@atlasauth/backend 0.24.0 → 0.26.0

package/dist/client/groups.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.groupsResource = groupsResource;
+const request_1 = require("./request");
+function groupsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/groups' });
+        },
+        get(idOrSlug) {
+            return request({ method: 'GET', path: `/v1/groups/${(0, request_1.enc)(idOrSlug)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/groups', body, idempotencyKey });
+        },
+        update(idOrSlug, body) {
+            return request({ method: 'PATCH', path: `/v1/groups/${(0, request_1.enc)(idOrSlug)}`, body });
+        },
+        delete(idOrSlug) {
+            return request({ method: 'DELETE', path: `/v1/groups/${(0, request_1.enc)(idOrSlug)}` });
+        },
+        listMembers(idOrSlug, query = {}) {
+            return request({ method: 'GET', path: `/v1/groups/${(0, request_1.enc)(idOrSlug)}/members`, query });
+        },
+        /** Add up to 500 users by hand. */
+        addMembers(idOrSlug, userIds) {
+            return request({ method: 'POST', path: `/v1/groups/${(0, request_1.enc)(idOrSlug)}/members`, body: { user_ids: userIds } });
+        },
+        removeMembers(idOrSlug, userIds) {
+            return request({ method: 'POST', path: `/v1/groups/${(0, request_1.enc)(idOrSlug)}/members/remove`, body: { user_ids: userIds } });
+        },
+        /** Re-evaluate a dynamic group's filter now. */
+        reapply(idOrSlug) {
+            return request({ method: 'POST', path: `/v1/groups/${(0, request_1.enc)(idOrSlug)}/reapply` });
+        },
+        /** A user's direct groups. */
+        forUser(userId) {
+            return request({ method: 'GET', path: `/v1/users/${(0, request_1.enc)(userId)}/groups` });
+        },
+        rules: {
+            list() {
+                return request({ method: 'GET', path: '/v1/group_rules' });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/group_rules/${(0, request_1.enc)(id)}` });
+            },
+            create(body, idempotencyKey) {
+                return request({ method: 'POST', path: '/v1/group_rules', body, idempotencyKey });
+            },
+            update(id, body) {
+                return request({ method: 'PATCH', path: `/v1/group_rules/${(0, request_1.enc)(id)}`, body });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: `/v1/group_rules/${(0, request_1.enc)(id)}` });
+            },
+            /** Run one rule now. */
+            apply(id) {
+                return request({ method: 'POST', path: `/v1/group_rules/${(0, request_1.enc)(id)}/apply` });
+            },
+            /** Run every enabled rule in priority order. */
+            applyAll() {
+                return request({ method: 'POST', path: '/v1/group_rules/apply' });
+            },
+        },
+    };
+}
+//# sourceMappingURL=groups.js.map

package/dist/client/groups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.js","sourceRoot":"","sources":["../../src/client/groups.ts"],"names":[],"mappings":";;AAqFA,wCA6DC;AAlJD,uCAAgD;AAqFhD,SAAgB,cAAc,CAAC,OAAkB;IAC/C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,GAAG,CAAC,QAAgB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,IAAgD,EAAE,cAAuB;YAC9E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,CAAC,QAAgB,EAAE,IAAe;YACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,QAAgB;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,WAAW,CAAC,QAAgB,EAAE,QAAqD,EAAE;YACnF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,mCAAmC;QACnC,UAAU,CAAC,QAAgB,EAAE,OAAiB;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,aAAa,CAAC,QAAgB,EAAE,OAAiB;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,gDAAgD;QAChD,OAAO,CAAC,QAAgB;YACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,8BAA8B;QAC9B,OAAO,CAAC,MAAc;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,EAAE;YACL,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,CAAC,IAAsG,EAAE,cAAuB;gBACpI,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAmB;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,wBAAwB;YACxB,KAAK,CAAC,EAAU;gBACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,gDAAgD;YAChD,QAAQ;gBACN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACpE,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/identity-verification.d.ts

@@ -0,0 +1,62 @@
+import { type RequestFn } from './request';
+export type IdentityVerificationOutcome = 'pending' | 'approved' | 'declined' | 'needs_review';
+export interface IdentityVerification {
+    object: 'identity_verification';
+    id: string;
+    user_id: string;
+    provider: 'persona' | 'onfido' | 'veriff' | 'stripe_identity';
+    status: IdentityVerificationOutcome;
+    reason: string | null;
+    /** The verification service's hosted page, while pending. */
+    url: string | null;
+    decided_by: string | null;
+    created_at: number;
+    completed_at: number | null;
+}
+export interface IdentityVerificationSettings {
+    object: 'identity_verification_settings';
+    enabled: boolean;
+    /** The service connector (Persona, Onfido, Veriff or Stripe Identity) that does the checking. */
+    connector_id: string | null;
+    /** Offer a verified identity as the custom second step of sign-in. */
+    as_challenge: boolean;
+    /** Give this URL to the verification service for verdict webhooks; store its webhook secret on the connector as `webhook_secret`. */
+    webhook_url: string | null;
+}
+/**
+ * Identity verification (document and selfie) through your own verification
+ * service. An approved check is written to the user as
+ * `public_metadata.verification.identity` (`{ status, provider, verified_at }`).
+ */
+export declare function identityVerificationResource(request: RequestFn): {
+    settings(): Promise<IdentityVerificationSettings>;
+    updateSettings(body: {
+        enabled: boolean;
+        connector_id?: string | null;
+        as_challenge?: boolean;
+    }): Promise<IdentityVerificationSettings>;
+    /** Checks by status, newest first. Defaults to `needs_review`, the review queue. */
+    list(params?: {
+        status?: IdentityVerificationOutcome;
+    }): Promise<{
+        object: "list";
+        data: IdentityVerification[];
+        has_more: boolean;
+    }>;
+    /** One check; a pending one is refreshed from the verification service. */
+    get(id: string): Promise<IdentityVerification>;
+    /** Approve or decline a check that is waiting for review. */
+    decide(id: string, body: {
+        decision: "approved" | "declined";
+        reason?: string;
+    }): Promise<IdentityVerification>;
+    forUser(userId: string): Promise<{
+        object: "list";
+        data: IdentityVerification[];
+        has_more: boolean;
+    }>;
+    /** Start a check for a user; send them to the returned `url`. */
+    start(userId: string, body?: {
+        redirect_url?: string;
+    }): Promise<IdentityVerification>;
+};

package/dist/client/identity-verification.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identityVerificationResource = identityVerificationResource;
+const request_1 = require("./request");
+/**
+ * Identity verification (document and selfie) through your own verification
+ * service. An approved check is written to the user as
+ * `public_metadata.verification.identity` (`{ status, provider, verified_at }`).
+ */
+function identityVerificationResource(request) {
+    return {
+        settings() {
+            return request({ method: 'GET', path: '/v1/identity_verification/settings' });
+        },
+        updateSettings(body) {
+            return request({ method: 'PUT', path: '/v1/identity_verification/settings', body });
+        },
+        /** Checks by status, newest first. Defaults to `needs_review`, the review queue. */
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/identity_verifications', query: params });
+        },
+        /** One check; a pending one is refreshed from the verification service. */
+        get(id) {
+            return request({ method: 'GET', path: `/v1/identity_verifications/${(0, request_1.enc)(id)}` });
+        },
+        /** Approve or decline a check that is waiting for review. */
+        decide(id, body) {
+            return request({ method: 'POST', path: `/v1/identity_verifications/${(0, request_1.enc)(id)}/decide`, body });
+        },
+        forUser(userId) {
+            return request({ method: 'GET', path: `/v1/users/${(0, request_1.enc)(userId)}/identity_verifications` });
+        },
+        /** Start a check for a user; send them to the returned `url`. */
+        start(userId, body = {}) {
+            return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(userId)}/identity_verifications`, body });
+        },
+    };
+}
+//# sourceMappingURL=identity-verification.js.map

package/dist/client/identity-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-verification.js","sourceRoot":"","sources":["../../src/client/identity-verification.ts"],"names":[],"mappings":";;AAkCA,oEA4BC;AA9DD,uCAAgD;AA6BhD;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,OAAkB;IAC7D,OAAO;QACL,QAAQ;YACN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,cAAc,CAAC,IAAgF;YAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,oFAAoF;QACpF,IAAI,CAAC,SAAmD,EAAE;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,2EAA2E;QAC3E,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,6DAA6D;QAC7D,MAAM,CAAC,EAAU,EAAE,IAA4D;YAC7E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,CAAC,MAAc;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,iEAAiE;QACjE,KAAK,CAAC,MAAc,EAAE,OAAkC,EAAE;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;QACpG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/iga.d.ts

@@ -0,0 +1,436 @@
+import { type RequestFn } from './request';
+export type IgaKind = 'role' | 'org_membership' | 'group' | 'resource_role' | 'app_assignment' | 'custom';
+export type IgaRisk = 'low' | 'medium' | 'high' | 'critical';
+export type IgaApproverSelector = {
+    type: 'manager' | 'owner';
+} | {
+    type: 'group' | 'users';
+    ids: string[];
+};
+export interface IgaApprovalStep {
+    type: 'manager' | 'owner' | 'group' | 'users';
+    /** A group slug (`group`) or user ids (`users`). */
+    ids?: string[];
+    /** `any` approver decides the step; `all` must approve. Default `any`. */
+    mode?: 'any' | 'all';
+    /** After this long without a decision the step escalates. */
+    timeout_seconds?: number;
+    escalate_to?: IgaApproverSelector;
+}
+export interface IgaEntitlement {
+    object: 'iga_entitlement';
+    id: string;
+    key: string;
+    name: string;
+    description: string | null;
+    kind: IgaKind;
+    target: Record<string, unknown>;
+    owner_user_id: string | null;
+    risk_level: IgaRisk;
+    approval_rules: {
+        steps: IgaApprovalStep[];
+    };
+    max_duration_seconds: number | null;
+    requestable: boolean;
+    require_justification: boolean;
+    created_at: number;
+    updated_at: number;
+}
+export interface IgaEntitlementInput {
+    key: string;
+    name: string;
+    kind: IgaKind;
+    /** role `{role_key}`, org_membership `{organization_id, role}`, group `{group}`, resource_role `{resource_id, role}`, app_assignment `{app_id}`, custom (free-form). */
+    target: Record<string, unknown>;
+    description?: string | null;
+    owner_user_id?: string | null;
+    risk_level?: IgaRisk;
+    approval_rules?: {
+        steps: IgaApprovalStep[];
+    };
+    max_duration_seconds?: number | null;
+    requestable?: boolean;
+    require_justification?: boolean;
+}
+export type IgaRequestStatus = 'pending' | 'approved' | 'denied' | 'cancelled' | 'fulfilled' | 'failed';
+export interface IgaRequest {
+    object: 'iga_request';
+    id: string;
+    entitlement_id: string;
+    requester_user_id: string | null;
+    beneficiary_user_id: string;
+    source: 'self' | 'admin';
+    justification: string | null;
+    duration_seconds: number | null;
+    status: IgaRequestStatus;
+    current_step: number | null;
+    steps: Array<{
+        index: number;
+        type: string;
+        mode: 'any' | 'all';
+        approvers: string[];
+        status: 'pending' | 'approved' | 'denied';
+        escalated: boolean;
+        timeout_seconds: number | null;
+        sod_rule_id: string | null;
+    }>;
+    sod: Array<{
+        rule_id: string;
+        rule_name: string;
+        mode: 'block' | 'require_approval';
+        conflicting_entitlement_id: string;
+    }>;
+    approvals: Array<{
+        step: number;
+        approver_user_id: string;
+        acting_for_user_id: string | null;
+        decision: 'approve' | 'deny';
+        comment: string | null;
+        decided_at: number;
+    }>;
+    failure: string | null;
+    decided_at: number | null;
+    created_at: number;
+}
+export interface IgaGrant {
+    object: 'iga_grant';
+    id: string;
+    user_id: string;
+    entitlement_id: string;
+    request_id: string | null;
+    source: 'request' | 'admin' | 'birthright' | 'existing';
+    status: 'active' | 'revoked' | 'expired';
+    granted_at: number;
+    expires_at: number | null;
+    revoked_at: number | null;
+    revoked_reason: string | null;
+    revoked_by: string | null;
+    /** The access existed before governance took it over; an expiry leaves it in place. */
+    adopted: boolean;
+}
+export interface IgaDelegation {
+    object: 'iga_delegation';
+    id: string;
+    delegator_user_id: string;
+    delegate_user_id: string;
+    starts_at: number;
+    ends_at: number;
+    created_at: number;
+}
+export interface IgaSodRule {
+    object: 'iga_sod_rule';
+    id: string;
+    name: string;
+    description: string | null;
+    entitlement_a: string;
+    entitlement_b: string;
+    mode: 'block' | 'require_approval';
+    approver: IgaApprovalStep | null;
+    enabled: boolean;
+    created_at: number;
+    updated_at: number;
+}
+export interface IgaSodViolation {
+    object: 'iga_sod_violation';
+    id: string;
+    rule_id: string;
+    rule_name: string | null;
+    mode: string | null;
+    user_id: string;
+    status: 'open' | 'accepted' | 'resolved';
+    source: 'request' | 'assignment' | 'scan';
+    request_id: string | null;
+    note: string | null;
+    detected_at: number;
+    resolved_at: number | null;
+}
+export interface IgaBirthrightMatch {
+    group?: string;
+    organization_id?: string;
+    org_role?: string;
+    app_role?: string;
+    email_domain?: string;
+}
+export interface IgaBirthrightRule {
+    object: 'iga_birthright_rule';
+    id: string;
+    name: string;
+    match: IgaBirthrightMatch;
+    entitlement_ids: string[];
+    revoke_on_unmatch: boolean;
+    enabled: boolean;
+    created_at: number;
+}
+export interface IgaSettings {
+    object: 'iga_settings';
+    jml_enabled: boolean;
+    leaver_action: 'revoke' | 'revoke_and_close';
+    leaver_close_grace_seconds: number | null;
+}
+export interface IgaCampaign {
+    object: 'iga_campaign';
+    id: string;
+    name: string;
+    description: string | null;
+    scope_type: 'all' | 'entitlement' | 'app' | 'role' | 'group' | 'org';
+    scope_ids: string[];
+    reviewer_type: 'manager' | 'owner' | 'named';
+    reviewer_ids: string[];
+    status: 'draft' | 'active' | 'closed';
+    due_at: number | null;
+    reminder_days: number[];
+    auto_revoke: boolean;
+    launched_at: number | null;
+    closed_at: number | null;
+    created_at: number;
+}
+export interface IgaCampaignInput {
+    name: string;
+    description?: string;
+    scope_type?: IgaCampaign['scope_type'];
+    scope_ids?: string[];
+    reviewer_type?: IgaCampaign['reviewer_type'];
+    reviewer_ids?: string[];
+    due_at?: number;
+    reminder_days?: number[];
+    /** Remove access reviewers marked for revocation when the campaign closes. Default true. */
+    auto_revoke?: boolean;
+}
+export interface IgaCampaignItem {
+    object: 'iga_campaign_item';
+    id: string;
+    campaign_id: string;
+    grant_id: string;
+    user_id: string;
+    entitlement_id: string;
+    reviewer_user_id: string | null;
+    decision: 'pending' | 'certified' | 'revoked';
+    decided_by: string | null;
+    decided_at: number | null;
+    comment: string | null;
+    revoked_applied: boolean;
+}
+export interface IgaCampaignProgress {
+    object: 'iga_campaign_progress';
+    campaign_id: string;
+    status: IgaCampaign['status'];
+    total: number;
+    pending: number;
+    certified: number;
+    revoked: number;
+    percent_complete: number;
+    overdue: boolean;
+    reviewers: Array<{
+        reviewer_user_id: string | null;
+        total: number;
+        decided: number;
+    }>;
+}
+export interface IgaEvidence {
+    object: 'iga_campaign_evidence';
+    campaign: IgaCampaign;
+    progress: IgaCampaignProgress;
+    generated_at: string;
+    items: Array<{
+        item_id: string;
+        user_id: string;
+        user_erased: boolean;
+        user_email_masked?: string | null;
+        entitlement_key: string | null;
+        entitlement_name: string | null;
+        risk_level: string | null;
+        reviewer_user_id: string | null;
+        decision: string;
+        decided_by: string | null;
+        decided_at: string | null;
+        revoked_applied: boolean;
+    }>;
+}
+export interface IgaOffboarding {
+    object: 'iga_offboarding';
+    user_id: string;
+    revoked_grants: number;
+    cancelled_requests: number;
+    account_closure: {
+        effective_at: number;
+        request_id: string;
+    } | null;
+}
+type List<T> = {
+    object: 'list';
+    data: T[];
+    has_more: boolean;
+};
+type Deleted<O extends string> = {
+    object: O;
+    id: string;
+    deleted: true;
+};
+/**
+ * Identity governance: the entitlement catalog, access requests with multi-step
+ * approvals, time-bound grants, certification campaigns, separation of duties
+ * and joiner/mover/leaver automation. Needs the `iga:read` / `iga:write` scopes.
+ */
+export declare function igaResource(request: RequestFn): {
+    entitlements: {
+        list: (params?: {
+            kind?: IgaKind;
+        }) => Promise<List<IgaEntitlement>>;
+        get: (idOrKey: string) => Promise<IgaEntitlement>;
+        create: (body: IgaEntitlementInput) => Promise<IgaEntitlement>;
+        update: (idOrKey: string, body: Partial<Omit<IgaEntitlementInput, "key" | "kind">>) => Promise<IgaEntitlement>;
+        delete: (idOrKey: string) => Promise<Deleted<"iga_entitlement">>;
+    };
+    requests: {
+        list: (params?: {
+            status?: IgaRequestStatus;
+            user_id?: string;
+            requester_user_id?: string;
+            entitlement?: string;
+            limit?: number;
+        }) => Promise<List<IgaRequest>>;
+        get: (id: string) => Promise<IgaRequest>;
+        /** File a request for a user; it follows the entitlement's approval steps. */
+        create: (body: {
+            entitlement: string;
+            user_id: string;
+            requester_user_id?: string;
+            justification?: string;
+            duration_seconds?: number;
+        }) => Promise<IgaRequest>;
+        /** Decide the open step as `approver_user_id`, or as an administrator override when omitted. */
+        decide: (id: string, body: {
+            decision: "approve" | "deny";
+            comment?: string;
+            approver_user_id?: string;
+        }) => Promise<IgaRequest>;
+        cancel: (id: string) => Promise<IgaRequest>;
+        /** Requests waiting on one person (their own steps and delegated ones). */
+        inbox: (approverUserId: string) => Promise<List<IgaRequest>>;
+    };
+    grants: {
+        list: (params?: {
+            user_id?: string;
+            entitlement?: string;
+            status?: "active" | "revoked" | "expired";
+            limit?: number;
+        }) => Promise<List<IgaGrant>>;
+        create: (body: {
+            entitlement: string;
+            user_id: string;
+            expires_at?: number;
+            override_reason?: string;
+        }) => Promise<IgaGrant>;
+        revoke: (id: string, body?: {
+            reason?: string;
+        }) => Promise<IgaGrant>;
+    };
+    delegations: {
+        list: (params?: {
+            delegator_user_id?: string;
+        }) => Promise<List<IgaDelegation>>;
+        create: (body: {
+            delegator_user_id: string;
+            delegate_user_id: string;
+            ends_at: number;
+            starts_at?: number;
+        }) => Promise<IgaDelegation>;
+        delete: (id: string) => Promise<Deleted<"iga_delegation">>;
+    };
+    sod: {
+        listRules: () => Promise<List<IgaSodRule>>;
+        createRule: (body: {
+            name: string;
+            entitlement_a: string;
+            entitlement_b: string;
+            mode?: "block" | "require_approval";
+            approver?: IgaApprovalStep;
+            description?: string;
+            enabled?: boolean;
+        }) => Promise<IgaSodRule>;
+        updateRule: (id: string, body: {
+            name?: string;
+            description?: string;
+            mode?: "block" | "require_approval";
+            approver?: IgaApprovalStep;
+            enabled?: boolean;
+        }) => Promise<IgaSodRule>;
+        deleteRule: (id: string) => Promise<Deleted<"iga_sod_rule">>;
+        /** The violations report. */
+        violations: (params?: {
+            status?: "open" | "accepted" | "resolved";
+        }) => Promise<List<IgaSodViolation>>;
+        /** Re-check every rule against what people hold now. */
+        scan: () => Promise<{
+            object: "iga_sod_scan";
+            found: number;
+            resolved: number;
+        }>;
+    };
+    lifecycle: {
+        listBirthrightRules: () => Promise<List<IgaBirthrightRule>>;
+        createBirthrightRule: (body: {
+            name: string;
+            match: IgaBirthrightMatch;
+            entitlement_ids: string[];
+            revoke_on_unmatch?: boolean;
+            enabled?: boolean;
+        }) => Promise<IgaBirthrightRule>;
+        updateBirthrightRule: (id: string, body: Partial<{
+            name: string;
+            match: IgaBirthrightMatch;
+            entitlement_ids: string[];
+            revoke_on_unmatch: boolean;
+            enabled: boolean;
+        }>) => Promise<IgaBirthrightRule>;
+        deleteBirthrightRule: (id: string) => Promise<Deleted<"iga_birthright_rule">>;
+        /** Re-evaluate one user's birthright access now (joiner or mover). */
+        reconcile: (userId: string) => Promise<{
+            object: "iga_jml";
+            user_id: string;
+            granted: string[];
+            revoked: string[];
+        }>;
+        /** Offboard a leaver; with `close_account` the closure goes through the data-rights path. */
+        offboard: (userId: string, body?: {
+            close_account?: boolean;
+            grace_seconds?: number;
+            reason?: string;
+        }) => Promise<IgaOffboarding>;
+        settings: () => Promise<IgaSettings>;
+        updateSettings: (body: Partial<Omit<IgaSettings, "object">>) => Promise<IgaSettings>;
+    };
+    campaigns: {
+        list: (params?: {
+            status?: IgaCampaign["status"];
+        }) => Promise<List<IgaCampaign>>;
+        get: (id: string) => Promise<IgaCampaign & {
+            progress: IgaCampaignProgress;
+        }>;
+        create: (body: IgaCampaignInput) => Promise<IgaCampaign>;
+        delete: (id: string) => Promise<Deleted<"iga_campaign">>;
+        /** Freeze the review list (adopting access that was never granted through governance) and notify reviewers. */
+        launch: (id: string) => Promise<IgaCampaign>;
+        /** Close the campaign; with auto-revoke, access reviewers marked for revocation is removed. */
+        close: (id: string) => Promise<IgaCampaign>;
+        items: (id: string, params?: {
+            decision?: IgaCampaignItem["decision"];
+            reviewer_user_id?: string;
+        }) => Promise<List<IgaCampaignItem>>;
+        progress: (id: string) => Promise<IgaCampaignProgress>;
+        /** Audit evidence as JSON. People appear by id only; free-text comments are never included. */
+        evidence: (id: string, params?: {
+            masked_emails?: boolean;
+        }) => Promise<IgaEvidence>;
+        /** The same evidence as CSV text. */
+        evidenceCsv: (id: string, params?: {
+            masked_emails?: boolean;
+        }) => Promise<string>;
+        decide: (itemId: string, body: {
+            decision: "certify" | "revoke";
+            comment?: string;
+            reviewer_user_id?: string;
+        }) => Promise<IgaCampaignItem>;
+    };
+};
+export {};