snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)

gen/es/ory/keto/opl/v1alpha1/syntax_service_connect.d.ts

@@ -0,0 +1,32 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-connect-es v1.7.0
+// @generated from file ory/keto/opl/v1alpha1/syntax_service.proto (package ory.keto.opl.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { CheckRequest, CheckResponse } from "./syntax_service_pb.js"
+import { MethodKind } from "@bufbuild/protobuf"
+
+/**
+ * The service that checks the syntax of an OPL file.
+ *
+ * @generated from service ory.keto.opl.v1alpha1.SyntaxService
+ */
+export declare const SyntaxService: {
+  readonly typeName: "ory.keto.opl.v1alpha1.SyntaxService"
+  readonly methods: {
+    /**
+     * Performs a syntax check request.
+     *
+     * @generated from rpc ory.keto.opl.v1alpha1.SyntaxService.Check
+     */
+    readonly check: {
+      readonly name: "Check"
+      readonly I: typeof CheckRequest
+      readonly O: typeof CheckResponse
+      readonly kind: MethodKind.Unary
+    }
+  }
+}

gen/es/ory/keto/opl/v1alpha1/syntax_service_connect.js

@@ -0,0 +1,32 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-connect-es v1.7.0
+// @generated from file ory/keto/opl/v1alpha1/syntax_service.proto (package ory.keto.opl.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { CheckRequest, CheckResponse } from "./syntax_service_pb.js"
+import { MethodKind } from "@bufbuild/protobuf"
+
+/**
+ * The service that checks the syntax of an OPL file.
+ *
+ * @generated from service ory.keto.opl.v1alpha1.SyntaxService
+ */
+export const SyntaxService = {
+  typeName: "ory.keto.opl.v1alpha1.SyntaxService",
+  methods: {
+    /**
+     * Performs a syntax check request.
+     *
+     * @generated from rpc ory.keto.opl.v1alpha1.SyntaxService.Check
+     */
+    check: {
+      name: "Check",
+      I: CheckRequest,
+      O: CheckResponse,
+      kind: MethodKind.Unary,
+    },
+  },
+}

gen/es/ory/keto/opl/v1alpha1/syntax_service_pb.d.ts

@@ -0,0 +1,118 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/opl/v1alpha1/syntax_service.proto (package ory.keto.opl.v1alpha1, syntax proto3)
+/* eslint-disable */
+
+import type {
+  GenFile,
+  GenMessage,
+  GenService,
+} from "@bufbuild/protobuf/codegenv2"
+import type { Message } from "@bufbuild/protobuf"
+
+/**
+ * Describes the file ory/keto/opl/v1alpha1/syntax_service.proto.
+ */
+export declare const file_ory_keto_opl_v1alpha1_syntax_service: GenFile
+
+/**
+ * @generated from message ory.keto.opl.v1alpha1.CheckRequest
+ */
+export declare type CheckRequest =
+  Message<"ory.keto.opl.v1alpha1.CheckRequest"> & {
+    /**
+     * @generated from field: bytes content = 1;
+     */
+    content: Uint8Array
+  }
+
+/**
+ * Describes the message ory.keto.opl.v1alpha1.CheckRequest.
+ * Use `create(CheckRequestSchema)` to create a new message.
+ */
+export declare const CheckRequestSchema: GenMessage<CheckRequest>
+
+/**
+ * @generated from message ory.keto.opl.v1alpha1.CheckResponse
+ */
+export declare type CheckResponse =
+  Message<"ory.keto.opl.v1alpha1.CheckResponse"> & {
+    /**
+     * @generated from field: repeated ory.keto.opl.v1alpha1.ParseError parse_errors = 1;
+     */
+    parseErrors: ParseError[]
+  }
+
+/**
+ * Describes the message ory.keto.opl.v1alpha1.CheckResponse.
+ * Use `create(CheckResponseSchema)` to create a new message.
+ */
+export declare const CheckResponseSchema: GenMessage<CheckResponse>
+
+/**
+ * @generated from message ory.keto.opl.v1alpha1.ParseError
+ */
+export declare type ParseError = Message<"ory.keto.opl.v1alpha1.ParseError"> & {
+  /**
+   * @generated from field: string message = 1;
+   */
+  message: string
+
+  /**
+   * @generated from field: ory.keto.opl.v1alpha1.SourcePosition start = 2;
+   */
+  start?: SourcePosition
+
+  /**
+   * @generated from field: ory.keto.opl.v1alpha1.SourcePosition end = 3;
+   */
+  end?: SourcePosition
+}
+
+/**
+ * Describes the message ory.keto.opl.v1alpha1.ParseError.
+ * Use `create(ParseErrorSchema)` to create a new message.
+ */
+export declare const ParseErrorSchema: GenMessage<ParseError>
+
+/**
+ * @generated from message ory.keto.opl.v1alpha1.SourcePosition
+ */
+export declare type SourcePosition =
+  Message<"ory.keto.opl.v1alpha1.SourcePosition"> & {
+    /**
+     * @generated from field: uint32 line = 1;
+     */
+    line: number
+
+    /**
+     * @generated from field: uint32 column = 2;
+     */
+    column: number
+  }
+
+/**
+ * Describes the message ory.keto.opl.v1alpha1.SourcePosition.
+ * Use `create(SourcePositionSchema)` to create a new message.
+ */
+export declare const SourcePositionSchema: GenMessage<SourcePosition>
+
+/**
+ * The service that checks the syntax of an OPL file.
+ *
+ * @generated from service ory.keto.opl.v1alpha1.SyntaxService
+ */
+export declare const SyntaxService: GenService<{
+  /**
+   * Performs a syntax check request.
+   *
+   * @generated from rpc ory.keto.opl.v1alpha1.SyntaxService.Check
+   */
+  check: {
+    methodKind: "unary"
+    input: typeof CheckRequestSchema
+    output: typeof CheckResponseSchema
+  }
+}>

gen/es/ory/keto/opl/v1alpha1/syntax_service_pb.js

@@ -0,0 +1,62 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/opl/v1alpha1/syntax_service.proto (package ory.keto.opl.v1alpha1, syntax proto3)
+/* eslint-disable */
+
+import {
+  fileDesc,
+  messageDesc,
+  serviceDesc,
+} from "@bufbuild/protobuf/codegenv2"
+
+/**
+ * Describes the file ory/keto/opl/v1alpha1/syntax_service.proto.
+ */
+export const file_ory_keto_opl_v1alpha1_syntax_service =
+  /*@__PURE__*/
+  fileDesc(
+    "Cipvcnkva2V0by9vcGwvdjFhbHBoYTEvc3ludGF4X3NlcnZpY2UucHJvdG8SFW9yeS5rZXRvLm9wbC52MWFscGhhMSIfCgxDaGVja1JlcXVlc3QSDwoHY29udGVudBgBIAEoDCJICg1DaGVja1Jlc3BvbnNlEjcKDHBhcnNlX2Vycm9ycxgBIAMoCzIhLm9yeS5rZXRvLm9wbC52MWFscGhhMS5QYXJzZUVycm9yIocBCgpQYXJzZUVycm9yEg8KB21lc3NhZ2UYASABKAkSNAoFc3RhcnQYAiABKAsyJS5vcnkua2V0by5vcGwudjFhbHBoYTEuU291cmNlUG9zaXRpb24SMgoDZW5kGAMgASgLMiUub3J5LmtldG8ub3BsLnYxYWxwaGExLlNvdXJjZVBvc2l0aW9uIi4KDlNvdXJjZVBvc2l0aW9uEgwKBGxpbmUYASABKA0SDgoGY29sdW1uGAIgASgNMmMKDVN5bnRheFNlcnZpY2USUgoFQ2hlY2sSIy5vcnkua2V0by5vcGwudjFhbHBoYTEuQ2hlY2tSZXF1ZXN0GiQub3J5LmtldG8ub3BsLnYxYWxwaGExLkNoZWNrUmVzcG9uc2VC3AEKGWNvbS5vcnkua2V0by5vcGwudjFhbHBoYTFCElN5bnRheFNlcnZpY2VQcm90b1ABWjRnaXRodWIuY29tL29yeS9rZXRvL2dlbi9nby9vcnkva2V0by9vcGwvdjFhbHBoYTE7b3BsogIDT0tPqgIVT3J5LktldG8uT3BsLlYxYWxwaGExygIVT3J5XEtldG9cT3BsXFYxYWxwaGEx4gIhT3J5XEtldG9cT3BsXFYxYWxwaGExXEdQQk1ldGFkYXRh6gIYT3J5OjpLZXRvOjpPcGw6OlYxYWxwaGExYgZwcm90bzM",
+  )
+
+/**
+ * Describes the message ory.keto.opl.v1alpha1.CheckRequest.
+ * Use `create(CheckRequestSchema)` to create a new message.
+ */
+export const CheckRequestSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_opl_v1alpha1_syntax_service, 0)
+
+/**
+ * Describes the message ory.keto.opl.v1alpha1.CheckResponse.
+ * Use `create(CheckResponseSchema)` to create a new message.
+ */
+export const CheckResponseSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_opl_v1alpha1_syntax_service, 1)
+
+/**
+ * Describes the message ory.keto.opl.v1alpha1.ParseError.
+ * Use `create(ParseErrorSchema)` to create a new message.
+ */
+export const ParseErrorSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_opl_v1alpha1_syntax_service, 2)
+
+/**
+ * Describes the message ory.keto.opl.v1alpha1.SourcePosition.
+ * Use `create(SourcePositionSchema)` to create a new message.
+ */
+export const SourcePositionSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_opl_v1alpha1_syntax_service, 3)
+
+/**
+ * The service that checks the syntax of an OPL file.
+ *
+ * @generated from service ory.keto.opl.v1alpha1.SyntaxService
+ */
+export const SyntaxService =
+  /*@__PURE__*/
+  serviceDesc(file_ory_keto_opl_v1alpha1_syntax_service, 0)

gen/es/ory/keto/relation_tuples/v1alpha2/check_service_connect.d.ts

@@ -0,0 +1,49 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-connect-es v1.7.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/check_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import {
+  BatchCheckRequest,
+  BatchCheckResponse,
+  CheckRequest,
+  CheckResponse,
+} from "./check_service_pb.js"
+import { MethodKind } from "@bufbuild/protobuf"
+
+/**
+ * The service that performs authorization checks
+ * based on the stored Access Control Lists.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.CheckService
+ */
+export declare const CheckService: {
+  readonly typeName: "ory.keto.relation_tuples.v1alpha2.CheckService"
+  readonly methods: {
+    /**
+     * Performs an authorization check.
+     *
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.CheckService.Check
+     */
+    readonly check: {
+      readonly name: "Check"
+      readonly I: typeof CheckRequest
+      readonly O: typeof CheckResponse
+      readonly kind: MethodKind.Unary
+    }
+    /**
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.CheckService.BatchCheck
+     */
+    readonly batchCheck: {
+      readonly name: "BatchCheck"
+      readonly I: typeof BatchCheckRequest
+      readonly O: typeof BatchCheckResponse
+      readonly kind: MethodKind.Unary
+    }
+  }
+}

gen/es/ory/keto/relation_tuples/v1alpha2/check_service_connect.js

@@ -0,0 +1,49 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-connect-es v1.7.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/check_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import {
+  BatchCheckRequest,
+  BatchCheckResponse,
+  CheckRequest,
+  CheckResponse,
+} from "./check_service_pb.js"
+import { MethodKind } from "@bufbuild/protobuf"
+
+/**
+ * The service that performs authorization checks
+ * based on the stored Access Control Lists.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.CheckService
+ */
+export const CheckService = {
+  typeName: "ory.keto.relation_tuples.v1alpha2.CheckService",
+  methods: {
+    /**
+     * Performs an authorization check.
+     *
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.CheckService.Check
+     */
+    check: {
+      name: "Check",
+      I: CheckRequest,
+      O: CheckResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.CheckService.BatchCheck
+     */
+    batchCheck: {
+      name: "BatchCheck",
+      I: BatchCheckRequest,
+      O: BatchCheckResponse,
+      kind: MethodKind.Unary,
+    },
+  },
+}

gen/es/ory/keto/relation_tuples/v1alpha2/check_service_pb.d.ts

@@ -0,0 +1,357 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/check_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+
+import type {
+  GenFile,
+  GenMessage,
+  GenService,
+} from "@bufbuild/protobuf/codegenv2"
+import type { Message } from "@bufbuild/protobuf"
+import type { RelationTuple, Subject } from "./relation_tuples_pb"
+
+/**
+ * Describes the file ory/keto/relation_tuples/v1alpha2/check_service.proto.
+ */
+export declare const file_ory_keto_relation_tuples_v1alpha2_check_service: GenFile
+
+/**
+ * The request for a CheckService.Check RPC.
+ * Checks whether a specific subject is related to an object.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.CheckRequest
+ */
+export declare type CheckRequest =
+  Message<"ory.keto.relation_tuples.v1alpha2.CheckRequest"> & {
+    /**
+     * The namespace to evaluate the check.
+     *
+     * Note: If you use the expand-API and the check
+     * evaluates a RelationTuple specifying a SubjectSet as
+     * subject or due to a rewrite rule in a namespace config
+     * this check request may involve other namespaces automatically.
+     *
+     * @generated from field: string namespace = 1 [deprecated = true];
+     * @deprecated
+     */
+    namespace: string
+
+    /**
+     * The related object in this check.
+     *
+     * @generated from field: string object = 2 [deprecated = true];
+     * @deprecated
+     */
+    object: string
+
+    /**
+     * The relation between the Object and the Subject.
+     *
+     * @generated from field: string relation = 3 [deprecated = true];
+     * @deprecated
+     */
+    relation: string
+
+    /**
+     * The related subject in this check.
+     *
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.Subject subject = 4 [deprecated = true];
+     * @deprecated
+     */
+    subject?: Subject
+
+    /**
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.RelationTuple tuple = 8;
+     */
+    tuple?: RelationTuple
+
+    /**
+     * This field is not implemented yet and has no effect.
+     * <!--
+     * Set this field to `true` in case your application
+     * needs to authorize depending on up to date ACLs,
+     * also called a "content-change check".
+     *
+     * If set to `true` the `snaptoken` field is ignored,
+     * the check is evaluated at the latest snapshot
+     * (globally consistent) and the response includes a
+     * snaptoken for clients to store along with object
+     * contents that can be used for subsequent checks
+     * of the same content version.
+     *
+     * Example use case:
+     *  - You need to authorize a user to modify/delete some resource
+     *    and it is unacceptable that if the permission to do that had
+     *    just been revoked some seconds ago so that the change had not
+     *    yet been fully replicated to all availability zones.
+     * -->
+     *
+     * @generated from field: bool latest = 5;
+     */
+    latest: boolean
+
+    /**
+     * This field is not implemented yet and has no effect.
+     * <!--
+     * Optional. Like reads, a check is always evaluated at a
+     * consistent snapshot no earlier than the given snaptoken.
+     *
+     * Leave this field blank if you want to evaluate the check
+     * based on eventually consistent ACLs, benefiting from very
+     * low latency, but possibly slightly stale results.
+     *
+     * If the specified token is too old and no longer known,
+     * the server falls back as if no snaptoken had been specified.
+     *
+     * If not specified the server tries to evaluate the check
+     * on the best snapshot version where it is very likely that
+     * ACLs had already been replicated to all availability zones.
+     * -->
+     *
+     * @generated from field: string snaptoken = 6;
+     */
+    snaptoken: string
+
+    /**
+     * The maximum depth to search for a relation.
+     *
+     * If the value is less than 1 or greater than the global
+     * max-depth then the global max-depth will be used instead.
+     *
+     * @generated from field: int32 max_depth = 7;
+     */
+    maxDepth: number
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.CheckRequest.
+ * Use `create(CheckRequestSchema)` to create a new message.
+ */
+export declare const CheckRequestSchema: GenMessage<CheckRequest>
+
+/**
+ * The response for a CheckService.Check rpc.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.CheckResponse
+ */
+export declare type CheckResponse =
+  Message<"ory.keto.relation_tuples.v1alpha2.CheckResponse"> & {
+    /**
+     * Whether the specified subject (id)
+     * is related to the requested object.
+     *
+     * It is false by default if no ACL matches.
+     *
+     * @generated from field: bool allowed = 1;
+     */
+    allowed: boolean
+
+    /**
+     * This field is not implemented yet and has no effect.
+     * <!--
+     * The last known snapshot token ONLY specified if
+     * the request had not specified a snaptoken,
+     * since this performed a "content-change request"
+     * and consistently fetched the last known snapshot token.
+     *
+     * This field is not set if the request had specified a snaptoken!
+     *
+     * If set, clients should cache and use this token
+     * for subsequent requests to have minimal latency,
+     * but allow slightly stale responses (only some milliseconds or seconds).
+     * -->
+     *
+     * @generated from field: string snaptoken = 2;
+     */
+    snaptoken: string
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.CheckResponse.
+ * Use `create(CheckResponseSchema)` to create a new message.
+ */
+export declare const CheckResponseSchema: GenMessage<CheckResponse>
+
+/**
+ * The response for an individual check in the CheckService.BatchCheck rpc.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.CheckResponseWithError
+ */
+export declare type CheckResponseWithError =
+  Message<"ory.keto.relation_tuples.v1alpha2.CheckResponseWithError"> & {
+    /**
+     * Whether the specified subject (id)
+     * is related to the requested object.
+     *
+     * It is false by default if no ACL matches.
+     *
+     * @generated from field: bool allowed = 1;
+     */
+    allowed: boolean
+
+    /**
+     * If there was an error checking the tuple,
+     * this will contain the error message.
+     *
+     * If the check was performed successfully, this will be empty.
+     *
+     * @generated from field: string error = 2;
+     */
+    error: string
+
+    /**
+     * This field is not implemented yet and has no effect.
+     * <!--
+     * The last known snapshot token ONLY specified if
+     * the request had not specified a snaptoken,
+     * since this performed a "content-change request"
+     * and consistently fetched the last known snapshot token.
+     *
+     * This field is not set if the request had specified a snaptoken!
+     *
+     * If set, clients should cache and use this token
+     * for subsequent requests to have minimal latency,
+     * but allow slightly stale responses (only some milliseconds or seconds).
+     * -->
+     *
+     * @generated from field: string snaptoken = 3;
+     */
+    snaptoken: string
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.CheckResponseWithError.
+ * Use `create(CheckResponseWithErrorSchema)` to create a new message.
+ */
+export declare const CheckResponseWithErrorSchema: GenMessage<CheckResponseWithError>
+
+/**
+ * The request for a CheckService.BatchCheck RPC.
+ * Checks a batch of relations.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.BatchCheckRequest
+ */
+export declare type BatchCheckRequest =
+  Message<"ory.keto.relation_tuples.v1alpha2.BatchCheckRequest"> & {
+    /**
+     * @generated from field: repeated ory.keto.relation_tuples.v1alpha2.RelationTuple tuples = 1;
+     */
+    tuples: RelationTuple[]
+
+    /**
+     * This field is not implemented yet and has no effect.
+     * <!--
+     * Set this field to `true` in case your application
+     * needs to authorize depending on up to date ACLs,
+     * also called a "content-change check".
+     *
+     * If set to `true` the `snaptoken` field is ignored,
+     * the check is evaluated at the latest snapshot
+     * (globally consistent) and the response includes a
+     * snaptoken for clients to store along with object
+     * contents that can be used for subsequent checks
+     * of the same content version.
+     *
+     * Example use case:
+     *  - You need to authorize a user to modify/delete some resource
+     *    and it is unacceptable that if the permission to do that had
+     *    just been revoked some seconds ago so that the change had not
+     *    yet been fully replicated to all availability zones.
+     * -->
+     *
+     * @generated from field: bool latest = 2;
+     */
+    latest: boolean
+
+    /**
+     * This field is not implemented yet and has no effect.
+     * <!--
+     * Optional. Like reads, a check is always evaluated at a
+     * consistent snapshot no earlier than the given snaptoken.
+     *
+     * Leave this field blank if you want to evaluate the check
+     * based on eventually consistent ACLs, benefiting from very
+     * low latency, but possibly slightly stale results.
+     *
+     * If the specified token is too old and no longer known,
+     * the server falls back as if no snaptoken had been specified.
+     *
+     * If not specified the server tries to evaluate the check
+     * on the best snapshot version where it is very likely that
+     * ACLs had already been replicated to all availability zones.
+     * -->
+     *
+     * @generated from field: string snaptoken = 3;
+     */
+    snaptoken: string
+
+    /**
+     * The maximum depth to search for a relation.
+     *
+     * If the value is less than 1 or greater than the global
+     * max-depth then the global max-depth will be used instead.
+     *
+     * @generated from field: int32 max_depth = 4;
+     */
+    maxDepth: number
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.BatchCheckRequest.
+ * Use `create(BatchCheckRequestSchema)` to create a new message.
+ */
+export declare const BatchCheckRequestSchema: GenMessage<BatchCheckRequest>
+
+/**
+ * The response for a CheckService.BatchCheck rpc.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.BatchCheckResponse
+ */
+export declare type BatchCheckResponse =
+  Message<"ory.keto.relation_tuples.v1alpha2.BatchCheckResponse"> & {
+    /**
+     * The results of the batch check. The order of these
+     * results will match the order of the input.
+     *
+     * @generated from field: repeated ory.keto.relation_tuples.v1alpha2.CheckResponseWithError results = 1;
+     */
+    results: CheckResponseWithError[]
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.BatchCheckResponse.
+ * Use `create(BatchCheckResponseSchema)` to create a new message.
+ */
+export declare const BatchCheckResponseSchema: GenMessage<BatchCheckResponse>
+
+/**
+ * The service that performs authorization checks
+ * based on the stored Access Control Lists.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.CheckService
+ */
+export declare const CheckService: GenService<{
+  /**
+   * Performs an authorization check.
+   *
+   * @generated from rpc ory.keto.relation_tuples.v1alpha2.CheckService.Check
+   */
+  check: {
+    methodKind: "unary"
+    input: typeof CheckRequestSchema
+    output: typeof CheckResponseSchema
+  }
+  /**
+   * @generated from rpc ory.keto.relation_tuples.v1alpha2.CheckService.BatchCheck
+   */
+  batchCheck: {
+    methodKind: "unary"
+    input: typeof BatchCheckRequestSchema
+    output: typeof BatchCheckResponseSchema
+  }
+}>

gen/es/ory/keto/relation_tuples/v1alpha2/check_service_pb.js

@@ -0,0 +1,75 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/check_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+
+import {
+  fileDesc,
+  messageDesc,
+  serviceDesc,
+} from "@bufbuild/protobuf/codegenv2"
+import { file_ory_keto_relation_tuples_v1alpha2_relation_tuples } from "./relation_tuples_pb"
+
+/**
+ * Describes the file ory/keto/relation_tuples/v1alpha2/check_service.proto.
+ */
+export const file_ory_keto_relation_tuples_v1alpha2_check_service =
+  /*@__PURE__*/
+  fileDesc(
+    "CjVvcnkva2V0by9yZWxhdGlvbl90dXBsZXMvdjFhbHBoYTIvY2hlY2tfc2VydmljZS5wcm90bxIhb3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyIocCCgxDaGVja1JlcXVlc3QSFQoJbmFtZXNwYWNlGAEgASgJQgIYARISCgZvYmplY3QYAiABKAlCAhgBEhQKCHJlbGF0aW9uGAMgASgJQgIYARI/CgdzdWJqZWN0GAQgASgLMioub3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyLlN1YmplY3RCAhgBEj8KBXR1cGxlGAggASgLMjAub3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyLlJlbGF0aW9uVHVwbGUSDgoGbGF0ZXN0GAUgASgIEhEKCXNuYXB0b2tlbhgGIAEoCRIRCgltYXhfZGVwdGgYByABKAUiMwoNQ2hlY2tSZXNwb25zZRIPCgdhbGxvd2VkGAEgASgIEhEKCXNuYXB0b2tlbhgCIAEoCSJLChZDaGVja1Jlc3BvbnNlV2l0aEVycm9yEg8KB2FsbG93ZWQYASABKAgSDQoFZXJyb3IYAiABKAkSEQoJc25hcHRva2VuGAMgASgJIosBChFCYXRjaENoZWNrUmVxdWVzdBJACgZ0dXBsZXMYASADKAsyMC5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIuUmVsYXRpb25UdXBsZRIOCgZsYXRlc3QYAiABKAgSEQoJc25hcHRva2VuGAMgASgJEhEKCW1heF9kZXB0aBgEIAEoBSJgChJCYXRjaENoZWNrUmVzcG9uc2USSgoHcmVzdWx0cxgBIAMoCzI5Lm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5DaGVja1Jlc3BvbnNlV2l0aEVycm9yMvUBCgxDaGVja1NlcnZpY2USagoFQ2hlY2sSLy5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIuQ2hlY2tSZXF1ZXN0GjAub3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyLkNoZWNrUmVzcG9uc2USeQoKQmF0Y2hDaGVjaxI0Lm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5CYXRjaENoZWNrUmVxdWVzdBo1Lm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5CYXRjaENoZWNrUmVzcG9uc2VCqgIKJWNvbS5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTJCEUNoZWNrU2VydmljZVByb3RvUAFaS2dpdGh1Yi5jb20vb3J5L2tldG8vZ2VuL2dvL29yeS9rZXRvL3JlbGF0aW9uX3R1cGxlcy92MWFscGhhMjtyZWxhdGlvbnR1cGxlc6ICA09LUqoCIE9yeS5LZXRvLlJlbGF0aW9uVHVwbGVzLlYxYWxwaGEyygIgT3J5XEtldG9cUmVsYXRpb25UdXBsZXNcVjFhbHBoYTLiAixPcnlcS2V0b1xSZWxhdGlvblR1cGxlc1xWMWFscGhhMlxHUEJNZXRhZGF0YeoCI09yeTo6S2V0bzo6UmVsYXRpb25UdXBsZXM6OlYxYWxwaGEyYgZwcm90bzM",
+    [file_ory_keto_relation_tuples_v1alpha2_relation_tuples],
+  )
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.CheckRequest.
+ * Use `create(CheckRequestSchema)` to create a new message.
+ */
+export const CheckRequestSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_check_service, 0)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.CheckResponse.
+ * Use `create(CheckResponseSchema)` to create a new message.
+ */
+export const CheckResponseSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_check_service, 1)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.CheckResponseWithError.
+ * Use `create(CheckResponseWithErrorSchema)` to create a new message.
+ */
+export const CheckResponseWithErrorSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_check_service, 2)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.BatchCheckRequest.
+ * Use `create(BatchCheckRequestSchema)` to create a new message.
+ */
+export const BatchCheckRequestSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_check_service, 3)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.BatchCheckResponse.
+ * Use `create(BatchCheckResponseSchema)` to create a new message.
+ */
+export const BatchCheckResponseSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_check_service, 4)
+
+/**
+ * The service that performs authorization checks
+ * based on the stored Access Control Lists.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.CheckService
+ */
+export const CheckService =
+  /*@__PURE__*/
+  serviceDesc(file_ory_keto_relation_tuples_v1alpha2_check_service, 0)

gen/es/ory/keto/relation_tuples/v1alpha2/expand_service_connect.d.ts

@@ -0,0 +1,35 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-connect-es v1.7.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/expand_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { ExpandRequest, ExpandResponse } from "./expand_service_pb.js"
+import { MethodKind } from "@bufbuild/protobuf"
+
+/**
+ * The service that performs subject set expansion
+ * based on the stored Access Control Lists.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.ExpandService
+ */
+export declare const ExpandService: {
+  readonly typeName: "ory.keto.relation_tuples.v1alpha2.ExpandService"
+  readonly methods: {
+    /**
+     * Expands the subject set into a tree of subjects.
+     *
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.ExpandService.Expand
+     */
+    readonly expand: {
+      readonly name: "Expand"
+      readonly I: typeof ExpandRequest
+      readonly O: typeof ExpandResponse
+      readonly kind: MethodKind.Unary
+    }
+  }
+}

gen/es/ory/keto/relation_tuples/v1alpha2/expand_service_connect.js

@@ -0,0 +1,35 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-connect-es v1.7.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/expand_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { ExpandRequest, ExpandResponse } from "./expand_service_pb.js"
+import { MethodKind } from "@bufbuild/protobuf"
+
+/**
+ * The service that performs subject set expansion
+ * based on the stored Access Control Lists.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.ExpandService
+ */
+export const ExpandService = {
+  typeName: "ory.keto.relation_tuples.v1alpha2.ExpandService",
+  methods: {
+    /**
+     * Expands the subject set into a tree of subjects.
+     *
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.ExpandService.Expand
+     */
+    expand: {
+      name: "Expand",
+      I: ExpandRequest,
+      O: ExpandResponse,
+      kind: MethodKind.Unary,
+    },
+  },
+}

gen/es/ory/keto/relation_tuples/v1alpha2/expand_service_pb.d.ts

@@ -0,0 +1,210 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/expand_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+
+import type {
+  GenEnum,
+  GenFile,
+  GenMessage,
+  GenService,
+} from "@bufbuild/protobuf/codegenv2"
+import type { Message } from "@bufbuild/protobuf"
+import type { RelationTuple, Subject } from "./relation_tuples_pb"
+
+/**
+ * Describes the file ory/keto/relation_tuples/v1alpha2/expand_service.proto.
+ */
+export declare const file_ory_keto_relation_tuples_v1alpha2_expand_service: GenFile
+
+/**
+ * The request for an ExpandService.Expand RPC.
+ * Expands the given subject set.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.ExpandRequest
+ */
+export declare type ExpandRequest =
+  Message<"ory.keto.relation_tuples.v1alpha2.ExpandRequest"> & {
+    /**
+     * The subject to expand.
+     *
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.Subject subject = 1;
+     */
+    subject?: Subject
+
+    /**
+     * The maximum depth of tree to build.
+     *
+     * If the value is less than 1 or greater than the global
+     * max-depth then the global max-depth will be used instead.
+     *
+     * It is important to set this parameter to a meaningful
+     * value. Ponder how deep you really want to display this.
+     *
+     * @generated from field: int32 max_depth = 2;
+     */
+    maxDepth: number
+
+    /**
+     * This field is not implemented yet and has no effect.
+     * <!--
+     * Optional. Like reads, a expand is always evaluated at a
+     * consistent snapshot no earlier than the given snaptoken.
+     *
+     * Leave this field blank if you want to expand
+     * based on eventually consistent ACLs, benefiting from very
+     * low latency, but possibly slightly stale results.
+     *
+     * If the specified token is too old and no longer known,
+     * the server falls back as if no snaptoken had been specified.
+     *
+     * If not specified the server tries to build the tree
+     * on the best snapshot version where it is very likely that
+     * ACLs had already been replicated to all availability zones.
+     * -->
+     *
+     * @generated from field: string snaptoken = 3;
+     */
+    snaptoken: string
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.ExpandRequest.
+ * Use `create(ExpandRequestSchema)` to create a new message.
+ */
+export declare const ExpandRequestSchema: GenMessage<ExpandRequest>
+
+/**
+ * The response for a ExpandService.Expand RPC.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.ExpandResponse
+ */
+export declare type ExpandResponse =
+  Message<"ory.keto.relation_tuples.v1alpha2.ExpandResponse"> & {
+    /**
+     * The tree the requested subject set expands to.
+     * The requested subject set is the subject of the root.
+     *
+     * This field can be nil in some circumstances.
+     *
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.SubjectTree tree = 1;
+     */
+    tree?: SubjectTree
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.ExpandResponse.
+ * Use `create(ExpandResponseSchema)` to create a new message.
+ */
+export declare const ExpandResponseSchema: GenMessage<ExpandResponse>
+
+/**
+ * @generated from message ory.keto.relation_tuples.v1alpha2.SubjectTree
+ */
+export declare type SubjectTree =
+  Message<"ory.keto.relation_tuples.v1alpha2.SubjectTree"> & {
+    /**
+     * The type of the node.
+     *
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.NodeType node_type = 1;
+     */
+    nodeType: NodeType
+
+    /**
+     * The subject this node represents.
+     * Deprecated: More information is now available in the tuple field.
+     *
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.Subject subject = 2 [deprecated = true];
+     * @deprecated
+     */
+    subject?: Subject
+
+    /**
+     * The relation tuple this node represents.
+     *
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.RelationTuple tuple = 4;
+     */
+    tuple?: RelationTuple
+
+    /**
+     * The children of this node.
+     *
+     * This is never set if `node_type` == `NODE_TYPE_LEAF`.
+     *
+     * @generated from field: repeated ory.keto.relation_tuples.v1alpha2.SubjectTree children = 3;
+     */
+    children: SubjectTree[]
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.SubjectTree.
+ * Use `create(SubjectTreeSchema)` to create a new message.
+ */
+export declare const SubjectTreeSchema: GenMessage<SubjectTree>
+
+/**
+ * @generated from enum ory.keto.relation_tuples.v1alpha2.NodeType
+ */
+export enum NodeType {
+  /**
+   * @generated from enum value: NODE_TYPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * This node expands to a union of all children.
+   *
+   * @generated from enum value: NODE_TYPE_UNION = 1;
+   */
+  UNION = 1,
+
+  /**
+   * Not implemented yet.
+   *
+   * @generated from enum value: NODE_TYPE_EXCLUSION = 2;
+   */
+  EXCLUSION = 2,
+
+  /**
+   * Not implemented yet.
+   *
+   * @generated from enum value: NODE_TYPE_INTERSECTION = 3;
+   */
+  INTERSECTION = 3,
+
+  /**
+   * This node is a leaf and contains no children.
+   * Its subject is a `SubjectID` unless `max_depth` was reached.
+   *
+   * @generated from enum value: NODE_TYPE_LEAF = 4;
+   */
+  LEAF = 4,
+}
+
+/**
+ * Describes the enum ory.keto.relation_tuples.v1alpha2.NodeType.
+ */
+export declare const NodeTypeSchema: GenEnum<NodeType>
+
+/**
+ * The service that performs subject set expansion
+ * based on the stored Access Control Lists.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.ExpandService
+ */
+export declare const ExpandService: GenService<{
+  /**
+   * Expands the subject set into a tree of subjects.
+   *
+   * @generated from rpc ory.keto.relation_tuples.v1alpha2.ExpandService.Expand
+   */
+  expand: {
+    methodKind: "unary"
+    input: typeof ExpandRequestSchema
+    output: typeof ExpandResponseSchema
+  }
+}>

gen/es/ory/keto/relation_tuples/v1alpha2/expand_service_pb.js

@@ -0,0 +1,73 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/expand_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+
+import {
+  enumDesc,
+  fileDesc,
+  messageDesc,
+  serviceDesc,
+  tsEnum,
+} from "@bufbuild/protobuf/codegenv2"
+import { file_ory_keto_relation_tuples_v1alpha2_relation_tuples } from "./relation_tuples_pb"
+
+/**
+ * Describes the file ory/keto/relation_tuples/v1alpha2/expand_service.proto.
+ */
+export const file_ory_keto_relation_tuples_v1alpha2_expand_service =
+  /*@__PURE__*/
+  fileDesc(
+    "CjZvcnkva2V0by9yZWxhdGlvbl90dXBsZXMvdjFhbHBoYTIvZXhwYW5kX3NlcnZpY2UucHJvdG8SIW9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMiJyCg1FeHBhbmRSZXF1ZXN0EjsKB3N1YmplY3QYASABKAsyKi5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIuU3ViamVjdBIRCgltYXhfZGVwdGgYAiABKAUSEQoJc25hcHRva2VuGAMgASgJIk4KDkV4cGFuZFJlc3BvbnNlEjwKBHRyZWUYASABKAsyLi5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIuU3ViamVjdFRyZWUikQIKC1N1YmplY3RUcmVlEj4KCW5vZGVfdHlwZRgBIAEoDjIrLm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5Ob2RlVHlwZRI/CgdzdWJqZWN0GAIgASgLMioub3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyLlN1YmplY3RCAhgBEj8KBXR1cGxlGAQgASgLMjAub3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyLlJlbGF0aW9uVHVwbGUSQAoIY2hpbGRyZW4YAyADKAsyLi5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIuU3ViamVjdFRyZWUqgwEKCE5vZGVUeXBlEhkKFU5PREVfVFlQRV9VTlNQRUNJRklFRBAAEhMKD05PREVfVFlQRV9VTklPThABEhcKE05PREVfVFlQRV9FWENMVVNJT04QAhIaChZOT0RFX1RZUEVfSU5URVJTRUNUSU9OEAMSEgoOTk9ERV9UWVBFX0xFQUYQBDJ+Cg1FeHBhbmRTZXJ2aWNlEm0KBkV4cGFuZBIwLm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5FeHBhbmRSZXF1ZXN0GjEub3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyLkV4cGFuZFJlc3BvbnNlQqsCCiVjb20ub3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyQhJFeHBhbmRTZXJ2aWNlUHJvdG9QAVpLZ2l0aHViLmNvbS9vcnkva2V0by9nZW4vZ28vb3J5L2tldG8vcmVsYXRpb25fdHVwbGVzL3YxYWxwaGEyO3JlbGF0aW9udHVwbGVzogIDT0tSqgIgT3J5LktldG8uUmVsYXRpb25UdXBsZXMuVjFhbHBoYTLKAiBPcnlcS2V0b1xSZWxhdGlvblR1cGxlc1xWMWFscGhhMuICLE9yeVxLZXRvXFJlbGF0aW9uVHVwbGVzXFYxYWxwaGEyXEdQQk1ldGFkYXRh6gIjT3J5OjpLZXRvOjpSZWxhdGlvblR1cGxlczo6VjFhbHBoYTJiBnByb3RvMw",
+    [file_ory_keto_relation_tuples_v1alpha2_relation_tuples],
+  )
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.ExpandRequest.
+ * Use `create(ExpandRequestSchema)` to create a new message.
+ */
+export const ExpandRequestSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_expand_service, 0)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.ExpandResponse.
+ * Use `create(ExpandResponseSchema)` to create a new message.
+ */
+export const ExpandResponseSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_expand_service, 1)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.SubjectTree.
+ * Use `create(SubjectTreeSchema)` to create a new message.
+ */
+export const SubjectTreeSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_expand_service, 2)
+
+/**
+ * Describes the enum ory.keto.relation_tuples.v1alpha2.NodeType.
+ */
+export const NodeTypeSchema =
+  /*@__PURE__*/
+  enumDesc(file_ory_keto_relation_tuples_v1alpha2_expand_service, 0)
+
+/**
+ * @generated from enum ory.keto.relation_tuples.v1alpha2.NodeType
+ */
+export const NodeType = /*@__PURE__*/ tsEnum(NodeTypeSchema)
+
+/**
+ * The service that performs subject set expansion
+ * based on the stored Access Control Lists.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.ExpandService
+ */
+export const ExpandService =
+  /*@__PURE__*/
+  serviceDesc(file_ory_keto_relation_tuples_v1alpha2_expand_service, 0)

gen/es/ory/keto/relation_tuples/v1alpha2/namespaces_service_connect.d.ts

@@ -0,0 +1,37 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-connect-es v1.7.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/namespaces_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import {
+  ListNamespacesRequest,
+  ListNamespacesResponse,
+} from "./namespaces_service_pb.js"
+import { MethodKind } from "@bufbuild/protobuf"
+
+/**
+ * The service to query namespaces.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.NamespacesService
+ */
+export declare const NamespacesService: {
+  readonly typeName: "ory.keto.relation_tuples.v1alpha2.NamespacesService"
+  readonly methods: {
+    /**
+     * Lists Namespaces
+     *
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.NamespacesService.ListNamespaces
+     */
+    readonly listNamespaces: {
+      readonly name: "ListNamespaces"
+      readonly I: typeof ListNamespacesRequest
+      readonly O: typeof ListNamespacesResponse
+      readonly kind: MethodKind.Unary
+    }
+  }
+}

gen/es/ory/keto/relation_tuples/v1alpha2/namespaces_service_connect.js

@@ -0,0 +1,37 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-connect-es v1.7.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/namespaces_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import {
+  ListNamespacesRequest,
+  ListNamespacesResponse,
+} from "./namespaces_service_pb.js"
+import { MethodKind } from "@bufbuild/protobuf"
+
+/**
+ * The service to query namespaces.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.NamespacesService
+ */
+export const NamespacesService = {
+  typeName: "ory.keto.relation_tuples.v1alpha2.NamespacesService",
+  methods: {
+    /**
+     * Lists Namespaces
+     *
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.NamespacesService.ListNamespaces
+     */
+    listNamespaces: {
+      name: "ListNamespaces",
+      I: ListNamespacesRequest,
+      O: ListNamespacesResponse,
+      kind: MethodKind.Unary,
+    },
+  },
+}

gen/es/ory/keto/relation_tuples/v1alpha2/namespaces_service_pb.d.ts

@@ -0,0 +1,86 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/namespaces_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+
+import type {
+  GenFile,
+  GenMessage,
+  GenService,
+} from "@bufbuild/protobuf/codegenv2"
+import type { Message } from "@bufbuild/protobuf"
+
+/**
+ * Describes the file ory/keto/relation_tuples/v1alpha2/namespaces_service.proto.
+ */
+export declare const file_ory_keto_relation_tuples_v1alpha2_namespaces_service: GenFile
+
+/**
+ * Request for ReadService.ListNamespaces RPC.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.ListNamespacesRequest
+ */
+export declare type ListNamespacesRequest =
+  Message<"ory.keto.relation_tuples.v1alpha2.ListNamespacesRequest"> & {}
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.ListNamespacesRequest.
+ * Use `create(ListNamespacesRequestSchema)` to create a new message.
+ */
+export declare const ListNamespacesRequestSchema: GenMessage<ListNamespacesRequest>
+
+/**
+ * @generated from message ory.keto.relation_tuples.v1alpha2.ListNamespacesResponse
+ */
+export declare type ListNamespacesResponse =
+  Message<"ory.keto.relation_tuples.v1alpha2.ListNamespacesResponse"> & {
+    /**
+     * @generated from field: repeated ory.keto.relation_tuples.v1alpha2.Namespace namespaces = 1;
+     */
+    namespaces: Namespace[]
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.ListNamespacesResponse.
+ * Use `create(ListNamespacesResponseSchema)` to create a new message.
+ */
+export declare const ListNamespacesResponseSchema: GenMessage<ListNamespacesResponse>
+
+/**
+ * @generated from message ory.keto.relation_tuples.v1alpha2.Namespace
+ */
+export declare type Namespace =
+  Message<"ory.keto.relation_tuples.v1alpha2.Namespace"> & {
+    /**
+     * @generated from field: string name = 1;
+     */
+    name: string
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.Namespace.
+ * Use `create(NamespaceSchema)` to create a new message.
+ */
+export declare const NamespaceSchema: GenMessage<Namespace>
+
+/**
+ * The service to query namespaces.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.NamespacesService
+ */
+export declare const NamespacesService: GenService<{
+  /**
+   * Lists Namespaces
+   *
+   * @generated from rpc ory.keto.relation_tuples.v1alpha2.NamespacesService.ListNamespaces
+   */
+  listNamespaces: {
+    methodKind: "unary"
+    input: typeof ListNamespacesRequestSchema
+    output: typeof ListNamespacesResponseSchema
+  }
+}>

gen/es/ory/keto/relation_tuples/v1alpha2/namespaces_service_pb.js

@@ -0,0 +1,56 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/namespaces_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+
+import {
+  fileDesc,
+  messageDesc,
+  serviceDesc,
+} from "@bufbuild/protobuf/codegenv2"
+
+/**
+ * Describes the file ory/keto/relation_tuples/v1alpha2/namespaces_service.proto.
+ */
+export const file_ory_keto_relation_tuples_v1alpha2_namespaces_service =
+  /*@__PURE__*/
+  fileDesc(
+    "Cjpvcnkva2V0by9yZWxhdGlvbl90dXBsZXMvdjFhbHBoYTIvbmFtZXNwYWNlc19zZXJ2aWNlLnByb3RvEiFvcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIiFwoVTGlzdE5hbWVzcGFjZXNSZXF1ZXN0IloKFkxpc3ROYW1lc3BhY2VzUmVzcG9uc2USQAoKbmFtZXNwYWNlcxgBIAMoCzIsLm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5OYW1lc3BhY2UiGQoJTmFtZXNwYWNlEgwKBG5hbWUYASABKAkymwEKEU5hbWVzcGFjZXNTZXJ2aWNlEoUBCg5MaXN0TmFtZXNwYWNlcxI4Lm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5MaXN0TmFtZXNwYWNlc1JlcXVlc3QaOS5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIuTGlzdE5hbWVzcGFjZXNSZXNwb25zZUKvAgolY29tLm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMkIWTmFtZXNwYWNlc1NlcnZpY2VQcm90b1ABWktnaXRodWIuY29tL29yeS9rZXRvL2dlbi9nby9vcnkva2V0by9yZWxhdGlvbl90dXBsZXMvdjFhbHBoYTI7cmVsYXRpb250dXBsZXOiAgNPS1KqAiBPcnkuS2V0by5SZWxhdGlvblR1cGxlcy5WMWFscGhhMsoCIE9yeVxLZXRvXFJlbGF0aW9uVHVwbGVzXFYxYWxwaGEy4gIsT3J5XEtldG9cUmVsYXRpb25UdXBsZXNcVjFhbHBoYTJcR1BCTWV0YWRhdGHqAiNPcnk6OktldG86OlJlbGF0aW9uVHVwbGVzOjpWMWFscGhhMmIGcHJvdG8z",
+  )
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.ListNamespacesRequest.
+ * Use `create(ListNamespacesRequestSchema)` to create a new message.
+ */
+export const ListNamespacesRequestSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_namespaces_service, 0)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.ListNamespacesResponse.
+ * Use `create(ListNamespacesResponseSchema)` to create a new message.
+ */
+export const ListNamespacesResponseSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_namespaces_service, 1)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.Namespace.
+ * Use `create(NamespaceSchema)` to create a new message.
+ */
+export const NamespaceSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_namespaces_service, 2)
+
+/**
+ * The service to query namespaces.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.NamespacesService
+ */
+export const NamespacesService =
+  /*@__PURE__*/
+  serviceDesc(file_ory_keto_relation_tuples_v1alpha2_namespaces_service, 0)

gen/es/ory/keto/relation_tuples/v1alpha2/read_service_connect.d.ts

@@ -0,0 +1,37 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-connect-es v1.7.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/read_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import {
+  ListRelationTuplesRequest,
+  ListRelationTuplesResponse,
+} from "./read_service_pb.js"
+import { MethodKind } from "@bufbuild/protobuf"
+
+/**
+ * The service to query relationships.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.ReadService
+ */
+export declare const ReadService: {
+  readonly typeName: "ory.keto.relation_tuples.v1alpha2.ReadService"
+  readonly methods: {
+    /**
+     * Lists ACL relationships.
+     *
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.ReadService.ListRelationTuples
+     */
+    readonly listRelationTuples: {
+      readonly name: "ListRelationTuples"
+      readonly I: typeof ListRelationTuplesRequest
+      readonly O: typeof ListRelationTuplesResponse
+      readonly kind: MethodKind.Unary
+    }
+  }
+}

gen/es/ory/keto/relation_tuples/v1alpha2/read_service_connect.js

@@ -0,0 +1,37 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-connect-es v1.7.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/read_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import {
+  ListRelationTuplesRequest,
+  ListRelationTuplesResponse,
+} from "./read_service_pb.js"
+import { MethodKind } from "@bufbuild/protobuf"
+
+/**
+ * The service to query relationships.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.ReadService
+ */
+export const ReadService = {
+  typeName: "ory.keto.relation_tuples.v1alpha2.ReadService",
+  methods: {
+    /**
+     * Lists ACL relationships.
+     *
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.ReadService.ListRelationTuples
+     */
+    listRelationTuples: {
+      name: "ListRelationTuples",
+      I: ListRelationTuplesRequest,
+      O: ListRelationTuplesResponse,
+      kind: MethodKind.Unary,
+    },
+  },
+}

gen/es/ory/keto/relation_tuples/v1alpha2/read_service_pb.d.ts

@@ -0,0 +1,206 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/read_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+
+import type {
+  GenFile,
+  GenMessage,
+  GenService,
+} from "@bufbuild/protobuf/codegenv2"
+import type { Message } from "@bufbuild/protobuf"
+import type {
+  RelationQuery,
+  RelationTuple,
+  Subject,
+} from "./relation_tuples_pb"
+import type { FieldMask } from "@bufbuild/protobuf/wkt"
+
+/**
+ * Describes the file ory/keto/relation_tuples/v1alpha2/read_service.proto.
+ */
+export declare const file_ory_keto_relation_tuples_v1alpha2_read_service: GenFile
+
+/**
+ * Request for ReadService.ListRelationTuples RPC.
+ * See `ListRelationTuplesRequest_Query` for how to filter the query.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest
+ */
+export declare type ListRelationTuplesRequest =
+  Message<"ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest"> & {
+    /**
+     * All query constraints are concatenated
+     * with a logical AND operator.
+     *
+     * The RelationTuple list from ListRelationTuplesResponse
+     * is ordered from the newest RelationTuple to the oldest.
+     *
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest.Query query = 1 [deprecated = true];
+     * @deprecated
+     */
+    query?: ListRelationTuplesRequest_Query
+
+    /**
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.RelationQuery relation_query = 6;
+     */
+    relationQuery?: RelationQuery
+
+    /**
+     * This field is not implemented yet and has no effect.
+     * <!--
+     * Optional. The list of fields to be expanded
+     * in the RelationTuple list returned in `ListRelationTuplesResponse`.
+     * Leaving this field unspecified means all fields are expanded.
+     *
+     * Available fields:
+     * "object", "relation", "subject",
+     * "namespace", "subject.id", "subject.namespace",
+     * "subject.object", "subject.relation"
+     * -->
+     *
+     * @generated from field: google.protobuf.FieldMask expand_mask = 2;
+     */
+    expandMask?: FieldMask
+
+    /**
+     * This field is not implemented yet and has no effect.
+     * <!--
+     * Optional. The snapshot token for this read.
+     * -->
+     *
+     * @generated from field: string snaptoken = 3;
+     */
+    snaptoken: string
+
+    /**
+     * Optional. The maximum number of
+     * RelationTuples to return in the response.
+     *
+     * Default: 100
+     *
+     * @generated from field: int32 page_size = 4;
+     */
+    pageSize: number
+
+    /**
+     * Optional. An opaque pagination token returned from
+     * a previous call to `ListRelationTuples` that
+     * indicates where the page should start at.
+     *
+     * An empty token denotes the first page. All successive
+     * pages require the token from the previous page.
+     *
+     * @generated from field: string page_token = 5;
+     */
+    pageToken: string
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest.
+ * Use `create(ListRelationTuplesRequestSchema)` to create a new message.
+ */
+export declare const ListRelationTuplesRequestSchema: GenMessage<ListRelationTuplesRequest>
+
+/**
+ * The query for listing relationships.
+ * Clients can specify any optional field to
+ * partially filter for specific relationships.
+ *
+ * Example use cases (namespace is always required):
+ *  - object only: display a list of all permissions referring to a specific object
+ *  - relation only: get all groups that have members; get all directories that have content
+ *  - object & relation: display all subjects that have a specific permission relation
+ *  - subject & relation: display all groups a subject belongs to; display all objects a subject has access to
+ *  - object & relation & subject: check whether the relation tuple already exists
+ *
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest.Query
+ */
+export declare type ListRelationTuplesRequest_Query =
+  Message<"ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest.Query"> & {
+    /**
+     * Required. The namespace to query.
+     *
+     * @generated from field: string namespace = 1;
+     */
+    namespace: string
+
+    /**
+     * Optional. The object to query for.
+     *
+     * @generated from field: string object = 2;
+     */
+    object: string
+
+    /**
+     * Optional. The relation to query for.
+     *
+     * @generated from field: string relation = 3;
+     */
+    relation: string
+
+    /**
+     * Optional. The subject to query for.
+     *
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.Subject subject = 4;
+     */
+    subject?: Subject
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest.Query.
+ * Use `create(ListRelationTuplesRequest_QuerySchema)` to create a new message.
+ */
+export declare const ListRelationTuplesRequest_QuerySchema: GenMessage<ListRelationTuplesRequest_Query>
+
+/**
+ * The response of a ReadService.ListRelationTuples RPC.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.ListRelationTuplesResponse
+ */
+export declare type ListRelationTuplesResponse =
+  Message<"ory.keto.relation_tuples.v1alpha2.ListRelationTuplesResponse"> & {
+    /**
+     * The relationships matching the list request.
+     *
+     * @generated from field: repeated ory.keto.relation_tuples.v1alpha2.RelationTuple relation_tuples = 1;
+     */
+    relationTuples: RelationTuple[]
+
+    /**
+     * The token required to get the next page.
+     * If this is the last page, the token will be the empty string.
+     *
+     * @generated from field: string next_page_token = 2;
+     */
+    nextPageToken: string
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.ListRelationTuplesResponse.
+ * Use `create(ListRelationTuplesResponseSchema)` to create a new message.
+ */
+export declare const ListRelationTuplesResponseSchema: GenMessage<ListRelationTuplesResponse>
+
+/**
+ * The service to query relationships.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.ReadService
+ */
+export declare const ReadService: GenService<{
+  /**
+   * Lists ACL relationships.
+   *
+   * @generated from rpc ory.keto.relation_tuples.v1alpha2.ReadService.ListRelationTuples
+   */
+  listRelationTuples: {
+    methodKind: "unary"
+    input: typeof ListRelationTuplesRequestSchema
+    output: typeof ListRelationTuplesResponseSchema
+  }
+}>

gen/es/ory/keto/relation_tuples/v1alpha2/read_service_pb.js

@@ -0,0 +1,62 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/read_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+
+import {
+  fileDesc,
+  messageDesc,
+  serviceDesc,
+} from "@bufbuild/protobuf/codegenv2"
+import { file_ory_keto_relation_tuples_v1alpha2_relation_tuples } from "./relation_tuples_pb"
+import { file_google_protobuf_field_mask } from "@bufbuild/protobuf/wkt"
+
+/**
+ * Describes the file ory/keto/relation_tuples/v1alpha2/read_service.proto.
+ */
+export const file_ory_keto_relation_tuples_v1alpha2_read_service =
+  /*@__PURE__*/
+  fileDesc(
+    "CjRvcnkva2V0by9yZWxhdGlvbl90dXBsZXMvdjFhbHBoYTIvcmVhZF9zZXJ2aWNlLnByb3RvEiFvcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIiogMKGUxpc3RSZWxhdGlvblR1cGxlc1JlcXVlc3QSVQoFcXVlcnkYASABKAsyQi5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIuTGlzdFJlbGF0aW9uVHVwbGVzUmVxdWVzdC5RdWVyeUICGAESSAoOcmVsYXRpb25fcXVlcnkYBiABKAsyMC5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIuUmVsYXRpb25RdWVyeRIvCgtleHBhbmRfbWFzaxgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2sSEQoJc25hcHRva2VuGAMgASgJEhEKCXBhZ2Vfc2l6ZRgEIAEoBRISCgpwYWdlX3Rva2VuGAUgASgJGnkKBVF1ZXJ5EhEKCW5hbWVzcGFjZRgBIAEoCRIOCgZvYmplY3QYAiABKAkSEAoIcmVsYXRpb24YAyABKAkSOwoHc3ViamVjdBgEIAEoCzIqLm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5TdWJqZWN0IoABChpMaXN0UmVsYXRpb25UdXBsZXNSZXNwb25zZRJJCg9yZWxhdGlvbl90dXBsZXMYASADKAsyMC5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIuUmVsYXRpb25UdXBsZRIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkyoQEKC1JlYWRTZXJ2aWNlEpEBChJMaXN0UmVsYXRpb25UdXBsZXMSPC5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIuTGlzdFJlbGF0aW9uVHVwbGVzUmVxdWVzdBo9Lm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5MaXN0UmVsYXRpb25UdXBsZXNSZXNwb25zZUKpAgolY29tLm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMkIQUmVhZFNlcnZpY2VQcm90b1ABWktnaXRodWIuY29tL29yeS9rZXRvL2dlbi9nby9vcnkva2V0by9yZWxhdGlvbl90dXBsZXMvdjFhbHBoYTI7cmVsYXRpb250dXBsZXOiAgNPS1KqAiBPcnkuS2V0by5SZWxhdGlvblR1cGxlcy5WMWFscGhhMsoCIE9yeVxLZXRvXFJlbGF0aW9uVHVwbGVzXFYxYWxwaGEy4gIsT3J5XEtldG9cUmVsYXRpb25UdXBsZXNcVjFhbHBoYTJcR1BCTWV0YWRhdGHqAiNPcnk6OktldG86OlJlbGF0aW9uVHVwbGVzOjpWMWFscGhhMmIGcHJvdG8z",
+    [
+      file_ory_keto_relation_tuples_v1alpha2_relation_tuples,
+      file_google_protobuf_field_mask,
+    ],
+  )
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest.
+ * Use `create(ListRelationTuplesRequestSchema)` to create a new message.
+ */
+export const ListRelationTuplesRequestSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_read_service, 0)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest.Query.
+ * Use `create(ListRelationTuplesRequest_QuerySchema)` to create a new message.
+ */
+export const ListRelationTuplesRequest_QuerySchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_read_service, 0, 0)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.ListRelationTuplesResponse.
+ * Use `create(ListRelationTuplesResponseSchema)` to create a new message.
+ */
+export const ListRelationTuplesResponseSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_read_service, 1)
+
+/**
+ * The service to query relationships.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.ReadService
+ */
+export const ReadService =
+  /*@__PURE__*/
+  serviceDesc(file_ory_keto_relation_tuples_v1alpha2_read_service, 0)

gen/es/ory/keto/relation_tuples/v1alpha2/relation_tuples_pb.d.ts

@@ -0,0 +1,192 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/relation_tuples.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2"
+import type { Message } from "@bufbuild/protobuf"
+
+/**
+ * Describes the file ory/keto/relation_tuples/v1alpha2/relation_tuples.proto.
+ */
+export declare const file_ory_keto_relation_tuples_v1alpha2_relation_tuples: GenFile
+
+/**
+ * RelationTuple defines a relation between an Object and a Subject.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.RelationTuple
+ */
+export declare type RelationTuple =
+  Message<"ory.keto.relation_tuples.v1alpha2.RelationTuple"> & {
+    /**
+     * The namespace this relation tuple lives in.
+     *
+     * @generated from field: string namespace = 1;
+     */
+    namespace: string
+
+    /**
+     * The object related by this tuple.
+     * It is an object in the namespace of the tuple.
+     *
+     * @generated from field: string object = 2;
+     */
+    object: string
+
+    /**
+     * The relation between an Object and a Subject.
+     *
+     * @generated from field: string relation = 3;
+     */
+    relation: string
+
+    /**
+     * The subject related by this tuple.
+     * A Subject either represents a concrete subject id or
+     * a `SubjectSet` that expands to more Subjects.
+     *
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.Subject subject = 4;
+     */
+    subject?: Subject
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.RelationTuple.
+ * Use `create(RelationTupleSchema)` to create a new message.
+ */
+export declare const RelationTupleSchema: GenMessage<RelationTuple>
+
+/**
+ * The query for listing relationships.
+ * Clients can specify any optional field to
+ * partially filter for specific relationships.
+ *
+ * Example use cases (namespace is always required):
+ *  - object only: display a list of all permissions referring to a specific object
+ *  - relation only: get all groups that have members; get all directories that have content
+ *  - object & relation: display all subjects that have a specific permission relation
+ *  - subject & relation: display all groups a subject belongs to; display all objects a subject has access to
+ *  - object & relation & subject: check whether the relation tuple already exists
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.RelationQuery
+ */
+export declare type RelationQuery =
+  Message<"ory.keto.relation_tuples.v1alpha2.RelationQuery"> & {
+    /**
+     * The namespace this relation tuple lives in.
+     *
+     * @generated from field: optional string namespace = 1;
+     */
+    namespace?: string
+
+    /**
+     * The object related by this tuple.
+     * It is an object in the namespace of the tuple.
+     *
+     * @generated from field: optional string object = 2;
+     */
+    object?: string
+
+    /**
+     * The relation between an Object and a Subject.
+     *
+     * @generated from field: optional string relation = 3;
+     */
+    relation?: string
+
+    /**
+     * The subject related by this tuple.
+     * A Subject either represents a concrete subject id or
+     * a `SubjectSet` that expands to more Subjects.
+     *
+     * @generated from field: optional ory.keto.relation_tuples.v1alpha2.Subject subject = 4;
+     */
+    subject?: Subject
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.RelationQuery.
+ * Use `create(RelationQuerySchema)` to create a new message.
+ */
+export declare const RelationQuerySchema: GenMessage<RelationQuery>
+
+/**
+ * Subject is either a concrete subject id or
+ * a `SubjectSet` expanding to more Subjects.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.Subject
+ */
+export declare type Subject =
+  Message<"ory.keto.relation_tuples.v1alpha2.Subject"> & {
+    /**
+     * The reference of this abstract subject.
+     *
+     * @generated from oneof ory.keto.relation_tuples.v1alpha2.Subject.ref
+     */
+    ref:
+      | {
+          /**
+           * A concrete id of the subject.
+           *
+           * @generated from field: string id = 1;
+           */
+          value: string
+          case: "id"
+        }
+      | {
+          /**
+           * A subject set that expands to more Subjects.
+           * More information are available under [concepts](../concepts/15_subjects.mdx).
+           *
+           * @generated from field: ory.keto.relation_tuples.v1alpha2.SubjectSet set = 2;
+           */
+          value: SubjectSet
+          case: "set"
+        }
+      | { case: undefined; value?: undefined }
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.Subject.
+ * Use `create(SubjectSchema)` to create a new message.
+ */
+export declare const SubjectSchema: GenMessage<Subject>
+
+/**
+ * SubjectSet refers to all subjects who have
+ * the same `relation` on an `object`.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.SubjectSet
+ */
+export declare type SubjectSet =
+  Message<"ory.keto.relation_tuples.v1alpha2.SubjectSet"> & {
+    /**
+     * The namespace of the object and relation
+     * referenced in this subject set.
+     *
+     * @generated from field: string namespace = 1;
+     */
+    namespace: string
+
+    /**
+     * The object related by this subject set.
+     *
+     * @generated from field: string object = 2;
+     */
+    object: string
+
+    /**
+     * The relation between the object and the subjects.
+     *
+     * @generated from field: string relation = 3;
+     */
+    relation: string
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.SubjectSet.
+ * Use `create(SubjectSetSchema)` to create a new message.
+ */
+export declare const SubjectSetSchema: GenMessage<SubjectSet>

gen/es/ory/keto/relation_tuples/v1alpha2/relation_tuples_pb.js

@@ -0,0 +1,49 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/relation_tuples.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2"
+
+/**
+ * Describes the file ory/keto/relation_tuples/v1alpha2/relation_tuples.proto.
+ */
+export const file_ory_keto_relation_tuples_v1alpha2_relation_tuples =
+  /*@__PURE__*/
+  fileDesc(
+    "Cjdvcnkva2V0by9yZWxhdGlvbl90dXBsZXMvdjFhbHBoYTIvcmVsYXRpb25fdHVwbGVzLnByb3RvEiFvcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIigQEKDVJlbGF0aW9uVHVwbGUSEQoJbmFtZXNwYWNlGAEgASgJEg4KBm9iamVjdBgCIAEoCRIQCghyZWxhdGlvbhgDIAEoCRI7CgdzdWJqZWN0GAQgASgLMioub3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyLlN1YmplY3QixwEKDVJlbGF0aW9uUXVlcnkSFgoJbmFtZXNwYWNlGAEgASgJSACIAQESEwoGb2JqZWN0GAIgASgJSAGIAQESFQoIcmVsYXRpb24YAyABKAlIAogBARJACgdzdWJqZWN0GAQgASgLMioub3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyLlN1YmplY3RIA4gBAUIMCgpfbmFtZXNwYWNlQgkKB19vYmplY3RCCwoJX3JlbGF0aW9uQgoKCF9zdWJqZWN0IlwKB1N1YmplY3QSDAoCaWQYASABKAlIABI8CgNzZXQYAiABKAsyLS5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIuU3ViamVjdFNldEgAQgUKA3JlZiJBCgpTdWJqZWN0U2V0EhEKCW5hbWVzcGFjZRgBIAEoCRIOCgZvYmplY3QYAiABKAkSEAoIcmVsYXRpb24YAyABKAlCrAIKJWNvbS5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTJCE1JlbGF0aW9uVHVwbGVzUHJvdG9QAVpLZ2l0aHViLmNvbS9vcnkva2V0by9nZW4vZ28vb3J5L2tldG8vcmVsYXRpb25fdHVwbGVzL3YxYWxwaGEyO3JlbGF0aW9udHVwbGVzogIDT0tSqgIgT3J5LktldG8uUmVsYXRpb25UdXBsZXMuVjFhbHBoYTLKAiBPcnlcS2V0b1xSZWxhdGlvblR1cGxlc1xWMWFscGhhMuICLE9yeVxLZXRvXFJlbGF0aW9uVHVwbGVzXFYxYWxwaGEyXEdQQk1ldGFkYXRh6gIjT3J5OjpLZXRvOjpSZWxhdGlvblR1cGxlczo6VjFhbHBoYTJiBnByb3RvMw",
+  )
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.RelationTuple.
+ * Use `create(RelationTupleSchema)` to create a new message.
+ */
+export const RelationTupleSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_relation_tuples, 0)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.RelationQuery.
+ * Use `create(RelationQuerySchema)` to create a new message.
+ */
+export const RelationQuerySchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_relation_tuples, 1)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.Subject.
+ * Use `create(SubjectSchema)` to create a new message.
+ */
+export const SubjectSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_relation_tuples, 2)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.SubjectSet.
+ * Use `create(SubjectSetSchema)` to create a new message.
+ */
+export const SubjectSetSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_relation_tuples, 3)

gen/es/ory/keto/relation_tuples/v1alpha2/version_connect.d.ts

@@ -0,0 +1,34 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-connect-es v1.7.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/version.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { GetVersionRequest, GetVersionResponse } from "./version_pb.js"
+import { MethodKind } from "@bufbuild/protobuf"
+
+/**
+ * The service returning the specific Ory Keto instance version.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis) and [write-APIs](../concepts/25_api-overview.mdx#write-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.VersionService
+ */
+export declare const VersionService: {
+  readonly typeName: "ory.keto.relation_tuples.v1alpha2.VersionService"
+  readonly methods: {
+    /**
+     * Returns the version of the Ory Keto instance.
+     *
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.VersionService.GetVersion
+     */
+    readonly getVersion: {
+      readonly name: "GetVersion"
+      readonly I: typeof GetVersionRequest
+      readonly O: typeof GetVersionResponse
+      readonly kind: MethodKind.Unary
+    }
+  }
+}

gen/es/ory/keto/relation_tuples/v1alpha2/version_connect.js

@@ -0,0 +1,34 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-connect-es v1.7.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/version.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { GetVersionRequest, GetVersionResponse } from "./version_pb.js"
+import { MethodKind } from "@bufbuild/protobuf"
+
+/**
+ * The service returning the specific Ory Keto instance version.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis) and [write-APIs](../concepts/25_api-overview.mdx#write-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.VersionService
+ */
+export const VersionService = {
+  typeName: "ory.keto.relation_tuples.v1alpha2.VersionService",
+  methods: {
+    /**
+     * Returns the version of the Ory Keto instance.
+     *
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.VersionService.GetVersion
+     */
+    getVersion: {
+      name: "GetVersion",
+      I: GetVersionRequest,
+      O: GetVersionResponse,
+      kind: MethodKind.Unary,
+    },
+  },
+}

gen/es/ory/keto/relation_tuples/v1alpha2/version_pb.d.ts

@@ -0,0 +1,73 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/version.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+
+import type {
+  GenFile,
+  GenMessage,
+  GenService,
+} from "@bufbuild/protobuf/codegenv2"
+import type { Message } from "@bufbuild/protobuf"
+
+/**
+ * Describes the file ory/keto/relation_tuples/v1alpha2/version.proto.
+ */
+export declare const file_ory_keto_relation_tuples_v1alpha2_version: GenFile
+
+/**
+ * Request for the VersionService.GetVersion RPC.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.GetVersionRequest
+ */
+export declare type GetVersionRequest =
+  Message<"ory.keto.relation_tuples.v1alpha2.GetVersionRequest"> & {}
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.GetVersionRequest.
+ * Use `create(GetVersionRequestSchema)` to create a new message.
+ */
+export declare const GetVersionRequestSchema: GenMessage<GetVersionRequest>
+
+/**
+ * Response of the VersionService.GetVersion RPC.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.GetVersionResponse
+ */
+export declare type GetVersionResponse =
+  Message<"ory.keto.relation_tuples.v1alpha2.GetVersionResponse"> & {
+    /**
+     * The version string of the Ory Keto instance.
+     *
+     * @generated from field: string version = 1;
+     */
+    version: string
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.GetVersionResponse.
+ * Use `create(GetVersionResponseSchema)` to create a new message.
+ */
+export declare const GetVersionResponseSchema: GenMessage<GetVersionResponse>
+
+/**
+ * The service returning the specific Ory Keto instance version.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis) and [write-APIs](../concepts/25_api-overview.mdx#write-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.VersionService
+ */
+export declare const VersionService: GenService<{
+  /**
+   * Returns the version of the Ory Keto instance.
+   *
+   * @generated from rpc ory.keto.relation_tuples.v1alpha2.VersionService.GetVersion
+   */
+  getVersion: {
+    methodKind: "unary"
+    input: typeof GetVersionRequestSchema
+    output: typeof GetVersionResponseSchema
+  }
+}>

gen/es/ory/keto/relation_tuples/v1alpha2/version_pb.js

@@ -0,0 +1,48 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/version.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+
+import {
+  fileDesc,
+  messageDesc,
+  serviceDesc,
+} from "@bufbuild/protobuf/codegenv2"
+
+/**
+ * Describes the file ory/keto/relation_tuples/v1alpha2/version.proto.
+ */
+export const file_ory_keto_relation_tuples_v1alpha2_version =
+  /*@__PURE__*/
+  fileDesc(
+    "Ci9vcnkva2V0by9yZWxhdGlvbl90dXBsZXMvdjFhbHBoYTIvdmVyc2lvbi5wcm90bxIhb3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyIhMKEUdldFZlcnNpb25SZXF1ZXN0IiUKEkdldFZlcnNpb25SZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgJMosBCg5WZXJzaW9uU2VydmljZRJ5CgpHZXRWZXJzaW9uEjQub3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyLkdldFZlcnNpb25SZXF1ZXN0GjUub3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyLkdldFZlcnNpb25SZXNwb25zZUKlAgolY29tLm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMkIMVmVyc2lvblByb3RvUAFaS2dpdGh1Yi5jb20vb3J5L2tldG8vZ2VuL2dvL29yeS9rZXRvL3JlbGF0aW9uX3R1cGxlcy92MWFscGhhMjtyZWxhdGlvbnR1cGxlc6ICA09LUqoCIE9yeS5LZXRvLlJlbGF0aW9uVHVwbGVzLlYxYWxwaGEyygIgT3J5XEtldG9cUmVsYXRpb25UdXBsZXNcVjFhbHBoYTLiAixPcnlcS2V0b1xSZWxhdGlvblR1cGxlc1xWMWFscGhhMlxHUEJNZXRhZGF0YeoCI09yeTo6S2V0bzo6UmVsYXRpb25UdXBsZXM6OlYxYWxwaGEyYgZwcm90bzM",
+  )
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.GetVersionRequest.
+ * Use `create(GetVersionRequestSchema)` to create a new message.
+ */
+export const GetVersionRequestSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_version, 0)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.GetVersionResponse.
+ * Use `create(GetVersionResponseSchema)` to create a new message.
+ */
+export const GetVersionResponseSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_version, 1)
+
+/**
+ * The service returning the specific Ory Keto instance version.
+ *
+ * This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis) and [write-APIs](../concepts/25_api-overview.mdx#write-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.VersionService
+ */
+export const VersionService =
+  /*@__PURE__*/
+  serviceDesc(file_ory_keto_relation_tuples_v1alpha2_version, 0)

gen/es/ory/keto/relation_tuples/v1alpha2/write_service_connect.d.ts

@@ -0,0 +1,50 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-connect-es v1.7.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/write_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import {
+  DeleteRelationTuplesRequest,
+  DeleteRelationTuplesResponse,
+  TransactRelationTuplesRequest,
+  TransactRelationTuplesResponse,
+} from "./write_service_pb.js"
+import { MethodKind } from "@bufbuild/protobuf"
+
+/**
+ * The write service to create and delete Access Control Lists.
+ *
+ * This service is part of the [write-APIs](../concepts/25_api-overview.mdx#write-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.WriteService
+ */
+export declare const WriteService: {
+  readonly typeName: "ory.keto.relation_tuples.v1alpha2.WriteService"
+  readonly methods: {
+    /**
+     * Writes one or more relationships in a single transaction.
+     *
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.WriteService.TransactRelationTuples
+     */
+    readonly transactRelationTuples: {
+      readonly name: "TransactRelationTuples"
+      readonly I: typeof TransactRelationTuplesRequest
+      readonly O: typeof TransactRelationTuplesResponse
+      readonly kind: MethodKind.Unary
+    }
+    /**
+     * Deletes relationships based on relation query
+     *
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.WriteService.DeleteRelationTuples
+     */
+    readonly deleteRelationTuples: {
+      readonly name: "DeleteRelationTuples"
+      readonly I: typeof DeleteRelationTuplesRequest
+      readonly O: typeof DeleteRelationTuplesResponse
+      readonly kind: MethodKind.Unary
+    }
+  }
+}

gen/es/ory/keto/relation_tuples/v1alpha2/write_service_connect.js

@@ -0,0 +1,50 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-connect-es v1.7.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/write_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import {
+  DeleteRelationTuplesRequest,
+  DeleteRelationTuplesResponse,
+  TransactRelationTuplesRequest,
+  TransactRelationTuplesResponse,
+} from "./write_service_pb.js"
+import { MethodKind } from "@bufbuild/protobuf"
+
+/**
+ * The write service to create and delete Access Control Lists.
+ *
+ * This service is part of the [write-APIs](../concepts/25_api-overview.mdx#write-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.WriteService
+ */
+export const WriteService = {
+  typeName: "ory.keto.relation_tuples.v1alpha2.WriteService",
+  methods: {
+    /**
+     * Writes one or more relationships in a single transaction.
+     *
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.WriteService.TransactRelationTuples
+     */
+    transactRelationTuples: {
+      name: "TransactRelationTuples",
+      I: TransactRelationTuplesRequest,
+      O: TransactRelationTuplesResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * Deletes relationships based on relation query
+     *
+     * @generated from rpc ory.keto.relation_tuples.v1alpha2.WriteService.DeleteRelationTuples
+     */
+    deleteRelationTuples: {
+      name: "DeleteRelationTuples",
+      I: DeleteRelationTuplesRequest,
+      O: DeleteRelationTuplesResponse,
+      kind: MethodKind.Unary,
+    },
+  },
+}

gen/es/ory/keto/relation_tuples/v1alpha2/write_service_pb.d.ts

@@ -0,0 +1,244 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/write_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+
+import type {
+  GenEnum,
+  GenFile,
+  GenMessage,
+  GenService,
+} from "@bufbuild/protobuf/codegenv2"
+import type { Message } from "@bufbuild/protobuf"
+import type {
+  RelationQuery,
+  RelationTuple,
+  Subject,
+} from "./relation_tuples_pb"
+
+/**
+ * Describes the file ory/keto/relation_tuples/v1alpha2/write_service.proto.
+ */
+export declare const file_ory_keto_relation_tuples_v1alpha2_write_service: GenFile
+
+/**
+ * The request of a WriteService.TransactRelationTuples RPC.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesRequest
+ */
+export declare type TransactRelationTuplesRequest =
+  Message<"ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesRequest"> & {
+    /**
+     * The write delta for the relationships operated in one single transaction.
+     * Either all actions succeed or no change takes effect on error.
+     *
+     * @generated from field: repeated ory.keto.relation_tuples.v1alpha2.RelationTupleDelta relation_tuple_deltas = 1;
+     */
+    relationTupleDeltas: RelationTupleDelta[]
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesRequest.
+ * Use `create(TransactRelationTuplesRequestSchema)` to create a new message.
+ */
+export declare const TransactRelationTuplesRequestSchema: GenMessage<TransactRelationTuplesRequest>
+
+/**
+ * Write-delta for a TransactRelationTuplesRequest.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.RelationTupleDelta
+ */
+export declare type RelationTupleDelta =
+  Message<"ory.keto.relation_tuples.v1alpha2.RelationTupleDelta"> & {
+    /**
+     * The action to do on the RelationTuple.
+     *
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.RelationTupleDelta.Action action = 1;
+     */
+    action: RelationTupleDelta_Action
+
+    /**
+     * The target RelationTuple.
+     *
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.RelationTuple relation_tuple = 2;
+     */
+    relationTuple?: RelationTuple
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.RelationTupleDelta.
+ * Use `create(RelationTupleDeltaSchema)` to create a new message.
+ */
+export declare const RelationTupleDeltaSchema: GenMessage<RelationTupleDelta>
+
+/**
+ * @generated from enum ory.keto.relation_tuples.v1alpha2.RelationTupleDelta.Action
+ */
+export enum RelationTupleDelta_Action {
+  /**
+   * Unspecified.
+   * The `TransactRelationTuples` RPC ignores this
+   * RelationTupleDelta if an action was unspecified.
+   *
+   * @generated from enum value: ACTION_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Insertion of a new RelationTuple.
+   *
+   * @generated from enum value: ACTION_INSERT = 1;
+   */
+  INSERT = 1,
+
+  /**
+   * Deletion of the RelationTuple.
+   * It is ignored if it does not exist.
+   *
+   * @generated from enum value: ACTION_DELETE = 2;
+   */
+  DELETE = 2,
+}
+
+/**
+ * Describes the enum ory.keto.relation_tuples.v1alpha2.RelationTupleDelta.Action.
+ */
+export declare const RelationTupleDelta_ActionSchema: GenEnum<RelationTupleDelta_Action>
+
+/**
+ * The response of a WriteService.TransactRelationTuples rpc.
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesResponse
+ */
+export declare type TransactRelationTuplesResponse =
+  Message<"ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesResponse"> & {
+    /**
+     * This field is not implemented yet and has no effect.
+     * <!--
+     * The list of the new latest snapshot tokens of the affected RelationTuple,
+     * with the same index as specified in the `relation_tuple_deltas` field of
+     * the TransactRelationTuplesRequest request.
+     *
+     * If the RelationTupleDelta_Action was DELETE
+     * the snaptoken is empty at the same index.
+     * -->
+     *
+     * @generated from field: repeated string snaptokens = 1;
+     */
+    snaptokens: string[]
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesResponse.
+ * Use `create(TransactRelationTuplesResponseSchema)` to create a new message.
+ */
+export declare const TransactRelationTuplesResponseSchema: GenMessage<TransactRelationTuplesResponse>
+
+/**
+ * @generated from message ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest
+ */
+export declare type DeleteRelationTuplesRequest =
+  Message<"ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest"> & {
+    /**
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest.Query query = 1 [deprecated = true];
+     * @deprecated
+     */
+    query?: DeleteRelationTuplesRequest_Query
+
+    /**
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.RelationQuery relation_query = 2;
+     */
+    relationQuery?: RelationQuery
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest.
+ * Use `create(DeleteRelationTuplesRequestSchema)` to create a new message.
+ */
+export declare const DeleteRelationTuplesRequestSchema: GenMessage<DeleteRelationTuplesRequest>
+
+/**
+ * The query for deleting relationships
+ *
+ * @generated from message ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest.Query
+ */
+export declare type DeleteRelationTuplesRequest_Query =
+  Message<"ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest.Query"> & {
+    /**
+     * Optional. The namespace to query.
+     *
+     * @generated from field: string namespace = 1;
+     */
+    namespace: string
+
+    /**
+     * Optional. The object to query for.
+     *
+     * @generated from field: string object = 2;
+     */
+    object: string
+
+    /**
+     * Optional. The relation to query for.
+     *
+     * @generated from field: string relation = 3;
+     */
+    relation: string
+
+    /**
+     * Optional. The subject to query for.
+     *
+     * @generated from field: ory.keto.relation_tuples.v1alpha2.Subject subject = 4;
+     */
+    subject?: Subject
+  }
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest.Query.
+ * Use `create(DeleteRelationTuplesRequest_QuerySchema)` to create a new message.
+ */
+export declare const DeleteRelationTuplesRequest_QuerySchema: GenMessage<DeleteRelationTuplesRequest_Query>
+
+/**
+ * @generated from message ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesResponse
+ */
+export declare type DeleteRelationTuplesResponse =
+  Message<"ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesResponse"> & {}
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesResponse.
+ * Use `create(DeleteRelationTuplesResponseSchema)` to create a new message.
+ */
+export declare const DeleteRelationTuplesResponseSchema: GenMessage<DeleteRelationTuplesResponse>
+
+/**
+ * The write service to create and delete Access Control Lists.
+ *
+ * This service is part of the [write-APIs](../concepts/25_api-overview.mdx#write-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.WriteService
+ */
+export declare const WriteService: GenService<{
+  /**
+   * Writes one or more relationships in a single transaction.
+   *
+   * @generated from rpc ory.keto.relation_tuples.v1alpha2.WriteService.TransactRelationTuples
+   */
+  transactRelationTuples: {
+    methodKind: "unary"
+    input: typeof TransactRelationTuplesRequestSchema
+    output: typeof TransactRelationTuplesResponseSchema
+  }
+  /**
+   * Deletes relationships based on relation query
+   *
+   * @generated from rpc ory.keto.relation_tuples.v1alpha2.WriteService.DeleteRelationTuples
+   */
+  deleteRelationTuples: {
+    methodKind: "unary"
+    input: typeof DeleteRelationTuplesRequestSchema
+    output: typeof DeleteRelationTuplesResponseSchema
+  }
+}>

gen/es/ory/keto/relation_tuples/v1alpha2/write_service_pb.js

@@ -0,0 +1,98 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// @generated by protoc-gen-es v2.11.0
+// @generated from file ory/keto/relation_tuples/v1alpha2/write_service.proto (package ory.keto.relation_tuples.v1alpha2, syntax proto3)
+/* eslint-disable */
+
+import {
+  enumDesc,
+  fileDesc,
+  messageDesc,
+  serviceDesc,
+  tsEnum,
+} from "@bufbuild/protobuf/codegenv2"
+import { file_ory_keto_relation_tuples_v1alpha2_relation_tuples } from "./relation_tuples_pb"
+
+/**
+ * Describes the file ory/keto/relation_tuples/v1alpha2/write_service.proto.
+ */
+export const file_ory_keto_relation_tuples_v1alpha2_write_service =
+  /*@__PURE__*/
+  fileDesc(
+    "CjVvcnkva2V0by9yZWxhdGlvbl90dXBsZXMvdjFhbHBoYTIvd3JpdGVfc2VydmljZS5wcm90bxIhb3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyInUKHVRyYW5zYWN0UmVsYXRpb25UdXBsZXNSZXF1ZXN0ElQKFXJlbGF0aW9uX3R1cGxlX2RlbHRhcxgBIAMoCzI1Lm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5SZWxhdGlvblR1cGxlRGVsdGEi9AEKElJlbGF0aW9uVHVwbGVEZWx0YRJMCgZhY3Rpb24YASABKA4yPC5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIuUmVsYXRpb25UdXBsZURlbHRhLkFjdGlvbhJICg5yZWxhdGlvbl90dXBsZRgCIAEoCzIwLm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5SZWxhdGlvblR1cGxlIkYKBkFjdGlvbhIWChJBQ1RJT05fVU5TUEVDSUZJRUQQABIRCg1BQ1RJT05fSU5TRVJUEAESEQoNQUNUSU9OX0RFTEVURRACIjQKHlRyYW5zYWN0UmVsYXRpb25UdXBsZXNSZXNwb25zZRISCgpzbmFwdG9rZW5zGAEgAygJIrsCChtEZWxldGVSZWxhdGlvblR1cGxlc1JlcXVlc3QSVwoFcXVlcnkYASABKAsyRC5vcnkua2V0by5yZWxhdGlvbl90dXBsZXMudjFhbHBoYTIuRGVsZXRlUmVsYXRpb25UdXBsZXNSZXF1ZXN0LlF1ZXJ5QgIYARJICg5yZWxhdGlvbl9xdWVyeRgCIAEoCzIwLm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5SZWxhdGlvblF1ZXJ5GnkKBVF1ZXJ5EhEKCW5hbWVzcGFjZRgBIAEoCRIOCgZvYmplY3QYAiABKAkSEAoIcmVsYXRpb24YAyABKAkSOwoHc3ViamVjdBgEIAEoCzIqLm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5TdWJqZWN0Ih4KHERlbGV0ZVJlbGF0aW9uVHVwbGVzUmVzcG9uc2UyyAIKDFdyaXRlU2VydmljZRKdAQoWVHJhbnNhY3RSZWxhdGlvblR1cGxlcxJALm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5UcmFuc2FjdFJlbGF0aW9uVHVwbGVzUmVxdWVzdBpBLm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5UcmFuc2FjdFJlbGF0aW9uVHVwbGVzUmVzcG9uc2USlwEKFERlbGV0ZVJlbGF0aW9uVHVwbGVzEj4ub3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyLkRlbGV0ZVJlbGF0aW9uVHVwbGVzUmVxdWVzdBo/Lm9yeS5rZXRvLnJlbGF0aW9uX3R1cGxlcy52MWFscGhhMi5EZWxldGVSZWxhdGlvblR1cGxlc1Jlc3BvbnNlQqoCCiVjb20ub3J5LmtldG8ucmVsYXRpb25fdHVwbGVzLnYxYWxwaGEyQhFXcml0ZVNlcnZpY2VQcm90b1ABWktnaXRodWIuY29tL29yeS9rZXRvL2dlbi9nby9vcnkva2V0by9yZWxhdGlvbl90dXBsZXMvdjFhbHBoYTI7cmVsYXRpb250dXBsZXOiAgNPS1KqAiBPcnkuS2V0by5SZWxhdGlvblR1cGxlcy5WMWFscGhhMsoCIE9yeVxLZXRvXFJlbGF0aW9uVHVwbGVzXFYxYWxwaGEy4gIsT3J5XEtldG9cUmVsYXRpb25UdXBsZXNcVjFhbHBoYTJcR1BCTWV0YWRhdGHqAiNPcnk6OktldG86OlJlbGF0aW9uVHVwbGVzOjpWMWFscGhhMmIGcHJvdG8z",
+    [file_ory_keto_relation_tuples_v1alpha2_relation_tuples],
+  )
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesRequest.
+ * Use `create(TransactRelationTuplesRequestSchema)` to create a new message.
+ */
+export const TransactRelationTuplesRequestSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_write_service, 0)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.RelationTupleDelta.
+ * Use `create(RelationTupleDeltaSchema)` to create a new message.
+ */
+export const RelationTupleDeltaSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_write_service, 1)
+
+/**
+ * Describes the enum ory.keto.relation_tuples.v1alpha2.RelationTupleDelta.Action.
+ */
+export const RelationTupleDelta_ActionSchema =
+  /*@__PURE__*/
+  enumDesc(file_ory_keto_relation_tuples_v1alpha2_write_service, 1, 0)
+
+/**
+ * @generated from enum ory.keto.relation_tuples.v1alpha2.RelationTupleDelta.Action
+ */
+export const RelationTupleDelta_Action =
+  /*@__PURE__*/
+  tsEnum(RelationTupleDelta_ActionSchema)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesResponse.
+ * Use `create(TransactRelationTuplesResponseSchema)` to create a new message.
+ */
+export const TransactRelationTuplesResponseSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_write_service, 2)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest.
+ * Use `create(DeleteRelationTuplesRequestSchema)` to create a new message.
+ */
+export const DeleteRelationTuplesRequestSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_write_service, 3)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest.Query.
+ * Use `create(DeleteRelationTuplesRequest_QuerySchema)` to create a new message.
+ */
+export const DeleteRelationTuplesRequest_QuerySchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_write_service, 3, 0)
+
+/**
+ * Describes the message ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesResponse.
+ * Use `create(DeleteRelationTuplesResponseSchema)` to create a new message.
+ */
+export const DeleteRelationTuplesResponseSchema =
+  /*@__PURE__*/
+  messageDesc(file_ory_keto_relation_tuples_v1alpha2_write_service, 4)
+
+/**
+ * The write service to create and delete Access Control Lists.
+ *
+ * This service is part of the [write-APIs](../concepts/25_api-overview.mdx#write-apis).
+ *
+ * @generated from service ory.keto.relation_tuples.v1alpha2.WriteService
+ */
+export const WriteService =
+  /*@__PURE__*/
+  serviceDesc(file_ory_keto_relation_tuples_v1alpha2_write_service, 0)

gen/es/package-lock.json

@@ -0,0 +1,28 @@
+{
+  "name": "@ory/keto-grpc-client",
+  "version": "0.6.0-alpha.1",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@ory/keto-grpc-client",
+      "version": "0.6.0-alpha.1",
+      "dependencies": {
+        "@bufbuild/protobuf": "^2.11.0"
+      }
+    },
+    "node_modules/@bufbuild/protobuf": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-2.11.0.tgz",
+      "integrity": "sha512-sBXGT13cpmPR5BMgHE6UEEfEaShh5Ror6rfN3yEK5si7QVrtZg8LEPQb0VVhiLRUslD2yLnXtnRzG035J/mZXQ==",
+      "license": "(Apache-2.0 AND BSD-3-Clause)"
+    }
+  },
+  "dependencies": {
+    "@bufbuild/protobuf": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-2.11.0.tgz",
+      "integrity": "sha512-sBXGT13cpmPR5BMgHE6UEEfEaShh5Ror6rfN3yEK5si7QVrtZg8LEPQb0VVhiLRUslD2yLnXtnRzG035J/mZXQ=="
+    }
+  }
+}

gen/es/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@ory/keto-grpc-client",
+  "version": "0.6.0-alpha.1",
+  "description": "gRPC client for Ory Keto",
+  "homepage": "https://www.ory.com/keto",
+  "bugs": "https://github.com/ory/keto/issues",
+  "dependencies": {
+    "@bufbuild/protobuf": "^2.11.0"
+  }
+}