@inkeep/agents-core 0.0.0-dev-20260129102848 → 0.0.0-dev-20260129163144

package/dist/auth/auth.d.ts

@@ -179,11 +179,11 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
     useSecureCookies?: boolean | undefined;
     disableCSRFCheck?: boolean | undefined;
     disableOriginCheck?: boolean | undefined;
-    crossSubDomainCookies: {
+    crossSubDomainCookies?: {
       enabled: boolean;
       additionalCookies?: string[];
       domain?: string;
-    };
+    } | undefined;
     cookies?: {
       [key: string]: {
         name?: string;
@@ -852,27 +852,28 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "member" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "member" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "member" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
         };
       };
+      creatorRole: "admin";
       membershipLimit: number;
       invitationLimit: number;
       invitationExpiresIn: number;
@@ -1044,7 +1045,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         id: string;
         organizationId: string;
         email: string;
-        role: "member" | "admin" | "owner";
+        role: "owner" | "admin" | "member";
         status: better_auth_plugins0.InvitationStatus;
         inviterId: string;
         expiresAt: Date;
@@ -1053,7 +1054,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       Member: {
         id: string;
         organizationId: string;
-        role: "member" | "admin" | "owner";
+        role: "owner" | "admin" | "member";
         createdAt: Date;
         userId: string;
         user: {
@@ -1069,7 +1070,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         members: {
           id: string;
           organizationId: string;
-          role: "member" | "admin" | "owner";
+          role: "owner" | "admin" | "member";
           createdAt: Date;
           userId: string;
           user: {
@@ -1083,7 +1084,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
           id: string;
           organizationId: string;
           email: string;
-          role: "member" | "admin" | "owner";
+          role: "owner" | "admin" | "member";
           status: better_auth_plugins0.InvitationStatus;
           inviterId: string;
           expiresAt: Date;
@@ -1161,27 +1162,28 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "member" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "member" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "member" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
         };
       };
+      creatorRole: "admin";
       membershipLimit: number;
       invitationLimit: number;
       invitationExpiresIn: number;

package/dist/auth/auth.js

@@ -106,10 +106,10 @@ function createAuth(config) {
 			}
 		},
 		advanced: {
-			crossSubDomainCookies: {
+			...cookieDomain && { crossSubDomainCookies: {
 				enabled: true,
-				...cookieDomain && { domain: cookieDomain }
-			},
+				domain: cookieDomain
+			} },
 			defaultCookieAttributes: {
 				sameSite: "none",
 				secure: true,
@@ -138,6 +138,7 @@ function createAuth(config) {
 					admin: adminRole,
 					owner: ownerRole
 				},
+				creatorRole: OrgRoles.ADMIN,
 				membershipLimit: 300,
 				invitationLimit: 300,
 				invitationExpiresIn: 10080 * 60,

package/dist/auth/authz/client.d.ts

@@ -16,7 +16,6 @@ declare const RelationshipOperation: typeof v1.RelationshipUpdate_Operation;
 declare const Permissionship: typeof v1.CheckPermissionResponse_Permissionship;
 /**
  * Check if a subject has a permission on a resource.
- * Note: Caller must verify isAuthzEnabled() before calling.
  */
 declare function checkPermission(params: {
   resourceType: string;

package/dist/auth/authz/client.js

@@ -30,7 +30,6 @@ const RelationshipOperation = RelationshipUpdate_Operation;
 const Permissionship = CheckPermissionResponse_Permissionship;
 /**
 * Check if a subject has a permission on a resource.
-* Note: Caller must verify isAuthzEnabled() before calling.
 */
 async function checkPermission(params) {
 	return (await getSpiceClient().promises.checkPermission({

package/dist/auth/authz/config.d.ts

@@ -1,10 +1,4 @@
 //#region src/auth/authz/config.d.ts
-/**
- * SpiceDB Authorization Configuration
- *
- * Feature flag and configuration for the SpiceDB authorization system.
- */
-declare function isAuthzEnabled(): boolean;
 /**
  * Get SpiceDB connection configuration from environment variables.
  * TLS is auto-detected: disabled for localhost, enabled for remote endpoints.
@@ -100,4 +94,4 @@ interface ProjectPermissions {
   canEdit: boolean;
 }
 //#endregion
-export { OrgRole, OrgRoles, ProjectPermissionLevel, ProjectPermissions, ProjectRole, ProjectRoles, SpiceDbOrgPermission, SpiceDbOrgPermissions, SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled };
+export { OrgRole, OrgRoles, ProjectPermissionLevel, ProjectPermissions, ProjectRole, ProjectRoles, SpiceDbOrgPermission, SpiceDbOrgPermissions, SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig };

package/dist/auth/authz/config.js

@@ -1,13 +1,5 @@
 //#region src/auth/authz/config.ts
 /**
-* SpiceDB Authorization Configuration
-*
-* Feature flag and configuration for the SpiceDB authorization system.
-*/
-function isAuthzEnabled() {
-	return process.env.ENABLE_AUTHZ === "true";
-}
-/**
 * Get SpiceDB connection configuration from environment variables.
 * TLS is auto-detected: disabled for localhost, enabled for remote endpoints.
 */
@@ -90,4 +82,4 @@ const ProjectRoles = {
 };
 
 //#endregion
-export { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled };
+export { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig };

package/dist/auth/authz/index.d.ts

@@ -1,5 +1,5 @@
 import { checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, writeRelationship } from "./client.js";
-import { OrgRole, OrgRoles, ProjectPermissionLevel, ProjectPermissions, ProjectRole, ProjectRoles, SpiceDbOrgPermission, SpiceDbOrgPermissions, SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled } from "./config.js";
+import { OrgRole, OrgRoles, ProjectPermissionLevel, ProjectPermissions, ProjectRole, ProjectRoles, SpiceDbOrgPermission, SpiceDbOrgPermissions, SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig } from "./config.js";
 import { canEditProject, canUseProject, canViewProject, listAccessibleProjectIds } from "./permissions.js";
 import { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb } from "./sync.js";
-export { type OrgRole, OrgRoles, type ProjectPermissionLevel, type ProjectPermissions, type ProjectRole, ProjectRoles, type SpiceDbOrgPermission, SpiceDbOrgPermissions, type SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, canEditProject, canUseProject, canViewProject, changeOrgRole, changeProjectRole, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, getSpiceDbConfig, grantProjectAccess, isAuthzEnabled, listAccessibleProjectIds, listProjectMembers, listUserProjectMembershipsInSpiceDb, lookupResources, readRelationships, removeProjectFromSpiceDb, resetSpiceClient, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb, writeRelationship };
+export { type OrgRole, OrgRoles, type ProjectPermissionLevel, type ProjectPermissions, type ProjectRole, ProjectRoles, type SpiceDbOrgPermission, SpiceDbOrgPermissions, type SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, canEditProject, canUseProject, canViewProject, changeOrgRole, changeProjectRole, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, getSpiceDbConfig, grantProjectAccess, listAccessibleProjectIds, listProjectMembers, listUserProjectMembershipsInSpiceDb, lookupResources, readRelationships, removeProjectFromSpiceDb, resetSpiceClient, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb, writeRelationship };

package/dist/auth/authz/index.js

@@ -1,6 +1,6 @@
-import { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled } from "./config.js";
+import { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig } from "./config.js";
 import { checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, writeRelationship } from "./client.js";
 import { canEditProject, canUseProject, canViewProject, listAccessibleProjectIds } from "./permissions.js";
 import { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb } from "./sync.js";
 
-export { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, canEditProject, canUseProject, canViewProject, changeOrgRole, changeProjectRole, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, getSpiceDbConfig, grantProjectAccess, isAuthzEnabled, listAccessibleProjectIds, listProjectMembers, listUserProjectMembershipsInSpiceDb, lookupResources, readRelationships, removeProjectFromSpiceDb, resetSpiceClient, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb, writeRelationship };
+export { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, canEditProject, canUseProject, canViewProject, changeOrgRole, changeProjectRole, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, getSpiceDbConfig, grantProjectAccess, listAccessibleProjectIds, listProjectMembers, listUserProjectMembershipsInSpiceDb, lookupResources, readRelationships, removeProjectFromSpiceDb, resetSpiceClient, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb, writeRelationship };

package/dist/auth/authz/permissions.js

@@ -1,4 +1,4 @@
-import { OrgRoles, SpiceDbProjectPermissions, SpiceDbResourceTypes, isAuthzEnabled } from "./config.js";
+import { OrgRoles, SpiceDbProjectPermissions, SpiceDbResourceTypes } from "./config.js";
 import { checkPermission, lookupResources } from "./client.js";
 
 //#region src/auth/authz/permissions.ts
@@ -15,8 +15,7 @@ import { checkPermission, lookupResources } from "./client.js";
 * - Otherwise: checks SpiceDB
 */
 async function canViewProject(params) {
-	const isAdmin = params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN;
-	if (!isAuthzEnabled() || isAdmin) return true;
+	if (params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN) return true;
 	return checkPermission({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
@@ -33,8 +32,7 @@ async function canViewProject(params) {
 * - Otherwise: checks SpiceDB for use permission
 */
 async function canUseProject(params) {
-	const isAdmin = params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN;
-	if (!isAuthzEnabled() || isAdmin) return true;
+	if (params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN) return true;
 	return checkPermission({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
@@ -52,7 +50,6 @@ async function canUseProject(params) {
 */
 async function canEditProject(params) {
 	if (params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN) return true;
-	if (!isAuthzEnabled()) return false;
 	return checkPermission({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
@@ -69,8 +66,7 @@ async function canEditProject(params) {
 * - Otherwise: uses SpiceDB LookupResources
 */
 async function listAccessibleProjectIds(params) {
-	const isAdmin = params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN;
-	if (!isAuthzEnabled() || isAdmin) return "all";
+	if (params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN) return "all";
 	return lookupResources({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		permission: SpiceDbProjectPermissions.VIEW,

package/dist/auth/authz/sync.js

@@ -1,4 +1,4 @@
-import { SpiceDbRelations, SpiceDbResourceTypes, isAuthzEnabled } from "./config.js";
+import { SpiceDbRelations, SpiceDbResourceTypes } from "./config.js";
 import { RelationshipOperation, deleteRelationship, getSpiceClient, readRelationships, writeRelationship } from "./client.js";
 
 //#region src/auth/authz/sync.ts
@@ -12,7 +12,6 @@ import { RelationshipOperation, deleteRelationship, getSpiceClient, readRelation
 * Call when: user joins org, role changes, user leaves org.
 */
 async function syncOrgMemberToSpiceDb(params) {
-	if (!isAuthzEnabled()) return;
 	if (params.action === "add") await writeRelationship({
 		resourceType: SpiceDbResourceTypes.ORGANIZATION,
 		resourceId: params.tenantId,
@@ -34,7 +33,6 @@ async function syncOrgMemberToSpiceDb(params) {
 * Call when: user's org role is updated (e.g., member -> admin).
 */
 async function changeOrgRole(params) {
-	if (!isAuthzEnabled()) return;
 	if (params.oldRole === params.newRole) return;
 	await getSpiceClient().promises.writeRelationships({
 		updates: [{
@@ -82,7 +80,6 @@ async function changeOrgRole(params) {
 * Call when: project is created.
 */
 async function syncProjectToSpiceDb(params) {
-	if (!isAuthzEnabled()) return;
 	const spice = getSpiceClient();
 	const isOrgAdminOrOwner = (await readRelationships({
 		resourceType: SpiceDbResourceTypes.ORGANIZATION,
@@ -136,7 +133,6 @@ async function syncProjectToSpiceDb(params) {
 * Grant project access to a user.
 */
 async function grantProjectAccess(params) {
-	if (!isAuthzEnabled()) throw new Error("Authorization is not enabled");
 	await writeRelationship({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
@@ -149,7 +145,6 @@ async function grantProjectAccess(params) {
 * Revoke project access from a user.
 */
 async function revokeProjectAccess(params) {
-	if (!isAuthzEnabled()) throw new Error("Authorization is not enabled");
 	await deleteRelationship({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
@@ -163,7 +158,6 @@ async function revokeProjectAccess(params) {
 * Removes the old role and adds the new one atomically in a single transaction.
 */
 async function changeProjectRole(params) {
-	if (!isAuthzEnabled()) throw new Error("Authorization is not enabled");
 	if (params.oldRole === params.newRole) return;
 	await getSpiceClient().promises.writeRelationships({
 		updates: [{
@@ -210,7 +204,6 @@ async function changeProjectRole(params) {
 * Call when: project is deleted.
 */
 async function removeProjectFromSpiceDb(params) {
-	if (!isAuthzEnabled()) return;
 	await getSpiceClient().promises.deleteRelationships({
 		relationshipFilter: {
 			resourceType: SpiceDbResourceTypes.PROJECT,
@@ -229,7 +222,6 @@ async function removeProjectFromSpiceDb(params) {
 * Returns users with project_admin, project_member, or project_viewer roles.
 */
 async function listProjectMembers(params) {
-	if (!isAuthzEnabled()) return [];
 	return (await readRelationships({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId
@@ -243,7 +235,6 @@ async function listProjectMembers(params) {
 * Returns projects where the user has explicit project_admin, project_member, or project_viewer roles.
 */
 async function listUserProjectMembershipsInSpiceDb(params) {
-	if (!isAuthzEnabled()) return [];
 	return (await readRelationships({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		subjectType: SpiceDbResourceTypes.USER,
@@ -260,7 +251,6 @@ async function listUserProjectMembershipsInSpiceDb(params) {
 * Uses efficient bulk delete - deletes all project relationships for user without listing first.
 */
 async function revokeAllProjectMemberships(params) {
-	if (!isAuthzEnabled()) return;
 	const spice = getSpiceClient();
 	await Promise.all([
 		spice.promises.deleteRelationships({

package/dist/auth/init.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/auth/init.js

@@ -0,0 +1,115 @@
+import { OrgRoles } from "./authz/config.js";
+import { loadEnvironmentFiles } from "../env.js";
+import { syncOrgMemberToSpiceDb } from "./authz/sync.js";
+import "./authz/index.js";
+import { createAgentsRunDatabaseClient } from "../db/runtime/runtime-client.js";
+import { addUserToOrganization, upsertOrganization } from "../data-access/runtime/organizations.js";
+import { getUserByEmail } from "../data-access/runtime/users.js";
+import { createAuth } from "./auth.js";
+
+//#region src/auth/init.ts
+/**
+* Standalone initialization script for creating the default organization and admin user.
+* This script is designed to run during setup/migration, NOT at server startup.
+*
+* Uses upsertOrganization to create org with TENANT_ID as the actual organization ID,
+* and Better Auth's API for user creation.
+*
+* Usage: pnpm db:auth:init
+*
+* Required environment variables:
+* - INKEEP_AGENTS_RUN_DATABASE_URL: PostgreSQL connection string
+* - TENANT_ID: Organization/tenant ID (defaults to 'default') - this becomes the org ID
+* - INKEEP_AGENTS_MANAGE_UI_USERNAME: Admin email address
+* - INKEEP_AGENTS_MANAGE_UI_PASSWORD: Admin password (min 8 chars)
+* - BETTER_AUTH_SECRET: Secret for Better Auth
+*
+* Optional environment variables:
+* - INKEEP_AGENTS_API_URL: API URL for Better Auth (defaults to http://localhost:3002)
+*/
+loadEnvironmentFiles();
+const TENANT_ID = process.env.TENANT_ID || "default";
+async function init() {
+	console.log("🚀 Initializing database with default organization and user...\n");
+	const dbClient = createAgentsRunDatabaseClient();
+	const username = process.env.INKEEP_AGENTS_MANAGE_UI_USERNAME;
+	const password = process.env.INKEEP_AGENTS_MANAGE_UI_PASSWORD;
+	const authSecret = process.env.BETTER_AUTH_SECRET;
+	if (!username || !password) {
+		console.error("❌ INKEEP_AGENTS_MANAGE_UI_USERNAME and INKEEP_AGENTS_MANAGE_UI_PASSWORD are required");
+		console.error("   These credentials are used to create the initial admin user.");
+		process.exit(1);
+	}
+	if (!authSecret) {
+		console.error("❌ BETTER_AUTH_SECRET is required");
+		console.error("   This secret is used to sign authentication tokens.");
+		process.exit(1);
+	}
+	const auth = createAuth({
+		baseURL: process.env.INKEEP_AGENTS_API_URL || "http://localhost:3002",
+		secret: authSecret,
+		dbClient
+	});
+	console.log(`📦 Checking/creating organization: ${TENANT_ID}`);
+	const { created: orgCreated } = await upsertOrganization(dbClient)({
+		organizationId: TENANT_ID,
+		name: TENANT_ID,
+		slug: TENANT_ID,
+		logo: null,
+		metadata: null
+	});
+	if (orgCreated) console.log(`   ✅ Organization created with ID: ${TENANT_ID}`);
+	else console.log(`   ℹ️  Organization already exists: ${TENANT_ID}`);
+	console.log(`\n👤 Creating admin user: ${username}`);
+	let user = await getUserByEmail(dbClient)(username);
+	if (user) console.log(`   ℹ️  User already exists: ${username}`);
+	else {
+		console.log("   Creating user with Better Auth...");
+		if (!(await auth.api.signUpEmail({ body: {
+			email: username,
+			password,
+			name: username.split("@")[0]
+		} })).user) {
+			console.error("   ❌ Failed to create user: signUpEmail returned no user");
+			process.exit(1);
+		}
+		user = await getUserByEmail(dbClient)(username);
+		if (!user) {
+			console.error("   ❌ User was created but could not be retrieved from database");
+			process.exit(1);
+		}
+		console.log(`   ✅ User created: ${user.email}`);
+	}
+	console.log(`\n🔗 Adding user to organization...`);
+	await addUserToOrganization(dbClient)({
+		userId: user.id,
+		organizationId: TENANT_ID,
+		role: OrgRoles.ADMIN
+	});
+	console.log(`   ✅ User ${user.email} added as ${OrgRoles.ADMIN}`);
+	try {
+		await syncOrgMemberToSpiceDb({
+			tenantId: TENANT_ID,
+			userId: user.id,
+			role: OrgRoles.ADMIN,
+			action: "add"
+		});
+		console.log("   ✅ Synced to SpiceDB");
+	} catch {
+		console.log("   ℹ️  SpiceDB sync failed");
+	}
+	console.log("\n================================================");
+	console.log("✅ Initialization complete!");
+	console.log("================================================");
+	console.log(`\nOrganization: ${TENANT_ID}`);
+	console.log(`Admin user:   ${username} (owner)`);
+	console.log("\nYou can now log in with these credentials.\n");
+	process.exit(0);
+}
+init().catch((error) => {
+	console.error("\n❌ Initialization failed:", error);
+	process.exit(1);
+});
+
+//#endregion
+export {  };

package/dist/auth/permissions.d.ts

@@ -5,25 +5,25 @@ import { organizationClient } from "better-auth/client/plugins";
 //#region src/auth/permissions.d.ts
 declare const ac: AccessControl;
 declare const memberRole: {
-  authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
-    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
+  authorize<K_1 extends "project" | "organization" | "member" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins69.Statements>[key] | {
+    actions: better_auth_plugins69.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins69.Statements>[key];
     connector: "OR" | "AND";
   } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
+  statements: better_auth_plugins69.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins69.Statements>;
 };
 declare const adminRole: {
-  authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
-    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
+  authorize<K_1 extends "project" | "organization" | "member" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins69.Statements>[key] | {
+    actions: better_auth_plugins69.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins69.Statements>[key];
     connector: "OR" | "AND";
   } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
+  statements: better_auth_plugins69.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins69.Statements>;
 };
 declare const ownerRole: {
-  authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
-    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
+  authorize<K_1 extends "project" | "organization" | "member" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins69.Statements>[key] | {
+    actions: better_auth_plugins69.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins69.Statements>[key];
     connector: "OR" | "AND";
   } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
+  statements: better_auth_plugins69.Subset<"project" | "organization" | "member" | "invitation" | "ac" | "team", better_auth_plugins69.Statements>;
 };
 //#endregion
 export { ac, adminRole, memberRole, organizationClient, ownerRole };