@openora/core 0.4.0 → 0.4.1-canary.100

package/dist/compliance/router/index.d.ts

@@ -1,17 +1,24 @@
 import { AdminGuard, type OssContext } from '@openora/core/server';
-import type { KycAdapter, KycWebhookVerifier } from '@openora/core/contracts';
+import type { AuditWritePort, JobQueueAdapter, KycAdapter, KycWebhookVerifier, QueueName, RealtimeTransport, User } from '@openora/core/contracts';
+import { type KycStatusUpdate } from '../contract/index.js';
 import { ComplianceService } from '../service/compliance.service.js';
 import { KycVerificationService } from '../service/kyc.service.js';
 import { RgService } from '../service/rg.service.js';
 import { RgMonitoringService } from '../service/rg-monitoring.service.js';
-export declare function createComplianceRouter({ compliance, adminGuard, kyc, kycAdapter, webhookVerifier, rg, rgMonitoring, }: {
+export declare function kycStatusChannel(userId: User['id']): string;
+export declare function createKycStatusStream(realtime: RealtimeTransport, userId: User['id'], signal: AbortSignal | undefined): AsyncGenerator<KycStatusUpdate>;
+export declare function createComplianceRouter({ compliance, adminGuard, audit, kyc, kycAdapter, webhookVerifier, jobQueue, kycDecisionSyncQueue, realtime, rg, rgMonitoring, }: {
     rg: RgService;
     rgMonitoring: RgMonitoringService;
     compliance: ComplianceService;
     adminGuard: AdminGuard;
+    audit: AuditWritePort;
     kyc: KycVerificationService;
     kycAdapter: KycAdapter;
     webhookVerifier: KycWebhookVerifier;
+    jobQueue: JobQueueAdapter;
+    kycDecisionSyncQueue: QueueName;
+    realtime: RealtimeTransport;
 }): {
     getLimits: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("@orpc/server").Schema<unknown, unknown>, import("zod").ZodArray<import("zod").ZodObject<{
         id: import("zod").ZodUUID;
@@ -22,7 +29,8 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
             loss: "loss";
             session: "session";
         }>;
-        amount: import("zod").ZodNumber;
+        amount: import("zod").ZodNullable<import("zod").ZodString>;
+        minutes: import("zod").ZodNullable<import("zod").ZodNumber>;
         period: import("zod").ZodEnum<{
             session: "session";
             daily: "daily";
@@ -38,13 +46,14 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
             loss: "loss";
             session: "session";
         }>;
-        amount: import("zod").ZodNumber;
+        amount: import("zod").ZodNullable<import("zod").ZodString>;
         period: import("zod").ZodEnum<{
             session: "session";
             daily: "daily";
             weekly: "weekly";
             monthly: "monthly";
         }>;
+        minutes: import("zod").ZodNullable<import("zod").ZodNumber>;
     }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
         id: import("zod").ZodUUID;
         userId: import("zod").ZodUUID;
@@ -54,7 +63,8 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
             loss: "loss";
             session: "session";
         }>;
-        amount: import("zod").ZodNumber;
+        amount: import("zod").ZodNullable<import("zod").ZodString>;
+        minutes: import("zod").ZodNullable<import("zod").ZodNumber>;
         period: import("zod").ZodEnum<{
             session: "session";
             daily: "daily";
@@ -108,6 +118,7 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
             status: import("zod").ZodEnum<{
                 pending: "pending";
                 not_started: "not_started";
+                approved: "approved";
                 verified: "verified";
                 rejected: "rejected";
                 resubmission_requested: "resubmission_requested";
@@ -124,6 +135,25 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
                 submission: "submission";
                 reverify_threshold: "reverify_threshold";
             }>;
+            riskSignals: import("zod").ZodNullable<import("zod").ZodObject<{
+                vpnOrTorDetected: import("zod").ZodBoolean;
+                dataCenterIpDetected: import("zod").ZodBoolean;
+                duplicateDeviceDetected: import("zod").ZodBoolean;
+                highRiskCountryDetected: import("zod").ZodBoolean;
+                deviceFingerprints: import("zod").ZodArray<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>>;
+            checks: import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodObject<{
+                step: import("zod").ZodString;
+                status: import("zod").ZodEnum<{
+                    expired: "expired";
+                    unknown: "unknown";
+                    not_started: "not_started";
+                    approved: "approved";
+                    in_progress: "in_progress";
+                    in_review: "in_review";
+                    declined: "declined";
+                }>;
+            }, import("zod/v4/core").$strip>>>;
             submittedAt: import("zod").ZodISODateTime;
             decidedAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
             createdAt: import("zod").ZodISODateTime;
@@ -137,6 +167,7 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
             status: import("zod").ZodEnum<{
                 pending: "pending";
                 not_started: "not_started";
+                approved: "approved";
                 verified: "verified";
                 rejected: "rejected";
                 resubmission_requested: "resubmission_requested";
@@ -153,6 +184,25 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
                 submission: "submission";
                 reverify_threshold: "reverify_threshold";
             }>;
+            riskSignals: import("zod").ZodNullable<import("zod").ZodObject<{
+                vpnOrTorDetected: import("zod").ZodBoolean;
+                dataCenterIpDetected: import("zod").ZodBoolean;
+                duplicateDeviceDetected: import("zod").ZodBoolean;
+                highRiskCountryDetected: import("zod").ZodBoolean;
+                deviceFingerprints: import("zod").ZodArray<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>>;
+            checks: import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodObject<{
+                step: import("zod").ZodString;
+                status: import("zod").ZodEnum<{
+                    expired: "expired";
+                    unknown: "unknown";
+                    not_started: "not_started";
+                    approved: "approved";
+                    in_progress: "in_progress";
+                    in_review: "in_review";
+                    declined: "declined";
+                }>;
+            }, import("zod/v4/core").$strip>>>;
             submittedAt: import("zod").ZodISODateTime;
             decidedAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
             createdAt: import("zod").ZodISODateTime;
@@ -177,6 +227,7 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
         status: import("zod").ZodEnum<{
             pending: "pending";
             not_started: "not_started";
+            approved: "approved";
             verified: "verified";
             rejected: "rejected";
             resubmission_requested: "resubmission_requested";
@@ -193,14 +244,162 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
             submission: "submission";
             reverify_threshold: "reverify_threshold";
         }>;
+        riskSignals: import("zod").ZodNullable<import("zod").ZodObject<{
+            vpnOrTorDetected: import("zod").ZodBoolean;
+            dataCenterIpDetected: import("zod").ZodBoolean;
+            duplicateDeviceDetected: import("zod").ZodBoolean;
+            highRiskCountryDetected: import("zod").ZodBoolean;
+            deviceFingerprints: import("zod").ZodArray<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        checks: import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodObject<{
+            step: import("zod").ZodString;
+            status: import("zod").ZodEnum<{
+                expired: "expired";
+                unknown: "unknown";
+                not_started: "not_started";
+                approved: "approved";
+                in_progress: "in_progress";
+                in_review: "in_review";
+                declined: "declined";
+            }>;
+        }, import("zod/v4/core").$strip>>>;
         submittedAt: import("zod").ZodISODateTime;
         decidedAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
         createdAt: import("zod").ZodISODateTime;
         updatedAt: import("zod").ZodISODateTime;
+        verificationUrl: import("zod").ZodOptional<import("zod").ZodString>;
     }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    streamKycStatus: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("@orpc/server").Schema<unknown, unknown>, import("@orpc/server").Schema<AsyncIteratorObject<{
+        eventId: string;
+        status: "pending" | "not_started" | "approved" | "verified" | "rejected" | "resubmission_requested" | "manually_overridden";
+    }, unknown, void>, import("@orpc/server").AsyncIteratorClass<{
+        eventId: string;
+        status: "pending" | "not_started" | "approved" | "verified" | "rejected" | "resubmission_requested" | "manually_overridden";
+    }, unknown, void>>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
     kycWebhook: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>, import("zod").ZodObject<{
         ok: import("zod").ZodLiteral<true>;
     }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    requestKycResubmission: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        userId: import("zod").ZodUUID;
+        reason: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        id: import("zod").ZodUUID;
+        userId: import("zod").ZodUUID;
+        provider: import("zod").ZodString;
+        referenceId: import("zod").ZodString;
+        status: import("zod").ZodEnum<{
+            pending: "pending";
+            not_started: "not_started";
+            approved: "approved";
+            verified: "verified";
+            rejected: "rejected";
+            resubmission_requested: "resubmission_requested";
+            manually_overridden: "manually_overridden";
+        }>;
+        documentTypes: import("zod").ZodArray<import("zod").ZodEnum<{
+            passport: "passport";
+            drivers_license: "drivers_license";
+            national_id: "national_id";
+        }>>;
+        decisionReason: import("zod").ZodNullable<import("zod").ZodString>;
+        triggeredBy: import("zod").ZodEnum<{
+            manual: "manual";
+            submission: "submission";
+            reverify_threshold: "reverify_threshold";
+        }>;
+        riskSignals: import("zod").ZodNullable<import("zod").ZodObject<{
+            vpnOrTorDetected: import("zod").ZodBoolean;
+            dataCenterIpDetected: import("zod").ZodBoolean;
+            duplicateDeviceDetected: import("zod").ZodBoolean;
+            highRiskCountryDetected: import("zod").ZodBoolean;
+            deviceFingerprints: import("zod").ZodArray<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        checks: import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodObject<{
+            step: import("zod").ZodString;
+            status: import("zod").ZodEnum<{
+                expired: "expired";
+                unknown: "unknown";
+                not_started: "not_started";
+                approved: "approved";
+                in_progress: "in_progress";
+                in_review: "in_review";
+                declined: "declined";
+            }>;
+        }, import("zod/v4/core").$strip>>>;
+        submittedAt: import("zod").ZodISODateTime;
+        decidedAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
+        createdAt: import("zod").ZodISODateTime;
+        updatedAt: import("zod").ZodISODateTime;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    overrideKycStatus: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        userId: import("zod").ZodUUID;
+        status: import("zod").ZodEnum<{
+            pending: "pending";
+            not_started: "not_started";
+            approved: "approved";
+            rejected: "rejected";
+            resubmission_requested: "resubmission_requested";
+        }>;
+        reason: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        id: import("zod").ZodUUID;
+        userId: import("zod").ZodUUID;
+        provider: import("zod").ZodString;
+        referenceId: import("zod").ZodString;
+        status: import("zod").ZodEnum<{
+            pending: "pending";
+            not_started: "not_started";
+            approved: "approved";
+            verified: "verified";
+            rejected: "rejected";
+            resubmission_requested: "resubmission_requested";
+            manually_overridden: "manually_overridden";
+        }>;
+        documentTypes: import("zod").ZodArray<import("zod").ZodEnum<{
+            passport: "passport";
+            drivers_license: "drivers_license";
+            national_id: "national_id";
+        }>>;
+        decisionReason: import("zod").ZodNullable<import("zod").ZodString>;
+        triggeredBy: import("zod").ZodEnum<{
+            manual: "manual";
+            submission: "submission";
+            reverify_threshold: "reverify_threshold";
+        }>;
+        riskSignals: import("zod").ZodNullable<import("zod").ZodObject<{
+            vpnOrTorDetected: import("zod").ZodBoolean;
+            dataCenterIpDetected: import("zod").ZodBoolean;
+            duplicateDeviceDetected: import("zod").ZodBoolean;
+            highRiskCountryDetected: import("zod").ZodBoolean;
+            deviceFingerprints: import("zod").ZodArray<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        checks: import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodObject<{
+            step: import("zod").ZodString;
+            status: import("zod").ZodEnum<{
+                expired: "expired";
+                unknown: "unknown";
+                not_started: "not_started";
+                approved: "approved";
+                in_progress: "in_progress";
+                in_review: "in_review";
+                declined: "declined";
+            }>;
+        }, import("zod/v4/core").$strip>>>;
+        submittedAt: import("zod").ZodISODateTime;
+        decidedAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
+        createdAt: import("zod").ZodISODateTime;
+        updatedAt: import("zod").ZodISODateTime;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    bulkApproveKyc: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        userIds: import("zod").ZodArray<import("zod").ZodUUID>;
+        reason: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        results: import("zod").ZodArray<import("zod").ZodObject<{
+            userId: import("zod").ZodUUID;
+            success: import("zod").ZodBoolean;
+            error: import("zod").ZodNullable<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
     setPlayerLimit: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
         userId: import("zod").ZodUUID;
         type: import("zod").ZodEnum<{
@@ -209,7 +408,8 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
             loss: "loss";
             session: "session";
         }>;
-        amount: import("zod").ZodNumber;
+        amount: import("zod").ZodNullable<import("zod").ZodString>;
+        minutes: import("zod").ZodNullable<import("zod").ZodNumber>;
         period: import("zod").ZodEnum<{
             session: "session";
             daily: "daily";
@@ -225,7 +425,8 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
             loss: "loss";
             session: "session";
         }>;
-        amount: import("zod").ZodNumber;
+        amount: import("zod").ZodNullable<import("zod").ZodString>;
+        minutes: import("zod").ZodNullable<import("zod").ZodNumber>;
         period: import("zod").ZodEnum<{
             session: "session";
             daily: "daily";
@@ -246,12 +447,12 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
             self_exclusion: "self_exclusion";
         }>;
         status: import("zod").ZodEnum<{
+            expired: "expired";
             active: "active";
             lifted: "lifted";
-            expired: "expired";
         }>;
         reason: import("zod").ZodString;
-        permanent: import("zod").ZodBoolean;
+        isPermanent: import("zod").ZodBoolean;
         startsAt: import("zod").ZodISODateTime;
         expiresAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
         liftedAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
@@ -263,7 +464,7 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
     }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
     activateSelfExclusion: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
         userId: import("zod").ZodUUID;
-        permanent: import("zod").ZodBoolean;
+        isPermanent: import("zod").ZodBoolean;
         durationMonths: import("zod").ZodOptional<import("zod").ZodNumber>;
         reason: import("zod").ZodString;
         confirm: import("zod").ZodLiteral<true>;
@@ -275,12 +476,12 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
             self_exclusion: "self_exclusion";
         }>;
         status: import("zod").ZodEnum<{
+            expired: "expired";
             active: "active";
             lifted: "lifted";
-            expired: "expired";
         }>;
         reason: import("zod").ZodString;
-        permanent: import("zod").ZodBoolean;
+        isPermanent: import("zod").ZodBoolean;
         startsAt: import("zod").ZodISODateTime;
         expiresAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
         liftedAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
@@ -302,12 +503,38 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
             self_exclusion: "self_exclusion";
         }>;
         status: import("zod").ZodEnum<{
+            expired: "expired";
             active: "active";
             lifted: "lifted";
+        }>;
+        reason: import("zod").ZodString;
+        isPermanent: import("zod").ZodBoolean;
+        startsAt: import("zod").ZodISODateTime;
+        expiresAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
+        liftedAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
+        liftedReason: import("zod").ZodNullable<import("zod").ZodString>;
+        liftedBy: import("zod").ZodNullable<import("zod").ZodUUID>;
+        createdBy: import("zod").ZodUUID;
+        createdAt: import("zod").ZodISODateTime;
+        updatedAt: import("zod").ZodISODateTime;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    liftCoolingOff: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        userId: import("zod").ZodUUID;
+        reason: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        id: import("zod").ZodUUID;
+        userId: import("zod").ZodUUID;
+        kind: import("zod").ZodEnum<{
+            cooling_off: "cooling_off";
+            self_exclusion: "self_exclusion";
+        }>;
+        status: import("zod").ZodEnum<{
             expired: "expired";
+            active: "active";
+            lifted: "lifted";
         }>;
         reason: import("zod").ZodString;
-        permanent: import("zod").ZodBoolean;
+        isPermanent: import("zod").ZodBoolean;
         startsAt: import("zod").ZodISODateTime;
         expiresAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
         liftedAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
@@ -329,7 +556,8 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
                 loss: "loss";
                 session: "session";
             }>;
-            amount: import("zod").ZodNumber;
+            amount: import("zod").ZodNullable<import("zod").ZodString>;
+            minutes: import("zod").ZodNullable<import("zod").ZodNumber>;
             period: import("zod").ZodEnum<{
                 session: "session";
                 daily: "daily";
@@ -346,12 +574,12 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
                 self_exclusion: "self_exclusion";
             }>;
             status: import("zod").ZodEnum<{
+                expired: "expired";
                 active: "active";
                 lifted: "lifted";
-                expired: "expired";
             }>;
             reason: import("zod").ZodString;
-            permanent: import("zod").ZodBoolean;
+            isPermanent: import("zod").ZodBoolean;
             startsAt: import("zod").ZodISODateTime;
             expiresAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
             liftedAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
@@ -369,12 +597,12 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
                 self_exclusion: "self_exclusion";
             }>;
             status: import("zod").ZodEnum<{
+                expired: "expired";
                 active: "active";
                 lifted: "lifted";
-                expired: "expired";
             }>;
             reason: import("zod").ZodString;
-            permanent: import("zod").ZodBoolean;
+            isPermanent: import("zod").ZodBoolean;
             startsAt: import("zod").ZodISODateTime;
             expiresAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
             liftedAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
@@ -405,6 +633,18 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
         }>>;
         fromDate: import("zod").ZodOptional<import("zod").ZodString>;
         toDate: import("zod").ZodOptional<import("zod").ZodString>;
+        sortBy: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+            status: "status";
+            userId: "userId";
+            flagType: "flagType";
+            flaggedAt: "flaggedAt";
+            limitType: "limitType";
+            clearedAt: "clearedAt";
+        }>>>;
+        sortOrder: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+            asc: "asc";
+            desc: "desc";
+        }>>>;
     }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
         items: import("zod").ZodArray<import("zod").ZodObject<{
             id: import("zod").ZodUUID;
@@ -417,9 +657,9 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
                 self_excluded_login: "self_excluded_login";
             }>;
             limitType: import("zod").ZodNullable<import("zod").ZodString>;
-            detail: import("zod").ZodUnion<readonly [import("zod").ZodObject<{
-                actual: import("zod").ZodNumber;
-                limit: import("zod").ZodNumber;
+            detail: import("zod").ZodUnion<[import("zod").ZodUnion<readonly [import("zod").ZodObject<{
+                actual: import("zod").ZodString;
+                limit: import("zod").ZodString;
                 period: import("zod").ZodEnum<{
                     session: "session";
                     daily: "daily";
@@ -437,7 +677,7 @@ export declare function createComplianceRouter({ compliance, adminGuard, kyc, ky
                     cooling_off: "cooling_off";
                     self_exclusion: "self_exclusion";
                 }>>;
-            }, import("zod/v4/core").$strip>]>;
+            }, import("zod/v4/core").$strip>]>, import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>]>;
             status: import("zod").ZodEnum<{
                 active: "active";
                 cleared: "cleared";

package/dist/compliance/router/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/compliance/router/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAwB,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE9E,OAAO,EACL,iBAAiB,EAGlB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EACL,SAAS,EAKV,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAQ1E,wBAAgB,sBAAsB,CAAC,EACrC,UAAU,EACV,UAAU,EACV,GAAG,EACH,UAAU,EACV,eAAe,EACf,EAAE,EACF,YAAY,GACb,EAAE;IACD,EAAE,EAAE,SAAS,CAAC;IACd,YAAY,EAAE,mBAAmB,CAAC;IAClC,UAAU,EAAE,iBAAiB,CAAC;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB,GAAG,EAAE,sBAAsB,CAAC;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,eAAe,EAAE,kBAAkB,CAAC;CACrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmGA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/compliance/router/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,UAAU,EAIV,KAAK,UAAU,EAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,SAAS,EACT,iBAAiB,EACjB,IAAI,EACL,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,iBAAiB,EAGlB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAuB,MAAM,2BAA2B,CAAC;AACxF,OAAO,EACL,SAAS,EAKV,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAE3D;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,MAAM,EAAE,WAAW,GAAG,SAAS,GAC9B,cAAc,CAAC,eAAe,CAAC,CAKjC;AAED,wBAAgB,sBAAsB,CAAC,EACrC,UAAU,EACV,UAAU,EACV,KAAK,EACL,GAAG,EACH,UAAU,EACV,eAAe,EACf,QAAQ,EACR,oBAAoB,EACpB,QAAQ,EACR,EAAE,EACF,YAAY,GACb,EAAE;IACD,EAAE,EAAE,SAAS,CAAC;IACd,YAAY,EAAE,mBAAmB,CAAC;IAClC,UAAU,EAAE,iBAAiB,CAAC;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,cAAc,CAAC;IACtB,GAAG,EAAE,sBAAsB,CAAC;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,eAAe,EAAE,kBAAkB,CAAC;IACpC,QAAQ,EAAE,eAAe,CAAC;IAC1B,oBAAoB,EAAE,SAAS,CAAC;IAChC,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2KA"}

package/dist/compliance/router/index.js

@@ -1,28 +1,33 @@
+import { createHash } from 'node:crypto';
 import { implement, ORPCError } from '@orpc/server';
-import { getUserId, mapErrors } from '@openora/core/server';
+import { createEventStreamGenerator, getUserId, mapErrors, } from '@openora/core/server';
 import { complianceContract } from '../contract/index.js';
 import { LimitNotFoundError, LimitOwnershipError, } from '../service/compliance.service.js';
+import { PlayerNotFoundError } from '../service/kyc.service.js';
 import { ExclusionNotFoundError, ActiveExclusionError, PermanentExclusionLiftError, ExclusionPeriodNotElapsedError, } from '../service/rg.service.js';
-function headerValue(context, name) {
-    const raw = context.request.headers[name];
-    if (Array.isArray(raw))
-        return raw[0] ?? null;
-    return raw ?? null;
+export function kycStatusChannel(userId) {
+    return `compliance:kyc-status:${userId}`;
 }
-export function createComplianceRouter({ compliance, adminGuard, kyc, kycAdapter, webhookVerifier, rg, rgMonitoring, }) {
+export function createKycStatusStream(realtime, userId, signal) {
+    return createEventStreamGenerator((push) => realtime.subscribe(kycStatusChannel(userId), push), { signal });
+}
+export function createComplianceRouter({ compliance, adminGuard, audit, kyc, kycAdapter, webhookVerifier, jobQueue, kycDecisionSyncQueue, realtime, rg, rgMonitoring, }) {
     const os = implement(complianceContract).$context();
     return os.router({
         getLimits: os.getLimits.handler(({ context }) => compliance.getLimitsForUser(getUserId(context))),
-        upsertLimit: os.upsertLimit.handler(({ input, context }) => compliance.upsertLimit(getUserId(context), input)),
-        deleteLimit: os.deleteLimit.handler(({ input, context }) => mapErrors({ NOT_FOUND: LimitNotFoundError, FORBIDDEN: LimitOwnershipError }, () => compliance.removeLimit(input.id, getUserId(context)))),
+        upsertLimit: os.upsertLimit.handler(({ input, context }) => {
+            return compliance.upsertLimit(getUserId(context), input, context.clientMeta);
+        }),
+        deleteLimit: os.deleteLimit.handler(({ input, context }) => {
+            return mapErrors({ NOT_FOUND: LimitNotFoundError, FORBIDDEN: LimitOwnershipError }, () => compliance.removeLimit(input.id, getUserId(context), context.clientMeta));
+        }),
         geoCheck: os.geoCheck.handler(({ context }) => {
-            const ip = context.request.headers['x-forwarded-for']?.split(',')[0]?.trim() ??
-                '127.0.0.1';
-            return compliance.geoCheck(ip);
+            const { ip } = context.clientMeta;
+            return compliance.geoCheck(ip ?? '127.0.0.1');
         }),
         addGeoRule: os.addGeoRule.handler(async ({ input, context }) => {
-            const caller = await adminGuard.assert(context, 'compliance', 'override-limit');
-            return compliance.addGeoRule(input, caller.userId);
+            const { userId, ip, userAgent } = await adminGuard.assert(context, 'compliance', 'override-limit');
+            return compliance.addGeoRule(input, userId, { ip, userAgent });
         }),
         listGeoRules: os.listGeoRules.handler(async ({ context }) => {
             await adminGuard.assert(context, 'compliance', 'view');
@@ -32,39 +37,94 @@ export function createComplianceRouter({ compliance, adminGuard, kyc, kycAdapter
             await adminGuard.assert(context, 'compliance', 'view');
             return kyc.getForPlayer(input.userId);
         }),
-        submitKyc: os.submitKyc.handler(({ input, context }) => kyc.submit(getUserId(context), input)),
+        submitKyc: os.submitKyc.handler(({ input, context }) => {
+            return kyc.submit(getUserId(context), input, context.clientMeta);
+        }),
+        streamKycStatus: os.streamKycStatus.handler(({ signal, context }) => {
+            return createKycStatusStream(realtime, getUserId(context), signal);
+        }),
         // M2M provider webhook - no admin session. Verify the verbatim bytes against the
         // signature header or reject (fail closed); never fall back to an empty body.
         kycWebhook: os.kycWebhook.handler(async ({ context }) => {
             const rawBody = context.rawBody;
             if (rawBody === undefined ||
-                !webhookVerifier.verify(rawBody, headerValue(context, 'x-kyc-signature'))) {
+                !(await webhookVerifier.verify(rawBody, context.request.headers))) {
                 throw new ORPCError('UNAUTHORIZED', { message: 'Invalid KYC webhook signature' });
             }
             const decision = kycAdapter.parseWebhook?.(rawBody, context.request.headers);
             if (decision) {
-                await kyc.reconcile(decision.referenceId, decision.status);
+                // Dedup on a hash of the verbatim delivery bytes, never on referenceId:status.
+                // The vendor-neutral KycResult carries no delivery/event id, so the only
+                // signal that reliably distinguishes "the SAME decision resent" (retry storm
+                // within the vendor's own SLA - collapse it) from "a genuinely NEW decision
+                // that happens to land on a status we've seen before" (eg
+                // rejected -> approved -> rejected again - must run) is the raw body itself:
+                // a true redelivery is byte-identical: a new decision is not. Keying on
+                // referenceId:status instead would give BullMQ's permanent-by-default jobId
+                // dedup (see bullmq-job-queue.ts) a key that legitimately repeats, silently
+                // dropping the later, real decision forever.
+                const idempotencyKey = `kyc-decision-sync:${createHash('sha256').update(rawBody).digest('hex')}`;
+                // Stamped HERE, at webhook-arrival time - never in the job handler - so the
+                // reconcile monotonicity guard has the true delivery order even when the job
+                // queue (which ignores orderingKey) runs two decisions for the same reference
+                // out of order.
+                const receivedAt = new Date().toISOString();
+                await jobQueue.enqueue(kycDecisionSyncQueue, { referenceId: decision.referenceId, status: decision.status, receivedAt }, {
+                    idempotencyKey,
+                    orderingKey: decision.referenceId,
+                    attempts: 5,
+                    backoff: { type: 'exponential', delayMs: 1_000 },
+                });
             }
             return { ok: true };
         }),
+        requestKycResubmission: os.requestKycResubmission.handler(async ({ input, context }) => {
+            const caller = await adminGuard.assert(context, 'compliance', 'override-limit');
+            return mapErrors({ NOT_FOUND: PlayerNotFoundError }, () => kyc.requestResubmission(input.userId, input.reason, caller.userId));
+        }),
+        overrideKycStatus: os.overrideKycStatus.handler(async ({ input, context }) => {
+            const caller = await adminGuard.assert(context, 'compliance', 'override-limit');
+            return mapErrors({ NOT_FOUND: PlayerNotFoundError }, () => kyc.overrideStatus(input.userId, input.status, input.reason, caller.userId));
+        }),
+        bulkApproveKyc: os.bulkApproveKyc.handler(async ({ input, context }) => {
+            const caller = await adminGuard.assert(context, 'compliance', 'override-limit');
+            const results = await kyc.bulkApprove(input.userIds, input.reason, caller.userId);
+            // A per-item failure never reaches overrideStatus, so it leaves no
+            // compliance.kyc.updated trail of its own - record the WHOLE attempted batch here
+            // (every userId, success/failure per item) so a probe of nonexistent ids is still
+            // visible in the audit log even when nothing downstream changed.
+            await audit.record({
+                actorId: caller.userId,
+                actorType: 'admin',
+                action: 'compliance.kyc.bulk_approve',
+                resourceType: 'compliance',
+                resourceId: null,
+                after: { reason: input.reason, results },
+            });
+            return { results };
+        }),
         setPlayerLimit: os.setPlayerLimit.handler(async ({ input, context }) => {
-            const caller = await adminGuard.assert(context, 'compliance', 'manage-rg');
-            return rg.setPlayerLimit(input.userId, input, caller.userId);
+            const { userId, ip, userAgent } = await adminGuard.assert(context, 'compliance', 'manage-rg');
+            return rg.setPlayerLimit(input.userId, input, userId, { ip, userAgent });
         }),
         activateCoolingOff: os.activateCoolingOff.handler(async ({ input, context }) => {
-            const caller = await adminGuard.assert(context, 'compliance', 'manage-rg');
-            return mapErrors({ CONFLICT: ActiveExclusionError }, () => rg.activateCoolingOff(input.userId, input, caller.userId));
+            const { userId, ip, userAgent } = await adminGuard.assert(context, 'compliance', 'manage-rg');
+            return mapErrors({ CONFLICT: ActiveExclusionError }, () => rg.activateCoolingOff(input.userId, input, userId, { ip, userAgent }));
         }),
         activateSelfExclusion: os.activateSelfExclusion.handler(async ({ input, context }) => {
-            const caller = await adminGuard.assert(context, 'compliance', 'manage-rg');
-            return mapErrors({ CONFLICT: ActiveExclusionError }, () => rg.activateSelfExclusion(input.userId, input, caller.userId));
+            const { userId, ip, userAgent } = await adminGuard.assert(context, 'compliance', 'manage-rg');
+            return mapErrors({ CONFLICT: ActiveExclusionError }, () => rg.activateSelfExclusion(input.userId, input, userId, { ip, userAgent }));
         }),
         liftSelfExclusion: os.liftSelfExclusion.handler(async ({ input, context }) => {
-            const caller = await adminGuard.assert(context, 'compliance', 'manage-rg');
+            const { userId, ip, userAgent } = await adminGuard.assert(context, 'compliance', 'manage-rg');
             return mapErrors({
                 NOT_FOUND: ExclusionNotFoundError,
                 CONFLICT: [PermanentExclusionLiftError, ExclusionPeriodNotElapsedError],
-            }, () => rg.liftSelfExclusion(input.userId, input, caller.userId));
+            }, () => rg.liftSelfExclusion(input.userId, input, userId, { ip, userAgent }));
+        }),
+        liftCoolingOff: os.liftCoolingOff.handler(async ({ input, context }) => {
+            const { userId, ip, userAgent } = await adminGuard.assert(context, 'compliance', 'manage-rg');
+            return mapErrors({ NOT_FOUND: ExclusionNotFoundError }, () => rg.liftCoolingOff(input.userId, input, userId, { ip, userAgent }));
         }),
         getRgSection: os.getRgSection.handler(async ({ input, context }) => {
             await adminGuard.assert(context, 'compliance', 'view');