@inkeep/agents-core 0.0.0-dev-20260123205017 → 0.0.0-dev-20260123212735

package/dist/auth/auth.d.ts

@@ -2,7 +2,7 @@ import { AgentsRunDatabaseClient } from "../db/runtime/runtime-client.js";
 import * as _better_auth_sso0 from "@better-auth/sso";
 import * as better_auth0 from "better-auth";
 import { BetterAuthAdvancedOptions } from "better-auth";
-import * as better_auth_plugins20 from "better-auth/plugins";
+import * as better_auth_plugins0 from "better-auth/plugins";
 import * as zod0 from "zod";
 import { GoogleOptions } from "better-auth/social-providers";
 
@@ -219,7 +219,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>;
       }[];
     };
-    options: better_auth_plugins20.BearerOptions | undefined;
+    options: better_auth_plugins0.BearerOptions | undefined;
   }, {
     id: "sso";
     endpoints: {
@@ -847,30 +847,30 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
     };
   }, {
     id: "organization";
-    endpoints: better_auth_plugins20.OrganizationEndpoints<{
+    endpoints: better_auth_plugins0.OrganizationEndpoints<{
       allowUserToCreateOrganization: true;
-      ac: better_auth_plugins20.AccessControl;
+      ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key] | {
-            actions: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-          statements: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key] | {
-            actions: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-          statements: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key] | {
-            actions: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-          statements: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
         };
       };
       membershipLimit: number;
@@ -880,9 +880,9 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         id: string;
         role: string;
         email: string;
-        organization: better_auth_plugins20.Organization;
-        invitation: better_auth_plugins20.Invitation;
-        inviter: better_auth_plugins20.Member & {
+        organization: better_auth_plugins0.Organization;
+        invitation: better_auth_plugins0.Invitation;
+        inviter: better_auth_plugins0.Member & {
           user: better_auth0.User;
         };
       }): Promise<void>;
@@ -892,28 +892,28 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
           user,
           organization: org
         }: {
-          invitation: better_auth_plugins20.Invitation & Record<string, any>;
-          member: better_auth_plugins20.Member & Record<string, any>;
+          invitation: better_auth_plugins0.Invitation & Record<string, any>;
+          member: better_auth_plugins0.Member & Record<string, any>;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins20.Organization & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
-        afterUpdateMemberRole: ({
+        beforeUpdateMemberRole: ({
           member,
           organization: org,
-          previousRole
+          newRole
         }: {
-          member: better_auth_plugins20.Member & Record<string, any>;
-          previousRole: string;
+          member: better_auth_plugins0.Member & Record<string, any>;
+          newRole: string;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins20.Organization & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
         afterRemoveMember: ({
           member,
           organization: org
         }: {
-          member: better_auth_plugins20.Member & Record<string, any>;
+          member: better_auth_plugins0.Member & Record<string, any>;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins20.Organization & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
       };
     }>;
@@ -1044,8 +1044,8 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         id: string;
         organizationId: string;
         email: string;
-        role: "member" | "admin" | "owner";
-        status: better_auth_plugins20.InvitationStatus;
+        role: "member" | "owner" | "admin";
+        status: better_auth_plugins0.InvitationStatus;
         inviterId: string;
         expiresAt: Date;
         createdAt: Date;
@@ -1053,7 +1053,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       Member: {
         id: string;
         organizationId: string;
-        role: "member" | "admin" | "owner";
+        role: "member" | "owner" | "admin";
         createdAt: Date;
         userId: string;
         user: {
@@ -1069,7 +1069,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         members: {
           id: string;
           organizationId: string;
-          role: "member" | "admin" | "owner";
+          role: "member" | "owner" | "admin";
           createdAt: Date;
           userId: string;
           user: {
@@ -1083,8 +1083,8 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
           id: string;
           organizationId: string;
           email: string;
-          role: "member" | "admin" | "owner";
-          status: better_auth_plugins20.InvitationStatus;
+          role: "member" | "owner" | "admin";
+          status: better_auth_plugins0.InvitationStatus;
           inviterId: string;
           expiresAt: Date;
           createdAt: Date;
@@ -1158,28 +1158,28 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
     };
     options: NoInfer<{
       allowUserToCreateOrganization: true;
-      ac: better_auth_plugins20.AccessControl;
+      ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key] | {
-            actions: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-          statements: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key] | {
-            actions: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-          statements: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key] | {
-            actions: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-          statements: better_auth_plugins20.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins20.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
         };
       };
       membershipLimit: number;
@@ -1189,9 +1189,9 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         id: string;
         role: string;
         email: string;
-        organization: better_auth_plugins20.Organization;
-        invitation: better_auth_plugins20.Invitation;
-        inviter: better_auth_plugins20.Member & {
+        organization: better_auth_plugins0.Organization;
+        invitation: better_auth_plugins0.Invitation;
+        inviter: better_auth_plugins0.Member & {
           user: better_auth0.User;
         };
       }): Promise<void>;
@@ -1201,28 +1201,28 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
           user,
           organization: org
         }: {
-          invitation: better_auth_plugins20.Invitation & Record<string, any>;
-          member: better_auth_plugins20.Member & Record<string, any>;
+          invitation: better_auth_plugins0.Invitation & Record<string, any>;
+          member: better_auth_plugins0.Member & Record<string, any>;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins20.Organization & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
-        afterUpdateMemberRole: ({
+        beforeUpdateMemberRole: ({
           member,
           organization: org,
-          previousRole
+          newRole
         }: {
-          member: better_auth_plugins20.Member & Record<string, any>;
-          previousRole: string;
+          member: better_auth_plugins0.Member & Record<string, any>;
+          newRole: string;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins20.Organization & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
         afterRemoveMember: ({
           member,
           organization: org
         }: {
-          member: better_auth_plugins20.Member & Record<string, any>;
+          member: better_auth_plugins0.Member & Record<string, any>;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins20.Organization & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
       };
     }>;
@@ -1559,8 +1559,8 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       readonly AUTHENTICATION_REQUIRED: "Authentication required";
     };
     options: Partial<{
-      expiresIn: better_auth_plugins20.TimeString;
-      interval: better_auth_plugins20.TimeString;
+      expiresIn: better_auth_plugins0.TimeString;
+      interval: better_auth_plugins0.TimeString;
       deviceCodeLength: number;
       userCodeLength: number;
       schema: {

package/dist/auth/auth.js

@@ -1,4 +1,5 @@
 import { member, ssoProvider } from "./auth-schema.js";
+import { OrgRoles } from "./authz/config.js";
 import { env } from "../env.js";
 import { generateId } from "../utils/conversations.js";
 import "../utils/index.js";
@@ -163,20 +164,23 @@ function createAuth(config) {
 							console.error("❌ SpiceDB sync failed for new member:", error);
 						}
 					},
-					afterUpdateMemberRole: async ({ member: member$1, organization: org, previousRole }) => {
-						try {
-							const { changeOrgRole } = await import("./authz/sync.js");
-							const oldRole = previousRole;
-							const newRole = member$1.role;
-							await changeOrgRole({
+					beforeUpdateMemberRole: async ({ member: member$1, organization: org, newRole }) => {
+						const { changeOrgRole, revokeAllProjectMemberships } = await import("./authz/sync.js");
+						const oldRole = member$1.role;
+						const targetRole = newRole;
+						await changeOrgRole({
+							tenantId: org.id,
+							userId: member$1.userId,
+							oldRole,
+							newRole: targetRole
+						});
+						console.log(`🔐 SpiceDB: Updated member ${member$1.userId} role from ${oldRole} to ${targetRole} in org ${org.name}`);
+						if (oldRole === OrgRoles.MEMBER && (targetRole === OrgRoles.ADMIN || targetRole === OrgRoles.OWNER)) {
+							await revokeAllProjectMemberships({
 								tenantId: org.id,
-								userId: member$1.userId,
-								oldRole,
-								newRole
+								userId: member$1.userId
 							});
-							console.log(`🔐 SpiceDB: Updated member ${member$1.userId} role from ${oldRole} to ${newRole} in org ${org.name}`);
-						} catch (error) {
-							console.error("❌ SpiceDB sync failed for role update:", error);
+							console.log(`🔐 SpiceDB: Revoked all project memberships for ${member$1.userId} (promoted to ${targetRole})`);
 						}
 					},
 					afterRemoveMember: async ({ member: member$1, organization: org }) => {

package/dist/auth/authz/client.d.ts

@@ -12,9 +12,11 @@ declare function getSpiceClient(): ZedClientInterface;
  * Reset the client (useful for testing)
  */
 declare function resetSpiceClient(): void;
+declare const RelationshipOperation: typeof v1.RelationshipUpdate_Operation;
+declare const Permissionship: typeof v1.CheckPermissionResponse_Permissionship;
 /**
  * Check if a subject has a permission on a resource.
- * Note: Caller must verify isAuthzEnabled(tenantId) before calling.
+ * Note: Caller must verify isAuthzEnabled() before calling.
  */
 declare function checkPermission(params: {
   resourceType: string;
@@ -67,15 +69,19 @@ declare function deleteRelationship(params: {
 }): Promise<void>;
 /**
  * Read relationships for a resource to list subjects with access.
+ * Optionally filter by subject type and ID.
  */
 declare function readRelationships(params: {
   resourceType: string;
-  resourceId: string;
+  resourceId?: string;
   relation?: string;
+  subjectType?: string;
+  subjectId?: string;
 }): Promise<Array<{
+  resourceId: string;
   subjectType: string;
   subjectId: string;
   relation: string;
 }>>;
 //#endregion
-export { checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, v1, writeRelationship };
+export { Permissionship, RelationshipOperation, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, v1, writeRelationship };

package/dist/auth/authz/client.js

@@ -7,6 +7,7 @@ import { v1 } from "@authzed/authzed-node";
 *
 * Provides a singleton SpiceDB client and helper functions for common operations.
 */
+const { RelationshipUpdate_Operation, CheckPermissionResponse_Permissionship } = v1;
 let client = null;
 /**
 * Get the SpiceDB client singleton.
@@ -25,11 +26,11 @@ function getSpiceClient() {
 function resetSpiceClient() {
 	client = null;
 }
-const PERMISSIONSHIP_HAS_PERMISSION = 2;
-const RELATIONSHIP_OPERATION_CREATE = 1;
+const RelationshipOperation = RelationshipUpdate_Operation;
+const Permissionship = CheckPermissionResponse_Permissionship;
 /**
 * Check if a subject has a permission on a resource.
-* Note: Caller must verify isAuthzEnabled(tenantId) before calling.
+* Note: Caller must verify isAuthzEnabled() before calling.
 */
 async function checkPermission(params) {
 	return (await getSpiceClient().promises.checkPermission({
@@ -46,12 +47,12 @@ async function checkPermission(params) {
 			optionalRelation: ""
 		},
 		consistency: { requirement: {
-			oneofKind: "minimizeLatency",
-			minimizeLatency: true
+			oneofKind: "fullyConsistent",
+			fullyConsistent: true
 		} },
 		context: void 0,
 		withTracing: false
-	})).permissionship === PERMISSIONSHIP_HAS_PERMISSION;
+	})).permissionship === CheckPermissionResponse_Permissionship.HAS_PERMISSION;
 }
 /**
 * Check multiple permissions on a resource in a single request.
@@ -75,15 +76,15 @@ async function checkBulkPermissions(params) {
 	const response = await spice.promises.checkBulkPermissions(v1.CheckBulkPermissionsRequest.create({
 		items,
 		consistency: { requirement: {
-			oneofKind: "minimizeLatency",
-			minimizeLatency: true
+			oneofKind: "fullyConsistent",
+			fullyConsistent: true
 		} }
 	}));
 	const result = {};
 	for (let i = 0; i < params.permissions.length; i++) {
 		const permission = params.permissions[i];
 		const pair = response.pairs[i];
-		if (pair.response.oneofKind === "item") result[permission] = pair.response.item.permissionship === PERMISSIONSHIP_HAS_PERMISSION;
+		if (pair.response.oneofKind === "item") result[permission] = pair.response.item.permissionship === CheckPermissionResponse_Permissionship.HAS_PERMISSION;
 		else result[permission] = false;
 	}
 	return result;
@@ -103,8 +104,8 @@ async function lookupResources(params) {
 			optionalRelation: ""
 		},
 		consistency: { requirement: {
-			oneofKind: "minimizeLatency",
-			minimizeLatency: true
+			oneofKind: "fullyConsistent",
+			fullyConsistent: true
 		} },
 		context: void 0,
 		optionalLimit: 0,
@@ -117,7 +118,7 @@ async function lookupResources(params) {
 async function writeRelationship(params) {
 	await getSpiceClient().promises.writeRelationships({
 		updates: [{
-			operation: RELATIONSHIP_OPERATION_CREATE,
+			operation: RelationshipUpdate_Operation.TOUCH,
 			relationship: {
 				resource: {
 					objectType: params.resourceType,
@@ -162,23 +163,29 @@ async function deleteRelationship(params) {
 }
 /**
 * Read relationships for a resource to list subjects with access.
+* Optionally filter by subject type and ID.
 */
 async function readRelationships(params) {
 	return (await getSpiceClient().promises.readRelationships({
 		relationshipFilter: {
 			resourceType: params.resourceType,
-			optionalResourceId: params.resourceId,
+			optionalResourceId: params.resourceId || "",
 			optionalResourceIdPrefix: "",
 			optionalRelation: params.relation || "",
-			optionalSubjectFilter: void 0
+			optionalSubjectFilter: params.subjectType || params.subjectId ? {
+				subjectType: params.subjectType || "",
+				optionalSubjectId: params.subjectId || "",
+				optionalRelation: void 0
+			} : void 0
 		},
 		consistency: { requirement: {
-			oneofKind: "minimizeLatency",
-			minimizeLatency: true
+			oneofKind: "fullyConsistent",
+			fullyConsistent: true
 		} },
 		optionalLimit: 0,
 		optionalCursor: void 0
 	})).map((item) => ({
+		resourceId: item.relationship?.resource?.objectId || "",
 		subjectType: item.relationship?.subject?.object?.objectType || "",
 		subjectId: item.relationship?.subject?.object?.objectId || "",
 		relation: item.relationship?.relation || ""
@@ -186,4 +193,4 @@ async function readRelationships(params) {
 }
 
 //#endregion
-export { checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, v1, writeRelationship };
+export { Permissionship, RelationshipOperation, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, v1, writeRelationship };

package/dist/auth/authz/config.d.ts

@@ -4,20 +4,10 @@
  *
  * Feature flag and configuration for the SpiceDB authorization system.
  */
-/**
- * Check if authorization is enabled.
- *
- * When called without tenantId:
- * - Returns true if ENABLE_AUTHZ=true
- *
- * When called with tenantId:
- * - If ENABLE_AUTHZ=false → returns false
- * - If ENABLE_AUTHZ=true and TENANT_ID is not set → returns true (all tenants)
- * - If ENABLE_AUTHZ=true and TENANT_ID is set → returns true only if tenantId matches
- */
-declare function isAuthzEnabled(tenantId: string): boolean;
+declare function isAuthzEnabled(): boolean;
 /**
  * Get SpiceDB connection configuration from environment variables.
+ * TLS is auto-detected: disabled for localhost, enabled for remote endpoints.
  */
 declare function getSpiceDbConfig(): {
   endpoint: string;
@@ -48,29 +38,66 @@ declare const SpiceDbRelations: {
   readonly PROJECT_VIEWER: "project_viewer";
 };
 /**
- * SpiceDB permissions used in the schema
+ * SpiceDB permissions for organization resources.
  *
- * Permissions are named as verbs (actions) per SpiceDB best practices.
+ * From schema.zed definition organization:
+ * - view: owner + admin + member
+ * - manage: owner + admin (includes managing org settings and all projects)
  */
+declare const SpiceDbOrgPermissions: {
+  readonly VIEW: "view";
+  readonly MANAGE: "manage";
+};
+type SpiceDbOrgPermission = (typeof SpiceDbOrgPermissions)[keyof typeof SpiceDbOrgPermissions];
 /**
- * SpiceDB permissions used in permission checks.
+ * SpiceDB permissions for project resources.
  *
- * Note: Organization-level permissions (manage) are handled via
- * orgRole bypass in permission functions, not direct SpiceDB checks.
+ * From schema.zed definition project:
+ * - view: read-only access to project and its resources
+ * - use: invoke agents, create API keys, view traces
+ * - edit: modify configurations, manage members
  */
-declare const SpiceDbPermissions: {
+declare const SpiceDbProjectPermissions: {
   readonly VIEW: "view";
   readonly USE: "use";
   readonly EDIT: "edit";
-  readonly DELETE: "delete";
 };
-type OrgRole = 'owner' | 'admin' | 'member';
+type SpiceDbProjectPermission = (typeof SpiceDbProjectPermissions)[keyof typeof SpiceDbProjectPermissions];
+/**
+ * Permission levels for project access checks.
+ */
+type ProjectPermissionLevel = SpiceDbProjectPermission;
+/**
+ * Organization roles from SpiceDB schema.
+ */
+declare const OrgRoles: {
+  readonly OWNER: "owner";
+  readonly ADMIN: "admin";
+  readonly MEMBER: "member";
+};
+type OrgRole = (typeof OrgRoles)[keyof typeof OrgRoles];
 /**
- * Project roles hierarchy:
- * - project_admin: Full access (view + use + edit + manage members + delete)
+ * Project roles from SpiceDB schema.
+ *
+ * Hierarchy:
+ * - project_admin: Full access (view + use + edit + manage members)
  * - project_member: Operator access (view + use: invoke agents, create API keys)
  * - project_viewer: Read-only access (view only)
  */
-type ProjectRole = 'project_admin' | 'project_member' | 'project_viewer';
+declare const ProjectRoles: {
+  readonly ADMIN: "project_admin";
+  readonly MEMBER: "project_member";
+  readonly VIEWER: "project_viewer";
+};
+type ProjectRole = (typeof ProjectRoles)[keyof typeof ProjectRoles];
+/**
+ * Project permission capabilities.
+ * Maps to the SpiceDB permission checks (view, use, edit).
+ */
+interface ProjectPermissions {
+  canView: boolean;
+  canUse: boolean;
+  canEdit: boolean;
+}
 //#endregion
-export { OrgRole, ProjectRole, SpiceDbPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled };
+export { OrgRole, OrgRoles, ProjectPermissionLevel, ProjectPermissions, ProjectRole, ProjectRoles, SpiceDbOrgPermission, SpiceDbOrgPermissions, SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled };