@beeuni/sdk 0.1.0

package/dist/core/rest/projects-client/github.d.ts

@@ -0,0 +1,128 @@
+import { type ProjectGitConnection } from './shared.js';
+import type { BeeuniProject, ProjectGlyph } from './projects.js';
+export interface GitHubRepository {
+    id: string;
+    name: string;
+    full_name: string;
+    private: boolean;
+    html_url: string;
+    clone_url: string;
+    ssh_url: string;
+    default_branch: string;
+    description: string | null;
+}
+export interface GitHubRepositoriesResponse {
+    account_id: string;
+    installation_id: string;
+    owner_login: string;
+    repositories: GitHubRepository[];
+}
+export interface GitHubRepositoryBranch {
+    name: string;
+    protected: boolean;
+}
+export interface GitHubRepositoryBranchesResponse {
+    account_id: string;
+    installation_id: string;
+    owner_login: string;
+    repo_full_name: string;
+    default_branch: string;
+    branches: GitHubRepositoryBranch[];
+}
+export interface LinkRepositoryInput {
+    account_id?: string;
+    repo_url?: string;
+    repo_full_name?: string;
+    installation_id?: string;
+    source?: 'managed';
+    name?: string;
+    default_branch?: string;
+    manifest_path?: string;
+    icon?: string;
+    icon_glyph?: ProjectGlyph;
+}
+export interface LinkRepositoryResponse {
+    project: BeeuniProject;
+    git_connection: ProjectGitConnection | null;
+}
+export interface ReplaceProjectRepositoryInput {
+    project_id: string;
+    repo_url: string;
+    expected_repo_url: string;
+    github_token?: string;
+    installation_id?: string;
+    github_user_token?: string;
+    copy_shared_secrets_from_project_id?: string;
+    copy_shared_secret_identifiers?: string[];
+}
+export type ReplaceProjectRepositoryResponse = LinkRepositoryResponse;
+export interface GitHubInstallationStatus {
+    account_id: string;
+    installation_row_id: string | null;
+    installed: boolean;
+    configured: boolean;
+    requires_installation: boolean;
+    install_url: string | null;
+    installation_id: string | null;
+    owner_login: string | null;
+    owner_type: string | null;
+    repository_selection: string | null;
+    permissions: Record<string, unknown>;
+    installation_url: string | null;
+    updated_at: string | null;
+}
+export interface GitHubInstallationsResponse extends GitHubInstallationStatus {
+    installations: GitHubInstallationStatus[];
+}
+export interface LinkableGitHubInstallation {
+    installation_id: string;
+    owner_login: string | null;
+    owner_type: string | null;
+    repository_selection: string | null;
+    permissions: Record<string, unknown>;
+    installation_url: string | null;
+    linked: boolean;
+    linked_to_other_accounts: number;
+}
+export interface LinkableGitHubInstallationsResponse {
+    account_id: string;
+    github_login: string;
+    configured: boolean;
+    install_url: string | null;
+    installations: LinkableGitHubInstallation[];
+}
+export declare function linkRepository(input: LinkRepositoryInput): Promise<LinkRepositoryResponse>;
+export declare function replaceProjectRepository(input: ReplaceProjectRepositoryInput): Promise<LinkRepositoryResponse>;
+export declare function getGitHubInstallation(accountId: string): Promise<GitHubInstallationsResponse>;
+export declare function listGitHubInstallations(accountId: string): Promise<GitHubInstallationsResponse>;
+export declare function listLinkableGitHubInstallations(input: {
+    account_id: string;
+    github_user_token: string;
+}): Promise<LinkableGitHubInstallationsResponse>;
+export declare function listGitHubRepositories(accountId: string, installationId?: string | null, options?: {
+    search?: string;
+    limit?: number;
+}): Promise<GitHubRepositoriesResponse>;
+export declare function listGitHubRepositoryBranches(accountId: string, installationId: string, repoFullName: string): Promise<GitHubRepositoryBranchesResponse>;
+export declare function saveGitHubInstallation(input: {
+    state: string;
+    installation_id: string;
+    github_user_token?: string;
+}): Promise<GitHubInstallationStatus>;
+export declare function linkGitHubInstallation(input: {
+    account_id: string;
+    installation_id: string;
+    github_user_token: string;
+}): Promise<GitHubInstallationStatus>;
+export declare function storeGitHubUserToken(input: {
+    account_id: string;
+    github_user_token: string;
+    expires_in?: number;
+    refresh_token?: string;
+}): Promise<{
+    ok: true;
+    github_login: string;
+}>;
+export declare function deleteGitHubInstallation(accountId: string, installationId?: string | null): Promise<{
+    ok: boolean;
+}>;

package/dist/core/rest/projects-client/github.js

@@ -0,0 +1,54 @@
+import { backendApi } from '../../http/api-client.js';
+import { unwrap } from './shared.js';
+export async function linkRepository(input) {
+    return unwrap(await backendApi.post('/projects/link-repository', input, {
+        showErrors: false,
+    }));
+}
+export async function replaceProjectRepository(input) {
+    const { project_id, ...body } = input;
+    return unwrap(await backendApi.put(`/projects/${encodeURIComponent(project_id)}/git/repository`, body, { showErrors: false }));
+}
+export async function getGitHubInstallation(accountId) {
+    return unwrap(await backendApi.get(`/projects/github/installation?account_id=${encodeURIComponent(accountId)}`, { showErrors: false }));
+}
+export async function listGitHubInstallations(accountId) {
+    return unwrap(await backendApi.get(`/projects/github/installations?account_id=${encodeURIComponent(accountId)}`, { showErrors: false }));
+}
+export async function listLinkableGitHubInstallations(input) {
+    return unwrap(await backendApi.post('/projects/github/installations/linkable', input, { showErrors: false }));
+}
+export async function listGitHubRepositories(accountId, installationId, options) {
+    const params = new URLSearchParams({ account_id: accountId });
+    if (installationId)
+        params.set('installation_id', installationId);
+    const search = options?.search?.trim();
+    if (search)
+        params.set('search', search);
+    if (options?.limit !== undefined)
+        params.set('limit', String(options.limit));
+    return unwrap(await backendApi.get(`/projects/github/repositories?${params.toString()}`, { showErrors: false }));
+}
+export async function listGitHubRepositoryBranches(accountId, installationId, repoFullName) {
+    const params = new URLSearchParams({
+        account_id: accountId,
+        installation_id: installationId,
+        repo_full_name: repoFullName,
+    });
+    return unwrap(await backendApi.get(`/projects/github/repository-branches?${params.toString()}`, { showErrors: false }));
+}
+export async function saveGitHubInstallation(input) {
+    return unwrap(await backendApi.post('/projects/github/installation', input, { showErrors: false }));
+}
+export async function linkGitHubInstallation(input) {
+    return unwrap(await backendApi.post('/projects/github/installations/link', input, { showErrors: false }));
+}
+export async function storeGitHubUserToken(input) {
+    return unwrap(await backendApi.post('/projects/github/user-token', input, { showErrors: false }));
+}
+export async function deleteGitHubInstallation(accountId, installationId) {
+    const params = new URLSearchParams({ account_id: accountId });
+    if (installationId)
+        params.set('installation_id', installationId);
+    return unwrap(await backendApi.delete(`/projects/github/installation?${params.toString()}`));
+}

package/dist/core/rest/projects-client/iam-audit.d.ts

@@ -0,0 +1,81 @@
+import type { AuditEvent } from './audit.js';
+export interface IamAuditWebhook {
+    webhook_id: string;
+    name: string;
+    url: string;
+    enabled: boolean;
+    action_prefix: string | null;
+    last_delivered_at: string | null;
+    last_error_at: string | null;
+    last_error: string | null;
+    created_at: string;
+    updated_at: string;
+}
+export interface CreatedAuditWebhook extends IamAuditWebhook {
+    secret: string;
+    test?: {
+        ok: boolean;
+        status?: number;
+        error?: string;
+    };
+}
+export declare function listAuditWebhooks(accountId: string): Promise<IamAuditWebhook[]>;
+export declare function createAuditWebhook(accountId: string, input: {
+    name: string;
+    url: string;
+    action_prefix?: string;
+}): Promise<CreatedAuditWebhook>;
+export declare function updateAuditWebhook(accountId: string, webhookId: string, patch: {
+    name?: string;
+    enabled?: boolean;
+    action_prefix?: string | null;
+}): Promise<IamAuditWebhook>;
+export declare function deleteAuditWebhook(accountId: string, webhookId: string): Promise<{
+    deleted: boolean;
+}>;
+export interface IamAuditEvent extends AuditEvent {
+    event_id: string;
+    occurred_at: string;
+    project_id: string | null;
+    session_id: string | null;
+    actor_user_id: string | null;
+    actor_type: 'human' | 'agent' | 'service_account' | 'system' | 'anonymous' | null;
+    source: string | null;
+    outcome: 'success' | 'failure' | 'denied' | 'pending' | null;
+    action: string;
+    resource_type: string;
+    resource_id: string | null;
+    http_status: number | null;
+    duration_ms: number | null;
+    request_id: string | null;
+    trace_id: string | null;
+    correlation_id: string | null;
+    before: Record<string, unknown> | null;
+    after: Record<string, unknown> | null;
+    ip: string | null;
+    user_agent: string | null;
+    metadata: Record<string, unknown>;
+}
+export interface ListAuditFilter {
+    action?: string;
+    actor?: string;
+    project_id?: string;
+    session_id?: string;
+    actor_type?: 'human' | 'agent' | 'service_account' | 'system' | 'anonymous';
+    source?: string;
+    credential_kind?: string;
+    phase?: string;
+    outcome?: 'success' | 'failure' | 'denied' | 'pending';
+    request_id?: string;
+    correlation_id?: string;
+    resource_type?: string;
+    since?: string;
+    until?: string;
+    q?: string;
+    cursor?: string;
+    limit?: number;
+}
+export declare function listAuditEvents(accountId: string, filter?: ListAuditFilter): Promise<{
+    events: IamAuditEvent[];
+    next_cursor: string | null;
+}>;

package/dist/core/rest/projects-client/iam-audit.js

@@ -0,0 +1,21 @@
+import { appendQuery } from './iam-query.js';
+import { backendApi } from '../../http/api-client.js';
+import { iamGet, iamUnwrap as unwrap } from './iam-shared.js';
+export async function listAuditWebhooks(accountId) {
+    return unwrap(await iamGet(`/accounts/${accountId}/audit/webhooks`)).webhooks;
+}
+export async function createAuditWebhook(accountId, input) {
+    return unwrap(await backendApi.post(`/accounts/${accountId}/audit/webhooks`, input, {
+        showErrors: false,
+    }));
+}
+export async function updateAuditWebhook(accountId, webhookId, patch) {
+    return unwrap(await backendApi.patch(`/accounts/${accountId}/audit/webhooks/${webhookId}`, patch));
+}
+export async function deleteAuditWebhook(accountId, webhookId) {
+    return unwrap(await backendApi.delete(`/accounts/${accountId}/audit/webhooks/${webhookId}`));
+}
+export async function listAuditEvents(accountId, filter = {}) {
+    const query = appendQuery({ action: filter.action, actor: filter.actor, project_id: filter.project_id, session_id: filter.session_id, actor_type: filter.actor_type, source: filter.source, credential_kind: filter.credential_kind, phase: filter.phase, outcome: filter.outcome, request_id: filter.request_id, correlation_id: filter.correlation_id, resource_type: filter.resource_type, since: filter.since, until: filter.until, q: filter.q, cursor: filter.cursor, limit: filter.limit });
+    return unwrap(await iamGet(`/accounts/${accountId}/audit${query}`));
+}

package/dist/core/rest/projects-client/iam-enterprise.d.ts

@@ -0,0 +1,2 @@
+export declare function getEnterpriseDemo(accountId: string): Promise<boolean>;
+export declare function setEnterpriseDemo(accountId: string, enabled: boolean): Promise<boolean>;

package/dist/core/rest/projects-client/iam-enterprise.js

@@ -0,0 +1,11 @@
+import { backendApi } from '../../http/api-client.js';
+import { iamGet, iamUnwrap as unwrap } from './iam-shared.js';
+export async function getEnterpriseDemo(accountId) {
+    return unwrap(await iamGet(`/accounts/${accountId}/iam/enterprise-demo`))
+        .enabled;
+}
+export async function setEnterpriseDemo(accountId, enabled) {
+    return unwrap(await backendApi.put(`/accounts/${accountId}/iam/enterprise-demo`, {
+        enabled,
+    })).enabled;
+}

package/dist/core/rest/projects-client/iam-grants.d.ts

@@ -0,0 +1,21 @@
+import type { ResourceGrantType } from './access.js';
+export interface AccountResourceGrant {
+    grant_id: string;
+    project_id: string;
+    project_name: string;
+    resource_type: ResourceGrantType;
+    resource_id: string;
+    principal_type: 'member' | 'group';
+    principal_id: string;
+    principal_label: string;
+    granted_by: string | null;
+    created_at: string;
+    expires_at: string | null;
+}
+export interface ListAccountResourceGrantsFilter {
+    resourceType?: ResourceGrantType;
+    principalType?: 'member' | 'group';
+    principalId?: string;
+    projectId?: string;
+}
+export declare function listAccountResourceGrants(accountId: string, filter?: ListAccountResourceGrantsFilter): Promise<AccountResourceGrant[]>;

package/dist/core/rest/projects-client/iam-grants.js

@@ -0,0 +1,6 @@
+import { appendQuery } from './iam-query.js';
+import { iamGet, iamUnwrap as unwrap } from './iam-shared.js';
+export async function listAccountResourceGrants(accountId, filter = {}) {
+    const query = appendQuery({ resourceType: filter.resourceType, principalType: filter.principalType, principalId: filter.principalId, projectId: filter.projectId });
+    return unwrap(await iamGet(`/accounts/${accountId}/iam/resource-grants${query}`)).grants;
+}

package/dist/core/rest/projects-client/iam-groups.d.ts

@@ -0,0 +1,65 @@
+import type { AccountGroup, GroupMember } from './iam-types.js';
+export declare function listGroups(accountId: string): Promise<AccountGroup[]>;
+export declare function getGroup(accountId: string, groupId: string): Promise<AccountGroup>;
+export declare function createGroup(accountId: string, input: {
+    name: string;
+    description?: string;
+}): Promise<AccountGroup>;
+export declare function updateGroup(accountId: string, groupId: string, patch: {
+    name?: string;
+    description?: string | null;
+}): Promise<AccountGroup>;
+export declare function deleteGroup(accountId: string, groupId: string): Promise<{
+    deleted: boolean;
+}>;
+export declare function listGroupMembers(accountId: string, groupId: string): Promise<GroupMember[]>;
+export declare function addGroupMembers(accountId: string, groupId: string, userIds: string[]): Promise<{
+    added: number;
+}>;
+export interface GroupProjectGrant {
+    project_id: string;
+    project_name: string;
+    role: 'manager' | 'member';
+    granted_by: string | null;
+    created_at: string;
+    expires_at?: string | null;
+}
+export declare function listGroupProjectGrants(accountId: string, groupId: string): Promise<GroupProjectGrant[]>;
+export declare function removeGroupMember(accountId: string, groupId: string, userId: string): Promise<{
+    removed: boolean;
+}>;
+export interface MemberGroupSummary {
+    group_id: string;
+    name: string;
+    added_at: string;
+}
+export declare function listMemberGroups(accountId: string, userId: string): Promise<MemberGroupSummary[]>;
+export interface MemberProjectAccess {
+    project_id: string;
+    project_name: string;
+    role: 'manager' | 'member';
+    sources: Array<'implicit' | 'direct' | 'group'>;
+    custom_role_policies?: Array<{
+        policy_id: string;
+        role_id: string;
+        role_key: string;
+        role_name: string;
+        source: 'direct' | 'group';
+        group_id: string | null;
+        group_name: string | null;
+        expires_at: string | null;
+    }>;
+}
+export declare function listMemberProjectAccess(accountId: string, userId: string): Promise<{
+    projects: MemberProjectAccess[];
+    account_wide_policies: {
+        policy_id: string;
+        role_id: string;
+        role_key: string;
+        role_name: string;
+        source: "direct" | "group";
+        group_id: string | null;
+        group_name: string | null;
+        expires_at: string | null;
+    }[];
+}>;

package/dist/core/rest/projects-client/iam-groups.js

@@ -0,0 +1,42 @@
+import { backendApi } from '../../http/api-client.js';
+import { iamGet, iamUnwrap as unwrap } from './iam-shared.js';
+export async function listGroups(accountId) {
+    return unwrap(await iamGet(`/accounts/${accountId}/iam/groups`))
+        .groups;
+}
+export async function getGroup(accountId, groupId) {
+    return unwrap(await iamGet(`/accounts/${accountId}/iam/groups/${groupId}`));
+}
+export async function createGroup(accountId, input) {
+    return unwrap(await backendApi.post(`/accounts/${accountId}/iam/groups`, input, {
+        showErrors: false,
+    }));
+}
+export async function updateGroup(accountId, groupId, patch) {
+    return unwrap(await backendApi.patch(`/accounts/${accountId}/iam/groups/${groupId}`, patch));
+}
+export async function deleteGroup(accountId, groupId) {
+    return unwrap(await backendApi.delete(`/accounts/${accountId}/iam/groups/${groupId}`));
+}
+export async function listGroupMembers(accountId, groupId) {
+    return unwrap(await iamGet(`/accounts/${accountId}/iam/groups/${groupId}/members`)).members;
+}
+export async function addGroupMembers(accountId, groupId, userIds) {
+    return unwrap(await backendApi.post(`/accounts/${accountId}/iam/groups/${groupId}/members`, { userIds }));
+}
+export async function listGroupProjectGrants(accountId, groupId) {
+    return unwrap(await iamGet(`/accounts/${accountId}/iam/groups/${groupId}/project-grants`)).grants;
+}
+export async function removeGroupMember(accountId, groupId, userId) {
+    return unwrap(await backendApi.delete(`/accounts/${accountId}/iam/groups/${groupId}/members/${userId}`));
+}
+export async function listMemberGroups(accountId, userId) {
+    return unwrap(await iamGet(`/accounts/${accountId}/iam/members/${userId}/groups`)).groups;
+}
+export async function listMemberProjectAccess(accountId, userId) {
+    const data = unwrap(await iamGet(`/accounts/${accountId}/iam/members/${userId}/project-access`));
+    return {
+        projects: data.projects,
+        account_wide_policies: data.account_wide_policies ?? [],
+    };
+}

package/dist/core/rest/projects-client/iam-policies.d.ts

@@ -0,0 +1,53 @@
+import type { ResourceType, PolicyScopeType, PrincipalType, IamPolicyEffect, PolicyConditions, IamPolicy } from './iam-types.js';
+export interface ListPoliciesFilter {
+    principalType?: PrincipalType;
+    principalId?: string;
+    scopeType?: ResourceType;
+    scopeId?: string | null;
+}
+export declare function listPolicies(accountId: string, filter?: ListPoliciesFilter): Promise<IamPolicy[]>;
+export declare function createPolicy(accountId: string, input: {
+    principalType: PrincipalType;
+    principalId: string;
+    scopeType: PolicyScopeType;
+    scopeId?: string | null;
+    roleId: string;
+    effect?: IamPolicyEffect;
+    conditions?: PolicyConditions;
+    expires_at?: string | null;
+}): Promise<IamPolicy>;
+export declare function updatePolicy(accountId: string, policyId: string, input: {
+    scopeType: PolicyScopeType;
+    scopeId?: string | null;
+    roleId: string;
+    effect: IamPolicyEffect;
+    conditions?: PolicyConditions;
+    expires_at?: string | null;
+}): Promise<IamPolicy>;
+export declare function deletePolicy(accountId: string, policyId: string): Promise<{
+    deleted: boolean;
+}>;
+export interface BulkDeleteResult {
+    deleted: number;
+}
+export declare function bulkDeletePolicies(accountId: string, policyIds: string[]): Promise<BulkDeleteResult>;
+export interface BulkImportEntry {
+    principal_type: PrincipalType;
+    principal_id: string;
+    scope_type: PolicyScopeType;
+    scope_id?: string | null;
+    role_key: string;
+    effect?: IamPolicyEffect;
+    conditions?: PolicyConditions;
+    expires_at?: string | null;
+}
+export interface BulkImportResult {
+    attempted: number;
+    created: number;
+    skipped: number;
+    errors: Array<{
+        index: number;
+        error: string;
+    }>;
+}
+export declare function bulkImportPolicies(accountId: string, policies: BulkImportEntry[]): Promise<BulkImportResult>;

package/dist/core/rest/projects-client/iam-policies.js

@@ -0,0 +1,26 @@
+import { appendQuery } from './iam-query.js';
+import { backendApi } from '../../http/api-client.js';
+import { iamGet, iamUnwrap as unwrap } from './iam-shared.js';
+export async function listPolicies(accountId, filter = {}) {
+    const query = appendQuery({ principalType: filter.principalType, principalId: filter.principalId, scopeType: filter.scopeType, scopeId: filter.scopeId === null ? 'null' : filter.scopeId });
+    return unwrap(await iamGet(`/accounts/${accountId}/iam/policies${query}`)).policies;
+}
+export async function createPolicy(accountId, input) {
+    return unwrap(await backendApi.post(`/accounts/${accountId}/iam/policies`, input, {
+        showErrors: false,
+    }));
+}
+export async function updatePolicy(accountId, policyId, input) {
+    return unwrap(await backendApi.patch(`/accounts/${accountId}/iam/policies/${policyId}`, input, {
+        showErrors: false,
+    }));
+}
+export async function deletePolicy(accountId, policyId) {
+    return unwrap(await backendApi.delete(`/accounts/${accountId}/iam/policies/${policyId}`));
+}
+export async function bulkDeletePolicies(accountId, policyIds) {
+    return unwrap(await backendApi.post(`/accounts/${accountId}/iam/policies:bulk-delete`, { policy_ids: policyIds }, { showErrors: false }));
+}
+export async function bulkImportPolicies(accountId, policies) {
+    return unwrap(await backendApi.post(`/accounts/${accountId}/iam/policies:bulk-import`, { policies }, { showErrors: false }));
+}

package/dist/core/rest/projects-client/iam-probe.d.ts

@@ -0,0 +1,27 @@
+import type { ResourceType, EffectivePermissionProbe } from './iam-types.js';
+export declare function probeEffectivePermission(accountId: string, userId: string, args: PermissionProbeInput): Promise<EffectivePermissionProbe>;
+type NonAccountPermissionProbeTarget = {
+    [Type in Exclude<ResourceType, 'account'>]: {
+        resourceType: Type;
+        resourceId: string;
+    };
+}[Exclude<ResourceType, 'account'>];
+export type PermissionProbeTarget = {
+    resourceType: 'account';
+    resourceId?: never;
+} | NonAccountPermissionProbeTarget;
+export type PermissionProbeInput = {
+    action: string;
+} & ({
+    resourceType?: never;
+    resourceId?: never;
+} | PermissionProbeTarget);
+export interface PermissionProbeResult {
+    action: string;
+    resource_type: ResourceType;
+    resource_id: string | null;
+    allowed: boolean;
+    reason: string | null;
+}
+export declare function probeEffectivePermissions(accountId: string, userId: string, probes: PermissionProbeInput[]): Promise<PermissionProbeResult[]>;
+export {};

package/dist/core/rest/projects-client/iam-probe.js

@@ -0,0 +1,16 @@
+import { backendApi } from '../../http/api-client.js';
+import { iamGet, iamUnwrap as unwrap } from './iam-shared.js';
+export async function probeEffectivePermission(accountId, userId, args) {
+    const params = new URLSearchParams();
+    params.set('action', args.action);
+    if (args.resourceType)
+        params.set('resourceType', args.resourceType);
+    if (args.resourceId)
+        params.set('resourceId', args.resourceId);
+    return unwrap(await iamGet(`/accounts/${accountId}/iam/members/${userId}/effective?${params.toString()}`));
+}
+export async function probeEffectivePermissions(accountId, userId, probes) {
+    if (probes.length === 0)
+        return [];
+    return unwrap(await backendApi.post(`/accounts/${accountId}/iam/members/${userId}/effective:batch`, { probes })).results;
+}

package/dist/core/rest/projects-client/iam-query.d.ts

@@ -0,0 +1 @@
+export declare function appendQuery(entries: Record<string, string | number | null | undefined>): string;

package/dist/core/rest/projects-client/iam-query.js

@@ -0,0 +1,9 @@
+export function appendQuery(entries) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(entries)) {
+        if (value)
+            params.set(key, String(value));
+    }
+    const qs = params.toString();
+    return qs ? `?${qs}` : '';
+}

package/dist/core/rest/projects-client/iam-roles.d.ts

@@ -0,0 +1,47 @@
+import type { ResourceType, IamRole } from './iam-types.js';
+export declare function listRoles(accountId: string): Promise<IamRole[]>;
+export interface AgentIdentity {
+    service_account_id: string;
+    name: string;
+    project_id: string | null;
+    agent_name: string | null;
+}
+export declare function listAgentIdentities(accountId: string): Promise<AgentIdentity[]>;
+export declare function listProjectAgentIdentities(projectId: string): Promise<AgentIdentity[]>;
+export declare function getRolePermissions(accountId: string, roleId: string): Promise<{
+    role_id: string;
+    key: string;
+    actions: string[];
+}>;
+export interface ActionCatalogEntry {
+    action: string;
+    label: string;
+    resource_type: ResourceType;
+}
+export declare function listActions(accountId: string): Promise<ActionCatalogEntry[]>;
+export declare function getRoleUsage(accountId: string, roleId: string): Promise<{
+    role_id: string;
+    policy_count: number;
+}>;
+export declare function createRole(accountId: string, input: {
+    key: string;
+    name: string;
+    description?: string;
+    resourceType: ResourceType;
+    actions: string[];
+}): Promise<IamRole>;
+export declare function updateRole(accountId: string, roleId: string, patch: {
+    name?: string;
+    description?: string | null;
+}): Promise<IamRole>;
+export declare function updateRolePermissions(accountId: string, roleId: string, actions: string[]): Promise<{
+    role_id: string;
+    actions: string[];
+}>;
+export declare function deleteRole(accountId: string, roleId: string): Promise<{
+    deleted: boolean;
+}>;
+export declare function setMemberSuperAdmin(accountId: string, userId: string, isSuperAdmin: boolean): Promise<{
+    user_id: string;
+    is_super_admin: boolean;
+}>;