@classytic/arc 2.8.5 → 2.10.3

package/dist/plugins/index.d.mts

@@ -1,7 +1,7 @@
-import { K as MiddlewareConfig, Kt as ResourceRegistry, Tn as HookSystem, et as PresetHook, m as AnyRecord, p as AdditionalRoute, vt as RouteSchemaOptions } from "../interface-CMRutPfe.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-BnkYrNzp.mjs";
-import { _ as _default$1, a as _default$7, c as MetricsCollector, d as metricsPlugin, f as SSEOptions, g as CachingRule, h as CachingOptions, i as VersioningOptions, l as MetricsOptions, m as ssePlugin, n as ErrorMapper, o as versioningPlugin, p as _default$6, r as errorHandlerPlugin, s as MetricEntry, t as ErrorHandlerOptions, u as _default$4, v as cachingPlugin } from "../errorHandler-Bah5JhBd.mjs";
-import { t as TracingOptions } from "../tracing-DdN2-wHJ.mjs";
+import { W as ResourceRegistry, at as PresetHook, dn as AnyRecord, gt as RouteSchemaOptions, nt as MiddlewareConfig, pt as RouteDefinition, tn as HookSystem } from "../index-Cl0uoKd5.mjs";
+import { t as ExternalOpenApiPaths } from "../externalPaths-BQ8QijNH.mjs";
+import { _ as CachingRule, a as VersioningOptions, c as MetricEntry, d as _default$4, f as metricsPlugin, g as CachingOptions, h as ssePlugin, i as errorHandlerPlugin, l as MetricsCollector, m as _default$6, n as ErrorMapper, o as _default$7, p as SSEOptions, r as defaultIsDuplicateKeyError, s as versioningPlugin, t as ErrorHandlerOptions, u as MetricsOptions, v as _default$1, y as cachingPlugin } from "../errorHandler-DRQ3EqfL.mjs";
+import { t as TracingOptions } from "../tracing-65B51Dw3.mjs";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
 import * as _$node_stream0 from "node:stream";
 
@@ -42,8 +42,8 @@ declare const _default: FastifyPluginAsync<ArcCorePluginOptions>;
 //#endregion
 //#region src/plugins/createPlugin.d.ts
 interface PluginResourceResult {
-  /** Additional routes to add to the resource */
-  additionalRoutes?: AdditionalRoute[];
+  /** Additional routes to add to the resource (v2.8 `RouteDefinition` shape) */
+  routes?: RouteDefinition[];
   /** Middlewares per operation */
   middlewares?: MiddlewareConfig;
   /** Hooks to register */
@@ -213,4 +213,4 @@ declare module "fastify" {
 declare const requestIdPlugin: FastifyPluginAsync<RequestIdOptions>;
 declare const _default$5: FastifyPluginAsync<RequestIdOptions>;
 //#endregion
-export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type RequestIdOptions, type SSEOptions, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, _default$1 as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, _default$2 as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, _default$3 as healthPlugin, healthPlugin as healthPluginFn, _default$4 as metricsPlugin, metricsPlugin as metricsPluginFn, replyHelpersPlugin, _default$5 as requestIdPlugin, requestIdPlugin as requestIdPluginFn, _default$6 as ssePlugin, ssePlugin as ssePluginFn, _default$7 as versioningPlugin, versioningPlugin as versioningPluginFn };
+export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type RequestIdOptions, type SSEOptions, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, _default$1 as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, _default$2 as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, _default$3 as healthPlugin, healthPlugin as healthPluginFn, _default$4 as metricsPlugin, metricsPlugin as metricsPluginFn, replyHelpersPlugin, _default$5 as requestIdPlugin, requestIdPlugin as requestIdPluginFn, _default$6 as ssePlugin, ssePlugin as ssePluginFn, _default$7 as versioningPlugin, versioningPlugin as versioningPluginFn };

package/dist/plugins/index.mjs

@@ -1,15 +1,15 @@
-import { p as MUTATION_OPERATIONS } from "../constants-Cxde4rpC.mjs";
+import { p as MUTATION_OPERATIONS } from "../constants-BhY1OHoH.mjs";
 import { o as getOrgId } from "../types-AOD8fxIw.mjs";
-import { t as requestContext } from "../requestContext-DYvHl113.mjs";
-import { t as hasEvents } from "../typeGuards-CcFZXgU7.mjs";
-import { t as HookSystem } from "../HookSystem-HprTmvVY.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-C6uXlWe3.mjs";
-import { n as caching_default, t as cachingPlugin } from "../caching-IMuYVjTL.mjs";
-import { t as errorHandlerPlugin } from "../errorHandler-f869_8PQ.mjs";
-import { n as metrics_default, t as metricsPlugin } from "../metrics-B-PU4-Yu.mjs";
-import { t as replyHelpersPlugin } from "../replyHelpers-CxkYGT81.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-Ad7ypl9e.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-CDugduqI.mjs";
+import { t as requestContext } from "../requestContext-xHIKedG6.mjs";
+import { t as hasEvents } from "../typeGuards-Cj5Rgvlg.mjs";
+import { t as HookSystem } from "../HookSystem-BNYKnrXF.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-BPd6NQDm.mjs";
+import { n as caching_default, t as cachingPlugin } from "../caching-CBpK_SCM.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-Bb49BvPD.mjs";
+import { n as metrics_default, t as metricsPlugin } from "../metrics-DuhiSEZI.mjs";
+import { t as replyHelpersPlugin } from "../replyHelpers-CXtJDAZ0.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-yBCgOLGu.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-C2U_bLY0.mjs";
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/core/arcCorePlugin.ts
@@ -393,15 +393,13 @@ var health_default = fp(healthPlugin, {
 const requestIdPlugin = async (fastify, opts = {}) => {
 	const { header = "x-request-id", generator = randomUUID, setResponseHeader = true } = opts;
 	if (!fastify.hasRequestDecorator("requestId")) fastify.decorateRequest("requestId", "");
-	fastify.addHook("onRequest", async (request) => {
+	fastify.addHook("onRequest", async (request, reply) => {
 		const incomingId = request.headers[header];
 		const sanitized = typeof incomingId === "string" ? incomingId.trim() : "";
 		const requestId = sanitized.length > 0 && sanitized.length <= 128 && /^[\w.:-]+$/.test(sanitized) ? sanitized : generator();
 		request.id = requestId;
 		request.requestId = requestId;
-	});
-	if (setResponseHeader) fastify.addHook("onSend", async (request, reply) => {
-		reply.header(header, request.requestId);
+		if (setResponseHeader) reply.header(header, requestId);
 	});
 	fastify.log?.debug?.("Request ID plugin registered");
 };
@@ -410,4 +408,4 @@ var requestId_default = fp(requestIdPlugin, {
 	fastify: "5.x"
 });
 //#endregion
-export { arcCorePlugin_default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, caching_default as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, gracefulShutdown_default as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, health_default as healthPlugin, healthPlugin as healthPluginFn, metrics_default as metricsPlugin, metricsPlugin as metricsPluginFn, replyHelpersPlugin, requestId_default as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sse_default as ssePlugin, ssePlugin as ssePluginFn, versioning_default as versioningPlugin, versioningPlugin as versioningPluginFn };
+export { arcCorePlugin_default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, caching_default as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, gracefulShutdown_default as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, health_default as healthPlugin, healthPlugin as healthPluginFn, metrics_default as metricsPlugin, metricsPlugin as metricsPluginFn, replyHelpersPlugin, requestId_default as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sse_default as ssePlugin, ssePlugin as ssePluginFn, versioning_default as versioningPlugin, versioningPlugin as versioningPluginFn };

package/dist/plugins/response-cache.mjs

@@ -1,4 +1,4 @@
-import { t as hasEvents } from "../typeGuards-CcFZXgU7.mjs";
+import { t as hasEvents } from "../typeGuards-Cj5Rgvlg.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/response-cache.ts
 /**
@@ -145,7 +145,7 @@ const responseCachePluginImpl = async (fastify, opts = {}) => {
 		request.__arcCacheTTL = 0;
 		reply.code(entry.statusCode).send(entry.body);
 	};
-	fastify.addHook("onSend", async (request, reply, payload) => {
+	fastify.addHook("preSerialization", async (request, reply, payload) => {
 		const ttl = request.__arcCacheTTL;
 		if (!ttl || ttl <= 0) return payload;
 		if (request.method !== "GET" && request.method !== "HEAD") return payload;

package/dist/plugins/tracing-entry.d.mts

@@ -1,2 +1,2 @@
-import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-DdN2-wHJ.mjs";
+import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-65B51Dw3.mjs";
 export { type TracingOptions, createSpan, isTracingAvailable, traced, _default as tracingPlugin };

package/dist/plugins/tracing-entry.mjs

@@ -44,7 +44,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.8.5";
+	const resolvedVersion = serviceVersion ?? "2.10.3";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/presets/filesUpload.d.mts

@@ -1,7 +1,7 @@
 import { r as RequestScope } from "../types-BD85MlEK.mjs";
-import { tt as PresetResult } from "../interface-CMRutPfe.mjs";
-import { t as PermissionCheck } from "../types-DZi1aYhm.mjs";
-import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-Dfzt4VTl.mjs";
+import { c as PermissionCheck } from "../fields-Lo1VUDpt.mjs";
+import { ot as PresetResult } from "../index-Cl0uoKd5.mjs";
+import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-CVk_SEn2.mjs";
 
 //#region src/presets/filesUpload.d.ts
 interface FilesUploadPresetRoutes {
@@ -14,6 +14,20 @@ interface FilesUploadPresetPermissions {
   read?: PermissionCheck;
   delete?: PermissionCheck;
 }
+/**
+ * Filename policy — controls how user-supplied filenames are validated before
+ * reaching the `Storage.upload()` adapter.
+ *
+ * - `true` (default): strict — rejects path separators, NULs, `.`/`..`, empty,
+ *   and names >255 chars. Safe default for disk/S3/prefix-joining adapters.
+ * - `false` | `'*'`: accept any filename verbatim. Use when the filename is a
+ *   user-supplied *label* and the adapter generates the storage key itself —
+ *   typical for microservice ingress, API-server proxies, or content stores
+ *   that use `id` for the path and treat `filename` as metadata.
+ * - function: custom policy. Return a string to *transform* the filename,
+ *   `false` to reject (triggers `ValidationError`), or `true`/`void` to accept.
+ */
+type FilenamePolicy = boolean | "*" | ((filename: string) => string | boolean | void);
 interface FilesUploadPresetOptions {
   /** Any implementation of the `Storage` interface. App owns it. */
   storage: Storage;
@@ -21,8 +35,16 @@ interface FilesUploadPresetOptions {
   fieldName?: string;
   /** Max bytes per file. Forwarded to `multipartBody`. Default: 10 MB. */
   maxFileSize?: number;
-  /** IANA MIME allow-list. Forwarded to `multipartBody`. Default: no filter. */
+  /**
+   * IANA MIME allow-list. Forwarded to `multipartBody`. Default: no filter.
+   * Pass `['*']` to explicitly allow any type (equivalent to omitting).
+   */
   allowedMimeTypes?: string[];
+  /**
+   * Filename validation policy. Default: `true` (strict).
+   * See {@link FilenamePolicy}.
+   */
+  sanitizeFilename?: FilenamePolicy;
   /**
    * Per-route permissions.
    * Defaults: upload → `requireAuth()`, read → `allowPublic()`, delete → `requireAuth()`.
@@ -46,4 +68,4 @@ interface FilesUploadPresetOptions {
  */
 declare function filesUploadPreset(options: FilesUploadPresetOptions): PresetResult;
 //#endregion
-export { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, type Storage, type StorageContext, type StorageFile, type StorageReadRange, type StorageReadResult, type StorageUploadInput, filesUploadPreset };
+export { FilenamePolicy, FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, type Storage, type StorageContext, type StorageFile, type StorageReadRange, type StorageReadResult, type StorageUploadInput, filesUploadPreset };

package/dist/presets/filesUpload.mjs

@@ -1,2 +1,2 @@
-import { t as filesUploadPreset } from "../filesUpload-C7r7HIeA.mjs";
+import { t as filesUploadPreset } from "../filesUpload-t21LS-py.mjs";
 export { filesUploadPreset };

package/dist/presets/index.d.mts

@@ -1,6 +1,7 @@
-import { Ht as IControllerResponse, Ut as IRequestContext, m as AnyRecord, on as PaginationResult, tt as PresetResult, ut as ResourceConfig } from "../interface-CMRutPfe.mjs";
+import { St as IRequestContext, dn as AnyRecord, lt as ResourceConfig, ot as PresetResult, u as PaginationResult, xt as IControllerResponse } from "../index-Cl0uoKd5.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
+import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";
 
 //#region src/presets/ownedByUser.d.ts
 interface OwnedByUserOptions {
@@ -272,4 +273,4 @@ type PresetInput = string | PresetResult | {
  */
 declare function applyPresets<TDoc = AnyRecord>(config: ResourceConfig<TDoc>, presets?: PresetInput[]): ResourceConfig<TDoc>;
 //#endregion
-export { type AuditedPresetOptions, type BulkOperation, type BulkPresetOptions, type FilesUploadPresetOptions, type FilesUploadPresetPermissions, type FilesUploadPresetRoutes, type IAuditedPreset, type IMultiTenantPreset, type IOwnedByUserPreset, type IPresetController, type ISlugLookupController, type ISoftDeleteController, type ITreeController, type MultiTenantOptions, type OwnedByUserOptions, type SlugLookupOptions, type TenantFieldSpec, type TreeOptions, applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, slugLookupPreset, softDeletePreset, treePreset };
+export { type AuditedPresetOptions, type BulkOperation, type BulkPresetOptions, type FilesUploadPresetOptions, type FilesUploadPresetPermissions, type FilesUploadPresetRoutes, type IAuditedPreset, type IMultiTenantPreset, type IOwnedByUserPreset, type IPresetController, type ISlugLookupController, type ISoftDeleteController, type ITreeController, type MultiTenantOptions, type OwnedByUserOptions, type SearchHandler, type SearchPresetOptions, type SearchRouteConfig, type SlugLookupOptions, type TenantFieldSpec, type TreeOptions, applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/index.mjs

@@ -1,4 +1,5 @@
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-C2xgzW6x.mjs";
-import { t as filesUploadPreset } from "../filesUpload-C7r7HIeA.mjs";
-export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, slugLookupPreset, softDeletePreset, treePreset };
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-fLJVXdVn.mjs";
+import { t as filesUploadPreset } from "../filesUpload-t21LS-py.mjs";
+import { searchPreset } from "./search.mjs";
+export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,4 +1,4 @@
-import { E as CrudRouteKey, tt as PresetResult } from "../interface-CMRutPfe.mjs";
+import { Q as CrudRouteKey, ot as PresetResult } from "../index-Cl0uoKd5.mjs";
 
 //#region src/presets/multiTenant.d.ts
 /**

package/dist/presets/multiTenant.mjs

@@ -1,4 +1,4 @@
-import "../constants-Cxde4rpC.mjs";
+import "../constants-BhY1OHoH.mjs";
 import { _ as isElevated, c as getRequestScope, f as getTeamId, h as hasOrgAccess, l as getScopeContext, o as getOrgId } from "../types-AOD8fxIw.mjs";
 //#region src/presets/multiTenant.ts
 /**
@@ -144,7 +144,7 @@ function multiTenantPreset(options = {}) {
 			list: [getFilter("list")],
 			get: [getFilter("get")],
 			create: [tenantInjection],
-			update: [getFilter("update")],
+			update: [getFilter("update"), tenantInjection],
 			delete: [getFilter("delete")]
 		}
 	};

package/dist/presets/search.d.mts

@@ -0,0 +1,178 @@
+import { c as PermissionCheck } from "../fields-Lo1VUDpt.mjs";
+import { _t as ControllerHandler, mt as RouteMcpConfig, ot as PresetResult, pt as RouteDefinition } from "../index-Cl0uoKd5.mjs";
+
+//#region src/presets/search.d.ts
+/**
+ * Search Preset — backend-agnostic search / vector / embed routes
+ *
+ * Arc doesn't ship a search engine. It ships the **routes** that front one.
+ * The preset mounts up to three standard routes on a resource:
+ *
+ *   POST /search           → full-text / engine-backed search (ES, OpenSearch, Algolia, Typesense, …)
+ *   POST /search-similar   → vector / semantic similarity (Atlas, Pinecone, Qdrant, Milvus, …)
+ *   POST /embed            → text / media → vector embedding
+ *
+ * Each route is OFF by default. You opt in by providing a `handler` that calls
+ * whatever backend you use. The preset contributes:
+ *   - Default path + method + permissions (customisable)
+ *   - OpenAPI description + MCP tool naming
+ *   - Arc envelope + pipeline (permissions, audit, hooks)
+ *   - Sensible Fastify route schema defaults
+ *
+ * Paths are fully customisable — if your product wants `/abc/search` or a
+ * GET-based autocomplete, pass `path`/`method` overrides or use `routes` for
+ * fully bespoke endpoints.
+ *
+ * @example MongoKit wiring (elasticSearchPlugin + vectorPlugin)
+ * ```typescript
+ * import { Repository, methodRegistryPlugin, elasticSearchPlugin } from '@classytic/mongokit';
+ * import { vectorPlugin } from '@classytic/mongokit/ai';
+ * import { searchPreset } from '@classytic/arc/presets/search';
+ *
+ * const productRepo = new Repository(Product, [
+ *   methodRegistryPlugin(),
+ *   elasticSearchPlugin({ client: esClient, indexName: 'products' }),
+ *   vectorPlugin({ fields: [{ path: 'embedding', dimensions: 1536 }], embedFn }),
+ * ]);
+ *
+ * defineResource({
+ *   name: 'product',
+ *   adapter: createMongooseAdapter({ model: Product, repository: productRepo }),
+ *   presets: [
+ *     searchPreset({
+ *       search:  { handler: (req) => productRepo.search(req.body.query, req.body) },
+ *       similar: { handler: (req) => productRepo.searchSimilar(req.body.query, req.body) },
+ *     }),
+ *   ],
+ * });
+ * ```
+ *
+ * @example Custom vector backend (Pinecone)
+ * ```typescript
+ * searchPreset({
+ *   similar: {
+ *     path: '/vector-search',                 // custom path
+ *     handler: async (req) => {
+ *       const hits = await pinecone.query({
+ *         vector: req.body.vector,
+ *         topK: req.body.topK ?? 10,
+ *       });
+ *       return hits.matches;
+ *     },
+ *     schema: { body: { type: 'object', properties: { vector: { type: 'array' }, topK: { type: 'integer' } } } },
+ *     mcp: false,                             // no MCP tool for this one
+ *   },
+ *   // Extra app-specific route
+ *   routes: [
+ *     {
+ *       method: 'GET',
+ *       path: '/autocomplete',
+ *       handler: async (req) => algolia.suggest(req.query.q as string),
+ *       permissions: allowPublic(),
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+/**
+ * Feature-detected search surface. Arc's `RepositoryLike` is the cross-kit
+ * minimum (repo-core's `MinimalRepo & Partial<StandardRepo>`) and does not
+ * declare search/vector/embed methods — those are kit-specific (mongokit's
+ * `elasticSearchPlugin` + `vectorPlugin`, pgkit's `pgvector` extension,
+ * sqlitekit FTS5, or a standalone Pinecone/Algolia adapter). We type the
+ * `repository` option locally so the preset can auto-wire handlers when a
+ * kit happens to ship these methods, without forcing every repo to declare
+ * them.
+ */
+interface SearchableRepository {
+  search?(query: unknown, options?: unknown): Promise<unknown>;
+  searchSimilar?(query: unknown, options?: unknown): Promise<unknown>;
+  embed?(input: unknown): Promise<number[]>;
+}
+/**
+ * Handler contract — receives arc's `IRequestContext` (same as any `actions` or
+ * non-raw route handler) and returns either the raw result (wrapped into
+ * `{ success: true, data }` by arc) or an explicit `IControllerResponse`.
+ */
+type SearchHandler = ControllerHandler;
+interface SearchRouteConfig {
+  /**
+   * User-supplied handler. When omitted, the preset auto-synthesises a handler
+   * from `options.repository` (calling `repo.search` / `repo.searchSimilar` /
+   * `repo.embed` respectively). If `repository` is also absent — or the repo
+   * doesn't expose the matching method — the route is NOT mounted.
+   */
+  handler?: SearchHandler;
+  /** HTTP path relative to the resource prefix. Defaults per-kind: `/search`, `/search-similar`, `/embed`. */
+  path?: string;
+  /** HTTP method. Default: `POST`. */
+  method?: "GET" | "POST";
+  /** Permission check. Defaults: search/similar fall back to `permissions.list ?? allowPublic()`; embed → `requireAuth()`. */
+  permissions?: PermissionCheck;
+  /** Fastify/AJV route schema (body/querystring/params/headers/response). */
+  schema?: RouteDefinition["schema"];
+  /**
+   * MCP tool generation.
+   * - omitted/true (default): auto-generate the tool from the route
+   * - false: skip MCP
+   * - object: explicit MCP config
+   */
+  mcp?: boolean | RouteMcpConfig;
+  /** OpenAPI summary. Defaults per-kind. */
+  summary?: string;
+  /** OpenAPI description. Defaults per-kind. */
+  description?: string;
+  /** Operation name. Defaults per-kind (`search`, `searchSimilar`, `embed`). */
+  operation?: string;
+  /** OpenAPI tags. */
+  tags?: string[];
+}
+/**
+ * Shorthand shape for `search` / `similar` / `embed` sections:
+ *   - `undefined`           → route not mounted
+ *   - `true`                → mount with defaults, auto-wire from `repository`
+ *   - `SearchRouteConfig`   → explicit config (and optional handler override)
+ */
+type SearchSection = true | SearchRouteConfig;
+interface SearchPresetOptions {
+  /**
+   * Repository exposing `search`/`searchSimilar`/`embed`. When provided,
+   * any section without an explicit `handler` is auto-wired to the matching
+   * repo method. Mongokit's `elasticSearchPlugin` + `vectorPlugin` register
+   * exactly these methods — pass the repo once and the handlers are synthesised.
+   *
+   * Sections set to `true` REQUIRE `repository` (otherwise the route is
+   * skipped silently). Sections with an explicit `handler` ignore this field.
+   */
+  repository?: SearchableRepository;
+  /** Full-text / engine-backed search route. Opt-in. */
+  search?: SearchSection;
+  /** Vector / semantic similarity route. Opt-in. */
+  similar?: SearchSection;
+  /** Embedding route (text/media → vector). Opt-in. */
+  embed?: SearchSection;
+  /**
+   * Fully custom routes — merged as-is into the resource's route table.
+   * Use this for endpoints that don't fit search/similar/embed naming,
+   * e.g. `/autocomplete`, `/reindex`, `/facets`, `/more-like-this`.
+   *
+   * You are responsible for permissions + schema on each entry.
+   */
+  routes?: RouteDefinition[];
+}
+/**
+ * Create a search preset bound to a resource.
+ *
+ * Mounts routes only for sections the caller opts into. A section's handler
+ * is either:
+ *   1. explicit `cfg.handler` — always wins,
+ *   2. `options.repository` auto-wire — if the repo exposes the matching
+ *      method (`search` / `searchSimilar` / `embed`),
+ *   3. otherwise the route is silently skipped.
+ *
+ * The preset itself stays DB-agnostic: nothing is imported from mongokit —
+ * it only feature-detects the optional methods on whatever repo you pass.
+ */
+declare function searchPreset(options?: SearchPresetOptions): PresetResult;
+//#endregion
+export { SearchHandler, SearchPresetOptions, SearchRouteConfig, SearchSection, SearchableRepository, searchPreset };

package/dist/presets/search.mjs

@@ -0,0 +1,150 @@
+import { C as requireAuth, y as allowPublic } from "../permissions-Dk6mshja.mjs";
+//#region src/presets/search.ts
+const BUILTINS = [
+	{
+		key: "search",
+		defaultPath: "/search",
+		defaultOperation: "search",
+		defaultSummary: "Search",
+		defaultDescription: "Full-text / engine-backed search. Delegates to the configured backend.",
+		permissionFallback: (p) => p.list ?? allowPublic()
+	},
+	{
+		key: "similar",
+		defaultPath: "/search-similar",
+		defaultOperation: "searchSimilar",
+		defaultSummary: "Semantic search",
+		defaultDescription: "Vector / similarity search. Delegates to the configured backend.",
+		permissionFallback: (p) => p.list ?? allowPublic()
+	},
+	{
+		key: "embed",
+		defaultPath: "/embed",
+		defaultOperation: "embed",
+		defaultSummary: "Embed",
+		defaultDescription: "Return the vector embedding for a text / media input.",
+		permissionFallback: () => requireAuth()
+	}
+];
+/**
+* Wrap the user handler to normalise the return shape into arc's envelope.
+* If the handler already returns `{ success, data }`, arc passes it through;
+* otherwise we wrap the raw return value so callers don't have to.
+*/
+function wrapEnvelope(handler) {
+	return async (req) => {
+		const out = await handler(req);
+		if (out !== null && typeof out === "object" && "success" in out) return out;
+		return {
+			success: true,
+			data: out
+		};
+	};
+}
+/**
+* Normalise a section value — `true` → empty config, `undefined` → undefined,
+* object → passthrough. Lets callers write `search: true` to mount with
+* defaults + auto-wire.
+*/
+function normaliseSection(value) {
+	if (value === void 0) return void 0;
+	if (value === true) return {};
+	return value;
+}
+/**
+* Build an auto-synthesised handler that proxies the request body to
+* `repo[method]` using each kit's native calling convention. Returns
+* `undefined` when the method isn't present so the caller can fall back to
+* an explicit `cfg.handler` or skip the route.
+*
+* Conventions (verified against mongokit 3.6):
+*
+* - **`search`** (mongokit `elasticSearchPlugin`):
+*   `search(query, { limit?, from?, mongoOptions? })` — positional. `query`
+*   is the engine-native DSL (e.g. ES `match` clause). Arc passes
+*   `(body.query, body)` so the rest of the body flows into options.
+*
+* - **`searchSimilar`** (mongokit `vectorPlugin`):
+*   `searchSimilar(params: VectorSearchParams)` — **single object**. `params`
+*   carries `query` (vector, text, or multimodal), `limit`, `filter`,
+*   `numCandidates`, `exact`, `field`, `minScore`, etc. Arc passes `body`
+*   directly so the shapes align. Passing positional args here would
+*   silently break (first arg becomes the whole `params`, second arg
+*   is ignored).
+*
+* - **`embed`** (mongokit `vectorPlugin`):
+*   `embed(input: string | EmbeddingInput)` — single arg. Arc passes
+*   `body.input ?? body`, so callers may wrap as `{ input: "…" }` or send
+*   the `EmbeddingInput` shape directly.
+*/
+function autoHandlerFor(repo, method) {
+	if (!repo) return void 0;
+	const fn = repo[method];
+	if (typeof fn !== "function") return void 0;
+	if (method === "embed") return async (req) => {
+		const body = req.body ?? {};
+		return fn(body.input ?? body);
+	};
+	if (method === "searchSimilar") return async (req) => {
+		return fn(req.body ?? {});
+	};
+	return async (req) => {
+		const body = req.body ?? {};
+		return fn(body.query, body);
+	};
+}
+/**
+* Create a search preset bound to a resource.
+*
+* Mounts routes only for sections the caller opts into. A section's handler
+* is either:
+*   1. explicit `cfg.handler` — always wins,
+*   2. `options.repository` auto-wire — if the repo exposes the matching
+*      method (`search` / `searchSimilar` / `embed`),
+*   3. otherwise the route is silently skipped.
+*
+* The preset itself stays DB-agnostic: nothing is imported from mongokit —
+* it only feature-detects the optional methods on whatever repo you pass.
+*/
+function searchPreset(options = {}) {
+	const sections = {
+		search: normaliseSection(options.search),
+		similar: normaliseSection(options.similar),
+		embed: normaliseSection(options.embed)
+	};
+	const extraRoutes = options.routes ?? [];
+	const repoMethodFor = {
+		search: "search",
+		similar: "searchSimilar",
+		embed: "embed"
+	};
+	return {
+		name: "search",
+		routes: (permissions) => {
+			const mounted = [];
+			for (const spec of BUILTINS) {
+				const cfg = sections[spec.key];
+				if (!cfg) continue;
+				const handler = cfg.handler ?? autoHandlerFor(options.repository, repoMethodFor[spec.key]);
+				if (!handler) continue;
+				const route = {
+					method: cfg.method ?? "POST",
+					path: cfg.path ?? spec.defaultPath,
+					operation: cfg.operation ?? spec.defaultOperation,
+					summary: cfg.summary ?? spec.defaultSummary,
+					description: cfg.description ?? spec.defaultDescription,
+					tags: cfg.tags,
+					permissions: cfg.permissions ?? spec.permissionFallback(permissions),
+					schema: cfg.schema,
+					mcp: cfg.mcp,
+					handler: wrapEnvelope(handler)
+				};
+				mounted.push(route);
+			}
+			for (const r of extraRoutes) mounted.push(r);
+			return mounted;
+		}
+	};
+}
+//#endregion
+export { searchPreset };

package/dist/{presets-C2xgzW6x.mjs → presets-fLJVXdVn.mjs}

@@ -1,6 +1,6 @@
 import { _ as isElevated, n as PUBLIC_SCOPE } from "./types-AOD8fxIw.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
-import { f as requireRoles, n as allowPublic, s as requireAuth } from "./permissions-CH4cNwJi.mjs";
+import { C as requireAuth, T as requireRoles, y as allowPublic } from "./permissions-Dk6mshja.mjs";
 //#region src/presets/ownedByUser.ts
 /**
 * Create ownership check middleware.

package/dist/{queryCachePlugin-BJJGBTlu.d.mts → queryCachePlugin-BKbWjgDG.d.mts}

@@ -1,4 +1,4 @@
-import { i as CacheStore } from "./interface-4y979v99.mjs";
+import { r as CacheStore } from "./interface-D218ikEo.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/cache/QueryCache.d.ts

package/dist/{queryCachePlugin-BH-fidlv.mjs → queryCachePlugin-DQCEfJis.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
 import { i as versionKey, r as tagVersionKey } from "./keys-qcD-TVJl.mjs";
-import { t as hasEvents } from "./typeGuards-CcFZXgU7.mjs";
-import { t as MemoryCacheStore } from "./memory-Cp7_cAko.mjs";
+import { t as hasEvents } from "./typeGuards-Cj5Rgvlg.mjs";
+import { t as MemoryCacheStore } from "./memory-B5Amv9A1.mjs";
 import fp from "fastify-plugin";
 //#region src/cache/QueryCache.ts
 var QueryCache = class {
@@ -33,17 +33,17 @@ var QueryCache = class {
 		};
 	}
 	async set(key, data, config) {
-		const staleTimeMs = (config.staleTime ?? 0) * 1e3;
-		const totalTtl = staleTimeMs + (config.gcTime ?? 60) * 1e3;
+		const staleTimeSec = config.staleTime ?? 0;
+		const totalTtlSec = staleTimeSec + (config.gcTime ?? 60);
 		const now = Date.now();
 		const envelope = {
 			data,
 			createdAt: now,
-			staleAfter: now + staleTimeMs,
-			expiresAt: now + totalTtl,
+			staleAfter: now + staleTimeSec * 1e3,
+			expiresAt: now + totalTtlSec * 1e3,
 			tags: config.tags ?? []
 		};
-		await this.store.set(key, envelope, { ttlMs: totalTtl });
+		await this.store.set(key, envelope, totalTtlSec);
 	}
 	async invalidate(key) {
 		await this.store.delete(key);
@@ -56,7 +56,7 @@ var QueryCache = class {
 	async bumpResourceVersion(resource) {
 		const key = versionKey(resource);
 		const newVersion = Date.now();
-		await this.store.set(key, newVersion, { ttlMs: 1440 * 60 * 1e3 });
+		await this.store.set(key, newVersion, 1440 * 60);
 	}
 	/** Get current version for a tag */
 	async getTagVersion(tag) {
@@ -66,7 +66,7 @@ var QueryCache = class {
 	async bumpTagVersion(tag) {
 		const key = tagVersionKey(tag);
 		const newVersion = Date.now();
-		await this.store.set(key, newVersion, { ttlMs: 1440 * 60 * 1e3 });
+		await this.store.set(key, newVersion, 1440 * 60);
 	}
 };
 //#endregion

package/dist/{queryParser-CgCtsjti.mjs → queryParser-DBqBB6AC.mjs}

@@ -1,4 +1,4 @@
-import { m as RESERVED_QUERY_PARAMS } from "./constants-Cxde4rpC.mjs";
+import { m as RESERVED_QUERY_PARAMS } from "./constants-BhY1OHoH.mjs";
 //#region src/utils/queryParser.ts
 /**
 * Arc Query Parser - Default URL-to-Query Parser

package/dist/{redis-BM00zaPB.d.mts → redis-DqyeggCa.d.mts}

@@ -1,4 +1,4 @@
-import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-DfLGcus7.mjs";
+import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-CSbZdv_3.mjs";
 
 //#region src/idempotency/stores/redis.d.ts
 interface RedisClient {

package/dist/{redis-stream-CrsfUmPt.d.mts → redis-stream-CakIQmwR.d.mts}

@@ -1,4 +1,4 @@
-import { i as EventTransport, n as EventHandler, r as EventLogger, t as DomainEvent } from "./EventTransport-BXja8NOc.mjs";
+import { i as EventLogger, n as DomainEvent, o as EventTransport, r as EventHandler } from "./EventTransport-CUw5NNWe.mjs";
 
 //#region src/events/transports/redis-stream.d.ts
 interface RedisStreamLike {