@classytic/repo-core 0.5.0 → 0.6.1

package/CHANGELOG.md

@@ -4,6 +4,43 @@ All notable changes to `@classytic/repo-core` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.1] - 2026-07-04
+
+### Changed — `TenantConfig` optionals widened to `T | undefined` (P10)
+
+Every optional prop on `TenantConfig` (`strategy`, `enabled`, `tenantField`,
+`fieldType`, `ref`, `contextKey`, `required`, `resolve`) is now typed
+`T | undefined`, so downstream packages compiling with
+`exactOptionalPropertyTypes: true` can extend it without redeclaring props
+(unblocks `@classytic/ledger`'s `MultiTenantConfig.required` exception).
+
+`resolveTenantConfig` strips explicit-`undefined` keys before spreading
+over `DEFAULT_TENANT_CONFIG`, so `{ required: maybeUndefined }` can never
+clobber a default with `undefined` — previously the un-widened type made
+that unrepresentable; now it's handled at runtime and pinned by tests.
+`DEFAULT_TENANT_CONFIG`'s annotation moved from `Required<Pick<...>>` to an
+`Exclude<..., undefined>` mapping (`-?` does not strip an explicit
+undefined union member). No runtime behavior change for existing callers.
+
+## [0.6.0] - 2026-06-11
+
+Standardization release. Coordinated with mongokit 3.16 + sqlitekit 0.6.
+
+### Added
+
+- **`StandardRepo.capabilities: RepoCapabilities`** (required) — runtime feature detection (`arrayOperators`, `changeStreams`, `regexFilter`, `lean`, `streaming`, `lookupPopulate`, + conformance flags). `ConformanceFeatures` is now an alias of the same type — runtime declaration and conformance gating cannot drift.
+- **Standard Schema validation** — `RepositoryBaseOptions.schema` / `updateSchema` accept any Zod / Valibot / ArkType / Effect schema; runs at new `HOOK_PRIORITY.VALIDATION` (150). Failures throw `HttpError` 400 with `validationErrors`. Vendored `StandardSchemaV1` types + `validateStandardSchema()` on `/schema`.
+- **Domain events** (`/events` subpath) — `RepositoryBaseOptions.events: { transport }` publishes `<resource>.<verb>` events through any arc/primitives-compatible transport. Publish failures never fail the op (routed to `error:events`).
+- **Change feed contract** — optional `StandardRepo.watch?()` returning `AsyncIterable<ChangeEvent<TDoc>>`; gated by `capabilities.changeStreams`.
+- **Resilience** — `QueryOptions.signal` + `QueryOptions.retryPolicy`; shared `withRetry()` / `throwIfAborted()` helpers.
+- **`recordToFilter()`** on `/filter` — promoted from per-kit copies.
+- `STANDARD_REPO_OPTION_KEYS` gains `'traceId'`.
+
+### Changed
+
+- `PurgeRetryPolicy` → **`RetryPolicy`** (rename, identical shape; was declared twice — now once). Clean break, no alias.
+- `AggregateOpsSupport` moved to `repository/capabilities.ts` (still re-exported from `/testing`).
+
 ## [0.5.0] - 2026-05-17
 
 ### Added — compliance-grade tenant cleanup primitive
@@ -28,7 +65,7 @@ on top.
 The chunk-loop logic — abort handling, progress emission, error-wrapping into result envelope, natural-exit on non-full batch — is identical across kits. Extracting it here means a single bug fix lands for every kit, and the surface a new kit has to implement shrinks to ~80 lines.
 
 - **`runChunkedPurge(strategy, options, port)`** — pure orchestrator (130 lines, no I/O).
-- **`PurgePort`** interface — the driving port. Each kit implements two closures: `selectChunkIds(limit)` + `applyStrategy(ids, strategy)`.
+- **`PurgePort`** interface — the driving port. Each kit implements a single closure: `purgeChunk(strategy, limit)` — one method lets each driver pick its own round-trip shape (sqlite hard-strategy compiles to one `DELETE … LIMIT`; a two-method `selectChunkIds` + `applyStrategy` split would force 2 round-trips per chunk for every kit).
 - **`WritingPurgeStrategy`** — strategy union with `skip` excluded (orchestrator handles `skip` before the port is consulted, so ports only see `hard` / `soft` / `anonymize`).
 
 Hexagonal pattern: orchestrator is the use-case, `PurgePort` is the driving port, each kit's port factory is the adapter. Adding a new strategy (e.g. `archive`) = one union member + one case per port. Adding a new kit = one port file + ~10-line method.

package/README.md

@@ -62,6 +62,19 @@ import { CORE_OP_REGISTRY, describe } from '@classytic/repo-core/operations';
 
 // Repository hook context type (for plugin authors).
 import type { RepositoryContext } from '@classytic/repo-core/context';
+
+// Capabilities + resilience (0.6.0) — runtime feature detection, the unified
+// retry/abort primitives, and the change-feed contract types.
+import { withRetry, throwIfAborted } from '@classytic/repo-core/repository';
+import type { RepoCapabilities, RetryPolicy, ChangeEvent, WatchOptions } from '@classytic/repo-core/repository';
+
+// Domain events (0.6.0) — pass `events: { transport }` at construction and every
+// mutating op publishes `<resource>.<verb>` through any arc-compatible transport.
+import type { RepositoryEventPublisher, DomainEvent } from '@classytic/repo-core/events';
+
+// Standard Schema validation (0.6.0) — `schema` / `updateSchema` construction
+// options accept any Zod / Valibot / ArkType / Effect schema.
+import { validateStandardSchema, type StandardSchemaV1 } from '@classytic/repo-core/schema';
 ```
 
 **There is no `.` / root entry.** Import from the exact subpath — that's the contract that keeps tree-shaking honest.
@@ -143,6 +156,51 @@ export function stampOrgId(orgId: string): Plugin {
 
 Typos like `'before:craete'` become compile errors. Subscribing to an event a given kit doesn't emit is a silent no-op (that's how the hook engine works), so a plugin can safely wire listeners for the full standard set.
 
+## Capabilities — feature detection, not runtime surprises
+
+Every kit declares `readonly capabilities: RepoCapabilities` (required on
+`StandardRepo` since 0.6.0). Kit-portable hosts branch once at boot:
+
+```ts
+if (!repo.capabilities.arrayOperators) {
+  // SQL kit without JSON array rewrites — model tags as a join table
+}
+if (repo.capabilities.aggregateOps?.percentile) {
+  dashboard.enableLatencyPercentiles();
+}
+```
+
+The conformance suite's `ConformanceFeatures` is an alias of the same type —
+what a kit declares at runtime is exactly what the cross-kit suite verifies.
+
+## Config-driven validation + events (0.6.0)
+
+`RepositoryBaseOptions` follows media-kit's config-driven activation: pass the
+slot and the feature lights up; omit it and the wiring is inert.
+
+```ts
+import { z } from 'zod';
+
+const repo = createRepository(UserModel, {
+  // Any Standard Schema validator — Zod, Valibot, ArkType, Effect.
+  schema: z.object({ name: z.string().min(1), email: z.string().email() }),
+  updateSchema: z.object({ name: z.string().min(1) }).partial(),
+
+  // Any arc / primitives-compatible EventTransport. Every mutating op then
+  // publishes `user.created` / `user.updated` / `user.deleted` / ...
+  events: { transport: redisTransport, source: 'commerce' },
+});
+```
+
+Validation runs at `HOOK_PRIORITY.VALIDATION` (150) — after policy plugins
+(tenant-stamped fields are present), before cache. Event publishing never
+fails the operation; transport failures route to the `error:events` hook.
+
+> **Warning — arc hosts:** these are the same event names `@classytic/arc`'s
+> `eventStrategy: 'auto'` emits. Wiring BOTH the repo-level bridge and arc
+> auto events for one resource double-publishes silently (arc's dual-publish
+> dev-warn cannot see the repo layer). Pick one layer per resource.
+
 ## Typed result extras
 
 ```ts
@@ -161,11 +219,15 @@ Default `TExtra` is `Record<string, never>` — `OffsetPaginationResult<User>` b
 
 ## Status
 
-**v0.3.0 — canonical contracts release.** Pagination types + wire envelope, tenant config, error contracts, and the `SchemaGenerator<TModel>` interface relocated from primitives / mongokit / arc to single sources of truth here.
+**v0.6.0 — standardization release.** Required `RepoCapabilities` feature
+detection (unified with `ConformanceFeatures`), Standard Schema validation
+slot, domain-event emission (`/events`), `watch()` change-feed contract,
+unified `RetryPolicy` + `signal` cancellation, and `recordToFilter`
+promoted from per-kit copies.
 
 Consumed by:
-- `@classytic/mongokit` ≥ 3.12 — `Repository extends RepositoryBase`; hook engine, plugin-order validator, `HOOK_PRIORITY` sourced from repo-core. Pagination + `HttpError` types now flow from repo-core (mongokit's local copies dropped). `MultiTenantOptions extends Pick<TenantConfig, ...>`. `buildCrudSchemasFromModel` ships a compile-time `SchemaGenerator<TModel>` conformance assertion. Mongokit's own `QueryParser` remains standalone.
-- `@classytic/sqlitekit` ≥ 0.2 — `SqliteRepository extends RepositoryBase`; Filter IR compiled to Drizzle / raw SQL natively. `MultiTenantOptions extends Pick<TenantConfig, ...>`. `buildCrudSchemasFromTable` ships the same `SchemaGenerator` conformance assertion.
+- `@classytic/mongokit` ≥ 3.16 — `Repository extends RepositoryBase`; declares `MONGOKIT_CAPABILITIES`; implements `watch()` via change streams; hook engine, plugin-order validator, `HOOK_PRIORITY`, pagination + `HttpError` types all flow from repo-core. Mongokit's own `QueryParser` remains standalone.
+- `@classytic/sqlitekit` ≥ 0.6 — `SqliteRepository extends RepositoryBase`; declares `SQLITEKIT_CAPABILITIES`; Filter IR compiled to Drizzle / raw SQL natively; `recordToFilter` consumed from here.
 - `@classytic/arc` ≥ 2.12 — adapters typed against `SchemaGenerator<TModel>`; `ArcError implements HttpError`; pagination wire envelope (`method` discriminant) emitted via `toCanonicalList()` with `reply.sendList()`.
 
 See [INFRA.md](./INFRA.md) for the architectural principles, subpath map, build/tooling decisions, and the roadmap for pgkit / prismakit.

package/dist/events/emit.d.mts

@@ -0,0 +1,22 @@
+import { EventMeta, RepositoryEventPublisher } from "./types.mjs";
+import { RepositoryBase } from "../repository/base.mjs";
+
+//#region src/events/emit.d.ts
+/** Construction-time event wiring. */
+interface RepositoryEventsOptions {
+  /** Any arc / primitives-compatible transport. Only `publish` is consumed. */
+  transport: RepositoryEventPublisher;
+  /**
+   * Event-name prefix. Defaults to the repository's model name lowercased
+   * (`User` model → `user.created`).
+   */
+  resource?: string;
+  /** `meta.source` — originating service/package (`'commerce'`, `'billing'`). */
+  source?: string;
+  /** Static meta merged into every event (host-controlled overrides win). */
+  meta?: Partial<EventMeta>;
+}
+/** Install the after-hooks. Called by `RepositoryBase`; not host-facing. */
+declare function registerRepositoryEvents(repo: RepositoryBase, options: RepositoryEventsOptions): void;
+//#endregion
+export { RepositoryEventsOptions, registerRepositoryEvents };

package/dist/events/emit.mjs

@@ -0,0 +1,105 @@
+import { HOOK_PRIORITY } from "../hooks/priority.mjs";
+//#region src/events/emit.ts
+const CREATED_OPS = ["create"];
+const UPDATED_OPS = [
+	"update",
+	"findOneAndUpdate",
+	"claim",
+	"claimVersion",
+	"replace",
+	"upsert"
+];
+function eventId() {
+	const c = globalThis.crypto;
+	if (c?.randomUUID) return c.randomUUID();
+	return `evt_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
+}
+function asRecord(value) {
+	return value !== null && typeof value === "object" ? value : void 0;
+}
+/** Pull actor/tenant/correlation meta off the hook context (and its options bag). */
+function contextMeta(context) {
+	const options = asRecord(context["options"]) ?? {};
+	const pick = (key) => options[key] ?? context[key];
+	const meta = {};
+	const userId = pick("userId");
+	if (typeof userId === "string") meta.userId = userId;
+	const organizationId = pick("organizationId");
+	if (typeof organizationId === "string") meta.organizationId = organizationId;
+	const requestId = pick("requestId");
+	if (typeof requestId === "string") meta.correlationId = requestId;
+	return meta;
+}
+function resourceId(result, context) {
+	const doc = asRecord(result);
+	const raw = doc?.["_id"] ?? doc?.["id"] ?? context.id;
+	return raw === void 0 || raw === null ? void 0 : String(raw);
+}
+/** Install the after-hooks. Called by `RepositoryBase`; not host-facing. */
+function registerRepositoryEvents(repo, options) {
+	const resource = options.resource ?? repo.modelName.toLowerCase();
+	const transport = options.transport;
+	const buildEvent = (verb, payload, context, id) => ({
+		type: `${resource}.${verb}`,
+		payload,
+		meta: {
+			id: eventId(),
+			timestamp: /* @__PURE__ */ new Date(),
+			resource,
+			...id !== void 0 ? {
+				resourceId: id,
+				partitionKey: id
+			} : {},
+			...options.source !== void 0 ? { source: options.source } : {},
+			...contextMeta(context),
+			...options.meta
+		}
+	});
+	const publish = async (event) => {
+		try {
+			await transport.publish(event);
+		} catch (err) {
+			repo.emit("error:events", {
+				event,
+				error: err
+			});
+		}
+	};
+	const onResult = (verb) => async ({ context, result }) => {
+		if (result === null || result === void 0) return;
+		await publish(buildEvent(verb, result, context, resourceId(result, context)));
+	};
+	const observe = { priority: HOOK_PRIORITY.OBSERVABILITY };
+	for (const op of CREATED_OPS) repo.on(`after:${op}`, onResult("created"), observe);
+	for (const op of UPDATED_OPS) repo.on(`after:${op}`, onResult("updated"), observe);
+	repo.on(`after:restore`, onResult("restored"), observe);
+	repo.on("after:delete", async ({ context, result }) => {
+		if (result === null || result === void 0) return;
+		const id = context.id === void 0 || context.id === null ? void 0 : String(context.id);
+		await publish(buildEvent("deleted", id !== void 0 ? { id } : result, context, id));
+	}, observe);
+	repo.on("after:getOrCreate", async ({ context, result }) => {
+		const envelope = asRecord(result);
+		if (!envelope || envelope["created"] !== true) return;
+		const doc = envelope["doc"];
+		await publish(buildEvent("created", doc, context, resourceId(doc, context)));
+	}, observe);
+	repo.on("after:createMany", async ({ context, result }) => {
+		if (!Array.isArray(result) || result.length === 0) return;
+		const events = result.map((doc) => buildEvent("created", doc, context, resourceId(doc, context)));
+		try {
+			if (transport.publishMany) await transport.publishMany(events);
+			else for (const event of events) await transport.publish(event);
+		} catch (err) {
+			repo.emit("error:events", {
+				event: events[0],
+				error: err
+			});
+		}
+	}, observe);
+	for (const [op, verb] of [["updateMany", "updatedMany"], ["deleteMany", "deletedMany"]]) repo.on(`after:${op}`, async ({ context, result }) => {
+		await publish(buildEvent(verb, result, context, void 0));
+	}, observe);
+}
+//#endregion
+export { registerRepositoryEvents };

package/dist/events/index.d.mts

@@ -0,0 +1,3 @@
+import { DomainEvent, EventMeta, PublishManyResult, RepositoryEventPublisher } from "./types.mjs";
+import { RepositoryEventsOptions, registerRepositoryEvents } from "./emit.mjs";
+export { type DomainEvent, type EventMeta, type PublishManyResult, type RepositoryEventPublisher, type RepositoryEventsOptions, registerRepositoryEvents };

package/dist/events/index.mjs

@@ -0,0 +1,2 @@
+import { registerRepositoryEvents } from "./emit.mjs";
+export { registerRepositoryEvents };

package/dist/events/types.d.mts

@@ -0,0 +1,73 @@
+//#region src/events/types.d.ts
+/**
+ * Domain-event types — structural mirror of the org-wide event contract.
+ *
+ * These shapes are structurally compatible with `@classytic/primitives/events`
+ * (which itself mirrors `@classytic/arc`'s `EventTransport` verbatim). Repo-core
+ * declares only the subset it consumes — `publish` / `publishMany` — so ANY
+ * arc transport (memory, Redis, Kafka), primitives' helpers, or media-kit's
+ * in-process bus drops into `RepositoryBaseOptions.events.transport` without
+ * adapters, and repo-core stays zero-dependency.
+ *
+ * Width subtyping does the work: a full `EventTransport` (with `subscribe`,
+ * `deadLetter`, `close`) satisfies this narrower parameter type automatically.
+ */
+/**
+ * Event metadata. Field semantics mirror arc v2.9 / primitives — see
+ * `@classytic/primitives/events` for the exhaustive docs. Repo-core
+ * populates `id`, `timestamp`, `resource`, `resourceId`, `source`, and —
+ * when present on the call's options bag — `userId`, `organizationId`,
+ * `correlationId` (from `requestId`).
+ */
+interface EventMeta {
+  /** Unique event identifier — UUID v4. */
+  id: string;
+  /** Emit timestamp. */
+  timestamp: Date;
+  /** Schema version for this event type. Default: `1`. */
+  schemaVersion?: number;
+  /** Correlation ID — stable across a causal chain (repo-core forwards `requestId`). */
+  correlationId?: string;
+  /** Causation ID — `meta.id` of the direct parent event. */
+  causationId?: string;
+  /** Partition key hint for ordered transports. Defaults to `resourceId`. */
+  partitionKey?: string;
+  /** Source resource name — the repository's model/table name. */
+  resource?: string;
+  /** Resource identifier — the document's primary key. */
+  resourceId?: string;
+  /** User who triggered the event. */
+  userId?: string;
+  /** Organization / tenant scope. */
+  organizationId?: string;
+  /** Originating service or package. */
+  source?: string;
+  /** Idempotency key — stable per logical operation. */
+  idempotencyKey?: string;
+  /** DDD aggregate marker. */
+  aggregate?: {
+    type: string;
+    id: string;
+  };
+}
+/** A domain event — `type` is dotted (`user.created`, `order.updatedMany`). */
+interface DomainEvent<T = unknown> {
+  type: string;
+  payload: T;
+  meta: EventMeta;
+}
+/** Per-event publish outcome keyed by `meta.id`. `null` = success. */
+type PublishManyResult = ReadonlyMap<string, Error | null>;
+/**
+ * The transport surface repo-core consumes. Structurally satisfied by any
+ * arc / primitives `EventTransport`. Repositories only PUBLISH — subscribing
+ * is host territory, on whichever full transport the host wired.
+ */
+interface RepositoryEventPublisher {
+  readonly name: string;
+  publish(event: DomainEvent): Promise<void>;
+  /** Batch publish (optional). Used for `createMany` when available. */
+  publishMany?(events: readonly DomainEvent[]): Promise<PublishManyResult>;
+}
+//#endregion
+export { DomainEvent, EventMeta, PublishManyResult, RepositoryEventPublisher };

package/dist/filter/from-record.d.mts

@@ -0,0 +1,13 @@
+import { Filter } from "./types.mjs";
+
+//#region src/filter/from-record.d.ts
+/**
+ * Convert a plain record (Mongo-style query object) into a Filter IR
+ * tree. Multiple top-level keys AND together. Empty record → `TRUE`.
+ *
+ * Already-IR inputs (anything with a `.op` field) pass through
+ * unchanged so callers can mix-and-match without branching.
+ */
+declare function recordToFilter(input: Filter | Record<string, unknown>): Filter;
+//#endregion
+export { recordToFilter };

package/dist/filter/from-record.mjs

@@ -0,0 +1,135 @@
+import { TRUE, and, contains, endsWith, eq, gt, gte, in_, isNotNull, isNull, like, lt, lte, ne, nin, startsWith } from "./builders.mjs";
+//#region src/filter/from-record.ts
+/**
+* Plain-record → Filter IR conversion — the canonical normalizer every
+* kit shares (promoted from per-kit copies in repo-core 0.6.0).
+*
+* The portable Filter IR is the canonical input every kit's compile path
+* expects, but several surfaces accept a record-shape shorthand for
+* ergonomics:
+*
+*   - `LookupSpec.where` (declared as `Filter | Record<string, unknown>`)
+*   - `AggRequest.filter` and `AggRequest.having`
+*   - Top-level filter args on `getAll`, `getOne`, etc.
+*
+* Mongo-style record syntax maps cleanly to IR leaves:
+*
+*   `{ status: 'active' }`               → `eq('status', 'active')`
+*   `{ price: { gte: 100, lt: 1000 } }`  → `and(gte('price', 100), lt('price', 1000))`
+*   `{ tags: { in: ['a', 'b'] } }`       → `in_('tags', ['a', 'b'])`
+*   `{ deletedAt: null }`                → `isNull('deletedAt')`
+*   `{ active: true, role: 'admin' }`    → `and(eq('active', true), eq('role', 'admin'))`
+*
+* Out of scope here:
+*   - Logical operators inside the record (`$or`, `$and`) — callers
+*     who need them should construct the IR directly.
+*   - Mongo's `$ne` / `$exists` etc. with leading `$` — kits sanitize
+*     dangerous operators upstream; if hosts want raw record-mongo
+*     syntax they reach for `compileFilterToMongo` (mongokit-specific).
+*/
+/**
+* True when the value looks like an operator object — a non-array
+* non-Date object whose keys are all known operators. Anything else
+* is treated as a literal value (including `Date`, arrays, primitives).
+*/
+function isOperatorObject(value) {
+	if (value === null || typeof value !== "object") return false;
+	if (Array.isArray(value)) return false;
+	if (value instanceof Date) return false;
+	const keys = Object.keys(value);
+	if (keys.length === 0) return false;
+	return keys.every((k) => KNOWN_OPS.has(k));
+}
+const KNOWN_OPS = new Set([
+	"eq",
+	"ne",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"in",
+	"nin",
+	"like",
+	"contains",
+	"startsWith",
+	"endsWith",
+	"exists"
+]);
+/**
+* Convert a single `field: value` pair into one Filter IR leaf (or
+* an `and(...)` node when the value carries multiple operators).
+*/
+function leafFromRecord(field, value) {
+	if (value === null) return isNull(field);
+	if (value === void 0) return TRUE;
+	if (!isOperatorObject(value)) {
+		if (Array.isArray(value)) return in_(field, value);
+		return eq(field, value);
+	}
+	const ops = [];
+	for (const [op, v] of Object.entries(value)) switch (op) {
+		case "eq":
+			ops.push(v === null ? isNull(field) : eq(field, v));
+			break;
+		case "ne":
+			ops.push(v === null ? isNotNull(field) : ne(field, v));
+			break;
+		case "gt":
+			ops.push(gt(field, v));
+			break;
+		case "gte":
+			ops.push(gte(field, v));
+			break;
+		case "lt":
+			ops.push(lt(field, v));
+			break;
+		case "lte":
+			ops.push(lte(field, v));
+			break;
+		case "in":
+			ops.push(in_(field, v));
+			break;
+		case "nin":
+			ops.push(nin(field, v));
+			break;
+		case "like":
+			ops.push(like(field, v));
+			break;
+		case "contains":
+			ops.push(contains(field, v));
+			break;
+		case "startsWith":
+			ops.push(startsWith(field, v));
+			break;
+		case "endsWith":
+			ops.push(endsWith(field, v));
+			break;
+		case "exists":
+			ops.push(v ? isNotNull(field) : isNull(field));
+			break;
+	}
+	if (ops.length === 0) return TRUE;
+	if (ops.length === 1) return ops[0];
+	return and(...ops);
+}
+/**
+* Convert a plain record (Mongo-style query object) into a Filter IR
+* tree. Multiple top-level keys AND together. Empty record → `TRUE`.
+*
+* Already-IR inputs (anything with a `.op` field) pass through
+* unchanged so callers can mix-and-match without branching.
+*/
+function recordToFilter(input) {
+	if (input && typeof input === "object" && "op" in input && typeof input.op === "string") return input;
+	const record = input;
+	const leaves = [];
+	for (const [field, value] of Object.entries(record)) {
+		if (value === void 0) continue;
+		leaves.push(leafFromRecord(field, value));
+	}
+	if (leaves.length === 0) return TRUE;
+	if (leaves.length === 1) return leaves[0];
+	return and(...leaves);
+}
+//#endregion
+export { recordToFilter };

package/dist/filter/index.d.mts

@@ -1,7 +1,8 @@
 import { Filter, FilterAnd, FilterEq, FilterExists, FilterFalse, FilterGt, FilterGte, FilterIn, FilterLike, FilterLt, FilterLte, FilterNe, FilterNin, FilterNot, FilterOp, FilterOr, FilterRaw, FilterRegex, FilterTrue } from "./types.mjs";
 import { FALSE, TRUE, and, between, contains, endsWith, eq, exists, gt, gte, iEq, in_, isNotNull, isNull, like, lt, lte, ne, nin, not, or, raw, regex, startsWith } from "./builders.mjs";
+import { recordToFilter } from "./from-record.mjs";
 import { isFilter } from "./guard.mjs";
 import { asPredicate, matchFilter } from "./match.mjs";
 import { SCOPE_ANY, buildTenantScope, mergeScope } from "./scope.mjs";
 import { collectFields, mapFilter, walkFilter } from "./walk.mjs";
-export { FALSE, type Filter, type FilterAnd, type FilterEq, type FilterExists, type FilterFalse, type FilterGt, type FilterGte, type FilterIn, type FilterLike, type FilterLt, type FilterLte, type FilterNe, type FilterNin, type FilterNot, type FilterOp, type FilterOr, type FilterRaw, type FilterRegex, type FilterTrue, SCOPE_ANY, TRUE, and, in_ as anyOf, asPredicate, between, buildTenantScope, collectFields, contains, endsWith, eq, exists, gt, gte, iEq, in_, not as invert, isFilter, isNotNull, isNull, like, lt, lte, mapFilter, matchFilter, mergeScope, ne, nin, nin as noneOf, not, or, raw, regex, startsWith, walkFilter };
+export { FALSE, type Filter, type FilterAnd, type FilterEq, type FilterExists, type FilterFalse, type FilterGt, type FilterGte, type FilterIn, type FilterLike, type FilterLt, type FilterLte, type FilterNe, type FilterNin, type FilterNot, type FilterOp, type FilterOr, type FilterRaw, type FilterRegex, type FilterTrue, SCOPE_ANY, TRUE, and, in_ as anyOf, asPredicate, between, buildTenantScope, collectFields, contains, endsWith, eq, exists, gt, gte, iEq, in_, not as invert, isFilter, isNotNull, isNull, like, lt, lte, mapFilter, matchFilter, mergeScope, ne, nin, nin as noneOf, not, or, raw, recordToFilter, regex, startsWith, walkFilter };

package/dist/filter/index.mjs

@@ -1,6 +1,7 @@
 import { FALSE, TRUE, and, between, contains, endsWith, eq, exists, gt, gte, iEq, in_, isNotNull, isNull, like, lt, lte, ne, nin, not, or, raw, regex, startsWith } from "./builders.mjs";
+import { recordToFilter } from "./from-record.mjs";
 import { isFilter } from "./guard.mjs";
 import { asPredicate, matchFilter } from "./match.mjs";
 import { SCOPE_ANY, buildTenantScope, mergeScope } from "./scope.mjs";
 import { collectFields, mapFilter, walkFilter } from "./walk.mjs";
-export { FALSE, SCOPE_ANY, TRUE, and, in_ as anyOf, asPredicate, between, buildTenantScope, collectFields, contains, endsWith, eq, exists, gt, gte, iEq, in_, not as invert, isFilter, isNotNull, isNull, like, lt, lte, mapFilter, matchFilter, mergeScope, ne, nin, nin as noneOf, not, or, raw, regex, startsWith, walkFilter };
+export { FALSE, SCOPE_ANY, TRUE, and, in_ as anyOf, asPredicate, between, buildTenantScope, collectFields, contains, endsWith, eq, exists, gt, gte, iEq, in_, not as invert, isFilter, isNotNull, isNull, like, lt, lte, mapFilter, matchFilter, mergeScope, ne, nin, nin as noneOf, not, or, raw, recordToFilter, regex, startsWith, walkFilter };

package/dist/hooks/priority.d.mts

@@ -12,7 +12,13 @@
  * compose identically.
  */
 declare const HOOK_PRIORITY: {
-  /** Policy enforcement — tenant isolation, soft-delete filtering, validation. */readonly POLICY: 100; /** Cache lookup / store — must run after policy so filters are in the key. */
+  /** Policy enforcement — tenant isolation, soft-delete filtering. */readonly POLICY: 100;
+  /**
+   * Input validation — Standard Schema / custom validators. Runs after
+   * policy (so tenant-stamped fields are present on the payload) and
+   * before cache (an invalid request must never claim a cache slot).
+   */
+  readonly VALIDATION: 150; /** Cache lookup / store — must run after policy so filters are in the key. */
   readonly CACHE: 200; /** Observability — audit logging, metrics, telemetry. Must not mutate context. */
   readonly OBSERVABILITY: 300; /** Default priority for user-registered hooks with no explicit priority. */
   readonly DEFAULT: 500;

package/dist/hooks/priority.mjs

@@ -13,6 +13,7 @@
 */
 const HOOK_PRIORITY = {
 	POLICY: 100,
+	VALIDATION: 150,
 	CACHE: 200,
 	OBSERVABILITY: 300,
 	DEFAULT: 500

package/dist/repository/base.d.mts

@@ -1,6 +1,8 @@
 import { RepositoryContext } from "../context/types.mjs";
+import { RepositoryEventsOptions } from "../events/emit.mjs";
 import { HookListener, HookMode } from "../hooks/types.mjs";
 import { HookEngine } from "../hooks/engine.mjs";
+import { StandardSchemaV1 } from "../schema/standard-schema.mjs";
 import { PluginType } from "./plugin-types.mjs";
 
 //#region src/repository/base.d.ts
@@ -16,6 +18,30 @@ interface RepositoryBaseOptions {
   pluginOrderChecks?: 'warn' | 'throw' | 'off';
   /** Optional callback for plugin-order warnings (defaults to `console.warn`). */
   onPluginOrderWarning?: (message: string) => void;
+  /**
+   * Standard Schema validator (Zod 3.24+, Valibot 1+, ArkType 2+, ...) for
+   * write payloads. Validates `create` data and every `createMany` doc at
+   * `HOOK_PRIORITY.VALIDATION` — after policy plugins (tenant-stamped fields
+   * are present), before cache/observability. Failures throw an `HttpError`
+   * 400 with structured `validationErrors`.
+   *
+   * Validator output replaces the payload, so coercions/defaults declared in
+   * the schema flow into the write.
+   */
+  schema?: StandardSchemaV1;
+  /**
+   * Standard Schema validator for `update` payloads. Separate slot because
+   * updates are partial — derive one explicitly (`schema.partial()` in Zod)
+   * rather than having repo-core guess partial semantics per vendor.
+   */
+  updateSchema?: StandardSchemaV1;
+  /**
+   * Domain-event emission. Pass any arc / `@classytic/primitives`-compatible
+   * transport and every mutating op publishes `<resource>.<verb>` events
+   * (`user.created`, `user.updated`, ...). Omit and the wiring is inert.
+   * See `@classytic/repo-core/events` for naming + delivery semantics.
+   */
+  events?: RepositoryEventsOptions;
 }
 /**
  * Base class every driver kit extends. Exposes the hook surface
@@ -35,6 +61,12 @@ declare abstract class RepositoryBase {
    */
   [key: string]: unknown;
   constructor(options: RepositoryBaseOptions);
+  /**
+   * Wire Standard Schema validation into the write lifecycle. Validator
+   * output replaces the payload so schema-declared coercions and defaults
+   * flow into the write.
+   */
+  private _registerSchemaValidation;
   /** Install a plugin (object with `apply(repo)` or a plain function). */
   use(plugin: PluginType): this;
   /**

package/dist/repository/base.mjs

@@ -1,4 +1,7 @@
 import { HookEngine } from "../hooks/engine.mjs";
+import { HOOK_PRIORITY } from "../hooks/priority.mjs";
+import { registerRepositoryEvents } from "../events/emit.mjs";
+import { validateStandardSchema } from "../schema/standard-schema.mjs";
 import { validatePluginOrder } from "./plugin-types.mjs";
 //#region src/repository/base.ts
 /**
@@ -18,6 +21,28 @@ var RepositoryBase = class {
 		for (let i = 0; i < plugins.length; i++) assertValidPlugin(plugins[i], this.modelName, i);
 		validatePluginOrder(plugins, this.modelName, options.pluginOrderChecks ?? "warn", options.onPluginOrderWarning);
 		for (const plugin of plugins) this.use(plugin);
+		if (options.schema) this._registerSchemaValidation(options.schema, options.updateSchema);
+		if (options.events) registerRepositoryEvents(this, options.events);
+	}
+	/**
+	* Wire Standard Schema validation into the write lifecycle. Validator
+	* output replaces the payload so schema-declared coercions and defaults
+	* flow into the write.
+	*/
+	_registerSchemaValidation(schema, updateSchema) {
+		const validation = { priority: HOOK_PRIORITY.VALIDATION };
+		this.on("before:create", async (context) => {
+			if (context.data === void 0) return;
+			context.data = await validateStandardSchema(schema, context.data);
+		}, validation);
+		this.on("before:createMany", async (context) => {
+			if (!Array.isArray(context.dataArray)) return;
+			context.dataArray = await Promise.all(context.dataArray.map((doc) => validateStandardSchema(schema, doc)));
+		}, validation);
+		if (updateSchema) this.on("before:update", async (context) => {
+			if (context.data === void 0) return;
+			context.data = await validateStandardSchema(updateSchema, context.data);
+		}, validation);
 	}
 	/** Install a plugin (object with `apply(repo)` or a plain function). */
 	use(plugin) {