }
+    /**
+     * Name the Account AWS exempts from every service control policy.
+     */
+    setManagementAccount(accountId) {
+        this.managementAccountId = accountId;
+    }
+    /**
+     * The policies in force for an Account, level by level, root first.
+     */
+    setFor(accountId) {
+        if (accountId === this.managementAccountId) {
+            return { applies: false, levels: [] };
+        }
+        const path = this.pathFor(accountId);
+        if (path.length === 0) {
+            return { applies: false, levels: [] };
+        }
+        return { applies: true, levels: path.map((node) => this.levelAt(node)) };
+    }
+    /**
+     * The nodes filtering an Account's requests.
+     *
+     * An Account placed in the organization is filtered by the path down to it.
+     * An Account only ever named by having a policy attached to it is filtered
+     * by that policy alone, which is what attaching to an Account meant before
+     * the organization had a shape.
+     */
+    pathFor(accountId) {
+        if (this.tree.holds(accountId)) {
+            return this.tree.pathTo(accountId);
+        }
+        return this.scpStore.holds(accountId) ? [accountId] : [];
+    }
+    /**
+     * What one node contributes to an Account's decision.
+     */
+    levelAt(nodeId) {
+        return {
+            nodeName: this.tree.nameOf(nodeId),
+            policies: this.scpStore.policiesAt(nodeId),
+        };
+    }
+}

package/dist/service/organizations/policy/sim-organizations-scp-store.d.ts

@@ -0,0 +1,61 @@
+import type { SimIamServiceControlPolicy } from "../../iam/authorize/scp/sim-iam-scp-resolver.js";
+import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+import type { SimOrganizationsNodeId } from "../tree/sim-organizations-node.js";
+/**
+ * The AWS-managed policy attached to every organization node by default.
+ *
+ * Turning service control policies on in an organization leaves every
+ * account's permissions as they were, because this policy comes with them. A
+ * simulated node gets the same treatment, so attaching one Deny statement
+ * denies that one action and leaves the rest working.
+ */
+export declare const SIM_ORGANIZATIONS_FULL_AWS_ACCESS: SimIamServiceControlPolicy;
+/**
+ * The service control policies attached to each node of an organization.
+ *
+ * A node holds FullAWSAccess along with whatever was attached to it, until a
+ * test detaches FullAWSAccess to write an allow list at that node. A node
+ * nothing was attached to still holds FullAWSAccess, so an organizational unit
+ * a test never mentions allows everything through it.
+ */
+export declare class SimOrganizationsScpStore {
+    private readonly byNodeId;
+    /**
+     * Attach a service control policy to a node under an id of its own.
+     *
+     * The id is what takes the policy off again. One policy attached to several
+     * nodes carries the same id at each of them, the way an AWS policy attached
+     * to several targets is one policy.
+     */
+    attach(nodeId: SimOrganizationsNodeId, policyId: string, document: SimIamPolicyDocument, policyName?: string): void;
+    /**
+     * Take one service control policy off a node, leaving the rest.
+     *
+     * A node can hold policies from more than one source, so taking the wrong
+     * ones off would change what an Account may do behind the caller's back.
+     */
+    detach(nodeId: SimOrganizationsNodeId, policyId: string): void;
+    /**
+     * Take the AWS-managed FullAWSAccess policy off a node.
+     *
+     * What remains at that node has to allow an action for a request through it
+     * to go ahead, which is how a level is turned into an allow list.
+     */
+    detachFullAwsAccess(nodeId: SimOrganizationsNodeId): void;
+    /**
+     * Put a node back to holding FullAWSAccess and nothing else.
+     */
+    detachAll(nodeId: SimOrganizationsNodeId): void;
+    /**
+     * The policies in force at one node, FullAWSAccess first.
+     */
+    policiesAt(nodeId: SimOrganizationsNodeId): readonly SimIamServiceControlPolicy[];
+    /**
+     * Whether anything has been attached to or detached from a node.
+     */
+    holds(nodeId: SimOrganizationsNodeId): boolean;
+    /**
+     * The record for a node, created on first use.
+     */
+    private nodePolicies;
+}

package/dist/service/organizations/policy/sim-organizations-scp-store.js

@@ -0,0 +1,103 @@
+/**
+ * The AWS-managed policy attached to every organization node by default.
+ *
+ * Turning service control policies on in an organization leaves every
+ * account's permissions as they were, because this policy comes with them. A
+ * simulated node gets the same treatment, so attaching one Deny statement
+ * denies that one action and leaves the rest working.
+ */
+export const SIM_ORGANIZATIONS_FULL_AWS_ACCESS = {
+    policyName: "FullAWSAccess",
+    document: {
+        Version: "2012-10-17",
+        Statement: { Effect: "Allow", Action: "*", Resource: "*" },
+    },
+};
+/**
+ * The service control policies attached to each node of an organization.
+ *
+ * A node holds FullAWSAccess along with whatever was attached to it, until a
+ * test detaches FullAWSAccess to write an allow list at that node. A node
+ * nothing was attached to still holds FullAWSAccess, so an organizational unit
+ * a test never mentions allows everything through it.
+ */
+export class SimOrganizationsScpStore {
+    byNodeId = new Map();
+    /**
+     * Attach a service control policy to a node under an id of its own.
+     *
+     * The id is what takes the policy off again. One policy attached to several
+     * nodes carries the same id at each of them, the way an AWS policy attached
+     * to several targets is one policy.
+     */
+    attach(nodeId, policyId, document, policyName) {
+        this.nodePolicies(nodeId).attached.push({
+            policyId,
+            policy: { document, policyName },
+        });
+    }
+    /**
+     * Take one service control policy off a node, leaving the rest.
+     *
+     * A node can hold policies from more than one source, so taking the wrong
+     * ones off would change what an Account may do behind the caller's back.
+     */
+    detach(nodeId, policyId) {
+        const node = this.byNodeId.get(nodeId);
+        if (node === undefined) {
+            return;
+        }
+        const remaining = node.attached.filter((attached) => attached.policyId !== policyId);
+        node.attached.length = 0;
+        node.attached.push(...remaining);
+    }
+    /**
+     * Take the AWS-managed FullAWSAccess policy off a node.
+     *
+     * What remains at that node has to allow an action for a request through it
+     * to go ahead, which is how a level is turned into an allow list.
+     */
+    detachFullAwsAccess(nodeId) {
+        this.nodePolicies(nodeId).fullAwsAccess = false;
+    }
+    /**
+     * Put a node back to holding FullAWSAccess and nothing else.
+     */
+    detachAll(nodeId) {
+        this.byNodeId.delete(nodeId);
+    }
+    /**
+     * The policies in force at one node, FullAWSAccess first.
+     */
+    policiesAt(nodeId) {
+        const node = this.byNodeId.get(nodeId);
+        if (node === undefined) {
+            return [SIM_ORGANIZATIONS_FULL_AWS_ACCESS];
+        }
+        const attached = node.attached.map((entry) => entry.policy);
+        return node.fullAwsAccess
+            ? [SIM_ORGANIZATIONS_FULL_AWS_ACCESS, ...attached]
+            : attached;
+    }
+    /**
+     * Whether anything has been attached to or detached from a node.
+     */
+    holds(nodeId) {
+        return this.byNodeId.has(nodeId);
+    }
+    /**
+     * The record for a node, created on first use.
+     */
+    nodePolicies(nodeId) {
+        const existing = this.byNodeId.get(nodeId);
+        if (existing !== undefined) {
+            return existing;
+        }
+        const created = {
+            attached: [],
+            fullAwsAccess: true,
+        };
+        this.byNodeId.set(nodeId, created);
+        return created;
+    }
+}

package/dist/service/organizations/sim-organizations-structure.d.ts

@@ -0,0 +1,94 @@
+import { SimOrganizationsEffectivePolicies } from "./policy/sim-organizations-effective-policies.js";
+import { SimOrganizationsScpStore } from "./policy/sim-organizations-scp-store.js";
+import { type SimOrganizationsNodeId, type SimOrganizationsOrganizationalUnit, type SimOrganizationsRoot, type SimOrganizationsTarget } from "./tree/sim-organizations-node.js";
+import { SimOrganizationsTree } from "./tree/sim-organizations-tree.js";
+/**
+ * The shape of one simulated organization: its root, the organizational units
+ * under it, and where its Accounts sit.
+ *
+ * SimOrganizations is the facade a test reaches through, and this is the half
+ * of it concerned with structure. The policies that hang on that structure are
+ * the other half.
+ */
+export declare abstract class SimOrganizationsStructure {
+    protected readonly scpStore: SimOrganizationsScpStore;
+    protected readonly tree: SimOrganizationsTree;
+    protected readonly effectivePolicies: SimOrganizationsEffectivePolicies;
+    /**
+     * The root of this organization, which every Account sits under.
+     */
+    root(): SimOrganizationsRoot;
+    /**
+     * Create an organizational unit, under the root unless a parent unit is
+     * given.
+     */
+    createOrganizationalUnit(name: string, parent?: SimOrganizationsTarget): SimOrganizationsOrganizationalUnit;
+    /**
+     * Put an Account in the organization, under an organizational unit or under
+     * the root.
+     */
+    moveAccount(accountId: string, parent?: SimOrganizationsTarget): void;
+    /**
+     * Name the Account that pays the organization's bills.
+     *
+     * AWS exempts the management account from every service control policy, and
+     * so does this. An Account named here is decided by its identity and
+     * resource policies alone, whatever is attached above it.
+     */
+    setManagementAccount(accountId: string): void;
+    /**
+     * Every Account this organization holds.
+     *
+     * A test tracking down where a denial came from reads this to see which
+     * Accounts the organization is filtering at all.
+     */
+    accountIds(): readonly string[];
+    /**
+     * Take an Account out of the organization.
+     *
+     * Nothing then filters its requests, whatever is attached above where it
+     * sat. This is how an Account leaves an organization, and it is a different
+     * thing from taking the policies off it.
+     */
+    removeAccount(accountId: string): void;
+    /**
+     * Take an organizational unit out of the organization.
+     *
+     * Anything still under it moves up to its parent, so every Account keeps a
+     * path back to the root.
+     */
+    removeOrganizationalUnit(target: SimOrganizationsTarget): void;
+    /**
+     * The node a target names.
+     *
+     * An Account is named by its twelve-digit id and needs no place in the
+     * organization yet, because attaching a policy to one is what puts it there.
+     * A root or organizational unit, whether given as a handle or as the `r-` or
+     * `ou-` id a template carries, has to be this organization's own. One from
+     * another organization is refused rather than attached to and never read.
+     */
+    protected nodeIdOf(target: SimOrganizationsTarget): SimOrganizationsNodeId;
+    /**
+     * Refuse the whole set unless every target names a node this organization
+     * has.
+     *
+     * Attaching one policy to several nodes is one act, so it either reaches all
+     * of them or none. Failing partway would leave a policy attached where
+     * nothing knows to take it off.
+     */
+    requireTargets(targets: readonly SimOrganizationsTarget[]): void;
+    /**
+     * The node a target names, or nothing where this organization has no such
+     * node.
+     *
+     * Taking something off a node that has already gone is what a Stack teardown
+     * asks for when a unit came down before the policy pointing at it. There is
+     * nothing to take off, and refusing would fail a teardown over work already
+     * done.
+     */
+    protected knownNodeIdOf(target: SimOrganizationsTarget): SimOrganizationsNodeId | undefined;
+    /**
+     * The node something sits under, defaulting to the root.
+     */
+    private parentIdOf;
+}