@open-core/framework 1.0.2-beta.1 → 1.0.5-beta.1

package/dist/runtime/server/system/processors/netEvent.processor.js

@@ -0,0 +1,243 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { inject, injectable } from 'tsyringe';
+import z from 'zod';
+import { AppError, SecurityError } from '../../../../';
+import { EventsAPI } from '../../../../adapters/contracts/transport/events.api';
+import { coreLogger, loggers } from '../../../../kernel/logger';
+import { NetEventSecurityObserverContract, } from '../../contracts/security/net-event-security-observer.contract';
+import { SecurityHandlerContract } from '../../contracts/security/security-handler.contract';
+import { processTupleSchema } from '../../helpers/process-tuple-schema';
+import { resolveMethod } from '../../helpers/resolve-method';
+import { Players } from '../../ports/players.api-port';
+import { METADATA_KEYS } from '../metadata-server.keys';
+import { generateSchemaFromTypes } from '../schema-generator';
+let NetEventProcessor = class NetEventProcessor {
+    playerService;
+    securityHandler;
+    netEventObserver;
+    events;
+    metadataKey = METADATA_KEYS.NET_EVENT;
+    INVALID_COUNTS_META_KEY = 'netEvent.invalidCounts';
+    constructor(playerService, securityHandler, netEventObserver, events) {
+        this.playerService = playerService;
+        this.securityHandler = securityHandler;
+        this.netEventObserver = netEventObserver;
+        this.events = events;
+    }
+    process(instance, methodName, metadata) {
+        const result = resolveMethod(instance, methodName, `[NetEventProcessor] Method "${methodName}" not found`);
+        if (!result)
+            return;
+        const { handler, handlerName, proto } = result;
+        const isPublic = Reflect.getMetadata(METADATA_KEYS.PUBLIC, proto, methodName);
+        this.events.on(metadata.eventName, async (ctx, ...args) => {
+            const clientId = ctx.clientId;
+            if (clientId === undefined) {
+                loggers.netEvent.warn(`Event ignored: Missing clientId in context`, {
+                    event: metadata.eventName,
+                });
+                return;
+            }
+            const player = this.playerService.getByClient(clientId);
+            if (!player) {
+                loggers.netEvent.warn(`Event ignored: Player session not found`, {
+                    event: metadata.eventName,
+                    clientId: clientId,
+                });
+                return;
+            }
+            // ═══════════════════════════════════════════════════════════════
+            // SECURE BY DEFAULT: Require authentication unless @Public()
+            // ═══════════════════════════════════════════════════════════════
+            if (!isPublic && !player.accountID) {
+                loggers.security.warn(`Unauthenticated request blocked`, {
+                    event: metadata.eventName,
+                    clientId: clientId,
+                });
+                return;
+            }
+            let validatedArgs = args;
+            let schema;
+            try {
+                schema = metadata.schema ?? generateSchemaFromTypes(metadata.paramTypes);
+            }
+            catch (error) {
+                if (error instanceof AppError) {
+                    loggers.netEvent.fatal(error.message, { playerId: clientId }, error);
+                    return;
+                }
+                throw error;
+            }
+            if (!schema) {
+                loggers.netEvent.fatal(`Event '${metadata.eventName}' expects complex args but has no schema. Provide options.schema in @OnNet().`, { event: metadata.eventName, playerId: clientId });
+                return;
+            }
+            try {
+                if (schema instanceof z.ZodTuple) {
+                    const processedArgs = processTupleSchema(schema, args);
+                    validatedArgs = schema.parse(processedArgs);
+                }
+                else {
+                    if (args.length !== 1) {
+                        throw new SecurityError('LOG', `Invalid argument count in ${metadata.eventName}`, {
+                            expected: 1,
+                            received: args.length,
+                        });
+                    }
+                    validatedArgs = [schema.parse(args[0])];
+                }
+            }
+            catch (error) {
+                if (error instanceof z.ZodError) {
+                    await this.handleInvalidPayload({
+                        player,
+                        event: metadata.eventName,
+                        schema,
+                        receivedArgsCount: args.length,
+                        reason: 'zod',
+                        zodError: error,
+                    });
+                    return;
+                }
+                if (error instanceof SecurityError) {
+                    await this.handleInvalidPayload({
+                        player,
+                        event: metadata.eventName,
+                        schema,
+                        receivedArgsCount: args.length,
+                        reason: this.reasonFromSecurityError(error),
+                        violation: error,
+                    });
+                    return;
+                }
+                loggers.netEvent.error(`Validation error in event`, {
+                    event: metadata.eventName,
+                    playerId: player.clientID,
+                }, error);
+                return;
+            }
+            try {
+                await handler(player, ...validatedArgs);
+            }
+            catch (error) {
+                if (error instanceof SecurityError) {
+                    await this.handleInvalidPayload({
+                        player,
+                        event: metadata.eventName,
+                        schema,
+                        receivedArgsCount: args.length,
+                        reason: this.reasonFromSecurityError(error),
+                        violation: error,
+                    });
+                    return;
+                }
+                loggers.netEvent.error(`Handler error in event`, {
+                    event: metadata.eventName,
+                    handler: handlerName,
+                    playerId: player.clientID,
+                }, error);
+            }
+        });
+        loggers.netEvent.debug(`Registered: ${metadata.eventName} -> ${handlerName}`);
+    }
+    async safeHandleViolation(player, violation, event) {
+        try {
+            await this.securityHandler.handleViolation(player, violation);
+        }
+        catch (e) {
+            loggers.security.fatal(`Failed to handle security violation`, { event, playerId: player.clientID }, e);
+        }
+    }
+    reasonFromSecurityError(error) {
+        return error.message.includes('Invalid argument count') ? 'arg_count' : 'security_error';
+    }
+    async handleInvalidPayload(params) {
+        const invalidCount = this.incrementInvalidCount(params.player, params.event);
+        const zodSummary = params.zodError ? this.summarizeZodError(params.zodError) : undefined;
+        const ctx = {
+            event: params.event,
+            reason: params.reason,
+            playerId: params.player.clientID,
+            accountId: params.player.accountID,
+            invalidCount,
+            zodSummary,
+            receivedArgsCount: params.receivedArgsCount,
+            expectedArgsCount: this.getExpectedArgsCount(params.schema),
+        };
+        loggers.netEvent.warn(`Invalid payload`, {
+            event: ctx.event,
+            playerId: ctx.playerId,
+            accountId: ctx.accountId,
+            invalidCount: ctx.invalidCount,
+            reason: ctx.reason,
+            zodSummary: ctx.zodSummary,
+        });
+        await this.safeObserve(params.player, ctx);
+        if (params.violation) {
+            await this.safeHandleViolation(params.player, params.violation, params.event);
+            return;
+        }
+        if (params.zodError) {
+            const violation = new SecurityError('LOG', `Invalid data received in ${params.event}`, {
+                issues: zodSummary ?? params.zodError.message,
+            });
+            await this.safeHandleViolation(params.player, violation, params.event);
+        }
+    }
+    incrementInvalidCount(player, event) {
+        const counts = (player.getMeta(this.INVALID_COUNTS_META_KEY) ??
+            {});
+        counts[event] = (counts[event] ?? 0) + 1;
+        player.setMeta(this.INVALID_COUNTS_META_KEY, counts);
+        return counts[event];
+    }
+    summarizeZodError(error, maxIssues = 3) {
+        return error.issues.slice(0, maxIssues).map((issue) => {
+            const path = issue.path.length ? issue.path.join('.') : '<root>';
+            return `${path}: ${issue.message}`;
+        });
+    }
+    async safeObserve(player, ctx) {
+        try {
+            await this.netEventObserver.onInvalidPayload(player, ctx);
+        }
+        catch (e) {
+            coreLogger.error(`NetEvent observer failed`, { event: ctx.event, playerId: player.clientID }, e);
+        }
+    }
+    getExpectedArgsCount(schema) {
+        if (schema instanceof z.ZodTuple) {
+            const defItems = schema?._def?.items;
+            if (Array.isArray(defItems))
+                return defItems.length;
+            const items = schema?.items;
+            if (Array.isArray(items))
+                return items.length;
+            return undefined;
+        }
+        return 1;
+    }
+};
+NetEventProcessor = __decorate([
+    injectable(),
+    __param(0, inject(Players)),
+    __param(1, inject(SecurityHandlerContract)),
+    __param(2, inject(NetEventSecurityObserverContract)),
+    __param(3, inject(EventsAPI)),
+    __metadata("design:paramtypes", [Players,
+        SecurityHandlerContract,
+        NetEventSecurityObserverContract,
+        EventsAPI])
+], NetEventProcessor);
+export { NetEventProcessor };

package/dist/runtime/server/system/processors/onRpc.processor.d.ts

@@ -0,0 +1,12 @@
+import { RpcAPI } from '../../../../adapters/contracts/transport/rpc.api';
+import { type DecoratorProcessor } from '../../../../kernel/di/index';
+import { Players } from '../../ports/players.api-port';
+import { RpcHandlerOptions } from '../../decorators/onRPC';
+export declare class OnRpcProcessor implements DecoratorProcessor {
+    private readonly players;
+    private readonly rpc;
+    readonly metadataKey: string;
+    private readonly INVALID_COUNTS_META_KEY;
+    constructor(players: Players, rpc: RpcAPI<'server'>);
+    process(instance: any, methodName: string, metadata: RpcHandlerOptions): void;
+}

package/dist/runtime/server/system/processors/onRpc.processor.js

@@ -0,0 +1,142 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { inject, injectable } from 'tsyringe';
+import z from 'zod';
+import { AppError } from '../../../../';
+import { RpcAPI } from '../../../../adapters/contracts/transport/rpc.api';
+import { loggers } from '../../../../kernel/logger';
+import { Player } from '../../entities/player';
+import { processTupleSchema } from '../../helpers/process-tuple-schema';
+import { resolveMethod } from '../../helpers/resolve-method';
+import { Players } from '../../ports/players.api-port';
+import { METADATA_KEYS } from '../metadata-server.keys';
+import { generateSchemaFromTypes } from '../schema-generator';
+let OnRpcProcessor = class OnRpcProcessor {
+    players;
+    rpc;
+    metadataKey = METADATA_KEYS.NET_RPC;
+    INVALID_COUNTS_META_KEY = 'rpcEvent.invalidCounts';
+    constructor(players, rpc) {
+        this.players = players;
+        this.rpc = rpc;
+    }
+    process(instance, methodName, metadata) {
+        const result = resolveMethod(instance, methodName, `[OnRpcProcessor] Method "${methodName}" not found`);
+        if (!result)
+            return;
+        const { handler, handlerName, proto } = result;
+        const isPublic = Reflect.getMetadata(METADATA_KEYS.PUBLIC, proto, methodName);
+        const invalidCounts = Reflect.getMetadata(this.INVALID_COUNTS_META_KEY, proto) ??
+            new Set();
+        const key = `${metadata.eventName}:${handlerName}`;
+        if (invalidCounts.has(key))
+            return;
+        const paramTypes = metadata.paramTypes;
+        const hasDesignParamTypes = Array.isArray(paramTypes);
+        const hasNoDeclaredParams = hasDesignParamTypes && paramTypes.length === 0;
+        if (hasDesignParamTypes && paramTypes.length > 0 && paramTypes[0] !== Player) {
+            invalidCounts.add(key);
+            Reflect.defineMetadata(this.INVALID_COUNTS_META_KEY, invalidCounts, proto);
+            throw new Error(`@OnRPC '${metadata.eventName}' must declare Player as the first parameter`);
+        }
+        let schema;
+        try {
+            if (metadata.schema) {
+                schema = metadata.schema;
+            }
+            else if (hasNoDeclaredParams) {
+                schema = z.tuple([]);
+            }
+            else if (hasDesignParamTypes) {
+                schema = generateSchemaFromTypes(paramTypes);
+            }
+            else {
+                invalidCounts.add(key);
+                Reflect.defineMetadata(this.INVALID_COUNTS_META_KEY, invalidCounts, proto);
+                throw new Error(`@OnRPC '${metadata.eventName}' requires schema when design:paramtypes metadata is unavailable`);
+            }
+        }
+        catch (error) {
+            if (error instanceof AppError) {
+                loggers.netEvent.fatal(error.message, { event: metadata.eventName }, error);
+                invalidCounts.add(key);
+                Reflect.defineMetadata(this.INVALID_COUNTS_META_KEY, invalidCounts, proto);
+                return;
+            }
+            throw error;
+        }
+        if (!schema) {
+            loggers.netEvent.fatal(`RPC '${metadata.eventName}' expects complex args but has no schema. Provide schema in @OnRPC().`, { event: metadata.eventName });
+            invalidCounts.add(key);
+            Reflect.defineMetadata(this.INVALID_COUNTS_META_KEY, invalidCounts, proto);
+            return;
+        }
+        this.rpc.on(metadata.eventName, async (ctx, ...args) => {
+            const clientId = ctx.clientId;
+            if (clientId === undefined) {
+                loggers.netEvent.warn(`RPC ignored: Missing clientId in context`, {
+                    event: metadata.eventName,
+                });
+                return;
+            }
+            const player = this.players.getByClient(clientId);
+            if (!player) {
+                loggers.netEvent.warn(`RPC ignored: Player session not found`, {
+                    event: metadata.eventName,
+                    clientId,
+                });
+                return;
+            }
+            if (!isPublic && !player.accountID) {
+                loggers.security.warn(`Unauthenticated RPC blocked`, {
+                    event: metadata.eventName,
+                    clientId,
+                });
+                return;
+            }
+            let validatedArgs = args;
+            try {
+                if (schema instanceof z.ZodTuple) {
+                    const processedArgs = processTupleSchema(schema, args);
+                    validatedArgs = schema.parse(processedArgs);
+                }
+                else {
+                    if (args.length !== 1) {
+                        throw new Error(`Invalid argument count in ${metadata.eventName}`);
+                    }
+                    validatedArgs = [schema.parse(args[0])];
+                }
+            }
+            catch (error) {
+                loggers.netEvent.warn(`Invalid RPC payload`, {
+                    event: metadata.eventName,
+                    clientId,
+                });
+                throw error;
+            }
+            if (hasNoDeclaredParams) {
+                return handler();
+            }
+            return handler(player, ...validatedArgs);
+        });
+        loggers.netEvent.debug(`Registered RPC: ${metadata.eventName} -> ${handlerName}`);
+    }
+};
+OnRpcProcessor = __decorate([
+    injectable(),
+    __param(0, inject(Players)),
+    __param(1, inject(RpcAPI)),
+    __metadata("design:paramtypes", [Players,
+        RpcAPI])
+], OnRpcProcessor);
+export { OnRpcProcessor };

package/dist/runtime/server/system/processors/runtimeEvent.processor.d.ts

@@ -0,0 +1,10 @@
+import { IEngineEvents } from '../../../../adapters/contracts/IEngineEvents';
+import { type DecoratorProcessor } from '../../../../kernel/di/index';
+export declare class RuntimeEventProcessor implements DecoratorProcessor {
+    private readonly engineEvents;
+    readonly metadataKey: string;
+    constructor(engineEvents: IEngineEvents);
+    process(instance: any, methodName: string, metadata: {
+        event: string;
+    }): void;
+}

package/dist/runtime/server/system/processors/runtimeEvent.processor.js

@@ -0,0 +1,48 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { inject, injectable } from 'tsyringe';
+import { IEngineEvents } from '../../../../adapters/contracts/IEngineEvents';
+import { loggers } from '../../../../kernel/logger';
+import { resolveMethod } from '../../helpers/resolve-method';
+import { METADATA_KEYS } from '../metadata-server.keys';
+let RuntimeEventProcessor = class RuntimeEventProcessor {
+    engineEvents;
+    metadataKey = METADATA_KEYS.RUNTIME_EVENT;
+    constructor(engineEvents) {
+        this.engineEvents = engineEvents;
+    }
+    process(instance, methodName, metadata) {
+        const result = resolveMethod(instance, methodName, `[RuntimeEventProcessor] Method "${methodName}" not found`);
+        if (!result)
+            return;
+        const { handler, handlerName } = result;
+        this.engineEvents.on(metadata.event, (...args) => {
+            try {
+                handler(...args);
+            }
+            catch (error) {
+                loggers.eventBus.error(`Handler error in runtime event`, {
+                    event: metadata.event,
+                    handler: handlerName,
+                }, error);
+            }
+        });
+        loggers.eventBus.debug(`Registered runtime event: ${metadata.event} -> ${handlerName}`);
+    }
+};
+RuntimeEventProcessor = __decorate([
+    injectable(),
+    __param(0, inject(IEngineEvents)),
+    __metadata("design:paramtypes", [IEngineEvents])
+], RuntimeEventProcessor);
+export { RuntimeEventProcessor };

package/dist/runtime/server/system/processors/tick.processor.d.ts

@@ -0,0 +1,8 @@
+import { ITick } from '../../../../adapters/contracts/ITick';
+import { type DecoratorProcessor } from '../../../../kernel/di/index';
+export declare class TickProcessor implements DecoratorProcessor {
+    private tickService;
+    readonly metadataKey: string;
+    constructor(tickService: ITick);
+    process(target: any, methodName: string): void;
+}

package/dist/runtime/server/system/processors/tick.processor.js

@@ -0,0 +1,44 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { inject, injectable } from 'tsyringe';
+import { ITick } from '../../../../adapters/contracts/ITick';
+import { loggers } from '../../../../kernel/logger';
+import { METADATA_KEYS } from '../metadata-server.keys';
+let TickProcessor = class TickProcessor {
+    tickService;
+    metadataKey = METADATA_KEYS.TICK;
+    constructor(tickService) {
+        this.tickService = tickService;
+    }
+    process(target, methodName) {
+        const handler = target[methodName].bind(target);
+        const handlerName = `${target.constructor.name}.${methodName}`;
+        this.tickService.setTick(async () => {
+            try {
+                await handler();
+            }
+            catch (error) {
+                loggers.tick.error(`Tick handler error`, {
+                    handler: handlerName,
+                }, error);
+            }
+        });
+        loggers.tick.debug(`Registered: ${handlerName}`);
+    }
+};
+TickProcessor = __decorate([
+    injectable(),
+    __param(0, inject(ITick)),
+    __metadata("design:paramtypes", [ITick])
+], TickProcessor);
+export { TickProcessor };

package/dist/runtime/server/system/processors.register.d.ts

@@ -0,0 +1,2 @@
+import { RuntimeContext } from '../runtime';
+export declare function registerSystemServer(ctx: RuntimeContext): void;

package/dist/runtime/server/system/processors.register.js

@@ -0,0 +1,43 @@
+import { GLOBAL_CONTAINER } from '../../../kernel/di/index';
+import { CommandErrorObserverContract } from '../contracts/security/command-error-observer.contract';
+import { NetEventSecurityObserverContract } from '../contracts/security/net-event-security-observer.contract';
+import { SecurityHandlerContract } from '../contracts/security/security-handler.contract';
+import { DefaultCommandErrorObserver } from '../default/default-command-error-observer';
+import { DefaultNetEventSecurityObserver } from '../default/default-net-event-security-observer';
+import { DefaultSecurityHandler } from '../default/default-security.handler';
+import { CommandProcessor } from './processors/command.processor';
+import { ExportProcessor } from './processors/export.processor';
+import { InternalEventProcessor } from './processors/internalEvent.processor';
+import { LibraryEventProcessor } from './processors/libraryEvent.processor';
+import { NetEventProcessor } from './processors/netEvent.processor';
+import { OnRpcProcessor } from './processors/onRpc.processor';
+import { RuntimeEventProcessor } from './processors/runtimeEvent.processor';
+import { TickProcessor } from './processors/tick.processor';
+export function registerSystemServer(ctx) {
+    const { features } = ctx;
+    if (features.netEvents.enabled) {
+        GLOBAL_CONTAINER.register('DecoratorProcessor', { useClass: NetEventProcessor });
+        GLOBAL_CONTAINER.register('DecoratorProcessor', { useClass: OnRpcProcessor });
+        if (!GLOBAL_CONTAINER.isRegistered(SecurityHandlerContract)) {
+            GLOBAL_CONTAINER.registerSingleton(SecurityHandlerContract, DefaultSecurityHandler);
+        }
+        if (!GLOBAL_CONTAINER.isRegistered(NetEventSecurityObserverContract)) {
+            GLOBAL_CONTAINER.registerSingleton(NetEventSecurityObserverContract, DefaultNetEventSecurityObserver);
+        }
+    }
+    GLOBAL_CONTAINER.register('DecoratorProcessor', { useClass: TickProcessor });
+    if (features.exports.enabled) {
+        GLOBAL_CONTAINER.register('DecoratorProcessor', { useClass: ExportProcessor });
+    }
+    GLOBAL_CONTAINER.register('DecoratorProcessor', { useClass: InternalEventProcessor });
+    GLOBAL_CONTAINER.register('DecoratorProcessor', { useClass: LibraryEventProcessor });
+    if (features.commands.enabled) {
+        GLOBAL_CONTAINER.register('DecoratorProcessor', { useClass: CommandProcessor });
+        if (!GLOBAL_CONTAINER.isRegistered(CommandErrorObserverContract)) {
+            GLOBAL_CONTAINER.registerSingleton(CommandErrorObserverContract, DefaultCommandErrorObserver);
+        }
+    }
+    if (features.runtimeEvents.enabled) {
+        GLOBAL_CONTAINER.register('DecoratorProcessor', { useClass: RuntimeEventProcessor });
+    }
+}

package/dist/runtime/server/system/schema-generator.d.ts

@@ -0,0 +1,2 @@
+import z from 'zod';
+export declare function generateSchemaFromTypes(paramTypes: any[]): z.ZodTuple | undefined;

package/dist/runtime/server/system/schema-generator.js

@@ -0,0 +1,38 @@
+import z from 'zod';
+import { AppError } from '../../../';
+import { Player } from '../entities/player';
+function typeToZodSchema(type) {
+    switch (type) {
+        case String:
+            // Use string().min(1) to reject empty/undefined values
+            // Command args are already strings, no coercion needed
+            return z.string().min(1);
+        case Number:
+            return z.coerce.number();
+        case Boolean:
+            return z.coerce.boolean();
+        case Array:
+            // Command/event arguments are always strings, so Array means string[]
+            // This enables spread operator support: handler(player: Player, ...args: string[])
+            return z.array(z.string());
+        case Object:
+            return undefined;
+    }
+}
+export function generateSchemaFromTypes(paramTypes) {
+    if (!paramTypes || paramTypes.length === 0)
+        return z.tuple([]);
+    if (paramTypes[0] !== Player) {
+        throw new AppError('SCHEMA:VALIDATION_ERROR', `First parameter must be Player, got ${paramTypes[0]?.name}`, 'core');
+    }
+    if (paramTypes.length === 1)
+        return z.tuple([]);
+    const argSchemas = [];
+    for (const t of paramTypes.slice(1)) {
+        const s = typeToZodSchema(t);
+        if (!s)
+            return undefined;
+        argSchemas.push(s);
+    }
+    return z.tuple(argSchemas);
+}

package/dist/runtime/server/types/channel.types.d.ts

@@ -0,0 +1,44 @@
+import { RGB } from '../../../kernel/utils/rgb';
+import { Player } from '../entities';
+export declare enum ChannelType {
+    GLOBAL = "global",
+    PROXIMITY = "proximity",
+    RADIO = "radio",
+    PHONE = "phone",
+    GROUP = "group",
+    ADMIN = "admin",
+    CUSTOM = "custom"
+}
+export interface ChannelMetadata {
+    type: ChannelType;
+    frequency?: number;
+    maxRange?: number;
+    encrypted?: boolean;
+    persistent?: boolean;
+    [key: string]: unknown;
+}
+export interface ChannelMessage {
+    channelId: string;
+    sender: Player;
+    message: string;
+    author?: string;
+    color?: RGB;
+    timestamp: number;
+}
+export interface ChannelSubscription {
+    player: Player;
+    subscribedAt: number;
+    metadata?: Record<string, unknown>;
+}
+export interface ChannelConfig {
+    id: string;
+    metadata: ChannelMetadata;
+    allowDuplicateSubscribers?: boolean;
+    maxSubscribers?: number;
+    requirePermission?: string;
+}
+export interface IChannelValidator {
+    canSubscribe(player: Player, channelId: string): boolean;
+    canBroadcast(player: Player, channelId: string): boolean;
+    canCreate(player: Player, channelId: string): boolean;
+}

package/dist/runtime/server/types/channel.types.js

@@ -0,0 +1,10 @@
+export var ChannelType;
+(function (ChannelType) {
+    ChannelType["GLOBAL"] = "global";
+    ChannelType["PROXIMITY"] = "proximity";
+    ChannelType["RADIO"] = "radio";
+    ChannelType["PHONE"] = "phone";
+    ChannelType["GROUP"] = "group";
+    ChannelType["ADMIN"] = "admin";
+    ChannelType["CUSTOM"] = "custom";
+})(ChannelType || (ChannelType = {}));