@classytic/arc 2.30.0 → 2.32.0

package/dist/plugins/response-cache.d.mts

@@ -1,3 +1,4 @@
+
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 //#region src/plugins/response-cache.d.ts
 interface ResponseCacheRule {

package/dist/plugins/response-cache.mjs

@@ -1,4 +1,5 @@
-import { t as hasEvents } from "../typeGuards-C9KXUly6.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as hasEvents } from "../typeGuards-B_5-hKjJ.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/response-cache.ts
 /**

package/dist/plugins/tracing-entry.d.mts

@@ -1,2 +1,3 @@
-import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-CsGKQJGg.mjs";
+
+import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-Dro5eH6j.mjs";
 export { type TracingOptions, createSpan, isTracingAvailable, traced, _default as tracingPlugin };

package/dist/plugins/tracing-entry.mjs

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { createRequire } from "node:module";
 import fp from "fastify-plugin";
 //#region src/plugins/tracing.ts
@@ -58,7 +59,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.30.0";
+	const resolvedVersion = serviceVersion ?? "2.32.0";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/{pluralize-BhrgwZb9.mjs → pluralize-C2ZkKbsn.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/utils/pluralize.ts
 /**
 * Lightweight English pluralization for the Arc CLI.

package/dist/{preloadResources-DSY5HGpS.mjs → preloadResources-CDs87fTw.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/factory/preloadResources.ts
 /**
 * Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.

package/dist/{preloadResources-DCfa2egz.d.mts → preloadResources-T1hmlTEZ.d.mts}

@@ -1,16 +1,102 @@
-import { Wt as Authenticator } from "./index-Q5gzEIWY.mjs";
-import { r as CacheStore } from "./interface-BGZCzOGL.mjs";
-import { n as ElevationOptions } from "./elevation-C9s5hFP_.mjs";
-import { a as EventTransport } from "./EventTransport-QmY7A258.mjs";
-import { t as ExternalOpenApiPaths } from "./externalPaths-BE6wFpYv.mjs";
-import { r as QueryCachePluginOptions } from "./queryCachePlugin-br4otiqF.mjs";
-import { t as ErrorHandlerOptions } from "./errorHandler-C6yv4ZTW.mjs";
-import { f as SchedulesPluginOptions, g as HealthOptions, n as ArcModuleInput, s as ResourceLike } from "./types-D_n8L6VY.mjs";
-import "./index-CCzVR-N3.mjs";
-import { t as EventPluginOptions } from "./eventPlugin-Bg3cP2_u.mjs";
-import { g as CachingOptions, o as MetricsOptions, p as SSEOptions, t as VersioningOptions, u as RealtimeOptions } from "./versioning-DXgY5BUm.mjs";
-import { r as IdempotencyStore } from "./interface-Uk8ONJv7.mjs";
+
+import { Gt as Authenticator } from "./index-CpzxqePp.mjs";
+import { r as CacheStore } from "./interface-BOk3YnTz.mjs";
+import { n as ElevationOptions } from "./elevation-BXCfVcNG.mjs";
+import { a as EventTransport } from "./EventTransport-2uVV34WU.mjs";
+import { t as ExternalOpenApiPaths } from "./externalPaths-CmGOxOtD.mjs";
+import { r as QueryCachePluginOptions } from "./queryCachePlugin-BzqxconG.mjs";
+import { t as ErrorHandlerOptions } from "./errorHandler-CpYUJmPA.mjs";
+import { l as ResourceLike, m as SchedulesPluginOptions, n as ArcModuleInput, v as HealthOptions } from "./types-CT5vu6M0.mjs";
+import "./index-ZWhLTp_s.mjs";
+import { t as EventPluginOptions } from "./eventPlugin-GF5nnBIq.mjs";
+import { g as CachingOptions, o as MetricsOptions, p as SSEOptions, t as VersioningOptions, u as RealtimeOptions } from "./versioning-D_rhHfZm.mjs";
+import { r as IdempotencyStore } from "./interface-DEWNOMza.mjs";
 import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, FastifyServerOptions } from "fastify";
+//#region src/factory/types/assets.d.ts
+/**
+ * How other origins may EMBED these bytes — the value of
+ * `Cross-Origin-Resource-Policy` for this prefix.
+ *
+ * - `same-site` (default) — `app.example.com` may embed assets served by
+ *   `api.example.com`; an unrelated site may not. The common deployment split.
+ * - `cross-origin` — ANY site may embed (and hotlink). Correct for genuinely
+ *   public, CDN-style assets; wrong for anything caller-specific.
+ * - `same-origin` — only the exact same origin. Arc's app-wide default; set it
+ *   per-root to keep a private prefix locked down.
+ */
+type AssetCrossOrigin = "same-origin" | "same-site" | "cross-origin";
+/** Cache posture for a prefix. See `CACHE_CONTROL` in `../assets.ts`. */
+type AssetCache = "immutable" | "revalidate" | "none";
+/** One static root mounted at one URL prefix. */
+interface AssetRoot {
+  /**
+   * URL prefix to serve from, e.g. `"/uploads"`. Must be unique across roots —
+   * a duplicate fails at boot rather than silently shadowing.
+   */
+  readonly prefix: string;
+  /** Filesystem directory (or directories) to serve. Passed to `@fastify/static`. */
+  readonly root: string | readonly string[] | URL | readonly URL[];
+  /**
+   * Who may embed these bytes cross-origin. Defaults to `"same-site"`.
+   * **This is the setting that unbreaks a separate-origin frontend** — arc's
+   * app-wide default (from helmet) is `same-origin`, which blocks the embed even
+   * when CORS is correct.
+   */
+  readonly crossOrigin?: AssetCrossOrigin;
+  /**
+   * Cache posture. Defaults to `"revalidate"` — safe for mutable paths, and
+   * cheap in practice because `ETag` turns the steady state into a 304.
+   *
+   * Use `"immutable"` ONLY for content-addressed filenames (a hash that changes
+   * with the bytes). On a mutable path it serves stale content for a year.
+   */
+  readonly cache?: AssetCache;
+  /**
+   * `Content-Disposition` type. Defaults to `"attachment"`.
+   *
+   * Keep the default for anything user-uploaded: serving untrusted content
+   * `inline` lets an uploaded `.svg`/`.html` execute on your origin with your
+   * cookies. `"inline"` is for trusted, transformed derivatives you produced.
+   */
+  readonly disposition?: "inline" | "attachment";
+  /**
+   * Serve `.br`/`.gz` siblings when the client accepts them. `@fastify/static`
+   * adds `Vary: Accept-Encoding` automatically.
+   *
+   * ⚠ `allowedPath` is evaluated against the REQUESTED path, before the variant
+   * is chosen — so denying `*.gz` does NOT prevent `/main.js` from serving
+   * `main.js.gz`. Treat pre-compressed files as public alternate encodings of the
+   * same asset; keep anything restricted out of the served root entirely.
+   */
+  readonly preCompressed?: boolean;
+  /**
+   * Per-request filter. Return `false` to fall through to the 404 handler.
+   *
+   * **Synchronous by contract** (it is `@fastify/static`'s signature), so an
+   * async permission check CANNOT run here. That makes it the right home for a
+   * SIGNED-URL check — HMAC verification is synchronous, needs no database, and
+   * stays CDN-cacheable. For an async gate, put a `preHandler` on the prefix
+   * instead.
+   */
+  readonly allowedPath?: (pathName: string, root: string, request: FastifyRequest) => boolean;
+  /** Extra headers, applied AFTER arc's policy so a host can override it. */
+  readonly setHeaders?: (reply: FastifyReply, filePath: string) => void;
+  /** Serve `index.html` for a directory request. Default `false`. */
+  readonly index?: string | readonly string[] | false;
+  /** Emit `ETag`. Default `true` — it is what makes `revalidate` cheap. */
+  readonly etag?: boolean;
+  /** Emit `Last-Modified`. Default `true`. */
+  readonly lastModified?: boolean;
+  /** Support byte ranges — audio/video seeking, resumable downloads. Default `true`. */
+  readonly acceptRanges?: boolean;
+  /**
+   * Let this root install the `reply.sendFile()` decorator. Default `false`
+   * because only ONE registration may decorate; set it on exactly one root if
+   * handlers need `reply.sendFile()`.
+   */
+  readonly decorateReply?: boolean;
+}
+//#endregion
 //#region src/factory/types/auth.d.ts
 /**
  * Arc's built-in JWT auth
@@ -576,6 +662,25 @@ interface CreateAppOptions {
   cors?: CorsOptions | false;
   /** Rate limiting. Set to false to disable. */
   rateLimit?: RateLimitOpts | false;
+  /**
+   * Static asset roots, each served by its own `@fastify/static` registration.
+   *
+   * Arc supplies POLICY (per-prefix `Cross-Origin-Resource-Policy`, cache preset,
+   * `Content-Disposition`) and delegates every transport mechanic — byte ranges,
+   * ETag/304, immutable directives, pre-compressed variants — to the plugin.
+   *
+   * ```ts
+   * assets: [{ prefix: "/uploads", root: "./var/uploads", crossOrigin: "same-site" }]
+   * ```
+   *
+   * **Why this exists:** arc's default security headers include
+   * `Cross-Origin-Resource-Policy: same-origin`, which makes a browser discard the
+   * response when a cross-origin document tries to embed it — even though the
+   * request returned 200 and CORS negotiated fine. A frontend on a different
+   * origin cannot render an uploaded image until CORP is relaxed for that prefix.
+   * Requires `@fastify/static`.
+   */
+  assets?: readonly AssetRoot[];
   /** Under pressure health monitoring. Set to false to disable. */
   underPressure?: UnderPressureOptions | false;
   /** @fastify/sensible (HTTP helpers). Set to false to disable. */

package/dist/presets/filesUpload.d.mts

@@ -1,7 +1,8 @@
-import { Y as PresetResult } from "../index-Q5gzEIWY.mjs";
-import { i as RequestScope } from "../types-DjC-KUCz.mjs";
-import { r as PermissionCheck } from "../types-ChvvVNP8.mjs";
-import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-DLUZ04kK.mjs";
+
+import { Y as PresetResult } from "../index-CpzxqePp.mjs";
+import { i as RequestScope } from "../types-ChuShpCP.mjs";
+import { r as PermissionCheck } from "../types-B7XeLEgK.mjs";
+import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-Cx9Sz3Ou.mjs";
 //#region src/presets/filesUpload.d.ts
 interface FilesUploadPresetRoutes {
   upload?: boolean;
@@ -61,7 +62,7 @@ interface FilesUploadPresetOptions {
 /**
  * Create a files-upload preset bound to a `Storage` adapter.
  *
- * The preset uses `raw: true` routes so binary responses bypass arc's JSON
+ * The preset declares every route via `rawHandler` so binary responses bypass arc's JSON
  * envelope. Upload still returns the standard `{ success: true, data }`
  * envelope manually because the response is structured metadata, not bytes.
  */

package/dist/presets/filesUpload.mjs

@@ -1,10 +1,11 @@
-import { i as NotFoundError, u as ValidationError } from "../errors-DkO8Nk6-.mjs";
-import { c as getOrgId, g as getUserId } from "../types-CSyCxl2V.mjs";
-import { I as requireAuth, j as allowPublic } from "../permissions-Bfu_8y1U.mjs";
-import { t as multipartBody } from "../multipartBody-D0eBvkeq.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-Bh1KK5ps.mjs";
+import { c as getOrgId, g as getUserId } from "../types-DXYX7dIR.mjs";
+import { B as requireAuth, F as allowPublic } from "../permissions-Dl_m0NCe.mjs";
+import { t as multipartBody } from "../multipartBody-BnkBLN7v.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";
-const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
+const DEFAULT_MAX_FILE_SIZE = 10485760;
 function defaultContextFrom(scope) {
 	if (!scope) return {};
 	const userId = getUserId(scope);
@@ -187,7 +188,7 @@ function toNotFound(err, resource, id) {
 /**
 * Create a files-upload preset bound to a `Storage` adapter.
 *
-* The preset uses `raw: true` routes so binary responses bypass arc's JSON
+* The preset declares every route via `rawHandler` so binary responses bypass arc's JSON
 * envelope. Upload still returns the standard `{ success: true, data }`
 * envelope manually because the response is structured metadata, not bytes.
 */
@@ -222,8 +223,7 @@ function filesUploadPreset(options) {
 					allowedMimeTypes,
 					requiredFields: [deps.fieldName]
 				})],
-				raw: true,
-				handler: makeUploadHandler(deps)
+				rawHandler: makeUploadHandler(deps)
 			});
 			if (includeRoutes.read) routes.push({
 				method: "GET",
@@ -232,8 +232,7 @@ function filesUploadPreset(options) {
 				summary: "Download a file",
 				description: "Streams the stored bytes. Supports single-range `Range: bytes=start-end`.",
 				permissions: options.permissions?.read ?? permissions.get ?? allowPublic(),
-				raw: true,
-				handler: makeReadHandler(deps),
+				rawHandler: makeReadHandler(deps),
 				mcp: false
 			});
 			if (includeRoutes.delete) routes.push({
@@ -242,8 +241,7 @@ function filesUploadPreset(options) {
 				operation: "filesUpload.delete",
 				summary: "Delete a file",
 				permissions: options.permissions?.delete ?? permissions.delete ?? requireAuth(),
-				raw: true,
-				handler: makeDeleteHandler(deps)
+				rawHandler: makeDeleteHandler(deps)
 			});
 			return routes;
 		}

package/dist/presets/index.d.mts

@@ -1,5 +1,6 @@
-import { Rt as IControllerResponse, U as ResourceConfig, Y as PresetResult, d as PaginationResult, zt as IRequestContext } from "../index-Q5gzEIWY.mjs";
-import { l as AnyRecord } from "../types-ChvvVNP8.mjs";
+
+import { Rt as IControllerResponse, U as ResourceConfig, Y as PresetResult, d as PaginationResult, zt as IRequestContext } from "../index-CpzxqePp.mjs";
+import { l as AnyRecord } from "../types-B7XeLEgK.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";

package/dist/presets/index.mjs

@@ -1,5 +1,6 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-CJOEXLuk.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-Dntd_pUO.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,4 +1,5 @@
-import { X as CrudRouteKey, Y as PresetResult } from "../index-Q5gzEIWY.mjs";
+
+import { X as CrudRouteKey, Y as PresetResult } from "../index-CpzxqePp.mjs";
 //#region src/presets/multiTenant.d.ts
 /**
  * One tenant dimension for multi-field filtering. Discriminated by source:

package/dist/presets/multiTenant.mjs

@@ -1,5 +1,6 @@
-import "../constants-DNre0wRg.mjs";
-import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-CSyCxl2V.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import "../constants-J99LGTJI.mjs";
+import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-DXYX7dIR.mjs";
 //#region src/presets/multiTenant.ts
 /**
 * Resolve a single TenantFieldSpec against the current scope.

package/dist/presets/search.d.mts

@@ -1,5 +1,6 @@
-import { At as RouteDefinition, Pt as ControllerHandler, Y as PresetResult, jt as RouteMcpConfig } from "../index-Q5gzEIWY.mjs";
-import { r as PermissionCheck } from "../types-ChvvVNP8.mjs";
+
+import { At as RouteDefinition, Pt as ControllerHandler, Y as PresetResult, jt as RouteMcpConfig } from "../index-CpzxqePp.mjs";
+import { r as PermissionCheck } from "../types-B7XeLEgK.mjs";
 //#region src/presets/search.d.ts
 /**
  * Search Preset — backend-agnostic search / vector / embed routes

package/dist/presets/search.mjs

@@ -1,4 +1,5 @@
-import { I as requireAuth, j as allowPublic } from "../permissions-Bfu_8y1U.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { B as requireAuth, F as allowPublic } from "../permissions-Dl_m0NCe.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-CJOEXLuk.mjs → presets-Dntd_pUO.mjs}

@@ -1,6 +1,7 @@
-import { l as UnauthorizedError } from "./errors-DkO8Nk6-.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE } from "./types-CSyCxl2V.mjs";
-import { I as requireAuth, R as requireRoles, j as allowPublic } from "./permissions-Bfu_8y1U.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { l as UnauthorizedError } from "./errors-Bh1KK5ps.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE } from "./types-DXYX7dIR.mjs";
+import { B as requireAuth, F as allowPublic, U as requireRoles } from "./permissions-Dl_m0NCe.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
 //#region src/presets/ownedByUser.ts
 /**
@@ -13,7 +14,8 @@ import { multiTenantPreset } from "./presets/multiTenant.mjs";
 */
 function createOwnershipCheck(ownerField, missingOwner) {
 	return async (request, _reply) => {
-		if (isElevated(request.scope ?? PUBLIC_SCOPE)) return;
+		const scope = request.scope ?? PUBLIC_SCOPE;
+		if (isElevated(scope)) return;
 		const user = request.user;
 		if (!user) throw new UnauthorizedError("Authentication required for this operation");
 		const userWithId = user;

package/dist/{projection-UBDgfMwu.mjs → projection-CjHhM5W1.mjs}

@@ -1,4 +1,5 @@
-import { c as getOrgId, g as getUserId, x as isMember } from "./types-CSyCxl2V.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { c as getOrgId, g as getUserId, x as isMember } from "./types-DXYX7dIR.mjs";
 //#region src/scope/projection.ts
 /**
 * Compute the request-scope projection. Returns `undefined` when no

package/dist/{pushref-registry-BbcnpNTm.d.mts → pushref-registry-Dov9l4qE.d.mts}

@@ -1,3 +1,4 @@
+
 //#region src/integrations/websocket/dead-queue.d.ts
 /**
  * Per-connection dead queue — ring buffer holding the last N outbound

package/dist/{queryCachePlugin-br4otiqF.d.mts → queryCachePlugin-BzqxconG.d.mts}

@@ -1,5 +1,6 @@
-import { r as CacheStore } from "./interface-BGZCzOGL.mjs";
-import { i as QueryCache } from "./QueryCache-DOMT_iq7.mjs";
+
+import { r as CacheStore } from "./interface-BOk3YnTz.mjs";
+import { i as QueryCache } from "./QueryCache-DFA-QrU9.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/cache/queryCachePlugin.d.ts
 interface QueryCachePluginOptions {

package/dist/{queryCachePlugin-DSGuSVLW.mjs → queryCachePlugin-Dhps-Ldt.mjs}

@@ -1,7 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
-import { i as versionKey, r as tagVersionKey } from "./keys-Cd316u_y.mjs";
-import { t as MemoryCacheStore } from "./memory-CmnzXE5Z.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
+import { t as hasEvents } from "./typeGuards-B_5-hKjJ.mjs";
+import { i as versionKey, r as tagVersionKey } from "./keys-B-HBTGXl.mjs";
+import { t as MemoryCacheStore } from "./memory-DsuWnj4T.mjs";
 import fp from "fastify-plugin";
 //#region src/cache/QueryCache.ts
 var QueryCache = class {
@@ -99,7 +100,7 @@ var QueryCache = class {
 	}
 };
 /** See `bumpVersion` — effectively non-expiring, refreshed on every bump. */
-const VERSION_TTL_SECONDS = 365 * 24 * 60 * 60;
+const VERSION_TTL_SECONDS = 31536e3;
 //#endregion
 //#region src/cache/queryCachePlugin.ts
 var queryCachePlugin_exports = /* @__PURE__ */ __exportAll({ queryCachePlugin: () => queryCachePlugin });

package/dist/{rateLimit-DrED-C4v.mjs → rateLimit-C7mmAGs3.mjs}

@@ -1,4 +1,5 @@
-import { n as requestContext } from "./requestContext-MrlJwECf.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { n as requestContext } from "./requestContext-B6vQF-sy.mjs";
 //#region src/core/middlewares/arcDecorator.ts
 /**
 * Build the `arcDecorator` preHandler for a resource.
@@ -211,6 +212,7 @@ function resolveRouterPluginMw(fastify, resourceHasQueryCache) {
 * Build the per-route Fastify `config` object shared by the CRUD, custom, and
 * action routers. Two independent concerns ride on `routeOptions.config`:
 *   - `config.rateLimit`     — read by `@fastify/rate-limit`.
+*   - `config.cors`          — read by `@fastify/cors` as a per-route override.
 *   - `config.arcExtensions` — read by arc plugins (encryption, …) at request
 *     time, sourced from `defineResource({ extensions })`.
 *
@@ -218,10 +220,12 @@ function resolveRouterPluginMw(fastify, resourceHasQueryCache) {
 * either stay config-free and the spread is a genuine no-op. Both fields are
 * optional in the return type, so no cast is needed when only one is set.
 */
-function buildRouteConfig(rateLimitConfig, extensions) {
-	if (!rateLimitConfig && !extensions) return {};
+function buildRouteConfig(rateLimitConfig, extensions, cors) {
+	const hasCors = cors !== void 0;
+	if (!rateLimitConfig && !extensions && !hasCors) return {};
 	return { config: {
 		...rateLimitConfig ?? {},
+		...hasCors ? { cors } : {},
 		...extensions ? { arcExtensions: extensions } : {}
 	} };
 }

package/dist/{rateLimitKey-BoWRH3e7.mjs → rateLimitKey-CccEFBfk.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/scope/rateLimitKey.ts
 function createTenantKeyGenerator(opts) {
 	if (opts?.strategy) return opts.strategy;

package/dist/{realtime-B9nmIY5V.mjs → realtime-DVvVZZFz.mjs}

@@ -1,15 +1,17 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
-import { c as getOrgId } from "./types-CSyCxl2V.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cg05HPsn.mjs";
-import { r as evaluateAndApplyPermission } from "./applyPermissionResult-Cf6zUCvb.mjs";
-import { t as applyFieldReadPermissions } from "./fields-CQ_7KQWw.mjs";
-import { a as promoteStreamTokenToHeader } from "./streaming-BQcW6_Kq.mjs";
-import { t as openSseStream } from "./sseStream-BQ7Qaynp.mjs";
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-__T3EJDA.mjs";
+import { n as getUserRoles } from "./userHelpers-BNsOXzOd.mjs";
+import { c as getOrgId } from "./types-DXYX7dIR.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-C4KiMWUa.mjs";
+import { t as applyFieldReadPermissions } from "./fields-DEi65pGj.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-DPZdQmDz.mjs";
+import { t as openSseStream } from "./sseStream-B3zb_d1h.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/realtime.ts
 var realtime_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_MAX_CONNECTION_MS: () => DEFAULT_MAX_CONNECTION_MS,
 	buildChangeFrame: () => buildChangeFrame,
 	connectionDeadlineMs: () => connectionDeadlineMs,
 	default: () => realtime_default,
@@ -38,6 +40,15 @@ const MAX_MULTIPLEX_RESOURCES = 20;
 /** Node's `setTimeout` ceiling (~24.8 days); larger delays fire immediately. */
 const MAX_TIMER_MS = 2147483647;
 /**
+* Secure default lease when no other bound applies (session/cookie auth with no
+* token `exp`, and no explicit `maxConnectionMs`). A change feed snapshots its
+* permission filters at connect, so without ANY ceiling a revoked caller would
+* keep their old view forever. 30 minutes bounds that staleness while not
+* churning connections. A host that truly wants a longer-lived feed sets
+* `maxConnectionMs` explicitly (up to `MAX_TIMER_MS`).
+*/
+const DEFAULT_MAX_CONNECTION_MS = 18e5;
+/**
 * Milliseconds from `now` until the feed should force-close to bound
 * permission staleness — `min(auth-token exp, maxConnectionMs)`. Returns
 * `undefined` when neither bound applies (no `exp` claim, no cap → the feed
@@ -147,7 +158,7 @@ function buildChangeFrame(event, resourceName, data) {
 	});
 }
 const realtimePlugin = async (fastify, opts = {}) => {
-	const { path = "/realtime/:resource", heartbeat = 3e4, resources: allowlist, operations = CHANGE_OPERATIONS, tokenQueryParam = "token", maxConnectionMs } = opts;
+	const { path = "/realtime/:resource", heartbeat = 3e4, resources: allowlist, operations = CHANGE_OPERATIONS, tokenQueryParam = "token", maxConnectionMs = DEFAULT_MAX_CONNECTION_MS } = opts;
 	if (!fastify.hasDecorator("events")) {
 		log.warn("Events plugin (arc-events) not registered. Realtime plugin will not function. Register eventPlugin before realtimePlugin.");
 		return;

package/dist/{redis-UDtLaNj6.d.mts → redis-CduhKsJi.d.mts}

@@ -1,4 +1,5 @@
-import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-Uk8ONJv7.mjs";
+
+import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-DEWNOMza.mjs";
 //#region src/idempotency/stores/redis.d.ts
 interface RedisClient {
   get(key: string): Promise<string | null>;

package/dist/{redis-stream-uIaauNpZ.d.mts → redis-stream-qN6A-RFv.d.mts}

@@ -1,4 +1,5 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-QmY7A258.mjs";
+
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-2uVV34WU.mjs";
 //#region src/events/transports/redis-stream.d.ts
 interface RedisStreamLike {
   xadd(key: string, id: string, ...fieldValues: string[]): Promise<string | null>;

package/dist/{registerRoute-JkxIEBJq.mjs → registerRoute-B_QrjYZS.mjs}

@@ -1,6 +1,7 @@
-import { f as createError } from "./errors-DkO8Nk6-.mjs";
-import { u as getRequestScope } from "./types-CSyCxl2V.mjs";
-import { r as evaluateAndApplyPermission } from "./applyPermissionResult-Cf6zUCvb.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-__T3EJDA.mjs";
+import { f as createError } from "./errors-Bh1KK5ps.mjs";
+import { u as getRequestScope } from "./types-DXYX7dIR.mjs";
 //#region src/core/middlewares/permissions.ts
 /**
 * Build a PermissionContext from a Fastify request. Extracted so the CRUD
@@ -31,10 +32,11 @@ function buildPermissionContext(req, opts) {
 function buildCrudPermissionMw(permissionCheck, resourceName, action) {
 	if (!permissionCheck) return null;
 	return async (req, reply) => {
-		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
+		const context = buildPermissionContext(req, {
 			resource: resourceName,
 			action
-		}), req, reply);
+		});
+		await evaluateAndApplyPermission(permissionCheck, context, req, reply);
 	};
 }
 /**
@@ -63,12 +65,13 @@ function buildActionPermissionMw(actionEnum, actionPermissions, globalAuth, reso
 		if (!permissionCheck) return;
 		const { action: _discard, ...data } = body;
 		const params = req.params;
-		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
+		const context = buildPermissionContext(req, {
 			resource: resourceName,
 			action,
 			resourceId: params?.id,
 			data
-		}), req, reply, { defaultDenialMessage: (user) => user ? `Permission denied for '${action}'` : "Authentication required" });
+		});
+		await evaluateAndApplyPermission(permissionCheck, context, req, reply, { defaultDenialMessage: (user) => user ? `Permission denied for '${action}'` : "Authentication required" });
 	};
 }
 //#endregion

package/dist/registry/index.d.mts

@@ -1,5 +1,6 @@
-import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-Q5gzEIWY.mjs";
-import "../fastify-augmentation-0WhPnUH7.mjs";
+
+import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-CpzxqePp.mjs";
+import "../fastify-augmentation-BppG5bMT.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { TenantPurgeProgress, TenantPurgeStrategy } from "@classytic/repo-core/repository";
 //#region src/registry/assertNoTenantData.d.ts

package/dist/registry/index.mjs

@@ -1,3 +1,4 @@
-import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-BYXUUg21.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-y9Hnypus.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-DqUmzA9W.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-BVr7PgA0.mjs";
 export { ResourceRegistry, assertNoTenantData, buildResourceManifest, buildResourceManifestFromRegistry, cascadeDeleteForOrganization, getCascadingResources, getCascadingResourcesWithMetadata, introspectionPlugin_default as introspectionPlugin, introspectionPlugin as introspectionPluginFn };

package/dist/{registry-BYXUUg21.mjs → registry-DqUmzA9W.mjs}

@@ -1,4 +1,5 @@
-import { t as CRUD_OPERATIONS } from "./constants-DNre0wRg.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "./constants-J99LGTJI.mjs";
 import fp from "fastify-plugin";
 //#region src/registry/assertNoTenantData.ts
 /**

package/dist/{renewingLease-3cuQH7h8.mjs → renewingLease-BpP9wwj7.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/lock/renewingLease.ts
 /**
 * Start renewing an ALREADY-ACQUIRED lease. The caller performed the

package/dist/{replyHelpers-67tRawQZ.mjs → replyHelpers-DS-P0b32.mjs}

@@ -1,4 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
 import { toCanonicalList } from "@classytic/repo-core/pagination";
 import fp from "fastify-plugin";
 //#region src/plugins/replyHelpers.ts

package/dist/{repositoryFilter-Dz8k3S4P.mjs → repositoryFilter-DotlxG3L.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
 import { policyRecordToFilter } from "@classytic/repo-core/filter";
 //#region src/core/repositoryFilter.ts

package/dist/{requestContext-MrlJwECf.mjs → requestContext-B6vQF-sy.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/context/requestContext.ts
 /**

package/dist/{rolldown-runtime-8H4AJuhK.mjs → rolldown-runtime-BhflRrBs.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import "node:module";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;

package/dist/{schedules-CjOd2MG9.mjs → schedules-C2Q3uv2d.mjs}

@@ -1,5 +1,6 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import { t as startRenewingLease } from "./renewingLease-3cuQH7h8.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
+import { t as startRenewingLease } from "./renewingLease-BpP9wwj7.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/schedules.ts
 var schedules_exports = /* @__PURE__ */ __exportAll({