@classytic/arc 2.18.4 → 2.19.0

package/dist/encryption/index.mjs

@@ -0,0 +1,270 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import fp from "fastify-plugin";
+//#region src/encryption/fieldCipher.ts
+/**
+* Field-level cipher — `node:crypto` AES-256-GCM, zero external deps.
+*
+* Used by `mode: 'fields'` to encrypt individual field values in place while
+* leaving the JSON structure intact. The envelope is an authenticated,
+* versioned, `kid`-tagged token:
+*
+*   arc.v1.<b64url(kid)>.<b64url(iv)>.<b64url(ciphertext)>.<b64url(tag)>
+*
+* This is NOT a hand-rolled cipher — it's the correct use of a vetted AEAD
+* primitive (AES-256-GCM): a fresh random 96-bit IV per operation (never
+* caller-supplied — IV reuse under GCM is catastrophic), authentication via
+* the GCM tag, and a version prefix so the format can evolve. Same shape, in
+* spirit, as MongoDB CSFLE's BSON-binary subtype-6 envelope. For
+* cross-vendor interop or asymmetric keys use `mode: 'jwe'` (RFC 7516)
+* instead.
+*/
+const ENVELOPE_PREFIX = "arc.v1";
+const IV_BYTES = 12;
+const KEY_BYTES = 32;
+function b64url(buf) {
+	return buf.toString("base64url");
+}
+function toKeyBuffer(key) {
+	if (Buffer.isBuffer(key)) {
+		if (key.length !== KEY_BYTES) throw new Error(`[arc/encryption] field-mode key must be ${KEY_BYTES} bytes (AES-256); got ${key.length}`);
+		return key;
+	}
+	if (key instanceof Uint8Array) return toKeyBuffer(Buffer.from(key));
+	throw new Error("[arc/encryption] field-mode key must be a 32-byte Buffer/Uint8Array. For asymmetric or cross-vendor encryption use mode: 'jwe'.");
+}
+/** Encrypt a UTF-8 string into the `arc.v1` field envelope. */
+function encryptField(plaintext, kid, key) {
+	const secret = toKeyBuffer(key);
+	const iv = randomBytes(IV_BYTES);
+	const cipher = createCipheriv("aes-256-gcm", secret, iv);
+	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+	const tag = cipher.getAuthTag();
+	return [
+		ENVELOPE_PREFIX,
+		b64url(Buffer.from(kid, "utf8")),
+		b64url(iv),
+		b64url(ciphertext),
+		b64url(tag)
+	].join(".");
+}
+/** Returns the parsed envelope, or `null` when the token isn't `arc.v1`. */
+function parseFieldEnvelope(token) {
+	if (typeof token !== "string") return null;
+	const parts = token.split(".");
+	if (parts.length !== 6) return null;
+	const [v0, v1, kidPart, ivPart, ctPart, tagPart] = parts;
+	if (`${v0}.${v1}` !== ENVELOPE_PREFIX) return null;
+	if (kidPart === void 0 || ivPart === void 0 || ctPart === void 0 || tagPart === void 0) return null;
+	try {
+		return {
+			kid: Buffer.from(kidPart, "base64url").toString("utf8"),
+			iv: Buffer.from(ivPart, "base64url"),
+			ciphertext: Buffer.from(ctPart, "base64url"),
+			tag: Buffer.from(tagPart, "base64url")
+		};
+	} catch {
+		return null;
+	}
+}
+/** Decrypt a parsed `arc.v1` envelope with the resolved key. Throws on tamper. */
+function decryptField(envelope, key) {
+	const decipher = createDecipheriv("aes-256-gcm", toKeyBuffer(key), envelope.iv);
+	decipher.setAuthTag(envelope.tag);
+	return Buffer.concat([decipher.update(envelope.ciphertext), decipher.final()]).toString("utf8");
+}
+//#endregion
+//#region src/encryption/jose.ts
+let josePromise;
+/** Load `jose` once, caching the module. Throws an actionable error if absent. */
+async function loadJose() {
+	if (!josePromise) josePromise = import("jose").then((m) => m, (cause) => {
+		josePromise = void 0;
+		throw new Error("[arc/encryption] mode 'jwe' requires the optional peer dependency `jose`. Install it with `npm i jose`, or use mode: 'fields' (node:crypto, no dependency).", { cause });
+	});
+	return josePromise;
+}
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+/** Encrypt a UTF-8 string into a JWE compact serialization. */
+async function jweEncrypt(plaintext, active, alg, enc) {
+	return new (await (loadJose())).CompactEncrypt(encoder.encode(plaintext)).setProtectedHeader({
+		alg: active.alg ?? alg,
+		enc,
+		kid: active.kid
+	}).encrypt(active.key);
+}
+/**
+* Decrypt a JWE compact string. `resolve` maps the header `kid` to a key;
+* the allowlists are enforced by `jose` so a malicious header can't downgrade
+* the algorithm.
+*/
+async function jweDecrypt(jwe, resolve, allowedAlgs, allowedEncs) {
+	const { plaintext } = await (await loadJose()).compactDecrypt(jwe, async (header) => {
+		if (!header.kid) throw new Error("[arc/encryption] inbound JWE is missing the `kid` header");
+		const key = await resolve(header.kid);
+		if (key === void 0) throw new Error(`[arc/encryption] no decryption key for kid '${header.kid}'`);
+		return key;
+	}, {
+		keyManagementAlgorithms: [...allowedAlgs],
+		contentEncryptionAlgorithms: [...allowedEncs]
+	});
+	return decoder.decode(plaintext);
+}
+//#endregion
+//#region src/encryption/resolver.ts
+function routeDirective(request) {
+	return (request.routeOptions?.config)?.arcExtensions?.encryption;
+}
+function finalize(directive, defaultMode) {
+	if (directive.enabled === false) return null;
+	return {
+		mode: directive.mode ?? defaultMode,
+		fields: directive.fields ?? []
+	};
+}
+/**
+* Resolve the active directive for a request, or `null` to skip encryption.
+*
+* @param request     incoming request (carries route config)
+* @param defaultMode plugin-level default mode
+* @param fallback    plugin-level `routes` matcher (optional)
+*/
+function resolveDirective(request, defaultMode, fallback) {
+	const declared = routeDirective(request);
+	if (declared) return finalize(declared, defaultMode);
+	if (fallback) {
+		const result = fallback(request);
+		if (result === true) return {
+			mode: defaultMode,
+			fields: []
+		};
+		if (result && typeof result === "object") return finalize(result, defaultMode);
+	}
+	return null;
+}
+//#endregion
+//#region src/encryption/encryptionPlugin.ts
+function getPath(obj, path) {
+	let cur = obj;
+	for (const seg of path.split(".")) {
+		if (cur === null || typeof cur !== "object") return void 0;
+		cur = cur[seg];
+	}
+	return cur;
+}
+function setPath(obj, path, value) {
+	const segs = path.split(".");
+	const last = segs[segs.length - 1];
+	if (last === void 0) return;
+	let cur = obj;
+	for (let i = 0; i < segs.length - 1; i++) {
+		const seg = segs[i];
+		if (seg === void 0) return;
+		const next = cur[seg];
+		if (next === null || typeof next !== "object") return;
+		cur = next;
+	}
+	cur[last] = value;
+}
+const encryptionPlugin = async (fastify, opts) => {
+	const { enabled = true, keyProvider, mode: defaultMode = "jwe", alg = "RSA-OAEP-256", enc = "A256GCM", routes: fallback, decryptRequests = true, contentType = "application/jose", responseContentType = "application/jose", flagHeader = "x-encrypted" } = opts;
+	fastify.decorateRequest("requestDecrypted", false);
+	fastify.decorateRequest("responseEncrypted", false);
+	if (enabled === false) {
+		fastify.log?.debug?.("[arc/encryption] disabled");
+		return;
+	}
+	if (!keyProvider) throw new Error("[arc/encryption] `keyProvider` is required when the plugin is enabled.");
+	const allowedAlgs = opts.allowedAlgs ?? [alg];
+	const allowedEncs = opts.allowedEncs ?? [enc];
+	function setFlag(reply) {
+		if (flagHeader) reply.header(flagHeader, "true");
+	}
+	if (decryptRequests) fastify.addContentTypeParser(contentType, { parseAs: "string" }, async (request, body) => {
+		const provider = keyProvider;
+		const plaintext = await jweDecrypt(body, (kid) => provider.decryptionKey(kid, { request }), allowedAlgs, allowedEncs);
+		request.requestDecrypted = true;
+		if (plaintext.length === 0) return void 0;
+		try {
+			return JSON.parse(plaintext);
+		} catch (cause) {
+			throw Object.assign(/* @__PURE__ */ new Error("[arc/encryption] decrypted request body is not valid JSON"), {
+				statusCode: 400,
+				cause
+			});
+		}
+	});
+	fastify.addHook("preSerialization", async (request, reply, payload) => {
+		const directive = resolveDirective(request, defaultMode, fallback);
+		if (!directive) return payload;
+		if (payload === null || typeof payload !== "object") return payload;
+		if (directive.mode === "fields") {
+			if (directive.fields.length === 0) return payload;
+			const { kid, key } = await keyProvider.encryptionKey({ request });
+			const obj = payload;
+			let touched = false;
+			for (const path of directive.fields) {
+				const value = getPath(obj, path);
+				if (value === void 0 || value === null) continue;
+				setPath(obj, path, encryptField(JSON.stringify(value), kid, key));
+				touched = true;
+			}
+			if (touched) {
+				setFlag(reply);
+				request.responseEncrypted = true;
+			}
+			return payload;
+		}
+		const active = await keyProvider.encryptionKey({ request });
+		const jwe = await jweEncrypt(JSON.stringify(payload), active, alg, enc);
+		reply.header("content-type", responseContentType);
+		setFlag(reply);
+		reply.serializer((p) => p);
+		request.responseEncrypted = true;
+		return jwe;
+	});
+	fastify.log?.debug?.({
+		mode: defaultMode,
+		alg,
+		enc
+	}, "[arc/encryption] enabled");
+};
+var encryptionPlugin_default = fp(encryptionPlugin, {
+	name: "arc-encryption",
+	fastify: "5.x"
+});
+//#endregion
+//#region src/encryption/keyProvider.ts
+/**
+* A static, in-memory key provider with `kid`-based rotation. Keys are held
+* for the process lifetime — resolve them from env / a secrets file at boot
+* and pass the imported key material in (don't re-parse PEM per request).
+*
+* @example symmetric field mode
+* ```ts
+* const provider = createStaticKeyProvider({
+*   encryptionKey: { kid: "2026-06", key: Buffer.from(process.env.FIELD_KEY!, "base64") },
+* });
+* ```
+*
+* @example asymmetric JWE (jose key material)
+* ```ts
+* const provider = createStaticKeyProvider({
+*   encryptionKey: { kid: "client-1", key: await importSPKI(clientPubPem, "RSA-OAEP-256") },
+*   decryptionKeys: { "server-1": await importPKCS8(serverPrivPem, "RSA-OAEP-256") },
+* });
+* ```
+*/
+function createStaticKeyProvider(options) {
+	const { encryptionKey } = options;
+	const decryptionKeys = {
+		[encryptionKey.kid]: encryptionKey.key,
+		...options.decryptionKeys
+	};
+	return {
+		encryptionKey: () => encryptionKey,
+		decryptionKey: (kid) => decryptionKeys[kid]
+	};
+}
+//#endregion
+export { createStaticKeyProvider, decryptField, encryptionPlugin_default as default, encryptField, encryptionPlugin, parseFieldEnvelope };

package/dist/{errorHandler-Bua97SEt.mjs → errorHandler-Dxf6P_kV.mjs}

@@ -1,5 +1,5 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { m as statusToArcCode, p as isArcError } from "./errors-j4aJm1Wg.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { m as statusToArcCode, p as isArcError } from "./errors-DkO8Nk6-.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import fp from "fastify-plugin";
 //#region src/plugins/errorHandler.ts

package/dist/{eventPlugin-Bw4bUDEO.mjs → eventPlugin-DJG2D7sy.mjs}

@@ -1,9 +1,110 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { d as createDomainError } from "./errors-j4aJm1Wg.mjs";
-import { n as requestContext } from "./requestContext-DDLS3NVU.mjs";
-import { n as createEvent, t as MemoryEventTransport } from "./EventTransport-7LPXLEUX.mjs";
+import { d as createDomainError } from "./errors-DkO8Nk6-.mjs";
+import { n as requestContext } from "./requestContext-BZKOr13H.mjs";
 import fp from "fastify-plugin";
+import { createEvent, matchEventPattern } from "@classytic/primitives/events";
+//#region src/events/EventTransport.ts
+/**
+* Internal arc events module — concrete in-memory transport.
+*
+* **Public type contracts moved out (arc 2.12).** `EventMeta`, `DomainEvent`,
+* `EventHandler`, `EventLogger`, `EventTransport`, `DeadLetteredEvent`,
+* `PublishManyResult`, plus the `createEvent` / `createChildEvent` /
+* `matchEventPattern` helpers, are now owned by `@classytic/primitives/events`.
+* Two reasons:
+*
+*   1. The shapes ARE the cross-package contract. arc, arc-next, mongokit's
+*      audit-log plugin, future kits and downstream services all share them.
+*      Owning them in `primitives` (pure types, zero runtime, zero deps)
+*      eliminates the "manually mirror in two places" problem the previous
+*      `primitives/src/events.ts` header explicitly called out.
+*   2. Inverting the dependency direction lets future packages (sqlitekit
+*      audit, billing services) consume the contract without depending on
+*      arc's HTTP-coupled stack.
+*
+* Hosts MUST import the types from primitives directly:
+*
+* ```typescript
+* import type {
+*   EventMeta, DomainEvent, EventHandler, EventTransport,
+*   DeadLetteredEvent, PublishManyResult,
+* } from '@classytic/primitives/events';
+* import { createEvent, createChildEvent } from '@classytic/primitives/events';
+* ```
+*
+* arc's `events/index.ts` barrel does NOT re-export these — by design, so
+* that consumer code is forced into the canonical import path and the org's
+* "no re-exports" rule holds at every public surface.
+*
+* What stays here:
+*   - `MemoryEventTransport` — the in-memory `EventTransport` implementation
+*     used as arc's default transport. Its handler-set state is process-local;
+*     wrong layer for primitives.
+*   - `MemoryEventTransportOptions` — its options shape.
+*
+* Inside arc, files that previously imported types from `./EventTransport.js`
+* keep working: this file re-exports them from primitives for arc's own
+* call sites. That re-export is an internal refactor convenience — the
+* public `events/index.ts` barrel stays clean.
+*/
+/**
+* In-memory event transport (default).
+*
+* Events are delivered synchronously within the process. Not suitable for
+* multi-instance deployments — pair with `RedisEventTransport` /
+* `RedisStreamTransport` (subpath imports) for those.
+*/
+var MemoryEventTransport = class {
+	name = "memory";
+	handlers = /* @__PURE__ */ new Map();
+	logger;
+	constructor(options) {
+		this.logger = options?.logger ?? console;
+	}
+	async publish(event) {
+		const allHandlers = /* @__PURE__ */ new Set();
+		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, event.type)) for (const h of handlers) allHandlers.add(h);
+		for (const handler of allHandlers) try {
+			await handler(event);
+		} catch (err) {
+			this.logger.error(`[EventTransport] Handler error for ${event.type}:`, err);
+		}
+	}
+	/**
+	* Reference `publishMany` implementation — delegates to `publish()` in order.
+	*
+	* Production transports (Kafka, Redis pipeline, SQS batch) should override
+	* this with a single batched network call. Memory transport has nothing to
+	* batch, so we just loop — the loop still returns a proper result map so
+	* `EventOutbox.relay` can exercise the batched code path in tests.
+	*/
+	async publishMany(events) {
+		const results = /* @__PURE__ */ new Map();
+		for (const event of events) try {
+			await this.publish(event);
+			results.set(event.meta.id, null);
+		} catch (err) {
+			results.set(event.meta.id, err instanceof Error ? err : new Error(String(err)));
+		}
+		return results;
+	}
+	async subscribe(pattern, handler) {
+		if (!this.handlers.has(pattern)) this.handlers.set(pattern, /* @__PURE__ */ new Set());
+		this.handlers.get(pattern)?.add(handler);
+		return () => {
+			const set = this.handlers.get(pattern);
+			if (set) {
+				set.delete(handler);
+				if (set.size === 0) this.handlers.delete(pattern);
+			}
+		};
+	}
+	async close() {
+		this.handlers.clear();
+	}
+};
+//#endregion
 //#region src/events/retry.ts
 /**
 * Wrap an event handler with retry logic and dead letter support.
@@ -219,4 +320,4 @@ var eventPlugin_default = fp(eventPlugin, {
 	fastify: "5.x"
 });
 //#endregion
-export { withRetry as i, eventPlugin_exports as n, createDeadLetterPublisher as r, eventPlugin as t };
+export { MemoryEventTransport as a, withRetry as i, eventPlugin_exports as n, createEvent as o, createDeadLetterPublisher as r, eventPlugin as t };

package/dist/{eventPlugin-C1W1CRbf.d.mts → eventPlugin-DbBFd3x_.d.mts}

@@ -1,4 +1,4 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-CaaXM5Y1.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-IEn7Tn-Q.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/events/defineEvent.d.ts

package/dist/events/index.d.mts

@@ -1,7 +1,7 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, o as MemoryEventTransport, r as EventHandler, s as MemoryEventTransportOptions, t as DeadLetteredEvent } from "../EventTransport-CaaXM5Y1.mjs";
-import { a as withRetry, c as EventDefinitionOutput, d as EventSchema, f as ValidationResult, i as createDeadLetterPublisher, l as EventRegistry, m as defineEvent, n as eventPlugin, o as CustomValidator, p as createEventRegistry, r as RetryOptions, s as EventDefinitionInput, t as EventPluginOptions, u as EventRegistryOptions } from "../eventPlugin-C1W1CRbf.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, o as MemoryEventTransport, r as EventHandler, s as MemoryEventTransportOptions, t as DeadLetteredEvent } from "../EventTransport-IEn7Tn-Q.mjs";
+import { a as withRetry, c as EventDefinitionOutput, d as EventSchema, f as ValidationResult, i as createDeadLetterPublisher, l as EventRegistry, m as defineEvent, n as eventPlugin, o as CustomValidator, p as createEventRegistry, r as RetryOptions, s as EventDefinitionInput, t as EventPluginOptions, u as EventRegistryOptions } from "../eventPlugin-DbBFd3x_.mjs";
 import { RedisEventTransportOptions, RedisLike } from "./transports/redis.mjs";
-import { r as RedisStreamTransportOptions, t as RedisStreamLike } from "../redis-stream-BtEUtjxZ.mjs";
+import { r as RedisStreamTransportOptions, t as RedisStreamLike } from "../redis-stream-DsP1vqZB.mjs";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 
 //#region src/events/eventTypes.d.ts

package/dist/events/index.mjs

@@ -1,9 +1,193 @@
-import { t as MemoryEventTransport } from "../EventTransport-7LPXLEUX.mjs";
-import { n as defineEvent, t as createEventRegistry } from "../defineEvent-DC981g-o.mjs";
-import { i as withRetry, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-Bw4bUDEO.mjs";
-import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-DjSYI2uP.mjs";
+import { t as __exportAll } from "../rolldown-runtime-8H4AJuhK.mjs";
+import { a as MemoryEventTransport, i as withRetry, o as createEvent, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-DJG2D7sy.mjs";
+import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-DY6xq4sM.mjs";
 import { and, anyOf, eq, lte, ne, or } from "@classytic/repo-core/filter";
 import { update } from "@classytic/repo-core/update";
+//#region src/events/defineEvent.ts
+/**
+* defineEvent — Typed Event Definitions with Optional Schema Validation
+*
+* Provides:
+* 1. defineEvent() — declare an event with name, schema, version, description
+* 2. EventRegistry — catalog of all known events + payload validation
+* 3. .create() helper — build DomainEvent with auto-generated metadata
+*
+* The built-in validator checks: object type, required fields, and top-level
+* property types. It does NOT recurse into nested objects, validate arrays,
+* enums, patterns, formats, or $ref. This is intentional — it's a lightweight
+* guard, not a full JSON Schema engine.
+*
+* For full validation, pass a custom `validate` function to `createEventRegistry()`:
+*
+* @example
+* ```typescript
+* import Ajv from 'ajv';
+* const ajv = new Ajv();
+*
+* const registry = createEventRegistry({
+*   validate: (schema, payload) => {
+*     const valid = ajv.validate(schema, payload);
+*     return valid
+*       ? { valid: true }
+*       : { valid: false, errors: ajv.errorsText().split(', ') };
+*   },
+* });
+* ```
+*
+* @example
+* ```typescript
+* import { defineEvent, createEventRegistry } from '@classytic/arc/events';
+*
+* const OrderCreated = defineEvent({
+*   name: 'order.created',
+*   version: 1,
+*   schema: {
+*     type: 'object',
+*     properties: {
+*       orderId: { type: 'string' },
+*       total: { type: 'number' },
+*     },
+*     required: ['orderId', 'total'],
+*   },
+* });
+*
+* // Type-safe event creation
+* const event = OrderCreated.create({ orderId: 'o-1', total: 100 });
+* await fastify.events.publish(event.type, event.payload, event.meta);
+*
+* // Registry for introspection + validation
+* const registry = createEventRegistry();
+* registry.register(OrderCreated);
+* const result = registry.validate('order.created', payload);
+* ```
+*/
+var defineEvent_exports = /* @__PURE__ */ __exportAll({
+	createEventRegistry: () => createEventRegistry,
+	defineEvent: () => defineEvent
+});
+/**
+* Define a typed event with optional schema validation.
+*
+* @example
+* const OrderCreated = defineEvent({
+*   name: 'order.created',
+*   schema: { type: 'object', properties: { orderId: { type: 'string' } }, required: ['orderId'] },
+* });
+*
+* const event = OrderCreated.create({ orderId: '123' });
+*/
+function defineEvent(input) {
+	const { name, schema, version = 1, description } = input;
+	return {
+		name,
+		schema,
+		version,
+		description,
+		create(payload, meta) {
+			return createEvent(name, payload, {
+				schemaVersion: version,
+				...meta
+			});
+		}
+	};
+}
+/**
+* Create an event registry for cataloging and validating events.
+*
+* The registry is opt-in — unregistered events pass validation.
+* This allows gradual adoption without breaking existing code.
+*
+* @param options.validate - Custom validator replacing the built-in minimal validator.
+*   The built-in validator only checks top-level object structure (type, required, property types).
+*   For nested objects, arrays, enums, patterns, or $ref, provide AJV or similar.
+*/
+function createEventRegistry(options) {
+	const customValidator = options?.validate;
+	const definitions = /* @__PURE__ */ new Map();
+	function registryKey(name, version) {
+		return `${name}:v${version}`;
+	}
+	return {
+		register(definition) {
+			const key = registryKey(definition.name, definition.version);
+			if (definitions.has(key)) throw new Error(`Event '${definition.name}' v${definition.version} is already registered. Use a different version number for schema evolution.`);
+			definitions.set(key, definition);
+		},
+		get(name, version) {
+			if (version !== void 0) return definitions.get(registryKey(name, version));
+			let latest;
+			let latestVersion = -1;
+			for (const def of definitions.values()) if (def.name === name && def.version > latestVersion) {
+				latest = def;
+				latestVersion = def.version;
+			}
+			return latest;
+		},
+		catalog() {
+			return Array.from(definitions.values()).map((def) => ({
+				name: def.name,
+				version: def.version,
+				description: def.description,
+				schema: def.schema
+			}));
+		},
+		validate(name, payload, version) {
+			let target = version !== void 0 ? definitions.get(registryKey(name, version)) : void 0;
+			if (!target && version === void 0) {
+				let latestVersion = -1;
+				for (const candidate of definitions.values()) if (candidate.name === name && candidate.version > latestVersion) {
+					target = candidate;
+					latestVersion = candidate.version;
+				}
+			}
+			if (!target) return { valid: true };
+			if (!target.schema) return { valid: true };
+			return customValidator ? customValidator(target.schema, payload) : validatePayload(payload, target.schema);
+		}
+	};
+}
+/**
+* Built-in minimal validator — lightweight guard, NOT a full JSON Schema engine.
+*
+* Checks:
+* - payload is an object (not null, not array)
+* - required fields are present
+* - top-level property types match (string, number, boolean, array, object)
+*
+* Does NOT check:
+* - nested object properties
+* - array item types
+* - enum, pattern, format, minLength, minimum, $ref
+*
+* For full validation, pass a custom `validate` function to `createEventRegistry()`.
+*/
+function validatePayload(payload, schema) {
+	const errors = [];
+	if (schema.type === "object") {
+		if (payload === null || payload === void 0 || typeof payload !== "object" || Array.isArray(payload)) return {
+			valid: false,
+			errors: ["Payload must be an object"]
+		};
+		const record = payload;
+		if (schema.required) {
+			for (const field of schema.required) if (!(field in record) || record[field] === void 0) errors.push(`Missing required field: '${field}'`);
+		}
+		if (schema.properties) {
+			for (const [key, propSchema] of Object.entries(schema.properties)) if (key in record && record[key] !== void 0 && record[key] !== null) {
+				const expectedType = propSchema.type;
+				if (expectedType) {
+					const actualType = Array.isArray(record[key]) ? "array" : typeof record[key];
+					if (expectedType !== actualType) errors.push(`Field '${key}': expected ${expectedType}, got ${actualType}`);
+				}
+			}
+		}
+	}
+	return errors.length === 0 ? { valid: true } : {
+		valid: false,
+		errors
+	};
+}
+//#endregion
 //#region src/events/eventTypes.ts
 /**
 * Event Type Constants and Helpers
@@ -757,7 +941,7 @@ function wrapWithSchema(definition, handler, options = {}) {
 		if (validate && definition.schema) result = validate(definition.schema, event.payload);
 		else if (registry) result = registry.validate(definition.name, event.payload, eventVersion);
 		else if (definition.schema) {
-			const { createEventRegistry } = await import("../defineEvent-DC981g-o.mjs").then((n) => n.r);
+			const { createEventRegistry } = await Promise.resolve().then(() => defineEvent_exports);
 			const adhoc = createEventRegistry();
 			adhoc.register(definition);
 			result = adhoc.validate(definition.name, event.payload);

package/dist/events/transports/redis-stream-entry.d.mts

@@ -1,2 +1,2 @@
-import { n as RedisStreamTransport, r as RedisStreamTransportOptions, t as RedisStreamLike } from "../../redis-stream-BtEUtjxZ.mjs";
+import { n as RedisStreamTransport, r as RedisStreamTransportOptions, t as RedisStreamLike } from "../../redis-stream-DsP1vqZB.mjs";
 export { type RedisStreamLike, RedisStreamTransport, type RedisStreamTransportOptions };

package/dist/events/transports/redis.d.mts

@@ -1,4 +1,4 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "../../EventTransport-CaaXM5Y1.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "../../EventTransport-IEn7Tn-Q.mjs";
 
 //#region src/events/transports/redis.d.ts
 interface RedisLike {

package/dist/factory/index.d.mts

@@ -1,4 +1,4 @@
-import { a as CustomPluginAuthOption, c as RawBodyOptions, d as preloadResourcesAsync, f as LoadResourcesOptions, h as loadResources, i as CustomAuthenticatorOption, l as UnderPressureOptions, m as ResourceModule, n as BetterAuthOption, o as JwtAuthOption, p as ResourceLike, r as CreateAppOptions, s as MultipartOptions, t as AuthOption, u as preloadResources } from "../types-WVlAVp8T.mjs";
+import { a as CustomPluginAuthOption, c as RawBodyOptions, d as preloadResourcesAsync, f as LoadResourcesOptions, h as loadResources, i as CustomAuthenticatorOption, l as UnderPressureOptions, m as ResourceModule, n as BetterAuthOption, o as JwtAuthOption, p as ResourceLike, r as CreateAppOptions, s as MultipartOptions, t as AuthOption, u as preloadResources } from "../types-9_wtNPsI.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 
 //#region src/factory/createApp.d.ts

package/dist/factory/index.mjs

@@ -1,6 +1,6 @@
-import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-B-j-iqo-.mjs";
-import { a as edgePreset, c as testingPreset, i as developmentPreset, n as createApp, o as getPreset, s as productionPreset, t as ArcFactory } from "../createApp-J1iPXY9p.mjs";
-import { t as loadResources } from "../loadResources-CwXt9MCh.mjs";
+import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-CHw3_oA_.mjs";
+import { a as edgePreset, c as testingPreset, i as developmentPreset, n as createApp, o as getPreset, s as productionPreset, t as ArcFactory } from "../createApp--703hQE1.mjs";
+import { t as loadResources } from "../loadResources-B8UmpITt.mjs";
 //#region src/factory/edge.ts
 /**
 * Convert a Fastify app into a Web Standards fetch handler.

package/dist/{fastify-augmentation-BdCl_eNo.d.mts → fastify-augmentation-D-5_yQJi.d.mts}

@@ -1,5 +1,5 @@
-import { yn as HookSystem, z as ResourceRegistry } from "./index-QYma8mdC.mjs";
-import { t as ExternalOpenApiPaths } from "./externalPaths-DLle0R07.mjs";
+import { bn as HookSystem, z as ResourceRegistry } from "./index-CUTG2Cuo.mjs";
+import { t as ExternalOpenApiPaths } from "./externalPaths-BE6wFpYv.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/core/arcCorePlugin.d.ts

package/dist/{fields-CKLrhyOb.d.mts → fields-C7ahdGYf.d.mts}

@@ -1,4 +1,4 @@
-import { i as RequestScope } from "./types-BJwJN2Pg.mjs";
+import { i as RequestScope } from "./types-LNebCoJx.mjs";
 import { FastifyRequest } from "fastify";
 
 //#region src/permissions/types.d.ts