@inkeep/agents-core 0.41.2 → 0.43.0

package/dist/auth/auth.d.ts

@@ -1,4 +1,4 @@
-import { DatabaseClient } from "../db/client.js";
+import { AgentsRunDatabaseClient } from "../db/runtime/runtime-client.js";
 import * as _better_auth_sso0 from "@better-auth/sso";
 import * as better_auth0 from "better-auth";
 import { BetterAuthAdvancedOptions } from "better-auth";
@@ -56,7 +56,7 @@ interface SSOProviderConfig {
 interface BetterAuthConfig {
   baseURL: string;
   secret: string;
-  dbClient: DatabaseClient;
+  dbClient: AgentsRunDatabaseClient;
   ssoProviders?: SSOProviderConfig[];
   socialProviders?: {
     google?: GoogleOptions;
@@ -81,6 +81,12 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
     requireEmailVerification: false;
     autoSignIn: true;
   };
+  account: {
+    accountLinking: {
+      enabled: true;
+      trustedProviders: ("google" | "email-password" | "auth0")[];
+    };
+  };
   databaseHooks: {
     session: {
       create: {
@@ -846,25 +852,25 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
         };
       };
       membershipLimit: number;
@@ -880,6 +886,36 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
           user: better_auth0.User;
         };
       }): Promise<void>;
+      organizationHooks: {
+        afterAcceptInvitation: ({
+          member,
+          user,
+          organization: org
+        }: {
+          invitation: better_auth_plugins0.Invitation & Record<string, any>;
+          member: better_auth_plugins0.Member & Record<string, any>;
+          user: better_auth0.User & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
+        }) => Promise<void>;
+        beforeUpdateMemberRole: ({
+          member,
+          organization: org,
+          newRole
+        }: {
+          member: better_auth_plugins0.Member & Record<string, any>;
+          newRole: string;
+          user: better_auth0.User & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
+        }) => Promise<void>;
+        afterRemoveMember: ({
+          member,
+          organization: org
+        }: {
+          member: better_auth_plugins0.Member & Record<string, any>;
+          user: better_auth0.User & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
+        }) => Promise<void>;
+      };
     }>;
     schema: {
       organization: {
@@ -1125,25 +1161,25 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "member" | "invitation" | "project" | "tool" | "ac" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
         };
       };
       membershipLimit: number;
@@ -1159,6 +1195,36 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
           user: better_auth0.User;
         };
       }): Promise<void>;
+      organizationHooks: {
+        afterAcceptInvitation: ({
+          member,
+          user,
+          organization: org
+        }: {
+          invitation: better_auth_plugins0.Invitation & Record<string, any>;
+          member: better_auth_plugins0.Member & Record<string, any>;
+          user: better_auth0.User & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
+        }) => Promise<void>;
+        beforeUpdateMemberRole: ({
+          member,
+          organization: org,
+          newRole
+        }: {
+          member: better_auth_plugins0.Member & Record<string, any>;
+          newRole: string;
+          user: better_auth0.User & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
+        }) => Promise<void>;
+        afterRemoveMember: ({
+          member,
+          organization: org
+        }: {
+          member: better_auth_plugins0.Member & Record<string, any>;
+          user: better_auth0.User & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
+        }) => Promise<void>;
+      };
     }>;
   }, {
     id: "device-authorization";

package/dist/auth/auth.js

@@ -1,4 +1,5 @@
 import { member, ssoProvider } from "./auth-schema.js";
+import { OrgRoles } from "./authz/config.js";
 import { env } from "../env.js";
 import { generateId } from "../utils/conversations.js";
 import "../utils/index.js";
@@ -22,7 +23,7 @@ async function getInitialOrganization(dbClient, userId) {
 /**
 * Extracts the root domain from a URL for cross-subdomain cookie sharing.
 * For example:
-* - https://manage-api.pilot.inkeep.com -> .pilot.inkeep.com
+* - https://api.pilot.inkeep.com -> .pilot.inkeep.com
 * - https://pilot.inkeep.com -> .pilot.inkeep.com
 * - http://localhost:3002 -> undefined (no domain for localhost)
 *
@@ -76,6 +77,14 @@ function createAuth(config) {
 			requireEmailVerification: false,
 			autoSignIn: true
 		},
+		account: { accountLinking: {
+			enabled: true,
+			trustedProviders: [
+				"auth0",
+				"google",
+				"email-password"
+			]
+		} },
 		databaseHooks: { session: { create: { before: async (session) => {
 			const organization$1 = await getInitialOrganization(config.dbClient, session.userId);
 			return { data: {
@@ -114,7 +123,7 @@ function createAuth(config) {
 			"http://localhost:3000",
 			"http://localhost:3002",
 			env.INKEEP_AGENTS_MANAGE_UI_URL,
-			env.INKEEP_AGENTS_MANAGE_API_URL,
+			env.INKEEP_AGENTS_API_URL,
 			env.TRUSTED_ORIGIN
 		].filter((origin) => typeof origin === "string" && origin.length > 0),
 		plugins: [
@@ -139,6 +148,55 @@ function createAuth(config) {
 						organization: data.organization.name,
 						invitationId: data.id
 					});
+				},
+				organizationHooks: {
+					afterAcceptInvitation: async ({ member: member$1, user, organization: org }) => {
+						try {
+							const { syncOrgMemberToSpiceDb } = await import("./authz/sync.js");
+							await syncOrgMemberToSpiceDb({
+								tenantId: org.id,
+								userId: user.id,
+								role: member$1.role,
+								action: "add"
+							});
+							console.log(`🔐 SpiceDB: Synced member ${user.email} as ${member$1.role} to org ${org.name}`);
+						} catch (error) {
+							console.error("❌ SpiceDB sync failed for new member:", error);
+						}
+					},
+					beforeUpdateMemberRole: async ({ member: member$1, organization: org, newRole }) => {
+						const { changeOrgRole, revokeAllProjectMemberships } = await import("./authz/sync.js");
+						const oldRole = member$1.role;
+						const targetRole = newRole;
+						await changeOrgRole({
+							tenantId: org.id,
+							userId: member$1.userId,
+							oldRole,
+							newRole: targetRole
+						});
+						console.log(`🔐 SpiceDB: Updated member ${member$1.userId} role from ${oldRole} to ${targetRole} in org ${org.name}`);
+						if (oldRole === OrgRoles.MEMBER && (targetRole === OrgRoles.ADMIN || targetRole === OrgRoles.OWNER)) {
+							await revokeAllProjectMemberships({
+								tenantId: org.id,
+								userId: member$1.userId
+							});
+							console.log(`🔐 SpiceDB: Revoked all project memberships for ${member$1.userId} (promoted to ${targetRole})`);
+						}
+					},
+					afterRemoveMember: async ({ member: member$1, organization: org }) => {
+						try {
+							const { syncOrgMemberToSpiceDb } = await import("./authz/sync.js");
+							await syncOrgMemberToSpiceDb({
+								tenantId: org.id,
+								userId: member$1.userId,
+								role: member$1.role,
+								action: "remove"
+							});
+							console.log(`🔐 SpiceDB: Removed member ${member$1.userId} from org ${org.name}`);
+						} catch (error) {
+							console.error("❌ SpiceDB sync failed for member removal:", error);
+						}
+					}
 				}
 			}),
 			deviceAuthorization({

package/dist/auth/authz/client.d.ts

@@ -0,0 +1,87 @@
+import { v1 } from "@authzed/authzed-node";
+
+//#region src/auth/authz/client.d.ts
+
+type ZedClientInterface = ReturnType<typeof v1.NewClient>;
+/**
+ * Get the SpiceDB client singleton.
+ * Creates a new client on first call.
+ */
+declare function getSpiceClient(): ZedClientInterface;
+/**
+ * Reset the client (useful for testing)
+ */
+declare function resetSpiceClient(): void;
+declare const RelationshipOperation: typeof v1.RelationshipUpdate_Operation;
+declare const Permissionship: typeof v1.CheckPermissionResponse_Permissionship;
+/**
+ * Check if a subject has a permission on a resource.
+ * Note: Caller must verify isAuthzEnabled() before calling.
+ */
+declare function checkPermission(params: {
+  resourceType: string;
+  resourceId: string;
+  permission: string;
+  subjectType: string;
+  subjectId: string;
+}): Promise<boolean>;
+/**
+ * Check multiple permissions on a resource in a single request.
+ * More efficient than multiple checkPermission calls.
+ *
+ * @returns Record mapping permission names to boolean results
+ */
+declare function checkBulkPermissions(params: {
+  resourceType: string;
+  resourceId: string;
+  permissions: string[];
+  subjectType: string;
+  subjectId: string;
+}): Promise<Record<string, boolean>>;
+/**
+ * Find all resources of a type that a subject has a permission on.
+ */
+declare function lookupResources(params: {
+  resourceType: string;
+  permission: string;
+  subjectType: string;
+  subjectId: string;
+}): Promise<string[]>;
+/**
+ * Write a relationship to SpiceDB.
+ */
+declare function writeRelationship(params: {
+  resourceType: string;
+  resourceId: string;
+  relation: string;
+  subjectType: string;
+  subjectId: string;
+}): Promise<void>;
+/**
+ * Delete a relationship from SpiceDB.
+ */
+declare function deleteRelationship(params: {
+  resourceType: string;
+  resourceId: string;
+  relation: string;
+  subjectType: string;
+  subjectId: string;
+}): Promise<void>;
+/**
+ * Read relationships for a resource to list subjects with access.
+ * Optionally filter by subject type and ID.
+ */
+declare function readRelationships(params: {
+  resourceType: string;
+  resourceId?: string;
+  relation?: string;
+  subjectType?: string;
+  subjectId?: string;
+}): Promise<Array<{
+  resourceId: string;
+  subjectType: string;
+  subjectId: string;
+  relation: string;
+}>>;
+//#endregion
+export { Permissionship, RelationshipOperation, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, v1, writeRelationship };

package/dist/auth/authz/client.js

@@ -0,0 +1,196 @@
+import { getSpiceDbConfig } from "./config.js";
+import { v1 } from "@authzed/authzed-node";
+
+//#region src/auth/authz/client.ts
+/**
+* SpiceDB Client Wrapper
+*
+* Provides a singleton SpiceDB client and helper functions for common operations.
+*/
+const { RelationshipUpdate_Operation, CheckPermissionResponse_Permissionship } = v1;
+let client = null;
+/**
+* Get the SpiceDB client singleton.
+* Creates a new client on first call.
+*/
+function getSpiceClient() {
+	if (!client) {
+		const config = getSpiceDbConfig();
+		client = v1.NewClient(config.token, config.endpoint, config.tlsEnabled ? v1.ClientSecurity.SECURE : v1.ClientSecurity.INSECURE_LOCALHOST_ALLOWED);
+	}
+	return client;
+}
+/**
+* Reset the client (useful for testing)
+*/
+function resetSpiceClient() {
+	client = null;
+}
+const RelationshipOperation = RelationshipUpdate_Operation;
+const Permissionship = CheckPermissionResponse_Permissionship;
+/**
+* Check if a subject has a permission on a resource.
+* Note: Caller must verify isAuthzEnabled() before calling.
+*/
+async function checkPermission(params) {
+	return (await getSpiceClient().promises.checkPermission({
+		resource: {
+			objectType: params.resourceType,
+			objectId: params.resourceId
+		},
+		permission: params.permission,
+		subject: {
+			object: {
+				objectType: params.subjectType,
+				objectId: params.subjectId
+			},
+			optionalRelation: ""
+		},
+		consistency: { requirement: {
+			oneofKind: "fullyConsistent",
+			fullyConsistent: true
+		} },
+		context: void 0,
+		withTracing: false
+	})).permissionship === CheckPermissionResponse_Permissionship.HAS_PERMISSION;
+}
+/**
+* Check multiple permissions on a resource in a single request.
+* More efficient than multiple checkPermission calls.
+*
+* @returns Record mapping permission names to boolean results
+*/
+async function checkBulkPermissions(params) {
+	const spice = getSpiceClient();
+	const items = params.permissions.map((permission) => v1.CheckBulkPermissionsRequestItem.create({
+		resource: v1.ObjectReference.create({
+			objectType: params.resourceType,
+			objectId: params.resourceId
+		}),
+		permission,
+		subject: v1.SubjectReference.create({ object: v1.ObjectReference.create({
+			objectType: params.subjectType,
+			objectId: params.subjectId
+		}) })
+	}));
+	const response = await spice.promises.checkBulkPermissions(v1.CheckBulkPermissionsRequest.create({
+		items,
+		consistency: { requirement: {
+			oneofKind: "fullyConsistent",
+			fullyConsistent: true
+		} }
+	}));
+	const result = {};
+	for (let i = 0; i < params.permissions.length; i++) {
+		const permission = params.permissions[i];
+		const pair = response.pairs[i];
+		if (pair.response.oneofKind === "item") result[permission] = pair.response.item.permissionship === CheckPermissionResponse_Permissionship.HAS_PERMISSION;
+		else result[permission] = false;
+	}
+	return result;
+}
+/**
+* Find all resources of a type that a subject has a permission on.
+*/
+async function lookupResources(params) {
+	return (await getSpiceClient().promises.lookupResources({
+		resourceObjectType: params.resourceType,
+		permission: params.permission,
+		subject: {
+			object: {
+				objectType: params.subjectType,
+				objectId: params.subjectId
+			},
+			optionalRelation: ""
+		},
+		consistency: { requirement: {
+			oneofKind: "fullyConsistent",
+			fullyConsistent: true
+		} },
+		context: void 0,
+		optionalLimit: 0,
+		optionalCursor: void 0
+	})).map((item) => item.resourceObjectId);
+}
+/**
+* Write a relationship to SpiceDB.
+*/
+async function writeRelationship(params) {
+	await getSpiceClient().promises.writeRelationships({
+		updates: [{
+			operation: RelationshipUpdate_Operation.TOUCH,
+			relationship: {
+				resource: {
+					objectType: params.resourceType,
+					objectId: params.resourceId
+				},
+				relation: params.relation,
+				subject: {
+					object: {
+						objectType: params.subjectType,
+						objectId: params.subjectId
+					},
+					optionalRelation: ""
+				},
+				optionalCaveat: void 0
+			}
+		}],
+		optionalPreconditions: [],
+		optionalTransactionMetadata: void 0
+	});
+}
+/**
+* Delete a relationship from SpiceDB.
+*/
+async function deleteRelationship(params) {
+	await getSpiceClient().promises.deleteRelationships({
+		relationshipFilter: {
+			resourceType: params.resourceType,
+			optionalResourceId: params.resourceId,
+			optionalResourceIdPrefix: "",
+			optionalRelation: params.relation,
+			optionalSubjectFilter: {
+				subjectType: params.subjectType,
+				optionalSubjectId: params.subjectId,
+				optionalRelation: void 0
+			}
+		},
+		optionalPreconditions: [],
+		optionalLimit: 0,
+		optionalAllowPartialDeletions: false,
+		optionalTransactionMetadata: void 0
+	});
+}
+/**
+* Read relationships for a resource to list subjects with access.
+* Optionally filter by subject type and ID.
+*/
+async function readRelationships(params) {
+	return (await getSpiceClient().promises.readRelationships({
+		relationshipFilter: {
+			resourceType: params.resourceType,
+			optionalResourceId: params.resourceId || "",
+			optionalResourceIdPrefix: "",
+			optionalRelation: params.relation || "",
+			optionalSubjectFilter: params.subjectType || params.subjectId ? {
+				subjectType: params.subjectType || "",
+				optionalSubjectId: params.subjectId || "",
+				optionalRelation: void 0
+			} : void 0
+		},
+		consistency: { requirement: {
+			oneofKind: "fullyConsistent",
+			fullyConsistent: true
+		} },
+		optionalLimit: 0,
+		optionalCursor: void 0
+	})).map((item) => ({
+		resourceId: item.relationship?.resource?.objectId || "",
+		subjectType: item.relationship?.subject?.object?.objectType || "",
+		subjectId: item.relationship?.subject?.object?.objectId || "",
+		relation: item.relationship?.relation || ""
+	}));
+}
+
+//#endregion
+export { Permissionship, RelationshipOperation, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, v1, writeRelationship };

package/dist/auth/authz/config.d.ts

@@ -0,0 +1,103 @@
+//#region src/auth/authz/config.d.ts
+/**
+ * SpiceDB Authorization Configuration
+ *
+ * Feature flag and configuration for the SpiceDB authorization system.
+ */
+declare function isAuthzEnabled(): boolean;
+/**
+ * Get SpiceDB connection configuration from environment variables.
+ * TLS is auto-detected: disabled for localhost, enabled for remote endpoints.
+ */
+declare function getSpiceDbConfig(): {
+  endpoint: string;
+  token: string;
+  tlsEnabled: boolean;
+};
+/**
+ * SpiceDB resource types used in the schema
+ */
+declare const SpiceDbResourceTypes: {
+  readonly USER: "user";
+  readonly ORGANIZATION: "organization";
+  readonly PROJECT: "project";
+};
+/**
+ * SpiceDB relations used in the schema
+ *
+ * Relations are named as nouns (roles) per SpiceDB best practices.
+ * Project roles are prefixed for clarity when debugging/grepping.
+ */
+declare const SpiceDbRelations: {
+  readonly OWNER: "owner";
+  readonly ADMIN: "admin";
+  readonly MEMBER: "member";
+  readonly ORGANIZATION: "organization";
+  readonly PROJECT_ADMIN: "project_admin";
+  readonly PROJECT_MEMBER: "project_member";
+  readonly PROJECT_VIEWER: "project_viewer";
+};
+/**
+ * SpiceDB permissions for organization resources.
+ *
+ * From schema.zed definition organization:
+ * - view: owner + admin + member
+ * - manage: owner + admin (includes managing org settings and all projects)
+ */
+declare const SpiceDbOrgPermissions: {
+  readonly VIEW: "view";
+  readonly MANAGE: "manage";
+};
+type SpiceDbOrgPermission = (typeof SpiceDbOrgPermissions)[keyof typeof SpiceDbOrgPermissions];
+/**
+ * SpiceDB permissions for project resources.
+ *
+ * From schema.zed definition project:
+ * - view: read-only access to project and its resources
+ * - use: invoke agents, create API keys, view traces
+ * - edit: modify configurations, manage members
+ */
+declare const SpiceDbProjectPermissions: {
+  readonly VIEW: "view";
+  readonly USE: "use";
+  readonly EDIT: "edit";
+};
+type SpiceDbProjectPermission = (typeof SpiceDbProjectPermissions)[keyof typeof SpiceDbProjectPermissions];
+/**
+ * Permission levels for project access checks.
+ */
+type ProjectPermissionLevel = SpiceDbProjectPermission;
+/**
+ * Organization roles from SpiceDB schema.
+ */
+declare const OrgRoles: {
+  readonly OWNER: "owner";
+  readonly ADMIN: "admin";
+  readonly MEMBER: "member";
+};
+type OrgRole = (typeof OrgRoles)[keyof typeof OrgRoles];
+/**
+ * Project roles from SpiceDB schema.
+ *
+ * Hierarchy:
+ * - project_admin: Full access (view + use + edit + manage members)
+ * - project_member: Operator access (view + use: invoke agents, create API keys)
+ * - project_viewer: Read-only access (view only)
+ */
+declare const ProjectRoles: {
+  readonly ADMIN: "project_admin";
+  readonly MEMBER: "project_member";
+  readonly VIEWER: "project_viewer";
+};
+type ProjectRole = (typeof ProjectRoles)[keyof typeof ProjectRoles];
+/**
+ * Project permission capabilities.
+ * Maps to the SpiceDB permission checks (view, use, edit).
+ */
+interface ProjectPermissions {
+  canView: boolean;
+  canUse: boolean;
+  canEdit: boolean;
+}
+//#endregion
+export { OrgRole, OrgRoles, ProjectPermissionLevel, ProjectPermissions, ProjectRole, ProjectRoles, SpiceDbOrgPermission, SpiceDbOrgPermissions, SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled };