@classytic/arc 2.18.4 → 2.18.5

package/dist/{core-C88uIwd3.mjs → core-ZnQBa5rh.mjs}

@@ -1,58 +1,18 @@
-import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-TrJVIJl0.mjs";
+import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-gaEeMlz-.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { r as ForbiddenError } from "./errors-j4aJm1Wg.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-Bi0r0vjG.mjs";
-import { N as assertValidConfig, f as getDefaultCrudSchemas, i as pipeUIMessageStreamToReply, r as isReadableStream } from "./utils-xAQeDyU_.mjs";
-import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-B-uXzf6I.mjs";
-import { a as resolveRoutePreHandlers, c as buildArcDecorator, i as buildPreHandlerChain, n as resolveRouterPluginMw, o as buildAuthMiddleware, r as selectPluginMw, t as buildRateLimitConfig } from "./rateLimit-yKvxWAky.mjs";
-import { F as applyFieldWritePermissions, L as resolveEffectiveRoles } from "./permissions-3uzwkbQt.mjs";
-import { t as getUserRoles } from "./types-D57iXYb8.mjs";
-import { r as buildCrudPermissionMw, t as tryRegisterRoute } from "./registerRoute-BEYn0ylk.mjs";
-import { t as applyPresets } from "./presets-CF79RHEo.mjs";
-import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-DatAaVNj.mjs";
-import { t as hasEvents } from "./typeGuards-CcFZXgU7.mjs";
-import { a as createFastifyHandler, i as createCrudHandlers, n as buildPipelineHandler, o as createRequestContext, r as resolvePipelineSteps, u as buildRequestScopeProjection } from "./pipeline-D4sqiokR.mjs";
-import { t as pluralize } from "./pluralize-BxdUl2P4.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CX9QIMTd.mjs";
-//#region src/core/middlewares/fieldWrite.ts
-/**
-* Build a preHandler that enforces field-write permissions on the request body.
-*
-* Auto-CRUD's create/update routes get this for free via `BodySanitizer.sanitize()`
-* inside `BaseController`. Custom routes (`config.routes`, presets, action endpoints)
-* never went through that path — so a host that declared
-* `fields: { role: fields.writableBy(['admin']) }` and a custom
-* `POST /users/promote` happily accepted `{ role: 'admin' }` from any caller.
-*
-* This preHandler closes that gap. It applies ONLY the `applyFieldWritePermissions`
-* step — no `SYSTEM_FIELDS` strip, no `fieldRules` strip — because custom-route
-* bodies don't necessarily mirror the resource's adapter shape, and we'd
-* generate surprising 403s by enforcing rules tied to that shape.
-*
-* Returns `null` when the resource has no field permissions configured — the
-* caller should then skip wiring it into the preHandler chain.
-*/
-function buildFieldWritePreHandler(fieldPermissions, policy = DEFAULT_FIELD_WRITE_DENIAL_POLICY) {
-	if (!fieldPermissions || Object.keys(fieldPermissions).length === 0) return null;
-	return async (request, _reply) => {
-		const body = request.body;
-		if (!body || typeof body !== "object" || Array.isArray(body)) return;
-		const scope = request.scope ?? PUBLIC_SCOPE;
-		if (isElevated(scope)) return;
-		const { body: filtered, deniedFields } = applyFieldWritePermissions(body, fieldPermissions, resolveEffectiveRoles(getUserRoles(request.user), isMember(scope) ? scope.orgRoles : []));
-		if (deniedFields.length > 0 && policy === "reject") throw new ForbiddenError(`Not permitted to write field${deniedFields.length === 1 ? "" : "s"}: ${deniedFields.join(", ")}`);
-		request.body = filtered;
-	};
-}
-/**
-* True for HTTP methods that carry a request body and should run the
-* field-write preHandler. GET/DELETE/HEAD/OPTIONS skip enforcement.
-*/
-function methodCarriesBody(method) {
-	const m = method.toUpperCase();
-	return m === "POST" || m === "PUT" || m === "PATCH";
-}
-//#endregion
+import { r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-bHblZ9YN.mjs";
+import { p as assertValidConfig, x as getDefaultCrudSchemas } from "./utils-C6QQ9-hd.mjs";
+import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-Dy6EQHjM.mjs";
+import { F as applyFieldWritePermissions, L as resolveEffectiveRoles } from "./permissions-BPB1xqGf.mjs";
+import { t as getUserRoles } from "./types-XTApa8b6.mjs";
+import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-U0MnO9vd.mjs";
+import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-BQcW6_Kq.mjs";
+import { a as createCrudHandlers, d as buildRequestScopeProjection, i as resolvePipelineSteps, o as createFastifyHandler, r as buildPipelineHandler, s as createRequestContext, t as resolveActionPermission } from "./actionPermissions-h7DYDNMg.mjs";
+import { c as resolveRoutePreHandlers, d as buildArcDecorator, i as selectPluginMw, l as buildAuthMiddleware, n as buildRateLimitConfig, o as buildCrudPermissionMw, r as resolveRouterPluginMw, s as buildPreHandlerChain, t as tryRegisterRoute } from "./registerRoute-CPmdkZGu.mjs";
+import { t as applyPresets } from "./presets-BtyFwTO4.mjs";
+import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
+import { t as pluralize } from "./pluralize-DccFV9R7.mjs";
 //#region src/core/aggregation/defineAggregation.ts
 /**
 * Declare a single resource aggregation. Exported configs flow into
@@ -99,6 +59,45 @@ function defineAggregation(config) {
 	return config;
 }
 //#endregion
+//#region src/core/middlewares/fieldWrite.ts
+/**
+* Build a preHandler that enforces field-write permissions on the request body.
+*
+* Auto-CRUD's create/update routes get this for free via `BodySanitizer.sanitize()`
+* inside `BaseController`. Custom routes (`config.routes`, presets, action endpoints)
+* never went through that path — so a host that declared
+* `fields: { role: fields.writableBy(['admin']) }` and a custom
+* `POST /users/promote` happily accepted `{ role: 'admin' }` from any caller.
+*
+* This preHandler closes that gap. It applies ONLY the `applyFieldWritePermissions`
+* step — no `SYSTEM_FIELDS` strip, no `fieldRules` strip — because custom-route
+* bodies don't necessarily mirror the resource's adapter shape, and we'd
+* generate surprising 403s by enforcing rules tied to that shape.
+*
+* Returns `null` when the resource has no field permissions configured — the
+* caller should then skip wiring it into the preHandler chain.
+*/
+function buildFieldWritePreHandler(fieldPermissions, policy = DEFAULT_FIELD_WRITE_DENIAL_POLICY) {
+	if (!fieldPermissions || Object.keys(fieldPermissions).length === 0) return null;
+	return async (request, _reply) => {
+		const body = request.body;
+		if (!body || typeof body !== "object" || Array.isArray(body)) return;
+		const scope = request.scope ?? PUBLIC_SCOPE;
+		if (isElevated(scope)) return;
+		const { body: filtered, deniedFields } = applyFieldWritePermissions(body, fieldPermissions, resolveEffectiveRoles(getUserRoles(request.user), isMember(scope) ? scope.orgRoles : []));
+		if (deniedFields.length > 0 && policy === "reject") throw new ForbiddenError(`Not permitted to write field${deniedFields.length === 1 ? "" : "s"}: ${deniedFields.join(", ")}`);
+		request.body = filtered;
+	};
+}
+/**
+* True for HTTP methods that carry a request body and should run the
+* field-write preHandler. GET/DELETE/HEAD/OPTIONS skip enforcement.
+*/
+function methodCarriesBody(method) {
+	const m = method.toUpperCase();
+	return m === "POST" || m === "PUT" || m === "PATCH";
+}
+//#endregion
 //#region src/core/createCrudRouter.ts
 /**
 * Mount custom routes (from presets or user-defined `routes`) on Fastify.
@@ -1246,7 +1245,7 @@ function buildResourcePlugin(resource) {
 				idField: resource.idField
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-DGCCp-kP.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-CagItpxI.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1260,7 +1259,7 @@ function buildResourcePlugin(resource) {
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-Ca77b8iK.mjs"), import("./validate-0__MuUsK.mjs").then((n) => n.r)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-DVKroXhC.mjs"), import("./validate-CRcaWzp2.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);

package/dist/{createActionRouter-DGCCp-kP.mjs → createActionRouter-CagItpxI.mjs}

@@ -1,10 +1,9 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import "./constants-TrJVIJl0.mjs";
-import { f as createError } from "./errors-j4aJm1Wg.mjs";
-import { c as buildArcDecorator, i as buildPreHandlerChain, n as resolveRouterPluginMw, r as selectPluginMw, s as buildAuthMiddlewareForPermissions, t as buildRateLimitConfig } from "./rateLimit-yKvxWAky.mjs";
-import { n as buildActionPermissionMw, t as tryRegisterRoute } from "./registerRoute-BEYn0ylk.mjs";
-import { l as sendControllerResponse, r as resolvePipelineSteps, t as buildActionPipelineHandler } from "./pipeline-D4sqiokR.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-CE6USIRi.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import "./constants-gaEeMlz-.mjs";
+import { f as createError } from "./errors-DkO8Nk6-.mjs";
+import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-h7DYDNMg.mjs";
+import { a as buildActionPermissionMw, d as buildArcDecorator, i as selectPluginMw, n as buildRateLimitConfig, r as resolveRouterPluginMw, s as buildPreHandlerChain, t as tryRegisterRoute, u as buildAuthMiddlewareForPermissions } from "./registerRoute-CPmdkZGu.mjs";
+import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-D1MJwqmp.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,

package/dist/{createAggregationRouter-Ca77b8iK.mjs → createAggregationRouter-DVKroXhC.mjs}

@@ -1,7 +1,7 @@
-import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-j4aJm1Wg.mjs";
-import { c as buildArcDecorator, i as buildPreHandlerChain, n as resolveRouterPluginMw, o as buildAuthMiddleware, r as selectPluginMw, t as buildRateLimitConfig } from "./rateLimit-yKvxWAky.mjs";
-import { n as validateAggregations } from "./validate-0__MuUsK.mjs";
-import { t as buildAggregationHandler } from "./buildHandler-Cvrc2p7r.mjs";
+import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
+import { d as buildArcDecorator, i as selectPluginMw, l as buildAuthMiddleware, n as buildRateLimitConfig, r as resolveRouterPluginMw, s as buildPreHandlerChain } from "./registerRoute-CPmdkZGu.mjs";
+import { n as validateAggregations } from "./validate-CRcaWzp2.mjs";
+import { t as buildAggregationHandler } from "./buildHandler-B0qvAguf.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts
 /**
 * Register one Fastify route per aggregation. No-op when the map is

package/dist/{createApp-J1iPXY9p.mjs → createApp--703hQE1.mjs}

@@ -1,6 +1,6 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { n as PUBLIC_SCOPE } from "./types-Bi0r0vjG.mjs";
+import { n as PUBLIC_SCOPE } from "./types-bHblZ9YN.mjs";
 import Fastify from "fastify";
 import qs from "qs";
 //#region src/factory/presets.ts
@@ -74,7 +74,7 @@ const productionPreset = {
 */
 function devLoggerConfig() {
 	try {
-		if (typeof import.meta?.resolve === "function") {
+		if (typeof import.meta.resolve === "function") {
 			import.meta.resolve("pino-pretty");
 			return {
 				level: "debug",
@@ -202,7 +202,7 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-Bw4bUDEO.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-DJG2D7sy.mjs").then((n) => n.n);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
 			...eventOpts,
@@ -239,15 +239,15 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules) {
 		trackPlugin("arc-graceful-shutdown");
 	}
 	if (config.arcPlugins?.caching) {
-		const { default: cachingPlugin } = await import("./caching-C0DdKiYB.mjs").then((n) => n.r);
+		const { default: cachingPlugin } = await import("./caching-_NJeDd1_.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.caching === true ? {} : config.arcPlugins.caching;
 		await fastify.register(cachingPlugin, opts);
 		trackPlugin("arc-caching", opts);
 	}
 	if (config.arcPlugins?.queryCache) {
-		const { queryCachePlugin } = await import("./queryCachePlugin-CnAeFqju.mjs").then((n) => n.n);
+		const { queryCachePlugin } = await import("./queryCachePlugin-emHb0CuX.mjs").then((n) => n.n);
 		const opts = config.arcPlugins.queryCache === true ? {} : config.arcPlugins.queryCache;
-		const store = config.stores?.queryCache ?? new (await (import("./memory-TdTHCS9-.mjs").then((n) => n.n))).MemoryCacheStore();
+		const store = config.stores?.queryCache ?? new (await (import("./memory-CLXA2VeJ.mjs").then((n) => n.n))).MemoryCacheStore();
 		await fastify.register(queryCachePlugin, {
 			store,
 			...opts
@@ -256,19 +256,19 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules) {
 	}
 	if (config.arcPlugins?.sse) if (config.arcPlugins?.events === false) fastify.log.warn("SSE plugin requires events plugin (arcPlugins.events). SSE disabled.");
 	else {
-		const { default: ssePlugin } = await import("./sse-BrY1W6U8.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("./sse-CfUjwjDk.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.sse === true ? {} : config.arcPlugins.sse;
 		await fastify.register(ssePlugin, opts);
 		trackPlugin("arc-sse", opts);
 	}
 	if (config.arcPlugins?.metrics) {
-		const { default: metricsPlugin } = await import("./metrics-Da2EUPi9.mjs").then((n) => n.r);
+		const { default: metricsPlugin } = await import("./metrics-fdxI5mn_.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.metrics === true ? {} : config.arcPlugins.metrics;
 		await fastify.register(metricsPlugin, opts);
 		trackPlugin("arc-metrics", opts);
 	}
 	if (config.arcPlugins?.versioning) {
-		const { default: versioningPlugin } = await import("./versioning-C0K8KQLx.mjs").then((n) => n.r);
+		const { default: versioningPlugin } = await import("./versioning-Dk-71iIz.mjs").then((n) => n.r);
 		await fastify.register(versioningPlugin, config.arcPlugins.versioning);
 		trackPlugin("arc-versioning", config.arcPlugins.versioning);
 	}
@@ -337,7 +337,7 @@ async function registerAuth(fastify, config, trackPlugin) {
 */
 async function registerElevation(fastify, config, trackPlugin) {
 	if (!config.elevation) return;
-	const { elevationPlugin } = await import("./elevation-BzhyVWfn.mjs").then((n) => n.r);
+	const { elevationPlugin } = await import("./elevation-COpYKt2h.mjs").then((n) => n.r);
 	await fastify.register(elevationPlugin, config.elevation);
 	trackPlugin("arc-elevation", config.elevation);
 	fastify.log.debug("Elevation plugin enabled");
@@ -347,7 +347,7 @@ async function registerElevation(fastify, config, trackPlugin) {
 */
 async function registerErrorHandler(fastify, config, trackPlugin) {
 	if (config.errorHandler === false) return;
-	const { errorHandlerPlugin } = await import("./errorHandler-Bua97SEt.mjs").then((n) => n.r);
+	const { errorHandlerPlugin } = await import("./errorHandler-Dxf6P_kV.mjs").then((n) => n.r);
 	const errorOpts = typeof config.errorHandler === "object" ? config.errorHandler : { includeStack: config.preset !== "production" };
 	await fastify.register(errorHandlerPlugin, errorOpts);
 	trackPlugin("arc-error-handler", errorOpts);
@@ -448,7 +448,7 @@ async function registerResources(fastify, config) {
 	let discoveryPath;
 	let discoveryYieldedZero = false;
 	if (resolvedResources === void 0 && config.resourceDir) {
-		const { loadResources } = await import("./loadResources-CwXt9MCh.mjs").then((n) => n.n);
+		const { loadResources } = await import("./loadResources-B8UmpITt.mjs").then((n) => n.n);
 		const { resolve, dirname } = await import("node:path");
 		const { fileURLToPath } = await import("node:url");
 		const rawDir = config.resourceDir;
@@ -896,7 +896,7 @@ async function createApp(options) {
 	await registerErrorHandler(fastify, config, trackPlugin);
 	await registerResources(fastify, config);
 	if (config.replyHelpers) {
-		const { replyHelpersPlugin } = await import("./replyHelpers-DXHVxrrj.mjs").then((n) => n.n);
+		const { replyHelpersPlugin } = await import("./replyHelpers-67tRawQZ.mjs").then((n) => n.n);
 		await fastify.register(replyHelpersPlugin);
 	}
 	if (config.serializeBigInt) {

package/dist/docs/index.d.mts

@@ -1,5 +1,5 @@
-import { p as RegistryEntry } from "../index-QYma8mdC.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-DLle0R07.mjs";
+import { p as RegistryEntry } from "../index-CHNQIhcb.mjs";
+import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/docs/openapi/types.d.ts

package/dist/docs/index.mjs

@@ -1,5 +1,5 @@
-import { t as getUserRoles } from "../types-D57iXYb8.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-ButnRyOM.mjs";
+import { t as getUserRoles } from "../types-XTApa8b6.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-xVJibapr.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/{elevation-BzhyVWfn.mjs → elevation-COpYKt2h.mjs}

@@ -1,6 +1,6 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { t as getUserRoles } from "./types-D57iXYb8.mjs";
+import { t as getUserRoles } from "./types-XTApa8b6.mjs";
 import fp from "fastify-plugin";
 //#region src/scope/elevation.ts
 var elevation_exports = /* @__PURE__ */ __exportAll({

package/dist/{errorHandler-Bua97SEt.mjs → errorHandler-Dxf6P_kV.mjs}

@@ -1,5 +1,5 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { m as statusToArcCode, p as isArcError } from "./errors-j4aJm1Wg.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { m as statusToArcCode, p as isArcError } from "./errors-DkO8Nk6-.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import fp from "fastify-plugin";
 //#region src/plugins/errorHandler.ts

package/dist/{eventPlugin-Bw4bUDEO.mjs → eventPlugin-DJG2D7sy.mjs}

@@ -1,9 +1,110 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { d as createDomainError } from "./errors-j4aJm1Wg.mjs";
-import { n as requestContext } from "./requestContext-DDLS3NVU.mjs";
-import { n as createEvent, t as MemoryEventTransport } from "./EventTransport-7LPXLEUX.mjs";
+import { d as createDomainError } from "./errors-DkO8Nk6-.mjs";
+import { n as requestContext } from "./requestContext-BZKOr13H.mjs";
 import fp from "fastify-plugin";
+import { createEvent, matchEventPattern } from "@classytic/primitives/events";
+//#region src/events/EventTransport.ts
+/**
+* Internal arc events module — concrete in-memory transport.
+*
+* **Public type contracts moved out (arc 2.12).** `EventMeta`, `DomainEvent`,
+* `EventHandler`, `EventLogger`, `EventTransport`, `DeadLetteredEvent`,
+* `PublishManyResult`, plus the `createEvent` / `createChildEvent` /
+* `matchEventPattern` helpers, are now owned by `@classytic/primitives/events`.
+* Two reasons:
+*
+*   1. The shapes ARE the cross-package contract. arc, arc-next, mongokit's
+*      audit-log plugin, future kits and downstream services all share them.
+*      Owning them in `primitives` (pure types, zero runtime, zero deps)
+*      eliminates the "manually mirror in two places" problem the previous
+*      `primitives/src/events.ts` header explicitly called out.
+*   2. Inverting the dependency direction lets future packages (sqlitekit
+*      audit, billing services) consume the contract without depending on
+*      arc's HTTP-coupled stack.
+*
+* Hosts MUST import the types from primitives directly:
+*
+* ```typescript
+* import type {
+*   EventMeta, DomainEvent, EventHandler, EventTransport,
+*   DeadLetteredEvent, PublishManyResult,
+* } from '@classytic/primitives/events';
+* import { createEvent, createChildEvent } from '@classytic/primitives/events';
+* ```
+*
+* arc's `events/index.ts` barrel does NOT re-export these — by design, so
+* that consumer code is forced into the canonical import path and the org's
+* "no re-exports" rule holds at every public surface.
+*
+* What stays here:
+*   - `MemoryEventTransport` — the in-memory `EventTransport` implementation
+*     used as arc's default transport. Its handler-set state is process-local;
+*     wrong layer for primitives.
+*   - `MemoryEventTransportOptions` — its options shape.
+*
+* Inside arc, files that previously imported types from `./EventTransport.js`
+* keep working: this file re-exports them from primitives for arc's own
+* call sites. That re-export is an internal refactor convenience — the
+* public `events/index.ts` barrel stays clean.
+*/
+/**
+* In-memory event transport (default).
+*
+* Events are delivered synchronously within the process. Not suitable for
+* multi-instance deployments — pair with `RedisEventTransport` /
+* `RedisStreamTransport` (subpath imports) for those.
+*/
+var MemoryEventTransport = class {
+	name = "memory";
+	handlers = /* @__PURE__ */ new Map();
+	logger;
+	constructor(options) {
+		this.logger = options?.logger ?? console;
+	}
+	async publish(event) {
+		const allHandlers = /* @__PURE__ */ new Set();
+		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, event.type)) for (const h of handlers) allHandlers.add(h);
+		for (const handler of allHandlers) try {
+			await handler(event);
+		} catch (err) {
+			this.logger.error(`[EventTransport] Handler error for ${event.type}:`, err);
+		}
+	}
+	/**
+	* Reference `publishMany` implementation — delegates to `publish()` in order.
+	*
+	* Production transports (Kafka, Redis pipeline, SQS batch) should override
+	* this with a single batched network call. Memory transport has nothing to
+	* batch, so we just loop — the loop still returns a proper result map so
+	* `EventOutbox.relay` can exercise the batched code path in tests.
+	*/
+	async publishMany(events) {
+		const results = /* @__PURE__ */ new Map();
+		for (const event of events) try {
+			await this.publish(event);
+			results.set(event.meta.id, null);
+		} catch (err) {
+			results.set(event.meta.id, err instanceof Error ? err : new Error(String(err)));
+		}
+		return results;
+	}
+	async subscribe(pattern, handler) {
+		if (!this.handlers.has(pattern)) this.handlers.set(pattern, /* @__PURE__ */ new Set());
+		this.handlers.get(pattern)?.add(handler);
+		return () => {
+			const set = this.handlers.get(pattern);
+			if (set) {
+				set.delete(handler);
+				if (set.size === 0) this.handlers.delete(pattern);
+			}
+		};
+	}
+	async close() {
+		this.handlers.clear();
+	}
+};
+//#endregion
 //#region src/events/retry.ts
 /**
 * Wrap an event handler with retry logic and dead letter support.
@@ -219,4 +320,4 @@ var eventPlugin_default = fp(eventPlugin, {
 	fastify: "5.x"
 });
 //#endregion
-export { withRetry as i, eventPlugin_exports as n, createDeadLetterPublisher as r, eventPlugin as t };
+export { MemoryEventTransport as a, withRetry as i, eventPlugin_exports as n, createEvent as o, createDeadLetterPublisher as r, eventPlugin as t };

package/dist/{eventPlugin-C1W1CRbf.d.mts → eventPlugin-DbBFd3x_.d.mts}

@@ -1,4 +1,4 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-CaaXM5Y1.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-IEn7Tn-Q.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/events/defineEvent.d.ts

package/dist/events/index.d.mts

@@ -1,7 +1,7 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, o as MemoryEventTransport, r as EventHandler, s as MemoryEventTransportOptions, t as DeadLetteredEvent } from "../EventTransport-CaaXM5Y1.mjs";
-import { a as withRetry, c as EventDefinitionOutput, d as EventSchema, f as ValidationResult, i as createDeadLetterPublisher, l as EventRegistry, m as defineEvent, n as eventPlugin, o as CustomValidator, p as createEventRegistry, r as RetryOptions, s as EventDefinitionInput, t as EventPluginOptions, u as EventRegistryOptions } from "../eventPlugin-C1W1CRbf.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, o as MemoryEventTransport, r as EventHandler, s as MemoryEventTransportOptions, t as DeadLetteredEvent } from "../EventTransport-IEn7Tn-Q.mjs";
+import { a as withRetry, c as EventDefinitionOutput, d as EventSchema, f as ValidationResult, i as createDeadLetterPublisher, l as EventRegistry, m as defineEvent, n as eventPlugin, o as CustomValidator, p as createEventRegistry, r as RetryOptions, s as EventDefinitionInput, t as EventPluginOptions, u as EventRegistryOptions } from "../eventPlugin-DbBFd3x_.mjs";
 import { RedisEventTransportOptions, RedisLike } from "./transports/redis.mjs";
-import { r as RedisStreamTransportOptions, t as RedisStreamLike } from "../redis-stream-BtEUtjxZ.mjs";
+import { r as RedisStreamTransportOptions, t as RedisStreamLike } from "../redis-stream-DsP1vqZB.mjs";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 
 //#region src/events/eventTypes.d.ts