@inkeep/agents-core 0.41.2 → 0.43.0

package/dist/auth/authz/config.js

@@ -0,0 +1,93 @@
+//#region src/auth/authz/config.ts
+/**
+* SpiceDB Authorization Configuration
+*
+* Feature flag and configuration for the SpiceDB authorization system.
+*/
+function isAuthzEnabled() {
+	return process.env.ENABLE_AUTHZ === "true";
+}
+/**
+* Get SpiceDB connection configuration from environment variables.
+* TLS is auto-detected: disabled for localhost, enabled for remote endpoints.
+*/
+function getSpiceDbConfig() {
+	const endpoint = process.env.SPICEDB_ENDPOINT || "localhost:50051";
+	const isLocalhost = endpoint.startsWith("localhost") || endpoint.startsWith("127.0.0.1");
+	return {
+		endpoint,
+		token: process.env.SPICEDB_PRESHARED_KEY || "",
+		tlsEnabled: !isLocalhost
+	};
+}
+/**
+* SpiceDB resource types used in the schema
+*/
+const SpiceDbResourceTypes = {
+	USER: "user",
+	ORGANIZATION: "organization",
+	PROJECT: "project"
+};
+/**
+* SpiceDB relations used in the schema
+*
+* Relations are named as nouns (roles) per SpiceDB best practices.
+* Project roles are prefixed for clarity when debugging/grepping.
+*/
+const SpiceDbRelations = {
+	OWNER: "owner",
+	ADMIN: "admin",
+	MEMBER: "member",
+	ORGANIZATION: "organization",
+	PROJECT_ADMIN: "project_admin",
+	PROJECT_MEMBER: "project_member",
+	PROJECT_VIEWER: "project_viewer"
+};
+/**
+* SpiceDB permissions for organization resources.
+*
+* From schema.zed definition organization:
+* - view: owner + admin + member
+* - manage: owner + admin (includes managing org settings and all projects)
+*/
+const SpiceDbOrgPermissions = {
+	VIEW: "view",
+	MANAGE: "manage"
+};
+/**
+* SpiceDB permissions for project resources.
+*
+* From schema.zed definition project:
+* - view: read-only access to project and its resources
+* - use: invoke agents, create API keys, view traces
+* - edit: modify configurations, manage members
+*/
+const SpiceDbProjectPermissions = {
+	VIEW: "view",
+	USE: "use",
+	EDIT: "edit"
+};
+/**
+* Organization roles from SpiceDB schema.
+*/
+const OrgRoles = {
+	OWNER: "owner",
+	ADMIN: "admin",
+	MEMBER: "member"
+};
+/**
+* Project roles from SpiceDB schema.
+*
+* Hierarchy:
+* - project_admin: Full access (view + use + edit + manage members)
+* - project_member: Operator access (view + use: invoke agents, create API keys)
+* - project_viewer: Read-only access (view only)
+*/
+const ProjectRoles = {
+	ADMIN: "project_admin",
+	MEMBER: "project_member",
+	VIEWER: "project_viewer"
+};
+
+//#endregion
+export { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled };

package/dist/auth/authz/index.d.ts

@@ -0,0 +1,5 @@
+import { checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, writeRelationship } from "./client.js";
+import { OrgRole, OrgRoles, ProjectPermissionLevel, ProjectPermissions, ProjectRole, ProjectRoles, SpiceDbOrgPermission, SpiceDbOrgPermissions, SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled } from "./config.js";
+import { canEditProject, canUseProject, canViewProject, listAccessibleProjectIds } from "./permissions.js";
+import { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb } from "./sync.js";
+export { type OrgRole, OrgRoles, type ProjectPermissionLevel, type ProjectPermissions, type ProjectRole, ProjectRoles, type SpiceDbOrgPermission, SpiceDbOrgPermissions, type SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, canEditProject, canUseProject, canViewProject, changeOrgRole, changeProjectRole, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, getSpiceDbConfig, grantProjectAccess, isAuthzEnabled, listAccessibleProjectIds, listProjectMembers, listUserProjectMembershipsInSpiceDb, lookupResources, readRelationships, removeProjectFromSpiceDb, resetSpiceClient, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb, writeRelationship };

package/dist/auth/authz/index.js

@@ -0,0 +1,6 @@
+import { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, getSpiceDbConfig, isAuthzEnabled } from "./config.js";
+import { checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, writeRelationship } from "./client.js";
+import { canEditProject, canUseProject, canViewProject, listAccessibleProjectIds } from "./permissions.js";
+import { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb } from "./sync.js";
+
+export { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, canEditProject, canUseProject, canViewProject, changeOrgRole, changeProjectRole, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, getSpiceDbConfig, grantProjectAccess, isAuthzEnabled, listAccessibleProjectIds, listProjectMembers, listUserProjectMembershipsInSpiceDb, lookupResources, readRelationships, removeProjectFromSpiceDb, resetSpiceClient, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb, writeRelationship };

package/dist/auth/authz/permissions.d.ts

@@ -0,0 +1,53 @@
+import { OrgRole } from "./config.js";
+
+//#region src/auth/authz/permissions.d.ts
+
+/**
+ * Check if a user can view a project.
+ *
+ * - If authz is disabled: returns true (current behavior)
+ * - If user is org owner/admin: returns true (bypass)
+ * - Otherwise: checks SpiceDB
+ */
+declare function canViewProject(params: {
+  userId: string;
+  projectId: string;
+  orgRole: OrgRole;
+}): Promise<boolean>;
+/**
+ * Check if a user can use a project (invoke agents, create API keys, view traces).
+ *
+ * - If authz is disabled: returns true (current behavior)
+ * - If user is org owner/admin: returns true (bypass)
+ * - Otherwise: checks SpiceDB for use permission
+ */
+declare function canUseProject(params: {
+  userId: string;
+  projectId: string;
+  orgRole: OrgRole;
+}): Promise<boolean>;
+/**
+ * Check if a user can edit a project (modify configurations).
+ *
+ * - If authz is disabled: only org owner/admin can edit
+ * - If user is org owner/admin: returns true (bypass)
+ * - Otherwise: checks SpiceDB for edit permission
+ */
+declare function canEditProject(params: {
+  userId: string;
+  projectId: string;
+  orgRole: OrgRole;
+}): Promise<boolean>;
+/**
+ * Get list of accessible project IDs for a user.
+ *
+ * - If authz is disabled: returns 'all' (no filtering needed)
+ * - If user is org owner/admin: returns 'all' (no filtering needed)
+ * - Otherwise: uses SpiceDB LookupResources
+ */
+declare function listAccessibleProjectIds(params: {
+  userId: string;
+  orgRole: OrgRole;
+}): Promise<string[] | 'all'>;
+//#endregion
+export { canEditProject, canUseProject, canViewProject, listAccessibleProjectIds };

package/dist/auth/authz/permissions.js

@@ -0,0 +1,83 @@
+import { OrgRoles, SpiceDbProjectPermissions, SpiceDbResourceTypes, isAuthzEnabled } from "./config.js";
+import { checkPermission, lookupResources } from "./client.js";
+
+//#region src/auth/authz/permissions.ts
+/**
+* SpiceDB Permission Check Functions
+*
+* High-level functions for checking project-level permissions.
+*/
+/**
+* Check if a user can view a project.
+*
+* - If authz is disabled: returns true (current behavior)
+* - If user is org owner/admin: returns true (bypass)
+* - Otherwise: checks SpiceDB
+*/
+async function canViewProject(params) {
+	const isAdmin = params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN;
+	if (!isAuthzEnabled() || isAdmin) return true;
+	return checkPermission({
+		resourceType: SpiceDbResourceTypes.PROJECT,
+		resourceId: params.projectId,
+		permission: SpiceDbProjectPermissions.VIEW,
+		subjectType: SpiceDbResourceTypes.USER,
+		subjectId: params.userId
+	});
+}
+/**
+* Check if a user can use a project (invoke agents, create API keys, view traces).
+*
+* - If authz is disabled: returns true (current behavior)
+* - If user is org owner/admin: returns true (bypass)
+* - Otherwise: checks SpiceDB for use permission
+*/
+async function canUseProject(params) {
+	const isAdmin = params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN;
+	if (!isAuthzEnabled() || isAdmin) return true;
+	return checkPermission({
+		resourceType: SpiceDbResourceTypes.PROJECT,
+		resourceId: params.projectId,
+		permission: SpiceDbProjectPermissions.USE,
+		subjectType: SpiceDbResourceTypes.USER,
+		subjectId: params.userId
+	});
+}
+/**
+* Check if a user can edit a project (modify configurations).
+*
+* - If authz is disabled: only org owner/admin can edit
+* - If user is org owner/admin: returns true (bypass)
+* - Otherwise: checks SpiceDB for edit permission
+*/
+async function canEditProject(params) {
+	if (params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN) return true;
+	if (!isAuthzEnabled()) return false;
+	return checkPermission({
+		resourceType: SpiceDbResourceTypes.PROJECT,
+		resourceId: params.projectId,
+		permission: SpiceDbProjectPermissions.EDIT,
+		subjectType: SpiceDbResourceTypes.USER,
+		subjectId: params.userId
+	});
+}
+/**
+* Get list of accessible project IDs for a user.
+*
+* - If authz is disabled: returns 'all' (no filtering needed)
+* - If user is org owner/admin: returns 'all' (no filtering needed)
+* - Otherwise: uses SpiceDB LookupResources
+*/
+async function listAccessibleProjectIds(params) {
+	const isAdmin = params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN;
+	if (!isAuthzEnabled() || isAdmin) return "all";
+	return lookupResources({
+		resourceType: SpiceDbResourceTypes.PROJECT,
+		permission: SpiceDbProjectPermissions.VIEW,
+		subjectType: SpiceDbResourceTypes.USER,
+		subjectId: params.userId
+	});
+}
+
+//#endregion
+export { canEditProject, canUseProject, canViewProject, listAccessibleProjectIds };

package/dist/auth/authz/sync.d.ts

@@ -0,0 +1,106 @@
+import { OrgRole, ProjectRole } from "./config.js";
+
+//#region src/auth/authz/sync.d.ts
+
+/**
+ * Sync a user's org membership to SpiceDB.
+ * Call when: user joins org, role changes, user leaves org.
+ */
+declare function syncOrgMemberToSpiceDb(params: {
+  tenantId: string;
+  userId: string;
+  role: OrgRole;
+  action: 'add' | 'remove';
+}): Promise<void>;
+/**
+ * Change a user's organization role.
+ * Removes the old role and adds the new one atomically in a single transaction.
+ * Call when: user's org role is updated (e.g., member -> admin).
+ */
+declare function changeOrgRole(params: {
+  tenantId: string;
+  userId: string;
+  oldRole: OrgRole;
+  newRole: OrgRole;
+}): Promise<void>;
+/**
+ * Sync a new project to SpiceDB.
+ * Links project to org and grants creator project_admin role (if not already org admin/owner).
+ * Call when: project is created.
+ */
+declare function syncProjectToSpiceDb(params: {
+  tenantId: string;
+  projectId: string;
+  creatorUserId: string;
+}): Promise<void>;
+/**
+ * Grant project access to a user.
+ */
+declare function grantProjectAccess(params: {
+  tenantId: string;
+  projectId: string;
+  userId: string;
+  role: ProjectRole;
+}): Promise<void>;
+/**
+ * Revoke project access from a user.
+ */
+declare function revokeProjectAccess(params: {
+  tenantId: string;
+  projectId: string;
+  userId: string;
+  role: ProjectRole;
+}): Promise<void>;
+/**
+ * Change a user's project role.
+ * Removes the old role and adds the new one atomically in a single transaction.
+ */
+declare function changeProjectRole(params: {
+  tenantId: string;
+  projectId: string;
+  userId: string;
+  oldRole: ProjectRole;
+  newRole: ProjectRole;
+}): Promise<void>;
+/**
+ * Remove a project from SpiceDB.
+ * Call when: project is deleted.
+ */
+declare function removeProjectFromSpiceDb(params: {
+  tenantId: string;
+  projectId: string;
+}): Promise<void>;
+/**
+ * List all explicit project members from SpiceDB.
+ * Returns users with project_admin, project_member, or project_viewer roles.
+ */
+declare function listProjectMembers(params: {
+  tenantId: string;
+  projectId: string;
+}): Promise<Array<{
+  userId: string;
+  role: ProjectRole;
+}>>;
+/**
+ * List all project memberships for a specific user.
+ * Returns projects where the user has explicit project_admin, project_member, or project_viewer roles.
+ */
+declare function listUserProjectMembershipsInSpiceDb(params: {
+  tenantId: string;
+  userId: string;
+}): Promise<Array<{
+  projectId: string;
+  role: ProjectRole;
+}>>;
+/**
+ * Revoke all project memberships for a user.
+ * Call when: user is promoted to org admin (they get inherited access, explicit project roles become redundant).
+ *
+ * Uses efficient bulk delete - deletes all project relationships for user without listing first.
+ */
+declare function revokeAllProjectMemberships(params: {
+  tenantId: string;
+  userId: string;
+}): Promise<void>;
+//#endregion
+export { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb };

package/dist/auth/authz/sync.js

@@ -0,0 +1,321 @@
+import { SpiceDbRelations, SpiceDbResourceTypes, isAuthzEnabled } from "./config.js";
+import { RelationshipOperation, deleteRelationship, getSpiceClient, readRelationships, writeRelationship } from "./client.js";
+
+//#region src/auth/authz/sync.ts
+/**
+* SpiceDB Sync Utilities
+*
+* Functions for syncing data between better-auth and SpiceDB.
+*/
+/**
+* Sync a user's org membership to SpiceDB.
+* Call when: user joins org, role changes, user leaves org.
+*/
+async function syncOrgMemberToSpiceDb(params) {
+	if (!isAuthzEnabled()) return;
+	if (params.action === "add") await writeRelationship({
+		resourceType: SpiceDbResourceTypes.ORGANIZATION,
+		resourceId: params.tenantId,
+		relation: params.role,
+		subjectType: SpiceDbResourceTypes.USER,
+		subjectId: params.userId
+	});
+	else await deleteRelationship({
+		resourceType: SpiceDbResourceTypes.ORGANIZATION,
+		resourceId: params.tenantId,
+		relation: params.role,
+		subjectType: SpiceDbResourceTypes.USER,
+		subjectId: params.userId
+	});
+}
+/**
+* Change a user's organization role.
+* Removes the old role and adds the new one atomically in a single transaction.
+* Call when: user's org role is updated (e.g., member -> admin).
+*/
+async function changeOrgRole(params) {
+	if (!isAuthzEnabled()) return;
+	if (params.oldRole === params.newRole) return;
+	await getSpiceClient().promises.writeRelationships({
+		updates: [{
+			operation: RelationshipOperation.DELETE,
+			relationship: {
+				resource: {
+					objectType: SpiceDbResourceTypes.ORGANIZATION,
+					objectId: params.tenantId
+				},
+				relation: params.oldRole,
+				subject: {
+					object: {
+						objectType: SpiceDbResourceTypes.USER,
+						objectId: params.userId
+					},
+					optionalRelation: ""
+				},
+				optionalCaveat: void 0
+			}
+		}, {
+			operation: RelationshipOperation.TOUCH,
+			relationship: {
+				resource: {
+					objectType: SpiceDbResourceTypes.ORGANIZATION,
+					objectId: params.tenantId
+				},
+				relation: params.newRole,
+				subject: {
+					object: {
+						objectType: SpiceDbResourceTypes.USER,
+						objectId: params.userId
+					},
+					optionalRelation: ""
+				},
+				optionalCaveat: void 0
+			}
+		}],
+		optionalPreconditions: [],
+		optionalTransactionMetadata: void 0
+	});
+}
+/**
+* Sync a new project to SpiceDB.
+* Links project to org and grants creator project_admin role (if not already org admin/owner).
+* Call when: project is created.
+*/
+async function syncProjectToSpiceDb(params) {
+	if (!isAuthzEnabled()) return;
+	const spice = getSpiceClient();
+	const isOrgAdminOrOwner = (await readRelationships({
+		resourceType: SpiceDbResourceTypes.ORGANIZATION,
+		resourceId: params.tenantId,
+		subjectType: SpiceDbResourceTypes.USER,
+		subjectId: params.creatorUserId
+	})).some((r) => r.relation === SpiceDbRelations.ADMIN || r.relation === SpiceDbRelations.OWNER);
+	const updates = [{
+		operation: RelationshipOperation.CREATE,
+		relationship: {
+			resource: {
+				objectType: SpiceDbResourceTypes.PROJECT,
+				objectId: params.projectId
+			},
+			relation: SpiceDbRelations.ORGANIZATION,
+			subject: {
+				object: {
+					objectType: SpiceDbResourceTypes.ORGANIZATION,
+					objectId: params.tenantId
+				},
+				optionalRelation: ""
+			},
+			optionalCaveat: void 0
+		}
+	}];
+	if (!isOrgAdminOrOwner) updates.push({
+		operation: RelationshipOperation.CREATE,
+		relationship: {
+			resource: {
+				objectType: SpiceDbResourceTypes.PROJECT,
+				objectId: params.projectId
+			},
+			relation: SpiceDbRelations.PROJECT_ADMIN,
+			subject: {
+				object: {
+					objectType: SpiceDbResourceTypes.USER,
+					objectId: params.creatorUserId
+				},
+				optionalRelation: ""
+			},
+			optionalCaveat: void 0
+		}
+	});
+	await spice.promises.writeRelationships({
+		updates,
+		optionalPreconditions: [],
+		optionalTransactionMetadata: void 0
+	});
+}
+/**
+* Grant project access to a user.
+*/
+async function grantProjectAccess(params) {
+	if (!isAuthzEnabled()) throw new Error("Authorization is not enabled");
+	await writeRelationship({
+		resourceType: SpiceDbResourceTypes.PROJECT,
+		resourceId: params.projectId,
+		relation: params.role,
+		subjectType: SpiceDbResourceTypes.USER,
+		subjectId: params.userId
+	});
+}
+/**
+* Revoke project access from a user.
+*/
+async function revokeProjectAccess(params) {
+	if (!isAuthzEnabled()) throw new Error("Authorization is not enabled");
+	await deleteRelationship({
+		resourceType: SpiceDbResourceTypes.PROJECT,
+		resourceId: params.projectId,
+		relation: params.role,
+		subjectType: SpiceDbResourceTypes.USER,
+		subjectId: params.userId
+	});
+}
+/**
+* Change a user's project role.
+* Removes the old role and adds the new one atomically in a single transaction.
+*/
+async function changeProjectRole(params) {
+	if (!isAuthzEnabled()) throw new Error("Authorization is not enabled");
+	if (params.oldRole === params.newRole) return;
+	await getSpiceClient().promises.writeRelationships({
+		updates: [{
+			operation: RelationshipOperation.DELETE,
+			relationship: {
+				resource: {
+					objectType: SpiceDbResourceTypes.PROJECT,
+					objectId: params.projectId
+				},
+				relation: params.oldRole,
+				subject: {
+					object: {
+						objectType: SpiceDbResourceTypes.USER,
+						objectId: params.userId
+					},
+					optionalRelation: ""
+				},
+				optionalCaveat: void 0
+			}
+		}, {
+			operation: RelationshipOperation.TOUCH,
+			relationship: {
+				resource: {
+					objectType: SpiceDbResourceTypes.PROJECT,
+					objectId: params.projectId
+				},
+				relation: params.newRole,
+				subject: {
+					object: {
+						objectType: SpiceDbResourceTypes.USER,
+						objectId: params.userId
+					},
+					optionalRelation: ""
+				},
+				optionalCaveat: void 0
+			}
+		}],
+		optionalPreconditions: [],
+		optionalTransactionMetadata: void 0
+	});
+}
+/**
+* Remove a project from SpiceDB.
+* Call when: project is deleted.
+*/
+async function removeProjectFromSpiceDb(params) {
+	if (!isAuthzEnabled()) return;
+	await getSpiceClient().promises.deleteRelationships({
+		relationshipFilter: {
+			resourceType: SpiceDbResourceTypes.PROJECT,
+			optionalResourceId: params.projectId,
+			optionalResourceIdPrefix: "",
+			optionalRelation: ""
+		},
+		optionalPreconditions: [],
+		optionalLimit: 0,
+		optionalAllowPartialDeletions: false,
+		optionalTransactionMetadata: void 0
+	});
+}
+/**
+* List all explicit project members from SpiceDB.
+* Returns users with project_admin, project_member, or project_viewer roles.
+*/
+async function listProjectMembers(params) {
+	if (!isAuthzEnabled()) return [];
+	return (await readRelationships({
+		resourceType: SpiceDbResourceTypes.PROJECT,
+		resourceId: params.projectId
+	})).filter((rel) => rel.subjectType === SpiceDbResourceTypes.USER && (rel.relation === SpiceDbRelations.PROJECT_ADMIN || rel.relation === SpiceDbRelations.PROJECT_MEMBER || rel.relation === SpiceDbRelations.PROJECT_VIEWER)).map((rel) => ({
+		userId: rel.subjectId,
+		role: rel.relation
+	}));
+}
+/**
+* List all project memberships for a specific user.
+* Returns projects where the user has explicit project_admin, project_member, or project_viewer roles.
+*/
+async function listUserProjectMembershipsInSpiceDb(params) {
+	if (!isAuthzEnabled()) return [];
+	return (await readRelationships({
+		resourceType: SpiceDbResourceTypes.PROJECT,
+		subjectType: SpiceDbResourceTypes.USER,
+		subjectId: params.userId
+	})).filter((rel) => rel.relation === SpiceDbRelations.PROJECT_ADMIN || rel.relation === SpiceDbRelations.PROJECT_MEMBER || rel.relation === SpiceDbRelations.PROJECT_VIEWER).map((rel) => ({
+		projectId: rel.resourceId,
+		role: rel.relation
+	}));
+}
+/**
+* Revoke all project memberships for a user.
+* Call when: user is promoted to org admin (they get inherited access, explicit project roles become redundant).
+*
+* Uses efficient bulk delete - deletes all project relationships for user without listing first.
+*/
+async function revokeAllProjectMemberships(params) {
+	if (!isAuthzEnabled()) return;
+	const spice = getSpiceClient();
+	await Promise.all([
+		spice.promises.deleteRelationships({
+			relationshipFilter: {
+				resourceType: SpiceDbResourceTypes.PROJECT,
+				optionalResourceId: "",
+				optionalResourceIdPrefix: "",
+				optionalRelation: SpiceDbRelations.PROJECT_ADMIN,
+				optionalSubjectFilter: {
+					subjectType: SpiceDbResourceTypes.USER,
+					optionalSubjectId: params.userId,
+					optionalRelation: void 0
+				}
+			},
+			optionalPreconditions: [],
+			optionalLimit: 0,
+			optionalAllowPartialDeletions: false,
+			optionalTransactionMetadata: void 0
+		}),
+		spice.promises.deleteRelationships({
+			relationshipFilter: {
+				resourceType: SpiceDbResourceTypes.PROJECT,
+				optionalResourceId: "",
+				optionalResourceIdPrefix: "",
+				optionalRelation: SpiceDbRelations.PROJECT_MEMBER,
+				optionalSubjectFilter: {
+					subjectType: SpiceDbResourceTypes.USER,
+					optionalSubjectId: params.userId,
+					optionalRelation: void 0
+				}
+			},
+			optionalPreconditions: [],
+			optionalLimit: 0,
+			optionalAllowPartialDeletions: false,
+			optionalTransactionMetadata: void 0
+		}),
+		spice.promises.deleteRelationships({
+			relationshipFilter: {
+				resourceType: SpiceDbResourceTypes.PROJECT,
+				optionalResourceId: "",
+				optionalResourceIdPrefix: "",
+				optionalRelation: SpiceDbRelations.PROJECT_VIEWER,
+				optionalSubjectFilter: {
+					subjectType: SpiceDbResourceTypes.USER,
+					optionalSubjectId: params.userId,
+					optionalRelation: void 0
+				}
+			},
+			optionalPreconditions: [],
+			optionalLimit: 0,
+			optionalAllowPartialDeletions: false,
+			optionalTransactionMetadata: void 0
+		})
+	]);
+}
+
+//#endregion
+export { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb };