@classytic/arc 2.28.0 → 2.31.0

package/dist/{pipe-BOLmGIxa.mjs → pipe-DRDNsI2T.mjs}

@@ -1,4 +1,5 @@
-import { r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { r as ForbiddenError } from "./errors-Cj42AntO.mjs";
 //#region src/pipeline/pipe.ts
 /**
 * Compose pipeline steps into an ordered array.

package/dist/pipeline/index.d.mts

@@ -1,4 +1,5 @@
-import { Ct as PipelineStep, Rt as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-DPRH0Cme.mjs";
+
+import { Ct as PipelineStep, Rt as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-CpzxqePp.mjs";
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {
   operations?: OperationFilter;

package/dist/pipeline/index.mjs

@@ -1,4 +1,5 @@
-import { n as pipe, t as executePipeline } from "../pipe-BOLmGIxa.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { n as pipe, t as executePipeline } from "../pipe-DRDNsI2T.mjs";
 //#region src/pipeline/guard.ts
 /**
 * Create a named guard.

package/dist/{pipeline-BGRnV-To.mjs → pipeline-UPQFatit.mjs}

@@ -1,23 +1,10 @@
-import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
-import { b as isElevated, c as getOrgId, g as getUserId, n as PUBLIC_SCOPE, x as isMember } from "./types-CSyCxl2V.mjs";
-import { i as applyFieldReadPermissions, s as resolveEffectiveRoles } from "./applyPermissionResult-BnyVE9eD.mjs";
-import { t as executePipeline } from "./pipe-BOLmGIxa.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-ChYJ6CdK.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-Cys0ko9Z.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CB5Cuzk9.mjs";
+import { t as executePipeline } from "./pipe-DRDNsI2T.mjs";
+import { t as buildRequestScopeProjection } from "./projection-BHw6xlOQ.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";
-//#region src/scope/projection.ts
-/**
-* Compute the request-scope projection. Returns `undefined` when no
-* scope is attached (public / unscoped routes) so hosts can idiomatically
-* write `ctx.scope?.organizationId` without a double-null check.
-*/
-function buildRequestScopeProjection(scope) {
-	if (!scope) return void 0;
-	return {
-		organizationId: getOrgId(scope),
-		userId: getUserId(scope),
-		orgRoles: isMember(scope) ? scope.orgRoles : void 0
-	};
-}
-//#endregion
 //#region src/core/fastifyAdapter.ts
 /** Type guard for Mongoose-like documents with toObject() */
 function isMongooseDoc(obj) {
@@ -334,4 +321,4 @@ function buildActionPipelineHandler(handler, steps, operation, resourceName) {
 	};
 }
 //#endregion
-export { createFastifyHandler as a, getControllerScope as c, createCrudHandlers as i, sendControllerResponse as l, buildPipelineHandler as n, createRequestContext as o, resolvePipelineSteps as r, getControllerContext as s, buildActionPipelineHandler as t, buildRequestScopeProjection as u };
+export { createFastifyHandler as a, getControllerScope as c, createCrudHandlers as i, sendControllerResponse as l, buildPipelineHandler as n, createRequestContext as o, resolvePipelineSteps as r, getControllerContext as s, buildActionPipelineHandler as t };

package/dist/plugins/index.d.mts

@@ -1,10 +1,11 @@
-import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-DPRH0Cme.mjs";
-import { c as AnyRecord } from "../types-Dmw-6Qeo.mjs";
-import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-C6yv4ZTW.mjs";
-import { _ as _default$3, d as ScheduleStats, f as SchedulesPluginOptions, g as HealthOptions, h as HealthCheck, m as schedulesPlugin, p as _default$7, u as ScheduleDefinition, v as healthPlugin } from "../types-Cu6vVJmh.mjs";
-import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-OzYGIiU1.mjs";
-import { _ as CachingRule, a as MetricsCollector, c as metricsPlugin, d as _default$5, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$8, n as _default$9, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, y as cachingPlugin } from "../versioning-DXgY5BUm.mjs";
-import { t as TracingOptions } from "../tracing-CsGKQJGg.mjs";
+
+import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-CpzxqePp.mjs";
+import { l as AnyRecord } from "../types-B7XeLEgK.mjs";
+import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-CpYUJmPA.mjs";
+import { _ as _default$3, d as ScheduleStats, f as SchedulesPluginOptions, g as HealthOptions, h as HealthCheck, m as schedulesPlugin, p as _default$7, u as ScheduleDefinition, v as healthPlugin } from "../types-CBgvkp8O.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-zh0_AYHa.mjs";
+import { _ as CachingRule, a as MetricsCollector, c as metricsPlugin, d as _default$5, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$8, n as _default$9, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, y as cachingPlugin } from "../versioning-D_rhHfZm.mjs";
+import { t as TracingOptions } from "../tracing-Dro5eH6j.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
 //#region src/plugins/createPlugin.d.ts

package/dist/plugins/index.mjs

@@ -1,18 +1,19 @@
-import { p as MUTATION_OPERATIONS } from "../constants-DNre0wRg.mjs";
-import { c as getOrgId } from "../types-CSyCxl2V.mjs";
-import { n as requestContext } from "../requestContext-MrlJwECf.mjs";
-import { t as hasEvents } from "../typeGuards-C9KXUly6.mjs";
-import { t as HookSystem } from "../HookSystem-C1vB_Gc9.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-y9Hnypus.mjs";
-import { a as requestIdPlugin, i as createRequestIdGenerator, n as health_default, o as requestId_default, s as sanitizeRequestId, t as healthPlugin } from "../health-CB_m4S32.mjs";
-import { n as caching_default, t as cachingPlugin } from "../caching-_NJeDd1_.mjs";
-import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-Bq2OeEQL.mjs";
-import { n as metrics_default, t as metricsPlugin } from "../metrics-fdxI5mn_.mjs";
-import { n as realtime_default, t as realtimePlugin } from "../realtime-DEuDu9io.mjs";
-import { t as replyHelpersPlugin } from "../replyHelpers-67tRawQZ.mjs";
-import { n as schedules_default, t as schedulesPlugin } from "../schedules-CjOd2MG9.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-BQ1w0dfl.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-gKWyryT3.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { p as MUTATION_OPERATIONS } from "../constants-D3Dv4LAV.mjs";
+import { c as getOrgId } from "../types-Cys0ko9Z.mjs";
+import { n as requestContext } from "../requestContext-2TxXOJ7T.mjs";
+import { t as hasEvents } from "../typeGuards-B0ryPo3I.mjs";
+import { t as HookSystem } from "../HookSystem-BcmPyq5I.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-qq0mn2s9.mjs";
+import { a as requestIdPlugin, i as createRequestIdGenerator, n as health_default, o as requestId_default, s as sanitizeRequestId, t as healthPlugin } from "../health-DjZYjM7H.mjs";
+import { n as caching_default, t as cachingPlugin } from "../caching-BFHA6Scf.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-C5NeD6bT.mjs";
+import { n as metrics_default, t as metricsPlugin } from "../metrics-CUdw_wLB.mjs";
+import { n as realtime_default, t as realtimePlugin } from "../realtime-C5NoxWFY.mjs";
+import { t as replyHelpersPlugin } from "../replyHelpers-DIiZKGUt.mjs";
+import { n as schedules_default, t as schedulesPlugin } from "../schedules-DdtlICTf.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-CUTo9y0X.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-CHDTor3P.mjs";
 import fp from "fastify-plugin";
 //#region src/core/arcCorePlugin.ts
 const arcCorePlugin = async (fastify, opts = {}) => {

package/dist/plugins/response-cache.d.mts

@@ -1,3 +1,4 @@
+
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 //#region src/plugins/response-cache.d.ts
 interface ResponseCacheRule {

package/dist/plugins/response-cache.mjs

@@ -1,4 +1,5 @@
-import { t as hasEvents } from "../typeGuards-C9KXUly6.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as hasEvents } from "../typeGuards-B0ryPo3I.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/response-cache.ts
 /**

package/dist/plugins/tracing-entry.d.mts

@@ -1,2 +1,3 @@
-import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-CsGKQJGg.mjs";
+
+import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-Dro5eH6j.mjs";
 export { type TracingOptions, createSpan, isTracingAvailable, traced, _default as tracingPlugin };

package/dist/plugins/tracing-entry.mjs

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { createRequire } from "node:module";
 import fp from "fastify-plugin";
 //#region src/plugins/tracing.ts
@@ -58,7 +59,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.28.0";
+	const resolvedVersion = serviceVersion ?? "2.31.0";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/{pluralize-BhrgwZb9.mjs → pluralize-O0FZgESl.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 //#region src/utils/pluralize.ts
 /**
 * Lightweight English pluralization for the Arc CLI.

package/dist/{preloadResources-CM4uUaFv.d.mts → preloadResources-CyoJMSiO.d.mts}

@@ -1,16 +1,102 @@
-import { Wt as Authenticator } from "./index-DPRH0Cme.mjs";
-import { r as CacheStore } from "./interface-BGZCzOGL.mjs";
-import { n as ElevationOptions } from "./elevation-C9s5hFP_.mjs";
-import { a as EventTransport } from "./EventTransport-QmY7A258.mjs";
-import { t as ExternalOpenApiPaths } from "./externalPaths-BE6wFpYv.mjs";
-import { r as QueryCachePluginOptions } from "./queryCachePlugin-br4otiqF.mjs";
-import { t as ErrorHandlerOptions } from "./errorHandler-C6yv4ZTW.mjs";
-import { f as SchedulesPluginOptions, g as HealthOptions, n as ArcModuleInput, s as ResourceLike } from "./types-Cu6vVJmh.mjs";
-import "./index-CZY4EGga.mjs";
-import { t as EventPluginOptions } from "./eventPlugin-Bg3cP2_u.mjs";
-import { g as CachingOptions, o as MetricsOptions, p as SSEOptions, t as VersioningOptions, u as RealtimeOptions } from "./versioning-DXgY5BUm.mjs";
-import { r as IdempotencyStore } from "./interface-Uk8ONJv7.mjs";
+
+import { Gt as Authenticator } from "./index-CpzxqePp.mjs";
+import { r as CacheStore } from "./interface-BOk3YnTz.mjs";
+import { n as ElevationOptions } from "./elevation-BXCfVcNG.mjs";
+import { a as EventTransport } from "./EventTransport-2uVV34WU.mjs";
+import { t as ExternalOpenApiPaths } from "./externalPaths-CmGOxOtD.mjs";
+import { r as QueryCachePluginOptions } from "./queryCachePlugin-BzqxconG.mjs";
+import { t as ErrorHandlerOptions } from "./errorHandler-CpYUJmPA.mjs";
+import { f as SchedulesPluginOptions, g as HealthOptions, n as ArcModuleInput, s as ResourceLike } from "./types-CBgvkp8O.mjs";
+import "./index-CFThn1K9.mjs";
+import { t as EventPluginOptions } from "./eventPlugin-GF5nnBIq.mjs";
+import { g as CachingOptions, o as MetricsOptions, p as SSEOptions, t as VersioningOptions, u as RealtimeOptions } from "./versioning-D_rhHfZm.mjs";
+import { r as IdempotencyStore } from "./interface-DEWNOMza.mjs";
 import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, FastifyServerOptions } from "fastify";
+//#region src/factory/types/assets.d.ts
+/**
+ * How other origins may EMBED these bytes — the value of
+ * `Cross-Origin-Resource-Policy` for this prefix.
+ *
+ * - `same-site` (default) — `app.example.com` may embed assets served by
+ *   `api.example.com`; an unrelated site may not. The common deployment split.
+ * - `cross-origin` — ANY site may embed (and hotlink). Correct for genuinely
+ *   public, CDN-style assets; wrong for anything caller-specific.
+ * - `same-origin` — only the exact same origin. Arc's app-wide default; set it
+ *   per-root to keep a private prefix locked down.
+ */
+type AssetCrossOrigin = "same-origin" | "same-site" | "cross-origin";
+/** Cache posture for a prefix. See `CACHE_CONTROL` in `../assets.ts`. */
+type AssetCache = "immutable" | "revalidate" | "none";
+/** One static root mounted at one URL prefix. */
+interface AssetRoot {
+  /**
+   * URL prefix to serve from, e.g. `"/uploads"`. Must be unique across roots —
+   * a duplicate fails at boot rather than silently shadowing.
+   */
+  readonly prefix: string;
+  /** Filesystem directory (or directories) to serve. Passed to `@fastify/static`. */
+  readonly root: string | readonly string[] | URL | readonly URL[];
+  /**
+   * Who may embed these bytes cross-origin. Defaults to `"same-site"`.
+   * **This is the setting that unbreaks a separate-origin frontend** — arc's
+   * app-wide default (from helmet) is `same-origin`, which blocks the embed even
+   * when CORS is correct.
+   */
+  readonly crossOrigin?: AssetCrossOrigin;
+  /**
+   * Cache posture. Defaults to `"revalidate"` — safe for mutable paths, and
+   * cheap in practice because `ETag` turns the steady state into a 304.
+   *
+   * Use `"immutable"` ONLY for content-addressed filenames (a hash that changes
+   * with the bytes). On a mutable path it serves stale content for a year.
+   */
+  readonly cache?: AssetCache;
+  /**
+   * `Content-Disposition` type. Defaults to `"attachment"`.
+   *
+   * Keep the default for anything user-uploaded: serving untrusted content
+   * `inline` lets an uploaded `.svg`/`.html` execute on your origin with your
+   * cookies. `"inline"` is for trusted, transformed derivatives you produced.
+   */
+  readonly disposition?: "inline" | "attachment";
+  /**
+   * Serve `.br`/`.gz` siblings when the client accepts them. `@fastify/static`
+   * adds `Vary: Accept-Encoding` automatically.
+   *
+   * ⚠ `allowedPath` is evaluated against the REQUESTED path, before the variant
+   * is chosen — so denying `*.gz` does NOT prevent `/main.js` from serving
+   * `main.js.gz`. Treat pre-compressed files as public alternate encodings of the
+   * same asset; keep anything restricted out of the served root entirely.
+   */
+  readonly preCompressed?: boolean;
+  /**
+   * Per-request filter. Return `false` to fall through to the 404 handler.
+   *
+   * **Synchronous by contract** (it is `@fastify/static`'s signature), so an
+   * async permission check CANNOT run here. That makes it the right home for a
+   * SIGNED-URL check — HMAC verification is synchronous, needs no database, and
+   * stays CDN-cacheable. For an async gate, put a `preHandler` on the prefix
+   * instead.
+   */
+  readonly allowedPath?: (pathName: string, root: string, request: FastifyRequest) => boolean;
+  /** Extra headers, applied AFTER arc's policy so a host can override it. */
+  readonly setHeaders?: (reply: FastifyReply, filePath: string) => void;
+  /** Serve `index.html` for a directory request. Default `false`. */
+  readonly index?: string | readonly string[] | false;
+  /** Emit `ETag`. Default `true` — it is what makes `revalidate` cheap. */
+  readonly etag?: boolean;
+  /** Emit `Last-Modified`. Default `true`. */
+  readonly lastModified?: boolean;
+  /** Support byte ranges — audio/video seeking, resumable downloads. Default `true`. */
+  readonly acceptRanges?: boolean;
+  /**
+   * Let this root install the `reply.sendFile()` decorator. Default `false`
+   * because only ONE registration may decorate; set it on exactly one root if
+   * handlers need `reply.sendFile()`.
+   */
+  readonly decorateReply?: boolean;
+}
+//#endregion
 //#region src/factory/types/auth.d.ts
 /**
  * Arc's built-in JWT auth
@@ -576,6 +662,25 @@ interface CreateAppOptions {
   cors?: CorsOptions | false;
   /** Rate limiting. Set to false to disable. */
   rateLimit?: RateLimitOpts | false;
+  /**
+   * Static asset roots, each served by its own `@fastify/static` registration.
+   *
+   * Arc supplies POLICY (per-prefix `Cross-Origin-Resource-Policy`, cache preset,
+   * `Content-Disposition`) and delegates every transport mechanic — byte ranges,
+   * ETag/304, immutable directives, pre-compressed variants — to the plugin.
+   *
+   * ```ts
+   * assets: [{ prefix: "/uploads", root: "./var/uploads", crossOrigin: "same-site" }]
+   * ```
+   *
+   * **Why this exists:** arc's default security headers include
+   * `Cross-Origin-Resource-Policy: same-origin`, which makes a browser discard the
+   * response when a cross-origin document tries to embed it — even though the
+   * request returned 200 and CORS negotiated fine. A frontend on a different
+   * origin cannot render an uploaded image until CORP is relaxed for that prefix.
+   * Requires `@fastify/static`.
+   */
+  assets?: readonly AssetRoot[];
   /** Under pressure health monitoring. Set to false to disable. */
   underPressure?: UnderPressureOptions | false;
   /** @fastify/sensible (HTTP helpers). Set to false to disable. */

package/dist/{preloadResources-DSY5HGpS.mjs → preloadResources-Dz6BjzM6.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 //#region src/factory/preloadResources.ts
 /**
 * Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.

package/dist/presets/filesUpload.d.mts

@@ -1,7 +1,8 @@
-import { Y as PresetResult } from "../index-DPRH0Cme.mjs";
-import { i as RequestScope } from "../types-DjC-KUCz.mjs";
-import { t as PermissionCheck } from "../types-Dmw-6Qeo.mjs";
-import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-DLUZ04kK.mjs";
+
+import { Y as PresetResult } from "../index-CpzxqePp.mjs";
+import { i as RequestScope } from "../types-ChuShpCP.mjs";
+import { r as PermissionCheck } from "../types-B7XeLEgK.mjs";
+import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-Cx9Sz3Ou.mjs";
 //#region src/presets/filesUpload.d.ts
 interface FilesUploadPresetRoutes {
   upload?: boolean;
@@ -61,7 +62,7 @@ interface FilesUploadPresetOptions {
 /**
  * Create a files-upload preset bound to a `Storage` adapter.
  *
- * The preset uses `raw: true` routes so binary responses bypass arc's JSON
+ * The preset declares every route via `rawHandler` so binary responses bypass arc's JSON
  * envelope. Upload still returns the standard `{ success: true, data }`
  * envelope manually because the response is structured metadata, not bytes.
  */

package/dist/presets/filesUpload.mjs

@@ -1,7 +1,8 @@
-import { i as NotFoundError, u as ValidationError } from "../errors-DkO8Nk6-.mjs";
-import { c as getOrgId, g as getUserId } from "../types-CSyCxl2V.mjs";
-import { A as requireAuth, E as allowPublic } from "../permissions-BrtiBKGs.mjs";
-import { t as multipartBody } from "../multipartBody-D0eBvkeq.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-Cj42AntO.mjs";
+import { c as getOrgId, g as getUserId } from "../types-Cys0ko9Z.mjs";
+import { I as requireAuth, j as allowPublic } from "../permissions-L--QDAir.mjs";
+import { t as multipartBody } from "../multipartBody-wOgj_fnj.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";
 const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
@@ -187,7 +188,7 @@ function toNotFound(err, resource, id) {
 /**
 * Create a files-upload preset bound to a `Storage` adapter.
 *
-* The preset uses `raw: true` routes so binary responses bypass arc's JSON
+* The preset declares every route via `rawHandler` so binary responses bypass arc's JSON
 * envelope. Upload still returns the standard `{ success: true, data }`
 * envelope manually because the response is structured metadata, not bytes.
 */
@@ -222,8 +223,7 @@ function filesUploadPreset(options) {
 					allowedMimeTypes,
 					requiredFields: [deps.fieldName]
 				})],
-				raw: true,
-				handler: makeUploadHandler(deps)
+				rawHandler: makeUploadHandler(deps)
 			});
 			if (includeRoutes.read) routes.push({
 				method: "GET",
@@ -232,8 +232,7 @@ function filesUploadPreset(options) {
 				summary: "Download a file",
 				description: "Streams the stored bytes. Supports single-range `Range: bytes=start-end`.",
 				permissions: options.permissions?.read ?? permissions.get ?? allowPublic(),
-				raw: true,
-				handler: makeReadHandler(deps),
+				rawHandler: makeReadHandler(deps),
 				mcp: false
 			});
 			if (includeRoutes.delete) routes.push({
@@ -242,8 +241,7 @@ function filesUploadPreset(options) {
 				operation: "filesUpload.delete",
 				summary: "Delete a file",
 				permissions: options.permissions?.delete ?? permissions.delete ?? requireAuth(),
-				raw: true,
-				handler: makeDeleteHandler(deps)
+				rawHandler: makeDeleteHandler(deps)
 			});
 			return routes;
 		}

package/dist/presets/index.d.mts

@@ -1,11 +1,24 @@
-import { Rt as IControllerResponse, U as ResourceConfig, Y as PresetResult, d as PaginationResult, zt as IRequestContext } from "../index-DPRH0Cme.mjs";
-import { c as AnyRecord } from "../types-Dmw-6Qeo.mjs";
+
+import { Rt as IControllerResponse, U as ResourceConfig, Y as PresetResult, d as PaginationResult, zt as IRequestContext } from "../index-CpzxqePp.mjs";
+import { l as AnyRecord } from "../types-B7XeLEgK.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";
 //#region src/presets/ownedByUser.d.ts
 interface OwnedByUserOptions {
   ownerField?: string;
+  /**
+   * What to do when a target record has NO value in `ownerField` (legacy /
+   * unowned records).
+   *
+   * - `"deny"` (default): fail closed — an unowned record is NOT modifiable
+   *   through an ownership-gated route. This is the secure default; ownership
+   *   that silently passes for records missing the owner is not an ownership
+   *   primitive.
+   * - `"allow"`: legacy compatibility — permit modifying records that predate
+   *   the owner field. Visibly unsafe; opt in only for a bounded migration.
+   */
+  missingOwner?: "deny" | "allow";
 }
 declare function ownedByUserPreset(options?: OwnedByUserOptions): PresetResult;
 //#endregion

package/dist/presets/index.mjs

@@ -1,5 +1,6 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-DwFDVKP0.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-C4-g4_4P.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,4 +1,5 @@
-import { X as CrudRouteKey, Y as PresetResult } from "../index-DPRH0Cme.mjs";
+
+import { X as CrudRouteKey, Y as PresetResult } from "../index-CpzxqePp.mjs";
 //#region src/presets/multiTenant.d.ts
 /**
  * One tenant dimension for multi-field filtering. Discriminated by source:

package/dist/presets/multiTenant.mjs

@@ -1,5 +1,6 @@
-import "../constants-DNre0wRg.mjs";
-import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-CSyCxl2V.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import "../constants-D3Dv4LAV.mjs";
+import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-Cys0ko9Z.mjs";
 //#region src/presets/multiTenant.ts
 /**
 * Resolve a single TenantFieldSpec against the current scope.

package/dist/presets/search.d.mts

@@ -1,5 +1,6 @@
-import { At as RouteDefinition, Pt as ControllerHandler, Y as PresetResult, jt as RouteMcpConfig } from "../index-DPRH0Cme.mjs";
-import { t as PermissionCheck } from "../types-Dmw-6Qeo.mjs";
+
+import { At as RouteDefinition, Pt as ControllerHandler, Y as PresetResult, jt as RouteMcpConfig } from "../index-CpzxqePp.mjs";
+import { r as PermissionCheck } from "../types-B7XeLEgK.mjs";
 //#region src/presets/search.d.ts
 /**
  * Search Preset — backend-agnostic search / vector / embed routes

package/dist/presets/search.mjs

@@ -1,4 +1,5 @@
-import { A as requireAuth, E as allowPublic } from "../permissions-BrtiBKGs.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { I as requireAuth, j as allowPublic } from "../permissions-L--QDAir.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-DwFDVKP0.mjs → presets-C4-g4_4P.mjs}

@@ -1,29 +1,41 @@
-import { b as isElevated, n as PUBLIC_SCOPE } from "./types-CSyCxl2V.mjs";
-import { A as requireAuth, E as allowPublic, M as requireRoles } from "./permissions-BrtiBKGs.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { l as UnauthorizedError } from "./errors-Cj42AntO.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE } from "./types-Cys0ko9Z.mjs";
+import { I as requireAuth, j as allowPublic, z as requireRoles } from "./permissions-L--QDAir.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
 //#region src/presets/ownedByUser.ts
 /**
 * Create ownership check middleware.
-* Elevated scope (platform admin) bypasses ownership checks.
+*
+* FAIL-CLOSED: ownership is meaningless without an authenticated identity, so a
+* request with no user (or a user with no id) is DENIED here rather than sliding
+* through with no ownership check installed. Elevated scope (platform admin)
+* bypasses the check by design.
 */
-function createOwnershipCheck(ownerField) {
+function createOwnershipCheck(ownerField, missingOwner) {
 	return async (request, _reply) => {
-		const user = request.user;
-		if (!user) return;
 		if (isElevated(request.scope ?? PUBLIC_SCOPE)) return;
+		const user = request.user;
+		if (!user) throw new UnauthorizedError("Authentication required for this operation");
 		const userWithId = user;
 		const userId = userWithId._id ?? userWithId.id;
-		if (userId) request._ownershipCheck = {
+		if (!userId) throw new UnauthorizedError("Authenticated identity has no usable id");
+		request._ownershipCheck = {
 			field: ownerField,
-			userId
+			userId,
+			missingOwner
 		};
 	};
 }
 function ownedByUserPreset(options = {}) {
-	const { ownerField = "userId" } = options;
-	const ownershipMiddleware = createOwnershipCheck(ownerField);
+	const { ownerField = "userId", missingOwner = "deny" } = options;
+	const ownershipMiddleware = createOwnershipCheck(ownerField, missingOwner);
 	return {
 		name: "ownedByUser",
+		permissions: {
+			update: requireAuth(),
+			delete: requireAuth()
+		},
 		middlewares: {
 			update: [ownershipMiddleware],
 			delete: [ownershipMiddleware]
@@ -366,6 +378,11 @@ function mergePreset(config, preset) {
 			result.middlewares[key] = [...result.middlewares[key] ?? [], ...mws ?? []];
 		}
 	}
+	if (preset.permissions) {
+		const merged = { ...result.permissions };
+		for (const [op, check] of Object.entries(preset.permissions)) if (merged[op] === void 0 && check !== void 0) merged[op] = check;
+		result.permissions = merged;
+	}
 	if (preset.schemaOptions) result.schemaOptions = {
 		...result.schemaOptions,
 		...preset.schemaOptions,

package/dist/projection-BHw6xlOQ.mjs

@@ -0,0 +1,18 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { c as getOrgId, g as getUserId, x as isMember } from "./types-Cys0ko9Z.mjs";
+//#region src/scope/projection.ts
+/**
+* Compute the request-scope projection. Returns `undefined` when no
+* scope is attached (public / unscoped routes) so hosts can idiomatically
+* write `ctx.scope?.organizationId` without a double-null check.
+*/
+function buildRequestScopeProjection(scope) {
+	if (!scope) return void 0;
+	return {
+		organizationId: getOrgId(scope),
+		userId: getUserId(scope),
+		orgRoles: isMember(scope) ? scope.orgRoles : void 0
+	};
+}
+//#endregion
+export { buildRequestScopeProjection as t };

package/dist/{pushref-registry-BbcnpNTm.d.mts → pushref-registry-Dov9l4qE.d.mts}

@@ -1,3 +1,4 @@
+
 //#region src/integrations/websocket/dead-queue.d.ts
 /**
  * Per-connection dead queue — ring buffer holding the last N outbound

package/dist/{queryCachePlugin-DSGuSVLW.mjs → queryCachePlugin-BZr8v46E.mjs}

@@ -1,7 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
-import { i as versionKey, r as tagVersionKey } from "./keys-Cd316u_y.mjs";
-import { t as MemoryCacheStore } from "./memory-CmnzXE5Z.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
+import { t as hasEvents } from "./typeGuards-B0ryPo3I.mjs";
+import { i as versionKey, r as tagVersionKey } from "./keys-C0_pa1tY.mjs";
+import { t as MemoryCacheStore } from "./memory-DR6wpa9F.mjs";
 import fp from "fastify-plugin";
 //#region src/cache/QueryCache.ts
 var QueryCache = class {

package/dist/{queryCachePlugin-br4otiqF.d.mts → queryCachePlugin-BzqxconG.d.mts}

@@ -1,5 +1,6 @@
-import { r as CacheStore } from "./interface-BGZCzOGL.mjs";
-import { i as QueryCache } from "./QueryCache-DOMT_iq7.mjs";
+
+import { r as CacheStore } from "./interface-BOk3YnTz.mjs";
+import { i as QueryCache } from "./QueryCache-DFA-QrU9.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/cache/queryCachePlugin.d.ts
 interface QueryCachePluginOptions {

package/dist/{rateLimit-DrED-C4v.mjs → rateLimit-CMPY5Qms.mjs}

@@ -1,4 +1,5 @@
-import { n as requestContext } from "./requestContext-MrlJwECf.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { n as requestContext } from "./requestContext-2TxXOJ7T.mjs";
 //#region src/core/middlewares/arcDecorator.ts
 /**
 * Build the `arcDecorator` preHandler for a resource.
@@ -211,6 +212,7 @@ function resolveRouterPluginMw(fastify, resourceHasQueryCache) {
 * Build the per-route Fastify `config` object shared by the CRUD, custom, and
 * action routers. Two independent concerns ride on `routeOptions.config`:
 *   - `config.rateLimit`     — read by `@fastify/rate-limit`.
+*   - `config.cors`          — read by `@fastify/cors` as a per-route override.
 *   - `config.arcExtensions` — read by arc plugins (encryption, …) at request
 *     time, sourced from `defineResource({ extensions })`.
 *
@@ -218,10 +220,12 @@ function resolveRouterPluginMw(fastify, resourceHasQueryCache) {
 * either stay config-free and the spread is a genuine no-op. Both fields are
 * optional in the return type, so no cast is needed when only one is set.
 */
-function buildRouteConfig(rateLimitConfig, extensions) {
-	if (!rateLimitConfig && !extensions) return {};
+function buildRouteConfig(rateLimitConfig, extensions, cors) {
+	const hasCors = cors !== void 0;
+	if (!rateLimitConfig && !extensions && !hasCors) return {};
 	return { config: {
 		...rateLimitConfig ?? {},
+		...hasCors ? { cors } : {},
 		...extensions ? { arcExtensions: extensions } : {}
 	} };
 }

package/dist/{rateLimitKey-BoWRH3e7.mjs → rateLimitKey-Dn5JNmkj.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 //#region src/scope/rateLimitKey.ts
 function createTenantKeyGenerator(opts) {
 	if (opts?.strategy) return opts.strategy;