@inkeep/agents-core 0.0.0-dev-20260206223853 → 0.0.0-dev-20260207223415

package/dist/auth/auth.d.ts

@@ -2,7 +2,7 @@ import { AgentsRunDatabaseClient } from "../db/runtime/runtime-client.js";
 import * as _better_auth_sso0 from "@better-auth/sso";
 import * as better_auth0 from "better-auth";
 import { BetterAuthAdvancedOptions } from "better-auth";
-import * as better_auth_plugins0 from "better-auth/plugins";
+import * as better_auth_plugins20 from "better-auth/plugins";
 import * as zod0 from "zod";
 import { GoogleOptions } from "better-auth/social-providers";
 
@@ -247,7 +247,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>;
       }[];
     };
-    options: better_auth_plugins0.BearerOptions | undefined;
+    options: better_auth_plugins20.BearerOptions | undefined;
   }, {
     id: "sso";
     endpoints: {
@@ -875,30 +875,30 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
     };
   }, {
     id: "organization";
-    endpoints: better_auth_plugins0.OrganizationEndpoints<{
+    endpoints: better_auth_plugins20.OrganizationEndpoints<{
       allowUserToCreateOrganization: true;
-      ac: better_auth_plugins0.AccessControl;
+      ac: better_auth_plugins20.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
+            actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
+          statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
         };
         admin: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
+            actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
+          statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
         };
         owner: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
+            actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
+          statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
         };
       };
       creatorRole: "admin";
@@ -909,9 +909,9 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         id: string;
         role: string;
         email: string;
-        organization: better_auth_plugins0.Organization;
-        invitation: better_auth_plugins0.Invitation;
-        inviter: better_auth_plugins0.Member & {
+        organization: better_auth_plugins20.Organization;
+        invitation: better_auth_plugins20.Invitation;
+        inviter: better_auth_plugins20.Member & {
           user: better_auth0.User;
         };
       }): Promise<void>;
@@ -932,28 +932,28 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
           user,
           organization: org
         }: {
-          invitation: better_auth_plugins0.Invitation & Record<string, any>;
-          member: better_auth_plugins0.Member & Record<string, any>;
+          invitation: better_auth_plugins20.Invitation & Record<string, any>;
+          member: better_auth_plugins20.Member & Record<string, any>;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins0.Organization & Record<string, any>;
+          organization: better_auth_plugins20.Organization & Record<string, any>;
         }) => Promise<void>;
         beforeUpdateMemberRole: ({
           member,
           organization: org,
           newRole
         }: {
-          member: better_auth_plugins0.Member & Record<string, any>;
+          member: better_auth_plugins20.Member & Record<string, any>;
           newRole: string;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins0.Organization & Record<string, any>;
+          organization: better_auth_plugins20.Organization & Record<string, any>;
         }) => Promise<void>;
         afterRemoveMember: ({
           member,
           organization: org
         }: {
-          member: better_auth_plugins0.Member & Record<string, any>;
+          member: better_auth_plugins20.Member & Record<string, any>;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins0.Organization & Record<string, any>;
+          organization: better_auth_plugins20.Organization & Record<string, any>;
         }) => Promise<void>;
       };
     }>;
@@ -1085,7 +1085,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         organizationId: string;
         email: string;
         role: "member" | "admin" | "owner";
-        status: better_auth_plugins0.InvitationStatus;
+        status: better_auth_plugins20.InvitationStatus;
         inviterId: string;
         expiresAt: Date;
         createdAt: Date;
@@ -1125,7 +1125,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
           organizationId: string;
           email: string;
           role: "member" | "admin" | "owner";
-          status: better_auth_plugins0.InvitationStatus;
+          status: better_auth_plugins20.InvitationStatus;
           inviterId: string;
           expiresAt: Date;
           createdAt: Date;
@@ -1200,28 +1200,28 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
     };
     options: NoInfer<{
       allowUserToCreateOrganization: true;
-      ac: better_auth_plugins0.AccessControl;
+      ac: better_auth_plugins20.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
+            actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
+          statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
         };
         admin: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
+            actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
+          statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
         };
         owner: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
+            actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
+          statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
         };
       };
       creatorRole: "admin";
@@ -1232,9 +1232,9 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         id: string;
         role: string;
         email: string;
-        organization: better_auth_plugins0.Organization;
-        invitation: better_auth_plugins0.Invitation;
-        inviter: better_auth_plugins0.Member & {
+        organization: better_auth_plugins20.Organization;
+        invitation: better_auth_plugins20.Invitation;
+        inviter: better_auth_plugins20.Member & {
           user: better_auth0.User;
         };
       }): Promise<void>;
@@ -1255,28 +1255,28 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
           user,
           organization: org
         }: {
-          invitation: better_auth_plugins0.Invitation & Record<string, any>;
-          member: better_auth_plugins0.Member & Record<string, any>;
+          invitation: better_auth_plugins20.Invitation & Record<string, any>;
+          member: better_auth_plugins20.Member & Record<string, any>;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins0.Organization & Record<string, any>;
+          organization: better_auth_plugins20.Organization & Record<string, any>;
         }) => Promise<void>;
         beforeUpdateMemberRole: ({
           member,
           organization: org,
           newRole
         }: {
-          member: better_auth_plugins0.Member & Record<string, any>;
+          member: better_auth_plugins20.Member & Record<string, any>;
           newRole: string;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins0.Organization & Record<string, any>;
+          organization: better_auth_plugins20.Organization & Record<string, any>;
         }) => Promise<void>;
         afterRemoveMember: ({
           member,
           organization: org
         }: {
-          member: better_auth_plugins0.Member & Record<string, any>;
+          member: better_auth_plugins20.Member & Record<string, any>;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins0.Organization & Record<string, any>;
+          organization: better_auth_plugins20.Organization & Record<string, any>;
         }) => Promise<void>;
       };
     }>;
@@ -1613,8 +1613,8 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       readonly AUTHENTICATION_REQUIRED: "Authentication required";
     };
     options: Partial<{
-      expiresIn: better_auth_plugins0.TimeString;
-      interval: better_auth_plugins0.TimeString;
+      expiresIn: better_auth_plugins20.TimeString;
+      interval: better_auth_plugins20.TimeString;
       deviceCodeLength: number;
       userCodeLength: number;
       schema: {

package/dist/auth/authz/config.d.ts

@@ -1,4 +1,8 @@
 //#region src/auth/authz/config.d.ts
+/**
+ * Check if a SpiceDB endpoint is localhost (used for TLS auto-detection).
+ */
+declare function isLocalhostEndpoint(endpoint: string): boolean;
 /**
  * Get SpiceDB connection configuration from environment variables.
  * TLS is auto-detected: disabled for localhost, enabled for remote endpoints.
@@ -94,4 +98,4 @@ interface ProjectPermissions {
   canEdit: boolean;
 }
 //#endregion
-export { OrgRole, OrgRoles, ProjectPermissionLevel, ProjectPermissions, ProjectRole, ProjectRoles, SpiceDbOrgPermission, SpiceDbOrgPermissions, SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig };
+export { OrgRole, OrgRoles, ProjectPermissionLevel, ProjectPermissions, ProjectRole, ProjectRoles, SpiceDbOrgPermission, SpiceDbOrgPermissions, SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isLocalhostEndpoint };

package/dist/auth/authz/config.js

@@ -1,15 +1,20 @@
 //#region src/auth/authz/config.ts
 /**
+* Check if a SpiceDB endpoint is localhost (used for TLS auto-detection).
+*/
+function isLocalhostEndpoint(endpoint) {
+	return endpoint.startsWith("localhost") || endpoint.startsWith("127.0.0.1");
+}
+/**
 * Get SpiceDB connection configuration from environment variables.
 * TLS is auto-detected: disabled for localhost, enabled for remote endpoints.
 */
 function getSpiceDbConfig() {
 	const endpoint = process.env.SPICEDB_ENDPOINT || "localhost:50051";
-	const isLocalhost = endpoint.startsWith("localhost") || endpoint.startsWith("127.0.0.1");
 	return {
 		endpoint,
 		token: process.env.SPICEDB_PRESHARED_KEY || "",
-		tlsEnabled: !isLocalhost
+		tlsEnabled: !isLocalhostEndpoint(endpoint)
 	};
 }
 /**
@@ -82,4 +87,4 @@ const ProjectRoles = {
 };
 
 //#endregion
-export { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig };
+export { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isLocalhostEndpoint };

package/dist/auth/init.js

@@ -6,6 +6,7 @@ import { createAgentsRunDatabaseClient } from "../db/runtime/runtime-client.js";
 import { addUserToOrganization, upsertOrganization } from "../data-access/runtime/organizations.js";
 import { getUserByEmail } from "../data-access/runtime/users.js";
 import { createAuth } from "./auth.js";
+import { writeSpiceDbSchema } from "./spicedb-schema.js";
 
 //#region src/auth/init.ts
 /**
@@ -31,6 +32,15 @@ loadEnvironmentFiles();
 const TENANT_ID = process.env.TENANT_ID || "default";
 async function init() {
 	console.log("🚀 Initializing database with default organization and user...\n");
+	console.log("📜 Writing SpiceDB schema...");
+	try {
+		await writeSpiceDbSchema();
+		console.log("   ✅ SpiceDB schema applied");
+	} catch (error) {
+		console.error("   ❌ Failed to write SpiceDB schema:", error);
+		console.error("   Make sure SpiceDB is running (docker-compose.dbs.yml)");
+		process.exit(1);
+	}
 	const dbClient = createAgentsRunDatabaseClient();
 	const username = process.env.INKEEP_AGENTS_MANAGE_UI_USERNAME;
 	const password = process.env.INKEEP_AGENTS_MANAGE_UI_PASSWORD;
@@ -102,7 +112,7 @@ async function init() {
 	console.log("✅ Initialization complete!");
 	console.log("================================================");
 	console.log(`\nOrganization: ${TENANT_ID}`);
-	console.log(`Admin user:   ${username} (owner)`);
+	console.log(`Admin user:   ${username}`);
 	console.log("\nYou can now log in with these credentials.\n");
 	process.exit(0);
 }

package/dist/auth/permissions.d.ts

@@ -1,29 +1,29 @@
-import * as better_auth_plugins69 from "better-auth/plugins";
+import * as better_auth_plugins0 from "better-auth/plugins";
 import { AccessControl } from "better-auth/plugins/access";
 import { organizationClient } from "better-auth/client/plugins";
 
 //#region src/auth/permissions.d.ts
 declare const ac: AccessControl;
 declare const memberRole: {
-  authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
-    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
+  authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
+    actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
     connector: "OR" | "AND";
-  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
+  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+  statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
 };
 declare const adminRole: {
-  authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
-    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
+  authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
+    actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
     connector: "OR" | "AND";
-  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
+  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+  statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
 };
 declare const ownerRole: {
-  authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
-    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
+  authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
+    actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
     connector: "OR" | "AND";
-  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
+  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+  statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
 };
 //#endregion
 export { ac, adminRole, memberRole, organizationClient, ownerRole };

package/dist/auth/spicedb-schema.d.ts

@@ -0,0 +1,9 @@
+//#region src/auth/spicedb-schema.d.ts
+declare function writeSpiceDbSchema(options?: {
+  endpoint?: string;
+  token?: string;
+  schemaPath?: string;
+  maxRetries?: number;
+}): Promise<void>;
+//#endregion
+export { writeSpiceDbSchema };

package/dist/auth/spicedb-schema.js

@@ -0,0 +1,24 @@
+import { getSpiceDbConfig, isLocalhostEndpoint } from "./authz/config.js";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { v1 } from "@authzed/authzed-node";
+
+//#region src/auth/spicedb-schema.ts
+async function writeSpiceDbSchema(options) {
+	const config = getSpiceDbConfig();
+	const { endpoint = config.endpoint, token = config.token, schemaPath = resolve(import.meta.dirname, "../../spicedb/schema.zed"), maxRetries = 30 } = options ?? {};
+	const schema = readFileSync(schemaPath, "utf-8");
+	const client = v1.NewClient(token, endpoint, isLocalhostEndpoint(endpoint) ? v1.ClientSecurity.INSECURE_LOCALHOST_ALLOWED : v1.ClientSecurity.SECURE);
+	let lastError;
+	for (let attempt = 1; attempt <= maxRetries; attempt++) try {
+		await client.promises.writeSchema(v1.WriteSchemaRequest.create({ schema }));
+		return;
+	} catch (error) {
+		lastError = error;
+		if (attempt < maxRetries) await new Promise((r) => setTimeout(r, 1e3));
+	}
+	throw new Error(`Failed to write SpiceDB schema after ${maxRetries} attempts: ${lastError?.message}`);
+}
+
+//#endregion
+export { writeSpiceDbSchema };