From a35ee9d01fcd10c64610faff0ba5e658aeba1e7f Mon Sep 17 00:00:00 2001
From: Tanner Stirrat <tstirrat@gmail.com>
Date: Mon, 16 Sep 2024 12:21:57 -0600
Subject: [PATCH 1/8] Use v2 of buf.gen.yaml

---
 magefiles/buf.gen.yaml | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/magefiles/buf.gen.yaml b/magefiles/buf.gen.yaml
index d165c95..ff152b3 100755
--- a/magefiles/buf.gen.yaml
+++ b/magefiles/buf.gen.yaml
@@ -1,16 +1,16 @@
 ---
-version: "v1"
+version: "v2"
 plugins:
-  - name: "go"
-    path: ["go", "run", "google.golang.org/protobuf/cmd/protoc-gen-go"]
+  # Go
+  - local: ["go", "run", "google.golang.org/protobuf/cmd/protoc-gen-go"]
     out: "../proto"
     opt: "paths=source_relative"
-  - name: "go-grpc"
-    out: "../proto"
-    path: ["go", "run", "google.golang.org/grpc/cmd/protoc-gen-go-grpc"]
+  # Go-grpc
+  - out: "../proto"
+    local: ["go", "run", "google.golang.org/grpc/cmd/protoc-gen-go-grpc"]
     opt: "paths=source_relative"
-  - name: "go-vtproto"
-    path:
+  # Go-vtproto
+  - local:
       [
         "go",
         "run",
@@ -18,12 +18,12 @@ plugins:
       ]
     out: "../proto"
     opt: "paths=source_relative,features=marshal+unmarshal+size+clone+equal"
-  - name: "validate"
-    path: ["go", "run", "github.com/envoyproxy/protoc-gen-validate"]
+  # Validate
+  - local: ["go", "run", "github.com/envoyproxy/protoc-gen-validate"]
     out: "../proto"
     opt: "paths=source_relative,lang=go"
-  - name: "grpc-gateway"
-    path:
+  # Grpc-gateway
+  - local:
       [
         "go",
         "run",
@@ -31,9 +31,9 @@ plugins:
       ]
     out: "../proto"
     opt: "paths=source_relative"
-  - name: "openapiv2"
-    out: "../proto"
-    path:
+  # Openapi V2
+  - out: "../proto"
+    local:
       [
         "go",
         "run",

From 565e8c27faa838dcd1de0770f4d1864ad0cccd66 Mon Sep 17 00:00:00 2001
From: Tanner Stirrat <tstirrat@gmail.com>
Date: Mon, 16 Sep 2024 12:22:49 -0600
Subject: [PATCH 2/8] Add pre-commit config for yamllint

---
 .pre-commit-config.yaml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 .pre-commit-config.yaml

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..9ee125d
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,6 @@
+---
+repos:
+  - repo: "https://github.com/adrienverge/yamllint.git"
+    rev: "v1.29.0"
+    hooks:
+      - id: "yamllint"

From a5385a726859625fe16abd7f18e4a30c56b00089 Mon Sep 17 00:00:00 2001
From: Tanner Stirrat <tstirrat@gmail.com>
Date: Mon, 16 Sep 2024 12:24:39 -0600
Subject: [PATCH 3/8] Add a pre-commit for the repo

---
 .pre-commit-config.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 9ee125d..322251b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -4,3 +4,7 @@ repos:
     rev: "v1.29.0"
     hooks:
       - id: "yamllint"
+  - repo: "https://github.com/golangci/golangci-lint.git"
+    rev: "v1.61.0"
+    hooks:
+      - id: "golangci-lint"

From 0ea975c5a8a69014e78e5fc788f1d62e2229840a Mon Sep 17 00:00:00 2001
From: Tanner Stirrat <tstirrat@gmail.com>
Date: Mon, 16 Sep 2024 12:53:04 -0600
Subject: [PATCH 4/8] Remove golangci-lint

---
 .pre-commit-config.yaml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 322251b..9ee125d 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -4,7 +4,3 @@ repos:
     rev: "v1.29.0"
     hooks:
       - id: "yamllint"
-  - repo: "https://github.com/golangci/golangci-lint.git"
-    rev: "v1.61.0"
-    hooks:
-      - id: "golangci-lint"

From 06766034d9054fb342f6a01830ba4c6bb388a5cc Mon Sep 17 00:00:00 2001
From: Tanner Stirrat <tstirrat@gmail.com>
Date: Mon, 16 Sep 2024 12:53:12 -0600
Subject: [PATCH 5/8] Bump to prerelease version

---
 magefiles/gen.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/magefiles/gen.go b/magefiles/gen.go
index ff03f7d..61f0fdc 100644
--- a/magefiles/gen.go
+++ b/magefiles/gen.go
@@ -24,7 +24,8 @@ func (g Gen) All() error {
 const (
 	ProtoPath     = "proto/authzed/api"
 	BufRepository = "buf.build/authzed/api"
-	BufTag        = "v1.35.0"
+	// Prerelease version
+	BufTag        = "699bacec3b42827155e8d78296c9c54224a0cffa"
 )
 
 // Proto runs proto codegen

From 2bef414e6e12b55e3e8513553d429958a6592ba1 Mon Sep 17 00:00:00 2001
From: Tanner Stirrat <tstirrat@gmail.com>
Date: Mon, 16 Sep 2024 12:53:22 -0600
Subject: [PATCH 6/8] Commit new protofiles

---
 proto/apidocs.swagger.json                    |   61 +
 .../v0/watchpermissions_grpc.pb.go            |   69 +-
 .../v0/watchpermissionsets_grpc.pb.go         |  113 +-
 .../api/materialize/zz_generated.version.go   |    2 +-
 proto/authzed/api/v0/developer_grpc.pb.go     |   25 +-
 proto/authzed/api/v0/zz_generated.version.go  |    2 +-
 .../api/v1/experimental_service_grpc.pb.go    |  130 +--
 proto/authzed/api/v1/permission_service.pb.go |  533 +++++++--
 .../api/v1/permission_service.pb.gw.go        |  131 +++
 .../api/v1/permission_service.pb.validate.go  |  620 ++++++++++
 .../api/v1/permission_service_grpc.pb.go      |  243 ++--
 .../api/v1/permission_service_vtproto.pb.go   | 1006 ++++++++++++++++-
 .../authzed/api/v1/schema_service_grpc.pb.go  |   25 +-
 proto/authzed/api/v1/watch_service_grpc.pb.go |   69 +-
 proto/authzed/api/v1/zz_generated.version.go  |    2 +-
 proto/authzed/api/v1alpha1/schema_grpc.pb.go  |   25 +-
 .../watchresources_service_grpc.pb.go         |   69 +-
 .../api/v1alpha1/zz_generated.version.go      |    2 +-
 18 files changed, 2586 insertions(+), 541 deletions(-)

diff --git a/proto/apidocs.swagger.json b/proto/apidocs.swagger.json
index 84675e0..1a94e22 100644
--- a/proto/apidocs.swagger.json
+++ b/proto/apidocs.swagger.json
@@ -2408,6 +2408,67 @@
     "v1ExperimentalUnregisterRelationshipCounterResponse": {
       "type": "object"
     },
+    "v1ExportBulkRelationshipsRequest": {
+      "type": "object",
+      "properties": {
+        "consistency": {
+          "$ref": "#/definitions/v1Consistency"
+        },
+        "optionalLimit": {
+          "type": "integer",
+          "format": "int64",
+          "description": "optional_limit, if non-zero, specifies the limit on the number of\nrelationships the server can return in one page. By default, the server\nwill pick a page size, and the server is free to choose a smaller size\nat will."
+        },
+        "optionalCursor": {
+          "$ref": "#/definitions/apiv1Cursor",
+          "description": "optional_cursor, if specified, indicates the cursor after which results\nshould resume being returned. The cursor can be found on the\nBulkExportRelationshipsResponse object."
+        },
+        "optionalRelationshipFilter": {
+          "$ref": "#/definitions/v1RelationshipFilter",
+          "description": "optional_relationship_filter, if specified, indicates the\nfilter to apply to each relationship to be exported."
+        }
+      },
+      "description": "ExportBulkRelationshipsRequest represents a resumable request for\nall relationships from the server."
+    },
+    "v1ExportBulkRelationshipsResponse": {
+      "type": "object",
+      "properties": {
+        "afterResultCursor": {
+          "$ref": "#/definitions/apiv1Cursor"
+        },
+        "relationships": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/v1Relationship"
+          }
+        }
+      },
+      "description": "ExportBulkRelationshipsResponse is one page in a stream of relationship\ngroups that meet the criteria specified by the originating request. The\nserver will continue to stream back relationship groups as quickly as it can\nuntil all relationships have been transmitted back."
+    },
+    "v1ImportBulkRelationshipsRequest": {
+      "type": "object",
+      "properties": {
+        "relationships": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/v1Relationship"
+          }
+        }
+      },
+      "description": "ImportBulkRelationshipsRequest represents one batch of the streaming\nImportBulkRelationships API. The maximum size is only limited by the backing\ndatastore, and optimal size should be determined by the calling client\nexperimentally."
+    },
+    "v1ImportBulkRelationshipsResponse": {
+      "type": "object",
+      "properties": {
+        "numLoaded": {
+          "type": "string",
+          "format": "uint64"
+        }
+      },
+      "description": "ImportBulkRelationshipsResponse is returned on successful completion of the\nbulk load stream, and contains the total number of relationships loaded."
+    },
     "v1LookupPermissionship": {
       "type": "string",
       "enum": [
diff --git a/proto/authzed/api/materialize/v0/watchpermissions_grpc.pb.go b/proto/authzed/api/materialize/v0/watchpermissions_grpc.pb.go
index d073f4f..214a3a4 100644
--- a/proto/authzed/api/materialize/v0/watchpermissions_grpc.pb.go
+++ b/proto/authzed/api/materialize/v0/watchpermissions_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: authzed/api/materialize/v0/watchpermissions.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	WatchPermissionsService_WatchPermissions_FullMethodName = "/authzed.api.materialize.v0.WatchPermissionsService/WatchPermissions"
@@ -41,7 +41,7 @@ type WatchPermissionsServiceClient interface {
 	// watched. It requires more resources and is less performant than WatchPermissionsSets. It's usage
 	// is only recommended when performing the set intersections of WatchPermissionSets in the client side is not viable
 	// or there is a strict application requirement to use consume the computed permissions.
-	WatchPermissions(ctx context.Context, in *WatchPermissionsRequest, opts ...grpc.CallOption) (WatchPermissionsService_WatchPermissionsClient, error)
+	WatchPermissions(ctx context.Context, in *WatchPermissionsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[WatchPermissionsResponse], error)
 }
 
 type watchPermissionsServiceClient struct {
@@ -52,13 +52,13 @@ func NewWatchPermissionsServiceClient(cc grpc.ClientConnInterface) WatchPermissi
 	return &watchPermissionsServiceClient{cc}
 }
 
-func (c *watchPermissionsServiceClient) WatchPermissions(ctx context.Context, in *WatchPermissionsRequest, opts ...grpc.CallOption) (WatchPermissionsService_WatchPermissionsClient, error) {
+func (c *watchPermissionsServiceClient) WatchPermissions(ctx context.Context, in *WatchPermissionsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[WatchPermissionsResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &WatchPermissionsService_ServiceDesc.Streams[0], WatchPermissionsService_WatchPermissions_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &watchPermissionsServiceWatchPermissionsClient{ClientStream: stream}
+	x := &grpc.GenericClientStream[WatchPermissionsRequest, WatchPermissionsResponse]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -68,26 +68,12 @@ func (c *watchPermissionsServiceClient) WatchPermissions(ctx context.Context, in
 	return x, nil
 }
 
-type WatchPermissionsService_WatchPermissionsClient interface {
-	Recv() (*WatchPermissionsResponse, error)
-	grpc.ClientStream
-}
-
-type watchPermissionsServiceWatchPermissionsClient struct {
-	grpc.ClientStream
-}
-
-func (x *watchPermissionsServiceWatchPermissionsClient) Recv() (*WatchPermissionsResponse, error) {
-	m := new(WatchPermissionsResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type WatchPermissionsService_WatchPermissionsClient = grpc.ServerStreamingClient[WatchPermissionsResponse]
 
 // WatchPermissionsServiceServer is the server API for WatchPermissionsService service.
 // All implementations must embed UnimplementedWatchPermissionsServiceServer
-// for forward compatibility
+// for forward compatibility.
 type WatchPermissionsServiceServer interface {
 	// WatchPermissions returns a stream of PermissionChange events for the given permissions.
 	//
@@ -104,19 +90,23 @@ type WatchPermissionsServiceServer interface {
 	// watched. It requires more resources and is less performant than WatchPermissionsSets. It's usage
 	// is only recommended when performing the set intersections of WatchPermissionSets in the client side is not viable
 	// or there is a strict application requirement to use consume the computed permissions.
-	WatchPermissions(*WatchPermissionsRequest, WatchPermissionsService_WatchPermissionsServer) error
+	WatchPermissions(*WatchPermissionsRequest, grpc.ServerStreamingServer[WatchPermissionsResponse]) error
 	mustEmbedUnimplementedWatchPermissionsServiceServer()
 }
 
-// UnimplementedWatchPermissionsServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedWatchPermissionsServiceServer struct {
-}
+// UnimplementedWatchPermissionsServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedWatchPermissionsServiceServer struct{}
 
-func (UnimplementedWatchPermissionsServiceServer) WatchPermissions(*WatchPermissionsRequest, WatchPermissionsService_WatchPermissionsServer) error {
+func (UnimplementedWatchPermissionsServiceServer) WatchPermissions(*WatchPermissionsRequest, grpc.ServerStreamingServer[WatchPermissionsResponse]) error {
 	return status.Errorf(codes.Unimplemented, "method WatchPermissions not implemented")
 }
 func (UnimplementedWatchPermissionsServiceServer) mustEmbedUnimplementedWatchPermissionsServiceServer() {
 }
+func (UnimplementedWatchPermissionsServiceServer) testEmbeddedByValue() {}
 
 // UnsafeWatchPermissionsServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to WatchPermissionsServiceServer will
@@ -126,6 +116,13 @@ type UnsafeWatchPermissionsServiceServer interface {
 }
 
 func RegisterWatchPermissionsServiceServer(s grpc.ServiceRegistrar, srv WatchPermissionsServiceServer) {
+	// If the following call pancis, it indicates UnimplementedWatchPermissionsServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&WatchPermissionsService_ServiceDesc, srv)
 }
 
@@ -134,21 +131,11 @@ func _WatchPermissionsService_WatchPermissions_Handler(srv interface{}, stream g
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(WatchPermissionsServiceServer).WatchPermissions(m, &watchPermissionsServiceWatchPermissionsServer{ServerStream: stream})
-}
-
-type WatchPermissionsService_WatchPermissionsServer interface {
-	Send(*WatchPermissionsResponse) error
-	grpc.ServerStream
+	return srv.(WatchPermissionsServiceServer).WatchPermissions(m, &grpc.GenericServerStream[WatchPermissionsRequest, WatchPermissionsResponse]{ServerStream: stream})
 }
 
-type watchPermissionsServiceWatchPermissionsServer struct {
-	grpc.ServerStream
-}
-
-func (x *watchPermissionsServiceWatchPermissionsServer) Send(m *WatchPermissionsResponse) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type WatchPermissionsService_WatchPermissionsServer = grpc.ServerStreamingServer[WatchPermissionsResponse]
 
 // WatchPermissionsService_ServiceDesc is the grpc.ServiceDesc for WatchPermissionsService service.
 // It's only intended for direct use with grpc.RegisterService,
diff --git a/proto/authzed/api/materialize/v0/watchpermissionsets_grpc.pb.go b/proto/authzed/api/materialize/v0/watchpermissionsets_grpc.pb.go
index 7608883..814cd1e 100644
--- a/proto/authzed/api/materialize/v0/watchpermissionsets_grpc.pb.go
+++ b/proto/authzed/api/materialize/v0/watchpermissionsets_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: authzed/api/materialize/v0/watchpermissionsets.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	WatchPermissionSetsService_WatchPermissionSets_FullMethodName  = "/authzed.api.materialize.v0.WatchPermissionSetsService/WatchPermissionSets"
@@ -58,7 +58,7 @@ type WatchPermissionSetsServiceClient interface {
 	// The API does not offer a sharding mechanism and thus there should only be one consumer per target system.
 	// Implementing an active-active HA consumer setup over the same target system will require coordinating which
 	// revisions have been consumed in order to prevent transitioning to an inconsistent state.
-	WatchPermissionSets(ctx context.Context, in *WatchPermissionSetsRequest, opts ...grpc.CallOption) (WatchPermissionSetsService_WatchPermissionSetsClient, error)
+	WatchPermissionSets(ctx context.Context, in *WatchPermissionSetsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[WatchPermissionSetsResponse], error)
 	// LookupPermissionSets returns the current state of the permission sets which can be used to derive the computed permissions.
 	// It's typically used to backfill the state of the permission sets in the consumer side.
 	//
@@ -71,7 +71,7 @@ type WatchPermissionSetsServiceClient interface {
 	// There may be many elements to stream, and so the consumer should be prepared to resume the stream from the last
 	// cursor received. Once completed, the consumer may start streaming permission set changes using WatchPermissionSets
 	// and the revision token from the last LookupPermissionSets response.
-	LookupPermissionSets(ctx context.Context, in *LookupPermissionSetsRequest, opts ...grpc.CallOption) (WatchPermissionSetsService_LookupPermissionSetsClient, error)
+	LookupPermissionSets(ctx context.Context, in *LookupPermissionSetsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[LookupPermissionSetsResponse], error)
 }
 
 type watchPermissionSetsServiceClient struct {
@@ -82,13 +82,13 @@ func NewWatchPermissionSetsServiceClient(cc grpc.ClientConnInterface) WatchPermi
 	return &watchPermissionSetsServiceClient{cc}
 }
 
-func (c *watchPermissionSetsServiceClient) WatchPermissionSets(ctx context.Context, in *WatchPermissionSetsRequest, opts ...grpc.CallOption) (WatchPermissionSetsService_WatchPermissionSetsClient, error) {
+func (c *watchPermissionSetsServiceClient) WatchPermissionSets(ctx context.Context, in *WatchPermissionSetsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[WatchPermissionSetsResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &WatchPermissionSetsService_ServiceDesc.Streams[0], WatchPermissionSetsService_WatchPermissionSets_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &watchPermissionSetsServiceWatchPermissionSetsClient{ClientStream: stream}
+	x := &grpc.GenericClientStream[WatchPermissionSetsRequest, WatchPermissionSetsResponse]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -98,30 +98,16 @@ func (c *watchPermissionSetsServiceClient) WatchPermissionSets(ctx context.Conte
 	return x, nil
 }
 
-type WatchPermissionSetsService_WatchPermissionSetsClient interface {
-	Recv() (*WatchPermissionSetsResponse, error)
-	grpc.ClientStream
-}
-
-type watchPermissionSetsServiceWatchPermissionSetsClient struct {
-	grpc.ClientStream
-}
-
-func (x *watchPermissionSetsServiceWatchPermissionSetsClient) Recv() (*WatchPermissionSetsResponse, error) {
-	m := new(WatchPermissionSetsResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type WatchPermissionSetsService_WatchPermissionSetsClient = grpc.ServerStreamingClient[WatchPermissionSetsResponse]
 
-func (c *watchPermissionSetsServiceClient) LookupPermissionSets(ctx context.Context, in *LookupPermissionSetsRequest, opts ...grpc.CallOption) (WatchPermissionSetsService_LookupPermissionSetsClient, error) {
+func (c *watchPermissionSetsServiceClient) LookupPermissionSets(ctx context.Context, in *LookupPermissionSetsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[LookupPermissionSetsResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &WatchPermissionSetsService_ServiceDesc.Streams[1], WatchPermissionSetsService_LookupPermissionSets_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &watchPermissionSetsServiceLookupPermissionSetsClient{ClientStream: stream}
+	x := &grpc.GenericClientStream[LookupPermissionSetsRequest, LookupPermissionSetsResponse]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -131,26 +117,12 @@ func (c *watchPermissionSetsServiceClient) LookupPermissionSets(ctx context.Cont
 	return x, nil
 }
 
-type WatchPermissionSetsService_LookupPermissionSetsClient interface {
-	Recv() (*LookupPermissionSetsResponse, error)
-	grpc.ClientStream
-}
-
-type watchPermissionSetsServiceLookupPermissionSetsClient struct {
-	grpc.ClientStream
-}
-
-func (x *watchPermissionSetsServiceLookupPermissionSetsClient) Recv() (*LookupPermissionSetsResponse, error) {
-	m := new(LookupPermissionSetsResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type WatchPermissionSetsService_LookupPermissionSetsClient = grpc.ServerStreamingClient[LookupPermissionSetsResponse]
 
 // WatchPermissionSetsServiceServer is the server API for WatchPermissionSetsService service.
 // All implementations must embed UnimplementedWatchPermissionSetsServiceServer
-// for forward compatibility
+// for forward compatibility.
 type WatchPermissionSetsServiceServer interface {
 	// WatchPermissionSets returns a stream of changes to the sets which can be used to compute the watched permissions.
 	//
@@ -183,7 +155,7 @@ type WatchPermissionSetsServiceServer interface {
 	// The API does not offer a sharding mechanism and thus there should only be one consumer per target system.
 	// Implementing an active-active HA consumer setup over the same target system will require coordinating which
 	// revisions have been consumed in order to prevent transitioning to an inconsistent state.
-	WatchPermissionSets(*WatchPermissionSetsRequest, WatchPermissionSetsService_WatchPermissionSetsServer) error
+	WatchPermissionSets(*WatchPermissionSetsRequest, grpc.ServerStreamingServer[WatchPermissionSetsResponse]) error
 	// LookupPermissionSets returns the current state of the permission sets which can be used to derive the computed permissions.
 	// It's typically used to backfill the state of the permission sets in the consumer side.
 	//
@@ -196,22 +168,26 @@ type WatchPermissionSetsServiceServer interface {
 	// There may be many elements to stream, and so the consumer should be prepared to resume the stream from the last
 	// cursor received. Once completed, the consumer may start streaming permission set changes using WatchPermissionSets
 	// and the revision token from the last LookupPermissionSets response.
-	LookupPermissionSets(*LookupPermissionSetsRequest, WatchPermissionSetsService_LookupPermissionSetsServer) error
+	LookupPermissionSets(*LookupPermissionSetsRequest, grpc.ServerStreamingServer[LookupPermissionSetsResponse]) error
 	mustEmbedUnimplementedWatchPermissionSetsServiceServer()
 }
 
-// UnimplementedWatchPermissionSetsServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedWatchPermissionSetsServiceServer struct {
-}
+// UnimplementedWatchPermissionSetsServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedWatchPermissionSetsServiceServer struct{}
 
-func (UnimplementedWatchPermissionSetsServiceServer) WatchPermissionSets(*WatchPermissionSetsRequest, WatchPermissionSetsService_WatchPermissionSetsServer) error {
+func (UnimplementedWatchPermissionSetsServiceServer) WatchPermissionSets(*WatchPermissionSetsRequest, grpc.ServerStreamingServer[WatchPermissionSetsResponse]) error {
 	return status.Errorf(codes.Unimplemented, "method WatchPermissionSets not implemented")
 }
-func (UnimplementedWatchPermissionSetsServiceServer) LookupPermissionSets(*LookupPermissionSetsRequest, WatchPermissionSetsService_LookupPermissionSetsServer) error {
+func (UnimplementedWatchPermissionSetsServiceServer) LookupPermissionSets(*LookupPermissionSetsRequest, grpc.ServerStreamingServer[LookupPermissionSetsResponse]) error {
 	return status.Errorf(codes.Unimplemented, "method LookupPermissionSets not implemented")
 }
 func (UnimplementedWatchPermissionSetsServiceServer) mustEmbedUnimplementedWatchPermissionSetsServiceServer() {
 }
+func (UnimplementedWatchPermissionSetsServiceServer) testEmbeddedByValue() {}
 
 // UnsafeWatchPermissionSetsServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to WatchPermissionSetsServiceServer will
@@ -221,6 +197,13 @@ type UnsafeWatchPermissionSetsServiceServer interface {
 }
 
 func RegisterWatchPermissionSetsServiceServer(s grpc.ServiceRegistrar, srv WatchPermissionSetsServiceServer) {
+	// If the following call pancis, it indicates UnimplementedWatchPermissionSetsServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&WatchPermissionSetsService_ServiceDesc, srv)
 }
 
@@ -229,42 +212,22 @@ func _WatchPermissionSetsService_WatchPermissionSets_Handler(srv interface{}, st
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(WatchPermissionSetsServiceServer).WatchPermissionSets(m, &watchPermissionSetsServiceWatchPermissionSetsServer{ServerStream: stream})
+	return srv.(WatchPermissionSetsServiceServer).WatchPermissionSets(m, &grpc.GenericServerStream[WatchPermissionSetsRequest, WatchPermissionSetsResponse]{ServerStream: stream})
 }
 
-type WatchPermissionSetsService_WatchPermissionSetsServer interface {
-	Send(*WatchPermissionSetsResponse) error
-	grpc.ServerStream
-}
-
-type watchPermissionSetsServiceWatchPermissionSetsServer struct {
-	grpc.ServerStream
-}
-
-func (x *watchPermissionSetsServiceWatchPermissionSetsServer) Send(m *WatchPermissionSetsResponse) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type WatchPermissionSetsService_WatchPermissionSetsServer = grpc.ServerStreamingServer[WatchPermissionSetsResponse]
 
 func _WatchPermissionSetsService_LookupPermissionSets_Handler(srv interface{}, stream grpc.ServerStream) error {
 	m := new(LookupPermissionSetsRequest)
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(WatchPermissionSetsServiceServer).LookupPermissionSets(m, &watchPermissionSetsServiceLookupPermissionSetsServer{ServerStream: stream})
-}
-
-type WatchPermissionSetsService_LookupPermissionSetsServer interface {
-	Send(*LookupPermissionSetsResponse) error
-	grpc.ServerStream
+	return srv.(WatchPermissionSetsServiceServer).LookupPermissionSets(m, &grpc.GenericServerStream[LookupPermissionSetsRequest, LookupPermissionSetsResponse]{ServerStream: stream})
 }
 
-type watchPermissionSetsServiceLookupPermissionSetsServer struct {
-	grpc.ServerStream
-}
-
-func (x *watchPermissionSetsServiceLookupPermissionSetsServer) Send(m *LookupPermissionSetsResponse) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type WatchPermissionSetsService_LookupPermissionSetsServer = grpc.ServerStreamingServer[LookupPermissionSetsResponse]
 
 // WatchPermissionSetsService_ServiceDesc is the grpc.ServiceDesc for WatchPermissionSetsService service.
 // It's only intended for direct use with grpc.RegisterService,
diff --git a/proto/authzed/api/materialize/zz_generated.version.go b/proto/authzed/api/materialize/zz_generated.version.go
index 10688e9..e822387 100644
--- a/proto/authzed/api/materialize/zz_generated.version.go
+++ b/proto/authzed/api/materialize/zz_generated.version.go
@@ -2,5 +2,5 @@ package materialize
 
 const (
 	BufRepository = "buf.build/authzed/api"
-	BufTag        = "v1.35.0"
+	BufTag        = "699bacec3b42827155e8d78296c9c54224a0cffa"
 )
diff --git a/proto/authzed/api/v0/developer_grpc.pb.go b/proto/authzed/api/v0/developer_grpc.pb.go
index 7063e05..2292cb7 100644
--- a/proto/authzed/api/v0/developer_grpc.pb.go
+++ b/proto/authzed/api/v0/developer_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: authzed/api/v0/developer.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	DeveloperService_EditCheck_FullMethodName     = "/authzed.api.v0.DeveloperService/EditCheck"
@@ -109,7 +109,7 @@ func (c *developerServiceClient) FormatSchema(ctx context.Context, in *FormatSch
 
 // DeveloperServiceServer is the server API for DeveloperService service.
 // All implementations must embed UnimplementedDeveloperServiceServer
-// for forward compatibility
+// for forward compatibility.
 type DeveloperServiceServer interface {
 	EditCheck(context.Context, *EditCheckRequest) (*EditCheckResponse, error)
 	Validate(context.Context, *ValidateRequest) (*ValidateResponse, error)
@@ -120,9 +120,12 @@ type DeveloperServiceServer interface {
 	mustEmbedUnimplementedDeveloperServiceServer()
 }
 
-// UnimplementedDeveloperServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedDeveloperServiceServer struct {
-}
+// UnimplementedDeveloperServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedDeveloperServiceServer struct{}
 
 func (UnimplementedDeveloperServiceServer) EditCheck(context.Context, *EditCheckRequest) (*EditCheckResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method EditCheck not implemented")
@@ -143,6 +146,7 @@ func (UnimplementedDeveloperServiceServer) FormatSchema(context.Context, *Format
 	return nil, status.Errorf(codes.Unimplemented, "method FormatSchema not implemented")
 }
 func (UnimplementedDeveloperServiceServer) mustEmbedUnimplementedDeveloperServiceServer() {}
+func (UnimplementedDeveloperServiceServer) testEmbeddedByValue()                          {}
 
 // UnsafeDeveloperServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to DeveloperServiceServer will
@@ -152,6 +156,13 @@ type UnsafeDeveloperServiceServer interface {
 }
 
 func RegisterDeveloperServiceServer(s grpc.ServiceRegistrar, srv DeveloperServiceServer) {
+	// If the following call pancis, it indicates UnimplementedDeveloperServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&DeveloperService_ServiceDesc, srv)
 }
 
diff --git a/proto/authzed/api/v0/zz_generated.version.go b/proto/authzed/api/v0/zz_generated.version.go
index 764f78e..13fa898 100644
--- a/proto/authzed/api/v0/zz_generated.version.go
+++ b/proto/authzed/api/v0/zz_generated.version.go
@@ -2,5 +2,5 @@ package v0
 
 const (
 	BufRepository = "buf.build/authzed/api"
-	BufTag        = "v1.35.0"
+	BufTag        = "699bacec3b42827155e8d78296c9c54224a0cffa"
 )
diff --git a/proto/authzed/api/v1/experimental_service_grpc.pb.go b/proto/authzed/api/v1/experimental_service_grpc.pb.go
index 032a3dd..c2185d8 100644
--- a/proto/authzed/api/v1/experimental_service_grpc.pb.go
+++ b/proto/authzed/api/v1/experimental_service_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: authzed/api/v1/experimental_service.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	ExperimentalService_BulkImportRelationships_FullMethodName                   = "/authzed.api.v1.ExperimentalService/BulkImportRelationships"
@@ -47,11 +47,11 @@ type ExperimentalServiceClient interface {
 	//
 	// EXPERIMENTAL
 	// https://github.com/authzed/spicedb/issues/1303
-	BulkImportRelationships(ctx context.Context, opts ...grpc.CallOption) (ExperimentalService_BulkImportRelationshipsClient, error)
+	BulkImportRelationships(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[BulkImportRelationshipsRequest, BulkImportRelationshipsResponse], error)
 	// BulkExportRelationships is the fastest path available to exporting
 	// relationships from the server. It is resumable, and will return results
 	// in an order determined by the server.
-	BulkExportRelationships(ctx context.Context, in *BulkExportRelationshipsRequest, opts ...grpc.CallOption) (ExperimentalService_BulkExportRelationshipsClient, error)
+	BulkExportRelationships(ctx context.Context, in *BulkExportRelationshipsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[BulkExportRelationshipsResponse], error)
 	// Deprecated: Do not use.
 	// NOTE: BulkCheckPermission has been promoted to the stable API as "CheckBulkPermission" and the
 	// API will be removed from experimental in a future release.
@@ -89,48 +89,26 @@ func NewExperimentalServiceClient(cc grpc.ClientConnInterface) ExperimentalServi
 	return &experimentalServiceClient{cc}
 }
 
-func (c *experimentalServiceClient) BulkImportRelationships(ctx context.Context, opts ...grpc.CallOption) (ExperimentalService_BulkImportRelationshipsClient, error) {
+func (c *experimentalServiceClient) BulkImportRelationships(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[BulkImportRelationshipsRequest, BulkImportRelationshipsResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &ExperimentalService_ServiceDesc.Streams[0], ExperimentalService_BulkImportRelationships_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &experimentalServiceBulkImportRelationshipsClient{ClientStream: stream}
+	x := &grpc.GenericClientStream[BulkImportRelationshipsRequest, BulkImportRelationshipsResponse]{ClientStream: stream}
 	return x, nil
 }
 
-type ExperimentalService_BulkImportRelationshipsClient interface {
-	Send(*BulkImportRelationshipsRequest) error
-	CloseAndRecv() (*BulkImportRelationshipsResponse, error)
-	grpc.ClientStream
-}
-
-type experimentalServiceBulkImportRelationshipsClient struct {
-	grpc.ClientStream
-}
-
-func (x *experimentalServiceBulkImportRelationshipsClient) Send(m *BulkImportRelationshipsRequest) error {
-	return x.ClientStream.SendMsg(m)
-}
-
-func (x *experimentalServiceBulkImportRelationshipsClient) CloseAndRecv() (*BulkImportRelationshipsResponse, error) {
-	if err := x.ClientStream.CloseSend(); err != nil {
-		return nil, err
-	}
-	m := new(BulkImportRelationshipsResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type ExperimentalService_BulkImportRelationshipsClient = grpc.ClientStreamingClient[BulkImportRelationshipsRequest, BulkImportRelationshipsResponse]
 
-func (c *experimentalServiceClient) BulkExportRelationships(ctx context.Context, in *BulkExportRelationshipsRequest, opts ...grpc.CallOption) (ExperimentalService_BulkExportRelationshipsClient, error) {
+func (c *experimentalServiceClient) BulkExportRelationships(ctx context.Context, in *BulkExportRelationshipsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[BulkExportRelationshipsResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &ExperimentalService_ServiceDesc.Streams[1], ExperimentalService_BulkExportRelationships_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &experimentalServiceBulkExportRelationshipsClient{ClientStream: stream}
+	x := &grpc.GenericClientStream[BulkExportRelationshipsRequest, BulkExportRelationshipsResponse]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -140,22 +118,8 @@ func (c *experimentalServiceClient) BulkExportRelationships(ctx context.Context,
 	return x, nil
 }
 
-type ExperimentalService_BulkExportRelationshipsClient interface {
-	Recv() (*BulkExportRelationshipsResponse, error)
-	grpc.ClientStream
-}
-
-type experimentalServiceBulkExportRelationshipsClient struct {
-	grpc.ClientStream
-}
-
-func (x *experimentalServiceBulkExportRelationshipsClient) Recv() (*BulkExportRelationshipsResponse, error) {
-	m := new(BulkExportRelationshipsResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type ExperimentalService_BulkExportRelationshipsClient = grpc.ServerStreamingClient[BulkExportRelationshipsResponse]
 
 // Deprecated: Do not use.
 func (c *experimentalServiceClient) BulkCheckPermission(ctx context.Context, in *BulkCheckPermissionRequest, opts ...grpc.CallOption) (*BulkCheckPermissionResponse, error) {
@@ -240,7 +204,7 @@ func (c *experimentalServiceClient) ExperimentalUnregisterRelationshipCounter(ct
 
 // ExperimentalServiceServer is the server API for ExperimentalService service.
 // All implementations must embed UnimplementedExperimentalServiceServer
-// for forward compatibility
+// for forward compatibility.
 //
 // ExperimentalService exposes a number of APIs that are currently being
 // prototyped and tested for future inclusion in the stable API.
@@ -254,11 +218,11 @@ type ExperimentalServiceServer interface {
 	//
 	// EXPERIMENTAL
 	// https://github.com/authzed/spicedb/issues/1303
-	BulkImportRelationships(ExperimentalService_BulkImportRelationshipsServer) error
+	BulkImportRelationships(grpc.ClientStreamingServer[BulkImportRelationshipsRequest, BulkImportRelationshipsResponse]) error
 	// BulkExportRelationships is the fastest path available to exporting
 	// relationships from the server. It is resumable, and will return results
 	// in an order determined by the server.
-	BulkExportRelationships(*BulkExportRelationshipsRequest, ExperimentalService_BulkExportRelationshipsServer) error
+	BulkExportRelationships(*BulkExportRelationshipsRequest, grpc.ServerStreamingServer[BulkExportRelationshipsResponse]) error
 	// Deprecated: Do not use.
 	// NOTE: BulkCheckPermission has been promoted to the stable API as "CheckBulkPermission" and the
 	// API will be removed from experimental in a future release.
@@ -289,14 +253,17 @@ type ExperimentalServiceServer interface {
 	mustEmbedUnimplementedExperimentalServiceServer()
 }
 
-// UnimplementedExperimentalServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedExperimentalServiceServer struct {
-}
+// UnimplementedExperimentalServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedExperimentalServiceServer struct{}
 
-func (UnimplementedExperimentalServiceServer) BulkImportRelationships(ExperimentalService_BulkImportRelationshipsServer) error {
+func (UnimplementedExperimentalServiceServer) BulkImportRelationships(grpc.ClientStreamingServer[BulkImportRelationshipsRequest, BulkImportRelationshipsResponse]) error {
 	return status.Errorf(codes.Unimplemented, "method BulkImportRelationships not implemented")
 }
-func (UnimplementedExperimentalServiceServer) BulkExportRelationships(*BulkExportRelationshipsRequest, ExperimentalService_BulkExportRelationshipsServer) error {
+func (UnimplementedExperimentalServiceServer) BulkExportRelationships(*BulkExportRelationshipsRequest, grpc.ServerStreamingServer[BulkExportRelationshipsResponse]) error {
 	return status.Errorf(codes.Unimplemented, "method BulkExportRelationships not implemented")
 }
 func (UnimplementedExperimentalServiceServer) BulkCheckPermission(context.Context, *BulkCheckPermissionRequest) (*BulkCheckPermissionResponse, error) {
@@ -324,6 +291,7 @@ func (UnimplementedExperimentalServiceServer) ExperimentalUnregisterRelationship
 	return nil, status.Errorf(codes.Unimplemented, "method ExperimentalUnregisterRelationshipCounter not implemented")
 }
 func (UnimplementedExperimentalServiceServer) mustEmbedUnimplementedExperimentalServiceServer() {}
+func (UnimplementedExperimentalServiceServer) testEmbeddedByValue()                             {}
 
 // UnsafeExperimentalServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to ExperimentalServiceServer will
@@ -333,55 +301,33 @@ type UnsafeExperimentalServiceServer interface {
 }
 
 func RegisterExperimentalServiceServer(s grpc.ServiceRegistrar, srv ExperimentalServiceServer) {
+	// If the following call pancis, it indicates UnimplementedExperimentalServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&ExperimentalService_ServiceDesc, srv)
 }
 
 func _ExperimentalService_BulkImportRelationships_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(ExperimentalServiceServer).BulkImportRelationships(&experimentalServiceBulkImportRelationshipsServer{ServerStream: stream})
-}
-
-type ExperimentalService_BulkImportRelationshipsServer interface {
-	SendAndClose(*BulkImportRelationshipsResponse) error
-	Recv() (*BulkImportRelationshipsRequest, error)
-	grpc.ServerStream
-}
-
-type experimentalServiceBulkImportRelationshipsServer struct {
-	grpc.ServerStream
-}
-
-func (x *experimentalServiceBulkImportRelationshipsServer) SendAndClose(m *BulkImportRelationshipsResponse) error {
-	return x.ServerStream.SendMsg(m)
+	return srv.(ExperimentalServiceServer).BulkImportRelationships(&grpc.GenericServerStream[BulkImportRelationshipsRequest, BulkImportRelationshipsResponse]{ServerStream: stream})
 }
 
-func (x *experimentalServiceBulkImportRelationshipsServer) Recv() (*BulkImportRelationshipsRequest, error) {
-	m := new(BulkImportRelationshipsRequest)
-	if err := x.ServerStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type ExperimentalService_BulkImportRelationshipsServer = grpc.ClientStreamingServer[BulkImportRelationshipsRequest, BulkImportRelationshipsResponse]
 
 func _ExperimentalService_BulkExportRelationships_Handler(srv interface{}, stream grpc.ServerStream) error {
 	m := new(BulkExportRelationshipsRequest)
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(ExperimentalServiceServer).BulkExportRelationships(m, &experimentalServiceBulkExportRelationshipsServer{ServerStream: stream})
+	return srv.(ExperimentalServiceServer).BulkExportRelationships(m, &grpc.GenericServerStream[BulkExportRelationshipsRequest, BulkExportRelationshipsResponse]{ServerStream: stream})
 }
 
-type ExperimentalService_BulkExportRelationshipsServer interface {
-	Send(*BulkExportRelationshipsResponse) error
-	grpc.ServerStream
-}
-
-type experimentalServiceBulkExportRelationshipsServer struct {
-	grpc.ServerStream
-}
-
-func (x *experimentalServiceBulkExportRelationshipsServer) Send(m *BulkExportRelationshipsResponse) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type ExperimentalService_BulkExportRelationshipsServer = grpc.ServerStreamingServer[BulkExportRelationshipsResponse]
 
 func _ExperimentalService_BulkCheckPermission_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(BulkCheckPermissionRequest)
diff --git a/proto/authzed/api/v1/permission_service.pb.go b/proto/authzed/api/v1/permission_service.pb.go
index 6771b12..bce5a8e 100644
--- a/proto/authzed/api/v1/permission_service.pb.go
+++ b/proto/authzed/api/v1/permission_service.pb.go
@@ -2214,6 +2214,247 @@ func (x *ResolvedSubject) GetPartialCaveatInfo() *PartialCaveatInfo {
 	return nil
 }
 
+// ImportBulkRelationshipsRequest represents one batch of the streaming
+// ImportBulkRelationships API. The maximum size is only limited by the backing
+// datastore, and optimal size should be determined by the calling client
+// experimentally.
+type ImportBulkRelationshipsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Relationships []*Relationship `protobuf:"bytes,1,rep,name=relationships,proto3" json:"relationships,omitempty"`
+}
+
+func (x *ImportBulkRelationshipsRequest) Reset() {
+	*x = ImportBulkRelationshipsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_authzed_api_v1_permission_service_proto_msgTypes[24]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ImportBulkRelationshipsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ImportBulkRelationshipsRequest) ProtoMessage() {}
+
+func (x *ImportBulkRelationshipsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_authzed_api_v1_permission_service_proto_msgTypes[24]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ImportBulkRelationshipsRequest.ProtoReflect.Descriptor instead.
+func (*ImportBulkRelationshipsRequest) Descriptor() ([]byte, []int) {
+	return file_authzed_api_v1_permission_service_proto_rawDescGZIP(), []int{24}
+}
+
+func (x *ImportBulkRelationshipsRequest) GetRelationships() []*Relationship {
+	if x != nil {
+		return x.Relationships
+	}
+	return nil
+}
+
+// ImportBulkRelationshipsResponse is returned on successful completion of the
+// bulk load stream, and contains the total number of relationships loaded.
+type ImportBulkRelationshipsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NumLoaded uint64 `protobuf:"varint,1,opt,name=num_loaded,json=numLoaded,proto3" json:"num_loaded,omitempty"`
+}
+
+func (x *ImportBulkRelationshipsResponse) Reset() {
+	*x = ImportBulkRelationshipsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_authzed_api_v1_permission_service_proto_msgTypes[25]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ImportBulkRelationshipsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ImportBulkRelationshipsResponse) ProtoMessage() {}
+
+func (x *ImportBulkRelationshipsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_authzed_api_v1_permission_service_proto_msgTypes[25]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ImportBulkRelationshipsResponse.ProtoReflect.Descriptor instead.
+func (*ImportBulkRelationshipsResponse) Descriptor() ([]byte, []int) {
+	return file_authzed_api_v1_permission_service_proto_rawDescGZIP(), []int{25}
+}
+
+func (x *ImportBulkRelationshipsResponse) GetNumLoaded() uint64 {
+	if x != nil {
+		return x.NumLoaded
+	}
+	return 0
+}
+
+// ExportBulkRelationshipsRequest represents a resumable request for
+// all relationships from the server.
+type ExportBulkRelationshipsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Consistency *Consistency `protobuf:"bytes,1,opt,name=consistency,proto3" json:"consistency,omitempty"`
+	// optional_limit, if non-zero, specifies the limit on the number of
+	// relationships the server can return in one page. By default, the server
+	// will pick a page size, and the server is free to choose a smaller size
+	// at will.
+	OptionalLimit uint32 `protobuf:"varint,2,opt,name=optional_limit,json=optionalLimit,proto3" json:"optional_limit,omitempty"`
+	// optional_cursor, if specified, indicates the cursor after which results
+	// should resume being returned. The cursor can be found on the
+	// BulkExportRelationshipsResponse object.
+	OptionalCursor *Cursor `protobuf:"bytes,3,opt,name=optional_cursor,json=optionalCursor,proto3" json:"optional_cursor,omitempty"`
+	// optional_relationship_filter, if specified, indicates the
+	// filter to apply to each relationship to be exported.
+	OptionalRelationshipFilter *RelationshipFilter `protobuf:"bytes,4,opt,name=optional_relationship_filter,json=optionalRelationshipFilter,proto3" json:"optional_relationship_filter,omitempty"`
+}
+
+func (x *ExportBulkRelationshipsRequest) Reset() {
+	*x = ExportBulkRelationshipsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_authzed_api_v1_permission_service_proto_msgTypes[26]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExportBulkRelationshipsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExportBulkRelationshipsRequest) ProtoMessage() {}
+
+func (x *ExportBulkRelationshipsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_authzed_api_v1_permission_service_proto_msgTypes[26]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExportBulkRelationshipsRequest.ProtoReflect.Descriptor instead.
+func (*ExportBulkRelationshipsRequest) Descriptor() ([]byte, []int) {
+	return file_authzed_api_v1_permission_service_proto_rawDescGZIP(), []int{26}
+}
+
+func (x *ExportBulkRelationshipsRequest) GetConsistency() *Consistency {
+	if x != nil {
+		return x.Consistency
+	}
+	return nil
+}
+
+func (x *ExportBulkRelationshipsRequest) GetOptionalLimit() uint32 {
+	if x != nil {
+		return x.OptionalLimit
+	}
+	return 0
+}
+
+func (x *ExportBulkRelationshipsRequest) GetOptionalCursor() *Cursor {
+	if x != nil {
+		return x.OptionalCursor
+	}
+	return nil
+}
+
+func (x *ExportBulkRelationshipsRequest) GetOptionalRelationshipFilter() *RelationshipFilter {
+	if x != nil {
+		return x.OptionalRelationshipFilter
+	}
+	return nil
+}
+
+// ExportBulkRelationshipsResponse is one page in a stream of relationship
+// groups that meet the criteria specified by the originating request. The
+// server will continue to stream back relationship groups as quickly as it can
+// until all relationships have been transmitted back.
+type ExportBulkRelationshipsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AfterResultCursor *Cursor         `protobuf:"bytes,1,opt,name=after_result_cursor,json=afterResultCursor,proto3" json:"after_result_cursor,omitempty"`
+	Relationships     []*Relationship `protobuf:"bytes,2,rep,name=relationships,proto3" json:"relationships,omitempty"`
+}
+
+func (x *ExportBulkRelationshipsResponse) Reset() {
+	*x = ExportBulkRelationshipsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_authzed_api_v1_permission_service_proto_msgTypes[27]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExportBulkRelationshipsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExportBulkRelationshipsResponse) ProtoMessage() {}
+
+func (x *ExportBulkRelationshipsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_authzed_api_v1_permission_service_proto_msgTypes[27]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExportBulkRelationshipsResponse.ProtoReflect.Descriptor instead.
+func (*ExportBulkRelationshipsResponse) Descriptor() ([]byte, []int) {
+	return file_authzed_api_v1_permission_service_proto_rawDescGZIP(), []int{27}
+}
+
+func (x *ExportBulkRelationshipsResponse) GetAfterResultCursor() *Cursor {
+	if x != nil {
+		return x.AfterResultCursor
+	}
+	return nil
+}
+
+func (x *ExportBulkRelationshipsResponse) GetRelationships() []*Relationship {
+	if x != nil {
+		return x.Relationships
+	}
+	return nil
+}
+
 type SubjectFilter_RelationFilter struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -2225,7 +2466,7 @@ type SubjectFilter_RelationFilter struct {
 func (x *SubjectFilter_RelationFilter) Reset() {
 	*x = SubjectFilter_RelationFilter{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_authzed_api_v1_permission_service_proto_msgTypes[24]
+		mi := &file_authzed_api_v1_permission_service_proto_msgTypes[28]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2238,7 +2479,7 @@ func (x *SubjectFilter_RelationFilter) String() string {
 func (*SubjectFilter_RelationFilter) ProtoMessage() {}
 
 func (x *SubjectFilter_RelationFilter) ProtoReflect() protoreflect.Message {
-	mi := &file_authzed_api_v1_permission_service_proto_msgTypes[24]
+	mi := &file_authzed_api_v1_permission_service_proto_msgTypes[28]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2781,7 +3022,49 @@ var file_authzed_api_v1_permission_service_proto_rawDesc = []byte{
 	0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x61, 0x72, 0x74, 0x69,
 	0x61, 0x6c, 0x43, 0x61, 0x76, 0x65, 0x61, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x42, 0x08, 0xfa, 0x42,
 	0x05, 0x8a, 0x01, 0x02, 0x10, 0x00, 0x52, 0x11, 0x70, 0x61, 0x72, 0x74, 0x69, 0x61, 0x6c, 0x43,
-	0x61, 0x76, 0x65, 0x61, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x2a, 0x99, 0x01, 0x0a, 0x14, 0x4c, 0x6f,
+	0x61, 0x76, 0x65, 0x61, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x22, 0x73, 0x0a, 0x1e, 0x49, 0x6d, 0x70,
+	0x6f, 0x72, 0x74, 0x42, 0x75, 0x6c, 0x6b, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x68, 0x69, 0x70, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x51, 0x0a, 0x0d, 0x72,
+	0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70,
+	0x42, 0x0d, 0xfa, 0x42, 0x0a, 0x92, 0x01, 0x07, 0x22, 0x05, 0x8a, 0x01, 0x02, 0x10, 0x01, 0x52,
+	0x0d, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x22, 0x40,
+	0x0a, 0x1f, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x42, 0x75, 0x6c, 0x6b, 0x52, 0x65, 0x6c, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x6e, 0x75, 0x6d, 0x5f, 0x6c, 0x6f, 0x61, 0x64, 0x65, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6e, 0x75, 0x6d, 0x4c, 0x6f, 0x61, 0x64, 0x65, 0x64,
+	0x22, 0xb6, 0x02, 0x0a, 0x1e, 0x45, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x42, 0x75, 0x6c, 0x6b, 0x52,
+	0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x3d, 0x0a, 0x0b, 0x63, 0x6f, 0x6e, 0x73, 0x69, 0x73, 0x74, 0x65, 0x6e,
+	0x63, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a,
+	0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x69, 0x73,
+	0x74, 0x65, 0x6e, 0x63, 0x79, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x73, 0x69, 0x73, 0x74, 0x65, 0x6e,
+	0x63, 0x79, 0x12, 0x2e, 0x0a, 0x0e, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f, 0x6c,
+	0x69, 0x6d, 0x69, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x2a,
+	0x02, 0x28, 0x00, 0x52, 0x0d, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x4c, 0x69, 0x6d,
+	0x69, 0x74, 0x12, 0x3f, 0x0a, 0x0f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f, 0x63,
+	0x75, 0x72, 0x73, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x61, 0x75,
+	0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x75, 0x72,
+	0x73, 0x6f, 0x72, 0x52, 0x0e, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x43, 0x75, 0x72,
+	0x73, 0x6f, 0x72, 0x12, 0x64, 0x0a, 0x1c, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f,
+	0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x5f, 0x66, 0x69, 0x6c,
+	0x74, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x61, 0x75, 0x74, 0x68,
+	0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x6c, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x1a, 0x6f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x68, 0x69, 0x70, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x22, 0xad, 0x01, 0x0a, 0x1f, 0x45, 0x78,
+	0x70, 0x6f, 0x72, 0x74, 0x42, 0x75, 0x6c, 0x6b, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x68, 0x69, 0x70, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x46, 0x0a,
+	0x13, 0x61, 0x66, 0x74, 0x65, 0x72, 0x5f, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x5f, 0x63, 0x75,
+	0x72, 0x73, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x61, 0x75, 0x74,
+	0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x75, 0x72, 0x73,
+	0x6f, 0x72, 0x52, 0x11, 0x61, 0x66, 0x74, 0x65, 0x72, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x43,
+	0x75, 0x72, 0x73, 0x6f, 0x72, 0x12, 0x42, 0x0a, 0x0d, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x61,
+	0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65,
+	0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x52, 0x0d, 0x72, 0x65, 0x6c, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x2a, 0x99, 0x01, 0x0a, 0x14, 0x4c, 0x6f,
 	0x6f, 0x6b, 0x75, 0x70, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x68,
 	0x69, 0x70, 0x12, 0x25, 0x0a, 0x21, 0x4c, 0x4f, 0x4f, 0x4b, 0x55, 0x50, 0x5f, 0x50, 0x45, 0x52,
 	0x4d, 0x49, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x53, 0x48, 0x49, 0x50, 0x5f, 0x55, 0x4e, 0x53, 0x50,
@@ -2791,7 +3074,7 @@ var file_authzed_api_v1_permission_service_proto_rawDesc = []byte{
 	0x4e, 0x10, 0x01, 0x12, 0x30, 0x0a, 0x2c, 0x4c, 0x4f, 0x4f, 0x4b, 0x55, 0x50, 0x5f, 0x50, 0x45,
 	0x52, 0x4d, 0x49, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x53, 0x48, 0x49, 0x50, 0x5f, 0x43, 0x4f, 0x4e,
 	0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x41, 0x4c, 0x5f, 0x50, 0x45, 0x52, 0x4d, 0x49, 0x53, 0x53,
-	0x49, 0x4f, 0x4e, 0x10, 0x02, 0x32, 0x9a, 0x09, 0x0a, 0x12, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73,
+	0x49, 0x4f, 0x4e, 0x10, 0x02, 0x32, 0x84, 0x0c, 0x0a, 0x12, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73,
 	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x8d, 0x01, 0x0a,
 	0x11, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69,
 	0x70, 0x73, 0x12, 0x28, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69,
@@ -2865,12 +3148,34 @@ var file_authzed_api_v1_permission_service_proto_rawDesc = []byte{
 	0x63, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x23, 0x82, 0xd3, 0xe4,
 	0x93, 0x02, 0x1d, 0x3a, 0x01, 0x2a, 0x22, 0x18, 0x2f, 0x76, 0x31, 0x2f, 0x70, 0x65, 0x72, 0x6d,
 	0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73,
-	0x30, 0x01, 0x42, 0x4a, 0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65,
-	0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x50, 0x01, 0x5a, 0x32, 0x67, 0x69, 0x74, 0x68,
-	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f, 0x61,
-	0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2d, 0x67, 0x6f, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f,
-	0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x62, 0x06,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x30, 0x01, 0x12, 0xb2, 0x01, 0x0a, 0x17, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x42, 0x75, 0x6c,
+	0x6b, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x12, 0x2e,
+	0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e,
+	0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x42, 0x75, 0x6c, 0x6b, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2f,
+	0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e,
+	0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x42, 0x75, 0x6c, 0x6b, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x34, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x2e, 0x3a, 0x01, 0x2a, 0x22, 0x29, 0x2f, 0x76, 0x31, 0x2f,
+	0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2f, 0x72, 0x65, 0x6c,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x2f, 0x62, 0x75, 0x6c, 0x6b, 0x69,
+	0x6d, 0x70, 0x6f, 0x72, 0x74, 0x28, 0x01, 0x12, 0xb2, 0x01, 0x0a, 0x17, 0x45, 0x78, 0x70, 0x6f,
+	0x72, 0x74, 0x42, 0x75, 0x6c, 0x6b, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68,
+	0x69, 0x70, 0x73, 0x12, 0x2e, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x42, 0x75, 0x6c, 0x6b, 0x52,
+	0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x42, 0x75, 0x6c, 0x6b, 0x52,
+	0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x34, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x2e, 0x3a, 0x01, 0x2a, 0x22,
+	0x29, 0x2f, 0x76, 0x31, 0x2f, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61,
+	0x6c, 0x2f, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x68, 0x69, 0x70, 0x73, 0x2f,
+	0x62, 0x75, 0x6c, 0x6b, 0x65, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x30, 0x01, 0x42, 0x4a, 0x0a, 0x12,
+	0x63, 0x6f, 0x6d, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x76, 0x31, 0x50, 0x01, 0x5a, 0x32, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64,
+	0x2d, 0x67, 0x6f, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65,
+	0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -2886,7 +3191,7 @@ func file_authzed_api_v1_permission_service_proto_rawDescGZIP() []byte {
 }
 
 var file_authzed_api_v1_permission_service_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
-var file_authzed_api_v1_permission_service_proto_msgTypes = make([]protoimpl.MessageInfo, 25)
+var file_authzed_api_v1_permission_service_proto_msgTypes = make([]protoimpl.MessageInfo, 29)
 var file_authzed_api_v1_permission_service_proto_goTypes = []any{
 	(LookupPermissionship)(0),                         // 0: authzed.api.v1.LookupPermissionship
 	(Precondition_Operation)(0),                       // 1: authzed.api.v1.Precondition.Operation
@@ -2917,105 +3222,119 @@ var file_authzed_api_v1_permission_service_proto_goTypes = []any{
 	(*LookupSubjectsRequest)(nil),                     // 26: authzed.api.v1.LookupSubjectsRequest
 	(*LookupSubjectsResponse)(nil),                    // 27: authzed.api.v1.LookupSubjectsResponse
 	(*ResolvedSubject)(nil),                           // 28: authzed.api.v1.ResolvedSubject
-	(*SubjectFilter_RelationFilter)(nil),              // 29: authzed.api.v1.SubjectFilter.RelationFilter
-	(*ZedToken)(nil),                                  // 30: authzed.api.v1.ZedToken
-	(*Cursor)(nil),                                    // 31: authzed.api.v1.Cursor
-	(*Relationship)(nil),                              // 32: authzed.api.v1.Relationship
-	(*RelationshipUpdate)(nil),                        // 33: authzed.api.v1.RelationshipUpdate
-	(*ObjectReference)(nil),                           // 34: authzed.api.v1.ObjectReference
-	(*SubjectReference)(nil),                          // 35: authzed.api.v1.SubjectReference
-	(*structpb.Struct)(nil),                           // 36: google.protobuf.Struct
-	(*PartialCaveatInfo)(nil),                         // 37: authzed.api.v1.PartialCaveatInfo
-	(*DebugInformation)(nil),                          // 38: authzed.api.v1.DebugInformation
-	(*status.Status)(nil),                             // 39: google.rpc.Status
-	(*PermissionRelationshipTree)(nil),                // 40: authzed.api.v1.PermissionRelationshipTree
+	(*ImportBulkRelationshipsRequest)(nil),            // 29: authzed.api.v1.ImportBulkRelationshipsRequest
+	(*ImportBulkRelationshipsResponse)(nil),           // 30: authzed.api.v1.ImportBulkRelationshipsResponse
+	(*ExportBulkRelationshipsRequest)(nil),            // 31: authzed.api.v1.ExportBulkRelationshipsRequest
+	(*ExportBulkRelationshipsResponse)(nil),           // 32: authzed.api.v1.ExportBulkRelationshipsResponse
+	(*SubjectFilter_RelationFilter)(nil),              // 33: authzed.api.v1.SubjectFilter.RelationFilter
+	(*ZedToken)(nil),                                  // 34: authzed.api.v1.ZedToken
+	(*Cursor)(nil),                                    // 35: authzed.api.v1.Cursor
+	(*Relationship)(nil),                              // 36: authzed.api.v1.Relationship
+	(*RelationshipUpdate)(nil),                        // 37: authzed.api.v1.RelationshipUpdate
+	(*ObjectReference)(nil),                           // 38: authzed.api.v1.ObjectReference
+	(*SubjectReference)(nil),                          // 39: authzed.api.v1.SubjectReference
+	(*structpb.Struct)(nil),                           // 40: google.protobuf.Struct
+	(*PartialCaveatInfo)(nil),                         // 41: authzed.api.v1.PartialCaveatInfo
+	(*DebugInformation)(nil),                          // 42: authzed.api.v1.DebugInformation
+	(*status.Status)(nil),                             // 43: google.rpc.Status
+	(*PermissionRelationshipTree)(nil),                // 44: authzed.api.v1.PermissionRelationshipTree
 }
 var file_authzed_api_v1_permission_service_proto_depIdxs = []int32{
-	30, // 0: authzed.api.v1.Consistency.at_least_as_fresh:type_name -> authzed.api.v1.ZedToken
-	30, // 1: authzed.api.v1.Consistency.at_exact_snapshot:type_name -> authzed.api.v1.ZedToken
+	34, // 0: authzed.api.v1.Consistency.at_least_as_fresh:type_name -> authzed.api.v1.ZedToken
+	34, // 1: authzed.api.v1.Consistency.at_exact_snapshot:type_name -> authzed.api.v1.ZedToken
 	7,  // 2: authzed.api.v1.RelationshipFilter.optional_subject_filter:type_name -> authzed.api.v1.SubjectFilter
-	29, // 3: authzed.api.v1.SubjectFilter.optional_relation:type_name -> authzed.api.v1.SubjectFilter.RelationFilter
+	33, // 3: authzed.api.v1.SubjectFilter.optional_relation:type_name -> authzed.api.v1.SubjectFilter.RelationFilter
 	5,  // 4: authzed.api.v1.ReadRelationshipsRequest.consistency:type_name -> authzed.api.v1.Consistency
 	6,  // 5: authzed.api.v1.ReadRelationshipsRequest.relationship_filter:type_name -> authzed.api.v1.RelationshipFilter
-	31, // 6: authzed.api.v1.ReadRelationshipsRequest.optional_cursor:type_name -> authzed.api.v1.Cursor
-	30, // 7: authzed.api.v1.ReadRelationshipsResponse.read_at:type_name -> authzed.api.v1.ZedToken
-	32, // 8: authzed.api.v1.ReadRelationshipsResponse.relationship:type_name -> authzed.api.v1.Relationship
-	31, // 9: authzed.api.v1.ReadRelationshipsResponse.after_result_cursor:type_name -> authzed.api.v1.Cursor
+	35, // 6: authzed.api.v1.ReadRelationshipsRequest.optional_cursor:type_name -> authzed.api.v1.Cursor
+	34, // 7: authzed.api.v1.ReadRelationshipsResponse.read_at:type_name -> authzed.api.v1.ZedToken
+	36, // 8: authzed.api.v1.ReadRelationshipsResponse.relationship:type_name -> authzed.api.v1.Relationship
+	35, // 9: authzed.api.v1.ReadRelationshipsResponse.after_result_cursor:type_name -> authzed.api.v1.Cursor
 	1,  // 10: authzed.api.v1.Precondition.operation:type_name -> authzed.api.v1.Precondition.Operation
 	6,  // 11: authzed.api.v1.Precondition.filter:type_name -> authzed.api.v1.RelationshipFilter
-	33, // 12: authzed.api.v1.WriteRelationshipsRequest.updates:type_name -> authzed.api.v1.RelationshipUpdate
+	37, // 12: authzed.api.v1.WriteRelationshipsRequest.updates:type_name -> authzed.api.v1.RelationshipUpdate
 	10, // 13: authzed.api.v1.WriteRelationshipsRequest.optional_preconditions:type_name -> authzed.api.v1.Precondition
-	30, // 14: authzed.api.v1.WriteRelationshipsResponse.written_at:type_name -> authzed.api.v1.ZedToken
+	34, // 14: authzed.api.v1.WriteRelationshipsResponse.written_at:type_name -> authzed.api.v1.ZedToken
 	6,  // 15: authzed.api.v1.DeleteRelationshipsRequest.relationship_filter:type_name -> authzed.api.v1.RelationshipFilter
 	10, // 16: authzed.api.v1.DeleteRelationshipsRequest.optional_preconditions:type_name -> authzed.api.v1.Precondition
-	30, // 17: authzed.api.v1.DeleteRelationshipsResponse.deleted_at:type_name -> authzed.api.v1.ZedToken
+	34, // 17: authzed.api.v1.DeleteRelationshipsResponse.deleted_at:type_name -> authzed.api.v1.ZedToken
 	2,  // 18: authzed.api.v1.DeleteRelationshipsResponse.deletion_progress:type_name -> authzed.api.v1.DeleteRelationshipsResponse.DeletionProgress
 	5,  // 19: authzed.api.v1.CheckPermissionRequest.consistency:type_name -> authzed.api.v1.Consistency
-	34, // 20: authzed.api.v1.CheckPermissionRequest.resource:type_name -> authzed.api.v1.ObjectReference
-	35, // 21: authzed.api.v1.CheckPermissionRequest.subject:type_name -> authzed.api.v1.SubjectReference
-	36, // 22: authzed.api.v1.CheckPermissionRequest.context:type_name -> google.protobuf.Struct
-	30, // 23: authzed.api.v1.CheckPermissionResponse.checked_at:type_name -> authzed.api.v1.ZedToken
+	38, // 20: authzed.api.v1.CheckPermissionRequest.resource:type_name -> authzed.api.v1.ObjectReference
+	39, // 21: authzed.api.v1.CheckPermissionRequest.subject:type_name -> authzed.api.v1.SubjectReference
+	40, // 22: authzed.api.v1.CheckPermissionRequest.context:type_name -> google.protobuf.Struct
+	34, // 23: authzed.api.v1.CheckPermissionResponse.checked_at:type_name -> authzed.api.v1.ZedToken
 	3,  // 24: authzed.api.v1.CheckPermissionResponse.permissionship:type_name -> authzed.api.v1.CheckPermissionResponse.Permissionship
-	37, // 25: authzed.api.v1.CheckPermissionResponse.partial_caveat_info:type_name -> authzed.api.v1.PartialCaveatInfo
-	38, // 26: authzed.api.v1.CheckPermissionResponse.debug_trace:type_name -> authzed.api.v1.DebugInformation
+	41, // 25: authzed.api.v1.CheckPermissionResponse.partial_caveat_info:type_name -> authzed.api.v1.PartialCaveatInfo
+	42, // 26: authzed.api.v1.CheckPermissionResponse.debug_trace:type_name -> authzed.api.v1.DebugInformation
 	5,  // 27: authzed.api.v1.CheckBulkPermissionsRequest.consistency:type_name -> authzed.api.v1.Consistency
 	18, // 28: authzed.api.v1.CheckBulkPermissionsRequest.items:type_name -> authzed.api.v1.CheckBulkPermissionsRequestItem
-	34, // 29: authzed.api.v1.CheckBulkPermissionsRequestItem.resource:type_name -> authzed.api.v1.ObjectReference
-	35, // 30: authzed.api.v1.CheckBulkPermissionsRequestItem.subject:type_name -> authzed.api.v1.SubjectReference
-	36, // 31: authzed.api.v1.CheckBulkPermissionsRequestItem.context:type_name -> google.protobuf.Struct
-	30, // 32: authzed.api.v1.CheckBulkPermissionsResponse.checked_at:type_name -> authzed.api.v1.ZedToken
+	38, // 29: authzed.api.v1.CheckBulkPermissionsRequestItem.resource:type_name -> authzed.api.v1.ObjectReference
+	39, // 30: authzed.api.v1.CheckBulkPermissionsRequestItem.subject:type_name -> authzed.api.v1.SubjectReference
+	40, // 31: authzed.api.v1.CheckBulkPermissionsRequestItem.context:type_name -> google.protobuf.Struct
+	34, // 32: authzed.api.v1.CheckBulkPermissionsResponse.checked_at:type_name -> authzed.api.v1.ZedToken
 	20, // 33: authzed.api.v1.CheckBulkPermissionsResponse.pairs:type_name -> authzed.api.v1.CheckBulkPermissionsPair
 	18, // 34: authzed.api.v1.CheckBulkPermissionsPair.request:type_name -> authzed.api.v1.CheckBulkPermissionsRequestItem
 	21, // 35: authzed.api.v1.CheckBulkPermissionsPair.item:type_name -> authzed.api.v1.CheckBulkPermissionsResponseItem
-	39, // 36: authzed.api.v1.CheckBulkPermissionsPair.error:type_name -> google.rpc.Status
+	43, // 36: authzed.api.v1.CheckBulkPermissionsPair.error:type_name -> google.rpc.Status
 	3,  // 37: authzed.api.v1.CheckBulkPermissionsResponseItem.permissionship:type_name -> authzed.api.v1.CheckPermissionResponse.Permissionship
-	37, // 38: authzed.api.v1.CheckBulkPermissionsResponseItem.partial_caveat_info:type_name -> authzed.api.v1.PartialCaveatInfo
+	41, // 38: authzed.api.v1.CheckBulkPermissionsResponseItem.partial_caveat_info:type_name -> authzed.api.v1.PartialCaveatInfo
 	5,  // 39: authzed.api.v1.ExpandPermissionTreeRequest.consistency:type_name -> authzed.api.v1.Consistency
-	34, // 40: authzed.api.v1.ExpandPermissionTreeRequest.resource:type_name -> authzed.api.v1.ObjectReference
-	30, // 41: authzed.api.v1.ExpandPermissionTreeResponse.expanded_at:type_name -> authzed.api.v1.ZedToken
-	40, // 42: authzed.api.v1.ExpandPermissionTreeResponse.tree_root:type_name -> authzed.api.v1.PermissionRelationshipTree
+	38, // 40: authzed.api.v1.ExpandPermissionTreeRequest.resource:type_name -> authzed.api.v1.ObjectReference
+	34, // 41: authzed.api.v1.ExpandPermissionTreeResponse.expanded_at:type_name -> authzed.api.v1.ZedToken
+	44, // 42: authzed.api.v1.ExpandPermissionTreeResponse.tree_root:type_name -> authzed.api.v1.PermissionRelationshipTree
 	5,  // 43: authzed.api.v1.LookupResourcesRequest.consistency:type_name -> authzed.api.v1.Consistency
-	35, // 44: authzed.api.v1.LookupResourcesRequest.subject:type_name -> authzed.api.v1.SubjectReference
-	36, // 45: authzed.api.v1.LookupResourcesRequest.context:type_name -> google.protobuf.Struct
-	31, // 46: authzed.api.v1.LookupResourcesRequest.optional_cursor:type_name -> authzed.api.v1.Cursor
-	30, // 47: authzed.api.v1.LookupResourcesResponse.looked_up_at:type_name -> authzed.api.v1.ZedToken
+	39, // 44: authzed.api.v1.LookupResourcesRequest.subject:type_name -> authzed.api.v1.SubjectReference
+	40, // 45: authzed.api.v1.LookupResourcesRequest.context:type_name -> google.protobuf.Struct
+	35, // 46: authzed.api.v1.LookupResourcesRequest.optional_cursor:type_name -> authzed.api.v1.Cursor
+	34, // 47: authzed.api.v1.LookupResourcesResponse.looked_up_at:type_name -> authzed.api.v1.ZedToken
 	0,  // 48: authzed.api.v1.LookupResourcesResponse.permissionship:type_name -> authzed.api.v1.LookupPermissionship
-	37, // 49: authzed.api.v1.LookupResourcesResponse.partial_caveat_info:type_name -> authzed.api.v1.PartialCaveatInfo
-	31, // 50: authzed.api.v1.LookupResourcesResponse.after_result_cursor:type_name -> authzed.api.v1.Cursor
+	41, // 49: authzed.api.v1.LookupResourcesResponse.partial_caveat_info:type_name -> authzed.api.v1.PartialCaveatInfo
+	35, // 50: authzed.api.v1.LookupResourcesResponse.after_result_cursor:type_name -> authzed.api.v1.Cursor
 	5,  // 51: authzed.api.v1.LookupSubjectsRequest.consistency:type_name -> authzed.api.v1.Consistency
-	34, // 52: authzed.api.v1.LookupSubjectsRequest.resource:type_name -> authzed.api.v1.ObjectReference
-	36, // 53: authzed.api.v1.LookupSubjectsRequest.context:type_name -> google.protobuf.Struct
-	31, // 54: authzed.api.v1.LookupSubjectsRequest.optional_cursor:type_name -> authzed.api.v1.Cursor
+	38, // 52: authzed.api.v1.LookupSubjectsRequest.resource:type_name -> authzed.api.v1.ObjectReference
+	40, // 53: authzed.api.v1.LookupSubjectsRequest.context:type_name -> google.protobuf.Struct
+	35, // 54: authzed.api.v1.LookupSubjectsRequest.optional_cursor:type_name -> authzed.api.v1.Cursor
 	4,  // 55: authzed.api.v1.LookupSubjectsRequest.wildcard_option:type_name -> authzed.api.v1.LookupSubjectsRequest.WildcardOption
-	30, // 56: authzed.api.v1.LookupSubjectsResponse.looked_up_at:type_name -> authzed.api.v1.ZedToken
+	34, // 56: authzed.api.v1.LookupSubjectsResponse.looked_up_at:type_name -> authzed.api.v1.ZedToken
 	0,  // 57: authzed.api.v1.LookupSubjectsResponse.permissionship:type_name -> authzed.api.v1.LookupPermissionship
-	37, // 58: authzed.api.v1.LookupSubjectsResponse.partial_caveat_info:type_name -> authzed.api.v1.PartialCaveatInfo
+	41, // 58: authzed.api.v1.LookupSubjectsResponse.partial_caveat_info:type_name -> authzed.api.v1.PartialCaveatInfo
 	28, // 59: authzed.api.v1.LookupSubjectsResponse.subject:type_name -> authzed.api.v1.ResolvedSubject
 	28, // 60: authzed.api.v1.LookupSubjectsResponse.excluded_subjects:type_name -> authzed.api.v1.ResolvedSubject
-	31, // 61: authzed.api.v1.LookupSubjectsResponse.after_result_cursor:type_name -> authzed.api.v1.Cursor
+	35, // 61: authzed.api.v1.LookupSubjectsResponse.after_result_cursor:type_name -> authzed.api.v1.Cursor
 	0,  // 62: authzed.api.v1.ResolvedSubject.permissionship:type_name -> authzed.api.v1.LookupPermissionship
-	37, // 63: authzed.api.v1.ResolvedSubject.partial_caveat_info:type_name -> authzed.api.v1.PartialCaveatInfo
-	8,  // 64: authzed.api.v1.PermissionsService.ReadRelationships:input_type -> authzed.api.v1.ReadRelationshipsRequest
-	11, // 65: authzed.api.v1.PermissionsService.WriteRelationships:input_type -> authzed.api.v1.WriteRelationshipsRequest
-	13, // 66: authzed.api.v1.PermissionsService.DeleteRelationships:input_type -> authzed.api.v1.DeleteRelationshipsRequest
-	15, // 67: authzed.api.v1.PermissionsService.CheckPermission:input_type -> authzed.api.v1.CheckPermissionRequest
-	17, // 68: authzed.api.v1.PermissionsService.CheckBulkPermissions:input_type -> authzed.api.v1.CheckBulkPermissionsRequest
-	22, // 69: authzed.api.v1.PermissionsService.ExpandPermissionTree:input_type -> authzed.api.v1.ExpandPermissionTreeRequest
-	24, // 70: authzed.api.v1.PermissionsService.LookupResources:input_type -> authzed.api.v1.LookupResourcesRequest
-	26, // 71: authzed.api.v1.PermissionsService.LookupSubjects:input_type -> authzed.api.v1.LookupSubjectsRequest
-	9,  // 72: authzed.api.v1.PermissionsService.ReadRelationships:output_type -> authzed.api.v1.ReadRelationshipsResponse
-	12, // 73: authzed.api.v1.PermissionsService.WriteRelationships:output_type -> authzed.api.v1.WriteRelationshipsResponse
-	14, // 74: authzed.api.v1.PermissionsService.DeleteRelationships:output_type -> authzed.api.v1.DeleteRelationshipsResponse
-	16, // 75: authzed.api.v1.PermissionsService.CheckPermission:output_type -> authzed.api.v1.CheckPermissionResponse
-	19, // 76: authzed.api.v1.PermissionsService.CheckBulkPermissions:output_type -> authzed.api.v1.CheckBulkPermissionsResponse
-	23, // 77: authzed.api.v1.PermissionsService.ExpandPermissionTree:output_type -> authzed.api.v1.ExpandPermissionTreeResponse
-	25, // 78: authzed.api.v1.PermissionsService.LookupResources:output_type -> authzed.api.v1.LookupResourcesResponse
-	27, // 79: authzed.api.v1.PermissionsService.LookupSubjects:output_type -> authzed.api.v1.LookupSubjectsResponse
-	72, // [72:80] is the sub-list for method output_type
-	64, // [64:72] is the sub-list for method input_type
-	64, // [64:64] is the sub-list for extension type_name
-	64, // [64:64] is the sub-list for extension extendee
-	0,  // [0:64] is the sub-list for field type_name
+	41, // 63: authzed.api.v1.ResolvedSubject.partial_caveat_info:type_name -> authzed.api.v1.PartialCaveatInfo
+	36, // 64: authzed.api.v1.ImportBulkRelationshipsRequest.relationships:type_name -> authzed.api.v1.Relationship
+	5,  // 65: authzed.api.v1.ExportBulkRelationshipsRequest.consistency:type_name -> authzed.api.v1.Consistency
+	35, // 66: authzed.api.v1.ExportBulkRelationshipsRequest.optional_cursor:type_name -> authzed.api.v1.Cursor
+	6,  // 67: authzed.api.v1.ExportBulkRelationshipsRequest.optional_relationship_filter:type_name -> authzed.api.v1.RelationshipFilter
+	35, // 68: authzed.api.v1.ExportBulkRelationshipsResponse.after_result_cursor:type_name -> authzed.api.v1.Cursor
+	36, // 69: authzed.api.v1.ExportBulkRelationshipsResponse.relationships:type_name -> authzed.api.v1.Relationship
+	8,  // 70: authzed.api.v1.PermissionsService.ReadRelationships:input_type -> authzed.api.v1.ReadRelationshipsRequest
+	11, // 71: authzed.api.v1.PermissionsService.WriteRelationships:input_type -> authzed.api.v1.WriteRelationshipsRequest
+	13, // 72: authzed.api.v1.PermissionsService.DeleteRelationships:input_type -> authzed.api.v1.DeleteRelationshipsRequest
+	15, // 73: authzed.api.v1.PermissionsService.CheckPermission:input_type -> authzed.api.v1.CheckPermissionRequest
+	17, // 74: authzed.api.v1.PermissionsService.CheckBulkPermissions:input_type -> authzed.api.v1.CheckBulkPermissionsRequest
+	22, // 75: authzed.api.v1.PermissionsService.ExpandPermissionTree:input_type -> authzed.api.v1.ExpandPermissionTreeRequest
+	24, // 76: authzed.api.v1.PermissionsService.LookupResources:input_type -> authzed.api.v1.LookupResourcesRequest
+	26, // 77: authzed.api.v1.PermissionsService.LookupSubjects:input_type -> authzed.api.v1.LookupSubjectsRequest
+	29, // 78: authzed.api.v1.PermissionsService.ImportBulkRelationships:input_type -> authzed.api.v1.ImportBulkRelationshipsRequest
+	31, // 79: authzed.api.v1.PermissionsService.ExportBulkRelationships:input_type -> authzed.api.v1.ExportBulkRelationshipsRequest
+	9,  // 80: authzed.api.v1.PermissionsService.ReadRelationships:output_type -> authzed.api.v1.ReadRelationshipsResponse
+	12, // 81: authzed.api.v1.PermissionsService.WriteRelationships:output_type -> authzed.api.v1.WriteRelationshipsResponse
+	14, // 82: authzed.api.v1.PermissionsService.DeleteRelationships:output_type -> authzed.api.v1.DeleteRelationshipsResponse
+	16, // 83: authzed.api.v1.PermissionsService.CheckPermission:output_type -> authzed.api.v1.CheckPermissionResponse
+	19, // 84: authzed.api.v1.PermissionsService.CheckBulkPermissions:output_type -> authzed.api.v1.CheckBulkPermissionsResponse
+	23, // 85: authzed.api.v1.PermissionsService.ExpandPermissionTree:output_type -> authzed.api.v1.ExpandPermissionTreeResponse
+	25, // 86: authzed.api.v1.PermissionsService.LookupResources:output_type -> authzed.api.v1.LookupResourcesResponse
+	27, // 87: authzed.api.v1.PermissionsService.LookupSubjects:output_type -> authzed.api.v1.LookupSubjectsResponse
+	30, // 88: authzed.api.v1.PermissionsService.ImportBulkRelationships:output_type -> authzed.api.v1.ImportBulkRelationshipsResponse
+	32, // 89: authzed.api.v1.PermissionsService.ExportBulkRelationships:output_type -> authzed.api.v1.ExportBulkRelationshipsResponse
+	80, // [80:90] is the sub-list for method output_type
+	70, // [70:80] is the sub-list for method input_type
+	70, // [70:70] is the sub-list for extension type_name
+	70, // [70:70] is the sub-list for extension extendee
+	0,  // [0:70] is the sub-list for field type_name
 }
 
 func init() { file_authzed_api_v1_permission_service_proto_init() }
@@ -3315,6 +3634,54 @@ func file_authzed_api_v1_permission_service_proto_init() {
 			}
 		}
 		file_authzed_api_v1_permission_service_proto_msgTypes[24].Exporter = func(v any, i int) any {
+			switch v := v.(*ImportBulkRelationshipsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_authzed_api_v1_permission_service_proto_msgTypes[25].Exporter = func(v any, i int) any {
+			switch v := v.(*ImportBulkRelationshipsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_authzed_api_v1_permission_service_proto_msgTypes[26].Exporter = func(v any, i int) any {
+			switch v := v.(*ExportBulkRelationshipsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_authzed_api_v1_permission_service_proto_msgTypes[27].Exporter = func(v any, i int) any {
+			switch v := v.(*ExportBulkRelationshipsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_authzed_api_v1_permission_service_proto_msgTypes[28].Exporter = func(v any, i int) any {
 			switch v := v.(*SubjectFilter_RelationFilter); i {
 			case 0:
 				return &v.state
@@ -3343,7 +3710,7 @@ func file_authzed_api_v1_permission_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_authzed_api_v1_permission_service_proto_rawDesc,
 			NumEnums:      5,
-			NumMessages:   25,
+			NumMessages:   29,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/proto/authzed/api/v1/permission_service.pb.gw.go b/proto/authzed/api/v1/permission_service.pb.gw.go
index d488578..c2cf3ce 100644
--- a/proto/authzed/api/v1/permission_service.pb.gw.go
+++ b/proto/authzed/api/v1/permission_service.pb.gw.go
@@ -224,6 +224,71 @@ func request_PermissionsService_LookupSubjects_0(ctx context.Context, marshaler
 
 }
 
+func request_PermissionsService_ImportBulkRelationships_0(ctx context.Context, marshaler runtime.Marshaler, client PermissionsServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var metadata runtime.ServerMetadata
+	stream, err := client.ImportBulkRelationships(ctx)
+	if err != nil {
+		grpclog.Errorf("Failed to start streaming: %v", err)
+		return nil, metadata, err
+	}
+	dec := marshaler.NewDecoder(req.Body)
+	for {
+		var protoReq ImportBulkRelationshipsRequest
+		err = dec.Decode(&protoReq)
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			grpclog.Errorf("Failed to decode request: %v", err)
+			return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+		}
+		if err = stream.Send(&protoReq); err != nil {
+			if err == io.EOF {
+				break
+			}
+			grpclog.Errorf("Failed to send request: %v", err)
+			return nil, metadata, err
+		}
+	}
+
+	if err := stream.CloseSend(); err != nil {
+		grpclog.Errorf("Failed to terminate client stream: %v", err)
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		grpclog.Errorf("Failed to get header from client: %v", err)
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+
+	msg, err := stream.CloseAndRecv()
+	metadata.TrailerMD = stream.Trailer()
+	return msg, metadata, err
+
+}
+
+func request_PermissionsService_ExportBulkRelationships_0(ctx context.Context, marshaler runtime.Marshaler, client PermissionsServiceClient, req *http.Request, pathParams map[string]string) (PermissionsService_ExportBulkRelationshipsClient, runtime.ServerMetadata, error) {
+	var protoReq ExportBulkRelationshipsRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	stream, err := client.ExportBulkRelationships(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+
+}
+
 // RegisterPermissionsServiceHandlerServer registers the http handlers for service PermissionsService to "mux".
 // UnaryRPC     :call PermissionsServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
@@ -377,6 +442,20 @@ func RegisterPermissionsServiceHandlerServer(ctx context.Context, mux *runtime.S
 		return
 	})
 
+	mux.Handle("POST", pattern_PermissionsService_ImportBulkRelationships_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	mux.Handle("POST", pattern_PermissionsService_ExportBulkRelationships_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
 	return nil
 }
 
@@ -594,6 +673,50 @@ func RegisterPermissionsServiceHandlerClient(ctx context.Context, mux *runtime.S
 
 	})
 
+	mux.Handle("POST", pattern_PermissionsService_ImportBulkRelationships_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/authzed.api.v1.PermissionsService/ImportBulkRelationships", runtime.WithHTTPPathPattern("/v1/experimental/relationships/bulkimport"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_PermissionsService_ImportBulkRelationships_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_PermissionsService_ImportBulkRelationships_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_PermissionsService_ExportBulkRelationships_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/authzed.api.v1.PermissionsService/ExportBulkRelationships", runtime.WithHTTPPathPattern("/v1/experimental/relationships/bulkexport"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_PermissionsService_ExportBulkRelationships_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_PermissionsService_ExportBulkRelationships_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+
+	})
+
 	return nil
 }
 
@@ -613,6 +736,10 @@ var (
 	pattern_PermissionsService_LookupResources_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "permissions", "resources"}, ""))
 
 	pattern_PermissionsService_LookupSubjects_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "permissions", "subjects"}, ""))
+
+	pattern_PermissionsService_ImportBulkRelationships_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "experimental", "relationships", "bulkimport"}, ""))
+
+	pattern_PermissionsService_ExportBulkRelationships_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "experimental", "relationships", "bulkexport"}, ""))
 )
 
 var (
@@ -631,4 +758,8 @@ var (
 	forward_PermissionsService_LookupResources_0 = runtime.ForwardResponseStream
 
 	forward_PermissionsService_LookupSubjects_0 = runtime.ForwardResponseStream
+
+	forward_PermissionsService_ImportBulkRelationships_0 = runtime.ForwardResponseMessage
+
+	forward_PermissionsService_ExportBulkRelationships_0 = runtime.ForwardResponseStream
 )
diff --git a/proto/authzed/api/v1/permission_service.pb.validate.go b/proto/authzed/api/v1/permission_service.pb.validate.go
index ca31547..6b10dc5 100644
--- a/proto/authzed/api/v1/permission_service.pb.validate.go
+++ b/proto/authzed/api/v1/permission_service.pb.validate.go
@@ -4992,6 +4992,626 @@ var _ResolvedSubject_Permissionship_NotInLookup = map[LookupPermissionship]struc
 	0: {},
 }
 
+// Validate checks the field values on ImportBulkRelationshipsRequest with the
+// rules defined in the proto definition for this message. If any rules are
+// violated, the first error encountered is returned, or nil if there are no violations.
+func (m *ImportBulkRelationshipsRequest) Validate() error {
+	return m.validate(false)
+}
+
+// ValidateAll checks the field values on ImportBulkRelationshipsRequest with
+// the rules defined in the proto definition for this message. If any rules
+// are violated, the result is a list of violation errors wrapped in
+// ImportBulkRelationshipsRequestMultiError, or nil if none found.
+func (m *ImportBulkRelationshipsRequest) ValidateAll() error {
+	return m.validate(true)
+}
+
+func (m *ImportBulkRelationshipsRequest) validate(all bool) error {
+	if m == nil {
+		return nil
+	}
+
+	var errors []error
+
+	for idx, item := range m.GetRelationships() {
+		_, _ = idx, item
+
+		if item == nil {
+			err := ImportBulkRelationshipsRequestValidationError{
+				field:  fmt.Sprintf("Relationships[%v]", idx),
+				reason: "value is required",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
+
+		if all {
+			switch v := interface{}(item).(type) {
+			case interface{ ValidateAll() error }:
+				if err := v.ValidateAll(); err != nil {
+					errors = append(errors, ImportBulkRelationshipsRequestValidationError{
+						field:  fmt.Sprintf("Relationships[%v]", idx),
+						reason: "embedded message failed validation",
+						cause:  err,
+					})
+				}
+			case interface{ Validate() error }:
+				if err := v.Validate(); err != nil {
+					errors = append(errors, ImportBulkRelationshipsRequestValidationError{
+						field:  fmt.Sprintf("Relationships[%v]", idx),
+						reason: "embedded message failed validation",
+						cause:  err,
+					})
+				}
+			}
+		} else if v, ok := interface{}(item).(interface{ Validate() error }); ok {
+			if err := v.Validate(); err != nil {
+				return ImportBulkRelationshipsRequestValidationError{
+					field:  fmt.Sprintf("Relationships[%v]", idx),
+					reason: "embedded message failed validation",
+					cause:  err,
+				}
+			}
+		}
+
+	}
+
+	if len(errors) > 0 {
+		return ImportBulkRelationshipsRequestMultiError(errors)
+	}
+
+	return nil
+}
+
+// ImportBulkRelationshipsRequestMultiError is an error wrapping multiple
+// validation errors returned by ImportBulkRelationshipsRequest.ValidateAll()
+// if the designated constraints aren't met.
+type ImportBulkRelationshipsRequestMultiError []error
+
+// Error returns a concatenation of all the error messages it wraps.
+func (m ImportBulkRelationshipsRequestMultiError) Error() string {
+	var msgs []string
+	for _, err := range m {
+		msgs = append(msgs, err.Error())
+	}
+	return strings.Join(msgs, "; ")
+}
+
+// AllErrors returns a list of validation violation errors.
+func (m ImportBulkRelationshipsRequestMultiError) AllErrors() []error { return m }
+
+// ImportBulkRelationshipsRequestValidationError is the validation error
+// returned by ImportBulkRelationshipsRequest.Validate if the designated
+// constraints aren't met.
+type ImportBulkRelationshipsRequestValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e ImportBulkRelationshipsRequestValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e ImportBulkRelationshipsRequestValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e ImportBulkRelationshipsRequestValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e ImportBulkRelationshipsRequestValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e ImportBulkRelationshipsRequestValidationError) ErrorName() string {
+	return "ImportBulkRelationshipsRequestValidationError"
+}
+
+// Error satisfies the builtin error interface
+func (e ImportBulkRelationshipsRequestValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sImportBulkRelationshipsRequest.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = ImportBulkRelationshipsRequestValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = ImportBulkRelationshipsRequestValidationError{}
+
+// Validate checks the field values on ImportBulkRelationshipsResponse with the
+// rules defined in the proto definition for this message. If any rules are
+// violated, the first error encountered is returned, or nil if there are no violations.
+func (m *ImportBulkRelationshipsResponse) Validate() error {
+	return m.validate(false)
+}
+
+// ValidateAll checks the field values on ImportBulkRelationshipsResponse with
+// the rules defined in the proto definition for this message. If any rules
+// are violated, the result is a list of violation errors wrapped in
+// ImportBulkRelationshipsResponseMultiError, or nil if none found.
+func (m *ImportBulkRelationshipsResponse) ValidateAll() error {
+	return m.validate(true)
+}
+
+func (m *ImportBulkRelationshipsResponse) validate(all bool) error {
+	if m == nil {
+		return nil
+	}
+
+	var errors []error
+
+	// no validation rules for NumLoaded
+
+	if len(errors) > 0 {
+		return ImportBulkRelationshipsResponseMultiError(errors)
+	}
+
+	return nil
+}
+
+// ImportBulkRelationshipsResponseMultiError is an error wrapping multiple
+// validation errors returned by ImportBulkRelationshipsResponse.ValidateAll()
+// if the designated constraints aren't met.
+type ImportBulkRelationshipsResponseMultiError []error
+
+// Error returns a concatenation of all the error messages it wraps.
+func (m ImportBulkRelationshipsResponseMultiError) Error() string {
+	var msgs []string
+	for _, err := range m {
+		msgs = append(msgs, err.Error())
+	}
+	return strings.Join(msgs, "; ")
+}
+
+// AllErrors returns a list of validation violation errors.
+func (m ImportBulkRelationshipsResponseMultiError) AllErrors() []error { return m }
+
+// ImportBulkRelationshipsResponseValidationError is the validation error
+// returned by ImportBulkRelationshipsResponse.Validate if the designated
+// constraints aren't met.
+type ImportBulkRelationshipsResponseValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e ImportBulkRelationshipsResponseValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e ImportBulkRelationshipsResponseValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e ImportBulkRelationshipsResponseValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e ImportBulkRelationshipsResponseValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e ImportBulkRelationshipsResponseValidationError) ErrorName() string {
+	return "ImportBulkRelationshipsResponseValidationError"
+}
+
+// Error satisfies the builtin error interface
+func (e ImportBulkRelationshipsResponseValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sImportBulkRelationshipsResponse.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = ImportBulkRelationshipsResponseValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = ImportBulkRelationshipsResponseValidationError{}
+
+// Validate checks the field values on ExportBulkRelationshipsRequest with the
+// rules defined in the proto definition for this message. If any rules are
+// violated, the first error encountered is returned, or nil if there are no violations.
+func (m *ExportBulkRelationshipsRequest) Validate() error {
+	return m.validate(false)
+}
+
+// ValidateAll checks the field values on ExportBulkRelationshipsRequest with
+// the rules defined in the proto definition for this message. If any rules
+// are violated, the result is a list of violation errors wrapped in
+// ExportBulkRelationshipsRequestMultiError, or nil if none found.
+func (m *ExportBulkRelationshipsRequest) ValidateAll() error {
+	return m.validate(true)
+}
+
+func (m *ExportBulkRelationshipsRequest) validate(all bool) error {
+	if m == nil {
+		return nil
+	}
+
+	var errors []error
+
+	if all {
+		switch v := interface{}(m.GetConsistency()).(type) {
+		case interface{ ValidateAll() error }:
+			if err := v.ValidateAll(); err != nil {
+				errors = append(errors, ExportBulkRelationshipsRequestValidationError{
+					field:  "Consistency",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		case interface{ Validate() error }:
+			if err := v.Validate(); err != nil {
+				errors = append(errors, ExportBulkRelationshipsRequestValidationError{
+					field:  "Consistency",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		}
+	} else if v, ok := interface{}(m.GetConsistency()).(interface{ Validate() error }); ok {
+		if err := v.Validate(); err != nil {
+			return ExportBulkRelationshipsRequestValidationError{
+				field:  "Consistency",
+				reason: "embedded message failed validation",
+				cause:  err,
+			}
+		}
+	}
+
+	if m.GetOptionalLimit() < 0 {
+		err := ExportBulkRelationshipsRequestValidationError{
+			field:  "OptionalLimit",
+			reason: "value must be greater than or equal to 0",
+		}
+		if !all {
+			return err
+		}
+		errors = append(errors, err)
+	}
+
+	if all {
+		switch v := interface{}(m.GetOptionalCursor()).(type) {
+		case interface{ ValidateAll() error }:
+			if err := v.ValidateAll(); err != nil {
+				errors = append(errors, ExportBulkRelationshipsRequestValidationError{
+					field:  "OptionalCursor",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		case interface{ Validate() error }:
+			if err := v.Validate(); err != nil {
+				errors = append(errors, ExportBulkRelationshipsRequestValidationError{
+					field:  "OptionalCursor",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		}
+	} else if v, ok := interface{}(m.GetOptionalCursor()).(interface{ Validate() error }); ok {
+		if err := v.Validate(); err != nil {
+			return ExportBulkRelationshipsRequestValidationError{
+				field:  "OptionalCursor",
+				reason: "embedded message failed validation",
+				cause:  err,
+			}
+		}
+	}
+
+	if all {
+		switch v := interface{}(m.GetOptionalRelationshipFilter()).(type) {
+		case interface{ ValidateAll() error }:
+			if err := v.ValidateAll(); err != nil {
+				errors = append(errors, ExportBulkRelationshipsRequestValidationError{
+					field:  "OptionalRelationshipFilter",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		case interface{ Validate() error }:
+			if err := v.Validate(); err != nil {
+				errors = append(errors, ExportBulkRelationshipsRequestValidationError{
+					field:  "OptionalRelationshipFilter",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		}
+	} else if v, ok := interface{}(m.GetOptionalRelationshipFilter()).(interface{ Validate() error }); ok {
+		if err := v.Validate(); err != nil {
+			return ExportBulkRelationshipsRequestValidationError{
+				field:  "OptionalRelationshipFilter",
+				reason: "embedded message failed validation",
+				cause:  err,
+			}
+		}
+	}
+
+	if len(errors) > 0 {
+		return ExportBulkRelationshipsRequestMultiError(errors)
+	}
+
+	return nil
+}
+
+// ExportBulkRelationshipsRequestMultiError is an error wrapping multiple
+// validation errors returned by ExportBulkRelationshipsRequest.ValidateAll()
+// if the designated constraints aren't met.
+type ExportBulkRelationshipsRequestMultiError []error
+
+// Error returns a concatenation of all the error messages it wraps.
+func (m ExportBulkRelationshipsRequestMultiError) Error() string {
+	var msgs []string
+	for _, err := range m {
+		msgs = append(msgs, err.Error())
+	}
+	return strings.Join(msgs, "; ")
+}
+
+// AllErrors returns a list of validation violation errors.
+func (m ExportBulkRelationshipsRequestMultiError) AllErrors() []error { return m }
+
+// ExportBulkRelationshipsRequestValidationError is the validation error
+// returned by ExportBulkRelationshipsRequest.Validate if the designated
+// constraints aren't met.
+type ExportBulkRelationshipsRequestValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e ExportBulkRelationshipsRequestValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e ExportBulkRelationshipsRequestValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e ExportBulkRelationshipsRequestValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e ExportBulkRelationshipsRequestValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e ExportBulkRelationshipsRequestValidationError) ErrorName() string {
+	return "ExportBulkRelationshipsRequestValidationError"
+}
+
+// Error satisfies the builtin error interface
+func (e ExportBulkRelationshipsRequestValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sExportBulkRelationshipsRequest.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = ExportBulkRelationshipsRequestValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = ExportBulkRelationshipsRequestValidationError{}
+
+// Validate checks the field values on ExportBulkRelationshipsResponse with the
+// rules defined in the proto definition for this message. If any rules are
+// violated, the first error encountered is returned, or nil if there are no violations.
+func (m *ExportBulkRelationshipsResponse) Validate() error {
+	return m.validate(false)
+}
+
+// ValidateAll checks the field values on ExportBulkRelationshipsResponse with
+// the rules defined in the proto definition for this message. If any rules
+// are violated, the result is a list of violation errors wrapped in
+// ExportBulkRelationshipsResponseMultiError, or nil if none found.
+func (m *ExportBulkRelationshipsResponse) ValidateAll() error {
+	return m.validate(true)
+}
+
+func (m *ExportBulkRelationshipsResponse) validate(all bool) error {
+	if m == nil {
+		return nil
+	}
+
+	var errors []error
+
+	if all {
+		switch v := interface{}(m.GetAfterResultCursor()).(type) {
+		case interface{ ValidateAll() error }:
+			if err := v.ValidateAll(); err != nil {
+				errors = append(errors, ExportBulkRelationshipsResponseValidationError{
+					field:  "AfterResultCursor",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		case interface{ Validate() error }:
+			if err := v.Validate(); err != nil {
+				errors = append(errors, ExportBulkRelationshipsResponseValidationError{
+					field:  "AfterResultCursor",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		}
+	} else if v, ok := interface{}(m.GetAfterResultCursor()).(interface{ Validate() error }); ok {
+		if err := v.Validate(); err != nil {
+			return ExportBulkRelationshipsResponseValidationError{
+				field:  "AfterResultCursor",
+				reason: "embedded message failed validation",
+				cause:  err,
+			}
+		}
+	}
+
+	for idx, item := range m.GetRelationships() {
+		_, _ = idx, item
+
+		if all {
+			switch v := interface{}(item).(type) {
+			case interface{ ValidateAll() error }:
+				if err := v.ValidateAll(); err != nil {
+					errors = append(errors, ExportBulkRelationshipsResponseValidationError{
+						field:  fmt.Sprintf("Relationships[%v]", idx),
+						reason: "embedded message failed validation",
+						cause:  err,
+					})
+				}
+			case interface{ Validate() error }:
+				if err := v.Validate(); err != nil {
+					errors = append(errors, ExportBulkRelationshipsResponseValidationError{
+						field:  fmt.Sprintf("Relationships[%v]", idx),
+						reason: "embedded message failed validation",
+						cause:  err,
+					})
+				}
+			}
+		} else if v, ok := interface{}(item).(interface{ Validate() error }); ok {
+			if err := v.Validate(); err != nil {
+				return ExportBulkRelationshipsResponseValidationError{
+					field:  fmt.Sprintf("Relationships[%v]", idx),
+					reason: "embedded message failed validation",
+					cause:  err,
+				}
+			}
+		}
+
+	}
+
+	if len(errors) > 0 {
+		return ExportBulkRelationshipsResponseMultiError(errors)
+	}
+
+	return nil
+}
+
+// ExportBulkRelationshipsResponseMultiError is an error wrapping multiple
+// validation errors returned by ExportBulkRelationshipsResponse.ValidateAll()
+// if the designated constraints aren't met.
+type ExportBulkRelationshipsResponseMultiError []error
+
+// Error returns a concatenation of all the error messages it wraps.
+func (m ExportBulkRelationshipsResponseMultiError) Error() string {
+	var msgs []string
+	for _, err := range m {
+		msgs = append(msgs, err.Error())
+	}
+	return strings.Join(msgs, "; ")
+}
+
+// AllErrors returns a list of validation violation errors.
+func (m ExportBulkRelationshipsResponseMultiError) AllErrors() []error { return m }
+
+// ExportBulkRelationshipsResponseValidationError is the validation error
+// returned by ExportBulkRelationshipsResponse.Validate if the designated
+// constraints aren't met.
+type ExportBulkRelationshipsResponseValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e ExportBulkRelationshipsResponseValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e ExportBulkRelationshipsResponseValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e ExportBulkRelationshipsResponseValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e ExportBulkRelationshipsResponseValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e ExportBulkRelationshipsResponseValidationError) ErrorName() string {
+	return "ExportBulkRelationshipsResponseValidationError"
+}
+
+// Error satisfies the builtin error interface
+func (e ExportBulkRelationshipsResponseValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sExportBulkRelationshipsResponse.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = ExportBulkRelationshipsResponseValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = ExportBulkRelationshipsResponseValidationError{}
+
 // Validate checks the field values on SubjectFilter_RelationFilter with the
 // rules defined in the proto definition for this message. If any rules are
 // violated, the first error encountered is returned, or nil if there are no violations.
diff --git a/proto/authzed/api/v1/permission_service_grpc.pb.go b/proto/authzed/api/v1/permission_service_grpc.pb.go
index 48ef669..f66babf 100644
--- a/proto/authzed/api/v1/permission_service_grpc.pb.go
+++ b/proto/authzed/api/v1/permission_service_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: authzed/api/v1/permission_service.proto
 
@@ -15,18 +15,20 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
-	PermissionsService_ReadRelationships_FullMethodName    = "/authzed.api.v1.PermissionsService/ReadRelationships"
-	PermissionsService_WriteRelationships_FullMethodName   = "/authzed.api.v1.PermissionsService/WriteRelationships"
-	PermissionsService_DeleteRelationships_FullMethodName  = "/authzed.api.v1.PermissionsService/DeleteRelationships"
-	PermissionsService_CheckPermission_FullMethodName      = "/authzed.api.v1.PermissionsService/CheckPermission"
-	PermissionsService_CheckBulkPermissions_FullMethodName = "/authzed.api.v1.PermissionsService/CheckBulkPermissions"
-	PermissionsService_ExpandPermissionTree_FullMethodName = "/authzed.api.v1.PermissionsService/ExpandPermissionTree"
-	PermissionsService_LookupResources_FullMethodName      = "/authzed.api.v1.PermissionsService/LookupResources"
-	PermissionsService_LookupSubjects_FullMethodName       = "/authzed.api.v1.PermissionsService/LookupSubjects"
+	PermissionsService_ReadRelationships_FullMethodName       = "/authzed.api.v1.PermissionsService/ReadRelationships"
+	PermissionsService_WriteRelationships_FullMethodName      = "/authzed.api.v1.PermissionsService/WriteRelationships"
+	PermissionsService_DeleteRelationships_FullMethodName     = "/authzed.api.v1.PermissionsService/DeleteRelationships"
+	PermissionsService_CheckPermission_FullMethodName         = "/authzed.api.v1.PermissionsService/CheckPermission"
+	PermissionsService_CheckBulkPermissions_FullMethodName    = "/authzed.api.v1.PermissionsService/CheckBulkPermissions"
+	PermissionsService_ExpandPermissionTree_FullMethodName    = "/authzed.api.v1.PermissionsService/ExpandPermissionTree"
+	PermissionsService_LookupResources_FullMethodName         = "/authzed.api.v1.PermissionsService/LookupResources"
+	PermissionsService_LookupSubjects_FullMethodName          = "/authzed.api.v1.PermissionsService/LookupSubjects"
+	PermissionsService_ImportBulkRelationships_FullMethodName = "/authzed.api.v1.PermissionsService/ImportBulkRelationships"
+	PermissionsService_ExportBulkRelationships_FullMethodName = "/authzed.api.v1.PermissionsService/ExportBulkRelationships"
 )
 
 // PermissionsServiceClient is the client API for PermissionsService service.
@@ -38,7 +40,7 @@ const (
 type PermissionsServiceClient interface {
 	// ReadRelationships reads a set of the relationships matching one or more
 	// filters.
-	ReadRelationships(ctx context.Context, in *ReadRelationshipsRequest, opts ...grpc.CallOption) (PermissionsService_ReadRelationshipsClient, error)
+	ReadRelationships(ctx context.Context, in *ReadRelationshipsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ReadRelationshipsResponse], error)
 	// WriteRelationships atomically writes and/or deletes a set of specified
 	// relationships. An optional set of preconditions can be provided that must
 	// be satisfied for the operation to commit.
@@ -60,10 +62,21 @@ type PermissionsServiceClient interface {
 	ExpandPermissionTree(ctx context.Context, in *ExpandPermissionTreeRequest, opts ...grpc.CallOption) (*ExpandPermissionTreeResponse, error)
 	// LookupResources returns all the resources of a given type that a subject
 	// can access whether via a computed permission or relation membership.
-	LookupResources(ctx context.Context, in *LookupResourcesRequest, opts ...grpc.CallOption) (PermissionsService_LookupResourcesClient, error)
+	LookupResources(ctx context.Context, in *LookupResourcesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[LookupResourcesResponse], error)
 	// LookupSubjects returns all the subjects of a given type that
 	// have access whether via a computed permission or relation membership.
-	LookupSubjects(ctx context.Context, in *LookupSubjectsRequest, opts ...grpc.CallOption) (PermissionsService_LookupSubjectsClient, error)
+	LookupSubjects(ctx context.Context, in *LookupSubjectsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[LookupSubjectsResponse], error)
+	// ImportBulkRelationships is a faster path to writing a large number of
+	// relationships at once. It is both batched and streaming. For maximum
+	// performance, the caller should attempt to write relationships in as close
+	// to relationship sort order as possible: (resource.object_type,
+	// resource.object_id, relation, subject.object.object_type,
+	// subject.object.object_id, subject.optional_relation)
+	ImportBulkRelationships(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[ImportBulkRelationshipsRequest, ImportBulkRelationshipsResponse], error)
+	// ExportBulkRelationships is the fastest path available to exporting
+	// relationships from the server. It is resumable, and will return results
+	// in an order determined by the server.
+	ExportBulkRelationships(ctx context.Context, in *ExportBulkRelationshipsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ExportBulkRelationshipsResponse], error)
 }
 
 type permissionsServiceClient struct {
@@ -74,13 +87,13 @@ func NewPermissionsServiceClient(cc grpc.ClientConnInterface) PermissionsService
 	return &permissionsServiceClient{cc}
 }
 
-func (c *permissionsServiceClient) ReadRelationships(ctx context.Context, in *ReadRelationshipsRequest, opts ...grpc.CallOption) (PermissionsService_ReadRelationshipsClient, error) {
+func (c *permissionsServiceClient) ReadRelationships(ctx context.Context, in *ReadRelationshipsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ReadRelationshipsResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &PermissionsService_ServiceDesc.Streams[0], PermissionsService_ReadRelationships_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &permissionsServiceReadRelationshipsClient{ClientStream: stream}
+	x := &grpc.GenericClientStream[ReadRelationshipsRequest, ReadRelationshipsResponse]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -90,22 +103,8 @@ func (c *permissionsServiceClient) ReadRelationships(ctx context.Context, in *Re
 	return x, nil
 }
 
-type PermissionsService_ReadRelationshipsClient interface {
-	Recv() (*ReadRelationshipsResponse, error)
-	grpc.ClientStream
-}
-
-type permissionsServiceReadRelationshipsClient struct {
-	grpc.ClientStream
-}
-
-func (x *permissionsServiceReadRelationshipsClient) Recv() (*ReadRelationshipsResponse, error) {
-	m := new(ReadRelationshipsResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type PermissionsService_ReadRelationshipsClient = grpc.ServerStreamingClient[ReadRelationshipsResponse]
 
 func (c *permissionsServiceClient) WriteRelationships(ctx context.Context, in *WriteRelationshipsRequest, opts ...grpc.CallOption) (*WriteRelationshipsResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
@@ -157,13 +156,13 @@ func (c *permissionsServiceClient) ExpandPermissionTree(ctx context.Context, in
 	return out, nil
 }
 
-func (c *permissionsServiceClient) LookupResources(ctx context.Context, in *LookupResourcesRequest, opts ...grpc.CallOption) (PermissionsService_LookupResourcesClient, error) {
+func (c *permissionsServiceClient) LookupResources(ctx context.Context, in *LookupResourcesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[LookupResourcesResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &PermissionsService_ServiceDesc.Streams[1], PermissionsService_LookupResources_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &permissionsServiceLookupResourcesClient{ClientStream: stream}
+	x := &grpc.GenericClientStream[LookupResourcesRequest, LookupResourcesResponse]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -173,30 +172,16 @@ func (c *permissionsServiceClient) LookupResources(ctx context.Context, in *Look
 	return x, nil
 }
 
-type PermissionsService_LookupResourcesClient interface {
-	Recv() (*LookupResourcesResponse, error)
-	grpc.ClientStream
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type PermissionsService_LookupResourcesClient = grpc.ServerStreamingClient[LookupResourcesResponse]
 
-type permissionsServiceLookupResourcesClient struct {
-	grpc.ClientStream
-}
-
-func (x *permissionsServiceLookupResourcesClient) Recv() (*LookupResourcesResponse, error) {
-	m := new(LookupResourcesResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-func (c *permissionsServiceClient) LookupSubjects(ctx context.Context, in *LookupSubjectsRequest, opts ...grpc.CallOption) (PermissionsService_LookupSubjectsClient, error) {
+func (c *permissionsServiceClient) LookupSubjects(ctx context.Context, in *LookupSubjectsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[LookupSubjectsResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &PermissionsService_ServiceDesc.Streams[2], PermissionsService_LookupSubjects_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &permissionsServiceLookupSubjectsClient{ClientStream: stream}
+	x := &grpc.GenericClientStream[LookupSubjectsRequest, LookupSubjectsResponse]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -206,33 +191,51 @@ func (c *permissionsServiceClient) LookupSubjects(ctx context.Context, in *Looku
 	return x, nil
 }
 
-type PermissionsService_LookupSubjectsClient interface {
-	Recv() (*LookupSubjectsResponse, error)
-	grpc.ClientStream
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type PermissionsService_LookupSubjectsClient = grpc.ServerStreamingClient[LookupSubjectsResponse]
 
-type permissionsServiceLookupSubjectsClient struct {
-	grpc.ClientStream
+func (c *permissionsServiceClient) ImportBulkRelationships(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[ImportBulkRelationshipsRequest, ImportBulkRelationshipsResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &PermissionsService_ServiceDesc.Streams[3], PermissionsService_ImportBulkRelationships_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[ImportBulkRelationshipsRequest, ImportBulkRelationshipsResponse]{ClientStream: stream}
+	return x, nil
 }
 
-func (x *permissionsServiceLookupSubjectsClient) Recv() (*LookupSubjectsResponse, error) {
-	m := new(LookupSubjectsResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type PermissionsService_ImportBulkRelationshipsClient = grpc.ClientStreamingClient[ImportBulkRelationshipsRequest, ImportBulkRelationshipsResponse]
+
+func (c *permissionsServiceClient) ExportBulkRelationships(ctx context.Context, in *ExportBulkRelationshipsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ExportBulkRelationshipsResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &PermissionsService_ServiceDesc.Streams[4], PermissionsService_ExportBulkRelationships_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[ExportBulkRelationshipsRequest, ExportBulkRelationshipsResponse]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
 		return nil, err
 	}
-	return m, nil
+	return x, nil
 }
 
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type PermissionsService_ExportBulkRelationshipsClient = grpc.ServerStreamingClient[ExportBulkRelationshipsResponse]
+
 // PermissionsServiceServer is the server API for PermissionsService service.
 // All implementations must embed UnimplementedPermissionsServiceServer
-// for forward compatibility
+// for forward compatibility.
 //
 // PermissionsService implements a set of RPCs that perform operations on
 // relationships and permissions.
 type PermissionsServiceServer interface {
 	// ReadRelationships reads a set of the relationships matching one or more
 	// filters.
-	ReadRelationships(*ReadRelationshipsRequest, PermissionsService_ReadRelationshipsServer) error
+	ReadRelationships(*ReadRelationshipsRequest, grpc.ServerStreamingServer[ReadRelationshipsResponse]) error
 	// WriteRelationships atomically writes and/or deletes a set of specified
 	// relationships. An optional set of preconditions can be provided that must
 	// be satisfied for the operation to commit.
@@ -254,18 +257,32 @@ type PermissionsServiceServer interface {
 	ExpandPermissionTree(context.Context, *ExpandPermissionTreeRequest) (*ExpandPermissionTreeResponse, error)
 	// LookupResources returns all the resources of a given type that a subject
 	// can access whether via a computed permission or relation membership.
-	LookupResources(*LookupResourcesRequest, PermissionsService_LookupResourcesServer) error
+	LookupResources(*LookupResourcesRequest, grpc.ServerStreamingServer[LookupResourcesResponse]) error
 	// LookupSubjects returns all the subjects of a given type that
 	// have access whether via a computed permission or relation membership.
-	LookupSubjects(*LookupSubjectsRequest, PermissionsService_LookupSubjectsServer) error
+	LookupSubjects(*LookupSubjectsRequest, grpc.ServerStreamingServer[LookupSubjectsResponse]) error
+	// ImportBulkRelationships is a faster path to writing a large number of
+	// relationships at once. It is both batched and streaming. For maximum
+	// performance, the caller should attempt to write relationships in as close
+	// to relationship sort order as possible: (resource.object_type,
+	// resource.object_id, relation, subject.object.object_type,
+	// subject.object.object_id, subject.optional_relation)
+	ImportBulkRelationships(grpc.ClientStreamingServer[ImportBulkRelationshipsRequest, ImportBulkRelationshipsResponse]) error
+	// ExportBulkRelationships is the fastest path available to exporting
+	// relationships from the server. It is resumable, and will return results
+	// in an order determined by the server.
+	ExportBulkRelationships(*ExportBulkRelationshipsRequest, grpc.ServerStreamingServer[ExportBulkRelationshipsResponse]) error
 	mustEmbedUnimplementedPermissionsServiceServer()
 }
 
-// UnimplementedPermissionsServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedPermissionsServiceServer struct {
-}
+// UnimplementedPermissionsServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedPermissionsServiceServer struct{}
 
-func (UnimplementedPermissionsServiceServer) ReadRelationships(*ReadRelationshipsRequest, PermissionsService_ReadRelationshipsServer) error {
+func (UnimplementedPermissionsServiceServer) ReadRelationships(*ReadRelationshipsRequest, grpc.ServerStreamingServer[ReadRelationshipsResponse]) error {
 	return status.Errorf(codes.Unimplemented, "method ReadRelationships not implemented")
 }
 func (UnimplementedPermissionsServiceServer) WriteRelationships(context.Context, *WriteRelationshipsRequest) (*WriteRelationshipsResponse, error) {
@@ -283,13 +300,20 @@ func (UnimplementedPermissionsServiceServer) CheckBulkPermissions(context.Contex
 func (UnimplementedPermissionsServiceServer) ExpandPermissionTree(context.Context, *ExpandPermissionTreeRequest) (*ExpandPermissionTreeResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ExpandPermissionTree not implemented")
 }
-func (UnimplementedPermissionsServiceServer) LookupResources(*LookupResourcesRequest, PermissionsService_LookupResourcesServer) error {
+func (UnimplementedPermissionsServiceServer) LookupResources(*LookupResourcesRequest, grpc.ServerStreamingServer[LookupResourcesResponse]) error {
 	return status.Errorf(codes.Unimplemented, "method LookupResources not implemented")
 }
-func (UnimplementedPermissionsServiceServer) LookupSubjects(*LookupSubjectsRequest, PermissionsService_LookupSubjectsServer) error {
+func (UnimplementedPermissionsServiceServer) LookupSubjects(*LookupSubjectsRequest, grpc.ServerStreamingServer[LookupSubjectsResponse]) error {
 	return status.Errorf(codes.Unimplemented, "method LookupSubjects not implemented")
 }
+func (UnimplementedPermissionsServiceServer) ImportBulkRelationships(grpc.ClientStreamingServer[ImportBulkRelationshipsRequest, ImportBulkRelationshipsResponse]) error {
+	return status.Errorf(codes.Unimplemented, "method ImportBulkRelationships not implemented")
+}
+func (UnimplementedPermissionsServiceServer) ExportBulkRelationships(*ExportBulkRelationshipsRequest, grpc.ServerStreamingServer[ExportBulkRelationshipsResponse]) error {
+	return status.Errorf(codes.Unimplemented, "method ExportBulkRelationships not implemented")
+}
 func (UnimplementedPermissionsServiceServer) mustEmbedUnimplementedPermissionsServiceServer() {}
+func (UnimplementedPermissionsServiceServer) testEmbeddedByValue()                            {}
 
 // UnsafePermissionsServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to PermissionsServiceServer will
@@ -299,6 +323,13 @@ type UnsafePermissionsServiceServer interface {
 }
 
 func RegisterPermissionsServiceServer(s grpc.ServiceRegistrar, srv PermissionsServiceServer) {
+	// If the following call pancis, it indicates UnimplementedPermissionsServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&PermissionsService_ServiceDesc, srv)
 }
 
@@ -307,21 +338,11 @@ func _PermissionsService_ReadRelationships_Handler(srv interface{}, stream grpc.
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(PermissionsServiceServer).ReadRelationships(m, &permissionsServiceReadRelationshipsServer{ServerStream: stream})
+	return srv.(PermissionsServiceServer).ReadRelationships(m, &grpc.GenericServerStream[ReadRelationshipsRequest, ReadRelationshipsResponse]{ServerStream: stream})
 }
 
-type PermissionsService_ReadRelationshipsServer interface {
-	Send(*ReadRelationshipsResponse) error
-	grpc.ServerStream
-}
-
-type permissionsServiceReadRelationshipsServer struct {
-	grpc.ServerStream
-}
-
-func (x *permissionsServiceReadRelationshipsServer) Send(m *ReadRelationshipsResponse) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type PermissionsService_ReadRelationshipsServer = grpc.ServerStreamingServer[ReadRelationshipsResponse]
 
 func _PermissionsService_WriteRelationships_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(WriteRelationshipsRequest)
@@ -418,43 +439,41 @@ func _PermissionsService_LookupResources_Handler(srv interface{}, stream grpc.Se
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(PermissionsServiceServer).LookupResources(m, &permissionsServiceLookupResourcesServer{ServerStream: stream})
-}
-
-type PermissionsService_LookupResourcesServer interface {
-	Send(*LookupResourcesResponse) error
-	grpc.ServerStream
+	return srv.(PermissionsServiceServer).LookupResources(m, &grpc.GenericServerStream[LookupResourcesRequest, LookupResourcesResponse]{ServerStream: stream})
 }
 
-type permissionsServiceLookupResourcesServer struct {
-	grpc.ServerStream
-}
-
-func (x *permissionsServiceLookupResourcesServer) Send(m *LookupResourcesResponse) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type PermissionsService_LookupResourcesServer = grpc.ServerStreamingServer[LookupResourcesResponse]
 
 func _PermissionsService_LookupSubjects_Handler(srv interface{}, stream grpc.ServerStream) error {
 	m := new(LookupSubjectsRequest)
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(PermissionsServiceServer).LookupSubjects(m, &permissionsServiceLookupSubjectsServer{ServerStream: stream})
+	return srv.(PermissionsServiceServer).LookupSubjects(m, &grpc.GenericServerStream[LookupSubjectsRequest, LookupSubjectsResponse]{ServerStream: stream})
 }
 
-type PermissionsService_LookupSubjectsServer interface {
-	Send(*LookupSubjectsResponse) error
-	grpc.ServerStream
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type PermissionsService_LookupSubjectsServer = grpc.ServerStreamingServer[LookupSubjectsResponse]
 
-type permissionsServiceLookupSubjectsServer struct {
-	grpc.ServerStream
+func _PermissionsService_ImportBulkRelationships_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(PermissionsServiceServer).ImportBulkRelationships(&grpc.GenericServerStream[ImportBulkRelationshipsRequest, ImportBulkRelationshipsResponse]{ServerStream: stream})
 }
 
-func (x *permissionsServiceLookupSubjectsServer) Send(m *LookupSubjectsResponse) error {
-	return x.ServerStream.SendMsg(m)
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type PermissionsService_ImportBulkRelationshipsServer = grpc.ClientStreamingServer[ImportBulkRelationshipsRequest, ImportBulkRelationshipsResponse]
+
+func _PermissionsService_ExportBulkRelationships_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(ExportBulkRelationshipsRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(PermissionsServiceServer).ExportBulkRelationships(m, &grpc.GenericServerStream[ExportBulkRelationshipsRequest, ExportBulkRelationshipsResponse]{ServerStream: stream})
 }
 
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type PermissionsService_ExportBulkRelationshipsServer = grpc.ServerStreamingServer[ExportBulkRelationshipsResponse]
+
 // PermissionsService_ServiceDesc is the grpc.ServiceDesc for PermissionsService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -499,6 +518,16 @@ var PermissionsService_ServiceDesc = grpc.ServiceDesc{
 			Handler:       _PermissionsService_LookupSubjects_Handler,
 			ServerStreams: true,
 		},
+		{
+			StreamName:    "ImportBulkRelationships",
+			Handler:       _PermissionsService_ImportBulkRelationships_Handler,
+			ClientStreams: true,
+		},
+		{
+			StreamName:    "ExportBulkRelationships",
+			Handler:       _PermissionsService_ExportBulkRelationships_Handler,
+			ServerStreams: true,
+		},
 	},
 	Metadata: "authzed/api/v1/permission_service.proto",
 }
diff --git a/proto/authzed/api/v1/permission_service_vtproto.pb.go b/proto/authzed/api/v1/permission_service_vtproto.pb.go
index c394765..5e43db0 100644
--- a/proto/authzed/api/v1/permission_service_vtproto.pb.go
+++ b/proto/authzed/api/v1/permission_service_vtproto.pb.go
@@ -617,6 +617,90 @@ func (m *ResolvedSubject) CloneMessageVT() proto.Message {
 	return m.CloneVT()
 }
 
+func (m *ImportBulkRelationshipsRequest) CloneVT() *ImportBulkRelationshipsRequest {
+	if m == nil {
+		return (*ImportBulkRelationshipsRequest)(nil)
+	}
+	r := new(ImportBulkRelationshipsRequest)
+	if rhs := m.Relationships; rhs != nil {
+		tmpContainer := make([]*Relationship, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.Relationships = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ImportBulkRelationshipsRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ImportBulkRelationshipsResponse) CloneVT() *ImportBulkRelationshipsResponse {
+	if m == nil {
+		return (*ImportBulkRelationshipsResponse)(nil)
+	}
+	r := new(ImportBulkRelationshipsResponse)
+	r.NumLoaded = m.NumLoaded
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ImportBulkRelationshipsResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ExportBulkRelationshipsRequest) CloneVT() *ExportBulkRelationshipsRequest {
+	if m == nil {
+		return (*ExportBulkRelationshipsRequest)(nil)
+	}
+	r := new(ExportBulkRelationshipsRequest)
+	r.Consistency = m.Consistency.CloneVT()
+	r.OptionalLimit = m.OptionalLimit
+	r.OptionalCursor = m.OptionalCursor.CloneVT()
+	r.OptionalRelationshipFilter = m.OptionalRelationshipFilter.CloneVT()
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ExportBulkRelationshipsRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ExportBulkRelationshipsResponse) CloneVT() *ExportBulkRelationshipsResponse {
+	if m == nil {
+		return (*ExportBulkRelationshipsResponse)(nil)
+	}
+	r := new(ExportBulkRelationshipsResponse)
+	r.AfterResultCursor = m.AfterResultCursor.CloneVT()
+	if rhs := m.Relationships; rhs != nil {
+		tmpContainer := make([]*Relationship, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.Relationships = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ExportBulkRelationshipsResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
 func (this *Consistency) EqualVT(that *Consistency) bool {
 	if this == that {
 		return true
@@ -1524,6 +1608,122 @@ func (this *ResolvedSubject) EqualMessageVT(thatMsg proto.Message) bool {
 	}
 	return this.EqualVT(that)
 }
+func (this *ImportBulkRelationshipsRequest) EqualVT(that *ImportBulkRelationshipsRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Relationships) != len(that.Relationships) {
+		return false
+	}
+	for i, vx := range this.Relationships {
+		vy := that.Relationships[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &Relationship{}
+			}
+			if q == nil {
+				q = &Relationship{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ImportBulkRelationshipsRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ImportBulkRelationshipsRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ImportBulkRelationshipsResponse) EqualVT(that *ImportBulkRelationshipsResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.NumLoaded != that.NumLoaded {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ImportBulkRelationshipsResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ImportBulkRelationshipsResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ExportBulkRelationshipsRequest) EqualVT(that *ExportBulkRelationshipsRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !this.Consistency.EqualVT(that.Consistency) {
+		return false
+	}
+	if this.OptionalLimit != that.OptionalLimit {
+		return false
+	}
+	if !this.OptionalCursor.EqualVT(that.OptionalCursor) {
+		return false
+	}
+	if !this.OptionalRelationshipFilter.EqualVT(that.OptionalRelationshipFilter) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ExportBulkRelationshipsRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ExportBulkRelationshipsRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ExportBulkRelationshipsResponse) EqualVT(that *ExportBulkRelationshipsResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !this.AfterResultCursor.EqualVT(that.AfterResultCursor) {
+		return false
+	}
+	if len(this.Relationships) != len(that.Relationships) {
+		return false
+	}
+	for i, vx := range this.Relationships {
+		vy := that.Relationships[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &Relationship{}
+			}
+			if q == nil {
+				q = &Relationship{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ExportBulkRelationshipsResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ExportBulkRelationshipsResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
 func (m *Consistency) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -3236,69 +3436,275 @@ func (m *ResolvedSubject) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *Consistency) SizeVT() (n int) {
+func (m *ImportBulkRelationshipsRequest) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
-		return 0
+		return nil, nil
 	}
-	var l int
-	_ = l
-	if vtmsg, ok := m.Requirement.(interface{ SizeVT() int }); ok {
-		n += vtmsg.SizeVT()
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	n += len(m.unknownFields)
-	return n
+	return dAtA[:n], nil
 }
 
-func (m *Consistency_MinimizeLatency) SizeVT() (n int) {
+func (m *ImportBulkRelationshipsRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ImportBulkRelationshipsRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 	if m == nil {
-		return 0
+		return 0, nil
 	}
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	n += 2
-	return n
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Relationships) > 0 {
+		for iNdEx := len(m.Relationships) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Relationships[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
 }
-func (m *Consistency_AtLeastAsFresh) SizeVT() (n int) {
+
+func (m *ImportBulkRelationshipsResponse) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
-		return 0
+		return nil, nil
 	}
-	var l int
-	_ = l
-	if m.AtLeastAsFresh != nil {
-		l = m.AtLeastAsFresh.SizeVT()
-		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	return n
+	return dAtA[:n], nil
 }
-func (m *Consistency_AtExactSnapshot) SizeVT() (n int) {
+
+func (m *ImportBulkRelationshipsResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ImportBulkRelationshipsResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 	if m == nil {
-		return 0
+		return 0, nil
 	}
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	if m.AtExactSnapshot != nil {
-		l = m.AtExactSnapshot.SizeVT()
-		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
 	}
-	return n
+	if m.NumLoaded != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.NumLoaded))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
 }
-func (m *Consistency_FullyConsistent) SizeVT() (n int) {
+
+func (m *ExportBulkRelationshipsRequest) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
-		return 0
+		return nil, nil
 	}
-	var l int
-	_ = l
-	n += 2
-	return n
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
 }
-func (m *RelationshipFilter) SizeVT() (n int) {
+
+func (m *ExportBulkRelationshipsRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ExportBulkRelationshipsRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 	if m == nil {
-		return 0
+		return 0, nil
 	}
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = len(m.ResourceType)
-	if l > 0 {
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.OptionalRelationshipFilter != nil {
+		size, err := m.OptionalRelationshipFilter.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.OptionalCursor != nil {
+		size, err := m.OptionalCursor.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.OptionalLimit != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.OptionalLimit))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Consistency != nil {
+		size, err := m.Consistency.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ExportBulkRelationshipsResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ExportBulkRelationshipsResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ExportBulkRelationshipsResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Relationships) > 0 {
+		for iNdEx := len(m.Relationships) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Relationships[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if m.AfterResultCursor != nil {
+		size, err := m.AfterResultCursor.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Consistency) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if vtmsg, ok := m.Requirement.(interface{ SizeVT() int }); ok {
+		n += vtmsg.SizeVT()
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *Consistency_MinimizeLatency) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 2
+	return n
+}
+func (m *Consistency_AtLeastAsFresh) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.AtLeastAsFresh != nil {
+		l = m.AtLeastAsFresh.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	return n
+}
+func (m *Consistency_AtExactSnapshot) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.AtExactSnapshot != nil {
+		l = m.AtExactSnapshot.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	return n
+}
+func (m *Consistency_FullyConsistent) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 2
+	return n
+}
+func (m *RelationshipFilter) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ResourceType)
+	if l > 0 {
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
 	l = len(m.OptionalResourceId)
@@ -3904,6 +4310,80 @@ func (m *ResolvedSubject) SizeVT() (n int) {
 	return n
 }
 
+func (m *ImportBulkRelationshipsRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Relationships) > 0 {
+		for _, e := range m.Relationships {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ImportBulkRelationshipsResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.NumLoaded != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.NumLoaded))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ExportBulkRelationshipsRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Consistency != nil {
+		l = m.Consistency.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.OptionalLimit != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.OptionalLimit))
+	}
+	if m.OptionalCursor != nil {
+		l = m.OptionalCursor.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.OptionalRelationshipFilter != nil {
+		l = m.OptionalRelationshipFilter.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ExportBulkRelationshipsResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.AfterResultCursor != nil {
+		l = m.AfterResultCursor.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.Relationships) > 0 {
+		for _, e := range m.Relationships {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
 func (m *Consistency) UnmarshalVT(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -8137,3 +8617,457 @@ func (m *ResolvedSubject) UnmarshalVT(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *ImportBulkRelationshipsRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ImportBulkRelationshipsRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ImportBulkRelationshipsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Relationships", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Relationships = append(m.Relationships, &Relationship{})
+			if err := m.Relationships[len(m.Relationships)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ImportBulkRelationshipsResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ImportBulkRelationshipsResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ImportBulkRelationshipsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NumLoaded", wireType)
+			}
+			m.NumLoaded = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.NumLoaded |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ExportBulkRelationshipsRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ExportBulkRelationshipsRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ExportBulkRelationshipsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Consistency", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Consistency == nil {
+				m.Consistency = &Consistency{}
+			}
+			if err := m.Consistency.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OptionalLimit", wireType)
+			}
+			m.OptionalLimit = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.OptionalLimit |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OptionalCursor", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.OptionalCursor == nil {
+				m.OptionalCursor = &Cursor{}
+			}
+			if err := m.OptionalCursor.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OptionalRelationshipFilter", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.OptionalRelationshipFilter == nil {
+				m.OptionalRelationshipFilter = &RelationshipFilter{}
+			}
+			if err := m.OptionalRelationshipFilter.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ExportBulkRelationshipsResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ExportBulkRelationshipsResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ExportBulkRelationshipsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AfterResultCursor", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.AfterResultCursor == nil {
+				m.AfterResultCursor = &Cursor{}
+			}
+			if err := m.AfterResultCursor.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Relationships", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Relationships = append(m.Relationships, &Relationship{})
+			if err := m.Relationships[len(m.Relationships)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/proto/authzed/api/v1/schema_service_grpc.pb.go b/proto/authzed/api/v1/schema_service_grpc.pb.go
index c15d344..30bb9f7 100644
--- a/proto/authzed/api/v1/schema_service_grpc.pb.go
+++ b/proto/authzed/api/v1/schema_service_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: authzed/api/v1/schema_service.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	SchemaService_ReadSchema_FullMethodName  = "/authzed.api.v1.SchemaService/ReadSchema"
@@ -69,7 +69,7 @@ func (c *schemaServiceClient) WriteSchema(ctx context.Context, in *WriteSchemaRe
 
 // SchemaServiceServer is the server API for SchemaService service.
 // All implementations must embed UnimplementedSchemaServiceServer
-// for forward compatibility
+// for forward compatibility.
 //
 // SchemaService implements operations on a Permissions System's Schema.
 type SchemaServiceServer interface {
@@ -84,9 +84,12 @@ type SchemaServiceServer interface {
 	mustEmbedUnimplementedSchemaServiceServer()
 }
 
-// UnimplementedSchemaServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedSchemaServiceServer struct {
-}
+// UnimplementedSchemaServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedSchemaServiceServer struct{}
 
 func (UnimplementedSchemaServiceServer) ReadSchema(context.Context, *ReadSchemaRequest) (*ReadSchemaResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ReadSchema not implemented")
@@ -95,6 +98,7 @@ func (UnimplementedSchemaServiceServer) WriteSchema(context.Context, *WriteSchem
 	return nil, status.Errorf(codes.Unimplemented, "method WriteSchema not implemented")
 }
 func (UnimplementedSchemaServiceServer) mustEmbedUnimplementedSchemaServiceServer() {}
+func (UnimplementedSchemaServiceServer) testEmbeddedByValue()                       {}
 
 // UnsafeSchemaServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to SchemaServiceServer will
@@ -104,6 +108,13 @@ type UnsafeSchemaServiceServer interface {
 }
 
 func RegisterSchemaServiceServer(s grpc.ServiceRegistrar, srv SchemaServiceServer) {
+	// If the following call pancis, it indicates UnimplementedSchemaServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&SchemaService_ServiceDesc, srv)
 }
 
diff --git a/proto/authzed/api/v1/watch_service_grpc.pb.go b/proto/authzed/api/v1/watch_service_grpc.pb.go
index ac8c591..c792edc 100644
--- a/proto/authzed/api/v1/watch_service_grpc.pb.go
+++ b/proto/authzed/api/v1/watch_service_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: authzed/api/v1/watch_service.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	WatchService_Watch_FullMethodName = "/authzed.api.v1.WatchService/Watch"
@@ -26,7 +26,7 @@ const (
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type WatchServiceClient interface {
-	Watch(ctx context.Context, in *WatchRequest, opts ...grpc.CallOption) (WatchService_WatchClient, error)
+	Watch(ctx context.Context, in *WatchRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[WatchResponse], error)
 }
 
 type watchServiceClient struct {
@@ -37,13 +37,13 @@ func NewWatchServiceClient(cc grpc.ClientConnInterface) WatchServiceClient {
 	return &watchServiceClient{cc}
 }
 
-func (c *watchServiceClient) Watch(ctx context.Context, in *WatchRequest, opts ...grpc.CallOption) (WatchService_WatchClient, error) {
+func (c *watchServiceClient) Watch(ctx context.Context, in *WatchRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[WatchResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &WatchService_ServiceDesc.Streams[0], WatchService_Watch_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &watchServiceWatchClient{ClientStream: stream}
+	x := &grpc.GenericClientStream[WatchRequest, WatchResponse]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -53,39 +53,29 @@ func (c *watchServiceClient) Watch(ctx context.Context, in *WatchRequest, opts .
 	return x, nil
 }
 
-type WatchService_WatchClient interface {
-	Recv() (*WatchResponse, error)
-	grpc.ClientStream
-}
-
-type watchServiceWatchClient struct {
-	grpc.ClientStream
-}
-
-func (x *watchServiceWatchClient) Recv() (*WatchResponse, error) {
-	m := new(WatchResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type WatchService_WatchClient = grpc.ServerStreamingClient[WatchResponse]
 
 // WatchServiceServer is the server API for WatchService service.
 // All implementations must embed UnimplementedWatchServiceServer
-// for forward compatibility
+// for forward compatibility.
 type WatchServiceServer interface {
-	Watch(*WatchRequest, WatchService_WatchServer) error
+	Watch(*WatchRequest, grpc.ServerStreamingServer[WatchResponse]) error
 	mustEmbedUnimplementedWatchServiceServer()
 }
 
-// UnimplementedWatchServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedWatchServiceServer struct {
-}
+// UnimplementedWatchServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedWatchServiceServer struct{}
 
-func (UnimplementedWatchServiceServer) Watch(*WatchRequest, WatchService_WatchServer) error {
+func (UnimplementedWatchServiceServer) Watch(*WatchRequest, grpc.ServerStreamingServer[WatchResponse]) error {
 	return status.Errorf(codes.Unimplemented, "method Watch not implemented")
 }
 func (UnimplementedWatchServiceServer) mustEmbedUnimplementedWatchServiceServer() {}
+func (UnimplementedWatchServiceServer) testEmbeddedByValue()                      {}
 
 // UnsafeWatchServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to WatchServiceServer will
@@ -95,6 +85,13 @@ type UnsafeWatchServiceServer interface {
 }
 
 func RegisterWatchServiceServer(s grpc.ServiceRegistrar, srv WatchServiceServer) {
+	// If the following call pancis, it indicates UnimplementedWatchServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&WatchService_ServiceDesc, srv)
 }
 
@@ -103,21 +100,11 @@ func _WatchService_Watch_Handler(srv interface{}, stream grpc.ServerStream) erro
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(WatchServiceServer).Watch(m, &watchServiceWatchServer{ServerStream: stream})
-}
-
-type WatchService_WatchServer interface {
-	Send(*WatchResponse) error
-	grpc.ServerStream
+	return srv.(WatchServiceServer).Watch(m, &grpc.GenericServerStream[WatchRequest, WatchResponse]{ServerStream: stream})
 }
 
-type watchServiceWatchServer struct {
-	grpc.ServerStream
-}
-
-func (x *watchServiceWatchServer) Send(m *WatchResponse) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type WatchService_WatchServer = grpc.ServerStreamingServer[WatchResponse]
 
 // WatchService_ServiceDesc is the grpc.ServiceDesc for WatchService service.
 // It's only intended for direct use with grpc.RegisterService,
diff --git a/proto/authzed/api/v1/zz_generated.version.go b/proto/authzed/api/v1/zz_generated.version.go
index 7111f48..c10f51e 100644
--- a/proto/authzed/api/v1/zz_generated.version.go
+++ b/proto/authzed/api/v1/zz_generated.version.go
@@ -2,5 +2,5 @@ package v1
 
 const (
 	BufRepository = "buf.build/authzed/api"
-	BufTag        = "v1.35.0"
+	BufTag        = "699bacec3b42827155e8d78296c9c54224a0cffa"
 )
diff --git a/proto/authzed/api/v1alpha1/schema_grpc.pb.go b/proto/authzed/api/v1alpha1/schema_grpc.pb.go
index 0c8bed4..0b428be 100644
--- a/proto/authzed/api/v1alpha1/schema_grpc.pb.go
+++ b/proto/authzed/api/v1alpha1/schema_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: authzed/api/v1alpha1/schema.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	SchemaService_ReadSchema_FullMethodName  = "/authzed.api.v1alpha1.SchemaService/ReadSchema"
@@ -71,7 +71,7 @@ func (c *schemaServiceClient) WriteSchema(ctx context.Context, in *WriteSchemaRe
 
 // SchemaServiceServer is the server API for SchemaService service.
 // All implementations must embed UnimplementedSchemaServiceServer
-// for forward compatibility
+// for forward compatibility.
 //
 // SchemaService implements operations on a Permissions System's Schema.
 type SchemaServiceServer interface {
@@ -88,9 +88,12 @@ type SchemaServiceServer interface {
 	mustEmbedUnimplementedSchemaServiceServer()
 }
 
-// UnimplementedSchemaServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedSchemaServiceServer struct {
-}
+// UnimplementedSchemaServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedSchemaServiceServer struct{}
 
 func (UnimplementedSchemaServiceServer) ReadSchema(context.Context, *ReadSchemaRequest) (*ReadSchemaResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ReadSchema not implemented")
@@ -99,6 +102,7 @@ func (UnimplementedSchemaServiceServer) WriteSchema(context.Context, *WriteSchem
 	return nil, status.Errorf(codes.Unimplemented, "method WriteSchema not implemented")
 }
 func (UnimplementedSchemaServiceServer) mustEmbedUnimplementedSchemaServiceServer() {}
+func (UnimplementedSchemaServiceServer) testEmbeddedByValue()                       {}
 
 // UnsafeSchemaServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to SchemaServiceServer will
@@ -108,6 +112,13 @@ type UnsafeSchemaServiceServer interface {
 }
 
 func RegisterSchemaServiceServer(s grpc.ServiceRegistrar, srv SchemaServiceServer) {
+	// If the following call pancis, it indicates UnimplementedSchemaServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&SchemaService_ServiceDesc, srv)
 }
 
diff --git a/proto/authzed/api/v1alpha1/watchresources_service_grpc.pb.go b/proto/authzed/api/v1alpha1/watchresources_service_grpc.pb.go
index 9de0ba3..458fbbb 100644
--- a/proto/authzed/api/v1alpha1/watchresources_service_grpc.pb.go
+++ b/proto/authzed/api/v1alpha1/watchresources_service_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: authzed/api/v1alpha1/watchresources_service.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	WatchResourcesService_WatchResources_FullMethodName = "/authzed.api.v1alpha1.WatchResourcesService/WatchResources"
@@ -31,7 +31,7 @@ const (
 type WatchResourcesServiceClient interface {
 	// WatchResources initiates a watch for permission changes for the provided
 	// (resource type, permission, subject) pair.
-	WatchResources(ctx context.Context, in *WatchResourcesRequest, opts ...grpc.CallOption) (WatchResourcesService_WatchResourcesClient, error)
+	WatchResources(ctx context.Context, in *WatchResourcesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[WatchResourcesResponse], error)
 }
 
 type watchResourcesServiceClient struct {
@@ -42,13 +42,13 @@ func NewWatchResourcesServiceClient(cc grpc.ClientConnInterface) WatchResourcesS
 	return &watchResourcesServiceClient{cc}
 }
 
-func (c *watchResourcesServiceClient) WatchResources(ctx context.Context, in *WatchResourcesRequest, opts ...grpc.CallOption) (WatchResourcesService_WatchResourcesClient, error) {
+func (c *watchResourcesServiceClient) WatchResources(ctx context.Context, in *WatchResourcesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[WatchResourcesResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &WatchResourcesService_ServiceDesc.Streams[0], WatchResourcesService_WatchResources_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &watchResourcesServiceWatchResourcesClient{ClientStream: stream}
+	x := &grpc.GenericClientStream[WatchResourcesRequest, WatchResourcesResponse]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -58,44 +58,34 @@ func (c *watchResourcesServiceClient) WatchResources(ctx context.Context, in *Wa
 	return x, nil
 }
 
-type WatchResourcesService_WatchResourcesClient interface {
-	Recv() (*WatchResourcesResponse, error)
-	grpc.ClientStream
-}
-
-type watchResourcesServiceWatchResourcesClient struct {
-	grpc.ClientStream
-}
-
-func (x *watchResourcesServiceWatchResourcesClient) Recv() (*WatchResourcesResponse, error) {
-	m := new(WatchResourcesResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type WatchResourcesService_WatchResourcesClient = grpc.ServerStreamingClient[WatchResourcesResponse]
 
 // WatchResourcesServiceServer is the server API for WatchResourcesService service.
 // All implementations must embed UnimplementedWatchResourcesServiceServer
-// for forward compatibility
+// for forward compatibility.
 //
 // WatchResourcesService is used to receive a stream of updates for resources of a
 // specific (resource type, permission, subject) combination.
 type WatchResourcesServiceServer interface {
 	// WatchResources initiates a watch for permission changes for the provided
 	// (resource type, permission, subject) pair.
-	WatchResources(*WatchResourcesRequest, WatchResourcesService_WatchResourcesServer) error
+	WatchResources(*WatchResourcesRequest, grpc.ServerStreamingServer[WatchResourcesResponse]) error
 	mustEmbedUnimplementedWatchResourcesServiceServer()
 }
 
-// UnimplementedWatchResourcesServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedWatchResourcesServiceServer struct {
-}
+// UnimplementedWatchResourcesServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedWatchResourcesServiceServer struct{}
 
-func (UnimplementedWatchResourcesServiceServer) WatchResources(*WatchResourcesRequest, WatchResourcesService_WatchResourcesServer) error {
+func (UnimplementedWatchResourcesServiceServer) WatchResources(*WatchResourcesRequest, grpc.ServerStreamingServer[WatchResourcesResponse]) error {
 	return status.Errorf(codes.Unimplemented, "method WatchResources not implemented")
 }
 func (UnimplementedWatchResourcesServiceServer) mustEmbedUnimplementedWatchResourcesServiceServer() {}
+func (UnimplementedWatchResourcesServiceServer) testEmbeddedByValue()                               {}
 
 // UnsafeWatchResourcesServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to WatchResourcesServiceServer will
@@ -105,6 +95,13 @@ type UnsafeWatchResourcesServiceServer interface {
 }
 
 func RegisterWatchResourcesServiceServer(s grpc.ServiceRegistrar, srv WatchResourcesServiceServer) {
+	// If the following call pancis, it indicates UnimplementedWatchResourcesServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&WatchResourcesService_ServiceDesc, srv)
 }
 
@@ -113,21 +110,11 @@ func _WatchResourcesService_WatchResources_Handler(srv interface{}, stream grpc.
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(WatchResourcesServiceServer).WatchResources(m, &watchResourcesServiceWatchResourcesServer{ServerStream: stream})
-}
-
-type WatchResourcesService_WatchResourcesServer interface {
-	Send(*WatchResourcesResponse) error
-	grpc.ServerStream
+	return srv.(WatchResourcesServiceServer).WatchResources(m, &grpc.GenericServerStream[WatchResourcesRequest, WatchResourcesResponse]{ServerStream: stream})
 }
 
-type watchResourcesServiceWatchResourcesServer struct {
-	grpc.ServerStream
-}
-
-func (x *watchResourcesServiceWatchResourcesServer) Send(m *WatchResourcesResponse) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type WatchResourcesService_WatchResourcesServer = grpc.ServerStreamingServer[WatchResourcesResponse]
 
 // WatchResourcesService_ServiceDesc is the grpc.ServiceDesc for WatchResourcesService service.
 // It's only intended for direct use with grpc.RegisterService,
diff --git a/proto/authzed/api/v1alpha1/zz_generated.version.go b/proto/authzed/api/v1alpha1/zz_generated.version.go
index f8fafc8..6303e41 100644
--- a/proto/authzed/api/v1alpha1/zz_generated.version.go
+++ b/proto/authzed/api/v1alpha1/zz_generated.version.go
@@ -2,5 +2,5 @@ package v1alpha1
 
 const (
 	BufRepository = "buf.build/authzed/api"
-	BufTag        = "v1.35.0"
+	BufTag        = "699bacec3b42827155e8d78296c9c54224a0cffa"
 )

From 6518ffb136a3562ac8da4bc7e37a2bbc86bf7389 Mon Sep 17 00:00:00 2001
From: Tanner Stirrat <tstirrat@gmail.com>
Date: Thu, 26 Sep 2024 16:20:56 -0600
Subject: [PATCH 7/8] Reference v1.37.0 tag

---
 magefiles/gen.go | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/magefiles/gen.go b/magefiles/gen.go
index 61f0fdc..491168c 100644
--- a/magefiles/gen.go
+++ b/magefiles/gen.go
@@ -24,8 +24,7 @@ func (g Gen) All() error {
 const (
 	ProtoPath     = "proto/authzed/api"
 	BufRepository = "buf.build/authzed/api"
-	// Prerelease version
-	BufTag        = "699bacec3b42827155e8d78296c9c54224a0cffa"
+	BufTag        = "v1.37.0"
 )
 
 // Proto runs proto codegen

From 73640f4e51e87642042f2948973b4b20a00f4156 Mon Sep 17 00:00:00 2001
From: Tanner Stirrat <tstirrat@gmail.com>
Date: Thu, 26 Sep 2024 16:35:42 -0600
Subject: [PATCH 8/8] Regen with v1.37.0

---
 proto/authzed/api/materialize/zz_generated.version.go | 2 +-
 proto/authzed/api/v0/zz_generated.version.go          | 2 +-
 proto/authzed/api/v1/zz_generated.version.go          | 2 +-
 proto/authzed/api/v1alpha1/zz_generated.version.go    | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/proto/authzed/api/materialize/zz_generated.version.go b/proto/authzed/api/materialize/zz_generated.version.go
index e822387..b89b596 100644
--- a/proto/authzed/api/materialize/zz_generated.version.go
+++ b/proto/authzed/api/materialize/zz_generated.version.go
@@ -2,5 +2,5 @@ package materialize
 
 const (
 	BufRepository = "buf.build/authzed/api"
-	BufTag        = "699bacec3b42827155e8d78296c9c54224a0cffa"
+	BufTag        = "v1.37.0"
 )
diff --git a/proto/authzed/api/v0/zz_generated.version.go b/proto/authzed/api/v0/zz_generated.version.go
index 13fa898..b8dcd1f 100644
--- a/proto/authzed/api/v0/zz_generated.version.go
+++ b/proto/authzed/api/v0/zz_generated.version.go
@@ -2,5 +2,5 @@ package v0
 
 const (
 	BufRepository = "buf.build/authzed/api"
-	BufTag        = "699bacec3b42827155e8d78296c9c54224a0cffa"
+	BufTag        = "v1.37.0"
 )
diff --git a/proto/authzed/api/v1/zz_generated.version.go b/proto/authzed/api/v1/zz_generated.version.go
index c10f51e..385bdd7 100644
--- a/proto/authzed/api/v1/zz_generated.version.go
+++ b/proto/authzed/api/v1/zz_generated.version.go
@@ -2,5 +2,5 @@ package v1
 
 const (
 	BufRepository = "buf.build/authzed/api"
-	BufTag        = "699bacec3b42827155e8d78296c9c54224a0cffa"
+	BufTag        = "v1.37.0"
 )
diff --git a/proto/authzed/api/v1alpha1/zz_generated.version.go b/proto/authzed/api/v1alpha1/zz_generated.version.go
index 6303e41..0fe0ef7 100644
--- a/proto/authzed/api/v1alpha1/zz_generated.version.go
+++ b/proto/authzed/api/v1alpha1/zz_generated.version.go
@@ -2,5 +2,5 @@ package v1alpha1
 
 const (
 	BufRepository = "buf.build/authzed/api"
-	BufTag        = "699bacec3b42827155e8d78296c9c54224a0cffa"
+	BufTag        = "v1.37.0"
 )