@clovnet/casino-sdk 1.0.0

package/dist/index.js

@@ -0,0 +1,2298 @@
+// src/config.ts
+var COOKIE = {
+  access: "cwe_access_token",
+  refresh: "cwe_refresh_token",
+  csrf: "cwe_csrf"
+};
+var HEADER = {
+  tenant: "x-tenant-id",
+  brand: "x-brand-id",
+  region: "x-region",
+  csrf: "x-csrf-token",
+  idempotency: "idempotency-key"
+};
+function resolveConfig(config) {
+  if (!config.baseUrl) throw new Error("createCasinoClient: `baseUrl` is required");
+  if (!config.tenantId) throw new Error("createCasinoClient: `tenantId` is required");
+  const fetchImpl = config.fetch ?? globalThis.fetch?.bind(globalThis);
+  if (!fetchImpl) {
+    throw new Error(
+      "createCasinoClient: no global `fetch` found; pass `fetch` in config (Node < 18)."
+    );
+  }
+  return {
+    baseUrl: stripTrailingSlash(config.baseUrl),
+    wsUrl: config.wsUrl ?? deriveWsUrl(config.baseUrl),
+    tenantId: config.tenantId,
+    brandId: config.brandId,
+    region: config.region,
+    defaultCurrency: (config.defaultCurrency ?? "EUR").toUpperCase(),
+    fetch: fetchImpl,
+    onAuthError: config.onAuthError,
+    autoRefresh: config.autoRefresh ?? true,
+    cookieJar: config.cookieJar,
+    timeoutMs: config.timeoutMs ?? 3e4
+  };
+}
+function stripTrailingSlash(url) {
+  return url.replace(/\/+$/, "");
+}
+function deriveWsUrl(baseUrl) {
+  return `${stripTrailingSlash(baseUrl).replace(/^http/, "ws")}/realtime`;
+}
+
+// src/core/cookies.ts
+var isBrowser = () => typeof document !== "undefined" && typeof document.cookie === "string";
+var CookieJar = class {
+  store = /* @__PURE__ */ new Map();
+  /** Read a cookie value by name, or undefined. */
+  get(name) {
+    return this.store.get(name);
+  }
+  /** Serialize all cookies into a `Cookie` request-header value. */
+  header() {
+    if (this.store.size === 0) return void 0;
+    return [...this.store.entries()].map(([k, v]) => `${k}=${v}`).join("; ");
+  }
+  /** Clear the jar (e.g. on logout). */
+  clear() {
+    this.store.clear();
+  }
+  /**
+   * Ingest `set-cookie` header(s) from a response. Only the `name=value` pair is
+   * retained (attributes like Path/HttpOnly are ignored — this jar is a dev/SSR
+   * convenience, not a spec-complete cookie store). A `Max-Age<=0` or an `Expires`
+   * in the past deletes the cookie; `Max-Age` wins when both are present.
+   */
+  ingest(setCookie) {
+    if (!setCookie) return;
+    const lines = Array.isArray(setCookie) ? setCookie : splitSetCookie(setCookie);
+    for (const line of lines) {
+      const [pair, ...attrs] = line.split(";");
+      if (!pair) continue;
+      const eq = pair.indexOf("=");
+      if (eq < 0) continue;
+      const name = pair.slice(0, eq).trim();
+      const value = pair.slice(eq + 1).trim();
+      if (!name) continue;
+      if (isExpired(attrs)) this.store.delete(name);
+      else this.store.set(name, value);
+    }
+  }
+};
+function isExpired(attrs) {
+  let expires;
+  for (const attr of attrs) {
+    const eq = attr.indexOf("=");
+    const key = (eq === -1 ? attr : attr.slice(0, eq)).trim().toLowerCase();
+    const value = eq === -1 ? void 0 : attr.slice(eq + 1).trim();
+    if (key === "max-age" && value !== void 0) return Number(value) <= 0;
+    if (key === "expires" && value !== void 0) expires = value;
+  }
+  if (expires !== void 0) {
+    const time = Date.parse(expires);
+    if (!Number.isNaN(time)) return time <= Date.now();
+  }
+  return false;
+}
+function splitSetCookie(header) {
+  const out = [];
+  let start = 0;
+  for (let i = 0; i < header.length; i++) {
+    if (header[i] === ",") {
+      const ahead = header.slice(i + 1, i + 12).toLowerCase();
+      const before = header.slice(start, i);
+      if (/expires=\w{3}$/i.test(before.trim()) || /^\s*\d{1,2}-\w{3}/.test(ahead)) {
+        continue;
+      }
+      out.push(header.slice(start, i).trim());
+      start = i + 1;
+    }
+  }
+  out.push(header.slice(start).trim());
+  return out.filter(Boolean);
+}
+function readCookie(name, jar) {
+  if (isBrowser()) {
+    const match = document.cookie.split(";").map((c) => c.trim()).find((c) => c.startsWith(`${name}=`));
+    if (match) return decodeURIComponent(match.slice(name.length + 1));
+  }
+  return jar?.get(name);
+}
+
+// src/core/errors.ts
+function isAppErrorEnvelope(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const err = value.error;
+  return typeof err === "object" && err !== null && typeof err.code === "string" && typeof err.message === "string";
+}
+var CasinoSdkError = class extends Error {
+  code;
+  status;
+  details;
+  constructor(code, message, status = 0, details) {
+    super(message);
+    this.name = new.target.name;
+    this.code = code;
+    this.status = status;
+    if (details !== void 0) this.details = details;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var AuthError = class extends CasinoSdkError {
+};
+var ForbiddenError = class extends CasinoSdkError {
+};
+var ValidationError = class extends CasinoSdkError {
+};
+var NotFoundError = class extends CasinoSdkError {
+};
+var ConflictError = class extends CasinoSdkError {
+};
+var InsufficientFundsError = class extends CasinoSdkError {
+};
+var UnprocessableError = class extends CasinoSdkError {
+};
+var OperationDeniedError = class extends CasinoSdkError {
+};
+var RateLimitError = class extends CasinoSdkError {
+};
+var FlowDelegatedError = class extends ConflictError {
+  /** The plugin that owns the delegated flow (from `details.pluginKey`). */
+  pluginKey;
+  /** The delegated flow kind (from `details.flow`), e.g. `"deposit"`. */
+  flow;
+  /**
+   * Set (best-effort, by the SDK) when the ext catalog shows an action named
+   * after the flow — `sdk.ext(pluginKey).call(continueWith.actionKey, …)` is
+   * then the way to continue. Left `undefined` when the catalog lookup fails;
+   * the original error is never masked.
+   */
+  continueWith;
+  constructor(code, message, status = 0, details) {
+    super(code, message, status, details);
+    const d = typeof details === "object" && details !== null ? details : {};
+    this.pluginKey = typeof d.pluginKey === "string" ? d.pluginKey : "";
+    this.flow = typeof d.flow === "string" ? d.flow : void 0;
+  }
+  /** Sugar for `sdk.ext(this.pluginKey)` — the plugin client to continue the flow with. */
+  resolve(sdk) {
+    if (!this.pluginKey) {
+      throw new Error("FlowDelegatedError.resolve(): the error carried no details.pluginKey.");
+    }
+    return sdk.ext(this.pluginKey);
+  }
+};
+var RgBlockedError = class extends CasinoSdkError {
+};
+var LimitExceededError = class extends CasinoSdkError {
+};
+var ServerError = class extends CasinoSdkError {
+};
+var NetworkError = class extends CasinoSdkError {
+};
+var NotImplementedError = class extends CasinoSdkError {
+  constructor(message) {
+    super("NOT_IMPLEMENTED", message, 0);
+  }
+};
+var PluginNotEnabledError = class extends NotFoundError {
+  pluginKey;
+  constructor(pluginKey, options) {
+    super(
+      options?.code ?? "PLUGIN_NOT_ENABLED",
+      options?.message ?? `Plugin "${pluginKey}" is not enabled for this tenant.`,
+      options?.status ?? 0,
+      options?.details
+    );
+    this.pluginKey = pluginKey;
+  }
+};
+var PluginActionNotFoundError = class extends NotFoundError {
+  pluginKey;
+  actionKey;
+  constructor(pluginKey, actionKey) {
+    super(
+      "PLUGIN_ACTION_NOT_FOUND",
+      `Plugin "${pluginKey}" declares no action "${actionKey}" in its catalog.`,
+      0
+    );
+    this.pluginKey = pluginKey;
+    this.actionKey = actionKey;
+  }
+};
+var PluginUnavailableError = class extends ServerError {
+};
+var PluginVersionMismatchError = class extends ConflictError {
+  pluginKey;
+  expectedRange;
+  actualVersion;
+  constructor(pluginKey, expectedRange, actualVersion) {
+    super(
+      "PLUGIN_VERSION_MISMATCH",
+      `Plugin "${pluginKey}" is installed at ${actualVersion}, but this client expects ${expectedRange}.`,
+      0,
+      { pluginKey, expectedRange, actualVersion }
+    );
+    this.pluginKey = pluginKey;
+    this.expectedRange = expectedRange;
+    this.actualVersion = actualVersion;
+  }
+};
+var CODE_TO_CLASS = {
+  VALIDATION_ERROR: ValidationError,
+  TENANT_CONTEXT_ERROR: ValidationError,
+  UNAUTHORIZED: AuthError,
+  REALTIME_UNAUTHORIZED: AuthError,
+  REALTIME_AUTH: AuthError,
+  FORBIDDEN: ForbiddenError,
+  NOT_FOUND: NotFoundError,
+  CONFLICT: ConflictError,
+  INVALID_STATE_TRANSITION: ConflictError,
+  INVALID_WITHDRAWAL_STATE: ConflictError,
+  INSUFFICIENT_FUNDS: InsufficientFundsError,
+  DEPOSIT_DENIED: OperationDeniedError,
+  WITHDRAWAL_DENIED: OperationDeniedError,
+  DEPOSIT_LIMIT_EXCEEDED: OperationDeniedError,
+  WITHDRAWAL_LIMIT_EXCEEDED: OperationDeniedError,
+  RATE_LIMITED: RateLimitError,
+  FLOW_DELEGATED: FlowDelegatedError,
+  // Plugin handler timed out / crashed (plugin actions & ext routes).
+  PLUGIN_ROUTE_ERROR: PluginUnavailableError,
+  PLUGIN_ROUTE_TIMEOUT: PluginUnavailableError,
+  RG_BLOCKED: RgBlockedError,
+  LIMIT_EXCEEDED: LimitExceededError,
+  // 422 — a KYC document upload was rejected (bad format/size/expiry). Mapped to
+  // ValidationError (not the status-422 InsufficientFundsError fallback).
+  KYC_DOCUMENT_INVALID: ValidationError,
+  // 409 conflict-family domain codes.
+  KYC_REQUEST_STATE: ConflictError,
+  PROFILE_FIELD_LOCKED: ConflictError,
+  BALANCE_REMAINING: ConflictError,
+  WITHDRAWAL_PENDING: ConflictError
+};
+function mapEnvelope(status, body) {
+  if (isAppErrorEnvelope(body)) {
+    const { code, message, details } = body.error;
+    const ByCode = CODE_TO_CLASS[code];
+    if (ByCode) return new ByCode(code, message, status, details);
+    return mapByStatus(status, code, message, details);
+  }
+  return mapByStatus(status, statusCodeName(status), `HTTP ${status}`, body);
+}
+function mapByStatus(status, code, message, details) {
+  if (status === 401) return new AuthError(code, message, status, details);
+  if (status === 403) return new ForbiddenError(code, message, status, details);
+  if (status === 404) return new NotFoundError(code, message, status, details);
+  if (status === 409) return new ConflictError(code, message, status, details);
+  if (status === 422) return new UnprocessableError(code, message, status, details);
+  if (status === 429) return new RateLimitError(code, message, status, details);
+  if (status >= 500) return new ServerError(code, message, status, details);
+  return new CasinoSdkError(code, message, status, details);
+}
+function statusCodeName(status) {
+  if (status === 400) return "VALIDATION_ERROR";
+  if (status === 401) return "UNAUTHORIZED";
+  if (status === 403) return "FORBIDDEN";
+  if (status === 404) return "NOT_FOUND";
+  if (status === 409) return "CONFLICT";
+  if (status === 422) return "UNPROCESSABLE";
+  if (status === 429) return "RATE_LIMITED";
+  if (status >= 500) return "INTERNAL_ERROR";
+  return "REQUEST_ERROR";
+}
+
+// src/core/idempotency.ts
+function generateIdempotencyKey(prefix = "idem") {
+  const uuid = randomUuid();
+  return `${prefix}-${uuid}`;
+}
+function randomUuid() {
+  const c = globalThis.crypto;
+  if (c?.randomUUID) return c.randomUUID();
+  if (c?.getRandomValues) {
+    const bytes = new Uint8Array(16);
+    c.getRandomValues(bytes);
+    return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  let out = "";
+  for (let i = 0; i < 32; i++) out += Math.floor(Math.random() * 16).toString(16);
+  return out;
+}
+
+// src/core/http.ts
+var HttpClient = class {
+  constructor(config) {
+    this.config = config;
+    this.jar = config.cookieJar ?? new CookieJar();
+  }
+  config;
+  jar;
+  refresh = null;
+  refreshInflight = null;
+  enrich = null;
+  /** Wired by the client after the auth module exists (avoids a circular import). */
+  setRefreshHandler(fn) {
+    this.refresh = fn;
+  }
+  /**
+   * Wired by the client: a best-effort pass over every decoded error before it is
+   * thrown (e.g. populating `FlowDelegatedError.continueWith` from the ext
+   * catalog). Whatever it does or throws, the original error is what propagates.
+   */
+  setErrorEnricher(fn) {
+    this.enrich = fn;
+  }
+  get(path, options) {
+    return this.request("GET", path, options);
+  }
+  post(path, options) {
+    return this.request("POST", path, options);
+  }
+  put(path, options) {
+    return this.request("PUT", path, options);
+  }
+  patch(path, options) {
+    return this.request("PATCH", path, options);
+  }
+  delete(path, options) {
+    return this.request("DELETE", path, options);
+  }
+  async request(method, path, options = {}) {
+    const response = await this.performFetch(method, path, options);
+    if (!response.ok) {
+      const err = await this.toError(response, options);
+      if (response.status === 401 && !options._noRefresh) this.config.onAuthError?.(err);
+      throw err;
+    }
+    return this.parseBody(response);
+  }
+  /**
+   * GET with ETag revalidation: sends `If-None-Match` when `etag` is given and
+   * treats `304 Not Modified` as success (empty `data`). Used for endpoints that
+   * declare HTTP caching, e.g. the ext plugin catalog.
+   */
+  async conditionalGet(path, options = {}) {
+    const requestOptions = {
+      ...options.etag !== void 0 ? { headers: { "if-none-match": options.etag } } : {},
+      ...options.signal ? { signal: options.signal } : {},
+      ...options._noEnrich !== void 0 ? { _noEnrich: options._noEnrich } : {}
+    };
+    const response = await this.performFetch("GET", path, requestOptions);
+    if (response.status === 304) {
+      return { notModified: true, ...readCacheMeta(response) };
+    }
+    if (!response.ok) {
+      const err = await this.toError(response, requestOptions);
+      if (response.status === 401) this.config.onAuthError?.(err);
+      throw err;
+    }
+    const data = await this.parseBody(response);
+    return {
+      notModified: false,
+      ...data !== void 0 ? { data } : {},
+      ...readCacheMeta(response)
+    };
+  }
+  /** The shared pipeline: headers, CSRF, idempotency, cookies, fetch, 401→refresh→retry. */
+  async performFetch(method, path, options = {}) {
+    const url = this.buildUrl(path, options.query);
+    const isMutation = method !== "GET";
+    const headers = new Headers();
+    headers.set(HEADER.tenant, this.config.tenantId);
+    if (this.config.brandId) headers.set(HEADER.brand, this.config.brandId);
+    if (this.config.region) headers.set(HEADER.region, this.config.region);
+    headers.set("accept", "application/json");
+    const wantCsrf = options.csrf ?? isMutation;
+    if (wantCsrf) {
+      const token = readCookie(COOKIE.csrf, this.jar);
+      if (token) headers.set(HEADER.csrf, token);
+    }
+    let body = options.body;
+    if (options.idempotent) {
+      const key = options.idempotencyKey ?? generateIdempotencyKey();
+      headers.set(HEADER.idempotency, key);
+      if (!options.idempotencyHeaderOnly) {
+        if (isPlainObject(body)) body = { ...body, idempotencyKey: key };
+        else if (body === void 0) body = { idempotencyKey: key };
+      }
+    }
+    let serialized;
+    if (isFormData(body)) {
+      serialized = body;
+    } else if (body !== void 0) {
+      headers.set("content-type", "application/json");
+      serialized = JSON.stringify(body);
+    }
+    if (options.headers) {
+      for (const [name, value] of Object.entries(options.headers)) headers.set(name, value);
+    }
+    if (!isBrowser()) {
+      const cookie = this.jar.header();
+      if (cookie) headers.set("cookie", cookie);
+    }
+    const timeoutMs = options.timeoutMs ?? this.config.timeoutMs;
+    const signal = withTimeout(options.signal, timeoutMs);
+    let response;
+    try {
+      const doFetch = this.config.fetch;
+      response = await doFetch(url, {
+        method,
+        headers,
+        credentials: "include",
+        ...serialized !== void 0 ? { body: serialized } : {},
+        ...signal ? { signal } : {}
+      });
+    } catch (cause) {
+      if (cause?.name === "TimeoutError") {
+        throw new NetworkError(
+          "NETWORK_TIMEOUT",
+          `Request to ${method} ${path} timed out after ${timeoutMs}ms`,
+          0,
+          cause
+        );
+      }
+      throw new NetworkError(
+        "NETWORK_ERROR",
+        `Request to ${method} ${path} failed: ${cause?.message ?? "unknown"}`,
+        0,
+        cause
+      );
+    }
+    if (!isBrowser()) {
+      const setCookie = readSetCookie(response.headers);
+      warnOnAuthIdentitySwitch(this.jar, setCookie);
+      this.jar.ingest(setCookie);
+    }
+    const refresh = this.refresh;
+    if (response.status === 401 && this.config.autoRefresh && refresh && !options._isRetry && !options._noRefresh) {
+      try {
+        await this.runRefresh(refresh);
+        return this.performFetch(method, path, { ...options, _isRetry: true });
+      } catch {
+        const err = await this.toError(response, options);
+        this.config.onAuthError?.(err);
+        throw err;
+      }
+    }
+    return response;
+  }
+  /**
+   * Run the wired refresh handler with single-flight dedupe (same pattern as the
+   * ext catalog): concurrent 401s all await ONE in-flight `POST /auth/player/refresh`.
+   * With rotating refresh tokens, parallel refreshes would present an already-rotated
+   * token and get the whole session revoked.
+   */
+  runRefresh(refresh) {
+    if (this.refreshInflight) return this.refreshInflight;
+    const running = Promise.resolve().then(refresh).finally(() => {
+      if (this.refreshInflight === running) this.refreshInflight = null;
+    });
+    this.refreshInflight = running;
+    return running;
+  }
+  async parseBody(response) {
+    if (response.status === 204) return void 0;
+    const text = await response.text();
+    if (!text) return void 0;
+    try {
+      return JSON.parse(text);
+    } catch {
+      return text;
+    }
+  }
+  async toError(response, options) {
+    let parsed;
+    try {
+      parsed = JSON.parse(await response.text());
+    } catch {
+      parsed = void 0;
+    }
+    const err = mapEnvelope(response.status, parsed);
+    if (this.enrich && !options?._noEnrich) {
+      try {
+        await this.enrich(err);
+      } catch {
+      }
+    }
+    return err;
+  }
+  buildUrl(path, query) {
+    const url = new URL(`${this.config.baseUrl}${path.startsWith("/") ? path : `/${path}`}`);
+    if (query) {
+      for (const [key, value] of Object.entries(query)) {
+        if (value === void 0 || value === null) continue;
+        if (Array.isArray(value)) for (const v of value) url.searchParams.append(key, v);
+        else url.searchParams.set(key, String(value));
+      }
+    }
+    return url.toString();
+  }
+};
+function withTimeout(caller, timeoutMs) {
+  if (!timeoutMs || timeoutMs <= 0 || typeof AbortSignal === "undefined" || typeof AbortSignal.timeout !== "function") {
+    return caller;
+  }
+  const timeout = AbortSignal.timeout(timeoutMs);
+  if (!caller) return timeout;
+  if (typeof AbortSignal.any === "function") return AbortSignal.any([caller, timeout]);
+  return caller;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && !isFormData(value);
+}
+function isFormData(value) {
+  return typeof FormData !== "undefined" && value instanceof FormData;
+}
+function readCacheMeta(response) {
+  const etag = response.headers.get("etag");
+  const cacheControl = response.headers.get("cache-control");
+  const match = cacheControl ? /(?:^|[,\s])max-age=(\d+)/i.exec(cacheControl) : null;
+  const maxAge = match?.[1] !== void 0 ? Number(match[1]) : void 0;
+  return {
+    ...etag !== null ? { etag } : {},
+    ...maxAge !== void 0 && Number.isFinite(maxAge) ? { maxAgeSeconds: maxAge } : {}
+  };
+}
+function warnOnAuthIdentitySwitch(jar, setCookie) {
+  if (typeof process !== "undefined" && process.env["NODE_ENV"] === "production") return;
+  if (!setCookie) return;
+  const previous = jar.get(COOKIE.access);
+  if (!previous) return;
+  const previousSub = jwtSub(previous);
+  if (previousSub === void 0) return;
+  const accessCookie = new RegExp(`(?:^|,\\s*)${COOKIE.access}=([^;,\\s]+)`);
+  const lines = Array.isArray(setCookie) ? setCookie : [setCookie];
+  for (const line of lines) {
+    const match = accessCookie.exec(line);
+    if (!match?.[1]) continue;
+    const incomingSub = jwtSub(match[1]);
+    if (incomingSub !== void 0 && incomingSub !== previousSub) {
+      console.warn(
+        "[casino-sdk] SECURITY: this client's cookie jar already holds a session for another player, and a response just switched it to a different identity. On the server, never share one client (or one CookieJar) across users' requests \u2014 module-scope clients are browser-only. Scope one per request with `client.withCookies(new CookieJar())`. See docs/guides/react.md."
+      );
+      return;
+    }
+  }
+}
+function jwtSub(token) {
+  const payload = token.split(".")[1];
+  if (!payload) return void 0;
+  try {
+    const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+    const decoded = typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("binary");
+    const claims = JSON.parse(decoded);
+    return typeof claims.sub === "string" ? claims.sub : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readSetCookie(headers) {
+  const getter = headers.getSetCookie;
+  if (typeof getter === "function") {
+    const all = getter.call(headers);
+    if (all.length) return all;
+  }
+  return headers.get("set-cookie");
+}
+
+// src/core/session.ts
+var Session = class {
+  player = null;
+  profile = null;
+  fallbackCurrency;
+  constructor(fallbackCurrency) {
+    this.fallbackCurrency = fallbackCurrency;
+  }
+  setPlayer(player, profile) {
+    this.player = player;
+    if (profile !== void 0) this.profile = profile;
+    if (player === null) this.profile = null;
+  }
+  clear() {
+    this.player = null;
+    this.profile = null;
+  }
+  get playerId() {
+    return this.player?.id;
+  }
+  /** Resolve a playerId, preferring an explicit override; throws if neither exists. */
+  requirePlayerId(override) {
+    const id = override ?? this.player?.id;
+    if (!id) {
+      throw new Error(
+        "No authenticated player. Call `auth.login()`/`auth.me()` first, or pass an explicit playerId."
+      );
+    }
+    return id;
+  }
+  /** Resolve a currency: override → profile → configured default. */
+  resolveCurrency(override) {
+    return (override ?? this.profile?.currency ?? this.fallbackCurrency).toUpperCase();
+  }
+  snapshot() {
+    return {
+      player: this.player,
+      profile: this.profile,
+      currency: this.resolveCurrency()
+    };
+  }
+};
+
+// src/modules/affiliate.ts
+var AffiliateModule = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /**
+   * Record an affiliate click. Returns the `clickId` join key — persist it
+   * (cookie/localStorage) and carry it into signup so the registration can be
+   * attributed to the click.
+   */
+  trackClick(input) {
+    return this.http.post("/affiliate/track/click", { body: input });
+  }
+};
+
+// src/modules/auth.ts
+var AuthModule = class {
+  constructor(http, session, baseUrl) {
+    this.http = http;
+    this.session = session;
+    this.baseUrl = baseUrl;
+  }
+  http;
+  session;
+  baseUrl;
+  /** Create an account and start a session. */
+  async signup(input) {
+    const res = await this.http.post("/auth/player/signup", { body: input });
+    this.session.setPlayer(res.player);
+    return res;
+  }
+  /** Log in with email + password and start a session. */
+  async login(input) {
+    const res = await this.http.post("/auth/player/login", { body: input });
+    this.session.setPlayer(res.player);
+    return res;
+  }
+  /** End the session and clear the cached player. */
+  async logout() {
+    try {
+      await this.http.post("/auth/player/logout");
+    } finally {
+      this.session.clear();
+      this.http.jar.clear();
+    }
+  }
+  /**
+   * Rotate the session using the refresh cookie. Called automatically by the HTTP
+   * layer on a 401; you rarely call it directly.
+   *
+   * The request is marked `_noRefresh`: a 401 here (fully logged out) must throw
+   * immediately instead of re-entering the 401 → refresh path it is part of.
+   */
+  async refresh() {
+    const res = await this.http.post("/auth/player/refresh", { _noRefresh: true });
+    this.session.setPlayer(res.player);
+    return res;
+  }
+  /** Current player + profile. Refreshes the session cache (incl. default currency). */
+  async me() {
+    const res = await this.http.get("/auth/player/me");
+    this.session.setPlayer(res.player, res.profile);
+    return res;
+  }
+  social = {
+    /**
+     * Build the URL that begins a social login. Send the browser here (full
+     * navigation, not fetch) so the runtime can redirect to the provider.
+     */
+    startUrl: (provider, options) => {
+      const url = new URL(`${this.baseUrl}/auth/player/social/${provider}/start`);
+      if (options?.redirectUri) url.searchParams.set("redirect_uri", options.redirectUri);
+      return url.toString();
+    },
+    /**
+     * Complete the OAuth callback (provider → your app) by exchanging `code`+`state`.
+     * Use this if your app handles the callback route itself; otherwise the runtime
+     * handles `/auth/player/social/:provider/callback` directly.
+     */
+    callback: async (provider, params) => {
+      const res = await this.http.get(`/auth/player/social/${provider}/callback`, {
+        query: params,
+        csrf: false
+      });
+      this.session.setPlayer(res.player);
+      return res;
+    },
+    /** Link a social account to the logged-in player. */
+    link: (provider, code) => this.http.post(`/auth/player/social/${provider}/link`, { body: { code } }),
+    /** Unlink a previously-linked social account. */
+    unlink: (provider, socialAccountId) => this.http.delete(`/auth/player/social/${provider}/${socialAccountId}`)
+  };
+  /**
+   * Session management — the "your devices" surface. The runtime scopes every call
+   * to the authenticated player (the id comes from the verified principal, never a
+   * path), so a player can only see and revoke their own sessions.
+   */
+  sessions = {
+    /** Active sessions — the player's currently signed-in devices. */
+    list: async () => {
+      const res = await this.http.get("/auth/player/sessions");
+      return res.sessions;
+    },
+    /**
+     * Full session history — active plus revoked/expired, newest first. Paginated:
+     * `limit` 1–100 (default 50), `offset` ≥ 0; `pagination.hasMore` says whether
+     * another page exists.
+     */
+    history: async (query = {}) => this.http.get("/auth/player/sessions/history", {
+      query: { limit: query.limit, offset: query.offset }
+    }),
+    /** Disconnect (revoke) one of the player's own sessions. */
+    revoke: (sessionId) => this.http.delete(`/auth/player/sessions/${encodeURIComponent(sessionId)}`),
+    /**
+     * Revoke every session. By default the current one survives ("sign out
+     * everywhere else"); pass `{ exceptCurrent: false }` to revoke this device
+     * too (the runtime then also clears the auth cookies).
+     */
+    revokeAll: (options) => (
+      // The runtime parses this with `z.coerce.boolean()`, where ANY non-empty
+      // string (including "false") coerces to true — only the empty string
+      // reads as false. Omit for the default (true), send "" for false.
+      this.http.delete("/auth/player/sessions", {
+        query: { exceptCurrent: options?.exceptCurrent === false ? "" : void 0 }
+      })
+    )
+  };
+  /**
+   * Login history (successful and failed attempts, newest first). Paginated:
+   * `limit` 1–100 (default 50), `offset` ≥ 0.
+   */
+  loginHistory(query = {}) {
+    return this.http.get("/auth/player/login-history", {
+      query: { limit: query.limit, offset: query.offset }
+    });
+  }
+  /** Password management. The reset flow is anonymous; `change` needs a session. */
+  password = {
+    /**
+     * Change the password (requires the current one). The runtime revokes every
+     * OTHER session; this one survives. Rate-limited 10/h per player.
+     */
+    change: (input) => this.http.post("/auth/player/password/change", { body: input }),
+    /**
+     * Request a password-reset email. Always resolves `{ success: true }`
+     * (anti-enumeration) — even for unknown emails or while rate-limited.
+     */
+    requestReset: (email) => this.http.post("/auth/player/password/reset/request", { body: { email } }),
+    /**
+     * Complete a reset with the emailed token. Revokes ALL sessions — the
+     * player must log in again.
+     */
+    confirmReset: (input) => this.http.post("/auth/player/password/reset/confirm", { body: input })
+  };
+  /**
+   * Email/phone verification. `request` sends the token/OTP (429 with
+   * `details.resendIn` inside the cooldown); `confirm` verifies it.
+   */
+  verification = {
+    email: {
+      request: () => this.http.post("/auth/player/email/verification/request"),
+      /** Confirm with the emailed link `token` XOR the 6-digit `code` (code needs a session). */
+      confirm: (input) => this.http.post("/auth/player/email/verification/confirm", { body: input })
+    },
+    phone: {
+      /** Pass `phone` to verify a NEW number (applied on confirm). */
+      request: (phone) => this.http.post("/auth/player/phone/verification/request", {
+        body: phone !== void 0 ? { phone } : {}
+      }),
+      confirm: (code) => this.http.post("/auth/player/phone/verification/confirm", { body: { code } })
+    }
+  };
+};
+
+// src/core/money.ts
+var MONEY_SCALE = 4;
+var FACTOR = 10 ** MONEY_SCALE;
+function decimalToMinor(value) {
+  const n = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(n)) {
+    throw new TypeError(`decimalToMinor: not a finite number: ${String(value)}`);
+  }
+  return Math.round(n * FACTOR);
+}
+function minorStringToMinor(value) {
+  if (!/^-?\d+$/.test(value)) {
+    throw new TypeError(`minorStringToMinor: not a minor-unit integer string: ${String(value)}`);
+  }
+  const n = Number(value);
+  if (!Number.isSafeInteger(n)) {
+    throw new TypeError(
+      `minorStringToMinor: value exceeds the safe integer range: ${String(value)}`
+    );
+  }
+  return n;
+}
+function minorToAmount(minor) {
+  if (!Number.isInteger(minor)) {
+    throw new TypeError(`minorToAmount: expected an integer, got ${String(minor)}`);
+  }
+  return minor / FACTOR;
+}
+function minorToDecimal(minor) {
+  if (!Number.isInteger(minor)) {
+    throw new TypeError(`minorToDecimal: expected an integer, got ${String(minor)}`);
+  }
+  const negative = minor < 0;
+  const abs = Math.abs(minor);
+  const whole = Math.trunc(abs / FACTOR);
+  const frac = String(abs % FACTOR).padStart(MONEY_SCALE, "0");
+  return `${negative ? "-" : ""}${whole}.${frac}`;
+}
+function formatMoney(minor, currency, options) {
+  const major = minor / FACTOR;
+  return new Intl.NumberFormat(options?.locale, {
+    style: "currency",
+    currency,
+    ...options?.minimumFractionDigits !== void 0 ? { minimumFractionDigits: options.minimumFractionDigits } : {},
+    ...options?.maximumFractionDigits !== void 0 ? { maximumFractionDigits: options.maximumFractionDigits } : {}
+  }).format(major);
+}
+
+// src/modules/cashier.ts
+var CashierModule = class {
+  constructor(http, session) {
+    this.http = http;
+    this.session = session;
+  }
+  http;
+  session;
+  /**
+   * Initiate a deposit. Follow `result.nextAction` for any PSP redirect/3DS step;
+   * a `result.challenge` means a gate plugin requires a step-up (e.g. KYC) first.
+   */
+  async deposit(input) {
+    const playerId = this.session.requirePlayerId(input.playerId);
+    const currency = this.session.resolveCurrency(input.currency);
+    const raw = await this.http.post("/cashier/deposits", {
+      idempotent: true,
+      ...input.idempotencyKey ? { idempotencyKey: input.idempotencyKey } : {},
+      body: {
+        playerId,
+        currency,
+        amount: minorToAmount(input.amount),
+        providerKey: input.providerKey,
+        methodKey: input.methodKey,
+        instrumentId: input.instrumentId,
+        baseCurrency: input.baseCurrency,
+        returnUrl: input.returnUrl,
+        metadata: input.metadata
+      }
+    });
+    return withBuckets(raw);
+  }
+  /** Request a withdrawal. May land in `pending_review` depending on risk rules. */
+  async withdraw(input) {
+    const playerId = this.session.requirePlayerId(input.playerId);
+    const currency = this.session.resolveCurrency(input.currency);
+    const raw = await this.http.post("/cashier/withdrawals", {
+      idempotent: true,
+      ...input.idempotencyKey ? { idempotencyKey: input.idempotencyKey } : {},
+      body: {
+        playerId,
+        currency,
+        amount: minorToAmount(input.amount),
+        providerKey: input.providerKey,
+        methodKey: input.methodKey,
+        instrumentId: input.instrumentId,
+        baseCurrency: input.baseCurrency,
+        metadata: input.metadata
+      }
+    });
+    return withBuckets(raw);
+  }
+  /**
+   * The payment methods available to the player (`GET /player/cashier/methods`),
+   * sorted for display; `limits` in minor units. Cached 60s server-side.
+   */
+  async listMethods(options = {}) {
+    const res = await this.http.get("/player/cashier/methods", {
+      query: { currency: options.currency }
+    });
+    return res.methods.map(toMethod);
+  }
+  /** Deposit history, newest first, amounts in minor units. */
+  async deposits(query = {}) {
+    const res = await this.http.get("/player/cashier/deposits", {
+      query: {
+        status: query.status,
+        providerKey: query.providerKey,
+        ...rangeQuery(query)
+      }
+    });
+    return { deposits: res.deposits.map(toDeposit), pagination: res.pagination };
+  }
+  /**
+   * One deposit with its wallet linkage and any pending `nextAction`
+   * (`GET /player/cashier/deposits/:id`). Realtime `wallet.deposit` remains the
+   * push channel; this is the authoritative re-read.
+   */
+  async depositStatus(depositId) {
+    const raw = await this.http.get(
+      `/player/cashier/deposits/${encodeURIComponent(depositId)}`
+    );
+    return toDeposit(raw);
+  }
+  /** Withdrawal history, newest first, amounts in minor units. */
+  async withdrawals(query = {}) {
+    const res = await this.http.get("/player/cashier/withdrawals", {
+      query: { status: query.status, ...rangeQuery(query) }
+    });
+    return { withdrawals: res.withdrawals.map(toWithdrawal), pagination: res.pagination };
+  }
+  /** One withdrawal with its reserve/settle/release wallet-transaction legs. */
+  async withdrawalStatus(withdrawalId) {
+    const raw = await this.http.get(
+      `/player/cashier/withdrawals/${encodeURIComponent(withdrawalId)}`
+    );
+    return toWithdrawal(raw);
+  }
+  /**
+   * Cancel a withdrawal that hasn't been picked up yet (`requested`/
+   * `pending_review` only — anything later is a `ConflictError` with code
+   * `INVALID_WITHDRAWAL_STATE`). Releases the reserved funds; idempotent
+   * (a replay returns `idempotent: true` without balances).
+   */
+  async cancelWithdrawal(withdrawalId) {
+    const raw = await this.http.post(
+      `/player/cashier/withdrawals/${encodeURIComponent(withdrawalId)}/cancel`
+    );
+    return withBuckets(raw);
+  }
+};
+function rangeQuery(query) {
+  return {
+    from: toIso(query.from),
+    to: toIso(query.to),
+    limit: query.limit,
+    offset: query.offset
+  };
+}
+function toIso(value) {
+  return value instanceof Date ? value.toISOString() : value;
+}
+function toDeposit(raw) {
+  const { amountMinor, ...rest } = raw;
+  return { ...rest, amount: minorStringToMinor(amountMinor) };
+}
+var toWithdrawal = toDeposit;
+function toMethod(raw) {
+  const { limits, ...rest } = raw;
+  return {
+    ...rest,
+    limits: {
+      min: minorStringToMinor(limits.minMinor),
+      max: minorStringToMinor(limits.maxMinor),
+      currency: limits.currency
+    }
+  };
+}
+function toBuckets(raw) {
+  return {
+    cash: decimalToMinor(raw.cash),
+    bonus: decimalToMinor(raw.bonus),
+    locked: decimalToMinor(raw.locked)
+  };
+}
+function withBuckets(raw) {
+  const { balances, ...rest } = raw;
+  return balances ? { ...rest, balances: toBuckets(balances) } : { ...rest };
+}
+
+// src/modules/wallet.ts
+var WalletModule = class {
+  constructor(http, session) {
+    this.http = http;
+    this.session = session;
+  }
+  http;
+  session;
+  /** Current balance across the cash/bonus/locked buckets, in minor units. */
+  async getBalance(options) {
+    const playerId = this.session.requirePlayerId(options?.playerId);
+    const currency = this.session.resolveCurrency(options?.currency);
+    const raw = await this.http.get("/wallet/balance", {
+      query: { playerId, currency }
+    });
+    return {
+      playerId: raw.playerId,
+      currency: raw.currency,
+      cash: decimalToMinor(raw.cashBalance),
+      bonus: decimalToMinor(raw.bonusBalance),
+      locked: decimalToMinor(raw.lockedBalance),
+      total: decimalToMinor(raw.total),
+      status: raw.status,
+      walletId: raw.walletId
+    };
+  }
+  /** Paginated transaction history (newest first), amounts in minor units. */
+  async transactions(query = {}) {
+    const playerId = this.session.requirePlayerId(query.playerId);
+    const raw = await this.http.get("/wallet/transactions", {
+      query: {
+        playerId,
+        walletId: query.walletId,
+        type: query.type,
+        status: query.status,
+        currency: query.currency,
+        limit: query.limit,
+        offset: query.offset
+      }
+    });
+    return { ...raw, rows: raw.rows.map(toTransaction) };
+  }
+  /**
+   * Paginated append-only ledger (newest first) — one row per bucket movement,
+   * with before/after balance snapshots, amounts in minor units. Filter by
+   * `transactionId` to see the legs of a single transaction.
+   */
+  async ledger(query = {}) {
+    const playerId = this.session.requirePlayerId(query.playerId);
+    const raw = await this.http.get("/wallet/ledger", {
+      query: {
+        playerId,
+        walletId: query.walletId,
+        walletType: query.walletType,
+        transactionId: query.transactionId,
+        limit: query.limit,
+        offset: query.offset
+      }
+    });
+    return { ...raw, rows: raw.rows.map(toLedgerEntry) };
+  }
+  /**
+   * Fetch a single transaction by id.
+   *
+   * @remarks Not available to players yet — the runtime route
+   * `GET /wallet/transactions/:id` requires staff permission. Tracked on the
+   * roadmap; use {@link transactions} to page history in the meantime.
+   */
+  getTransaction(_id) {
+    return Promise.reject(
+      new NotImplementedError(
+        "wallet.getTransaction: runtime exposes single-transaction reads to staff only. Use wallet.transactions() until a player-facing endpoint ships."
+      )
+    );
+  }
+};
+function toTransaction(raw) {
+  return { ...raw, amount: decimalToMinor(raw.amount) };
+}
+function toLedgerEntry(raw) {
+  return {
+    ...raw,
+    amount: decimalToMinor(raw.amount),
+    balanceBefore: decimalToMinor(raw.balanceBefore),
+    balanceAfter: decimalToMinor(raw.balanceAfter)
+  };
+}
+
+// src/modules/catalog.ts
+var CatalogModule = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** The default lobby, filtered by geo/currency/device. */
+  lobby(query = {}) {
+    return this.http.get("/catalog/lobby", { query: { ...query } });
+  }
+  /** Search/filter games by text, provider, category, and feature flags. */
+  searchGames(query = {}) {
+    return this.http.get("/catalog/games", {
+      query: {
+        country: query.country,
+        subdivision: query.subdivision,
+        currency: query.currency,
+        locale: query.locale,
+        device: query.device,
+        limit: query.limit,
+        offset: query.offset,
+        q: query.q,
+        provider: query.provider,
+        category: query.category,
+        hasDemo: boolParam(query.hasDemo),
+        isVirtual: boolParam(query.isVirtual),
+        bonusBuy: boolParam(query.bonusBuy),
+        megaways: boolParam(query.megaways)
+      }
+    });
+  }
+  /** Trending games over a window (`"all"` by default), most popular first. */
+  async trending(query = {}) {
+    const res = await this.http.get("/catalog/trending", {
+      query: { ...query }
+    });
+    return res.games;
+  }
+  /** The localized category tree (recursive `children`). */
+  async categories(options) {
+    const res = await this.http.get("/catalog/categories", {
+      query: { locale: options?.locale }
+    });
+    return res.categories;
+  }
+  /** All enabled providers for this brand/region. */
+  async providers(query = {}) {
+    const res = await this.http.get("/catalog/providers", {
+      query: { ...query }
+    });
+    return res.providers;
+  }
+  /** A single game by internal id or slug. */
+  game(idOrSlug, query = {}) {
+    return this.http.get(`/catalog/games/${encodeURIComponent(idOrSlug)}`, {
+      query: { ...query }
+    });
+  }
+  /**
+   * Games suggested alongside the given game. Takes the internal game **id** only
+   * (an unknown id — including a slug — yields an empty list, not a 404).
+   */
+  async suggested(gameId, query = {}) {
+    const res = await this.http.get(
+      `/catalog/games/${encodeURIComponent(gameId)}/suggested`,
+      { query: { ...query } }
+    );
+    return res.games;
+  }
+};
+function boolParam(value) {
+  if (value === void 0) return void 0;
+  return value ? "1" : "0";
+}
+
+// src/core/json-schema.ts
+function checkJsonSchema(value, schema, path = "") {
+  if (typeof schema !== "object" || schema === null) return [];
+  const node = schema;
+  const problems = [];
+  if (node.type !== void 0) {
+    const allowed = Array.isArray(node.type) ? node.type : [node.type];
+    if (!allowed.some((t) => matchesType(value, t))) {
+      problems.push({ path, message: `expected ${allowed.join(" | ")}, got ${typeName(value)}` });
+      return problems;
+    }
+  }
+  if (node.enum !== void 0 && !node.enum.some((candidate) => sameJson(candidate, value))) {
+    problems.push({ path, message: `expected one of ${JSON.stringify(node.enum)}` });
+  }
+  if (isRecord(value)) {
+    for (const key of node.required ?? []) {
+      if (!(key in value) || value[key] === void 0) {
+        problems.push({ path: joinPath(path, key), message: "required property is missing" });
+      }
+    }
+    if (node.properties) {
+      for (const [key, propSchema] of Object.entries(node.properties)) {
+        if (key in value && value[key] !== void 0) {
+          problems.push(...checkJsonSchema(value[key], propSchema, joinPath(path, key)));
+        }
+      }
+    }
+  }
+  if (Array.isArray(value) && node.items !== void 0 && !Array.isArray(node.items)) {
+    value.forEach((item, i) => {
+      problems.push(...checkJsonSchema(item, node.items, `${path}[${i}]`));
+    });
+  }
+  return problems;
+}
+function matchesType(value, type) {
+  switch (type) {
+    case "object":
+      return isRecord(value);
+    case "array":
+      return Array.isArray(value);
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number" && Number.isFinite(value);
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "boolean":
+      return typeof value === "boolean";
+    case "null":
+      return value === null;
+    default:
+      return true;
+  }
+}
+function sameJson(a, b) {
+  if (Object.is(a, b)) return true;
+  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) return false;
+  try {
+    return JSON.stringify(a) === JSON.stringify(b);
+  } catch {
+    return false;
+  }
+}
+function typeName(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function joinPath(path, key) {
+  return path ? `${path}.${key}` : key;
+}
+
+// src/core/env.ts
+function isDevEnvironment() {
+  try {
+    return typeof process === "undefined" || process.env.NODE_ENV !== "production";
+  } catch {
+    return true;
+  }
+}
+
+// src/modules/ext.ts
+var CATALOG_PATH = "/api/ext/_catalog";
+var DEFAULT_CATALOG_MAX_AGE_S = 60;
+function createExtModule(http) {
+  let cache = null;
+  let inflight = null;
+  const clients = /* @__PURE__ */ new Map();
+  const warnedDeprecated = /* @__PURE__ */ new Set();
+  function cacheUntil(maxAgeSeconds) {
+    return Date.now() + (maxAgeSeconds ?? DEFAULT_CATALOG_MAX_AGE_S) * 1e3;
+  }
+  async function fetchCatalog(force) {
+    const etag = !force && cache ? cache.etag : void 0;
+    const res = await http.conditionalGet(CATALOG_PATH, {
+      ...etag !== void 0 ? { etag } : {},
+      _noEnrich: true
+    });
+    if (res.notModified && cache) {
+      cache = { ...cache, expiresAt: cacheUntil(res.maxAgeSeconds) };
+      return cache.catalog;
+    }
+    if (res.data === void 0) {
+      throw new ServerError(
+        "EXT_CATALOG_EMPTY",
+        "The plugin catalog endpoint returned no body.",
+        0
+      );
+    }
+    cache = { catalog: res.data, etag: res.etag, expiresAt: cacheUntil(res.maxAgeSeconds) };
+    return res.data;
+  }
+  function catalog(opts = {}) {
+    if (!opts.force) {
+      if (cache && Date.now() < cache.expiresAt) return Promise.resolve(cache.catalog);
+      if (inflight) return inflight;
+    }
+    const fetching = fetchCatalog(opts.force ?? false).finally(() => {
+      if (inflight === fetching) inflight = null;
+    });
+    inflight = fetching;
+    return fetching;
+  }
+  async function plugin(pluginKey) {
+    try {
+      return await http.get(`${CATALOG_PATH}/${encodeURIComponent(pluginKey)}`, {
+        _noEnrich: true
+      });
+    } catch (err) {
+      throw remapExtError(err, pluginKey);
+    }
+  }
+  async function resolveDescriptor(pluginKey, actionKey) {
+    const cat = await catalog();
+    const entry = cat.plugins.find((p) => p.pluginKey === pluginKey);
+    if (!entry) throw new PluginNotEnabledError(pluginKey);
+    const action = entry.actions.find((a) => a.key === actionKey);
+    if (!action) throw new PluginActionNotFoundError(pluginKey, actionKey);
+    return action;
+  }
+  async function callAction(pluginKey, actionKey, input, opts = {}) {
+    const action = await resolveDescriptor(pluginKey, actionKey);
+    if (isDevEnvironment()) {
+      if (action.deprecated !== void 0) {
+        const key = `${pluginKey}.${actionKey}`;
+        if (!warnedDeprecated.has(key)) {
+          warnedDeprecated.add(key);
+          console.warn(`[casino-sdk] ext action "${key}" is deprecated: ${action.deprecated}`);
+        }
+      }
+      warnOnSchemaMismatch(pluginKey, action, input);
+    }
+    const routed = routeInput(action, input);
+    const autoIdempotent = action.kind === "mutation" && action.idempotent === true;
+    const idempotencyKey = opts.idempotencyKey ?? (autoIdempotent ? generateIdempotencyKey() : void 0);
+    try {
+      return await http.request(action.method, routed.path, {
+        ...routed.query !== void 0 ? { query: routed.query } : {},
+        ...routed.body !== void 0 ? { body: routed.body } : {},
+        ...idempotencyKey !== void 0 ? { idempotent: true, idempotencyHeaderOnly: true, idempotencyKey } : {},
+        ...opts.signal ? { signal: opts.signal } : {}
+      });
+    } catch (err) {
+      throw remapExtError(err, pluginKey);
+    }
+  }
+  async function rawRequest(pluginKey, method, path, init = {}) {
+    const sub = path.startsWith("/") ? path : `/${path}`;
+    try {
+      return await http.request(method, `/api/ext/${encodeURIComponent(pluginKey)}${sub}`, {
+        ...init.query !== void 0 ? { query: toQuery(init.query) } : {},
+        ...init.body !== void 0 ? { body: init.body } : {},
+        ...init.idempotencyKey !== void 0 ? { idempotent: true, idempotencyHeaderOnly: true, idempotencyKey: init.idempotencyKey } : {},
+        ...init.signal ? { signal: init.signal } : {}
+      });
+    } catch (err) {
+      throw remapExtError(err, pluginKey);
+    }
+  }
+  function pluginClient(pluginKey) {
+    const existing = clients.get(pluginKey);
+    if (existing) return existing;
+    const client = {
+      pluginKey,
+      call: (actionKey, input, opts) => callAction(pluginKey, actionKey, input, opts),
+      request: (method, path, init) => rawRequest(pluginKey, method, path, init)
+    };
+    clients.set(pluginKey, client);
+    return client;
+  }
+  return Object.assign(pluginClient, { catalog, plugin });
+}
+function routeInput(action, input) {
+  let path = action.path;
+  const isObjectInput = isPlainObject2(input);
+  const rest = isObjectInput ? { ...input } : void 0;
+  if (rest && path.includes(":")) {
+    path = path.replace(/:([A-Za-z0-9_]+)/g, (segment, name) => {
+      if (!(name in rest)) return segment;
+      const value = rest[name];
+      if (value === void 0 || value === null) {
+        delete rest[name];
+        return segment;
+      }
+      delete rest[name];
+      return encodeURIComponent(String(value));
+    });
+  }
+  if (action.method === "GET" || action.method === "DELETE") {
+    if (input !== void 0 && !isObjectInput && isDevEnvironment()) {
+      console.warn(
+        `[casino-sdk] ext action "${action.key}": ${action.method} input must be a flat object; ignoring ${describeValue(input)}.`
+      );
+    }
+    return {
+      path,
+      ...rest && Object.keys(rest).length > 0 ? { query: toQuery(rest) } : {}
+    };
+  }
+  if (rest) return { path, body: rest };
+  return { path, ...input !== void 0 ? { body: input } : {} };
+}
+function toQuery(record) {
+  const query = {};
+  for (const [key, value] of Object.entries(record)) {
+    if (value === void 0 || value === null) continue;
+    if (Array.isArray(value)) {
+      query[key] = value.map((v) => String(v));
+    } else if (typeof value === "object") {
+      if (isDevEnvironment()) {
+        console.warn(
+          `[casino-sdk] ext query param "${key}" is an object; query schemas are flat \u2014 dropping it.`
+        );
+      }
+    } else {
+      query[key] = value;
+    }
+  }
+  return query;
+}
+function warnOnSchemaMismatch(pluginKey, action, input) {
+  if (action.input === void 0) return;
+  const value = input === void 0 ? schemaExpectsObject(action.input) ? {} : void 0 : input;
+  if (value === void 0) return;
+  const problems = checkJsonSchema(value, action.input);
+  if (problems.length > 0) {
+    console.warn(
+      `[casino-sdk] input for ext action "${pluginKey}.${action.key}" does not match its declared schema (the server stays authoritative): ` + problems.map((p) => `${p.path || "$"}: ${p.message}`).join("; ")
+    );
+  }
+}
+function schemaExpectsObject(schema) {
+  if (typeof schema !== "object" || schema === null) return false;
+  const node = schema;
+  if (node.type === "object") return true;
+  if (Array.isArray(node.type) && node.type.includes("object")) return true;
+  return node.type === void 0 && node.properties !== void 0;
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function describeValue(value) {
+  return Array.isArray(value) ? "an array" : `a ${typeof value}`;
+}
+function remapExtError(err, pluginKey) {
+  if (!(err instanceof CasinoSdkError)) return err;
+  if (err instanceof NotFoundError && !(err instanceof PluginNotEnabledError) && !(err instanceof PluginActionNotFoundError)) {
+    return new PluginNotEnabledError(pluginKey, {
+      code: err.code,
+      message: err.message,
+      status: err.status,
+      details: err.details
+    });
+  }
+  if (err instanceof ServerError && err.status === 504 && !(err instanceof PluginUnavailableError)) {
+    return new PluginUnavailableError(err.code, err.message, err.status, err.details);
+  }
+  return err;
+}
+function assertPluginVersion(catalogEntry, expectedRange) {
+  const expected = parseMajor(expectedRange);
+  if (expected === null) {
+    throw new TypeError(
+      `assertPluginVersion: cannot parse a major version out of expected range "${expectedRange}".`
+    );
+  }
+  const actual = parseMajor(catalogEntry.version);
+  if (actual === null || actual !== expected) {
+    throw new PluginVersionMismatchError(
+      catalogEntry.pluginKey,
+      expectedRange,
+      catalogEntry.version
+    );
+  }
+}
+function parseMajor(version) {
+  const match = /^\s*[\^~=v]*\s*(\d+)/.exec(version);
+  return match?.[1] !== void 0 ? Number(match[1]) : null;
+}
+
+// src/modules/games.ts
+function assertLaunchUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new ValidationError("LAUNCH_URL_INVALID", `launchUrl is not a valid URL: ${url}`, 0);
+  }
+  const loopback = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]" || parsed.hostname === "::1";
+  if (parsed.protocol === "https:" || parsed.protocol === "http:" && loopback) return url;
+  throw new ValidationError(
+    "LAUNCH_URL_INVALID",
+    `launchUrl must be https: (got "${parsed.protocol}"). Refusing to expose it to the game iframe.`,
+    0,
+    { url }
+  );
+}
+var GamesModule = class {
+  constructor(http, session) {
+    this.http = http;
+    this.session = session;
+  }
+  http;
+  session;
+  /**
+   * @deprecated The runtime removed the SlotServ aggregation route
+   * (`POST /plugins/slotserv/launch`) along with its baked-in plugins
+   * (runtime `16d4e5d`, 2026-07-10) — this now always throws
+   * {@link NotImplementedError}. Launch through a tenant-registered provider
+   * adapter instead: {@link providerSession}. It returns the same
+   * `{ launchUrl, sessionId }` shape.
+   */
+  async launch(gameId, _input = {}) {
+    throw new NotImplementedError(
+      `games.launch("${gameId}"): the runtime no longer serves POST /plugins/slotserv/launch (the SlotServ aggregation plugin was removed). Use games.providerSession(provider, gameId) \u2014 provider adapters are registered per tenant (built-in "fake" for dev, or plugin-contributed).`
+    );
+  }
+  /**
+   * Open a game session with a specific provider adapter via the generic
+   * `POST /providers/:provider/session` route (provider-agnostic counterpart of
+   * {@link launch}). Currency defaults from the session.
+   */
+  async providerSession(provider, gameId, options = {}) {
+    const playerId = this.session.requirePlayerId(options.playerId);
+    const currency = this.session.resolveCurrency(options.currency);
+    const result = await this.http.post(
+      `/providers/${encodeURIComponent(provider)}/session`,
+      { body: { playerId, gameId, currency } }
+    );
+    assertLaunchUrl(result.launchUrl);
+    return result;
+  }
+  /** Bet history (`GET /player/bets`), newest first, amounts in minor units. */
+  async bets(query = {}) {
+    const res = await this.http.get(
+      "/player/bets",
+      {
+        query: {
+          gameId: query.gameId,
+          providerKey: query.providerKey,
+          status: query.status,
+          from: toIso2(query.from),
+          to: toIso2(query.to),
+          limit: query.limit,
+          offset: query.offset
+        }
+      }
+    );
+    return { bets: res.bets.map(toBet), pagination: res.pagination };
+  }
+  /** One bet plus its round-linked wallet transactions (`GET /player/bets/:betId`). */
+  async bet(betId) {
+    const raw = await this.http.get(`/player/bets/${encodeURIComponent(betId)}`);
+    return { ...toBet(raw), walletTransactions: raw.walletTransactions };
+  }
+  /** Game-session history with per-session bet/win totals in minor units. */
+  async gameSessions(query = {}) {
+    const res = await this.http.get("/player/game-sessions", {
+      query: {
+        from: toIso2(query.from),
+        to: toIso2(query.to),
+        limit: query.limit,
+        offset: query.offset
+      }
+    });
+    return { sessions: res.sessions.map(toGameSession), pagination: res.pagination };
+  }
+};
+function toIso2(value) {
+  return value instanceof Date ? value.toISOString() : value;
+}
+function toBet(raw) {
+  const { betAmountMinor, winAmountMinor, ...rest } = raw;
+  return {
+    ...rest,
+    betAmount: minorStringToMinor(betAmountMinor),
+    winAmount: winAmountMinor === null ? null : minorStringToMinor(winAmountMinor)
+  };
+}
+function toGameSession(raw) {
+  const { betTotalMinor, winTotalMinor, ...rest } = raw;
+  return {
+    ...rest,
+    betTotal: minorStringToMinor(betTotalMinor),
+    winTotal: minorStringToMinor(winTotalMinor)
+  };
+}
+
+// src/modules/kyc.ts
+var KycModule = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** Verification level, per-gate requirements, and email/phone verification flags. */
+  status() {
+    return this.http.get("/player/kyc/status");
+  }
+  /** Open KYC requests (draft/submitted/in_review/needs_more) with their checklists. */
+  async requirements() {
+    const res = await this.http.get("/player/kyc/requirements");
+    return res.requests;
+  }
+  /** All requests, newest first. `limit` 1–100 (default 50). */
+  history(query = {}) {
+    return this.http.get("/player/kyc/history", {
+      query: { limit: query.limit, offset: query.offset }
+    });
+  }
+  /**
+   * Upload a document. With `requestId` it attaches to that request (which must
+   * be `draft`/`needs_more`); without, it is a proactive re-verification
+   * upload. Rejections are `ValidationError` with code `KYC_DOCUMENT_INVALID`
+   * (format/size/expiry — see `details`).
+   *
+   * Large files on slow uplinks can outlive the client's default request
+   * timeout (30s) — raise or disable it per call via `options.timeoutMs`
+   * (`0` disables).
+   */
+  uploadDocument(input, options = {}) {
+    const form = new FormData();
+    form.append("documentTypeKey", input.documentTypeKey);
+    if (input.expiryDate !== void 0) form.append("expiryDate", input.expiryDate);
+    const fileName = input.fileName ?? (typeof File !== "undefined" && input.file instanceof File ? input.file.name : "document");
+    form.append("file", input.file, fileName);
+    const path = input.requestId !== void 0 ? `/player/kyc/requests/${encodeURIComponent(input.requestId)}/documents` : "/player/kyc/documents";
+    return this.http.post(path, {
+      body: form,
+      ...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {},
+      ...options.signal ? { signal: options.signal } : {}
+    });
+  }
+  /**
+   * Submit a request for review. Every `required` checklist item needs an
+   * uploaded/approved document first — otherwise `ValidationError` with
+   * `details.missing` listing the absent `documentTypeKey`s.
+   */
+  submit(requestId) {
+    return this.http.post(`/player/kyc/requests/${encodeURIComponent(requestId)}/submit`);
+  }
+};
+
+// src/modules/player.ts
+var PlayerModule = class {
+  constructor(http, auth) {
+    this.http = http;
+    this.auth = auth;
+  }
+  http;
+  auth;
+  /** The logged-in player's identity + profile (via `/auth/player/me`). */
+  getProfile() {
+    return this.auth.me();
+  }
+  /**
+   * The full profile row plus which identity fields are KYC-locked
+   * (`GET /player/profile`). `profile` is null until one exists.
+   */
+  profile() {
+    return this.http.get("/player/profile");
+  }
+  /**
+   * Patch the profile (`PATCH /player/profile`). At least one field; `null`
+   * clears. Identity fields (`firstName`/`lastName`/`birthDate`/`country`)
+   * throw `ConflictError` (`PROFILE_FIELD_LOCKED`) after KYC approval.
+   */
+  updateProfile(patch) {
+    return this.http.patch("/player/profile", { body: patch });
+  }
+  /** Preferences (locale, display currency, marketing consents, reality check). */
+  getPreferences() {
+    return this.http.get("/player/preferences");
+  }
+  /**
+   * Update preferences (`PUT /player/preferences`, partial — at least one
+   * field). Marketing changes are recorded on the consent trail; set
+   * `realityCheckMinutes: null` to disable the reality check.
+   */
+  setPreferences(patch) {
+    return this.http.put("/player/preferences", { body: patch });
+  }
+  /** The append-only marketing-consent trail, newest first. */
+  consents(query = {}) {
+    return this.http.get("/player/consents", {
+      query: { limit: query.limit, offset: query.offset }
+    });
+  }
+  /**
+   * Active responsible-gaming limits, values in minor units (minutes for
+   * `session_time`). `pending` carries a ratcheted increase/removal and when it
+   * applies.
+   */
+  async getLimits() {
+    const res = await this.http.get("/player/limits");
+    return res.limits.map(toLimit);
+  }
+  /**
+   * Set/remove limits (`PUT /player/limits`). `value` in minor units (minutes
+   * for `session_time`); `null` removes. New limits and decreases apply
+   * immediately; increases/removals apply after the 24h ratchet cooldown
+   * (returned in `pending`).
+   */
+  async setLimits(limits) {
+    const res = await this.http.put("/player/limits", {
+      body: {
+        limits: limits.map((l) => ({
+          kind: l.kind,
+          period: l.period,
+          value: l.value === null ? null : toLimitString(l.value),
+          currency: l.currency
+        }))
+      }
+    });
+    return res.limits.map(toLimit);
+  }
+  /** Responsible-gaming actions beyond limits. */
+  rg = {
+    /**
+     * Start a cooling-off period (blocks gameplay + deposits; login and
+     * withdrawals stay). Extend-only — a shorter period than the active one is
+     * a `ConflictError`.
+     */
+    coolOff: (period) => this.http.post("/player/rg/cool-off", { body: { period } }),
+    /**
+     * Self-exclude. Irreversible player-side; revokes every session (including
+     * this one). `until` is null for `"permanent"`.
+     */
+    selfExclude: (period) => this.http.post("/player/rg/self-exclude", { body: { period } }),
+    /** Acknowledge a reality-check prompt (audit trail only). */
+    acknowledgeRealityCheck: (gameSessionId) => this.http.post("/player/rg/reality-check/ack", {
+      body: gameSessionId !== void 0 ? { gameSessionId } : {}
+    })
+  };
+  /** Presence signals. */
+  presence = {
+    /**
+     * Tell the runtime this player is still here (`POST
+     * /player/presence/heartbeat`, 204). Any authenticated request already
+     * refreshes presence server-side — call this only for clients that idle
+     * while "in play" (e.g. a game iframe generates provider callbacks, not
+     * player API traffic). Best-effort on the server: a storage blip never
+     * fails the request; presence decays via TTL and heals on the next call.
+     */
+    heartbeat: () => this.http.post("/player/presence/heartbeat")
+  };
+  /** Account lifecycle. */
+  account = {
+    /**
+     * Close the account (idempotent). Requires zero balances and no pending
+     * withdrawal — otherwise `ConflictError` with code `BALANCE_REMAINING` or
+     * `WITHDRAWAL_PENDING`. Revokes every session.
+     */
+    close: (reason) => this.http.post("/player/account/close", {
+      body: reason !== void 0 ? { reason } : {}
+    }),
+    /**
+     * Request a GDPR data export (202; one active at a time — a second request
+     * while pending/processing is a `ConflictError`). The download link is
+     * delivered out-of-band.
+     */
+    requestDataExport: () => this.http.post("/player/account/export"),
+    /** Latest export request, or `{ status: "none" }` if never requested. */
+    dataExportStatus: () => this.http.get("/player/account/export")
+  };
+};
+function toLimit(raw) {
+  return {
+    kind: raw.kind,
+    period: raw.period,
+    value: minorStringToMinor(raw.value),
+    currency: raw.currency,
+    activeFrom: raw.activeFrom,
+    pending: raw.pending ? {
+      value: raw.pending.value === null ? null : minorStringToMinor(raw.pending.value),
+      removal: raw.pending.removal,
+      activeAt: raw.pending.activeAt
+    } : null
+  };
+}
+function toLimitString(value) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new TypeError(
+      `player.setLimits: value must be a positive safe integer (minor units, or minutes for session_time), got ${String(value)}`
+    );
+  }
+  return String(value);
+}
+
+// src/realtime/transport.ts
+function resolveWebSocket(injected) {
+  if (injected) return injected;
+  const g = globalThis;
+  if (g.WebSocket) return g.WebSocket;
+  throw new Error(
+    "No WebSocket implementation available. In Node, pass `WebSocketImpl` (e.g. `import WebSocket from 'ws'`) in the realtime options."
+  );
+}
+var WS_OPEN = 1;
+
+// src/realtime/client.ts
+var DEFAULTS = { baseMs: 500, maxMs: 15e3, factor: 2, dedupeWindow: 512, heartbeatMs: 25e3 };
+var MAX_PENDING_CONNECT_ATTEMPTS = 5;
+var PONG_DEADLINE_INTERVALS = 2;
+var READY_DEADLINE_MS = 1e4;
+function createRealtimeClient(options) {
+  return new RealtimeClientImpl(options);
+}
+var RealtimeClientImpl = class {
+  constructor(options) {
+    this.options = options;
+    this.seen = new SeenSet(options.dedupeWindow ?? DEFAULTS.dedupeWindow);
+  }
+  options;
+  state = "idle";
+  socket = null;
+  handlers = /* @__PURE__ */ new Map();
+  active = /* @__PURE__ */ new Set();
+  /**
+   * Channels the app declared via `subscribe()` (as opposed to interest implied by
+   * an `on()` handler). A channel is torn down only when BOTH interests are gone:
+   * `unsubscribe()` must not kill a channel that still has a handler, and removing
+   * the last handler must not kill a channel the app explicitly subscribed.
+   */
+  explicit = /* @__PURE__ */ new Set();
+  seen;
+  stateListeners = /* @__PURE__ */ new Set();
+  errorListeners = /* @__PURE__ */ new Set();
+  attempt = 0;
+  lastPongAt = 0;
+  heartbeatTimer = null;
+  reconnectTimer = null;
+  readyDeadlineTimer = null;
+  intentionalClose = false;
+  /**
+   * Teardown epoch. `disconnect()` bumps it; an `open()` that suspended (awaiting
+   * the auth credential) before the bump must abandon its cycle when it resumes —
+   * otherwise it resurrects an authenticated "zombie" socket after logout.
+   */
+  epoch = 0;
+  lastOccurredAt;
+  idCounter = 0;
+  connectResolve = null;
+  connectReject = null;
+  connectPromise = null;
+  connect() {
+    if (this.state === "ready") return Promise.resolve();
+    if (this.connectPromise) return this.connectPromise;
+    this.intentionalClose = false;
+    const pending = new Promise((resolve, reject) => {
+      this.connectResolve = resolve;
+      this.connectReject = reject;
+    });
+    const tracked = pending.finally(() => {
+      if (this.connectPromise === tracked) this.connectPromise = null;
+    });
+    this.connectPromise = tracked;
+    if (this.state !== "reconnecting") void this.open();
+    return tracked;
+  }
+  async disconnect() {
+    this.intentionalClose = true;
+    this.epoch++;
+    this.clearTimers();
+    this.failConnect(new Error("realtime: disconnect() before the connection became ready"));
+    if (this.socket) {
+      try {
+        this.socket.close(1e3, "client disconnect");
+      } catch {
+      }
+      this.socket = null;
+    }
+    this.setState("closed");
+  }
+  on(channel, handler) {
+    let set = this.handlers.get(channel);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      this.handlers.set(channel, set);
+    }
+    set.add(handler);
+    if (!this.active.has(channel)) this.markActive([channel]);
+    return () => {
+      const handlers = this.handlers.get(channel);
+      handlers?.delete(handler);
+      if (handlers && handlers.size === 0) {
+        this.handlers.delete(channel);
+        if (!this.explicit.has(channel)) this.teardown([channel]);
+      }
+    };
+  }
+  async subscribe(channels) {
+    for (const c of channels) this.explicit.add(c);
+    this.markActive(channels);
+  }
+  async unsubscribe(channels) {
+    for (const c of channels) this.explicit.delete(c);
+    this.teardown(channels.filter((c) => !this.handlers.get(c)?.size));
+  }
+  async withSubscription(channels, scope) {
+    await this.subscribe(channels);
+    try {
+      return await scope();
+    } finally {
+      await this.unsubscribe(channels);
+    }
+  }
+  activeChannels() {
+    return [...this.active];
+  }
+  /** Register interest and subscribe on the wire when connected. */
+  markActive(channels) {
+    for (const c of channels) this.active.add(c);
+    if (this.state === "ready") {
+      this.send({ type: "subscribe", channels: [...channels], id: this.nextId() });
+    }
+  }
+  /** Drop interest and unsubscribe on the wire when connected. */
+  teardown(channels) {
+    if (channels.length === 0) return;
+    for (const c of channels) this.active.delete(c);
+    if (this.state === "ready") {
+      this.send({ type: "unsubscribe", channels: [...channels], id: this.nextId() });
+    }
+  }
+  onStateChange(handler) {
+    this.stateListeners.add(handler);
+    return () => this.stateListeners.delete(handler);
+  }
+  onError(handler) {
+    this.errorListeners.add(handler);
+    return () => this.errorListeners.delete(handler);
+  }
+  // ── internals ────────────────────────────────────────────────────────────────
+  async open() {
+    const epoch = this.epoch;
+    this.setState(this.attempt === 0 ? "connecting" : "reconnecting");
+    let ticket;
+    try {
+      const cred = await this.options.getAuthCredential?.();
+      if (cred && "ticket" in cred) ticket = cred.ticket;
+    } catch (err) {
+      if (epoch !== this.epoch) return;
+      this.emitError({ code: "REALTIME_AUTH", message: err.message });
+      this.failConnect(err instanceof Error ? err : new Error(String(err)));
+      this.scheduleReconnect();
+      return;
+    }
+    if (epoch !== this.epoch) return;
+    let socket;
+    try {
+      const WebSocketImpl = resolveWebSocket(this.options.WebSocketImpl);
+      socket = new WebSocketImpl(this.options.url);
+    } catch (err) {
+      this.failConnect(err);
+      this.scheduleReconnect();
+      return;
+    }
+    this.socket = socket;
+    this.armReadyDeadline(socket);
+    socket.onopen = () => {
+      if (socket !== this.socket) return;
+      if (ticket) this.send({ type: "auth", token: ticket });
+    };
+    socket.onmessage = (ev) => {
+      if (socket !== this.socket) return;
+      this.onMessage(ev.data);
+    };
+    socket.onerror = () => {
+      if (socket !== this.socket) return;
+      this.emitError({ code: "REALTIME_SOCKET", message: "socket error" });
+    };
+    socket.onclose = (ev) => this.onClose(socket, ev?.code);
+  }
+  onMessage(raw) {
+    if (typeof raw !== "string") return;
+    let frame;
+    try {
+      frame = JSON.parse(raw);
+    } catch {
+      return;
+    }
+    switch (frame.type) {
+      case "ready":
+        this.onReady(frame);
+        break;
+      case "event":
+        this.onEvent(frame);
+        break;
+      case "error":
+        this.emitError({
+          code: frame.code,
+          message: frame.message,
+          ...isRecord2(frame.details) ? { details: frame.details } : {}
+        });
+        break;
+      case "reconnect":
+        try {
+          this.socket?.close(1e3, frame.reason);
+        } catch {
+        }
+        break;
+      case "pong":
+        this.lastPongAt = Date.now();
+        break;
+    }
+  }
+  onReady(frame) {
+    this.attempt = 0;
+    this.clearReadyDeadline();
+    this.setState("ready");
+    this.startHeartbeat(frame.heartbeatMs || this.options.heartbeatMs || DEFAULTS.heartbeatMs);
+    if (this.active.size > 0) {
+      this.send({ type: "subscribe", channels: [...this.active], id: this.nextId() });
+    }
+    const ctx = this.lastOccurredAt !== void 0 ? { since: this.lastOccurredAt } : {};
+    void Promise.resolve(this.options.resync?.(ctx)).catch(() => {
+    });
+    this.connectResolve?.();
+    this.connectResolve = null;
+    this.connectReject = null;
+  }
+  onEvent(frame) {
+    if (this.seen.has(frame.eventId)) return;
+    this.seen.add(frame.eventId);
+    this.lastOccurredAt = frame.occurredAt;
+    const handlers = this.handlers.get(frame.channel);
+    if (!handlers) return;
+    const event = frame;
+    for (const handler of handlers) {
+      try {
+        handler(event);
+      } catch (err) {
+        this.emitError({ code: "REALTIME_HANDLER", message: err.message });
+      }
+    }
+  }
+  onClose(socket, code) {
+    if (socket !== this.socket) return;
+    this.clearTimers();
+    this.socket = null;
+    if (this.intentionalClose) {
+      this.setState("closed");
+      return;
+    }
+    this.scheduleReconnect(code);
+  }
+  scheduleReconnect(_code) {
+    if (this.intentionalClose) return;
+    this.setState("reconnecting");
+    if (this.connectReject && this.attempt + 1 >= MAX_PENDING_CONNECT_ATTEMPTS) {
+      this.failConnect(
+        new Error(
+          `realtime: connection not ready after ${MAX_PENDING_CONNECT_ATTEMPTS} attempts (still retrying in the background)`
+        )
+      );
+    }
+    const delay = this.backoffDelay(this.attempt++);
+    this.reconnectTimer = setTimeout(() => void this.open(), delay);
+  }
+  backoffDelay(attempt) {
+    const { baseMs, maxMs, factor } = {
+      baseMs: this.options.backoff?.baseMs ?? DEFAULTS.baseMs,
+      maxMs: this.options.backoff?.maxMs ?? DEFAULTS.maxMs,
+      factor: this.options.backoff?.factor ?? DEFAULTS.factor
+    };
+    const ceiling = Math.min(maxMs, baseMs * factor ** attempt);
+    return Math.floor(Math.random() * ceiling);
+  }
+  startHeartbeat(intervalMs) {
+    this.clearHeartbeat();
+    this.lastPongAt = Date.now();
+    this.heartbeatTimer = setInterval(() => {
+      const socket = this.socket;
+      if (!socket || socket.readyState !== WS_OPEN) return;
+      if (Date.now() - this.lastPongAt >= intervalMs * PONG_DEADLINE_INTERVALS) {
+        try {
+          socket.close(4e3, "pong deadline");
+        } catch {
+        }
+        this.onClose(socket);
+        return;
+      }
+      this.send({ type: "ping" });
+    }, intervalMs);
+  }
+  clearHeartbeat() {
+    if (this.heartbeatTimer) {
+      clearInterval(this.heartbeatTimer);
+      this.heartbeatTimer = null;
+    }
+  }
+  /** Reap a socket that upgrades but never becomes `ready` (see READY_DEADLINE_MS). */
+  armReadyDeadline(socket) {
+    this.clearReadyDeadline();
+    const deadlineMs = this.options.heartbeatMs ?? READY_DEADLINE_MS;
+    this.readyDeadlineTimer = setTimeout(() => {
+      if (socket !== this.socket || this.state === "ready") return;
+      try {
+        socket.close(4e3, "ready deadline");
+      } catch {
+      }
+      this.onClose(socket);
+    }, deadlineMs);
+  }
+  clearReadyDeadline() {
+    if (this.readyDeadlineTimer) {
+      clearTimeout(this.readyDeadlineTimer);
+      this.readyDeadlineTimer = null;
+    }
+  }
+  clearTimers() {
+    this.clearHeartbeat();
+    this.clearReadyDeadline();
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+  }
+  send(frame) {
+    if (!this.socket || this.socket.readyState !== WS_OPEN) return;
+    try {
+      this.socket.send(JSON.stringify(frame));
+    } catch (err) {
+      this.emitError({ code: "REALTIME_SEND", message: err.message });
+    }
+  }
+  setState(state) {
+    if (this.state === state) return;
+    this.state = state;
+    for (const l of this.stateListeners) {
+      try {
+        l(state);
+      } catch {
+      }
+    }
+  }
+  emitError(error) {
+    for (const l of this.errorListeners) {
+      try {
+        l(error);
+      } catch {
+      }
+    }
+  }
+  failConnect(err) {
+    this.connectReject?.(err);
+    this.connectResolve = null;
+    this.connectReject = null;
+    this.connectPromise = null;
+  }
+  nextId() {
+    return `c${++this.idCounter}`;
+  }
+};
+var SeenSet = class {
+  constructor(max) {
+    this.max = max;
+  }
+  max;
+  set = /* @__PURE__ */ new Set();
+  has(id) {
+    return this.set.has(id);
+  }
+  add(id) {
+    this.set.add(id);
+    if (this.set.size > this.max) {
+      const oldest = this.set.values().next().value;
+      if (oldest !== void 0) this.set.delete(oldest);
+    }
+  }
+};
+function isRecord2(v) {
+  return typeof v === "object" && v !== null;
+}
+
+// src/modules/realtime.ts
+var RealtimeModule = class {
+  constructor(http, wsUrl, options = {}) {
+    this.http = http;
+    this.wsUrl = wsUrl;
+    this.options = options;
+  }
+  http;
+  wsUrl;
+  options;
+  client = null;
+  /** Fetch a single-use socket ticket from the gateway. */
+  ticket() {
+    return this.http.post("/realtime/ticket");
+  }
+  ensure() {
+    if (this.client) return this.client;
+    this.client = createRealtimeClient({
+      url: this.wsUrl,
+      getAuthCredential: async () => {
+        const { ticket } = await this.ticket();
+        return { ticket };
+      },
+      ...this.options.resync ? { resync: this.options.resync } : {},
+      ...this.options.backoff ? { backoff: this.options.backoff } : {},
+      ...this.options.heartbeatMs !== void 0 ? { heartbeatMs: this.options.heartbeatMs } : {},
+      ...this.options.dedupeWindow !== void 0 ? { dedupeWindow: this.options.dedupeWindow } : {},
+      ...this.options.WebSocketImpl ? { WebSocketImpl: this.options.WebSocketImpl } : {}
+    });
+    return this.client;
+  }
+  get state() {
+    return this.client?.state ?? "idle";
+  }
+  /** Open the socket and authenticate. Call once after login. */
+  connect() {
+    return this.ensure().connect();
+  }
+  /** Close intentionally (call on logout). Stops auto-reconnect. */
+  async disconnect() {
+    if (this.client) await this.client.disconnect();
+  }
+  /** Subscribe to a channel with a typed handler. Returns an unsubscribe fn. */
+  on(channel, handler) {
+    return this.ensure().on(channel, handler);
+  }
+  subscribe(channels) {
+    return this.ensure().subscribe(channels);
+  }
+  unsubscribe(channels) {
+    return this.ensure().unsubscribe(channels);
+  }
+  withSubscription(channels, scope) {
+    return this.ensure().withSubscription(channels, scope);
+  }
+  activeChannels() {
+    return this.client?.activeChannels() ?? [];
+  }
+  onStateChange(handler) {
+    return this.ensure().onStateChange(handler);
+  }
+  onError(handler) {
+    return this.ensure().onError(handler);
+  }
+};
+
+// src/client.ts
+function createCasinoClient(config) {
+  const resolved = resolveConfig(config);
+  const http = new HttpClient(resolved);
+  const session = new Session(resolved.defaultCurrency);
+  const auth = new AuthModule(http, session, resolved.baseUrl);
+  http.setRefreshHandler(async () => {
+    await auth.refresh();
+  });
+  const ext = createExtModule(http);
+  http.setErrorEnricher(async (error) => {
+    if (!(error instanceof FlowDelegatedError) || !error.pluginKey || error.flow === void 0) {
+      return;
+    }
+    const cat = await ext.catalog();
+    const entry = cat.plugins.find((p) => p.pluginKey === error.pluginKey);
+    const action = entry?.actions.find((a) => a.key === error.flow);
+    if (action) error.continueWith = { actionKey: action.key };
+  });
+  return {
+    affiliate: new AffiliateModule(http),
+    auth,
+    cashier: new CashierModule(http, session),
+    wallet: new WalletModule(http, session),
+    catalog: new CatalogModule(http),
+    ext,
+    games: new GamesModule(http, session),
+    kyc: new KycModule(http),
+    player: new PlayerModule(http, auth),
+    realtime: new RealtimeModule(http, resolved.wsUrl, config.realtime ?? {}),
+    getSession: () => session.snapshot(),
+    withCookies: (jar) => createCasinoClient({ ...config, cookieJar: jar })
+  };
+}
+
+// src/realtime/contract.ts
+function isExtChannel(value) {
+  return value.startsWith("ext.") && value.length > 4;
+}
+var REALTIME_CHANNELS = [
+  "wallet.balance",
+  "wallet.deposit",
+  "wallet.withdrawal",
+  "gaming",
+  "bonus",
+  "player"
+];
+
+// src/index.ts
+var RUNTIME_API_VERSION = "2026-07-27";
+
+export { AuthError, COOKIE, CasinoSdkError, ConflictError, CookieJar, FlowDelegatedError, ForbiddenError, HEADER, InsufficientFundsError, LimitExceededError, MONEY_SCALE, NetworkError, NotFoundError, NotImplementedError, OperationDeniedError, PluginActionNotFoundError, PluginNotEnabledError, PluginUnavailableError, PluginVersionMismatchError, REALTIME_CHANNELS, RUNTIME_API_VERSION, RateLimitError, RgBlockedError, ServerError, UnprocessableError, ValidationError, assertLaunchUrl, assertPluginVersion, checkJsonSchema, createCasinoClient, decimalToMinor, formatMoney, generateIdempotencyKey, isAppErrorEnvelope, isExtChannel, minorStringToMinor, minorToAmount, minorToDecimal };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map