@classytic/arc 2.22.0 → 2.23.0

package/dist/{permissions-BJMuKMl7.mjs → permissions-tbxFHxjZ.mjs}

@@ -3,269 +3,6 @@ import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d
 import { t as getUserRoles } from "./types-XTApa8b6.mjs";
 import { t as MemoryCacheStore } from "./memory-CLXA2VeJ.mjs";
 import { randomUUID } from "node:crypto";
-//#region src/permissions/fields.ts
-/**
-* Field-Level Permissions
-*
-* Control field visibility and writability per role.
-* Integrated into the response path (read) and sanitization path (write).
-*
-* @example
-* ```typescript
-* import { fields, defineResource } from '@classytic/arc';
-*
-* const userResource = defineResource({
-*   name: 'user',
-*   adapter: userAdapter,
-*   fields: {
-*     salary: fields.visibleTo(['admin', 'hr']),
-*     internalNotes: fields.writableBy(['admin']),
-*     email: fields.redactFor(['viewer']),
-*     password: fields.hidden(),
-*   },
-* });
-* ```
-*/
-/** Type guard for Mongoose-like documents with toObject() */
-function isMongooseDoc(obj) {
-	return !!obj && typeof obj === "object" && "toObject" in obj && typeof obj.toObject === "function";
-}
-const fields = {
-	/**
-	* Field is never included in responses. Not writable via API.
-	*
-	* @example
-	* ```typescript
-	* fields: { password: fields.hidden() }
-	* ```
-	*/
-	hidden() {
-		return { _type: "hidden" };
-	},
-	/**
-	* Field is only visible to users with specified roles.
-	* Other users don't see the field at all.
-	*
-	* @example
-	* ```typescript
-	* fields: { salary: fields.visibleTo(['admin', 'hr']) }
-	* ```
-	*/
-	visibleTo(roles) {
-		return {
-			_type: "visibleTo",
-			roles
-		};
-	},
-	/**
-	* Field is only writable by users with specified roles.
-	* All users can still read the field. Users without the role
-	* have the field silently stripped from write operations.
-	*
-	* @example
-	* ```typescript
-	* fields: { role: fields.writableBy(['admin']) }
-	* ```
-	*/
-	writableBy(roles) {
-		return {
-			_type: "writableBy",
-			roles
-		};
-	},
-	/**
-	* Field is redacted (replaced with a placeholder) for specified roles.
-	* Other users see the real value.
-	*
-	* @param roles - Roles that see the redacted value
-	* @param redactValue - Replacement value (default: '***')
-	*
-	* @example
-	* ```typescript
-	* fields: {
-	*   email: fields.redactFor(['viewer']),
-	*   ssn: fields.redactFor(['basic'], '***-**-****'),
-	* }
-	* ```
-	*/
-	redactFor(roles, redactValue = "***") {
-		return {
-			_type: "redactFor",
-			roles,
-			redactValue
-		};
-	}
-};
-/**
-* Apply field-level READ permissions to a response object.
-* Strips hidden fields, enforces visibility, and applies redaction.
-*
-* @param data - The response object (mutated in place for performance)
-* @param fieldPermissions - Field permission map from resource config
-* @param userRoles - Current user's roles (empty array for unauthenticated)
-* @returns The filtered object
-*/
-function applyFieldReadPermissions(data, fieldPermissions, userRoles) {
-	if (!data || typeof data !== "object") return data;
-	const result = { ...isMongooseDoc(data) ? data.toObject() : data };
-	for (const [field, perm] of Object.entries(fieldPermissions)) switch (perm._type) {
-		case "hidden":
-			delete result[field];
-			break;
-		case "visibleTo":
-			if (!perm.roles?.some((r) => userRoles.includes(r))) delete result[field];
-			break;
-		case "redactFor":
-			if (perm.roles?.some((r) => userRoles.includes(r))) result[field] = perm.redactValue ?? "***";
-			break;
-		case "writableBy": break;
-	}
-	return result;
-}
-/**
-* Apply field-level WRITE permissions to request body.
-*
-* Returns both the filtered body and the list of denied fields. Callers are
-* expected to reject the request when `deniedFields.length > 0` — silently
-* stripping fields hides misconfigurations and real attacks. See
-* `BodySanitizer` for the default policy.
-*
-* @param body - The request body (returns a new filtered copy)
-* @param fieldPermissions - Field permission map from resource config
-* @param userRoles - Current user's roles
-*/
-function applyFieldWritePermissions(body, fieldPermissions, userRoles) {
-	const result = { ...body };
-	const deniedFields = [];
-	for (const [field, perm] of Object.entries(fieldPermissions)) switch (perm._type) {
-		case "hidden":
-			if (field in result) {
-				deniedFields.push(field);
-				delete result[field];
-			}
-			break;
-		case "writableBy":
-			if (field in result && !perm.roles?.some((r) => userRoles.includes(r))) {
-				deniedFields.push(field);
-				delete result[field];
-			}
-			break;
-	}
-	return {
-		body: result,
-		deniedFields
-	};
-}
-/**
-* Resolve effective roles by merging global user roles with org-level roles.
-*
-* Global roles come from `req.user.role` (normalized via getUserRoles()).
-* Org roles come from `req.context.orgRoles` (set by BA adapter's org bridge).
-*
-* When no org context exists, returns global roles only — backward compatible.
-*/
-function resolveEffectiveRoles(userRoles, orgRoles) {
-	if (orgRoles.length === 0) return [...userRoles];
-	if (userRoles.length === 0) return [...orgRoles];
-	return [.../* @__PURE__ */ new Set([...userRoles, ...orgRoles])];
-}
-//#endregion
-//#region src/permissions/applyPermissionResult.ts
-/**
-* Normalize a permission check return value (`boolean | PermissionResult`)
-* into a concrete `PermissionResult`. This is the only place in Arc that
-* promotes booleans to results — keeps the type narrowing honest everywhere.
-*/
-function normalizePermissionResult(result) {
-	if (typeof result === "boolean") return { granted: result };
-	return result;
-}
-/**
-* Apply a granted `PermissionResult` to a Fastify request — merges row-level
-* filters into `_policyFilters` and conditionally installs the scope.
-*
-* **Scope install rule:** only writes `scope` when the current request scope
-* is absent or `public`. This prevents downgrading an already-authenticated
-* request (e.g. Better Auth set `member`, then a permission check returns a
-* narrower `service` scope — the original `member` wins because it came from
-* a more authoritative source).
-*
-* Safe to call with a non-granted result — it simply no-ops. Callers should
-* still check `result.granted` and send an error response before reaching here,
-* but this function tolerates the misuse defensively.
-*/
-function applyPermissionResult(result, request) {
-	if (!result.granted) return;
-	if (result.filters) request._policyFilters = {
-		...request._policyFilters ?? {},
-		...result.filters
-	};
-	if (result.scope) {
-		const current = request.scope;
-		if (!current || current.kind === "public") request.scope = result.scope;
-	}
-}
-/**
-* Max length of a `PermissionResult.reason` string before we fall back to the
-* generic default message. Upstream checks can return arbitrary strings; we
-* clamp to prevent accidental leakage of internal diagnostics or oversized
-* payloads via the 4xx response body.
-*/
-const MAX_DENIAL_REASON_LENGTH = 100;
-/**
-* End-to-end evaluator: runs the permission check, catches throws, normalizes
-* the result, sends a 401/403 response on denial, and applies side-effects on
-* grant. Returns `true` if the caller should continue, `false` if a response
-* has been sent and the caller should return.
-*
-* This is the single source of truth for the 5-step sequence shared by the
-* CRUD router, action router, and MCP tool handlers:
-*
-*   1. `try { await check(ctx) } catch { reply 403 }`
-*   2. `normalizePermissionResult(result)`
-*   3. If denied → 401 (no user) or 403 (user) with clamped reason
-*   4. If granted → `applyPermissionResult` (filters + scope)
-*   5. Return true/false so the caller knows whether to keep going
-*
-* Context construction, pre-check auth gating, and success-path handler
-* invocation stay at the callsite — those are genuinely different per router
-* and don't belong here.
-*
-* @returns `true` if authorized (caller continues), `false` if a response was sent
-*/
-async function evaluateAndApplyPermission(check, context, request, reply, opts) {
-	let result;
-	try {
-		result = await check(context);
-	} catch (err) {
-		request.log?.warn?.({
-			err,
-			resource: context.resource,
-			action: context.action
-		}, "Permission check threw");
-		reply.code(403).send({
-			code: "arc.forbidden",
-			message: "Permission denied",
-			status: 403
-		});
-		return false;
-	}
-	const permResult = normalizePermissionResult(result);
-	if (!permResult.granted) {
-		const defaultMsg = opts?.defaultDenialMessage?.(context.user) ?? (context.user ? "Permission denied" : "Authentication required");
-		const reason = permResult.reason && permResult.reason.length <= MAX_DENIAL_REASON_LENGTH ? permResult.reason : defaultMsg;
-		const status = context.user ? 403 : 401;
-		reply.code(status).send({
-			code: context.user ? "arc.forbidden" : "arc.unauthorized",
-			message: reason,
-			status
-		});
-		return false;
-	}
-	applyPermissionResult(permResult, request);
-	return true;
-}
-//#endregion
 //#region src/permissions/agent.ts
 /**
 * Agent-Auth Permission Helpers — DPoP + capability mandates for AI-agent flows
@@ -1315,6 +1052,82 @@ function createDynamicPermissionMatrix(config) {
 	};
 }
 //#endregion
+//#region src/permissions/grants.ts
+/**
+* The grant-mode lattice, weakest → strongest. Holding a mode satisfies
+* every mode at or below it (`write` ⊇ `read` ⊇ `list` ⊇ `see`); `manage`
+* (grant/revoke rights) satisfies everything. Same semantics as Puter's
+* `see < list < read < write` hierarchy with `manage` folded into the
+* lattice top instead of a separate string namespace.
+*/
+const GRANT_MODES = [
+	"see",
+	"list",
+	"read",
+	"write",
+	"manage"
+];
+/**
+* Does a HELD mode satisfy a REQUIRED mode? Lattice implication —
+* `modeSatisfies('write', 'read') === true`, `modeSatisfies('see', 'read')
+* === false`. Unknown strings (a corrupted grant row) never satisfy
+* anything: fail-closed.
+*/
+function modeSatisfies(held, required) {
+	if (held === void 0) return false;
+	const heldRank = GRANT_MODES.indexOf(held);
+	if (heldRank === -1) return false;
+	return heldRank >= GRANT_MODES.indexOf(required);
+}
+/**
+* Per-record grant gate. Same combinator tier as `requireOwnership` —
+* compose with `anyOf`/`allOf` like any other `PermissionCheck`.
+*
+* Fail-closed contract: resolver throws → denied (logged via
+* `ctx.request.log`); resolution carries neither `mode` nor `filters` →
+* denied; unknown/corrupted mode strings → denied.
+*/
+function requireGrant(options) {
+	const { mode: required, resolve, bypassRoles } = options;
+	return async (ctx) => {
+		if (bypassRoles && ctx.user && getUserRoles(ctx.user).some((r) => bypassRoles.includes(r))) return true;
+		let resolution;
+		try {
+			resolution = await resolve(ctx);
+		} catch (err) {
+			ctx.request.log?.warn?.({
+				err,
+				resource: ctx.resource,
+				action: ctx.action
+			}, "requireGrant: resolve threw — denying (fail-closed)");
+			return {
+				granted: false,
+				reason: "Grant lookup failed"
+			};
+		}
+		if (typeof resolution === "boolean") return resolution;
+		const { mode: held, filters, reason } = resolution;
+		if (held !== void 0) {
+			if (!modeSatisfies(held, required)) return {
+				granted: false,
+				...reason ? { reason } : {}
+			};
+			return {
+				granted: true,
+				...filters ? { filters } : {}
+			};
+		}
+		if (filters !== void 0) return {
+			granted: true,
+			filters
+		};
+		return {
+			granted: false,
+			...reason ? { reason } : {}
+		};
+	};
+}
+//#endregion
 //#region src/permissions/roleHierarchy.ts
 /**
 * Create a role hierarchy from a parent → children map.
@@ -1530,4 +1343,4 @@ function readOnly(overrides) {
 	}, overrides);
 }
 //#endregion
-export { requireDPoP as A, not as C, roles as D, requireRoles as E, applyFieldReadPermissions as F, applyFieldWritePermissions as I, fields as L, applyPermissionResult as M, evaluateAndApplyPermission as N, when as O, normalizePermissionResult as P, resolveEffectiveRoles as R, denyAll as S, requireOwnership as T, requireServiceScope as _, permissionMatrix as a, allowPublic as b, publicReadAdminWrite as c, createDynamicPermissionMatrix as d, createOrgPermissions as f, requireScopeContext as g, requireOrgRole as h, ownerWithAdminBypass as i, requireMandate as j, requireAgentScope as k, readOnly as l, requireOrgMembership as m, authenticated as n, presets_exports as o, requireOrgInScope as p, fullPublic as r, publicRead as s, adminOnly as t, createRoleHierarchy as u, requireTeamMembership as v, requireAuth as w, anyOf as x, allOf as y };
+export { roles as A, allowPublic as C, requireAuth as D, not as E, requireAgentScope as M, requireDPoP as N, requireOwnership as O, requireMandate as P, allOf as S, denyAll as T, requireOrgMembership as _, permissionMatrix as a, requireServiceScope as b, publicReadAdminWrite as c, GRANT_MODES as d, modeSatisfies as f, requireOrgInScope as g, createOrgPermissions as h, ownerWithAdminBypass as i, when as j, requireRoles as k, readOnly as l, createDynamicPermissionMatrix as m, authenticated as n, presets_exports as o, requireGrant as p, fullPublic as r, publicRead as s, adminOnly as t, createRoleHierarchy as u, requireOrgRole as v, anyOf as w, requireTeamMembership as x, requireScopeContext as y };

package/dist/pipeline/index.d.mts

@@ -1,4 +1,4 @@
-import { Ct as PipelineStep, Rt as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-DbtgCOCj.mjs";
+import { Ct as PipelineStep, Rt as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-BBsvQt7U.mjs";
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {
   operations?: OperationFilter;

package/dist/plugins/index.d.mts

@@ -1,7 +1,7 @@
-import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions, qt as AnyRecord } from "../index-DbtgCOCj.mjs";
+import { At as RouteDefinition, J as PresetHook, Jt as AnyRecord, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-BBsvQt7U.mjs";
 import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-C6yv4ZTW.mjs";
-import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-9_fuetB4.mjs";
-import { _ as HealthOptions, a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, g as HealthCheck, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$8, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$7, v as _default$3, y as healthPlugin } from "../versioning-DLwklPlG.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-g_f9omSc.mjs";
+import { C as healthPlugin, S as _default$3, _ as CachingRule, a as MetricsCollector, b as HealthCheck, c as metricsPlugin, d as _default$5, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$8, n as _default$9, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, x as HealthOptions, y as cachingPlugin } from "../versioning-D6PvCwpq.mjs";
 import { t as TracingOptions } from "../tracing-CsGKQJGg.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
@@ -163,7 +163,7 @@ declare function createRequestIdGenerator(opts?: Pick<RequestIdOptions, "header"
   headers: Record<string, string | string[] | undefined>;
 }) => string;
 declare const requestIdPlugin: FastifyPluginAsync<RequestIdOptions>;
-declare const _default$5: FastifyPluginAsync<RequestIdOptions>;
+declare const _default$6: FastifyPluginAsync<RequestIdOptions>;
 //#endregion
 //#region src/plugins/schedules.d.ts
 /**
@@ -236,6 +236,6 @@ declare module "fastify" {
   }
 }
 declare const schedulesPlugin: FastifyPluginAsync<SchedulesPluginOptions>;
-declare const _default$6: FastifyPluginAsync<SchedulesPluginOptions>;
+declare const _default$7: FastifyPluginAsync<SchedulesPluginOptions>;
 //#endregion
-export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type RequestIdOptions, type SSEOptions, type ScheduleDefinition, type ScheduleLockLike, type ScheduleStats, type SchedulesPluginOptions, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, _default$1 as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, _default$2 as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, _default$3 as healthPlugin, healthPlugin as healthPluginFn, _default$4 as metricsPlugin, metricsPlugin as metricsPluginFn, replyHelpersPlugin, _default$5 as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, _default$6 as schedulesPlugin, schedulesPlugin as schedulesPluginFn, _default$7 as ssePlugin, ssePlugin as ssePluginFn, _default$8 as versioningPlugin, versioningPlugin as versioningPluginFn };
+export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type ChangeOperation, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type RealtimeOptions, type RequestIdOptions, type SSEOptions, type ScheduleDefinition, type ScheduleLockLike, type ScheduleStats, type SchedulesPluginOptions, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, _default$1 as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, _default$2 as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, _default$3 as healthPlugin, healthPlugin as healthPluginFn, _default$4 as metricsPlugin, metricsPlugin as metricsPluginFn, _default$5 as realtimePlugin, realtimePlugin as realtimePluginFn, replyHelpersPlugin, _default$6 as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, _default$7 as schedulesPlugin, schedulesPlugin as schedulesPluginFn, _default$8 as ssePlugin, ssePlugin as ssePluginFn, _default$9 as versioningPlugin, versioningPlugin as versioningPluginFn };

package/dist/plugins/index.mjs

@@ -3,14 +3,15 @@ import { c as getOrgId } from "../types-bHblZ9YN.mjs";
 import { n as requestContext } from "../requestContext-BZKOr13H.mjs";
 import { t as hasEvents } from "../typeGuards-C9KXUly6.mjs";
 import { t as HookSystem } from "../HookSystem-C1vB_Gc9.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-7RnrEWNP.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-y9Hnypus.mjs";
 import { i as sanitizeRequestId, n as requestIdPlugin, r as requestId_default, t as createRequestIdGenerator } from "../requestId-5BhTVzBv.mjs";
 import { n as health_default, t as healthPlugin } from "../health-ScyjIVo5.mjs";
 import { n as caching_default, t as cachingPlugin } from "../caching-_NJeDd1_.mjs";
-import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-BTzXSwIg.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-Bq2OeEQL.mjs";
 import { n as metrics_default, t as metricsPlugin } from "../metrics-fdxI5mn_.mjs";
+import { n as realtime_default, t as realtimePlugin } from "../realtime-I8OrfnMR.mjs";
 import { t as replyHelpersPlugin } from "../replyHelpers-67tRawQZ.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-CfUjwjDk.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-0u4P4-OI.mjs";
 import { n as versioning_default, t as versioningPlugin } from "../versioning-Dk-71iIz.mjs";
 import fp from "fastify-plugin";
 //#region src/core/arcCorePlugin.ts
@@ -287,4 +288,4 @@ var schedules_default = fp(schedulesPlugin, {
 	fastify: "5.x"
 });
 //#endregion
-export { arcCorePlugin_default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, caching_default as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, gracefulShutdown_default as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, health_default as healthPlugin, healthPlugin as healthPluginFn, metrics_default as metricsPlugin, metricsPlugin as metricsPluginFn, replyHelpersPlugin, requestId_default as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, schedules_default as schedulesPlugin, schedulesPlugin as schedulesPluginFn, sse_default as ssePlugin, ssePlugin as ssePluginFn, versioning_default as versioningPlugin, versioningPlugin as versioningPluginFn };
+export { arcCorePlugin_default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, caching_default as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, gracefulShutdown_default as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, health_default as healthPlugin, healthPlugin as healthPluginFn, metrics_default as metricsPlugin, metricsPlugin as metricsPluginFn, realtime_default as realtimePlugin, realtimePlugin as realtimePluginFn, replyHelpersPlugin, requestId_default as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, schedules_default as schedulesPlugin, schedulesPlugin as schedulesPluginFn, sse_default as ssePlugin, ssePlugin as ssePluginFn, versioning_default as versioningPlugin, versioningPlugin as versioningPluginFn };

package/dist/plugins/tracing-entry.mjs

@@ -58,7 +58,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.22.0";
+	const resolvedVersion = serviceVersion ?? "2.23.0";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/presets/filesUpload.d.mts

@@ -1,4 +1,4 @@
-import { Y as PresetResult } from "../index-DbtgCOCj.mjs";
+import { Y as PresetResult } from "../index-BBsvQt7U.mjs";
 import { i as RequestScope } from "../types-DH0GupI7.mjs";
 import { t as PermissionCheck } from "../types-Csxga7d3.mjs";
 import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-DLUZ04kK.mjs";

package/dist/presets/filesUpload.mjs

@@ -1,6 +1,6 @@
 import { i as NotFoundError, u as ValidationError } from "../errors-DkO8Nk6-.mjs";
 import { c as getOrgId, g as getUserId } from "../types-bHblZ9YN.mjs";
-import { b as allowPublic, w as requireAuth } from "../permissions-BJMuKMl7.mjs";
+import { C as allowPublic, D as requireAuth } from "../permissions-tbxFHxjZ.mjs";
 import { t as multipartBody } from "../multipartBody-CHEQSZ6G.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";

package/dist/presets/index.d.mts

@@ -1,4 +1,4 @@
-import { Rt as IControllerResponse, U as ResourceConfig, Y as PresetResult, d as PaginationResult, qt as AnyRecord, zt as IRequestContext } from "../index-DbtgCOCj.mjs";
+import { Jt as AnyRecord, Rt as IControllerResponse, U as ResourceConfig, Y as PresetResult, d as PaginationResult, zt as IRequestContext } from "../index-BBsvQt7U.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";

package/dist/presets/index.mjs

@@ -1,5 +1,5 @@
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-gw0ciIUD.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-BOe4Ugkl.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,4 +1,4 @@
-import { X as CrudRouteKey, Y as PresetResult } from "../index-DbtgCOCj.mjs";
+import { X as CrudRouteKey, Y as PresetResult } from "../index-BBsvQt7U.mjs";
 //#region src/presets/multiTenant.d.ts
 /**
  * One tenant dimension for multi-field filtering. Discriminated by source:

package/dist/presets/search.d.mts

@@ -1,4 +1,4 @@
-import { At as RouteDefinition, Pt as ControllerHandler, Y as PresetResult, jt as RouteMcpConfig } from "../index-DbtgCOCj.mjs";
+import { At as RouteDefinition, Pt as ControllerHandler, Y as PresetResult, jt as RouteMcpConfig } from "../index-BBsvQt7U.mjs";
 import { t as PermissionCheck } from "../types-Csxga7d3.mjs";
 //#region src/presets/search.d.ts
 /**

package/dist/presets/search.mjs

@@ -1,4 +1,4 @@
-import { b as allowPublic, w as requireAuth } from "../permissions-BJMuKMl7.mjs";
+import { C as allowPublic, D as requireAuth } from "../permissions-tbxFHxjZ.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-gw0ciIUD.mjs → presets-BOe4Ugkl.mjs}

@@ -1,6 +1,6 @@
 import { b as isElevated, n as PUBLIC_SCOPE } from "./types-bHblZ9YN.mjs";
-import { E as requireRoles, b as allowPublic, w as requireAuth } from "./permissions-BJMuKMl7.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
+import { C as allowPublic, D as requireAuth, k as requireRoles } from "./permissions-tbxFHxjZ.mjs";
 //#region src/presets/ownedByUser.ts
 /**
 * Create ownership check middleware.