@inkeep/agents-core 0.0.0-dev-20260123205017 → 0.0.0-dev-20260123212735

package/dist/auth/authz/config.js

@@ -4,31 +4,20 @@
 *
 * Feature flag and configuration for the SpiceDB authorization system.
 */
-/**
-* Check if authorization is enabled.
-*
-* When called without tenantId:
-* - Returns true if ENABLE_AUTHZ=true
-*
-* When called with tenantId:
-* - If ENABLE_AUTHZ=false → returns false
-* - If ENABLE_AUTHZ=true and TENANT_ID is not set → returns true (all tenants)
-* - If ENABLE_AUTHZ=true and TENANT_ID is set → returns true only if tenantId matches
-*/
-function isAuthzEnabled(tenantId) {
-	if (process.env.ENABLE_AUTHZ !== "true") return false;
-	const configuredTenantId = process.env.TENANT_ID?.trim();
-	if (!configuredTenantId) return true;
-	return tenantId === configuredTenantId;
+function isAuthzEnabled() {
+	return process.env.ENABLE_AUTHZ === "true";
 }
 /**
 * Get SpiceDB connection configuration from environment variables.
+* TLS is auto-detected: disabled for localhost, enabled for remote endpoints.
 */
 function getSpiceDbConfig() {
+	const endpoint = process.env.SPICEDB_ENDPOINT || "localhost:50051";
+	const isLocalhost = endpoint.startsWith("localhost") || endpoint.startsWith("127.0.0.1");
 	return {
-		endpoint: process.env.SPICEDB_ENDPOINT || "localhost:50051",
+		endpoint,
 		token: process.env.SPICEDB_PRESHARED_KEY || "",
-		tlsEnabled: process.env.SPICEDB_TLS_ENABLED === "true"
+		tlsEnabled: !isLocalhost
 	};
 }
 /**
@@ -55,22 +44,50 @@ const SpiceDbRelations = {
 	PROJECT_VIEWER: "project_viewer"
 };
 /**
-* SpiceDB permissions used in the schema
+* SpiceDB permissions for organization resources.
 *
-* Permissions are named as verbs (actions) per SpiceDB best practices.
+* From schema.zed definition organization:
+* - view: owner + admin + member
+* - manage: owner + admin (includes managing org settings and all projects)
 */
+const SpiceDbOrgPermissions = {
+	VIEW: "view",
+	MANAGE: "manage"
+};
 /**
-* SpiceDB permissions used in permission checks.
+* SpiceDB permissions for project resources.
 *
-* Note: Organization-level permissions (manage) are handled via
-* orgRole bypass in permission functions, not direct SpiceDB checks.
+* From schema.zed definition project:
+* - view: read-only access to project and its resources
+* - use: invoke agents, create API keys, view traces
+* - edit: modify configurations, manage members
 */
-const SpiceDbPermissions = {
+const SpiceDbProjectPermissions = {
 	VIEW: "view",
 	USE: "use",
-	EDIT: "edit",
-	DELETE: "delete"
+	EDIT: "edit"
+};
+/**
+* Organization roles from SpiceDB schema.
+*/
+const OrgRoles = {
+	OWNER: "owner",
+	ADMIN: "admin",
+	MEMBER: "member"
+};
+/**
+* Project roles from SpiceDB schema.
+*
+* Hierarchy:
+* - project_admin: Full access (view + use + edit + manage members)
+* - project_member: Operator access (view + use: invoke agents, create API keys)
+* - project_viewer: Read-only access (view only)
+*/
+const ProjectRoles = {
+	ADMIN: "project_admin",
+	MEMBER: "project_member",
+	VIEWER: "project_viewer"
 };
 
 //#endregion
-export { SpiceDbPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled };
+export { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled };

package/dist/auth/authz/index.d.ts

@@ -1,5 +1,5 @@
 import { checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, writeRelationship } from "./client.js";
-import { OrgRole, ProjectRole, SpiceDbPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled } from "./config.js";
+import { OrgRole, OrgRoles, ProjectPermissionLevel, ProjectPermissions, ProjectRole, ProjectRoles, SpiceDbOrgPermission, SpiceDbOrgPermissions, SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled } from "./config.js";
 import { canEditProject, canUseProject, canViewProject, listAccessibleProjectIds } from "./permissions.js";
-import { changeProjectRole, grantProjectAccess, listProjectMembers, removeProjectFromSpiceDb, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb } from "./sync.js";
-export { type OrgRole, type ProjectRole, SpiceDbPermissions, SpiceDbRelations, SpiceDbResourceTypes, canEditProject, canUseProject, canViewProject, changeProjectRole, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, getSpiceDbConfig, grantProjectAccess, isAuthzEnabled, listAccessibleProjectIds, listProjectMembers, lookupResources, readRelationships, removeProjectFromSpiceDb, resetSpiceClient, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb, writeRelationship };
+import { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb } from "./sync.js";
+export { type OrgRole, OrgRoles, type ProjectPermissionLevel, type ProjectPermissions, type ProjectRole, ProjectRoles, type SpiceDbOrgPermission, SpiceDbOrgPermissions, type SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, canEditProject, canUseProject, canViewProject, changeOrgRole, changeProjectRole, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, getSpiceDbConfig, grantProjectAccess, isAuthzEnabled, listAccessibleProjectIds, listProjectMembers, listUserProjectMembershipsInSpiceDb, lookupResources, readRelationships, removeProjectFromSpiceDb, resetSpiceClient, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb, writeRelationship };

package/dist/auth/authz/index.js

@@ -1,6 +1,6 @@
-import { SpiceDbPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled } from "./config.js";
+import { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled } from "./config.js";
 import { checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, writeRelationship } from "./client.js";
 import { canEditProject, canUseProject, canViewProject, listAccessibleProjectIds } from "./permissions.js";
-import { changeProjectRole, grantProjectAccess, listProjectMembers, removeProjectFromSpiceDb, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb } from "./sync.js";
+import { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb } from "./sync.js";
 
-export { SpiceDbPermissions, SpiceDbRelations, SpiceDbResourceTypes, canEditProject, canUseProject, canViewProject, changeProjectRole, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, getSpiceDbConfig, grantProjectAccess, isAuthzEnabled, listAccessibleProjectIds, listProjectMembers, lookupResources, readRelationships, removeProjectFromSpiceDb, resetSpiceClient, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb, writeRelationship };
+export { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, canEditProject, canUseProject, canViewProject, changeOrgRole, changeProjectRole, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, getSpiceDbConfig, grantProjectAccess, isAuthzEnabled, listAccessibleProjectIds, listProjectMembers, listUserProjectMembershipsInSpiceDb, lookupResources, readRelationships, removeProjectFromSpiceDb, resetSpiceClient, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb, writeRelationship };

package/dist/auth/authz/permissions.d.ts

@@ -10,7 +10,6 @@ import { OrgRole } from "./config.js";
  * - Otherwise: checks SpiceDB
  */
 declare function canViewProject(params: {
-  tenantId: string;
   userId: string;
   projectId: string;
   orgRole: OrgRole;
@@ -23,7 +22,6 @@ declare function canViewProject(params: {
  * - Otherwise: checks SpiceDB for use permission
  */
 declare function canUseProject(params: {
-  tenantId: string;
   userId: string;
   projectId: string;
   orgRole: OrgRole;
@@ -36,7 +34,6 @@ declare function canUseProject(params: {
  * - Otherwise: checks SpiceDB for edit permission
  */
 declare function canEditProject(params: {
-  tenantId: string;
   userId: string;
   projectId: string;
   orgRole: OrgRole;
@@ -49,7 +46,6 @@ declare function canEditProject(params: {
  * - Otherwise: uses SpiceDB LookupResources
  */
 declare function listAccessibleProjectIds(params: {
-  tenantId: string;
   userId: string;
   orgRole: OrgRole;
 }): Promise<string[] | 'all'>;

package/dist/auth/authz/permissions.js

@@ -1,4 +1,4 @@
-import { SpiceDbPermissions, SpiceDbResourceTypes, isAuthzEnabled } from "./config.js";
+import { OrgRoles, SpiceDbProjectPermissions, SpiceDbResourceTypes, isAuthzEnabled } from "./config.js";
 import { checkPermission, lookupResources } from "./client.js";
 
 //#region src/auth/authz/permissions.ts
@@ -15,12 +15,12 @@ import { checkPermission, lookupResources } from "./client.js";
 * - Otherwise: checks SpiceDB
 */
 async function canViewProject(params) {
-	if (!isAuthzEnabled(params.tenantId)) return true;
-	if (params.orgRole === "owner" || params.orgRole === "admin") return true;
+	const isAdmin = params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN;
+	if (!isAuthzEnabled() || isAdmin) return true;
 	return checkPermission({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
-		permission: SpiceDbPermissions.VIEW,
+		permission: SpiceDbProjectPermissions.VIEW,
 		subjectType: SpiceDbResourceTypes.USER,
 		subjectId: params.userId
 	});
@@ -33,12 +33,12 @@ async function canViewProject(params) {
 * - Otherwise: checks SpiceDB for use permission
 */
 async function canUseProject(params) {
-	if (!isAuthzEnabled(params.tenantId)) return true;
-	if (params.orgRole === "owner" || params.orgRole === "admin") return true;
+	const isAdmin = params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN;
+	if (!isAuthzEnabled() || isAdmin) return true;
 	return checkPermission({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
-		permission: SpiceDbPermissions.USE,
+		permission: SpiceDbProjectPermissions.USE,
 		subjectType: SpiceDbResourceTypes.USER,
 		subjectId: params.userId
 	});
@@ -51,12 +51,12 @@ async function canUseProject(params) {
 * - Otherwise: checks SpiceDB for edit permission
 */
 async function canEditProject(params) {
-	if (!isAuthzEnabled(params.tenantId)) return params.orgRole === "owner" || params.orgRole === "admin";
-	if (params.orgRole === "owner" || params.orgRole === "admin") return true;
+	if (params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN) return true;
+	if (!isAuthzEnabled()) return false;
 	return checkPermission({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
-		permission: SpiceDbPermissions.EDIT,
+		permission: SpiceDbProjectPermissions.EDIT,
 		subjectType: SpiceDbResourceTypes.USER,
 		subjectId: params.userId
 	});
@@ -69,11 +69,11 @@ async function canEditProject(params) {
 * - Otherwise: uses SpiceDB LookupResources
 */
 async function listAccessibleProjectIds(params) {
-	if (!isAuthzEnabled(params.tenantId)) return "all";
-	if (params.orgRole === "owner" || params.orgRole === "admin") return "all";
+	const isAdmin = params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN;
+	if (!isAuthzEnabled() || isAdmin) return "all";
 	return lookupResources({
 		resourceType: SpiceDbResourceTypes.PROJECT,
-		permission: SpiceDbPermissions.VIEW,
+		permission: SpiceDbProjectPermissions.VIEW,
 		subjectType: SpiceDbResourceTypes.USER,
 		subjectId: params.userId
 	});

package/dist/auth/authz/sync.d.ts

@@ -25,7 +25,7 @@ declare function changeOrgRole(params: {
 }): Promise<void>;
 /**
  * Sync a new project to SpiceDB.
- * Links project to org and grants creator project_admin role.
+ * Links project to org and grants creator project_admin role (if not already org admin/owner).
  * Call when: project is created.
  */
 declare function syncProjectToSpiceDb(params: {
@@ -81,5 +81,26 @@ declare function listProjectMembers(params: {
   userId: string;
   role: ProjectRole;
 }>>;
+/**
+ * List all project memberships for a specific user.
+ * Returns projects where the user has explicit project_admin, project_member, or project_viewer roles.
+ */
+declare function listUserProjectMembershipsInSpiceDb(params: {
+  tenantId: string;
+  userId: string;
+}): Promise<Array<{
+  projectId: string;
+  role: ProjectRole;
+}>>;
+/**
+ * Revoke all project memberships for a user.
+ * Call when: user is promoted to org admin (they get inherited access, explicit project roles become redundant).
+ *
+ * Uses efficient bulk delete - deletes all project relationships for user without listing first.
+ */
+declare function revokeAllProjectMemberships(params: {
+  tenantId: string;
+  userId: string;
+}): Promise<void>;
 //#endregion
-export { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, removeProjectFromSpiceDb, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb };
+export { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb };

package/dist/auth/authz/sync.js

@@ -1,5 +1,5 @@
 import { SpiceDbRelations, SpiceDbResourceTypes, isAuthzEnabled } from "./config.js";
-import { deleteRelationship, getSpiceClient, readRelationships, writeRelationship } from "./client.js";
+import { RelationshipOperation, deleteRelationship, getSpiceClient, readRelationships, writeRelationship } from "./client.js";
 
 //#region src/auth/authz/sync.ts
 /**
@@ -7,15 +7,12 @@ import { deleteRelationship, getSpiceClient, readRelationships, writeRelationshi
 *
 * Functions for syncing data between better-auth and SpiceDB.
 */
-const RELATIONSHIP_OPERATION_CREATE = 1;
-const RELATIONSHIP_OPERATION_TOUCH = 2;
-const RELATIONSHIP_OPERATION_DELETE = 3;
 /**
 * Sync a user's org membership to SpiceDB.
 * Call when: user joins org, role changes, user leaves org.
 */
 async function syncOrgMemberToSpiceDb(params) {
-	if (!isAuthzEnabled(params.tenantId)) return;
+	if (!isAuthzEnabled()) return;
 	if (params.action === "add") await writeRelationship({
 		resourceType: SpiceDbResourceTypes.ORGANIZATION,
 		resourceId: params.tenantId,
@@ -37,11 +34,11 @@ async function syncOrgMemberToSpiceDb(params) {
 * Call when: user's org role is updated (e.g., member -> admin).
 */
 async function changeOrgRole(params) {
-	if (!isAuthzEnabled(params.tenantId)) return;
+	if (!isAuthzEnabled()) return;
 	if (params.oldRole === params.newRole) return;
 	await getSpiceClient().promises.writeRelationships({
 		updates: [{
-			operation: RELATIONSHIP_OPERATION_DELETE,
+			operation: RelationshipOperation.DELETE,
 			relationship: {
 				resource: {
 					objectType: SpiceDbResourceTypes.ORGANIZATION,
@@ -58,7 +55,7 @@ async function changeOrgRole(params) {
 				optionalCaveat: void 0
 			}
 		}, {
-			operation: RELATIONSHIP_OPERATION_TOUCH,
+			operation: RelationshipOperation.TOUCH,
 			relationship: {
 				resource: {
 					objectType: SpiceDbResourceTypes.ORGANIZATION,
@@ -81,47 +78,56 @@ async function changeOrgRole(params) {
 }
 /**
 * Sync a new project to SpiceDB.
-* Links project to org and grants creator project_admin role.
+* Links project to org and grants creator project_admin role (if not already org admin/owner).
 * Call when: project is created.
 */
 async function syncProjectToSpiceDb(params) {
-	if (!isAuthzEnabled(params.tenantId)) return;
-	await getSpiceClient().promises.writeRelationships({
-		updates: [{
-			operation: RELATIONSHIP_OPERATION_CREATE,
-			relationship: {
-				resource: {
-					objectType: SpiceDbResourceTypes.PROJECT,
-					objectId: params.projectId
-				},
-				relation: SpiceDbRelations.ORGANIZATION,
-				subject: {
-					object: {
-						objectType: SpiceDbResourceTypes.ORGANIZATION,
-						objectId: params.tenantId
-					},
-					optionalRelation: ""
-				},
-				optionalCaveat: void 0
-			}
-		}, {
-			operation: RELATIONSHIP_OPERATION_CREATE,
-			relationship: {
-				resource: {
-					objectType: SpiceDbResourceTypes.PROJECT,
-					objectId: params.projectId
+	if (!isAuthzEnabled()) return;
+	const spice = getSpiceClient();
+	const isOrgAdminOrOwner = (await readRelationships({
+		resourceType: SpiceDbResourceTypes.ORGANIZATION,
+		resourceId: params.tenantId,
+		subjectType: SpiceDbResourceTypes.USER,
+		subjectId: params.creatorUserId
+	})).some((r) => r.relation === SpiceDbRelations.ADMIN || r.relation === SpiceDbRelations.OWNER);
+	const updates = [{
+		operation: RelationshipOperation.CREATE,
+		relationship: {
+			resource: {
+				objectType: SpiceDbResourceTypes.PROJECT,
+				objectId: params.projectId
+			},
+			relation: SpiceDbRelations.ORGANIZATION,
+			subject: {
+				object: {
+					objectType: SpiceDbResourceTypes.ORGANIZATION,
+					objectId: params.tenantId
 				},
-				relation: SpiceDbRelations.PROJECT_ADMIN,
-				subject: {
-					object: {
-						objectType: SpiceDbResourceTypes.USER,
-						objectId: params.creatorUserId
-					},
-					optionalRelation: ""
+				optionalRelation: ""
+			},
+			optionalCaveat: void 0
+		}
+	}];
+	if (!isOrgAdminOrOwner) updates.push({
+		operation: RelationshipOperation.CREATE,
+		relationship: {
+			resource: {
+				objectType: SpiceDbResourceTypes.PROJECT,
+				objectId: params.projectId
+			},
+			relation: SpiceDbRelations.PROJECT_ADMIN,
+			subject: {
+				object: {
+					objectType: SpiceDbResourceTypes.USER,
+					objectId: params.creatorUserId
 				},
-				optionalCaveat: void 0
-			}
-		}],
+				optionalRelation: ""
+			},
+			optionalCaveat: void 0
+		}
+	});
+	await spice.promises.writeRelationships({
+		updates,
 		optionalPreconditions: [],
 		optionalTransactionMetadata: void 0
 	});
@@ -130,7 +136,7 @@ async function syncProjectToSpiceDb(params) {
 * Grant project access to a user.
 */
 async function grantProjectAccess(params) {
-	if (!isAuthzEnabled(params.tenantId)) throw new Error("Authorization is not enabled");
+	if (!isAuthzEnabled()) throw new Error("Authorization is not enabled");
 	await writeRelationship({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
@@ -143,7 +149,7 @@ async function grantProjectAccess(params) {
 * Revoke project access from a user.
 */
 async function revokeProjectAccess(params) {
-	if (!isAuthzEnabled(params.tenantId)) throw new Error("Authorization is not enabled");
+	if (!isAuthzEnabled()) throw new Error("Authorization is not enabled");
 	await deleteRelationship({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
@@ -157,11 +163,11 @@ async function revokeProjectAccess(params) {
 * Removes the old role and adds the new one atomically in a single transaction.
 */
 async function changeProjectRole(params) {
-	if (!isAuthzEnabled(params.tenantId)) throw new Error("Authorization is not enabled");
+	if (!isAuthzEnabled()) throw new Error("Authorization is not enabled");
 	if (params.oldRole === params.newRole) return;
 	await getSpiceClient().promises.writeRelationships({
 		updates: [{
-			operation: RELATIONSHIP_OPERATION_DELETE,
+			operation: RelationshipOperation.DELETE,
 			relationship: {
 				resource: {
 					objectType: SpiceDbResourceTypes.PROJECT,
@@ -178,7 +184,7 @@ async function changeProjectRole(params) {
 				optionalCaveat: void 0
 			}
 		}, {
-			operation: RELATIONSHIP_OPERATION_TOUCH,
+			operation: RelationshipOperation.TOUCH,
 			relationship: {
 				resource: {
 					objectType: SpiceDbResourceTypes.PROJECT,
@@ -204,7 +210,7 @@ async function changeProjectRole(params) {
 * Call when: project is deleted.
 */
 async function removeProjectFromSpiceDb(params) {
-	if (!isAuthzEnabled(params.tenantId)) return;
+	if (!isAuthzEnabled()) return;
 	await getSpiceClient().promises.deleteRelationships({
 		relationshipFilter: {
 			resourceType: SpiceDbResourceTypes.PROJECT,
@@ -223,7 +229,7 @@ async function removeProjectFromSpiceDb(params) {
 * Returns users with project_admin, project_member, or project_viewer roles.
 */
 async function listProjectMembers(params) {
-	if (!isAuthzEnabled(params.tenantId)) return [];
+	if (!isAuthzEnabled()) return [];
 	return (await readRelationships({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId
@@ -232,6 +238,84 @@ async function listProjectMembers(params) {
 		role: rel.relation
 	}));
 }
+/**
+* List all project memberships for a specific user.
+* Returns projects where the user has explicit project_admin, project_member, or project_viewer roles.
+*/
+async function listUserProjectMembershipsInSpiceDb(params) {
+	if (!isAuthzEnabled()) return [];
+	return (await readRelationships({
+		resourceType: SpiceDbResourceTypes.PROJECT,
+		subjectType: SpiceDbResourceTypes.USER,
+		subjectId: params.userId
+	})).filter((rel) => rel.relation === SpiceDbRelations.PROJECT_ADMIN || rel.relation === SpiceDbRelations.PROJECT_MEMBER || rel.relation === SpiceDbRelations.PROJECT_VIEWER).map((rel) => ({
+		projectId: rel.resourceId,
+		role: rel.relation
+	}));
+}
+/**
+* Revoke all project memberships for a user.
+* Call when: user is promoted to org admin (they get inherited access, explicit project roles become redundant).
+*
+* Uses efficient bulk delete - deletes all project relationships for user without listing first.
+*/
+async function revokeAllProjectMemberships(params) {
+	if (!isAuthzEnabled()) return;
+	const spice = getSpiceClient();
+	await Promise.all([
+		spice.promises.deleteRelationships({
+			relationshipFilter: {
+				resourceType: SpiceDbResourceTypes.PROJECT,
+				optionalResourceId: "",
+				optionalResourceIdPrefix: "",
+				optionalRelation: SpiceDbRelations.PROJECT_ADMIN,
+				optionalSubjectFilter: {
+					subjectType: SpiceDbResourceTypes.USER,
+					optionalSubjectId: params.userId,
+					optionalRelation: void 0
+				}
+			},
+			optionalPreconditions: [],
+			optionalLimit: 0,
+			optionalAllowPartialDeletions: false,
+			optionalTransactionMetadata: void 0
+		}),
+		spice.promises.deleteRelationships({
+			relationshipFilter: {
+				resourceType: SpiceDbResourceTypes.PROJECT,
+				optionalResourceId: "",
+				optionalResourceIdPrefix: "",
+				optionalRelation: SpiceDbRelations.PROJECT_MEMBER,
+				optionalSubjectFilter: {
+					subjectType: SpiceDbResourceTypes.USER,
+					optionalSubjectId: params.userId,
+					optionalRelation: void 0
+				}
+			},
+			optionalPreconditions: [],
+			optionalLimit: 0,
+			optionalAllowPartialDeletions: false,
+			optionalTransactionMetadata: void 0
+		}),
+		spice.promises.deleteRelationships({
+			relationshipFilter: {
+				resourceType: SpiceDbResourceTypes.PROJECT,
+				optionalResourceId: "",
+				optionalResourceIdPrefix: "",
+				optionalRelation: SpiceDbRelations.PROJECT_VIEWER,
+				optionalSubjectFilter: {
+					subjectType: SpiceDbResourceTypes.USER,
+					optionalSubjectId: params.userId,
+					optionalRelation: void 0
+				}
+			},
+			optionalPreconditions: [],
+			optionalLimit: 0,
+			optionalAllowPartialDeletions: false,
+			optionalTransactionMetadata: void 0
+		})
+	]);
+}
 
 //#endregion
-export { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, removeProjectFromSpiceDb, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb };
+export { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb };

package/dist/auth/permissions.d.ts

@@ -1,29 +1,29 @@
-import * as better_auth_plugins0 from "better-auth/plugins";
+import * as better_auth_plugins69 from "better-auth/plugins";
 import { AccessControl } from "better-auth/plugins/access";
 import { organizationClient } from "better-auth/client/plugins";
 
 //#region src/auth/permissions.d.ts
 declare const ac: AccessControl;
 declare const memberRole: {
-  authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
-    actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
+  authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>[key] | {
+    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>[key];
     connector: "OR" | "AND";
-  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-  statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
+  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
+  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>;
 };
 declare const adminRole: {
-  authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
-    actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
+  authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>[key] | {
+    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>[key];
     connector: "OR" | "AND";
-  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-  statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
+  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
+  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>;
 };
 declare const ownerRole: {
-  authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
-    actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
+  authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>[key] | {
+    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>[key];
     connector: "OR" | "AND";
-  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-  statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
+  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
+  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>;
 };
 //#endregion
 export { ac, adminRole, memberRole, organizationClient, ownerRole };

package/dist/client-exports.d.ts

@@ -1,3 +1,4 @@
+import { OrgRole, OrgRoles, ProjectRole, ProjectRoles } from "./auth/authz/config.js";
 import { BreakdownComponentDef, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextBreakdown, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, parseContextBreakdownFromSpan } from "./constants/context-breakdown.js";
 import { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AI_OPERATIONS, AI_TOOL_TYPES, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, SPAN_KEYS, SPAN_NAMES, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, UNKNOWN_VALUE } from "./constants/otel-attributes.js";
 import { AGGREGATE_OPERATORS, DATA_SOURCES, DATA_TYPES, FIELD_TYPES, OPERATORS, ORDER_DIRECTIONS, PANEL_TYPES, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS } from "./constants/signoz-queries.js";
@@ -314,4 +315,4 @@ declare function generateIdFromName(name: string): string;
 type ToolInsert = ToolApiInsert;
 type AgentAgentInsert = AgentAgentApiInsert;
 //#endregion
-export { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AGGREGATE_OPERATORS, AI_OPERATIONS, AI_TOOL_TYPES, AgentAgentApiInsert, AgentAgentApiInsertSchema, AgentAgentInsert, AgentApiInsert, AgentApiInsertSchema, type AgentStopWhen, AgentStopWhenSchema, ApiKeyApiCreationResponse, ApiKeyApiCreationResponseSchema, ApiKeyApiSelect, ApiKeyApiSelectSchema, ApiKeyApiUpdateResponse, ArtifactComponentApiInsert, ArtifactComponentApiInsertSchema, BreakdownComponentDef, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextBreakdown, ContextConfigApiInsert, ContextConfigApiInsertSchema, CredentialReferenceApiInsert, CredentialReferenceApiInsertSchema, CredentialStoreType, DATA_SOURCES, DATA_TYPES, DEFAULT_NANGO_STORE_ID, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, DataComponentApiInsert, DataComponentApiInsertSchema, ErrorResponse, ErrorResponseSchema, ExternalAgentApiInsert, ExternalAgentApiInsertSchema, ExternalAgentDefinition, FIELD_TYPES, FullAgentDefinition, FullAgentDefinitionSchema, FunctionApiInsert, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, IdParamsSchema, InternalAgentDefinition, ListResponseSchema, MAX_ID_LENGTH, MCPTransportType, MIN_ID_LENGTH, type ModelSettings, ModelSettingsSchema, OPERATORS, ORDER_DIRECTIONS, PANEL_TYPES, PaginationSchema, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS, SPAN_KEYS, SPAN_NAMES, type SignatureSource, type SignatureVerificationConfig, SignatureVerificationConfigSchema, type SignedComponent, SingleResponseSchema, type StopWhen, StopWhenSchema, type SubAgentStopWhen, SubAgentStopWhenSchema, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, TenantParams, TenantParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, ToolApiInsert, ToolApiInsertSchema, ToolInsert, TriggerApiInsert, TriggerApiInsertSchema, TriggerApiSelect, TriggerApiSelectSchema, TriggerApiUpdate, TriggerApiUpdateSchema, TriggerInvocationApiSelect, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, TriggerWithWebhookUrlListResponse, TriggerWithWebhookUrlResponse, TriggerWithWebhookUrlSchema, UNKNOWN_VALUE, URL_SAFE_ID_PATTERN, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, detectAuthenticationRequired, generateIdFromName, parseContextBreakdownFromSpan, resourceIdSchema, validatePropsAsJsonSchema };
+export { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AGGREGATE_OPERATORS, AI_OPERATIONS, AI_TOOL_TYPES, AgentAgentApiInsert, AgentAgentApiInsertSchema, AgentAgentInsert, AgentApiInsert, AgentApiInsertSchema, type AgentStopWhen, AgentStopWhenSchema, ApiKeyApiCreationResponse, ApiKeyApiCreationResponseSchema, ApiKeyApiSelect, ApiKeyApiSelectSchema, ApiKeyApiUpdateResponse, ArtifactComponentApiInsert, ArtifactComponentApiInsertSchema, BreakdownComponentDef, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextBreakdown, ContextConfigApiInsert, ContextConfigApiInsertSchema, CredentialReferenceApiInsert, CredentialReferenceApiInsertSchema, CredentialStoreType, DATA_SOURCES, DATA_TYPES, DEFAULT_NANGO_STORE_ID, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, DataComponentApiInsert, DataComponentApiInsertSchema, ErrorResponse, ErrorResponseSchema, ExternalAgentApiInsert, ExternalAgentApiInsertSchema, ExternalAgentDefinition, FIELD_TYPES, FullAgentDefinition, FullAgentDefinitionSchema, FunctionApiInsert, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, IdParamsSchema, InternalAgentDefinition, ListResponseSchema, MAX_ID_LENGTH, MCPTransportType, MIN_ID_LENGTH, type ModelSettings, ModelSettingsSchema, OPERATORS, ORDER_DIRECTIONS, type OrgRole, OrgRoles, PANEL_TYPES, PaginationSchema, type ProjectRole, ProjectRoles, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS, SPAN_KEYS, SPAN_NAMES, type SignatureSource, type SignatureVerificationConfig, SignatureVerificationConfigSchema, type SignedComponent, SingleResponseSchema, type StopWhen, StopWhenSchema, type SubAgentStopWhen, SubAgentStopWhenSchema, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, TenantParams, TenantParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, ToolApiInsert, ToolApiInsertSchema, ToolInsert, TriggerApiInsert, TriggerApiInsertSchema, TriggerApiSelect, TriggerApiSelectSchema, TriggerApiUpdate, TriggerApiUpdateSchema, TriggerInvocationApiSelect, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, TriggerWithWebhookUrlListResponse, TriggerWithWebhookUrlResponse, TriggerWithWebhookUrlSchema, UNKNOWN_VALUE, URL_SAFE_ID_PATTERN, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, detectAuthenticationRequired, generateIdFromName, parseContextBreakdownFromSpan, resourceIdSchema, validatePropsAsJsonSchema };

package/dist/client-exports.js

@@ -3,6 +3,7 @@ import { CredentialStoreType, MCPTransportType } from "./types/utility.js";
 import { AgentStopWhenSchema, ArtifactComponentApiInsertSchema as ArtifactComponentApiInsertSchema$1, FullAgentAgentInsertSchema, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, ModelSettingsSchema, SignatureVerificationConfigSchema, StopWhenSchema, SubAgentStopWhenSchema, TriggerApiInsertSchema, TriggerApiSelectSchema, TriggerApiUpdateSchema, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, TriggerWithWebhookUrlListResponse, TriggerWithWebhookUrlResponse, TriggerWithWebhookUrlSchema } from "./validation/schemas.js";
 import { DEFAULT_NANGO_STORE_ID } from "./credential-stores/default-constants.js";
 import { validatePropsAsJsonSchema } from "./validation/props-validation.js";
+import { OrgRoles, ProjectRoles } from "./auth/authz/config.js";
 import { CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, parseContextBreakdownFromSpan } from "./constants/context-breakdown.js";
 import { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AI_OPERATIONS, AI_TOOL_TYPES, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, SPAN_KEYS, SPAN_NAMES, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, UNKNOWN_VALUE } from "./constants/otel-attributes.js";
 import { AGGREGATE_OPERATORS, DATA_SOURCES, DATA_TYPES, FIELD_TYPES, OPERATORS, ORDER_DIRECTIONS, PANEL_TYPES, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS } from "./constants/signoz-queries.js";
@@ -168,4 +169,4 @@ function generateIdFromName(name) {
 }
 
 //#endregion
-export { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AGGREGATE_OPERATORS, AI_OPERATIONS, AI_TOOL_TYPES, AgentAgentApiInsertSchema, AgentApiInsertSchema, AgentStopWhenSchema, ApiKeyApiCreationResponseSchema, ApiKeyApiSelectSchema, ArtifactComponentApiInsertSchema, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextConfigApiInsertSchema, CredentialReferenceApiInsertSchema, CredentialStoreType, DATA_SOURCES, DATA_TYPES, DEFAULT_NANGO_STORE_ID, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, DataComponentApiInsertSchema, ErrorResponseSchema, ExternalAgentApiInsertSchema, FIELD_TYPES, FullAgentDefinitionSchema, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, IdParamsSchema, ListResponseSchema, MAX_ID_LENGTH, MCPTransportType, MIN_ID_LENGTH, ModelSettingsSchema, OPERATORS, ORDER_DIRECTIONS, PANEL_TYPES, PaginationSchema, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS, SPAN_KEYS, SPAN_NAMES, SignatureVerificationConfigSchema, SingleResponseSchema, StopWhenSchema, SubAgentStopWhenSchema, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, TenantParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, ToolApiInsertSchema, TriggerApiInsertSchema, TriggerApiSelectSchema, TriggerApiUpdateSchema, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, TriggerWithWebhookUrlListResponse, TriggerWithWebhookUrlResponse, TriggerWithWebhookUrlSchema, UNKNOWN_VALUE, URL_SAFE_ID_PATTERN, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, detectAuthenticationRequired, generateIdFromName, parseContextBreakdownFromSpan, resourceIdSchema, validatePropsAsJsonSchema };
+export { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AGGREGATE_OPERATORS, AI_OPERATIONS, AI_TOOL_TYPES, AgentAgentApiInsertSchema, AgentApiInsertSchema, AgentStopWhenSchema, ApiKeyApiCreationResponseSchema, ApiKeyApiSelectSchema, ArtifactComponentApiInsertSchema, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextConfigApiInsertSchema, CredentialReferenceApiInsertSchema, CredentialStoreType, DATA_SOURCES, DATA_TYPES, DEFAULT_NANGO_STORE_ID, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, DataComponentApiInsertSchema, ErrorResponseSchema, ExternalAgentApiInsertSchema, FIELD_TYPES, FullAgentDefinitionSchema, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, IdParamsSchema, ListResponseSchema, MAX_ID_LENGTH, MCPTransportType, MIN_ID_LENGTH, ModelSettingsSchema, OPERATORS, ORDER_DIRECTIONS, OrgRoles, PANEL_TYPES, PaginationSchema, ProjectRoles, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS, SPAN_KEYS, SPAN_NAMES, SignatureVerificationConfigSchema, SingleResponseSchema, StopWhenSchema, SubAgentStopWhenSchema, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, TenantParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, ToolApiInsertSchema, TriggerApiInsertSchema, TriggerApiSelectSchema, TriggerApiUpdateSchema, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, TriggerWithWebhookUrlListResponse, TriggerWithWebhookUrlResponse, TriggerWithWebhookUrlSchema, UNKNOWN_VALUE, URL_SAFE_ID_PATTERN, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, detectAuthenticationRequired, generateIdFromName, parseContextBreakdownFromSpan, resourceIdSchema, validatePropsAsJsonSchema };