@clovnet/plugin-sdk 0.1.4

package/dist/index.d.ts

@@ -0,0 +1,3658 @@
+import { z } from 'zod';
+
+/**
+ * Canonical domain event names, grouped by aggregate.
+ *
+ * Names are the *contract*. They are dot-delimited `aggregate.action` strings;
+ * the NATS subject is derived by prefixing `cwe.` (see `subjects.ts`). Never
+ * inline an event-name string anywhere — always reference these constants so a
+ * rename is a single, type-checked edit and consumers can't drift.
+ */
+declare const WalletEvents: {
+    readonly CREDITED: "wallet.credited";
+    readonly DEBITED: "wallet.debited";
+    readonly TRANSFERRED: "wallet.transferred";
+    readonly DEPOSIT_COMPLETED: "wallet.deposit_completed";
+    readonly WITHDRAWAL_REQUESTED: "wallet.withdrawal_requested";
+    readonly WITHDRAWAL_APPROVED: "wallet.withdrawal_approved";
+    readonly WITHDRAWAL_REJECTED: "wallet.withdrawal_rejected";
+    readonly TRANSACTION_REVERSED: "wallet.transaction_reversed";
+    readonly WALLET_FROZEN: "wallet.frozen";
+    readonly WALLET_UNFROZEN: "wallet.unfrozen";
+};
+declare const PlayerEvents: {
+    readonly CREATED: "player.created";
+    readonly LOGGED_IN: "player.logged_in";
+    readonly LOGGED_OUT: "player.logged_out";
+    readonly SESSION_REFRESHED: "player.session_refreshed";
+    readonly SOCIAL_LINKED: "player.social_linked";
+    readonly SOCIAL_UNLINKED: "player.social_unlinked";
+    readonly PASSWORD_CHANGED: "player.password_changed";
+    readonly LOGIN_FAILED: "player.login_failed";
+    readonly ACCOUNT_LOCKED: "player.account_locked";
+    readonly UPDATED: "player.updated";
+    /** KYC level-up: the player reached a higher verified level. */
+    readonly VERIFIED: "player.verified";
+    readonly CLOSED: "player.closed";
+    /** Staff suspended the account (backoffice action; payload = ids + reason only). */
+    readonly SUSPENDED: "player.suspended";
+    /** Staff lifted a suspension, returning the account to active. */
+    readonly REACTIVATED: "player.reactivated";
+    readonly EMAIL_VERIFIED: "player.email_verified";
+    readonly PHONE_VERIFIED: "player.phone_verified";
+    readonly SESSION_REVOKED: "player.session_revoked";
+    readonly PREFERENCES_UPDATED: "player.preferences_updated";
+    readonly LIMIT_CHANGED: "player.limit_changed";
+    readonly COOL_OFF_STARTED: "player.cool_off_started";
+    readonly SELF_EXCLUDED: "player.self_excluded";
+    /**
+     * Reality-check tick (§8.2): produced by the worker sweep for active game
+     * sessions, delivered to the frontend via the realtime `player` channel.
+     * Transport fact only — carries session aggregates, never money truth.
+     */
+    readonly REALITY_CHECK: "player.reality_check";
+    readonly ONLINE: "player.online";
+    readonly OFFLINE: "player.offline";
+};
+/**
+ * Dynamic-KYC lifecycle events (PLAYER_ACCOUNT_BUILD_PROMPT.md §5). Payloads
+ * carry ids, document-type KEYS and coded statuses/reasons only — never
+ * document content, storage refs, file names or signed URLs.
+ */
+declare const KycEvents: {
+    readonly CONFIG_UPDATED: "kyc.config_updated";
+    readonly REQUEST_CREATED: "kyc.request_created";
+    readonly DOCUMENT_UPLOADED: "kyc.document_uploaded";
+    readonly DOCUMENT_APPROVED: "kyc.document_approved";
+    readonly DOCUMENT_REJECTED: "kyc.document_rejected";
+    readonly REQUEST_SUBMITTED: "kyc.request_submitted";
+    readonly REQUEST_APPROVED: "kyc.request_approved";
+    readonly REQUEST_REJECTED: "kyc.request_rejected";
+    readonly REQUEST_NEEDS_MORE: "kyc.request_needs_more";
+    readonly REQUEST_ESCALATED: "kyc.request_escalated";
+};
+declare const BonusEvents: {
+    readonly GRANTED: "bonus.granted";
+    readonly REVOKED: "bonus.revoked";
+    readonly OFFERED: "bonus.offered";
+    readonly CLAIMED: "bonus.claimed";
+    readonly ACTIVATED: "bonus.activated";
+    readonly WAGERING_PROGRESSED: "bonus.wagering_progressed";
+    readonly WAGERING_COMPLETED: "bonus.wagering_completed";
+    readonly CONVERTED: "bonus.converted";
+    readonly EXPIRED: "bonus.expired";
+    readonly FORFEITED: "bonus.forfeited";
+    readonly VOIDED: "bonus.voided";
+    readonly GRANT_QUEUED: "bonus.grant_queued";
+    readonly GRANT_REJECTED: "bonus.grant_rejected";
+    readonly CONSTRAINT_BREACHED: "bonus.constraint_breached";
+};
+/**
+ * Tournament lifecycle events. Emitted by promo plugins through the SDK's
+ * typed `emitDomain` surface (BONUS_PLATFORM.md G7) so CRM/analytics can
+ * consume them uniformly; never free-form `plugin.<key>.*` strings.
+ */
+declare const TournamentEvents: {
+    readonly STARTED: "tournament.started";
+    readonly ENDED: "tournament.ended";
+    readonly PRIZE_AWARDED: "tournament.prize_awarded";
+};
+/**
+ * Gamification events (missions, achievements, levels) — plugin-emitted via
+ * the typed SDK surface, same rationale as `TournamentEvents`.
+ */
+declare const GamificationEvents: {
+    readonly ACHIEVEMENT_UNLOCKED: "gamification.achievement_unlocked";
+    readonly MISSION_COMPLETED: "gamification.mission_completed";
+    readonly LEVEL_UP: "gamification.level_up";
+};
+/** Loyalty-points events — plugin-emitted via the typed SDK surface. */
+declare const LoyaltyEvents: {
+    readonly POINTS_EARNED: "loyalty.points_earned";
+    readonly POINTS_REDEEMED: "loyalty.points_redeemed";
+};
+declare const BetEvents: {
+    readonly PLACED: "bet.placed";
+    readonly SETTLED: "bet.settled";
+};
+declare const AffiliateEvents: {
+    readonly CLICK_RECORDED: "affiliate.click_recorded";
+    readonly REGISTRATION_ATTRIBUTED: "affiliate.registration_attributed";
+    /** The one-time, permanent player→affiliate assignment (one per player, ever). */
+    readonly ASSIGNED: "affiliate.assigned";
+    readonly COMMISSION_CREATED: "affiliate.commission_created";
+    readonly COMMISSION_SETTLED: "affiliate.commission_settled";
+};
+/**
+ * Player classification & audience events (System family, like Plugin/Provider).
+ * Emitted by the `@cwe/classification` engine and the audience/conversion
+ * exporters — tags, segment membership, and the ad-platform feedback loop
+ * (docs/AFFILIATE_ANALYTICS.md Parts G–H). Projection-side facts: they never
+ * carry money truth, only classification state changes.
+ */
+declare const ClassificationEvents: {
+    readonly PLAYER_TAG_ASSIGNED: "classification.tag_assigned";
+    readonly PLAYER_TAG_REMOVED: "classification.tag_removed";
+    readonly SEGMENT_MEMBERSHIP_CHANGED: "classification.segment_membership_changed";
+    readonly AUDIENCE_EXPORTED: "classification.audience_exported";
+    readonly CONVERSION_FEEDBACK_SENT: "classification.conversion_feedback_sent";
+};
+/**
+ * Catalog (game & provider catalog) events. Global/control-plane events
+ * (source/provider/category/game definition changes) do NOT carry a tenant scope
+ * in their payload; tenant-scoped events (provider toggle, game overlay) do.
+ */
+declare const CatalogEvents: {
+    readonly SOURCE_REGISTERED: "catalog.source_registered";
+    readonly SOURCE_IMPORTED: "catalog.source_imported";
+    readonly PROVIDER_UPSERTED: "catalog.provider_upserted";
+    readonly CATEGORY_UPSERTED: "catalog.category_upserted";
+    readonly GAME_CREATED: "catalog.game_created";
+    readonly GAME_UPDATED: "catalog.game_updated";
+    readonly GAME_RETIRED: "catalog.game_retired";
+    readonly TENANT_PROVIDER_TOGGLED: "catalog.tenant_provider_toggled";
+    readonly TENANT_GAME_OVERLAID: "catalog.tenant_game_overlaid";
+    readonly GAMES_BULK_UPDATED: "catalog.games_bulk_updated";
+    readonly CACHE_INVALIDATED: "catalog.cache_invalidated";
+};
+/**
+ * Cashier (money-in / money-out) events — the payment lifecycle on top of the
+ * wallet's financial events. The wallet still emits `wallet.*` for the actual
+ * balance moves; these carry the PSP/payment facts the funnel + NGR waterfall
+ * need (payment method, itemized fees, chargebacks, FX snapshot).
+ */
+declare const CashierEvents: {
+    readonly DEPOSIT_INITIATED: "cashier.deposit_initiated";
+    readonly DEPOSIT_COMPLETED: "cashier.deposit_completed";
+    readonly DEPOSIT_FAILED: "cashier.deposit_failed";
+    readonly WITHDRAWAL_REQUESTED: "cashier.withdrawal_requested";
+    readonly WITHDRAWAL_APPROVED: "cashier.withdrawal_approved";
+    readonly WITHDRAWAL_REJECTED: "cashier.withdrawal_rejected";
+    readonly WITHDRAWAL_PAID: "cashier.withdrawal_paid";
+    readonly WITHDRAWAL_FAILED: "cashier.withdrawal_failed";
+    /** Player/BO cancelled a not-yet-processing withdrawal; locked funds released. */
+    readonly WITHDRAWAL_CANCELLED: "cashier.withdrawal_cancelled";
+    readonly PAYMENT_FEE_RECORDED: "cashier.payment_fee_recorded";
+    readonly CHARGEBACK_RECORDED: "cashier.chargeback_recorded";
+    readonly PAYMENT_INSTRUMENT_ADDED: "cashier.payment_instrument_added";
+};
+/**
+ * Plugin-platform lifecycle events (System family). Emitted by the plugin host
+ * commands (install/enable/configure/publish/…), never by plugin code itself —
+ * plugin-emitted events are namespaced `plugin.<key>.*` and flow through the
+ * outbox as raw subjects, not through this typed catalog.
+ */
+declare const PluginEvents: {
+    readonly INSTALLED: "plugin.installed";
+    readonly ENABLED: "plugin.enabled";
+    readonly DISABLED: "plugin.disabled";
+    readonly UNINSTALLED: "plugin.uninstalled";
+    readonly CONFIGURED: "plugin.configured";
+    readonly PUBLISHED: "plugin.published";
+    readonly VERSION_YANKED: "plugin.version_yanked";
+    readonly UPGRADED: "plugin.upgraded";
+    readonly TASK_STARTED: "plugin.task_started";
+    readonly TASK_COMPLETED: "plugin.task_completed";
+    readonly TASK_FAILED: "plugin.task_failed";
+    readonly JOB_FAILED: "plugin.job_failed";
+    readonly DATA_PURGED: "plugin.data_purged";
+};
+/**
+ * Provider lifecycle events (System family). `provider.enabled` fires when a
+ * provider-kind plugin is enabled for a tenant and its adapter is registered.
+ */
+declare const ProviderEvents: {
+    readonly ENABLED: "provider.enabled";
+    readonly DISABLED: "provider.disabled";
+};
+/**
+ * Backoffice-platform events (System family). Emitted by the `packages/backoffice`
+ * services (view/dashboard save, export completion, PII reveal, translations).
+ * Projection/operational facts only — never money truth. PII_REVEALED carries the
+ * subject id + revealed field KEYS only, never the revealed values.
+ */
+declare const BackofficeEvents: {
+    readonly VIEW_SAVED: "backoffice.view_saved";
+    readonly DASHBOARD_SAVED: "backoffice.dashboard_saved";
+    readonly EXPORT_COMPLETED: "backoffice.export_completed";
+    readonly PII_REVEALED: "backoffice.pii_revealed";
+    readonly TRANSLATIONS_UPDATED: "backoffice.translations_updated";
+    /**
+     * TASK-005: staff reassigned a player's CRM owner. Carries staff user ids
+     * (before/after, either may be null for unassign) + reason. No player PII.
+     */
+    readonly OWNER_ASSIGNED: "backoffice.owner_assigned";
+    /**
+     * TASK-007: staff logged a typed CRM activity on any entity record.
+     * Payload carries ids + kind + ownerActorId + dueAt/completedAt only —
+     * NO body text (PII exfiltration risk), NO authorActorId (retrievable
+     * from the audit row).
+     */
+    readonly ACTIVITY_CREATED: "backoffice.activity_created";
+    /** TASK-007: staff marked an activity complete. Payload = ids + timestamps. */
+    readonly ACTIVITY_COMPLETED: "backoffice.activity_completed";
+};
+/**
+ * Platform/system events (System family). Emitted by worker jobs and settings
+ * commands — cache-busting + config-change signals, never money truth.
+ * `FX_RATES_UPDATED` lets conversion caches invalidate after a rate sync;
+ * `TENANT_SETTINGS_UPDATED` fires on any tenant-settings write (e.g. a reporting
+ * currency change) so read caches refresh (CURRENCY_SYNC_BUILD.md §3/§4.3).
+ */
+declare const SystemEvents: {
+    readonly FX_RATES_UPDATED: "system.fx_rates_updated";
+    readonly TENANT_SETTINGS_UPDATED: "system.tenant_settings_updated";
+};
+/**
+ * Union of every known event name.
+ *
+ * NOTE: families share some constant KEYS (e.g. both Wallet and Cashier define
+ * `DEPOSIT_COMPLETED`, with distinct *values* `wallet.*` vs `cashier.*`). A flat
+ * spread would let a later family's value overwrite an earlier one's at that key,
+ * silently dropping it from the type. So the runtime object is kept for
+ * convenience, but the `DomainEventName` union is derived from each family's
+ * VALUE type — guaranteeing every event value is in the union regardless of key
+ * collisions.
+ */
+declare const DomainEventNames: {
+    readonly FX_RATES_UPDATED: "system.fx_rates_updated";
+    readonly TENANT_SETTINGS_UPDATED: "system.tenant_settings_updated";
+    readonly VIEW_SAVED: "backoffice.view_saved";
+    readonly DASHBOARD_SAVED: "backoffice.dashboard_saved";
+    readonly EXPORT_COMPLETED: "backoffice.export_completed";
+    readonly PII_REVEALED: "backoffice.pii_revealed";
+    readonly TRANSLATIONS_UPDATED: "backoffice.translations_updated";
+    /**
+     * TASK-005: staff reassigned a player's CRM owner. Carries staff user ids
+     * (before/after, either may be null for unassign) + reason. No player PII.
+     */
+    readonly OWNER_ASSIGNED: "backoffice.owner_assigned";
+    /**
+     * TASK-007: staff logged a typed CRM activity on any entity record.
+     * Payload carries ids + kind + ownerActorId + dueAt/completedAt only —
+     * NO body text (PII exfiltration risk), NO authorActorId (retrievable
+     * from the audit row).
+     */
+    readonly ACTIVITY_CREATED: "backoffice.activity_created";
+    /** TASK-007: staff marked an activity complete. Payload = ids + timestamps. */
+    readonly ACTIVITY_COMPLETED: "backoffice.activity_completed";
+    readonly POINTS_EARNED: "loyalty.points_earned";
+    readonly POINTS_REDEEMED: "loyalty.points_redeemed";
+    readonly ACHIEVEMENT_UNLOCKED: "gamification.achievement_unlocked";
+    readonly MISSION_COMPLETED: "gamification.mission_completed";
+    readonly LEVEL_UP: "gamification.level_up";
+    readonly STARTED: "tournament.started";
+    readonly ENDED: "tournament.ended";
+    readonly PRIZE_AWARDED: "tournament.prize_awarded";
+    readonly ENABLED: "provider.enabled";
+    readonly DISABLED: "provider.disabled";
+    readonly INSTALLED: "plugin.installed";
+    readonly UNINSTALLED: "plugin.uninstalled";
+    readonly CONFIGURED: "plugin.configured";
+    readonly PUBLISHED: "plugin.published";
+    readonly VERSION_YANKED: "plugin.version_yanked";
+    readonly UPGRADED: "plugin.upgraded";
+    readonly TASK_STARTED: "plugin.task_started";
+    readonly TASK_COMPLETED: "plugin.task_completed";
+    readonly TASK_FAILED: "plugin.task_failed";
+    readonly JOB_FAILED: "plugin.job_failed";
+    readonly DATA_PURGED: "plugin.data_purged";
+    readonly DEPOSIT_INITIATED: "cashier.deposit_initiated";
+    readonly DEPOSIT_COMPLETED: "cashier.deposit_completed";
+    readonly DEPOSIT_FAILED: "cashier.deposit_failed";
+    readonly WITHDRAWAL_REQUESTED: "cashier.withdrawal_requested";
+    readonly WITHDRAWAL_APPROVED: "cashier.withdrawal_approved";
+    readonly WITHDRAWAL_REJECTED: "cashier.withdrawal_rejected";
+    readonly WITHDRAWAL_PAID: "cashier.withdrawal_paid";
+    readonly WITHDRAWAL_FAILED: "cashier.withdrawal_failed";
+    /** Player/BO cancelled a not-yet-processing withdrawal; locked funds released. */
+    readonly WITHDRAWAL_CANCELLED: "cashier.withdrawal_cancelled";
+    readonly PAYMENT_FEE_RECORDED: "cashier.payment_fee_recorded";
+    readonly CHARGEBACK_RECORDED: "cashier.chargeback_recorded";
+    readonly PAYMENT_INSTRUMENT_ADDED: "cashier.payment_instrument_added";
+    readonly SOURCE_REGISTERED: "catalog.source_registered";
+    readonly SOURCE_IMPORTED: "catalog.source_imported";
+    readonly PROVIDER_UPSERTED: "catalog.provider_upserted";
+    readonly CATEGORY_UPSERTED: "catalog.category_upserted";
+    readonly GAME_CREATED: "catalog.game_created";
+    readonly GAME_UPDATED: "catalog.game_updated";
+    readonly GAME_RETIRED: "catalog.game_retired";
+    readonly TENANT_PROVIDER_TOGGLED: "catalog.tenant_provider_toggled";
+    readonly TENANT_GAME_OVERLAID: "catalog.tenant_game_overlaid";
+    readonly GAMES_BULK_UPDATED: "catalog.games_bulk_updated";
+    readonly CACHE_INVALIDATED: "catalog.cache_invalidated";
+    readonly PLAYER_TAG_ASSIGNED: "classification.tag_assigned";
+    readonly PLAYER_TAG_REMOVED: "classification.tag_removed";
+    readonly SEGMENT_MEMBERSHIP_CHANGED: "classification.segment_membership_changed";
+    readonly AUDIENCE_EXPORTED: "classification.audience_exported";
+    readonly CONVERSION_FEEDBACK_SENT: "classification.conversion_feedback_sent";
+    readonly CLICK_RECORDED: "affiliate.click_recorded";
+    readonly REGISTRATION_ATTRIBUTED: "affiliate.registration_attributed";
+    /** The one-time, permanent player→affiliate assignment (one per player, ever). */
+    readonly ASSIGNED: "affiliate.assigned";
+    readonly COMMISSION_CREATED: "affiliate.commission_created";
+    readonly COMMISSION_SETTLED: "affiliate.commission_settled";
+    readonly PLACED: "bet.placed";
+    readonly SETTLED: "bet.settled";
+    readonly GRANTED: "bonus.granted";
+    readonly REVOKED: "bonus.revoked";
+    readonly OFFERED: "bonus.offered";
+    readonly CLAIMED: "bonus.claimed";
+    readonly ACTIVATED: "bonus.activated";
+    readonly WAGERING_PROGRESSED: "bonus.wagering_progressed";
+    readonly WAGERING_COMPLETED: "bonus.wagering_completed";
+    readonly CONVERTED: "bonus.converted";
+    readonly EXPIRED: "bonus.expired";
+    readonly FORFEITED: "bonus.forfeited";
+    readonly VOIDED: "bonus.voided";
+    readonly GRANT_QUEUED: "bonus.grant_queued";
+    readonly GRANT_REJECTED: "bonus.grant_rejected";
+    readonly CONSTRAINT_BREACHED: "bonus.constraint_breached";
+    readonly CONFIG_UPDATED: "kyc.config_updated";
+    readonly REQUEST_CREATED: "kyc.request_created";
+    readonly DOCUMENT_UPLOADED: "kyc.document_uploaded";
+    readonly DOCUMENT_APPROVED: "kyc.document_approved";
+    readonly DOCUMENT_REJECTED: "kyc.document_rejected";
+    readonly REQUEST_SUBMITTED: "kyc.request_submitted";
+    readonly REQUEST_APPROVED: "kyc.request_approved";
+    readonly REQUEST_REJECTED: "kyc.request_rejected";
+    readonly REQUEST_NEEDS_MORE: "kyc.request_needs_more";
+    readonly REQUEST_ESCALATED: "kyc.request_escalated";
+    readonly CREATED: "player.created";
+    readonly LOGGED_IN: "player.logged_in";
+    readonly LOGGED_OUT: "player.logged_out";
+    readonly SESSION_REFRESHED: "player.session_refreshed";
+    readonly SOCIAL_LINKED: "player.social_linked";
+    readonly SOCIAL_UNLINKED: "player.social_unlinked";
+    readonly PASSWORD_CHANGED: "player.password_changed";
+    readonly LOGIN_FAILED: "player.login_failed";
+    readonly ACCOUNT_LOCKED: "player.account_locked";
+    readonly UPDATED: "player.updated";
+    /** KYC level-up: the player reached a higher verified level. */
+    readonly VERIFIED: "player.verified";
+    readonly CLOSED: "player.closed";
+    /** Staff suspended the account (backoffice action; payload = ids + reason only). */
+    readonly SUSPENDED: "player.suspended";
+    /** Staff lifted a suspension, returning the account to active. */
+    readonly REACTIVATED: "player.reactivated";
+    readonly EMAIL_VERIFIED: "player.email_verified";
+    readonly PHONE_VERIFIED: "player.phone_verified";
+    readonly SESSION_REVOKED: "player.session_revoked";
+    readonly PREFERENCES_UPDATED: "player.preferences_updated";
+    readonly LIMIT_CHANGED: "player.limit_changed";
+    readonly COOL_OFF_STARTED: "player.cool_off_started";
+    readonly SELF_EXCLUDED: "player.self_excluded";
+    /**
+     * Reality-check tick (§8.2): produced by the worker sweep for active game
+     * sessions, delivered to the frontend via the realtime `player` channel.
+     * Transport fact only — carries session aggregates, never money truth.
+     */
+    readonly REALITY_CHECK: "player.reality_check";
+    readonly ONLINE: "player.online";
+    readonly OFFLINE: "player.offline";
+    readonly CREDITED: "wallet.credited";
+    readonly DEBITED: "wallet.debited";
+    readonly TRANSFERRED: "wallet.transferred";
+    readonly TRANSACTION_REVERSED: "wallet.transaction_reversed";
+    readonly WALLET_FROZEN: "wallet.frozen";
+    readonly WALLET_UNFROZEN: "wallet.unfrozen";
+};
+type EventValues<T> = T[keyof T];
+type DomainEventName = EventValues<typeof WalletEvents> | EventValues<typeof PlayerEvents> | EventValues<typeof KycEvents> | EventValues<typeof BonusEvents> | EventValues<typeof BetEvents> | EventValues<typeof AffiliateEvents> | EventValues<typeof ClassificationEvents> | EventValues<typeof CatalogEvents> | EventValues<typeof CashierEvents> | EventValues<typeof PluginEvents> | EventValues<typeof ProviderEvents> | EventValues<typeof TournamentEvents> | EventValues<typeof GamificationEvents> | EventValues<typeof LoyaltyEvents> | EventValues<typeof BackofficeEvents> | EventValues<typeof SystemEvents>;
+
+/**
+ * Strongly-typed payload interfaces — one per event name.
+ *
+ * These are the stable wire contracts consumers depend on. Payloads are
+ * additive-only within a version: to make a breaking change, bump the event
+ * version in `versions.ts` and add a new payload interface (e.g.
+ * `WalletCreditedPayloadV2`) rather than mutating this one.
+ */
+
+interface WalletCreditedPayload {
+    walletId: string;
+    playerId: string;
+    transactionId: string;
+    amount: string;
+    currency: string;
+    source: string;
+    balanceBefore: string;
+    balanceAfter: string;
+    /** Bucket this credit applied to. Additive — populated for realtime wallet.balance. */
+    walletType?: WalletBucket;
+    /** Post-event balances of every bucket (cash/bonus/locked). Additive. */
+    balances?: WalletBucketBalances;
+}
+interface WalletDebitedPayload {
+    walletId: string;
+    playerId: string;
+    transactionId: string;
+    amount: string;
+    currency: string;
+    source: string;
+    balanceBefore: string;
+    balanceAfter: string;
+    /** Bucket this debit applied to. Additive — populated for realtime wallet.balance. */
+    walletType?: WalletBucket;
+    /** Post-event balances of every bucket (cash/bonus/locked). Additive. */
+    balances?: WalletBucketBalances;
+}
+/** The bucket (cash/bonus/locked/…) a movement applied to. */
+type WalletBucket = "cash" | "bonus" | "locked" | (string & {});
+/**
+ * Post-event balances of every wallet bucket, as fixed-precision strings. Carried
+ * additively on balance-affecting wallet events so the realtime `wallet.balance`
+ * projection can ship an authoritative per-bucket snapshot (the SDK contract)
+ * without a second read. Buckets beyond these are added here as the engine grows.
+ */
+interface WalletBucketBalances {
+    cash: string;
+    bonus: string;
+    locked: string;
+}
+/** An internal transfer between two buckets of the same wallet. */
+interface WalletTransferredPayload {
+    walletId: string;
+    playerId: string;
+    transactionId: string;
+    fromWalletType: WalletBucket;
+    toWalletType: WalletBucket;
+    amount: string;
+    currency: string;
+    source: string;
+    fromBalanceBefore: string;
+    fromBalanceAfter: string;
+    toBalanceBefore: string;
+    toBalanceAfter: string;
+    /** Post-event balances of every bucket (cash/bonus/locked). Additive. */
+    balances?: WalletBucketBalances;
+}
+interface WalletDepositCompletedPayload {
+    walletId: string;
+    playerId: string;
+    transactionId: string;
+    externalTransactionId: string | null;
+    amount: string;
+    currency: string;
+    source: string;
+    balanceBefore: string;
+    balanceAfter: string;
+}
+interface WalletWithdrawalRequestedPayload {
+    walletId: string;
+    playerId: string;
+    transactionId: string;
+    amount: string;
+    currency: string;
+    source: string;
+    /** Cash balance after the funds were moved into the locked bucket. */
+    balanceAfter: string;
+    lockedBalanceAfter: string;
+}
+interface WalletWithdrawalApprovedPayload {
+    walletId: string;
+    playerId: string;
+    transactionId: string;
+    amount: string;
+    currency: string;
+    lockedBalanceAfter: string;
+}
+interface WalletWithdrawalRejectedPayload {
+    walletId: string;
+    playerId: string;
+    transactionId: string;
+    amount: string;
+    currency: string;
+    reason: string;
+    /** Cash balance after the locked funds were returned. */
+    balanceAfter: string;
+    lockedBalanceAfter: string;
+}
+interface WalletTransactionReversedPayload {
+    walletId: string;
+    playerId: string;
+    /** The newly-created reversing transaction. */
+    transactionId: string;
+    /** The original transaction that was reversed. */
+    originalTransactionId: string;
+    originalType: string;
+    amount: string;
+    currency: string;
+    reason: string;
+    /** Internal catalog GameId carried from the original transaction (v2). */
+    gameId?: string | null;
+}
+interface WalletFrozenPayload {
+    walletId: string;
+    playerId: string;
+    currency: string;
+    reason: string;
+}
+interface WalletUnfrozenPayload {
+    walletId: string;
+    playerId: string;
+    currency: string;
+    reason: string;
+}
+interface PlayerCreatedPayload {
+    playerId: string;
+    brandId: string;
+    externalId: string;
+    /** How the player came to exist: credential signup or a social provider. */
+    signupMethod?: "password" | "social";
+    provider?: string;
+    /**
+     * Attribution hints captured at signup (additive). The click chain lives in
+     * a cookie/param set by the tracking endpoint; the affiliate consumer
+     * resolves them into the one-time player_attribution row. Capture-or-lose:
+     * these cannot be reconstructed later.
+     */
+    signupClickId?: string;
+    affiliateCode?: string;
+    deviceFingerprint?: string;
+}
+/** A successful authentication. `method` distinguishes password vs social login. */
+interface PlayerLoggedInPayload {
+    playerId: string;
+    sessionId: string;
+    method: "password" | "social" | "refresh";
+    provider?: string;
+    ip?: string;
+    /** Resolved geo at login — carried for fraud/risk/compliance consumers. */
+    country?: string;
+    region?: string;
+    city?: string;
+}
+interface PlayerLoggedOutPayload {
+    playerId: string;
+    sessionId: string;
+}
+interface PlayerSessionRefreshedPayload {
+    playerId: string;
+    /** The revoked session. */
+    previousSessionId: string;
+    /** The freshly minted session that replaced it. */
+    sessionId: string;
+}
+interface PlayerSocialLinkedPayload {
+    playerId: string;
+    provider: string;
+    providerUserId: string;
+    socialAccountId: string;
+}
+interface PlayerSocialUnlinkedPayload {
+    playerId: string;
+    provider: string;
+    socialAccountId: string;
+}
+interface PlayerPasswordChangedPayload {
+    playerId: string;
+}
+interface PlayerLoginFailedPayload {
+    /** Player id when the account was found; null for unknown email. */
+    playerId: string | null;
+    email?: string;
+    reason: "invalid_credentials" | "account_locked" | "account_inactive";
+    ip?: string;
+}
+interface PlayerAccountLockedPayload {
+    playerId: string;
+    lockedUntil: string;
+    failedLoginAttempts: number;
+}
+/** Profile fields changed. `changedFields` lists NAMES only — never values. */
+interface PlayerUpdatedPayload {
+    playerId: string;
+    changedFields: string[];
+}
+/** KYC level-up: the player's verified level increased (§5.5). */
+interface PlayerVerifiedPayload {
+    playerId: string;
+    level: number;
+    previousLevel: number;
+    /** The KYC request whose approval caused the level-up (null = level 0). */
+    kycRequestId: string | null;
+}
+/** Player-initiated account closure (§9). Financial history is retained. */
+interface PlayerClosedPayload {
+    playerId: string;
+    /** Optional player-supplied reason category; free text stays in audit only. */
+    reason: string | null;
+}
+/** Staff suspended the account (backoffice). Reason category only — no PII. */
+interface PlayerSuspendedPayload {
+    playerId: string;
+    reason: string | null;
+}
+/** Staff lifted a suspension. Reason category only — no PII. */
+interface PlayerReactivatedPayload {
+    playerId: string;
+    reason: string | null;
+}
+interface PlayerEmailVerifiedPayload {
+    playerId: string;
+    /** Which variant confirmed it: emailed link token or 6-digit OTP. */
+    method: "token" | "otp";
+}
+interface PlayerPhoneVerifiedPayload {
+    playerId: string;
+}
+/** One or more sessions revoked (list + revoke, password change/reset, close). */
+interface PlayerSessionRevokedPayload {
+    playerId: string;
+    sessionIds: string[];
+    reason: "player" | "password_changed" | "password_reset" | "account_closed" | "admin" | "token_reuse";
+}
+/**
+ * Preferences and/or marketing consents changed. Consent changes are also
+ * appended to the `player_consents` GDPR trail; the event carries key+granted
+ * (not PII) so CRM consumers can react without reading the table.
+ */
+interface PlayerPreferencesUpdatedPayload {
+    playerId: string;
+    changedKeys: string[];
+    consentChanges: Array<{
+        consentKey: string;
+        granted: boolean;
+    }>;
+}
+/**
+ * A responsible-gaming limit changed (§8.1). Decreases apply immediately;
+ * increases/removals are stored pending and apply at `appliesAt` (regulatory
+ * ratchet). `value` is a minor-unit amount string, or minutes for
+ * `session_time`; null = limit removal.
+ */
+interface PlayerLimitChangedPayload {
+    playerId: string;
+    kind: "deposit" | "loss" | "wager" | "session_time";
+    period: "day" | "week" | "month";
+    value: string | null;
+    currency?: string;
+    /** ISO-8601 moment the new value takes effect. */
+    appliesAt: string;
+    /** True when the change is a ratcheted (delayed) increase/removal. */
+    pending: boolean;
+}
+interface PlayerCoolOffStartedPayload {
+    playerId: string;
+    period: "24h" | "48h" | "7d" | "30d";
+    endsAt: string;
+}
+interface PlayerSelfExcludedPayload {
+    playerId: string;
+    period: "6m" | "1y" | "5y" | "permanent";
+    /** ISO-8601 expiry; null = permanent. */
+    endsAt: string | null;
+}
+/** Reality-check tick for an active game session (§8.2). */
+interface PlayerRealityCheckPayload {
+    playerId: string;
+    gameSessionId: string;
+    sessionMinutes: number;
+    betTotalMinor: string;
+    winTotalMinor: string;
+    currency: string | null;
+}
+/** The player transitioned offline→online (first activity after idle/login). */
+interface PlayerOnlinePayload {
+    playerId: string;
+}
+/** The player transitioned online→offline (presence TTL expiry, logout, or revocation). */
+interface PlayerOfflinePayload {
+    playerId: string;
+    /** ISO-8601 timestamp of the last activity we saw; null if unknown. */
+    lastActivityAt: string | null;
+    reason: "ttl_expired" | "logged_out" | "sessions_revoked";
+}
+/** Operator edited the KYC configuration (document types / requirement sets). */
+interface KycConfigUpdatedPayload {
+    entity: "document_type" | "requirement_set";
+    key: string;
+    active: boolean;
+}
+interface KycRequestCreatedPayload {
+    kycRequestId: string;
+    playerId: string;
+    trigger: "manual" | "signup" | "deposit_total_threshold" | "withdrawal_amount_threshold" | "withdrawal_total_threshold" | "risk_flag";
+    requirementSetId: string | null;
+    targetLevel: number | null;
+    /** Snapshot of required document-type keys at creation time. */
+    requiredDocumentTypes: string[];
+}
+/** A document landed — this is what auto-verify KYC adapters key on (§2.4). */
+interface KycDocumentUploadedPayload {
+    documentId: string;
+    kycRequestId: string | null;
+    playerId: string;
+    documentTypeKey: string;
+    mimeType: string;
+    sizeBytes: number;
+}
+interface KycDocumentApprovedPayload {
+    documentId: string;
+    kycRequestId: string | null;
+    playerId: string;
+    documentTypeKey: string;
+}
+interface KycDocumentRejectedPayload {
+    documentId: string;
+    kycRequestId: string | null;
+    playerId: string;
+    documentTypeKey: string;
+    /** Coded rejection reason (e.g. `blurry`, `expired`, `mismatch`). */
+    reason: string;
+}
+interface KycRequestSubmittedPayload {
+    kycRequestId: string;
+    playerId: string;
+    documentCount: number;
+}
+interface KycRequestApprovedPayload {
+    kycRequestId: string;
+    playerId: string;
+    /** Level the approval grants (requirement set's targetLevel). */
+    level: number;
+}
+interface KycRequestRejectedPayload {
+    kycRequestId: string;
+    playerId: string;
+    reasonCode: string;
+}
+/** BO requested more documents — request flips back to draft with new items. */
+interface KycRequestNeedsMorePayload {
+    kycRequestId: string;
+    playerId: string;
+    requestedDocumentTypes: string[];
+    reasonCode: string | null;
+}
+/**
+ * TASK-013 — a BO reviewer escalated a submitted request into the senior
+ * `in_review` lane. Carries ids + the mandatory coded/free reason only.
+ */
+interface KycRequestEscalatedPayload {
+    kycRequestId: string;
+    playerId: string;
+    reason: string;
+}
+interface BonusGrantedPayload {
+    bonusId: string;
+    playerId: string;
+    campaign: string;
+    amount: string;
+    currency: string;
+}
+interface BonusRevokedPayload {
+    bonusId: string;
+    playerId: string;
+    reason: string;
+}
+interface BonusOfferedPayload {
+    instanceId: string;
+    templateId: string;
+    templateVersion: number;
+    playerId: string;
+    amount: string;
+    currency: string;
+    /** ISO-8601 claim deadline; null when the offer has no claim clock. */
+    claimBy: string | null;
+    /** Domain event id (or other natural key) that triggered the grant. */
+    sourceEventId: string | null;
+}
+interface BonusClaimedPayload {
+    instanceId: string;
+    templateId: string;
+    playerId: string;
+}
+interface BonusActivatedPayload {
+    instanceId: string;
+    templateId: string;
+    playerId: string;
+    amount: string;
+    currency: string;
+    wageringRequired: string;
+    /** ISO-8601 wagering deadline; null when the plan has no complete-by clock. */
+    completeBy: string | null;
+}
+interface BonusWageringProgressedPayload {
+    instanceId: string;
+    playerId: string;
+    progress: string;
+    required: string;
+    /** The 10%-step milestone just crossed (10, 20, … 100). */
+    milestonePct: number;
+}
+interface BonusWageringCompletedPayload {
+    instanceId: string;
+    playerId: string;
+    wagered: string;
+    required: string;
+}
+interface BonusConvertedPayload {
+    instanceId: string;
+    playerId: string;
+    /** Amount moved bonus → cash after caps. */
+    convertedAmount: string;
+    /** Excess removed by max-win/conversion caps ("0.0000" when uncapped). */
+    cappedAmount: string;
+    currency: string;
+    /** false = phantom bonus: principal removed, only winnings converted. */
+    cashable: boolean;
+}
+interface BonusExpiredPayload {
+    instanceId: string;
+    playerId: string;
+    /** Which clock ran out: the claim-by window or the wagering complete-by window. */
+    phase: "claim" | "wagering";
+    forfeitedAmount: string;
+    currency: string;
+}
+interface BonusForfeitedPayload {
+    instanceId: string;
+    playerId: string;
+    reason: "player_cancelled" | "withdrawal" | "breach" | "admin";
+    forfeitedAmount: string;
+    currency: string;
+}
+interface BonusVoidedPayload {
+    instanceId: string;
+    playerId: string;
+    reason: string;
+    voidedAmount: string;
+    currency: string;
+}
+interface BonusGrantQueuedPayload {
+    approvalId: string;
+    templateId: string;
+    playerId: string;
+    amount: string;
+    currency: string;
+    reason: string;
+}
+interface BonusGrantRejectedPayload {
+    templateId: string;
+    playerId: string;
+    /** Guard/policy that rejected the grant, for audit + analytics. */
+    reason: string;
+    sourceEventId: string | null;
+}
+interface BonusConstraintBreachedPayload {
+    instanceId: string;
+    playerId: string;
+    kind: "max_bet" | "restricted_game";
+    action: "rejected" | "warned" | "voided";
+    roundId: string | null;
+    gameId: string | null;
+}
+interface TournamentStartedPayload {
+    tournamentId: string;
+    name: string;
+    /** Plugin that runs the tournament (emitDomain attribution). */
+    pluginKey: string | null;
+    startsAt: string;
+    endsAt: string;
+}
+interface TournamentEndedPayload {
+    tournamentId: string;
+    name: string;
+    pluginKey: string | null;
+    endedAt: string;
+    participants: number;
+}
+interface TournamentPrizeAwardedPayload {
+    tournamentId: string;
+    playerId: string;
+    rank: number;
+    /** RewardArtifact kind granted for the rank (cash, bonusFunds, freeSpins, …). */
+    artifactKind: string;
+    amount: string | null;
+    currency: string | null;
+    /** Bonus instance created by the prize grant, when the artifact was fund-like. */
+    bonusInstanceId: string | null;
+}
+interface AchievementUnlockedPayload {
+    playerId: string;
+    achievementKey: string;
+    pluginKey: string | null;
+}
+interface MissionCompletedPayload {
+    playerId: string;
+    missionKey: string;
+    pluginKey: string | null;
+}
+interface LevelUpPayload {
+    playerId: string;
+    level: number;
+    previousLevel: number;
+    pluginKey: string | null;
+}
+interface LoyaltyPointsEarnedPayload {
+    playerId: string;
+    points: number;
+    balance: number;
+    /** Earn rule / source key (e.g. "bet_turnover", "mission:daily-spin"). */
+    source: string;
+    pluginKey: string | null;
+}
+interface LoyaltyPointsRedeemedPayload {
+    playerId: string;
+    points: number;
+    balance: number;
+    /** What the points were redeemed for (shop item / reward key). */
+    redemptionKey: string;
+    pluginKey: string | null;
+}
+interface BetPlacedPayload {
+    playerId: string;
+    roundId: string;
+    amount: string;
+    currency: string;
+    provider: string;
+    /** Internal catalog GameId (v2; resolved by the provider/command layer). */
+    gameId: string | null;
+}
+interface BetSettledPayload {
+    playerId: string;
+    roundId: string;
+    payout: string;
+    currency: string;
+    provider: string;
+    /** Internal catalog GameId (v2). */
+    gameId: string | null;
+}
+/**
+ * A tracked click on an affiliate link — the irreversible capture. Click IDs
+ * (`gclid`/`fbclid`/…) can only be keyed here; a click ID not stored at click
+ * time is unrecoverable (the whole PPC feedback loop depends on this event).
+ */
+interface AffiliateClickRecordedPayload {
+    clickId: string;
+    affiliateId: string;
+    campaignId?: string;
+    creativeId?: string;
+    subId1?: string;
+    subId2?: string;
+    subId3?: string;
+    subId4?: string;
+    subId5?: string;
+    gclid?: string;
+    fbclid?: string;
+    ttclid?: string;
+    msclkid?: string;
+    utmSource?: string;
+    utmMedium?: string;
+    utmCampaign?: string;
+    utmTerm?: string;
+    utmContent?: string;
+    landingPage?: string;
+    referrer?: string;
+    /** PII-adjacent fraud/attribution signals — analytics must not re-expose these. */
+    ip?: string;
+    userAgent?: string;
+    deviceFingerprint?: string;
+}
+/** A registration matched to a recorded click (funnel step: click → reg). */
+interface AffiliateRegistrationAttributedPayload {
+    playerId: string;
+    affiliateId: string;
+    clickId: string | null;
+    /** Attribution model that made the match. */
+    attributionModel: "first_touch" | "last_touch" | "multi_touch";
+}
+/**
+ * The one-time player→affiliate assignment. Exactly one per player, ever
+ * (`UNIQUE(tenantId, playerId)`); re-delivery never reassigns.
+ */
+interface AffiliateAssignedPayload {
+    playerId: string;
+    affiliateId: string;
+    dealId: string | null;
+    clickId: string | null;
+    attributionModel: "first_touch" | "last_touch" | "multi_touch";
+    /** Which lifecycle moment resolved the attribution. */
+    trigger: "registration" | "first_deposit";
+    /** Denormalized acquisition dimensions for analytics facts. */
+    channel?: string;
+    source?: string;
+    campaignId?: string;
+    gclid?: string;
+    fbclid?: string;
+    ttclid?: string;
+    msclkid?: string;
+}
+/**
+ * One append-only `affiliate_commissions` ledger row (v2 — ledger semantics).
+ * `playerId` is set for per-player accruals (CPA) and null for period-cohort
+ * accruals (RevShare); corrections are compensating rows, never mutations.
+ */
+interface AffiliateCommissionCreatedPayload {
+    entryId: string;
+    affiliateId: string;
+    dealId: string | null;
+    /** Ledger leg kind. */
+    kind: "cpa" | "revshare" | "adjustment" | "settlement";
+    playerId: string | null;
+    /** Commission run this accrual belongs to (null for out-of-run adjustments). */
+    runId: string | null;
+    /** Signed amount in `currency` (negative = carryover deficit / clawback). */
+    amount: string;
+    currency: string;
+    baseCurrency?: string;
+    fxRate?: string;
+    /** Running affiliate commission balance, wallet-ledger style. */
+    balanceBefore: string;
+    balanceAfter: string;
+}
+/** A closed commission run settled under maker-checker. */
+interface AffiliateCommissionSettledPayload {
+    runId: string;
+    affiliateId: string;
+    /** Period the statement covers (ISO dates, inclusive start / exclusive end). */
+    periodStart: string;
+    periodEnd: string;
+    /** Net payable after carryover + admin fee ("0.0000" when carryover ate it). */
+    amount: string;
+    currency: string;
+    baseCurrency?: string;
+    fxRate?: string;
+    /** Carryover balance remaining after this settlement (negative = still owed). */
+    carryoverAfter: string;
+    makerActorId: string;
+    checkerActorId: string;
+}
+interface PlayerTagAssignedPayload {
+    playerId: string;
+    /** Namespaced `category:value` tag key, e.g. `value:whale`. */
+    tagKey: string;
+    source: "auto" | "manual" | "import" | "campaign";
+    /** Ruleset/model version that produced the assignment (auditable). */
+    ruleVersion: string | null;
+    reason: string | null;
+    /** ISO-8601 expiry; null = does not auto-expire. */
+    expiresAt: string | null;
+}
+interface PlayerTagRemovedPayload {
+    playerId: string;
+    tagKey: string;
+    reason: "expired" | "rule_no_longer_matches" | "manual" | "superseded";
+    ruleVersion: string | null;
+}
+interface SegmentMembershipChangedPayload {
+    segmentId: string;
+    playerId: string;
+    change: "entered" | "exited";
+    /** Segment definition version the recompute evaluated. */
+    segmentVersion: number;
+}
+interface AudienceExportedPayload {
+    exportId: string;
+    segmentId: string;
+    destination: "google" | "meta" | "tiktok" | "dsp" | "csv";
+    purpose: "seed" | "suppression";
+    /** How match keys were hashed (e.g. `sha256_email_phone`). Never the keys. */
+    matchKeyType: string;
+    count: number;
+    /** Players excluded by the RG/consent guard at the exporter boundary. */
+    excludedCount: number;
+}
+interface ConversionFeedbackSentPayload {
+    playerId: string;
+    destination: "google" | "meta" | "tiktok";
+    /** Which stored click ID keyed the conversion. */
+    clickIdType: "gclid" | "fbclid" | "ttclid" | "msclkid";
+    /** Milestone that triggered the postback. */
+    conversionEvent: "ftd" | "value_milestone";
+    conversionValue: string;
+    currency: string;
+    valueSource: "deposit" | "pltv";
+}
+interface CatalogSourceRegisteredPayload {
+    sourceId: string;
+    key: string;
+    adapter: string;
+    /** NULL/undefined = platform/global source; set = tenant-owned. */
+    ownerTenantId?: string | null;
+}
+interface CatalogSourceImportedPayload {
+    sourceId: string;
+    /** Per-entity diff counts produced by the idempotent import. */
+    providers: {
+        inserted: number;
+        updated: number;
+        retired: number;
+    };
+    games: {
+        inserted: number;
+        updated: number;
+        retired: number;
+    };
+    categories: {
+        inserted: number;
+        updated: number;
+    };
+    restrictionGroups: {
+        inserted: number;
+        updated: number;
+    };
+    currencyGroups: {
+        inserted: number;
+        updated: number;
+    };
+    durationMs: number;
+}
+interface CatalogProviderUpsertedPayload {
+    sourceId: string;
+    providerId: string;
+    externalId: string;
+    parentProviderId: string | null;
+    operation: "inserted" | "updated";
+}
+interface CatalogCategoryUpsertedPayload {
+    sourceId: string;
+    categoryId: string;
+    slug: string;
+    parentCategoryId: string | null;
+    operation: "inserted" | "updated";
+}
+interface CatalogGameCreatedPayload {
+    sourceId: string;
+    gameId: string;
+    externalGameId: string;
+    providerId: string;
+    launchCode: string | null;
+    /** Set when this is an operator-owned custom game. */
+    ownerTenantId?: string | null;
+}
+interface CatalogGameUpdatedPayload {
+    sourceId: string;
+    gameId: string;
+    externalGameId: string;
+    changedFields: string[];
+}
+interface CatalogGameRetiredPayload {
+    sourceId: string;
+    gameId: string;
+    externalGameId: string;
+}
+interface CatalogTenantProviderToggledPayload {
+    tenantId: string;
+    providerId: string;
+    status: "enabled" | "disabled";
+}
+interface CatalogTenantGameOverlaidPayload {
+    tenantId: string;
+    gameId: string;
+    status: "enabled" | "disabled" | "archived" | "hidden";
+    featured?: boolean;
+}
+interface CatalogGamesBulkUpdatedPayload {
+    tenantId: string;
+    count: number;
+    status?: "enabled" | "disabled" | "archived" | "hidden";
+}
+interface CatalogCacheInvalidatedPayload {
+    /** Scope of the invalidation. Global bumps affect all tenants. */
+    scope: "global" | "tenant";
+    /** Present when scope === "tenant". */
+    tenantId?: string;
+    /** The new effective version counter value. */
+    version: number;
+}
+interface CashierDepositInitiatedPayload {
+    depositId: string;
+    playerId: string;
+    amount: string;
+    currency: string;
+    providerKey: string;
+    methodKey?: string;
+    isFirstDeposit: boolean;
+}
+interface CashierDepositCompletedPayload {
+    depositId: string;
+    playerId: string;
+    /** SOFT id of the wallet transaction that credited cash. */
+    walletTransactionId: string;
+    amount: string;
+    currency: string;
+    baseCurrency?: string;
+    /** FX rate snapshot at event time (string for precision). */
+    fxRate?: string;
+    providerKey: string;
+    methodKey?: string;
+    /** Total estimated fee at capture (itemized rows come via PAYMENT_FEE_RECORDED). */
+    feeAmount?: string;
+    isFirstDeposit: boolean;
+    affiliateId?: string;
+}
+interface CashierDepositFailedPayload {
+    depositId: string;
+    playerId: string;
+    amount: string;
+    currency: string;
+    providerKey: string;
+    reason: string;
+}
+interface CashierWithdrawalRequestedPayload {
+    withdrawalId: string;
+    playerId: string;
+    amount: string;
+    currency: string;
+    /** SOFT id of the wallet transaction that reserved cash→locked. */
+    reserveWalletTxId: string;
+    status: string;
+}
+interface CashierWithdrawalApprovedPayload {
+    withdrawalId: string;
+    playerId: string;
+    amount: string;
+    currency: string;
+    providerKey: string;
+    approvalActorType?: string;
+    approvalActorId?: string;
+}
+interface CashierWithdrawalRejectedPayload {
+    withdrawalId: string;
+    playerId: string;
+    amount: string;
+    currency: string;
+    reason: string;
+    /** SOFT id of the wallet transaction that released locked→cash. */
+    releaseWalletTxId: string;
+}
+interface CashierWithdrawalPaidPayload {
+    withdrawalId: string;
+    playerId: string;
+    amount: string;
+    currency: string;
+    providerKey: string;
+    /** SOFT id of the wallet transaction that debited the locked funds. */
+    settleWalletTxId: string;
+}
+/** Cancel while `requested`/`pending_review`: locked funds released to cash. */
+interface CashierWithdrawalCancelledPayload {
+    withdrawalId: string;
+    playerId: string;
+    amount: string;
+    currency: string;
+    cancelledBy: "player" | "staff" | "plugin";
+    /** SOFT id of the wallet transaction that released locked→cash. */
+    releaseWalletTxId: string;
+}
+interface CashierWithdrawalFailedPayload {
+    withdrawalId: string;
+    playerId: string;
+    amount: string;
+    currency: string;
+    reason: string;
+    /** SOFT id of the wallet transaction that released locked→cash (if released). */
+    releaseWalletTxId?: string;
+}
+/** NGR deduction fact — `ded_payment_fees`. Itemized, never collapsed. */
+interface CashierPaymentFeeRecordedPayload {
+    feeId: string;
+    depositId?: string;
+    withdrawalId?: string;
+    playerId?: string;
+    feeType: string;
+    estimatedOrActual: "estimated" | "actual";
+    amount: string;
+    currency: string;
+    baseCurrency?: string;
+    fxRate?: string;
+    source: string;
+    sourceTxId?: string;
+    sourceReportId?: string;
+    affiliateId?: string;
+}
+/** NGR deduction fact — `ded_chargebacks`. */
+interface CashierChargebackRecordedPayload {
+    chargebackId: string;
+    depositId?: string;
+    playerId?: string;
+    disputeId: string;
+    stage: string;
+    amount: string;
+    feeAmount?: string;
+    currency: string;
+    baseCurrency?: string;
+    fxRate?: string;
+    /** SOFT id of the wallet clawback transaction (set on `lost`). */
+    clawbackWalletTxId?: string;
+    affiliateId?: string;
+}
+interface CashierPaymentInstrumentAddedPayload {
+    instrumentId: string;
+    playerId: string;
+    providerKey: string;
+    kind: string;
+    brand?: string;
+    fingerprint?: string;
+}
+interface PluginInstalledPayload {
+    pluginId: string;
+    pluginKey: string;
+    version: string;
+    channel: string;
+}
+interface PluginEnabledPayload {
+    pluginId: string;
+    pluginKey: string;
+    version: string;
+    /** Set for provider-kind plugins (the provider adapter that was registered). */
+    providerKey?: string;
+}
+interface PluginDisabledPayload {
+    pluginId: string;
+    pluginKey: string;
+    reason?: string;
+    providerKey?: string;
+}
+interface PluginUninstalledPayload {
+    pluginId: string;
+    pluginKey: string;
+}
+interface PluginConfiguredPayload {
+    pluginId: string;
+    pluginKey: string;
+    /** Plugin version the saved values validate against. */
+    schemaVersion: string;
+    /** Non-secret setting keys that changed. Values are never carried on events. */
+    changedKeys: string[];
+    /** Secret keys that were (re)written. Only key names — never values. */
+    secretKeysChanged: string[];
+    /** Set when this event records a pin/unpin rather than a settings write. */
+    pinnedVersion?: string | null;
+}
+interface PluginPublishedPayload {
+    pluginId: string;
+    pluginKey: string;
+    version: string;
+    channel: string;
+    checksum: string;
+}
+interface PluginVersionYankedPayload {
+    pluginId: string;
+    pluginKey: string;
+    version: string;
+    reason?: string;
+}
+interface PluginUpgradedPayload {
+    pluginId: string;
+    pluginKey: string;
+    fromVersion: string;
+    toVersion: string;
+    /** Migration step ids that ran as part of the upgrade (may be empty). */
+    migrationsRun: string[];
+}
+interface PluginTaskStartedPayload {
+    pluginId: string;
+    pluginKey: string;
+    taskId: string;
+    /** Task type declared by the plugin, e.g. `seed-games`. */
+    type: string;
+}
+interface PluginTaskCompletedPayload {
+    pluginId: string;
+    pluginKey: string;
+    taskId: string;
+    type: string;
+    durationMs: number;
+}
+interface PluginTaskFailedPayload {
+    pluginId: string;
+    pluginKey: string;
+    taskId: string;
+    type: string;
+    /** Redacted failure summary — never a stack trace or secret. */
+    error: string;
+    attempts: number;
+}
+interface PluginJobFailedPayload {
+    pluginId: string;
+    pluginKey: string;
+    job: string;
+    /** Emitted only when the failure-streak policy trips (3 consecutive). */
+    consecutiveFailures: number;
+    error: string;
+}
+interface PluginDataPurgedPayload {
+    pluginId: string;
+    pluginKey: string;
+    dataset: string;
+    /** Archived rows hard-deleted by the purge command. */
+    purgedCount: number;
+}
+interface ProviderEnabledPayload {
+    providerKey: string;
+    /** Present when the provider was contributed by a plugin. */
+    pluginKey?: string;
+    pluginVersion?: string;
+}
+interface ProviderDisabledPayload {
+    providerKey: string;
+    pluginKey?: string;
+    reason?: string;
+}
+interface BackofficeViewSavedPayload {
+    viewId: string;
+    resource: string;
+    scope: "personal" | "shared";
+    actorStaffId: string;
+}
+interface BackofficeDashboardSavedPayload {
+    dashboardId: string;
+    scope: "personal" | "shared";
+    actorStaffId: string;
+}
+interface BackofficeExportCompletedPayload {
+    exportId: string;
+    resource: string;
+    rowCount: number;
+    format: string;
+    actorStaffId: string;
+}
+/** PII_REVEALED: field KEYS only, never the revealed values. */
+interface BackofficePiiRevealedPayload {
+    subjectType: string;
+    subjectId: string;
+    fields: string[];
+    actorStaffId: string;
+    reason?: string;
+}
+interface BackofficeTranslationsUpdatedPayload {
+    locale: string;
+    namespace: string;
+    keyCount: number;
+    actorStaffId: string;
+}
+/**
+ * TASK-005: staff reassigned a player's CRM owner. Carries staff user ids
+ * (either may be null for unassign) + reason. No player PII, no email/phone,
+ * no owner names — consumers resolve names via the staff_users label endpoint.
+ */
+interface BackofficeOwnerAssignedPayload {
+    playerId: string;
+    fromOwnerActorId: string | null;
+    toOwnerActorId: string | null;
+    reason: string | null;
+}
+/**
+ * TASK-007: staff logged a typed CRM activity on any entity record. Carries
+ * ids + kind + owner + dueAt/completedAt only — NO body text (PII exfiltration
+ * risk), NO authorActorId (retrievable from the audit row).
+ */
+interface BackofficeActivityCreatedPayload {
+    activityId: string;
+    entityKey: string;
+    entityId: string;
+    kind: string;
+    ownerActorId: string | null;
+    /** ISO-8601 or null (unscheduled). */
+    dueAt: string | null;
+    /** ISO-8601 or null (always null on create — set by the complete path). */
+    completedAt: string | null;
+}
+/**
+ * TASK-007: staff marked an activity complete. `completedAt` is always non-null.
+ * Same PII-exclusion rules as `BackofficeActivityCreatedPayload`.
+ */
+interface BackofficeActivityCompletedPayload {
+    activityId: string;
+    entityKey: string;
+    entityId: string;
+    kind: string;
+    ownerActorId: string | null;
+    /** ISO-8601, always non-null. */
+    completedAt: string;
+}
+/**
+ * The master map: event name → payload type. This is what makes the whole
+ * package type-safe end to end — builders, the outbox, and consumers all key
+ * off this single source of truth.
+ */
+/** A rate sync run published new/updated rates — cache-bust signal (§4.3). */
+interface SystemFxRatesUpdatedPayload {
+    source: string;
+    kind: "fiat" | "crypto";
+    /** The as-of day the synced rates apply to (`YYYY-MM-DD`). */
+    asOfDate: string;
+    ratesUpserted: number;
+}
+/** A tenant setting changed (e.g. reporting currency) — refresh read caches. */
+interface SystemTenantSettingsUpdatedPayload {
+    key: string;
+    updatedBy?: string;
+}
+interface DomainEventPayloads {
+    [WalletEvents.CREDITED]: WalletCreditedPayload;
+    [WalletEvents.DEBITED]: WalletDebitedPayload;
+    [WalletEvents.TRANSFERRED]: WalletTransferredPayload;
+    [WalletEvents.DEPOSIT_COMPLETED]: WalletDepositCompletedPayload;
+    [WalletEvents.WITHDRAWAL_REQUESTED]: WalletWithdrawalRequestedPayload;
+    [WalletEvents.WITHDRAWAL_APPROVED]: WalletWithdrawalApprovedPayload;
+    [WalletEvents.WITHDRAWAL_REJECTED]: WalletWithdrawalRejectedPayload;
+    [WalletEvents.TRANSACTION_REVERSED]: WalletTransactionReversedPayload;
+    [WalletEvents.WALLET_FROZEN]: WalletFrozenPayload;
+    [WalletEvents.WALLET_UNFROZEN]: WalletUnfrozenPayload;
+    [PlayerEvents.CREATED]: PlayerCreatedPayload;
+    [PlayerEvents.LOGGED_IN]: PlayerLoggedInPayload;
+    [PlayerEvents.LOGGED_OUT]: PlayerLoggedOutPayload;
+    [PlayerEvents.SESSION_REFRESHED]: PlayerSessionRefreshedPayload;
+    [PlayerEvents.SOCIAL_LINKED]: PlayerSocialLinkedPayload;
+    [PlayerEvents.SOCIAL_UNLINKED]: PlayerSocialUnlinkedPayload;
+    [PlayerEvents.PASSWORD_CHANGED]: PlayerPasswordChangedPayload;
+    [PlayerEvents.LOGIN_FAILED]: PlayerLoginFailedPayload;
+    [PlayerEvents.ACCOUNT_LOCKED]: PlayerAccountLockedPayload;
+    [PlayerEvents.UPDATED]: PlayerUpdatedPayload;
+    [PlayerEvents.VERIFIED]: PlayerVerifiedPayload;
+    [PlayerEvents.CLOSED]: PlayerClosedPayload;
+    [PlayerEvents.SUSPENDED]: PlayerSuspendedPayload;
+    [PlayerEvents.REACTIVATED]: PlayerReactivatedPayload;
+    [PlayerEvents.EMAIL_VERIFIED]: PlayerEmailVerifiedPayload;
+    [PlayerEvents.PHONE_VERIFIED]: PlayerPhoneVerifiedPayload;
+    [PlayerEvents.SESSION_REVOKED]: PlayerSessionRevokedPayload;
+    [PlayerEvents.PREFERENCES_UPDATED]: PlayerPreferencesUpdatedPayload;
+    [PlayerEvents.LIMIT_CHANGED]: PlayerLimitChangedPayload;
+    [PlayerEvents.COOL_OFF_STARTED]: PlayerCoolOffStartedPayload;
+    [PlayerEvents.SELF_EXCLUDED]: PlayerSelfExcludedPayload;
+    [PlayerEvents.REALITY_CHECK]: PlayerRealityCheckPayload;
+    [PlayerEvents.ONLINE]: PlayerOnlinePayload;
+    [PlayerEvents.OFFLINE]: PlayerOfflinePayload;
+    [KycEvents.CONFIG_UPDATED]: KycConfigUpdatedPayload;
+    [KycEvents.REQUEST_CREATED]: KycRequestCreatedPayload;
+    [KycEvents.DOCUMENT_UPLOADED]: KycDocumentUploadedPayload;
+    [KycEvents.DOCUMENT_APPROVED]: KycDocumentApprovedPayload;
+    [KycEvents.DOCUMENT_REJECTED]: KycDocumentRejectedPayload;
+    [KycEvents.REQUEST_SUBMITTED]: KycRequestSubmittedPayload;
+    [KycEvents.REQUEST_APPROVED]: KycRequestApprovedPayload;
+    [KycEvents.REQUEST_REJECTED]: KycRequestRejectedPayload;
+    [KycEvents.REQUEST_NEEDS_MORE]: KycRequestNeedsMorePayload;
+    [KycEvents.REQUEST_ESCALATED]: KycRequestEscalatedPayload;
+    [BonusEvents.GRANTED]: BonusGrantedPayload;
+    [BonusEvents.REVOKED]: BonusRevokedPayload;
+    [BonusEvents.OFFERED]: BonusOfferedPayload;
+    [BonusEvents.CLAIMED]: BonusClaimedPayload;
+    [BonusEvents.ACTIVATED]: BonusActivatedPayload;
+    [BonusEvents.WAGERING_PROGRESSED]: BonusWageringProgressedPayload;
+    [BonusEvents.WAGERING_COMPLETED]: BonusWageringCompletedPayload;
+    [BonusEvents.CONVERTED]: BonusConvertedPayload;
+    [BonusEvents.EXPIRED]: BonusExpiredPayload;
+    [BonusEvents.FORFEITED]: BonusForfeitedPayload;
+    [BonusEvents.VOIDED]: BonusVoidedPayload;
+    [BonusEvents.GRANT_QUEUED]: BonusGrantQueuedPayload;
+    [BonusEvents.GRANT_REJECTED]: BonusGrantRejectedPayload;
+    [BonusEvents.CONSTRAINT_BREACHED]: BonusConstraintBreachedPayload;
+    [BetEvents.PLACED]: BetPlacedPayload;
+    [BetEvents.SETTLED]: BetSettledPayload;
+    [AffiliateEvents.CLICK_RECORDED]: AffiliateClickRecordedPayload;
+    [AffiliateEvents.REGISTRATION_ATTRIBUTED]: AffiliateRegistrationAttributedPayload;
+    [AffiliateEvents.ASSIGNED]: AffiliateAssignedPayload;
+    [AffiliateEvents.COMMISSION_CREATED]: AffiliateCommissionCreatedPayload;
+    [AffiliateEvents.COMMISSION_SETTLED]: AffiliateCommissionSettledPayload;
+    [ClassificationEvents.PLAYER_TAG_ASSIGNED]: PlayerTagAssignedPayload;
+    [ClassificationEvents.PLAYER_TAG_REMOVED]: PlayerTagRemovedPayload;
+    [ClassificationEvents.SEGMENT_MEMBERSHIP_CHANGED]: SegmentMembershipChangedPayload;
+    [ClassificationEvents.AUDIENCE_EXPORTED]: AudienceExportedPayload;
+    [ClassificationEvents.CONVERSION_FEEDBACK_SENT]: ConversionFeedbackSentPayload;
+    [CatalogEvents.SOURCE_REGISTERED]: CatalogSourceRegisteredPayload;
+    [CatalogEvents.SOURCE_IMPORTED]: CatalogSourceImportedPayload;
+    [CatalogEvents.PROVIDER_UPSERTED]: CatalogProviderUpsertedPayload;
+    [CatalogEvents.CATEGORY_UPSERTED]: CatalogCategoryUpsertedPayload;
+    [CatalogEvents.GAME_CREATED]: CatalogGameCreatedPayload;
+    [CatalogEvents.GAME_UPDATED]: CatalogGameUpdatedPayload;
+    [CatalogEvents.GAME_RETIRED]: CatalogGameRetiredPayload;
+    [CatalogEvents.TENANT_PROVIDER_TOGGLED]: CatalogTenantProviderToggledPayload;
+    [CatalogEvents.TENANT_GAME_OVERLAID]: CatalogTenantGameOverlaidPayload;
+    [CatalogEvents.GAMES_BULK_UPDATED]: CatalogGamesBulkUpdatedPayload;
+    [CatalogEvents.CACHE_INVALIDATED]: CatalogCacheInvalidatedPayload;
+    [CashierEvents.DEPOSIT_INITIATED]: CashierDepositInitiatedPayload;
+    [CashierEvents.DEPOSIT_COMPLETED]: CashierDepositCompletedPayload;
+    [CashierEvents.DEPOSIT_FAILED]: CashierDepositFailedPayload;
+    [CashierEvents.WITHDRAWAL_REQUESTED]: CashierWithdrawalRequestedPayload;
+    [CashierEvents.WITHDRAWAL_APPROVED]: CashierWithdrawalApprovedPayload;
+    [CashierEvents.WITHDRAWAL_REJECTED]: CashierWithdrawalRejectedPayload;
+    [CashierEvents.WITHDRAWAL_PAID]: CashierWithdrawalPaidPayload;
+    [CashierEvents.WITHDRAWAL_FAILED]: CashierWithdrawalFailedPayload;
+    [CashierEvents.WITHDRAWAL_CANCELLED]: CashierWithdrawalCancelledPayload;
+    [CashierEvents.PAYMENT_FEE_RECORDED]: CashierPaymentFeeRecordedPayload;
+    [CashierEvents.CHARGEBACK_RECORDED]: CashierChargebackRecordedPayload;
+    [CashierEvents.PAYMENT_INSTRUMENT_ADDED]: CashierPaymentInstrumentAddedPayload;
+    [PluginEvents.INSTALLED]: PluginInstalledPayload;
+    [PluginEvents.ENABLED]: PluginEnabledPayload;
+    [PluginEvents.DISABLED]: PluginDisabledPayload;
+    [PluginEvents.UNINSTALLED]: PluginUninstalledPayload;
+    [PluginEvents.CONFIGURED]: PluginConfiguredPayload;
+    [PluginEvents.PUBLISHED]: PluginPublishedPayload;
+    [PluginEvents.VERSION_YANKED]: PluginVersionYankedPayload;
+    [PluginEvents.UPGRADED]: PluginUpgradedPayload;
+    [PluginEvents.TASK_STARTED]: PluginTaskStartedPayload;
+    [PluginEvents.TASK_COMPLETED]: PluginTaskCompletedPayload;
+    [PluginEvents.TASK_FAILED]: PluginTaskFailedPayload;
+    [PluginEvents.JOB_FAILED]: PluginJobFailedPayload;
+    [PluginEvents.DATA_PURGED]: PluginDataPurgedPayload;
+    [ProviderEvents.ENABLED]: ProviderEnabledPayload;
+    [ProviderEvents.DISABLED]: ProviderDisabledPayload;
+    [TournamentEvents.STARTED]: TournamentStartedPayload;
+    [TournamentEvents.ENDED]: TournamentEndedPayload;
+    [TournamentEvents.PRIZE_AWARDED]: TournamentPrizeAwardedPayload;
+    [GamificationEvents.ACHIEVEMENT_UNLOCKED]: AchievementUnlockedPayload;
+    [GamificationEvents.MISSION_COMPLETED]: MissionCompletedPayload;
+    [GamificationEvents.LEVEL_UP]: LevelUpPayload;
+    [LoyaltyEvents.POINTS_EARNED]: LoyaltyPointsEarnedPayload;
+    [LoyaltyEvents.POINTS_REDEEMED]: LoyaltyPointsRedeemedPayload;
+    [BackofficeEvents.VIEW_SAVED]: BackofficeViewSavedPayload;
+    [BackofficeEvents.DASHBOARD_SAVED]: BackofficeDashboardSavedPayload;
+    [BackofficeEvents.EXPORT_COMPLETED]: BackofficeExportCompletedPayload;
+    [BackofficeEvents.PII_REVEALED]: BackofficePiiRevealedPayload;
+    [BackofficeEvents.TRANSLATIONS_UPDATED]: BackofficeTranslationsUpdatedPayload;
+    [BackofficeEvents.OWNER_ASSIGNED]: BackofficeOwnerAssignedPayload;
+    [BackofficeEvents.ACTIVITY_CREATED]: BackofficeActivityCreatedPayload;
+    [BackofficeEvents.ACTIVITY_COMPLETED]: BackofficeActivityCompletedPayload;
+    [SystemEvents.FX_RATES_UPDATED]: SystemFxRatesUpdatedPayload;
+    [SystemEvents.TENANT_SETTINGS_UPDATED]: SystemTenantSettingsUpdatedPayload;
+}
+
+/**
+ * Cross-cutting domain types shared by every module.
+ */
+/** Tenant context attached to every request. */
+interface TenantContext$1 {
+    tenantId: string;
+    brandId: string;
+    region: string;
+}
+/** Which realm a request's caller belongs to. */
+type PrincipalType = "player" | "staff" | "system" | "provider" | "plugin" | "anonymous";
+/**
+ * The authenticated caller of a request, resolved fail-closed by the
+ * auth-context plugin and attached to `request.user`. A player token can never
+ * yield a `staff` principal and vice-versa (separate realms, separate cookies).
+ *
+ * `permissions` is the resolved staff permission set (empty for non-staff);
+ * `roles` is informational. `anonymous` means no/invalid credentials — it can
+ * only satisfy `public` routes.
+ */
+interface Principal {
+    type: PrincipalType;
+    id: string | null;
+    tenantId: string | null;
+    roles: string[];
+    permissions: string[];
+    sessionId?: string | null;
+    /** Raw token the principal authenticated with, if any. */
+    token?: string | null;
+}
+
+/**
+ * Fixed-window rate limiter seam. Backed by Redis in the apps so every API
+ * instance shares the window; the in-memory variant is for tests/dev. Used by
+ * token-issuing auth endpoints (password reset, OTPs) and upload endpoints.
+ * Rate-limit state is ephemeral by definition — Redis-appropriate.
+ */
+interface RateLimiter {
+    /** True when the caller identified by `key` is within `max` per `windowSeconds`. */
+    allow(key: string, windowSeconds: number, max: number): Promise<boolean>;
+}
+
+/**
+ * Messaging delivery seam (PLAYER_ACCOUNT_BUILD_PROMPT.md §2.4): email + SMS
+ * for verification tokens, OTPs, password resets and KYC notifications.
+ *
+ * Core modules depend only on this contract. The default binding is the
+ * FakeMessagingAdapter below (dev/test — captures sends so the verify suites
+ * can assert on delivered tokens); real providers ship as messaging-kind
+ * plugins whose adapters the plugin host bridges into this seam.
+ *
+ * Templates are KEYS (tenant-configurable content lives in tenant settings);
+ * variables are template-validated at the send boundary. Raw secrets (tokens,
+ * OTPs) ride in `variables` — adapters must never log them.
+ */
+interface MessagingSendInput {
+    channel: "email" | "sms";
+    to: string;
+    /** Template key, e.g. `auth.password_reset`, `auth.phone_otp`. */
+    template: string;
+    variables: Record<string, string>;
+}
+interface MessagingSendResult {
+    /** Provider-side message id, when the provider returns one. */
+    externalRef?: string;
+}
+interface MessagingAdapter$1 {
+    /** e.g. `messaging:fake`, `messaging:twilio-like`. */
+    readonly providerKey: string;
+    send(tenant: TenantContext$1, message: MessagingSendInput): Promise<MessagingSendResult>;
+}
+
+/**
+ * Player presence seam (docs/PROPOSED_DECISIONS.md §10).
+ *
+ * The implementation lives in `@cwe/players` (`createPresenceService`) —
+ * Redis-backed, TTL-driven, transition events through the outbox. This
+ * interface exists so `@cwe/auth` (login/logout/revocation paths) and the
+ * API auth-context hook can call presence without a cross-domain import;
+ * the composition roots in `apps/*` wire the concrete service in.
+ *
+ * Both methods are best-effort from the caller's point of view: presence is
+ * ephemeral state and must never fail or slow an auth flow. Callers swallow
+ * errors (`.catch(() => undefined)`); the implementation degrades gracefully
+ * when Redis blips.
+ */
+interface PlayerPresence {
+    /**
+     * Record authenticated player activity "now": refreshes the Redis presence
+     * entry, throttles a durable `players.lastActivityAt` write, and emits
+     * `player.online` through the outbox on an offline→online transition.
+     */
+    refresh(tenant: TenantContext$1, playerId: string): Promise<void>;
+    /**
+     * Immediately mark the player offline (logout / full session revocation):
+     * clears the Redis presence entry and emits `player.offline` through the
+     * outbox if the player was online. No-op when already offline.
+     */
+    clear(tenant: TenantContext$1, playerId: string, reason?: "logged_out" | "sessions_revoked"): Promise<void>;
+}
+
+declare module "fastify" {
+    interface FastifyRequest {
+        tenant: TenantContext$1;
+        user: Principal;
+    }
+    interface FastifyInstance {
+        /**
+         * Shared fixed-window rate limiter (Redis-backed in the apps). Optional:
+         * modules fall back to an in-memory limiter when the app doesn't wire one.
+         */
+        rateLimiter?: RateLimiter;
+        /**
+         * Messaging delivery seam (email/SMS). Optional: modules fall back to the
+         * FakeMessagingAdapter (dev/test) when the app doesn't wire one.
+         */
+        messaging?: MessagingAdapter$1;
+        /**
+         * Player presence seam (docs/PROPOSED_DECISIONS.md §10), wired by the API
+         * composition root from `@cwe/players`. Optional: without it, presence
+         * refresh/clear are silently skipped (players simply never read online).
+         */
+        presence?: PlayerPresence;
+        /**
+         * Flows framework seam (PLAYER_ACCOUNT_BUILD_PROMPT.md §2), wired by the
+         * composition root from the plugin host. Optional: without it, flows run
+         * core-only (no plugin interception, no delegation).
+         */
+        flows?: {
+            /** Run every intercept hook for `stage`; throws FlowRejectedError on reject. */
+            runIntercept<I, O>(tenant: TenantContext$1, stage: string, input: I): Promise<O[]>;
+            /** Owning plugin key when `flows.<flow>.mode = plugin:<key>`, else null. */
+            isDelegated(tenant: TenantContext$1, flow: string): Promise<string | null>;
+        };
+    }
+}
+
+/**
+ * The canonical envelope every domain event is wrapped in. This is exactly what
+ * gets stored in `event_outbox.payload` and published to NATS, so it IS the
+ * external contract.
+ *
+ * @typeParam N - the event name (keys the payload type).
+ */
+interface DomainEvent<N extends DomainEventName = DomainEventName> {
+    /** Unique id for this occurrence — used for idempotent consumers. */
+    eventId: string;
+    /** Event name, e.g. `wallet.credited`. */
+    name: N;
+    /** Payload schema version. */
+    version: number;
+    /** ISO-8601 timestamp of when the event occurred. */
+    occurredAt: string;
+    /** Tenant the event belongs to. */
+    tenant: TenantContext$1;
+    /** Strongly-typed, name-specific payload. */
+    payload: DomainEventPayloads[N];
+}
+
+/**
+ * Scoped data reads (`ctx.data`) — the contract half of the host's
+ * ReadModelRegistry. Plugins never query tables: they call named, versioned
+ * read models, and may only call a model whose required scope is declared in
+ * `manifest.permissions.dataScopes`. Results are DTOs, never entities —
+ * `passwordHash`/`refreshTokenHash`/secrets are structurally absent from
+ * these shapes.
+ */
+/** Read-model scopes. Granted per manifest; enforced fail-closed per call. */
+type DataScope = "players:read" | "players:pii" | "wallet:read" | "ledger:read" | "bets:read" | "bonus:read" | "affiliate:read" | "tenant:read" | "kyc:read" | "documents:read" | "limits:read" | "catalog:read";
+declare const DataScopes: readonly DataScope[];
+/** Cursor-paginated page shape shared by list read models. Max page 200. */
+interface ReadModelPage<T> {
+    items: T[];
+    nextCursor?: string;
+}
+/**
+ * Player DTO. PII fields (`email`, `username`, `phone`) are populated only
+ * when the plugin holds `players:pii`; with bare `players:read` they are
+ * absent from the result.
+ */
+interface PlayerSummaryDTO {
+    id: string;
+    brandId: string;
+    status: string;
+    createdAt: string;
+    email?: string | null;
+    username?: string | null;
+    phone?: string | null;
+}
+/** Wallet projection snapshot — buckets, never a mutation surface. */
+interface WalletBalanceDTO {
+    walletId: string;
+    playerId: string;
+    currency: string;
+    cash: string;
+    bonus: string;
+    locked: string;
+    status: string;
+}
+/** One immutable `wallet_ledger` leg. */
+interface LedgerEntryDTO {
+    id: string;
+    playerId: string;
+    walletId: string;
+    transactionId: string;
+    walletType: string;
+    direction: "credit" | "debit";
+    amount: string;
+    currency: string;
+    balanceBefore: string;
+    balanceAfter: string;
+    createdAt: string;
+}
+/** A bet-flow wallet transaction (type bet | settle | rollback). */
+interface BetRecordDTO {
+    transactionId: string;
+    playerId: string;
+    walletId: string;
+    type: string;
+    amount: string;
+    currency: string;
+    source: string;
+    externalTransactionId: string | null;
+    gameId: string | null;
+    status: string;
+    createdAt: string;
+}
+interface TenantInfoDTO {
+    tenantId: string;
+    brandId: string;
+    region: string;
+    /** Currencies with at least one wallet in this tenant. */
+    currencies: string[];
+}
+/** player_kyc_state projection — level/status only, never document content. */
+interface KycStateDTO {
+    playerId: string;
+    level: number;
+    status: string;
+    approvedAt: string | null;
+}
+interface KycRequestDTO {
+    id: string;
+    playerId: string;
+    trigger: string;
+    status: string;
+    targetLevel: number | null;
+    requiredDocumentTypes: string[];
+    createdAt: string;
+}
+/** Document METADATA — storageRef/bytes/signed URLs are structurally absent. */
+interface KycDocumentDTO {
+    id: string;
+    playerId: string;
+    kycRequestId: string | null;
+    documentTypeKey: string;
+    status: string;
+    mimeType: string;
+    sizeBytes: number;
+    uploadedAt: string;
+}
+/** A player-history bet row (the `bets` projection, not wallet transactions). */
+interface PlayerBetDTO {
+    betId: string;
+    playerId: string;
+    roundId: string;
+    providerKey: string;
+    gameId: string | null;
+    betAmount: string;
+    winAmount: string | null;
+    currency: string;
+    status: string;
+    placedAt: string;
+}
+interface GameSessionDTO {
+    id: string;
+    playerId: string;
+    providerKey: string;
+    gameId: string | null;
+    status: string;
+    betCount: number;
+    startedAt: string;
+    lastActivityAt: string | null;
+}
+/** A responsible-gaming limit (read-only — no RG command is plugin-reachable). */
+interface PlayerLimitDTO {
+    playerId: string;
+    kind: string;
+    period: string;
+    value: string;
+    currency: string | null;
+    pendingValue: string | null;
+    pendingActiveAt: string | null;
+}
+/** A visible game, resolved for the tenant (overlay name/featured applied). */
+interface CatalogGameDTO {
+    id: string;
+    slug: string | null;
+    /** Locale-picked title (overlay override wins). */
+    title: string | null;
+    /** Full i18n name map. */
+    name: unknown;
+    providerId: string;
+    launchCode: string | null;
+    imageUrl: string | null;
+    rtp: string | null;
+    minBet: string | null;
+    maxBet: string | null;
+    featured: boolean;
+    features: Record<string, unknown>;
+}
+/** A resolved category tree node (tenant visibility/sort/label applied). */
+interface CatalogCategoryNodeDTO {
+    id: string;
+    slug: string;
+    title: string | null;
+    kind: string;
+    sort: number;
+    children: CatalogCategoryNodeDTO[];
+}
+/** A provider visible to the tenant (enabled ∪ tenant-owned). */
+interface CatalogProviderDTO {
+    id: string;
+    externalId: string;
+    name: string;
+    alias: string | null;
+    logoUrl: string | null;
+    logoPath: string | null;
+    weight: number;
+    parentProviderId: string | null;
+}
+/**
+ * Optional eligibility context accepted by the catalog read models — passed
+ * through to the platform resolver so plugin routes automatically respect
+ * restriction-group geo blocking and currency-group filtering. Restriction
+ * groups only ever NARROW availability: a plugin's own groups apply on top
+ * of tenant/platform compliance, never instead of it.
+ */
+interface CatalogEligibilityParams {
+    /** Raw country (alpha-2/alpha-3); normalized by the resolver. */
+    country?: string;
+    /** ISO-4217 currency — when set, currency filtering is strict. */
+    currency?: string;
+    locale?: string;
+}
+/**
+ * The read-model catalog: name → { params, result }. The host implements each
+ * entry with Zod-validated params, tenant-filtered repositories and explicit
+ * indexes; this map is what makes `ctx.data.query` type-safe for plugin code.
+ */
+interface ReadModelDefinitions {
+    "players.list": {
+        params: {
+            status?: string;
+            cursor?: string;
+            limit?: number;
+        };
+        result: ReadModelPage<PlayerSummaryDTO>;
+    };
+    "players.byId": {
+        params: {
+            playerId: string;
+        };
+        result: {
+            player: PlayerSummaryDTO | null;
+        };
+    };
+    "wallet.balances": {
+        params: {
+            playerId: string;
+        };
+        result: {
+            wallets: WalletBalanceDTO[];
+        };
+    };
+    "ledger.entries": {
+        params: {
+            playerId?: string;
+            walletId?: string;
+            cursor?: string;
+            limit?: number;
+        };
+        result: ReadModelPage<LedgerEntryDTO>;
+    };
+    "bets.list": {
+        params: {
+            playerId?: string;
+            gameId?: string;
+            source?: string;
+            cursor?: string;
+            limit?: number;
+        };
+        result: ReadModelPage<BetRecordDTO>;
+    };
+    "bets.byRound": {
+        params: {
+            source: string;
+            externalTransactionId: string;
+        };
+        result: {
+            bets: BetRecordDTO[];
+        };
+    };
+    "tenant.info": {
+        params: Record<string, never>;
+        result: TenantInfoDTO;
+    };
+    "kyc.state": {
+        params: {
+            playerId: string;
+        };
+        result: {
+            state: KycStateDTO | null;
+        };
+    };
+    "kyc.requests": {
+        params: {
+            playerId?: string;
+            status?: string;
+            cursor?: string;
+            limit?: number;
+        };
+        result: ReadModelPage<KycRequestDTO>;
+    };
+    "kyc.documents": {
+        params: {
+            playerId?: string;
+            kycRequestId?: string;
+            cursor?: string;
+            limit?: number;
+        };
+        result: ReadModelPage<KycDocumentDTO>;
+    };
+    "bets.byPlayer": {
+        params: {
+            playerId: string;
+            status?: string;
+            cursor?: string;
+            limit?: number;
+        };
+        result: ReadModelPage<PlayerBetDTO>;
+    };
+    "gameSessions.list": {
+        params: {
+            playerId?: string;
+            cursor?: string;
+            limit?: number;
+        };
+        result: ReadModelPage<GameSessionDTO>;
+    };
+    "limits.byPlayer": {
+        params: {
+            playerId: string;
+        };
+        result: {
+            limits: PlayerLimitDTO[];
+        };
+    };
+    "catalog.games": {
+        params: CatalogEligibilityParams & {
+            search?: string;
+            categorySlug?: string;
+            providerId?: string;
+            cursor?: string;
+            limit?: number;
+        };
+        result: ReadModelPage<CatalogGameDTO>;
+    };
+    "catalog.categories": {
+        params: CatalogEligibilityParams & {
+            cursor?: string;
+            limit?: number;
+        };
+        result: {
+            categories: CatalogCategoryNodeDTO[];
+            nextCursor?: string;
+        };
+    };
+    "catalog.providers": {
+        params: {
+            cursor?: string;
+            limit?: number;
+        };
+        result: ReadModelPage<CatalogProviderDTO>;
+    };
+}
+type ReadModelName = keyof ReadModelDefinitions;
+type ReadModelParams<Q extends ReadModelName> = ReadModelDefinitions[Q]["params"];
+type ReadModelResult<Q extends ReadModelName> = ReadModelDefinitions[Q]["result"];
+/**
+ * Which scope each read model requires. Single source of truth for the host
+ * enforcer AND the dev-harness doctor (declared-vs-used permission checks).
+ * `players.*` additionally populates PII fields only under `players:pii`.
+ */
+declare const ReadModelRequiredScopes: Record<ReadModelName, DataScope>;
+/** Hard cap on any read-model page size (host clamps, never errors). */
+declare const READ_MODEL_MAX_PAGE = 200;
+
+/**
+ * Explicit allowlists — the whole permission model. The host's capability
+ * layer enforces these at runtime: a command not in `commands` throws
+ * `ForbiddenError` and writes a `plugin.permission_denied` audit row; an event
+ * not in `events.subscribe` is never delivered; an emitted event must match
+ * `events.emit` (namespaced `plugin.<key>.*`); a read model whose scope is
+ * not in `dataScopes` is refused; a foreign dataset not in `datasets.read`
+ * is invisible.
+ */
+interface PluginPermissions {
+    /** Command names the plugin may execute through `ctx.commands.execute`. */
+    commands: string[];
+    events: {
+        /** Typed domain events the plugin may subscribe to. */
+        subscribe: DomainEventName[];
+        /** Event names the plugin may emit — must be namespaced `plugin.<key>.*`. */
+        emit: string[];
+    };
+    /**
+     * Read-model scopes for `ctx.data` (v2 vocabulary, see `data.ts`). Legacy
+     * v1 `PluginScope` values are still accepted for backward compatibility but
+     * grant no read models.
+     */
+    dataScopes?: Array<DataScope | PluginScope>;
+    /** Foreign dataset reads: `"ownerPluginKey.datasetName"` entries. */
+    datasets?: {
+        read?: string[];
+    };
+    /**
+     * Flow stages the plugin may hook (`"signup.validate"`, …). A `flows` entry
+     * whose stage is not granted here fails publish; runtime enforcement fails
+     * closed with a `plugin.permission_denied` audit like every capability.
+     */
+    flows?: string[];
+    /** Provider plugins: which provider keys this plugin may own. */
+    providerKeys?: string[];
+    /**
+     * Short event types (`<key>.<type>`, i.e. the emitted name minus its
+     * `plugin.` prefix) allowed to fan out to player sockets on the
+     * `ext.<key>` realtime channel. Must be a subset of `events.emit`
+     * (doctor-enforced); anything not listed is dropped by the gateway.
+     */
+    frontendEvents?: string[];
+    /**
+     * @deprecated v1 field — use `manifest.network.allowedHosts`. The host
+     * honours the union of both while plugins migrate.
+     */
+    networkAllow?: string[];
+}
+/** Coarse capability scopes (vocabulary for `dataScopes`). */
+declare const PluginScopes: {
+    readonly WalletRead: "wallet:read";
+    readonly WalletWrite: "wallet:write";
+    readonly PlayerRead: "player:read";
+    readonly PlayerWrite: "player:write";
+    readonly CatalogRead: "catalog:read";
+    readonly BonusWrite: "bonus:write";
+    readonly EventsSubscribe: "events:subscribe";
+    readonly EventsPublish: "events:publish";
+    readonly CommandsExecute: "commands:execute";
+};
+type PluginScope = (typeof PluginScopes)[keyof typeof PluginScopes];
+/** Prefix every plugin-emitted event name must carry: `plugin.<key>.` */
+declare function pluginEventPrefix(pluginKey: string): string;
+
+/**
+ * Typed per-tenant settings. Each field pairs UI metadata (label, type,
+ * secret flag) with the Zod validator actually enforced at the boundary.
+ * Secret fields are stored encrypted in `plugin_secrets` and are write-only
+ * over the API; non-secret values live in `plugin_settings.values`.
+ */
+type PluginSettingsFieldType = "string" | "number" | "boolean" | "enum" | "json";
+interface PluginSettingsField {
+    type: PluginSettingsFieldType;
+    label: string;
+    description?: string;
+    required: boolean;
+    /** Secret fields go to `plugin_secrets`, never returned, never logged. */
+    secret?: boolean;
+    default?: unknown;
+    enumValues?: string[];
+    /** The actual validator used at the boundary. */
+    zod: z.ZodTypeAny;
+}
+interface PluginSettingsSchema {
+    fields: Record<string, PluginSettingsField>;
+    /** Optional migration when a new version changes the schema shape. */
+    migrate?: (previous: Record<string, unknown>) => Record<string, unknown>;
+}
+type FieldOptions = {
+    label: string;
+    description?: string;
+    required?: boolean;
+    secret?: boolean;
+    default?: unknown;
+    /** Override the derived validator (e.g. `z.string().url()`). */
+    zod?: z.ZodTypeAny;
+};
+/** Zod-backed field helpers — the ergonomic way to author a settings schema. */
+declare const settingsField: {
+    string: (opts: FieldOptions) => PluginSettingsField;
+    number: (opts: FieldOptions) => PluginSettingsField;
+    boolean: (opts: FieldOptions) => PluginSettingsField;
+    enum: (opts: FieldOptions & {
+        enumValues: [string, ...string[]];
+    }) => PluginSettingsField;
+    json: (opts: FieldOptions) => PluginSettingsField;
+};
+/** Wire-safe render descriptor for one field — everything except the validator. */
+interface PluginSettingsFieldDescriptor {
+    type: PluginSettingsFieldType;
+    label: string;
+    description?: string;
+    required: boolean;
+    secret: boolean;
+    /** Omitted for secret fields — defaults could leak intended values. */
+    default?: unknown;
+    enumValues?: string[];
+}
+type PluginSettingsSchemaDescriptor = Record<string, PluginSettingsFieldDescriptor>;
+/**
+ * Serialize a settings schema for the backoffice form renderer and for the
+ * `plugin_versions.settingsSchema` snapshot: strips `zod`, drops secret
+ * defaults. This is what `GET …/settings/schema` returns.
+ */
+declare function serializeSettingsSchema(schema: PluginSettingsSchema): PluginSettingsSchemaDescriptor;
+/**
+ * Compose the Zod object validating a settings payload. `secret: "only"`
+ * validates just the secret fields (for the write-only secrets payload),
+ * `"exclude"` just the non-secret values, `"include"` everything.
+ */
+declare function settingsZodObject(schema: PluginSettingsSchema, secret?: "include" | "exclude" | "only"): z.ZodObject<Record<string, z.ZodTypeAny>>;
+/** Default non-secret values derived from the schema (used to seed on install). */
+declare function defaultSettingsValues(schema: PluginSettingsSchema): Record<string, unknown>;
+
+/**
+ * Every provider call carries the tenant context so adapters can route to the
+ * correct upstream credentials / endpoints per tenant.
+ */
+interface ProviderContext {
+    tenant: TenantContext$1;
+}
+interface CreateSessionInput {
+    playerId: string;
+    gameId: string;
+    currency: string;
+}
+interface CreateSessionResult {
+    sessionId: string;
+    launchUrl: string;
+}
+interface BalanceResult {
+    currency: string;
+    balance: string;
+}
+interface PlaceBetInput {
+    sessionId: string;
+    roundId: string;
+    amount: string;
+    currency: string;
+}
+interface SettleBetInput {
+    sessionId: string;
+    roundId: string;
+    payout: string;
+    currency: string;
+}
+interface RollbackInput {
+    sessionId: string;
+    roundId: string;
+}
+interface CloseRoundInput {
+    sessionId: string;
+    roundId: string;
+}
+interface FreeSpinInput {
+    sessionId: string;
+    roundId: string;
+    /** Number of free spins awarded/consumed. */
+    spins: number;
+    campaign?: string;
+}
+interface BonusWinInput {
+    sessionId: string;
+    roundId: string;
+    amount: string;
+    currency: string;
+    campaign?: string;
+}
+interface BetResult {
+    roundId: string;
+    balance: string;
+    status: "ok" | "rejected";
+}
+interface RoundResult {
+    roundId: string;
+    status: "open" | "closed";
+}
+/**
+ * The contract every game/payment provider integration must implement.
+ * Business code depends only on this interface — never on a concrete provider.
+ *
+ * Extension points are grouped: session/balance, bet lifecycle
+ * (place→settle→rollback→close), and bonus mechanics (free spins, bonus wins).
+ * Keeping all of these in the contract now avoids a breaking redesign when real
+ * providers are integrated.
+ */
+interface ProviderAdapter {
+    readonly name: string;
+    createSession(ctx: ProviderContext, input: CreateSessionInput): Promise<CreateSessionResult>;
+    getBalance(ctx: ProviderContext, playerId: string, currency: string): Promise<BalanceResult>;
+    placeBet(ctx: ProviderContext, input: PlaceBetInput): Promise<BetResult>;
+    settleBet(ctx: ProviderContext, input: SettleBetInput): Promise<BetResult>;
+    rollback(ctx: ProviderContext, input: RollbackInput): Promise<BetResult>;
+    closeRound(ctx: ProviderContext, input: CloseRoundInput): Promise<RoundResult>;
+    freeSpin(ctx: ProviderContext, input: FreeSpinInput): Promise<BetResult>;
+    bonusWin(ctx: ProviderContext, input: BonusWinInput): Promise<BetResult>;
+}
+
+/**
+ * Provider-adapter contracts a plugin can contribute besides game providers
+ * (PLAYER_ACCOUNT_BUILD_PROMPT.md §2.4): payments, KYC auto-verification and
+ * messaging delivery. Registered in `setup(ctx)` via the matching
+ * `ctx.register*Adapter` capability (gated by `permissions.providerKeys`,
+ * exactly like game adapters); the host bridges them into the cashier /
+ * KYC / messaging seams on tenant enable.
+ *
+ * Money rule: adapters NEVER move money themselves. Webhooks arrive on the
+ * plugin's `callback` route surface; the handler verifies the signature and
+ * dispatches the allowlisted cashier commands (`cashier.deposit.confirm`,
+ * `cashier.withdrawal.confirm_payout`, `cashier.withdrawal.cancel`, …) via
+ * `ctx.commands`, idempotent on (providerKey, sourceTxId).
+ */
+interface PluginPaymentMethodDescriptor {
+    methodKey: string;
+    providerKey: string;
+    title: string;
+    kind: "card" | "bank" | "ewallet" | "crypto" | "voucher";
+    direction: "deposit" | "withdrawal" | "both";
+    /** 4-dp integer minor units as strings. */
+    limits: {
+        minMinor: string;
+        maxMinor: string;
+        currency: string;
+    };
+    requiresKycLevel?: number;
+    fields?: Array<{
+        key: string;
+        label: string;
+        type: "text" | "number" | "select";
+        required?: boolean;
+        options?: string[];
+    }>;
+    sort?: number;
+}
+interface PspDepositInput {
+    depositId: string;
+    playerId: string;
+    amount: string;
+    currency: string;
+    methodKey?: string;
+    returnUrl?: string;
+}
+interface PspDepositResult {
+    /** PSP-side intent/charge id — the (providerKey, sourceTxId) natural key. */
+    sourceTxId: string;
+    nextAction?: {
+        type: "redirect" | "qr" | "iframe" | "none";
+        url?: string;
+        data?: unknown;
+    };
+}
+interface PspWithdrawalInput {
+    withdrawalId: string;
+    playerId: string;
+    amount: string;
+    currency: string;
+    methodKey?: string;
+    instrumentToken?: string;
+}
+interface PspWithdrawalResult {
+    sourceTxId: string;
+}
+interface PaymentProviderAdapter {
+    /** e.g. `psp:coinpay`. Must be listed in `permissions.providerKeys`. */
+    readonly providerKey: string;
+    /** Feeds `cashier.listMethods` (§6.3). */
+    methods(ctx: PluginContext): Promise<PluginPaymentMethodDescriptor[]>;
+    createDeposit(ctx: PluginContext, input: PspDepositInput): Promise<PspDepositResult>;
+    createWithdrawal(ctx: PluginContext, input: PspWithdrawalInput): Promise<PspWithdrawalResult>;
+}
+/** Document reference passed to a KYC provider — METADATA only, never bytes. */
+interface KycDocumentRef {
+    documentId: string;
+    playerId: string;
+    documentTypeKey: string;
+    mimeType: string;
+    sizeBytes: number;
+}
+interface KycProviderAdapter {
+    /** e.g. `kyc:sumsub-like`. Must be listed in `permissions.providerKeys`. */
+    readonly providerKey: string;
+    /**
+     * Called by the host (observe hook `kyc.document.submitted`) when
+     * auto-verify is enabled. The provider webhook lands on the plugin's
+     * callback surface and dispatches `kyc.document.approve` /
+     * `kyc.document.reject` via `ctx.commands`.
+     */
+    submitDocument(ctx: PluginContext, doc: KycDocumentRef): Promise<{
+        externalRef: string;
+    }>;
+}
+interface PluginMessage {
+    channel: "email" | "sms";
+    to: string;
+    /** Template KEY — content is tenant configuration. */
+    template: string;
+    variables: Record<string, string>;
+}
+interface MessagingAdapter {
+    /** e.g. `messaging:twilio-like`. Must be listed in `permissions.providerKeys`. */
+    readonly providerKey: string;
+    send(ctx: PluginContext, message: PluginMessage): Promise<{
+        externalRef?: string;
+    }>;
+}
+
+/**
+ * Plugin datasets — plugin-owned custom data (the Metafields/Metaobjects
+ * analogue). Declared in the manifest, provisioned at install (snapshot only;
+ * rows materialize on first write), accessed exclusively through
+ * `ctx.datasets` — a host-owned capability that injects `tenantId`, validates
+ * every write against the declared Zod schema and enforces quotas. There is
+ * no dynamic DDL, ever: all records share one table with up to three
+ * extracted index columns.
+ */
+interface PluginDatasetDecl {
+    /** Record shape, validated on every write. */
+    schema: z.ZodObject<z.ZodRawShape>;
+    /** Business key inside the record (upsert identity). */
+    keyField: string;
+    /** Up to 3 top-level fields queryable via `.query({ where })`. */
+    indexes?: string[];
+    /** Readable by other plugins that declare `permissions.datasets.read`. */
+    shared?: boolean;
+    /** Per-tenant record cap. The host cap wins when smaller. */
+    maxRecords?: number;
+}
+interface PluginDatasetQuery {
+    /** Indexed fields only — a non-indexed field here is a ValidationError. */
+    where?: Partial<Record<string, string | number | boolean>>;
+    cursor?: string;
+    /** Max 200 (host clamps). */
+    limit?: number;
+}
+interface PluginDatasetCollection<T = Record<string, unknown>> {
+    get(key: string): Promise<T | null>;
+    /** Upsert by business key. */
+    put(key: string, value: T): Promise<void>;
+    /** Batched upsert, max 500 per call. All-or-nothing on quota breach. */
+    putMany(records: Array<{
+        key: string;
+        value: T;
+    }>): Promise<void>;
+    delete(key: string): Promise<void>;
+    query(q: PluginDatasetQuery): Promise<{
+        records: Array<{
+            key: string;
+            value: T;
+        }>;
+        nextCursor?: string;
+    }>;
+    count(): Promise<number>;
+    /** Audited; own datasets only. */
+    truncate(): Promise<void>;
+}
+/** Host-enforced dataset limits (Phase 1, shared-table storage model). */
+declare const PLUGIN_DATASET_LIMITS: {
+    readonly maxIndexes: 3;
+    readonly maxBatch: 500;
+    readonly maxQueryLimit: 200;
+    /** Serialized record cap in bytes. */
+    readonly maxRecordBytes: 65536;
+    /** Default per-tenant record quota when the declaration omits one. */
+    readonly defaultMaxRecords: 100000;
+};
+
+/**
+ * Outbound HTTP (`ctx.http`) — allowlisted, HTTPS-only, SSRF-guarded egress.
+ * The host enforces `manifest.network.allowedHosts` (exact host or one-level
+ * wildcard `*.example.com`), blocks private/link-local/metadata IP ranges
+ * after DNS resolution, and rejects redirects that leave the allowlist.
+ *
+ * Secrets never transit plugin code: `secretHeaders` names a tenant secret
+ * per header and the HOST resolves it at send time — logs and persisted
+ * exchanges show `<redacted:name>`.
+ */
+interface PluginFetchInit {
+    method?: "GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "HEAD";
+    headers?: Record<string, string>;
+    /** Objects are JSON-serialized with `content-type: application/json`. */
+    body?: string | Record<string, unknown> | Array<unknown>;
+    /** Default 10s. */
+    timeoutMs?: number;
+    /** header name → SECRET NAME, resolved host-side, never exposed. */
+    secretHeaders?: Record<string, string>;
+    /**
+     * Persist the redacted request/response to `plugin_http_exchanges` (same
+     * mechanism as provider raw I/O persistence) for support/debugging.
+     */
+    persistExchange?: boolean;
+}
+/** Materialized response — body already read, capped at 30 MB by the host. */
+interface PluginFetchResponse {
+    status: number;
+    ok: boolean;
+    headers: Readonly<Record<string, string>>;
+    bodyText: string;
+    /** JSON.parse of bodyText, typed for convenience. Throws on non-JSON. */
+    json<T = unknown>(): T;
+}
+declare const PLUGIN_HTTP_LIMITS: {
+    readonly defaultTimeoutMs: 10000;
+    readonly maxResponseBytes: 31457280;
+    /** Retries on idempotent methods (GET/HEAD) only. */
+    readonly maxRetries: 2;
+    readonly maxRedirects: 3;
+};
+
+/**
+ * CatalogSourceAdapter — the seam that makes the catalog multi-source from day
+ * one. Each aggregator integration (SoftGamings first; operator-owned sources
+ * later) implements this interface to turn its native export into ONE normalized,
+ * source-agnostic shape the importer understands. The importer never knows which
+ * aggregator it's importing — only this contract.
+ *
+ * Normalization rules the adapter MUST apply (so the importer can stay dumb):
+ *  - Never reuse the aggregator's ids as our PKs — they become `externalId`.
+ *  - Country codes → lowercase ISO-3166 alpha-3 (normalizeCountry).
+ *  - Currency codes → uppercase ISO-4217 (normalizeCurrency).
+ *  - Emit a provider entry for EVERY referenced provider externalId (including
+ *    parents and game MerchantIDs missing from the source's merchant list) so the
+ *    NOT-NULL games.providerId FK always resolves. Missing ones are `stub: true`.
+ */
+/** A provider (merchant / sub-provider) in normalized form. */
+interface NormalizedProvider {
+    externalId: string;
+    name: string;
+    alias?: string | null;
+    /** Source parent merchant id (resolved to parentProviderId by the importer). */
+    parentExternalId?: string | null;
+    logoPath?: string | null;
+    logoUrl?: string | null;
+    weight?: number;
+    /** True when this provider was only referenced (not in the source list). */
+    stub?: boolean;
+}
+/** A category in normalized form (flat source nodes; the curated tree is built by the importer). */
+interface NormalizedCategory {
+    externalId: string;
+    slug: string;
+    /** i18n locale map. */
+    name?: Record<string, string> | null;
+    tags?: string[] | null;
+    sort?: number;
+    subSort?: number;
+}
+interface NormalizedRestrictionGroup {
+    externalId: string;
+    name?: string | null;
+    providerExternalId?: string | null;
+    /** Lowercase ISO-3 alpha codes BLOCKED by this group. */
+    blockedCountries: string[];
+    isDefault?: boolean;
+    parentExternalId?: string | null;
+    subdivisions?: string[] | null;
+}
+interface NormalizedCurrencyGroup {
+    externalId: string;
+    name?: string | null;
+    providerExternalId?: string | null;
+    /** Uppercase ISO-4217 codes supported by this group. */
+    supportedCurrencies: string[];
+    defaultCurrency?: string | null;
+    isDefault?: boolean;
+}
+/** Per-platform launch codes (PageCode variants). */
+interface NormalizedLaunchCodes {
+    desktop?: string | null;
+    mobile?: string | null;
+    android?: string | null;
+    windows?: string | null;
+}
+/** A game in normalized form. The importer mints our internal UUID + slug. */
+interface NormalizedGame {
+    externalGameId: string;
+    /** Primary launch code (desktop PageCode). */
+    launchCode?: string | null;
+    launchCodes?: NormalizedLaunchCodes | null;
+    providerExternalId: string;
+    subProviderExternalId?: string | null;
+    name?: Record<string, string> | null;
+    description?: Record<string, string> | null;
+    launchUrl?: string | null;
+    mobileLaunchUrl?: string | null;
+    imagePath?: string | null;
+    imageUrl?: string | null;
+    /** Source category externalIds this game belongs to (unknown ones are skipped). */
+    categoryExternalIds: string[];
+    /** Per-(source)category sort, keyed by category externalId. */
+    sortPerCategory?: Record<string, number> | null;
+    restrictionGroupExternalId?: string | null;
+    currencyGroupExternalId?: string | null;
+    rtp?: string | null;
+    minBet?: string | null;
+    maxBet?: string | null;
+    maxMultiplier?: string | null;
+    aspectRatio?: string | null;
+    hasDemo: boolean;
+    isVirtual: boolean;
+    bonusBuy: boolean;
+    megaways: boolean;
+    /** Full feature flag set (typed columns above are promoted from here). */
+    features: Record<string, boolean>;
+    /** Raw/rare source fields. */
+    metadata?: Record<string, unknown> | null;
+}
+interface NormalizedCatalog {
+    providers: NormalizedProvider[];
+    categories: NormalizedCategory[];
+    restrictionGroups: NormalizedRestrictionGroup[];
+    currencyGroups: NormalizedCurrencyGroup[];
+    games: NormalizedGame[];
+}
+/** One game↔category link, both sides referenced by their source externalIds. */
+interface NormalizedGameCategoryLink {
+    gameExternalId: string;
+    categoryExternalId: string;
+}
+/**
+ * A PARTIAL catalog delta — the incremental counterpart of `NormalizedCatalog`
+ * (every family optional; NO retire semantics — retire is snapshot-import-only).
+ * Consumed by `upsertNormalizedDelta` and submitted by the plugin SDK's
+ * `ctx.catalog.upsertBatch`. Reference-resolution rules match the importer:
+ * `*ExternalId` references resolve within the SAME source only; an unknown
+ * provider reference auto-creates a stub provider row; an unknown
+ * restriction/currency-group/category reference is a validation error
+ * (compliance data is never silently invented).
+ */
+interface NormalizedCatalogDelta {
+    providers?: NormalizedProvider[];
+    categories?: NormalizedCategory[];
+    restrictionGroups?: NormalizedRestrictionGroup[];
+    currencyGroups?: NormalizedCurrencyGroup[];
+    games?: NormalizedGame[];
+    gameCategories?: NormalizedGameCategoryLink[];
+}
+
+/** Reserved task type the HOST executes: full ingest via the registered
+ *  adapter → validate → snapshot import (insert/update/retire). Plugins may
+ *  use it as `install.seedTask` and via `ctx.catalog.requestImport()`; they
+ *  never implement a handler for it. */
+declare const CATALOG_IMPORT_TASK_TYPE = "catalog:import";
+/** Plugin kinds allowed to declare `manifest.catalog` (doctor-enforced). */
+declare const CATALOG_ALLOWED_KINDS: readonly ["provider", "content", "integration"];
+declare const PLUGIN_CATALOG_LIMITS: {
+    /** Max rows per family per `upsertBatch` call. */
+    readonly maxRowsPerFamily: 500;
+};
+/** Per-family counts returned by the incremental upsert path. */
+interface ImportSummaryLite {
+    providers: {
+        inserted: number;
+        updated: number;
+    };
+    categories: {
+        inserted: number;
+        updated: number;
+    };
+    restrictionGroups: {
+        inserted: number;
+        updated: number;
+    };
+    currencyGroups: {
+        inserted: number;
+        updated: number;
+    };
+    games: {
+        inserted: number;
+        updated: number;
+        unchanged: number;
+    };
+    /** Games whose category memberships changed via `gameCategories` links. */
+    gameCategoryLinks: number;
+}
+/** Full snapshot-import summary (host `catalog:import` task result shape). */
+interface CatalogImportSummary {
+    providers: {
+        inserted: number;
+        updated: number;
+    };
+    categories: {
+        inserted: number;
+        updated: number;
+    };
+    restrictionGroups: {
+        inserted: number;
+        updated: number;
+    };
+    currencyGroups: {
+        inserted: number;
+        updated: number;
+    };
+    games: {
+        inserted: number;
+        updated: number;
+        retired: number;
+        unchanged: number;
+    };
+    skippedUnknownCategoryLinks: number;
+    durationMs: number;
+}
+/** One of the plugin's OWN games (management view — includes retired rows). */
+interface OwnGameSummary {
+    /** Internal catalog GameId — what wallet/analytics reference. */
+    gameId: string;
+    externalGameId: string;
+    slug: string | null;
+    name: Record<string, string> | null;
+    launchCode: string | null;
+    providerId: string;
+    status: "active" | "retired";
+}
+/**
+ * `ctx.catalog` — present only when the manifest declares a `catalog` block
+ * AND the plugin kind is in `CATALOG_ALLOWED_KINDS`. All `*ExternalId`
+ * references resolve within the plugin's own source only. A game referencing
+ * an unknown provider auto-creates a stub provider row (the importer's own
+ * rule — `games.providerId` is NOT NULL and must always resolve); an unknown
+ * restriction/currency-group/category reference is a ValidationError naming
+ * the missing externalId — compliance data is never silently invented.
+ * Restriction groups only ever NARROW availability: they apply on top of —
+ * never instead of — tenant/platform compliance rules.
+ */
+interface PluginCatalogCapability {
+    /**
+     * RECOMMENDED incremental entry point: a partial NormalizedCatalog delta.
+     * The bridge runs the SAME family ordering + second-pass FK resolution as
+     * the importer (providers → restriction/currency groups → categories →
+     * games → category links). No retire step (that is import-only).
+     * ≤500 rows per family per call.
+     */
+    upsertBatch(delta: NormalizedCatalogDelta): Promise<ImportSummaryLite>;
+    upsertProviders(providers: NormalizedProvider[]): Promise<{
+        upserted: number;
+    }>;
+    upsertRestrictionGroups(groups: NormalizedRestrictionGroup[]): Promise<{
+        upserted: number;
+    }>;
+    upsertCurrencyGroups(groups: NormalizedCurrencyGroup[]): Promise<{
+        upserted: number;
+    }>;
+    upsertCategories(categories: NormalizedCategory[]): Promise<{
+        upserted: number;
+    }>;
+    upsertGames(games: NormalizedGame[]): Promise<{
+        upserted: number;
+    }>;
+    attachGameCategories(links: Array<{
+        gameExternalId: string;
+        categoryExternalId: string;
+    }>): Promise<void>;
+    /** Enable/disable one of the plugin's OWN games (status flip — never an
+     *  operator overlay, never a delete). */
+    setGameStatus(externalGameId: string, enabled: boolean): Promise<void>;
+    /** Cursor-paginated listing of the plugin's own rows (incl. retired). */
+    listOwnGames(q?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<{
+        games: OwnGameSummary[];
+        nextCursor?: string;
+    }>;
+    /** Enqueue a full ingest via the registered adapter (the host-run
+     *  `catalog:import` task: ingest → validate → import with retire). */
+    requestImport(): Promise<{
+        taskId: string;
+    }>;
+}
+/**
+ * The plugin's catalog source adapter — registered in `setup(ctx)` via
+ * `ctx.registerCatalogSource`. `ingest` receives the PluginContext so it can
+ * use `ctx.http` / `ctx.settings` / `ctx.secrets`; the host adapts it to the
+ * catalog's `CatalogSourceAdapter` shape and runs it inside the
+ * `catalog:import` task.
+ */
+interface PluginCatalogSourceAdapter {
+    ingest(ctx: PluginContext): Promise<NormalizedCatalog>;
+}
+
+/** A command dispatch request from a plugin — name must be in `permissions.commands`. */
+interface PluginCommand {
+    name: string;
+    input: unknown;
+}
+/**
+ * An event a plugin emits. Name must be declared in `permissions.events.emit`
+ * and namespaced `plugin.<key>.*`. Routed through the outbox — never NATS.
+ */
+interface PluginEmittedEvent {
+    name: string;
+    payload: Record<string, unknown>;
+    version?: number;
+    /**
+     * Player the event addresses. REQUIRED for the event to reach player
+     * sockets on the `ext.<key>` realtime channel (tenant broadcast is out of
+     * scope — the gateway drops player-less events). Carried on the outbox
+     * envelope, never inside `payload`.
+     */
+    playerId?: string;
+}
+/** Logger scoped to tenant + plugin; the host's implementation redacts secrets. */
+interface ScopedLogger {
+    debug(message: string, extra?: Record<string, unknown>): void;
+    info(message: string, extra?: Record<string, unknown>): void;
+    warn(message: string, extra?: Record<string, unknown>): void;
+    error(message: string, extra?: Record<string, unknown>): void;
+}
+/**
+ * The ENTIRE surface a plugin may touch, built per tenant by the host's
+ * capability layer. There is intentionally no `db`, no NATS handle, no wallet
+ * service here — state changes go through commands, events through the outbox.
+ */
+interface PluginContext {
+    readonly tenantId: string;
+    readonly region: string;
+    readonly pluginKey: string;
+    readonly version: string;
+    /** The ONLY way a plugin changes state. Rejects commands not in the manifest allowlist. */
+    commands: {
+        execute<TResult = unknown>(command: PluginCommand, opts?: {
+            idempotencyKey?: string;
+        }): Promise<TResult>;
+    };
+    /** Typed, validated, READ-ONLY non-secret settings for this plugin + tenant. */
+    settings: {
+        get<T = Record<string, unknown>>(): T;
+    };
+    /** Secret values resolved on demand; never logged, never echoed to the API layer. */
+    secrets: {
+        get(key: string): Promise<string | undefined>;
+    };
+    events: {
+        /** Subscribe to a domain event declared in `permissions.events.subscribe`. */
+        on<E extends DomainEventName>(event: E, handler: (e: DomainEvent<E>) => Promise<void>): void;
+        /** Emit a `plugin.<key>.*` event declared in `permissions.events.emit`. */
+        emit(event: PluginEmittedEvent): Promise<void>;
+    };
+    /**
+     * Scoped READ access to core data via registered read models. The model's
+     * required scope must be declared in `permissions.dataScopes`; results are
+     * DTOs (PII only under `players:pii`), cursor-paginated, max page 200.
+     */
+    data: {
+        query<Q extends ReadModelName>(model: Q, params: ReadModelParams<Q>): Promise<ReadModelResult<Q>>;
+    };
+    /**
+     * Plugin-owned datasets declared in the manifest. Own datasets: full CRUD.
+     * Foreign datasets (`"owner.dataset"`): read-only, only when the owner marks
+     * them `shared` AND this plugin declares `permissions.datasets.read`.
+     */
+    datasets: {
+        collection<T = Record<string, unknown>>(name: string): PluginDatasetCollection<T>;
+    };
+    /**
+     * Outbound HTTP restricted to `manifest.network.allowedHosts`. HTTPS only,
+     * SSRF-guarded, secrets injected host-side via `init.secretHeaders`.
+     */
+    http: {
+        fetch(url: string, init?: PluginFetchInit): Promise<PluginFetchResponse>;
+        /** HMAC over `payload` with the named tenant secret, computed host-side. */
+        hmacSha256(secretName: string, payload: string): Promise<string>;
+    };
+    /** Enqueue a background task on this plugin (seeding, backfill). */
+    tasks: {
+        start(type: string, input?: Record<string, unknown>): Promise<{
+            taskId: string;
+        }>;
+    };
+    logger: ScopedLogger;
+    /**
+     * Game-catalog content surface (§7b) — present ONLY when the manifest
+     * declares a `catalog` block and the plugin kind allows it. Every write is
+     * scoped to the plugin's own tenant-owned catalog source; the platform
+     * keeps search/categories/visibility/eligibility/overlays/stats/caching.
+     */
+    catalog?: PluginCatalogCapability;
+    /**
+     * Register the catalog source adapter for this tenant (in `setup(ctx)`,
+     * like provider adapters). The host runs it inside the reserved
+     * `catalog:import` task: ingest → validate → snapshot import (with retire).
+     * Requires `manifest.catalog`.
+     */
+    registerCatalogSource?(adapter: PluginCatalogSourceAdapter): void;
+    /** Provider plugins only: register the adapter for this tenant's provider key. */
+    registerProviderAdapter?(adapter: ProviderAdapter): void;
+    registerPaymentAdapter?(adapter: PaymentProviderAdapter): void;
+    registerKycAdapter?(adapter: KycProviderAdapter): void;
+    registerMessagingAdapter?(adapter: MessagingAdapter): void;
+}
+
+/**
+ * Lifecycle hooks a plugin MAY implement. The host invokes them through the
+ * hook runner (per-hook try/catch + timeout): a throwing or hanging hook marks
+ * the tenant's plugin `errored` with `lastError` set — it never rolls back the
+ * core transaction that triggered it.
+ */
+declare const PluginHookNames: readonly ["onInstall", "onEnable", "onConfigure", "onDisable", "onUninstall", "onMigrateSettings", "onUpgrade"];
+type PluginHookName = (typeof PluginHookNames)[number];
+interface PluginRuntimeHooks {
+    onInstall?(ctx: PluginContext): Promise<void> | void;
+    onEnable?(ctx: PluginContext): Promise<void> | void;
+    /** Runs after settings were validated and saved for a tenant. */
+    onConfigure?(ctx: PluginContext): Promise<void> | void;
+    onDisable?(ctx: PluginContext): Promise<void> | void;
+    onUninstall?(ctx: PluginContext): Promise<void> | void;
+    /**
+     * Runs when a tenant's saved settings were validated against an older
+     * schema version than the one now enabled. Returns the migrated values.
+     */
+    onMigrateSettings?(ctx: PluginContext, previous: Record<string, unknown>): Promise<Record<string, unknown>> | Record<string, unknown>;
+    /**
+     * Runs after `UpgradePluginCommand` completed all migrations and flipped
+     * `installedVersion` — the plugin is already running `toVersion`.
+     */
+    onUpgrade?(ctx: PluginContext, info: {
+        fromVersion: string;
+        toVersion: string;
+    }): Promise<void> | void;
+}
+
+/**
+ * Host contract types, VENDORED from `@cwe/shared` (distribution prompt §2).
+ *
+ * The published SDK must be fully self-contained — its d.ts may not reference
+ * private workspace packages. These are small, stable, structural interfaces:
+ * TypeScript's structural typing keeps them assignment-compatible with the
+ * host's own `@cwe/shared` definitions, and the SDK↔runtime lockstep gate
+ * (major.minor == RUNTIME_API_VERSION) is the contract that keeps them in
+ * sync. If a field changes in `@cwe/shared`, change it here in the same PR.
+ */
+/** Tenant context attached to every request. */
+interface TenantContext {
+    tenantId: string;
+    brandId: string;
+    region: string;
+}
+/** The kind of principal that triggered an action — recorded in the audit trail. */
+type ActorType = "user" | "player" | "staff" | "system" | "provider" | "plugin" | "anonymous";
+/**
+ * Who is performing an action. Flows into commands and the audit log so every
+ * state change is attributable.
+ */
+interface Actor {
+    type: ActorType;
+    id: string | null;
+}
+/** Standard money representation. Amounts are fixed-precision strings. */
+interface Money {
+    amount: string;
+    currency: string;
+}
+
+/**
+ * Plugin HTTP routes — how a plugin adds endpoints to the casino API. Routes
+ * are DECLARED in the manifest and IMPLEMENTED as named handlers in
+ * `definePlugin({ handlers.routes })`; the host's PluginRouter mounts them:
+ *
+ *   public   /api/ext/:pluginKey/*       no session (tenant context as always)
+ *   player   /api/ext/:pluginKey/*       player session required
+ *   admin    /admin/ext/:pluginKey/*     staff RBAC `plugin:<key>:admin`
+ *   callback /callbacks/:pluginKey/*     mandatory signature verification
+ *
+ * Routes exist only for tenants where the plugin is enabled — otherwise 404
+ * (never 403; installation state must not leak). Handlers never see Fastify:
+ * they get a sanitized PluginRequest and return a PluginResponse.
+ */
+type PluginRouteSurface = "public" | "player" | "admin" | "callback";
+type PluginRouteMethod = "GET" | "POST" | "PUT" | "DELETE";
+interface PluginRouteDecl {
+    method: PluginRouteMethod;
+    /** Relative path, e.g. `/lobby` or `/games/:gameKey`. */
+    path: string;
+    surface: PluginRouteSurface;
+    /** Name of the implementation in `definePlugin({ handlers: { routes } })`. */
+    handler: string;
+    /** Zod at the boundary — validated by the host before the handler runs. */
+    input?: {
+        params?: z.ZodTypeAny;
+        query?: z.ZodTypeAny;
+        body?: z.ZodTypeAny;
+    };
+    /**
+     * Optional Zod schema of the success response body. Not enforced at
+     * runtime — used at publish/codegen time to derive the action catalog's
+     * `output` JSON Schema and the generated client's result types.
+     */
+    output?: z.ZodTypeAny;
+    /** Per tenant+IP, Redis-backed. Host defaults apply when omitted. */
+    rateLimit?: {
+        windowSec: number;
+        max: number;
+    };
+    /** POST routes that require an `Idempotency-Key` header. */
+    idempotent?: boolean;
+}
+/** Options for callback-surface signature verification. */
+interface SignatureVerifyOptions {
+    /** Header carrying the signature. Default `x-signature`. */
+    header?: string;
+    /** HMAC algorithm. Default `sha256`. */
+    algorithm?: "sha256" | "sha512";
+    /** Signature encoding in the header. Default `hex`. */
+    encoding?: "hex" | "base64";
+}
+/**
+ * What a route handler receives — already Zod-validated per the declaration,
+ * with a sanitized header subset (no cookies, no authorization header).
+ */
+interface PluginRequest {
+    params: unknown;
+    query: unknown;
+    body: unknown;
+    /** Player surface only. */
+    player?: {
+        id: string;
+    };
+    /** Admin surface only. */
+    actor?: Actor;
+    headers: Readonly<Record<string, string>>;
+    /** Set when the route declared `idempotent: true`. */
+    idempotencyKey?: string;
+    /**
+     * Callback surface: verify the request signature against the named tenant
+     * secret BEFORE trusting the body. Throws on mismatch. The dev-harness
+     * doctor rejects callback handlers that never call this.
+     */
+    verifySignature(secretName: string, opts?: SignatureVerifyOptions): Promise<void>;
+}
+interface PluginResponse {
+    /** Default 200. */
+    status?: number;
+    body?: unknown;
+    headers?: Record<string, string>;
+}
+type PluginRouteHandler = (req: PluginRequest, ctx: PluginContext) => Promise<PluginResponse>;
+/** Host defaults enforced around every handler invocation. */
+declare const PLUGIN_ROUTE_LIMITS: {
+    /** Handler timeout (ms) — public/player/admin surfaces. */
+    readonly timeoutMs: 5000;
+    /** Handler timeout (ms) — callback surface (providers can be slow). */
+    readonly callbackTimeoutMs: 10000;
+    /** Serialized response body cap in bytes. */
+    readonly maxResponseBytes: 1048576;
+    /** Default public-surface rate limit when the manifest omits one. */
+    readonly defaultRateLimit: {
+        readonly windowSec: 60;
+        readonly max: 60;
+    };
+};
+
+/**
+ * Scheduled plugin jobs. Declared in the manifest, implemented as named
+ * handlers in `definePlugin({ handlers.jobs })`, executed by the JobScheduler
+ * in `apps/worker` per `(tenant, enabled plugin, job)` under a Redis lock so
+ * exactly one worker runs a due job. Missed schedules coalesce to ONE
+ * catch-up run; handlers must be idempotent regardless.
+ */
+interface PluginJobDecl {
+    /** 5-field cron expression, UTC. Minimum effective interval: 1 minute. */
+    schedule: string;
+    /** Name of the implementation in `definePlugin({ handlers: { jobs } })`. */
+    handler: string;
+    /** Default 300, max 900. */
+    timeoutSec?: number;
+}
+type PluginJobHandler = (ctx: PluginContext) => Promise<void>;
+declare const PLUGIN_JOB_LIMITS: {
+    readonly defaultTimeoutSec: 300;
+    readonly maxTimeoutSec: 900;
+    /** Consecutive failures before `PLUGIN_JOB_FAILED` is emitted. */
+    readonly failureStreakThreshold: 3;
+};
+
+/**
+ * Upgrade migrations — ordered dataset/settings transforms that run inside
+ * `UpgradePluginCommand` when a tenant moves THROUGH `toVersion`. Each step is
+ * recorded in `plugin_migrations` (running → completed | failed) and must be
+ * idempotent: a failed upgrade leaves the OLD version running and a retry
+ * resumes from the failed step's checkpoint.
+ *
+ * Migrations are forward-only. Rollback = pin to the old version, which never
+ * re-runs old migrations — so dataset schemas must stay read-compatible one
+ * version back.
+ */
+interface PluginMigrationDecl {
+    /** Runs when upgrading through this version (semver in (from, to]). */
+    toVersion: string;
+    /** Name of the implementation in `definePlugin({ handlers: { migrations } })`. */
+    handler: string;
+    description: string;
+}
+/**
+ * Batch-transform helper handed to migration handlers. Iterates an own
+ * dataset in batches of 500, applies the transform, upserts the result and
+ * checkpoints the cursor into the `plugin_migrations` row after every batch —
+ * a re-run after a mid-batch failure resumes where it stopped.
+ */
+interface PluginMigrationHelper {
+    transformDataset<T = Record<string, unknown>>(dataset: string, transform: (record: {
+        key: string;
+        value: T;
+    }) => Promise<{
+        key: string;
+        value: T;
+    } | null> | {
+        key: string;
+        value: T;
+    } | null): Promise<{
+        processed: number;
+    }>;
+}
+type PluginMigrationHandler = (ctx: PluginContext, helper: PluginMigrationHelper) => Promise<void>;
+declare const PLUGIN_MIGRATION_LIMITS: {
+    readonly batchSize: 500;
+    /** Per-step timeout (ms). */
+    readonly stepTimeoutMs: 900000;
+};
+
+/**
+ * Backoffice surface DESCRIPTORS — data only, no UI is built now. Plugins
+ * declare navigation entries and generic page blocks; the platform stores the
+ * descriptors with the manifest snapshot and serves them so a future
+ * backoffice can render plugin UI generically, pulling data from the plugin's
+ * own `admin`-surface routes (the doctor validates every `dataRoute` /
+ * `submitRoute` references a declared admin route).
+ */
+type PluginSurfaceBlock = {
+    type: "table";
+    dataRoute: string;
+    columns: Array<{
+        key: string;
+        label: string;
+    }>;
+} | {
+    type: "stats";
+    dataRoute: string;
+} | {
+    type: "form";
+    submitRoute: string;
+    fields: PluginSettingsFieldDescriptor[];
+} | {
+    type: "json";
+    dataRoute: string;
+};
+interface PluginSurfacePage {
+    key: string;
+    title: string;
+    blocks: PluginSurfaceBlock[];
+}
+interface PluginSurfacesDecl {
+    backoffice?: {
+        nav?: Array<{
+            label: string;
+            pageKey: string;
+        }>;
+        pages?: PluginSurfacePage[];
+    };
+}
+
+/**
+ * The Flows framework (PLAYER_ACCOUNT_BUILD_PROMPT.md §2) — the extensibility
+ * backbone that lets a plugin participate in the core signup / KYC / deposit /
+ * withdrawal flows WITHOUT a workflow engine. A Flow is a named sequence of
+ * stages executed inside core services; each stage exposes plugin
+ * participation in one of two modes:
+ *
+ * - `observe`   — fire-and-isolate, AFTER commit, driven off the domain event
+ *   in the consumers runtime. Cannot veto or modify; failures never affect the
+ *   flow. The default, and all compliance-sensitive stages allow only this.
+ * - `intercept` — runs INSIDE the flow, before commit, and may return a typed
+ *   patch (`modify` / `reject`). Wrapped in the same timeout/circuit machinery
+ *   as plugin routes; the fail policy is per stage (closed stages reject the
+ *   action when the hook errors, open stages proceed without it). An intercept
+ *   hook can never touch money, change tenant/player identity, or bypass a
+ *   core validator — the host re-validates every patch.
+ */
+type FlowName = "signup" | "kyc" | "deposit" | "withdrawal";
+type FlowStageMode = "observe" | "intercept";
+type FlowFailPolicy = "closed" | "open";
+interface FlowHookDecl {
+    flow: FlowName;
+    /** Stage name from {@link FLOW_STAGE_CATALOG} — validated at publish time. */
+    stage: FlowStageName;
+    mode: FlowStageMode;
+    /** Named handler in `definePlugin({ handlers: { flows } })`. */
+    handler: string;
+    /** Intercept budget. Default 2000, max 5000. */
+    timeoutMs?: number;
+}
+/**
+ * Handler signature: return a patch (intercept) or nothing (observe). The
+ * `any` defaults keep specifically-typed handlers assignable to the
+ * `handlers.flows` map (inputs are host-validated per stage regardless).
+ */
+type FlowHookHandler<I = any, O = any> = (ctx: PluginContext, input: Readonly<I>) => Promise<O | void> | O | void;
+/**
+ * The initial stage catalog (§2.2) — extended via decision record ONLY. Each
+ * entry pins which modes a stage admits and its intercept fail policy. An
+ * undeclared stage fails publish; a stage used beyond its allowed mode too.
+ */
+declare const FLOW_STAGE_CATALOG: {
+    readonly "signup.validate": {
+        readonly flow: "signup";
+        readonly modes: readonly ["intercept"];
+        readonly failPolicy: "closed";
+    };
+    readonly "signup.completed": {
+        readonly flow: "signup";
+        readonly modes: readonly ["observe"];
+        readonly failPolicy: "open";
+    };
+    readonly "kyc.requirements.resolve": {
+        readonly flow: "kyc";
+        readonly modes: readonly ["intercept"];
+        readonly failPolicy: "closed";
+    };
+    readonly "kyc.document.submitted": {
+        readonly flow: "kyc";
+        readonly modes: readonly ["observe"];
+        readonly failPolicy: "open";
+    };
+    readonly "kyc.decision": {
+        readonly flow: "kyc";
+        readonly modes: readonly ["observe"];
+        readonly failPolicy: "open";
+    };
+    readonly "deposit.validate": {
+        readonly flow: "deposit";
+        readonly modes: readonly ["intercept"];
+        readonly failPolicy: "closed";
+    };
+    readonly "deposit.completed": {
+        readonly flow: "deposit";
+        readonly modes: readonly ["observe"];
+        readonly failPolicy: "open";
+    };
+    readonly "withdrawal.validate": {
+        readonly flow: "withdrawal";
+        readonly modes: readonly ["intercept"];
+        readonly failPolicy: "closed";
+    };
+    readonly "withdrawal.review": {
+        readonly flow: "withdrawal";
+        readonly modes: readonly ["intercept"];
+        readonly failPolicy: "open";
+    };
+    readonly "withdrawal.settled": {
+        readonly flow: "withdrawal";
+        readonly modes: readonly ["observe"];
+        readonly failPolicy: "open";
+    };
+};
+type FlowStageName = keyof typeof FLOW_STAGE_CATALOG;
+declare const FLOW_STAGE_NAMES: FlowStageName[];
+declare const FLOW_HOOK_DEFAULT_TIMEOUT_MS = 2000;
+declare const FLOW_HOOK_MAX_TIMEOUT_MS = 5000;
+/** Generic intercept verdict: modify a whitelisted subset, or reject. */
+interface FlowInterceptPatch<M = Record<string, unknown>> {
+    modify?: Partial<M>;
+    reject?: {
+        code: string;
+        message: string;
+    };
+}
+interface SignupValidateInput {
+    email?: string;
+    username?: string;
+    profile?: Record<string, unknown>;
+    metadata?: Record<string, unknown>;
+}
+type SignupValidateOutput = FlowInterceptPatch<{
+    profile: Record<string, unknown>;
+    metadata: Record<string, unknown>;
+}>;
+interface KycRequirementsResolveInput {
+    playerId: string;
+    trigger: string;
+    baseRequirements: Array<{
+        documentTypeKey: string;
+        required: boolean;
+    }>;
+}
+/** Add/remove requirement items — only known document-type keys are honored. */
+interface KycRequirementsResolveOutput {
+    add?: string[];
+    satisfied?: string[];
+}
+interface DepositValidateInput {
+    playerId: string;
+    amount: string;
+    currency: string;
+    providerKey?: string;
+    methodKey?: string;
+    metadata?: Record<string, unknown>;
+}
+type DepositValidateOutput = FlowInterceptPatch<{
+    metadata: Record<string, unknown>;
+}>;
+interface WithdrawalValidateInput {
+    playerId: string;
+    amount: string;
+    currency: string;
+    methodKey?: string;
+    metadata?: Record<string, unknown>;
+}
+type WithdrawalValidateOutput = FlowInterceptPatch<{
+    metadata: Record<string, unknown>;
+}>;
+interface WithdrawalReviewInput {
+    withdrawalId: string;
+    playerId: string;
+    amount: string;
+    currency: string;
+    riskContext?: {
+        score?: number;
+        flags?: string[];
+    };
+}
+/** ADVISORY — the final verdict is always core/back-office (§2.2). */
+interface WithdrawalReviewOutput {
+    reviewVerdict?: "approve" | "hold" | "reject";
+    reason?: string;
+}
+/**
+ * Tenant flow ownership (§2.3): `flows.<name>.mode` tenant setting. When a
+ * flow is plugin-owned, the core's default player routes for it return
+ * 409 FLOW_DELEGATED with `details.pluginKey`.
+ */
+type FlowMode = "core" | `plugin:${string}`;
+declare const flowModeSettingKey: (flow: FlowName) => string;
+
+/**
+ * Plugin actions (manifest v3) — SDK-exposed aliases of a plugin's declared
+ * `public`/`player` routes, served to frontends through the host's extension
+ * catalog (`GET /api/ext/_catalog`) and called generically via
+ * `sdk.ext("<key>").call("<action>", input)`.
+ *
+ * Spec: docs/prompts/PLUGIN_ACTIONS_RUNTIME_BUILD_PROMPT.md §2. The doctor
+ * enforces every structural rule below at build/publish time (fail closed):
+ *
+ *  - `route` references a declared route with surface `public` or `player` —
+ *    never `admin` or `callback`.
+ *  - `kind: "query"` ⇒ GET; `kind: "mutation"` ⇒ POST/PUT/DELETE.
+ *  - `idempotent` matches the referenced route declaration's flag.
+ *  - keys unique per plugin, camelCase.
+ *  - `emits` ⊆ manifest-declared emitted events (short form — see below);
+ *    `permissions.frontendEvents` ⊆ emitted events.
+ *  - `frontend.widgets[].dataAction` is a declared `query` action and
+ *    `actions[]` are declared mutations.
+ *
+ * Event-type convention: `emits` and `permissions.frontendEvents` use the
+ * SHORT event type — the emitted name without its `plugin.` prefix, e.g.
+ * `"cashback.claimed"` for an emitted `"plugin.cashback.claimed"`. The same
+ * short type is what reaches player sockets as `ExtPluginEvent.data.type`.
+ */
+/** camelCase action keys — a plugin's stable public API. */
+declare const ACTION_KEY_RE: RegExp;
+interface PluginActionDecl {
+    /** camelCase, unique per plugin, stable public API. */
+    key: string;
+    /** `"<METHOD> <path>"` referencing a declared route, e.g. `"POST /claim"`. */
+    route: string;
+    title: string;
+    description?: string;
+    kind: "query" | "mutation";
+    /** Mutations requiring `Idempotency-Key` (must match the route decl). */
+    idempotent?: boolean;
+    /** Short plugin event types this action may cause, e.g. `"cashback.claimed"`. */
+    emits?: string[];
+    deprecated?: string;
+}
+interface PluginFrontendWidgetDecl {
+    key: string;
+    title: string;
+    slot: "lobby" | "account" | "cashier" | "game-sidebar";
+    /** Must reference a declared `kind: "query"` action. */
+    dataAction: string;
+    /** Mutation action keys the widget may invoke. */
+    actions?: string[];
+}
+interface PluginFrontendDecl {
+    widgets?: PluginFrontendWidgetDecl[];
+}
+/**
+ * Parse an action's `route` reference into method + path. Returns null when
+ * the string is not of the form `"<METHOD> <path>"`.
+ */
+declare function parseActionRoute(route: string): {
+    method: string;
+    path: string;
+} | null;
+/** Short event type (`<key>.<type>`) → full emitted name (`plugin.<key>.<type>`). */
+declare function fullPluginEventName(shortType: string): string;
+/** Full emitted name → short event type, or null if not `plugin.`-prefixed. */
+declare function shortPluginEventType(fullName: string): string | null;
+
+/** What a plugin *is* to the platform — drives wiring (provider bridge, consumers, backoffice). */
+type PluginKind = "provider" | "backoffice" | "consumer" | "integration" | "content";
+/** Capabilities a provider-kind plugin's adapter implements. */
+type ProviderCapability = "launch" | "balance" | "bet" | "settle" | "rollback" | "closeRound" | "freeSpin" | "bonusWin";
+/**
+ * The declarative descriptor every plugin ships. The host reads this to
+ * install, grant permissions, render/validate settings and wire hooks. The
+ * manifest is snapshotted into `plugin_versions` at publish time — treat every
+ * field as a stable wire contract.
+ */
+interface PluginManifest {
+    /** Unique slug, e.g. `sloterv`. Doubles as the registry key. */
+    key: string;
+    name: string;
+    author: string;
+    /** SemVer version of this plugin build. */
+    version: string;
+    kind: PluginKind;
+    /** SemVer range against the host's RUNTIME_API_VERSION, e.g. `>=0.1.0 <0.2.0`. */
+    runtimeCompat: string;
+    description?: string;
+    /** Explicit allowlists. Anything not declared here is denied and audited. */
+    permissions: PluginPermissions;
+    /** Typed per-tenant settings; the backoffice renders a form from this. */
+    settings: PluginSettingsSchema;
+    /** Provider plugins only: the provider key this plugin owns + its capabilities. */
+    provider?: {
+        providerKey: string;
+        capabilities: ProviderCapability[];
+    };
+    /**
+     * Game-catalog content surface (§7b). Presence of this block IS the grant:
+     * the host registers a tenant-owned catalog source for (tenant, plugin) on
+     * enable and exposes `ctx.catalog`. Allowed kinds: provider | content |
+     * integration (doctor-enforced). `sourceName` labels the source in the
+     * backoffice (defaults to the plugin name).
+     */
+    catalog?: {
+        sourceName?: string;
+    };
+    /** Lifecycle hooks this plugin implements (informational; host still probes). */
+    hooks?: Partial<Record<PluginHookName, true>>;
+    /** Regions the plugin is allowed to run in (omitted = all). */
+    regions?: string[];
+    /** HTTP routes this plugin adds to the casino API (host PluginRouter). */
+    routes?: PluginRouteDecl[];
+    /** Plugin-owned datasets, provisioned at install, accessed via `ctx.datasets`. */
+    datasets?: Record<string, PluginDatasetDecl>;
+    /** Ordered dataset/settings migrations run by `UpgradePluginCommand`. */
+    migrations?: PluginMigrationDecl[];
+    /** Scheduled jobs run per tenant by the worker's JobScheduler. */
+    jobs?: Record<string, PluginJobDecl>;
+    /**
+     * Flow-stage participation (PLAYER_ACCOUNT_BUILD_PROMPT.md §2). Each entry
+     * must name a catalog stage, an allowed mode, and a handler in
+     * `handlers.flows`; the stage must also be granted in `permissions.flows`.
+     */
+    flows?: FlowHookDecl[];
+    /**
+     * Outbound HTTP allowlist for `ctx.http` — exact hosts or one-level
+     * wildcards (`*.sloterv.com`). HTTPS only. Nothing declared = no egress.
+     */
+    network?: {
+        allowedHosts: string[];
+    };
+    /** Backoffice surface descriptors (data only — no UI is built now). */
+    surfaces?: PluginSurfacesDecl;
+    /** Task type to enqueue after install commits (async dataset seeding). */
+    install?: {
+        seedTask?: string;
+    };
+    /**
+     * SDK-exposed action aliases of declared `public`/`player` routes, served
+     * through the tenant extension catalog with JSON Schemas derived from the
+     * routes' Zod declarations at publish time.
+     */
+    actions?: PluginActionDecl[];
+    /** Frontend widget descriptors binding catalog actions to casino UI slots. */
+    frontend?: PluginFrontendDecl;
+}
+/** Release channels a version can be published to. */
+declare const PluginChannels: readonly ["dev", "beta", "stable"];
+type PluginChannel = (typeof PluginChannels)[number];
+/** Per-tenant enablement state (host-managed, `tenant_plugins.state`). */
+declare const TenantPluginStates: readonly ["installed", "enabled", "disabled", "errored"];
+type TenantPluginState = (typeof TenantPluginStates)[number];
+/** Catalog lifecycle of a published version (`plugin_versions.status`). */
+declare const PluginVersionStatuses: readonly ["draft", "published", "yanked"];
+type PluginVersionStatus = (typeof PluginVersionStatuses)[number];
+
+/**
+ * Async plugin tasks — long-running background work (install-time dataset
+ * seeding, backfills) that must never run inside a lifecycle transaction.
+ * Enqueued via `StartPluginTaskCommand` (or `ctx.tasks.start`), claimed and
+ * executed by the TaskRunner in `apps/worker` with the full PluginContext.
+ *
+ * Handlers MUST be idempotent/resumable: a retry re-invokes the handler with
+ * the last saved checkpoint, and `putMany` upserts make re-runs safe.
+ */
+interface PluginTaskProgress {
+    /** Persist progress (0–100) + message so the backoffice can poll it. */
+    report(percent: number, message?: string): Promise<void>;
+    /** Checkpoint saved by a previous (failed/interrupted) attempt, if any. */
+    readonly checkpoint: Record<string, unknown> | null;
+    /** Persist a resumability cursor; survives worker crashes and retries. */
+    saveCheckpoint(checkpoint: Record<string, unknown>): Promise<void>;
+}
+type PluginTaskHandler = (ctx: PluginContext, input: Record<string, unknown>, progress: PluginTaskProgress) => Promise<void>;
+declare const PLUGIN_TASK_LIMITS: {
+    /** Task execution timeout (ms). */
+    readonly timeoutMs: 900000;
+};
+
+/**
+ * Named implementations that manifest declarations reference by string:
+ * `routes[].handler`, `jobs.<name>.handler`, `install.seedTask` /
+ * `ctx.tasks.start` types, and `migrations[].handler`. The host validates at
+ * load time that every referenced handler exists (`plugin doctor` reports any
+ * mismatch before publish).
+ */
+interface PluginHandlers {
+    routes?: Record<string, PluginRouteHandler>;
+    jobs?: Record<string, PluginJobHandler>;
+    tasks?: Record<string, PluginTaskHandler>;
+    migrations?: Record<string, PluginMigrationHandler>;
+    /** Flow-stage handlers referenced by `manifest.flows[].handler` (§2). */
+    flows?: Record<string, FlowHookHandler>;
+}
+/**
+ * The full authored shape of a plugin — what a plugin package's entry module
+ * exports and what the host loads. `setup` runs when the host activates the
+ * plugin for a tenant: register event handlers via `ctx.events.on` and (for
+ * provider plugins) the adapter via `ctx.registerProviderAdapter`.
+ */
+interface PluginDefinition {
+    manifest: PluginManifest;
+    hooks?: PluginRuntimeHooks;
+    handlers?: PluginHandlers;
+    setup?(ctx: PluginContext): Promise<void> | void;
+}
+/** Identity helper that pins the authored object to the contract type. */
+declare function definePlugin(definition: PluginDefinition): PluginDefinition;
+
+/** Persisted per-action schema document (draft-07 JSON Schemas, JSON-safe). */
+interface PluginActionSchema {
+    /**
+     * Input schema. For GET (query) actions this is the route's `query` schema;
+     * for mutations it is the route's `body` schema. Absent when the route
+     * declares none.
+     */
+    input?: unknown;
+    /** Output schema, when the route declares `output`. */
+    output?: unknown;
+}
+/** Map persisted on `plugin_versions.actionSchemas`, keyed by action key. */
+type PluginActionSchemas = Record<string, PluginActionSchema>;
+/**
+ * Derive the persisted action-schema map for a plugin definition. Assumes the
+ * definition already passed the doctor (unknown route references are skipped,
+ * not thrown — validation owns the error surface).
+ */
+declare function deriveActionSchemas(definition: PluginDefinition): PluginActionSchemas;
+
+interface ActionValidationIssues {
+    errors: string[];
+    warnings: string[];
+}
+declare function validateActionDecls(definition: PluginDefinition): ActionValidationIssues;
+
+/** Relative path → file contents. Paths use `/` separators. */
+type GeneratedClientFiles = Record<string, string>;
+interface GenerateClientOptions {
+    /** Peer range on the Casino SDK. Default `">=0.3.0"`. */
+    sdkPeerRange?: string;
+}
+declare function pascalCase(value: string): string;
+/**
+ * Print a TypeScript type for a derived JSON Schema. Handles exactly the
+ * shapes zod-to-json-schema emits for plugin route schemas; anything outside
+ * the subset degrades to `unknown` (never throws — codegen must not be able
+ * to fail on an exotic schema the doctor already accepted).
+ */
+declare function jsonSchemaToTsType(schema: unknown): string;
+/**
+ * Generate the full `@cwe-plugins/<key>-client` package for a definition.
+ * Pure and deterministic — no filesystem access, no clock, no randomness.
+ */
+declare function generateClientPackage(definition: PluginDefinition, opts?: GenerateClientOptions): GeneratedClientFiles;
+
+export { ACTION_KEY_RE, type ActionValidationIssues, type Actor, type ActorType, AffiliateEvents, type BalanceResult, BetEvents, type BetRecordDTO, type BetResult, BonusEvents, CATALOG_ALLOWED_KINDS, CATALOG_IMPORT_TASK_TYPE, CashierEvents, type CatalogCategoryNodeDTO, type CatalogEligibilityParams, CatalogEvents, type CatalogGameDTO, type CatalogImportSummary, type CatalogProviderDTO, type CloseRoundInput, type CreateSessionInput, type CreateSessionResult, type DataScope, DataScopes, type DepositValidateInput, type DepositValidateOutput, type DomainEvent, type DomainEventName, DomainEventNames, type DomainEventPayloads, FLOW_HOOK_DEFAULT_TIMEOUT_MS, FLOW_HOOK_MAX_TIMEOUT_MS, FLOW_STAGE_CATALOG, FLOW_STAGE_NAMES, type FlowFailPolicy, type FlowHookDecl, type FlowHookHandler, type FlowInterceptPatch, type FlowMode, type FlowName, type FlowStageMode, type FlowStageName, type GameSessionDTO, type GenerateClientOptions, type GeneratedClientFiles, type ImportSummaryLite, type KycDocumentDTO, type KycDocumentRef, type KycProviderAdapter, type KycRequestDTO, type KycRequirementsResolveInput, type KycRequirementsResolveOutput, type KycStateDTO, type LedgerEntryDTO, type MessagingAdapter, type Money, type NormalizedCatalog, type NormalizedCatalogDelta, type NormalizedCategory, type NormalizedCurrencyGroup, type NormalizedGame, type NormalizedGameCategoryLink, type NormalizedLaunchCodes, type NormalizedProvider, type NormalizedRestrictionGroup, type OwnGameSummary, PLUGIN_CATALOG_LIMITS, PLUGIN_DATASET_LIMITS, PLUGIN_HTTP_LIMITS, PLUGIN_JOB_LIMITS, PLUGIN_MIGRATION_LIMITS, PLUGIN_ROUTE_LIMITS, PLUGIN_TASK_LIMITS, type PaymentProviderAdapter, type PlaceBetInput, type PlayerBetDTO, PlayerEvents, type PlayerLimitDTO, type PlayerSummaryDTO, type PluginActionDecl, type PluginActionSchema, type PluginActionSchemas, type PluginCatalogCapability, type PluginCatalogSourceAdapter, type PluginChannel, PluginChannels, type PluginCommand, type PluginContext, type PluginDatasetCollection, type PluginDatasetDecl, type PluginDatasetQuery, type PluginDefinition, type PluginEmittedEvent, PluginEvents, type PluginFetchInit, type PluginFetchResponse, type PluginFrontendDecl, type PluginFrontendWidgetDecl, type PluginHandlers, type PluginHookName, PluginHookNames, type PluginJobDecl, type PluginJobHandler, type PluginKind, type PluginManifest, type PluginMessage, type PluginMigrationDecl, type PluginMigrationHandler, type PluginMigrationHelper, type PluginPaymentMethodDescriptor, type PluginPermissions, type PluginRequest, type PluginResponse, type PluginRouteDecl, type PluginRouteHandler, type PluginRouteMethod, type PluginRouteSurface, type PluginRuntimeHooks, type PluginScope, PluginScopes, type PluginSettingsField, type PluginSettingsFieldDescriptor, type PluginSettingsFieldType, type PluginSettingsSchema, type PluginSettingsSchemaDescriptor, type PluginSurfaceBlock, type PluginSurfacePage, type PluginSurfacesDecl, type PluginTaskHandler, type PluginTaskProgress, type PluginVersionStatus, PluginVersionStatuses, type ProviderAdapter, type ProviderCapability, type ProviderContext, ProviderEvents, type PspDepositInput, type PspDepositResult, type PspWithdrawalInput, type PspWithdrawalResult, READ_MODEL_MAX_PAGE, type ReadModelDefinitions, type ReadModelName, type ReadModelPage, type ReadModelParams, ReadModelRequiredScopes, type ReadModelResult, type RollbackInput, type RoundResult, type ScopedLogger, type SettleBetInput, type SignatureVerifyOptions, type SignupValidateInput, type SignupValidateOutput, type TenantContext, type TenantInfoDTO, type TenantPluginState, TenantPluginStates, type WalletBalanceDTO, WalletEvents, type WithdrawalReviewInput, type WithdrawalReviewOutput, type WithdrawalValidateInput, type WithdrawalValidateOutput, defaultSettingsValues, definePlugin, deriveActionSchemas, flowModeSettingKey, fullPluginEventName, generateClientPackage, jsonSchemaToTsType, parseActionRoute, pascalCase, pluginEventPrefix, serializeSettingsSchema, settingsField, settingsZodObject, shortPluginEventType, validateActionDecls };