@openora/core 0.4.0 → 0.4.1-canary.100

package/dist/contracts/adapters/rate-limit.js

@@ -1,9 +1,32 @@
-// Rate-limiter seam. Abuse-prone routes (auth flows, money mutations) consume
-// from this adapter so the throttling backend is swappable: the default binding
-// is an in-process fixed-window limiter (zero deps - good for `pnpm dev`, seed
-// and tests), process-local so it does NOT coordinate across replicas. Set
-// REDIS_URL to bind the shipped Redis reference adapter (distributed fixed-window)
-// with zero consumer code; rebind RATE_LIMITER via an overlay for any other backend.
+/**
+ * Rate-limiter seam. Abuse-prone routes (auth flows, money mutations) consume
+ * from this adapter so the throttling backend is swappable: the default binding
+ * is an in-process fixed-window limiter (zero deps - good for `pnpm dev`, seed
+ * and tests), process-local so it does NOT coordinate across replicas. Set
+ * REDIS_URL to bind the shipped Redis reference adapter (distributed fixed-window)
+ * with zero consumer code; rebind RATE_LIMITER via an overlay for any other backend.
+ */
 import { createToken } from './token.js';
+export const RATE_LIMIT_KEYS = {
+    REGISTER: 'register',
+    LOGIN: 'login',
+    ENABLE_2FA: 'enable2fa',
+    VERIFY_2FA: 'verify2fa',
+    DISABLE_2FA: 'disable2fa',
+    PASSWORD_RESET_REQUEST: 'pwreset-req',
+    PASSWORD_RESET_VERIFY: 'pwreset-verify',
+    PASSWORD_RESET: 'pwreset',
+    CHANGE_PASSWORD: 'change-password',
+    EMAIL_VERIFICATION: 'email-verify',
+    VERIFY_EMAIL: 'verify-email',
+    WALLET_MUTATION: 'wallet-mutation',
+    WALLET_WEBHOOK: 'wallet-webhook',
+    CHAT_ROOM_JOIN: 'chat-room-join',
+    CHAT_SEND: 'chat-send',
+    REPORT_ACCESS_DENIED: 'report-access-denied',
+};
+export function makeRateLimitKey(prefix, id) {
+    return `${prefix}:${id}`;
+}
 export const RATE_LIMITER = createToken('RATE_LIMITER');
 //# sourceMappingURL=rate-limit.js.map

package/dist/contracts/adapters/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/contracts/adapters/rate-limit.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,2EAA2E;AAC3E,mFAAmF;AACnF,qFAAqF;AACrF,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAuBrD,MAAM,CAAC,MAAM,YAAY,GAA8B,WAAW,CAAC,cAAc,CAAC,CAAC"}
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/contracts/adapters/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAErD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,WAAW;IACvB,UAAU,EAAE,WAAW;IACvB,WAAW,EAAE,YAAY;IACzB,sBAAsB,EAAE,aAAa;IACrC,qBAAqB,EAAE,gBAAgB;IACvC,cAAc,EAAE,SAAS;IACzB,eAAe,EAAE,iBAAiB;IAClC,kBAAkB,EAAE,cAAc;IAClC,YAAY,EAAE,cAAc;IAC5B,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,SAAS,EAAE,WAAW;IACtB,oBAAoB,EAAE,sBAAsB;CACpC,CAAC;AAMX,MAAM,UAAU,gBAAgB,CAAC,MAA0B,EAAE,EAAU;IACrE,OAAO,GAAG,MAAM,IAAI,EAAE,EAAE,CAAC;AAC3B,CAAC;AA0BD,MAAM,CAAC,MAAM,YAAY,GAA4C,WAAW,CAAC,cAAc,CAAC,CAAC"}

package/dist/contracts/adapters/realtime.d.ts

@@ -1,35 +1,134 @@
+/**
+ * Realtime-transport seam. Client-facing push (live chat messages, PvP round
+ * state, live odds, big-win/jackpot feeds) flows through this adapter, so the
+ * transport is swappable: the default binding is a first-party in-process
+ * fan-out (served to clients as oRPC event-iterators over SSE); a downstream
+ * operator binds a managed transport (Ably / GetStream / PubNub) to
+ * REALTIME_TRANSPORT without touching modules. This realizes ADR-0007's
+ * `ChatTransportPort` as a generic primitive shared across modules - it is NOT
+ * the inter-module MESSAGE_BROKER (ADR-0010 #4 keeps client push separate from
+ * the event broker, which has delivery guarantees/acks). Money and moderation
+ * stay first-party domain logic; they are never delegated to the transport.
+ *
+ * CHAT_REALTIME_TRANSPORT / CHAT_REALTIME_CLIENT_AUTHORIZER are the SAME two
+ * port shapes, scoped to chat only. The chat module defaults them to whatever
+ * REALTIME_TRANSPORT/REALTIME_CLIENT_AUTHORIZER resolve to (so out of the box
+ * chat behaves identically to every other realtime consumer), but an operator
+ * can rebind just the CHAT_-prefixed tokens to run chat on a managed vendor
+ * (eg Ably) while KYC status updates and everything else stay first-party SSE
+ * - the two seams are independently swappable. `chat-commands` shares the SAME
+ * chat channels (gift claims, rain), so it consumes CHAT_REALTIME_TRANSPORT
+ * too, never the generic token.
+ */
 import { type Token } from './token.js';
+/**
+ * Optional presence capability. A first-party transport can offer a simple
+ * connected-member count; managed vendors provide richer presence. Kept optional
+ * (a capability flag, per ADR-0007) so the base port is the common denominator.
+ */
 export type RealtimePresence = {
-    join(channel: string, memberId: string): void;
-    leave(channel: string, memberId: string): void;
-    count(channel: string): number;
+    /**
+     * `connectionId` distinguishes concurrent tabs for the same member. Counts remain
+     * per member, so one tab leaving never marks a user offline while another is active.
+     */
+    join(channel: string, memberId: string, connectionId: string): void;
+    leave(channel: string, memberId: string, connectionId: string): void;
+    count(channel: string): number | Promise<number>;
 };
 export type RealtimeTransport = {
+    /**
+     * Fan a message out to every subscriber of `channel`. Best-effort, at-most-once
+     * for late joiners (the transport is not a system of record - persist first).
+     */
     publish<T>(channel: string, event: T): void | Promise<void>;
-    subscribe<T>(channel: string, handler: (event: T) => void): () => void;
+    /**
+     * Fan out a deletion/tombstone event to the channel. The transport does not
+     * remove persisted data; callers must complete the database mutation first.
+     * SSE and managed transports deliver this through their normal live stream.
+     */
+    remove<T>(channel: string, event: T): void | Promise<void>;
+    /**
+     * Subscribe a handler to a channel. Returns an unsubscribe fn the caller MUST
+     * invoke on teardown (eg an SSE handler on request abort).
+     */
+    subscribe<T>(channel: string, handler: (event: T) => void, clientId?: string): () => void;
+    /** Revoke managed-provider credentials for a client after access is removed. */
+    revokeClient?: (clientId: string) => void | Promise<void>;
+    /** Revoke a managed client's access to one channel without affecting other chats. */
+    revokeClientFromChannel?: (clientId: string, channel: string) => void | Promise<void>;
     presence?: RealtimePresence;
+    /**
+     * Returns the set of authenticated user IDs currently online in `channel`.
+     * Anonymous connections (memberIds beginning with 'anonymous:') are excluded.
+     */
+    getOnlineUserIds(channel: string): Promise<string[]>;
 };
 export declare const REALTIME_TRANSPORT: Token<RealtimeTransport>;
-export type RealtimeConnectionGrant = {
+/** Chat-scoped realtime transport - see the module header comment above. */
+export declare const CHAT_REALTIME_TRANSPORT: Token<RealtimeTransport>;
+/**
+ * Client connection provisioning - the complement to REALTIME_TRANSPORT.
+ *
+ * REALTIME_TRANSPORT is how the SERVER fans a message out. This seam is how a
+ * CLIENT learns to CONNECT and receive. The two models differ by provider:
+ *   - first-party (default): the client pulls from our own API over SSE, so the
+ *     "grant" is just the stream path - no secret, the session cookie authorizes.
+ *   - managed vendor (Ably/GetStream/PubNub): the client connects DIRECTLY to the
+ *     vendor edge, so the backend must mint a per-player, capability-scoped token
+ *     (never ship the vendor API key to the browser). The grant carries that token.
+ * A downstream operator binds this token to its provider's authorizer without any
+ * module change; the chat module just hands the grant to the caller. See ADR-0007.
+ */
+/**
+ * What the client needs to start receiving, tagged by `provider` so a pluggable
+ * client-side adapter can pick the right transport. Open union - a new vendor adds
+ * its own variant without editing core.
+ */
+export type RealtimeConnectionGrant = 
+/** First-party SSE: subscribe by opening this event-iterator path on our API. */
+{
     provider: 'sse';
     streamPath: string;
     channels: string[];
-} | {
+}
+/**
+ * Ably: a signed TokenRequest the browser exchanges for a scoped token, plus the
+ * channels the player may subscribe to. `tokenRequest` is opaque here (the Ably
+ * SDK shape lives in the consumer, not in vendor-neutral core).
+ */
+ | {
     provider: 'ably';
     tokenRequest: unknown;
     channels: string[];
-} | {
+}
+/** Escape hatch for any other vendor (GetStream, PubNub, ...). */
+ | {
     provider: string;
     channels: string[];
     [key: string]: unknown;
 };
 export type RealtimeClientAuthorizerInput = {
+    /**
+     * The authenticated caller; becomes the vendor `clientId` so presence/identity
+     * is bound server-side and cannot be spoofed by the browser.
+     */
     userId: string;
+    /** A stable per-connection id from the client (defaults to userId when absent). */
     clientId: string;
+    /**
+     * The channels the caller is allowed to subscribe to (the module computes these
+     * from the player's access - eg the global channel plus their rooms).
+     */
     channels: string[];
 };
 export type RealtimeClientAuthorizer = {
+    /**
+     * Mint a connection grant for an authenticated caller. Async because a managed
+     * vendor signs a token request over its SDK.
+     */
     issueGrant(input: RealtimeClientAuthorizerInput): RealtimeConnectionGrant | Promise<RealtimeConnectionGrant>;
 };
 export declare const REALTIME_CLIENT_AUTHORIZER: Token<RealtimeClientAuthorizer>;
+/** Chat-scoped client authorizer - see the module header comment above. */
+export declare const CHAT_REALTIME_CLIENT_AUTHORIZER: Token<RealtimeClientAuthorizer>;
 //# sourceMappingURL=realtime.d.ts.map

package/dist/contracts/adapters/realtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/realtime.ts"],"names":[],"mappings":"AAUA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAKrD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAG9B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG5D,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACvE,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAqC,CAAC;AAiB9F,MAAM,MAAM,uBAAuB,GAE/B;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAI3D;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAE/D;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAErE,MAAM,MAAM,6BAA6B,GAAG;IAG1C,MAAM,EAAE,MAAM,CAAC;IAEf,QAAQ,EAAE,MAAM,CAAC;IAGjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAGrC,UAAU,CACR,KAAK,EAAE,6BAA6B,GACnC,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/D,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,KAAK,CAAC,wBAAwB,CAEtE,CAAC"}
+{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/realtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;OAGG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACpE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrE,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D;;;;OAIG;IACH,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;OAGG;IACH,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI,CAAC;IAC1F,gFAAgF;IAChF,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,qFAAqF;IACrF,uBAAuB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAqC,CAAC;AAE9F,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,EAAE,KAAK,CAAC,iBAAiB,CACrB,CAAC;AAEzC;;;;;;;;;;;;GAYG;AAEH;;;;GAIG;AACH,MAAM,MAAM,uBAAuB;AACjC,iFAAiF;AAC/E;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE;AAC7D;;;;GAIG;GACD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE;AACjE,kEAAkE;GAChE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAErE,MAAM,MAAM,6BAA6B,GAAG;IAC1C;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC;;;OAGG;IACH,UAAU,CACR,KAAK,EAAE,6BAA6B,GACnC,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/D,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,KAAK,CAAC,wBAAwB,CAEtE,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,+BAA+B,EAAE,KAAK,CAAC,wBAAwB,CAE3E,CAAC"}

package/dist/contracts/adapters/realtime.js

@@ -1,14 +1,30 @@
-// Realtime-transport seam. Client-facing push (live chat messages, PvP round
-// state, live odds, big-win/jackpot feeds) flows through this adapter, so the
-// transport is swappable: the default binding is a first-party in-process
-// fan-out (served to clients as oRPC event-iterators over SSE); a downstream
-// operator binds a managed transport (Ably / GetStream / PubNub) to
-// REALTIME_TRANSPORT without touching modules. This realizes ADR-0007's
-// `ChatTransportPort` as a generic primitive shared across modules - it is NOT
-// the inter-module MESSAGE_BROKER (ADR-0010 #4 keeps client push separate from
-// the event broker, which has delivery guarantees/acks). Money and moderation
-// stay first-party domain logic; they are never delegated to the transport.
+/**
+ * Realtime-transport seam. Client-facing push (live chat messages, PvP round
+ * state, live odds, big-win/jackpot feeds) flows through this adapter, so the
+ * transport is swappable: the default binding is a first-party in-process
+ * fan-out (served to clients as oRPC event-iterators over SSE); a downstream
+ * operator binds a managed transport (Ably / GetStream / PubNub) to
+ * REALTIME_TRANSPORT without touching modules. This realizes ADR-0007's
+ * `ChatTransportPort` as a generic primitive shared across modules - it is NOT
+ * the inter-module MESSAGE_BROKER (ADR-0010 #4 keeps client push separate from
+ * the event broker, which has delivery guarantees/acks). Money and moderation
+ * stay first-party domain logic; they are never delegated to the transport.
+ *
+ * CHAT_REALTIME_TRANSPORT / CHAT_REALTIME_CLIENT_AUTHORIZER are the SAME two
+ * port shapes, scoped to chat only. The chat module defaults them to whatever
+ * REALTIME_TRANSPORT/REALTIME_CLIENT_AUTHORIZER resolve to (so out of the box
+ * chat behaves identically to every other realtime consumer), but an operator
+ * can rebind just the CHAT_-prefixed tokens to run chat on a managed vendor
+ * (eg Ably) while KYC status updates and everything else stay first-party SSE
+ * - the two seams are independently swappable. `chat-commands` shares the SAME
+ * chat channels (gift claims, rain), so it consumes CHAT_REALTIME_TRANSPORT
+ * too, never the generic token.
+ */
 import { createToken } from './token.js';
 export const REALTIME_TRANSPORT = createToken('REALTIME_TRANSPORT');
+/** Chat-scoped realtime transport - see the module header comment above. */
+export const CHAT_REALTIME_TRANSPORT = createToken('CHAT_REALTIME_TRANSPORT');
 export const REALTIME_CLIENT_AUTHORIZER = createToken('REALTIME_CLIENT_AUTHORIZER');
+/** Chat-scoped client authorizer - see the module header comment above. */
+export const CHAT_REALTIME_CLIENT_AUTHORIZER = createToken('CHAT_REALTIME_CLIENT_AUTHORIZER');
 //# sourceMappingURL=realtime.js.map

package/dist/contracts/adapters/realtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"realtime.js","sourceRoot":"","sources":["../../../src/contracts/adapters/realtime.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,oEAAoE;AACpE,wEAAwE;AACxE,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAqBrD,MAAM,CAAC,MAAM,kBAAkB,GAA6B,WAAW,CAAC,oBAAoB,CAAC,CAAC;AA8C9F,MAAM,CAAC,MAAM,0BAA0B,GAAoC,WAAW,CACpF,4BAA4B,CAC7B,CAAC"}
+{"version":3,"file":"realtime.js","sourceRoot":"","sources":["../../../src/contracts/adapters/realtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AA8CrD,MAAM,CAAC,MAAM,kBAAkB,GAA6B,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAE9F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAClC,WAAW,CAAC,yBAAyB,CAAC,CAAC;AA0DzC,MAAM,CAAC,MAAM,0BAA0B,GAAoC,WAAW,CACpF,4BAA4B,CAC7B,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,+BAA+B,GAAoC,WAAW,CACzF,iCAAiC,CAClC,CAAC"}

package/dist/contracts/adapters/rng.d.ts

@@ -1,3 +1,14 @@
+/**
+ * Random number generator seam. For dev / demo / non-certified game contexts.
+ *
+ * IMPORTANT: production game outcomes are governed by the SEALED
+ * `GAME_OUTCOME_AUTHORITY` token in `@openora/core/compliance` (regulator
+ * mandate - GLI / eCOGRA / BMM / iTechLabs). `RNG_ADAPTER` is NOT a substitute
+ * for a lab-certified RGS. Use this seam to swap deterministic mocks in tests,
+ * to plug in a seedable provider for replay debugging, or to back demo games
+ * that never resolve real money. Real-money RTP must flow through the sealed
+ * authority.
+ */
 import { type Token } from './token.js';
 export type RngAdapter = {
     /** Uniform float in [0, 1). */

package/dist/contracts/adapters/rng.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rng.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/rng.ts"],"names":[],"mappings":"AASA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG;IACvB,+BAA+B;IAC/B,SAAS,IAAI,MAAM,CAAC;IACpB,8CAA8C;IAC9C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACnD,qFAAqF;IACrF,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC"}
+{"version":3,"file":"rng.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/rng.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG;IACvB,+BAA+B;IAC/B,SAAS,IAAI,MAAM,CAAC;IACpB,8CAA8C;IAC9C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACnD,qFAAqF;IACrF,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC"}

package/dist/contracts/adapters/rng.js

@@ -1,12 +1,14 @@
-// Random number generator seam. For dev / demo / non-certified game contexts.
-//
-// IMPORTANT: production game outcomes are governed by the SEALED
-// `GAME_OUTCOME_AUTHORITY` token in `@openora/core/compliance` (regulator
-// mandate - GLI / eCOGRA / BMM / iTechLabs). `RNG_ADAPTER` is NOT a substitute
-// for a lab-certified RGS. Use this seam to swap deterministic mocks in tests,
-// to plug in a seedable provider for replay debugging, or to back demo games
-// that never resolve real money. Real-money RTP must flow through the sealed
-// authority.
+/**
+ * Random number generator seam. For dev / demo / non-certified game contexts.
+ *
+ * IMPORTANT: production game outcomes are governed by the SEALED
+ * `GAME_OUTCOME_AUTHORITY` token in `@openora/core/compliance` (regulator
+ * mandate - GLI / eCOGRA / BMM / iTechLabs). `RNG_ADAPTER` is NOT a substitute
+ * for a lab-certified RGS. Use this seam to swap deterministic mocks in tests,
+ * to plug in a seedable provider for replay debugging, or to back demo games
+ * that never resolve real money. Real-money RTP must flow through the sealed
+ * authority.
+ */
 import { createToken } from './token.js';
 export const RNG_ADAPTER = createToken('RNG_ADAPTER');
 //# sourceMappingURL=rng.js.map

package/dist/contracts/adapters/rng.js.map

@@ -1 +1 @@
-{"version":3,"file":"rng.js","sourceRoot":"","sources":["../../../src/contracts/adapters/rng.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,iEAAiE;AACjE,0EAA0E;AAC1E,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,aAAa;AACb,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAWrD,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC"}
+{"version":3,"file":"rng.js","sourceRoot":"","sources":["../../../src/contracts/adapters/rng.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAWrD,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC"}

package/dist/contracts/adapters/sms.d.ts

@@ -0,0 +1,15 @@
+/**
+ * SMS delivery seam. The phone-login OTP flow sends codes through this adapter so the
+ * transport is swappable: the platform default (bound in identity/plugin.ts) is a
+ * log-to-stdout mock, safe for dev/stage. A consumer overlay rebinds SMS_ADAPTER to a
+ * real vendor (Twilio, AWS SNS) in production. See AGENTS.md "third-party integration".
+ */
+import { type Token } from './token.js';
+export type SmsAdapter = {
+    sendOtp(params: {
+        to: string;
+        code: string;
+    }): Promise<void>;
+};
+export declare const SMS_ADAPTER: Token<SmsAdapter>;
+//# sourceMappingURL=sms.d.ts.map

package/dist/contracts/adapters/sms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sms.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/sms.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC"}

package/dist/contracts/adapters/sms.js

@@ -0,0 +1,9 @@
+/**
+ * SMS delivery seam. The phone-login OTP flow sends codes through this adapter so the
+ * transport is swappable: the platform default (bound in identity/plugin.ts) is a
+ * log-to-stdout mock, safe for dev/stage. A consumer overlay rebinds SMS_ADAPTER to a
+ * real vendor (Twilio, AWS SNS) in production. See AGENTS.md "third-party integration".
+ */
+import { createToken } from './token.js';
+export const SMS_ADAPTER = createToken('SMS_ADAPTER');
+//# sourceMappingURL=sms.js.map

package/dist/contracts/adapters/sms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sms.js","sourceRoot":"","sources":["../../../src/contracts/adapters/sms.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAMrD,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC"}

package/dist/contracts/adapters/social-commands.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Social command port: chat's blockUser() dissolves any active friendship on the
+ * caller's own tx, so the dissolve is atomic with the block. ADR-0017.
+ */
+import { type Token } from './token.js';
+import type { DomainEventPayload } from '../schemas/events.js';
+export type SocialCommands = {
+    dissolveFriendshipOnBlock(tx: unknown, blockerId: string, blockedId: string): Promise<FriendshipDissolvedPayload | null>;
+};
+export type FriendshipDissolvedPayload = DomainEventPayload<'social.friendship.removed'>;
+export declare const SOCIAL_COMMANDS: Token<SocialCommands>;
+//# sourceMappingURL=social-commands.d.ts.map

package/dist/contracts/adapters/social-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"social-commands.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/social-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,MAAM,MAAM,cAAc,GAAG;IAC3B,yBAAyB,CACvB,EAAE,EAAE,OAAO,EACX,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;AAEzF,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,cAAc,CAAkC,CAAC"}

package/dist/contracts/adapters/social-commands.js

@@ -0,0 +1,7 @@
+/**
+ * Social command port: chat's blockUser() dissolves any active friendship on the
+ * caller's own tx, so the dissolve is atomic with the block. ADR-0017.
+ */
+import { createToken } from './token.js';
+export const SOCIAL_COMMANDS = createToken('SOCIAL_COMMANDS');
+//# sourceMappingURL=social-commands.js.map

package/dist/contracts/adapters/social-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"social-commands.js","sourceRoot":"","sources":["../../../src/contracts/adapters/social-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAarD,MAAM,CAAC,MAAM,eAAe,GAA0B,WAAW,CAAC,iBAAiB,CAAC,CAAC"}

package/dist/contracts/adapters/tag-evaluation-commands.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Tag-evaluation command port: wallet's withdraw() calls this synchronously, on its own
+ * transaction handle, so a withdrawal_review assignment is guaranteed to commit before
+ * maybeAutoApprove reads risk tags - closing the race an unawaited EventBus emit alone
+ * leaves open (`wallet.withdrawal.requested` is still fired for other consumers, but
+ * auto-approval's money decision must never depend on that fire-and-forget fan-out; see
+ * messaging-and-microservices "money never flows over events"). Mirrors the WALLET_COMMANDS
+ * command-port idiom (ADR-0017): `tx: unknown` so the caller's transaction handle threads
+ * through without either side importing the other's DB module.
+ */
+import { type Token } from './token.js';
+export type TagEvaluationWithdrawalRequestedArgs = {
+    userId: string;
+    amount: string;
+};
+export type TagEvaluationCommands = {
+    evaluateWithdrawalRequested(tx: unknown, args: TagEvaluationWithdrawalRequestedArgs): Promise<void>;
+};
+export declare const TAG_EVALUATION_COMMANDS: Token<TagEvaluationCommands>;
+//# sourceMappingURL=tag-evaluation-commands.d.ts.map

package/dist/contracts/adapters/tag-evaluation-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tag-evaluation-commands.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/tag-evaluation-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,oCAAoC,GAAG;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,2BAA2B,CACzB,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,oCAAoC,GACzC,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,KAAK,CAAC,qBAAqB,CACzB,CAAC"}

package/dist/contracts/adapters/tag-evaluation-commands.js

@@ -0,0 +1,13 @@
+/**
+ * Tag-evaluation command port: wallet's withdraw() calls this synchronously, on its own
+ * transaction handle, so a withdrawal_review assignment is guaranteed to commit before
+ * maybeAutoApprove reads risk tags - closing the race an unawaited EventBus emit alone
+ * leaves open (`wallet.withdrawal.requested` is still fired for other consumers, but
+ * auto-approval's money decision must never depend on that fire-and-forget fan-out; see
+ * messaging-and-microservices "money never flows over events"). Mirrors the WALLET_COMMANDS
+ * command-port idiom (ADR-0017): `tx: unknown` so the caller's transaction handle threads
+ * through without either side importing the other's DB module.
+ */
+import { createToken } from './token.js';
+export const TAG_EVALUATION_COMMANDS = createToken('TAG_EVALUATION_COMMANDS');
+//# sourceMappingURL=tag-evaluation-commands.js.map

package/dist/contracts/adapters/tag-evaluation-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tag-evaluation-commands.js","sourceRoot":"","sources":["../../../src/contracts/adapters/tag-evaluation-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAcrD,MAAM,CAAC,MAAM,uBAAuB,GAClC,WAAW,CAAC,yBAAyB,CAAC,CAAC"}

package/dist/contracts/adapters/token.d.ts

@@ -1,10 +1,33 @@
-export type AnyToken<T> = symbol & {
+/**
+ * Typed DI token. A token is a plain Symbol at runtime; the phantom `__token`
+ * field only carries the resolved type so the composition container can infer
+ * what `container.get(TOKEN)` returns. No decorators, no reflection - the type
+ * travels with the symbol. See @openora/core/server `Container`.
+ */
+/**
+ * Common shape both Token and SealedToken share - what Container itself accepts.
+ * Container is a type-erased-at-runtime symbol map; it doesn't care whether a
+ * token is sealed, only ModuleRegistry.provide()/provideSealed() do.
+ */
+export type AnyToken<T, K extends string = string> = symbol & {
     readonly __token?: T;
+    readonly __key?: K;
 };
-export type Token<T> = AnyToken<T> & {
+export type TokenCatalogValues = Record<string, unknown>;
+export type TokenCatalog<Values extends TokenCatalogValues = TokenCatalogValues> = {
+    [K in keyof Values]: AnyToken<Values[K]>;
+};
+export type TokenValue<T> = T extends AnyToken<infer Value> ? Value : never;
+/**
+ * The `__sealed?: never` brand makes Token<T> structurally incompatible with
+ * SealedToken<T> (which has `__sealed: true`). That mismatch is what lets the
+ * `provide<T>(token: Token<T>, ...)` signature reject sealed tokens at the
+ * call site - see SealedToken below.
+ */
+export type Token<T, K extends string = string> = AnyToken<T, K> & {
     readonly __sealed?: never;
 };
-export declare function createToken<T>(description: string): Token<T>;
+export declare function createToken<T, const K extends string = string>(key: K): Token<T, K>;
 /**
  * A sealed token represents a regulator-mandated service operators must NEVER
  * override (self-exclusion enforcement, AML/SAR audit log writes, ledger writes,
@@ -22,10 +45,10 @@ export declare function createToken<T>(description: string): Token<T>;
  * See `@openora/core/compliance` for the canonical list and the regulatory
  * citation per token.
  */
-export type SealedToken<T> = AnyToken<T> & {
+export type SealedToken<T, K extends string = string> = AnyToken<T, K> & {
     readonly __sealed: true;
 };
-export declare function createSealedToken<T>(description: string): SealedToken<T>;
+export declare function createSealedToken<T, const K extends string = string>(key: K): SealedToken<T, K>;
 /**
  * A page override token lets a plugin replace an entire client-side page
  * via `ctx.provide(ADMIN_USERS_PAGE, MyImpl)`. The phantom type tracks the

package/dist/contracts/adapters/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/token.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;CAAE,CAAC;AAM5D,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAEnE,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAE5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG;IACzC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAExE;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,GAAG;IAClD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;CAC7B,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,CAAC,GAAG,OAAO,EAAE,WAAW,EAAE,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAE1F"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/token.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,MAAM,GAAG;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEzD,MAAM,MAAM,YAAY,CAAC,MAAM,SAAS,kBAAkB,GAAG,kBAAkB,IAAI;KAChF,CAAC,IAAI,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,MAAM,KAAK,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;CAC3B,CAAC;AAEF,wBAAgB,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAEnF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;IACvE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAE/F;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,GAAG;IAClD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;CAC7B,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,CAAC,GAAG,OAAO,EAAE,WAAW,EAAE,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAE1F"}

package/dist/contracts/adapters/token.js

@@ -1,12 +1,14 @@
-// Typed DI token. A token is a plain Symbol at runtime; the phantom `__token`
-// field only carries the resolved type so the composition container can infer
-// what `container.get(TOKEN)` returns. No decorators, no reflection - the type
-// travels with the symbol. See @openora/core/server `Container`.
-export function createToken(description) {
-    return Symbol(description);
+/**
+ * Typed DI token. A token is a plain Symbol at runtime; the phantom `__token`
+ * field only carries the resolved type so the composition container can infer
+ * what `container.get(TOKEN)` returns. No decorators, no reflection - the type
+ * travels with the symbol. See @openora/core/server `Container`.
+ */
+export function createToken(key) {
+    return Symbol(key);
 }
-export function createSealedToken(description) {
-    return Symbol(`sealed:${description}`);
+export function createSealedToken(key) {
+    return Symbol(`sealed:${key}`);
 }
 export function createClientPageToken(description) {
     return Symbol(`page:${description}`);

package/dist/contracts/adapters/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/contracts/adapters/token.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,iEAAiE;AAajE,MAAM,UAAU,WAAW,CAAI,WAAmB;IAChD,OAAO,MAAM,CAAC,WAAW,CAAa,CAAC;AACzC,CAAC;AAuBD,MAAM,UAAU,iBAAiB,CAAI,WAAmB;IACtD,OAAO,MAAM,CAAC,UAAU,WAAW,EAAE,CAAmB,CAAC;AAC3D,CAAC;AAgBD,MAAM,UAAU,qBAAqB,CAAc,WAAmB;IACpE,OAAO,MAAM,CAAC,QAAQ,WAAW,EAAE,CAAuB,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/contracts/adapters/token.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA8BH,MAAM,UAAU,WAAW,CAAqC,GAAM;IACpE,OAAO,MAAM,CAAC,GAAG,CAAgB,CAAC;AACpC,CAAC;AAuBD,MAAM,UAAU,iBAAiB,CAAqC,GAAM;IAC1E,OAAO,MAAM,CAAC,UAAU,GAAG,EAAE,CAAsB,CAAC;AACtD,CAAC;AAgBD,MAAM,UAAU,qBAAqB,CAAc,WAAmB;IACpE,OAAO,MAAM,CAAC,QAAQ,WAAW,EAAE,CAAuB,CAAC;AAC7D,CAAC"}

package/dist/contracts/adapters/wallet-asset-catalog.d.ts

@@ -0,0 +1,34 @@
+/**
+ * One operator-configured (currency, network) pair the platform accepts deposits for or
+ * pays withdrawals out of. Rows are editable at runtime from the admin surface, so this
+ * is config rather than code: adding a currency is not a deploy.
+ */
+export type WalletAsset = {
+    currency: string;
+    network: string;
+    /**
+     * The bound payment vendor's own identifier for this asset (eg a custody vendor's
+     * `USDT_ERC20`). Opaque - the wallet module stores and returns it, never parses it,
+     * so a different vendor's identifier scheme needs no core change.
+     */
+    providerAssetId: string;
+    minDeposit: string;
+    minWithdrawal: string;
+    withdrawalFee: string;
+    depositEnabled: boolean;
+    withdrawalEnabled: boolean;
+};
+/**
+ * Read side of the asset catalog, for an adapter that needs the operator's asset table
+ * without importing wallet internals.
+ *
+ * Unlike most ports here, the wallet module binds a DB-backed default implementation to
+ * this token itself (as with `CACHE`/`RATE_LIMITER`), so an operator gets a working
+ * catalog with no wiring; rebinding it is possible but not required.
+ */
+export type WalletAssetCatalog = {
+    list(): Promise<WalletAsset[]>;
+    get(currency: string, network: string): Promise<WalletAsset | null>;
+};
+export declare const WALLET_ASSET_CATALOG: import("./token.js").Token<WalletAssetCatalog, string>;
+//# sourceMappingURL=wallet-asset-catalog.d.ts.map

package/dist/contracts/adapters/wallet-asset-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-asset-catalog.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/wallet-asset-catalog.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACrE,CAAC;AAEF,eAAO,MAAM,oBAAoB,wDAA0D,CAAC"}

package/dist/contracts/adapters/wallet-asset-catalog.js

@@ -0,0 +1,3 @@
+import { createToken } from './token.js';
+export const WALLET_ASSET_CATALOG = createToken('WALLET_ASSET_CATALOG');
+//# sourceMappingURL=wallet-asset-catalog.js.map

package/dist/contracts/adapters/wallet-asset-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-asset-catalog.js","sourceRoot":"","sources":["../../../src/contracts/adapters/wallet-asset-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAoCzC,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAqB,sBAAsB,CAAC,CAAC"}

package/dist/contracts/adapters/wallet-commands.d.ts

@@ -1,25 +1,36 @@
+/**
+ * Wallet command port: another module moves money on the caller's own `tx`, so the move is
+ * atomic with the caller's writes yet the modules stay decoupled and independently extractable. ADR-0017.
+ */
 import type { WalletTransactionType } from '../schemas/wallet-tx.js';
 import { type Token } from './token.js';
 export type WalletDebitArgs = {
     userId: string;
-    amount: number;
+    amount: string;
     type: WalletTransactionType;
 };
 export type WalletDebitOutcome = {
     ok: true;
-    newBalance: number;
+    newBalance: string;
+    currency: string;
+    completedBonusCredits?: Array<{
+        id: string;
+        currency: string;
+        creditedAmount: string;
+    }>;
 } | {
     ok: false;
-    available: number;
+    available: string;
 };
 export type WalletCreditArgs = {
     userId: string;
-    amount: number;
+    amount: string;
+    currency: string;
     type: WalletTransactionType;
 };
 export type WalletCreditOutcome = {
     ok: true;
-    newBalance: number;
+    newBalance: string;
 } | {
     ok: false;
     reason: string;

package/dist/contracts/adapters/wallet-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wallet-commands.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/wallet-commands.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,qBAAqB,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,qBAAqB,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnG,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC3E,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,cAAc,CAAkC,CAAC"}
+{"version":3,"file":"wallet-commands.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/wallet-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,qBAAqB,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,qBAAqB,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnG,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC3E,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,cAAc,CAAkC,CAAC"}

package/dist/contracts/adapters/wallet-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"wallet-commands.js","sourceRoot":"","sources":["../../../src/contracts/adapters/wallet-commands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAyBrD,MAAM,CAAC,MAAM,eAAe,GAA0B,WAAW,CAAC,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"wallet-commands.js","sourceRoot":"","sources":["../../../src/contracts/adapters/wallet-commands.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AA+BrD,MAAM,CAAC,MAAM,eAAe,GAA0B,WAAW,CAAC,iBAAiB,CAAC,CAAC"}