@openora/core 0.4.0

package/dist/compliance/schema/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/compliance/schema/index.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,qBAAqB,2IAAkD,CAAC;AACrF,eAAO,MAAM,cAAc,sFAA+C,CAAC;AAC3E,eAAO,MAAM,eAAe,yEAA+C,CAAC;AAC5E,eAAO,MAAM,iBAAiB,uEAAoD,CAAC;AACnF,eAAO,MAAM,UAAU,kGAAwC,CAAC;AAChE,eAAO,MAAM,YAAY,6DAA6C,CAAC;AAEvE,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBrB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKlB,CAAC;AAGH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0B3B,CAAC;AAKF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BvB,CAAC;AAIF,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBlB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,YAAY,CAAC;AACtD,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,YAAY,CAAC;AAClD,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,YAAY,CAAC;AAClE,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,YAAY,CAAC;AAC1D,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,YAAY,CAAC"}

package/dist/compliance/schema/index.js

@@ -0,0 +1,104 @@
+import { sql } from 'drizzle-orm';
+import { pgTable, pgEnum, uuid, text, real, boolean, decimal, jsonb, timestamp, uniqueIndex, index, } from 'drizzle-orm/pg-core';
+import { KYC_STATUSES, EXCLUSION_KINDS, EXCLUSION_STATUSES, RG_FLAG_TYPES, RG_FLAG_STATUSES, } from '@openora/core/contracts';
+import { KYC_TRIGGERED_BY } from '../contract/enums.js';
+export const kycVerificationStatus = pgEnum('kyc_verification_status', KYC_STATUSES);
+export const kycTriggeredBy = pgEnum('kyc_triggered_by', KYC_TRIGGERED_BY);
+export const rgExclusionKind = pgEnum('rg_exclusion_kind', EXCLUSION_KINDS);
+export const rgExclusionStatus = pgEnum('rg_exclusion_status', EXCLUSION_STATUSES);
+export const rgFlagType = pgEnum('rg_flag_type', RG_FLAG_TYPES);
+export const rgFlagStatus = pgEnum('rg_flag_status', RG_FLAG_STATUSES);
+export const userLimit = pgTable('user_limit', {
+    id: uuid().primaryKey().defaultRandom(),
+    userId: uuid().notNull(),
+    type: text().notNull(),
+    amount: real().notNull(),
+    period: text().notNull(),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp({ withTimezone: true })
+        .notNull()
+        .$onUpdateFn(() => new Date()),
+}, (t) => [
+    uniqueIndex('user_limit_user_id_type_period_key').on(t.userId, t.type, t.period),
+    index('user_limit_user_id_idx').on(t.userId),
+]);
+export const geoRule = pgTable('geo_rule', {
+    id: uuid().primaryKey().defaultRandom(),
+    countryCode: text().notNull().unique('geo_rule_country_code_unique'),
+    action: text().notNull(),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+});
+// Append-only history: the player's current verification is the latest row by createdAt.
+export const kycVerification = pgTable('kyc_verification', {
+    id: uuid().primaryKey().defaultRandom(),
+    userId: uuid().notNull(),
+    provider: text().notNull(),
+    referenceId: text().notNull(),
+    status: kycVerificationStatus().notNull(),
+    documentTypes: jsonb().$type().notNull().default([]),
+    decisionReason: text(),
+    triggeredBy: kycTriggeredBy().notNull(),
+    // High-water mark of deposits at the last reverify_threshold fire, so re-KYC triggers
+    // once per fresh threshold band rather than on every deposit.
+    triggerDeposits: decimal({ precision: 18, scale: 2 }),
+    submittedAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    decidedAt: timestamp({ withTimezone: true }),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp({ withTimezone: true })
+        .notNull()
+        .$onUpdateFn(() => new Date()),
+}, (t) => [
+    index('kyc_verification_user_id_created_at_idx').on(t.userId, t.createdAt),
+    index('kyc_verification_reference_id_idx').on(t.referenceId),
+    index('kyc_verification_status_idx').on(t.status),
+]);
+// Cooling-off + self-exclusion. The partial-unique on (userId, kind) WHERE active
+// guarantees at most one open exclusion of each kind per player. Auto-expiry is by
+// the login gate comparing `now >= expiresAt`, not a background job.
+export const rgExclusion = pgTable('rg_exclusion', {
+    id: uuid().primaryKey().defaultRandom(),
+    userId: uuid().notNull(),
+    kind: rgExclusionKind().notNull(),
+    status: rgExclusionStatus().notNull().default('active'),
+    reason: text().notNull(),
+    permanent: boolean().notNull().default(false),
+    startsAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp({ withTimezone: true }),
+    liftedAt: timestamp({ withTimezone: true }),
+    liftedReason: text(),
+    liftedBy: uuid(),
+    createdBy: uuid().notNull(),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp({ withTimezone: true })
+        .notNull()
+        .$onUpdateFn(() => new Date()),
+}, (t) => [
+    index('rg_exclusion_user_id_idx').on(t.userId),
+    index('rg_exclusion_user_id_status_idx').on(t.userId, t.status),
+    index('rg_exclusion_kind_status_idx').on(t.kind, t.status),
+    uniqueIndex('rg_exclusion_active_kind_key')
+        .on(t.userId, t.kind)
+        .where(sql `${t.status} = 'active'`),
+]);
+// Monitoring flags surfaced in the back-office. The worker dedupes app-side per
+// (userId, flagType, limitType) - no DB unique because limitType is nullable.
+export const rgFlag = pgTable('rg_flag', {
+    id: uuid().primaryKey().defaultRandom(),
+    userId: uuid().notNull(),
+    flagType: rgFlagType().notNull(),
+    limitType: text(),
+    // Every insert path (raiseFlag) passes detail explicitly; the DB default is a bare
+    // '{}' safety net only, so it's raw SQL rather than a value typed as RgFlagDetail.
+    detail: jsonb()
+        .$type()
+        .notNull()
+        .default(sql `'{}'::jsonb`),
+    status: rgFlagStatus().notNull().default('active'),
+    flaggedAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    clearedAt: timestamp({ withTimezone: true }),
+}, (t) => [
+    index('rg_flag_status_flagged_at_idx').on(t.status, t.flaggedAt),
+    index('rg_flag_user_id_idx').on(t.userId),
+    index('rg_flag_flag_type_idx').on(t.flagType),
+]);
+//# sourceMappingURL=index.js.map

package/dist/compliance/schema/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/compliance/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,OAAO,EACP,KAAK,EACL,SAAS,EACT,WAAW,EACX,KAAK,GACN,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAsB,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAG5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;AACnF,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAC9B,YAAY,EACZ;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACtB,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,WAAW,CAAC,oCAAoC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAChF,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAC7C,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE;IACzC,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,8BAA8B,CAAC;IACpE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACpE,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CACpC,kBAAkB,EAClB;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC7B,MAAM,EAAE,qBAAqB,EAAE,CAAC,OAAO,EAAE;IACzC,aAAa,EAAE,KAAK,EAAE,CAAC,KAAK,EAAyC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3F,cAAc,EAAE,IAAI,EAAE;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC,OAAO,EAAE;IACvC,sFAAsF;IACtF,8DAA8D;IAC9D,eAAe,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACrE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5C,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,yCAAyC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;IAC1E,KAAK,CAAC,mCAAmC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IAC5D,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAClD,CACF,CAAC;AAEF,kFAAkF;AAClF,mFAAmF;AACnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAChC,cAAc,EACd;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,IAAI,EAAE,eAAe,EAAE,CAAC,OAAO,EAAE;IACjC,MAAM,EAAE,iBAAiB,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvD,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,SAAS,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,QAAQ,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IAClE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5C,QAAQ,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3C,YAAY,EAAE,IAAI,EAAE;IACpB,QAAQ,EAAE,IAAI,EAAE;IAChB,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC3B,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,CAAC,iCAAiC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;IAC/D,KAAK,CAAC,8BAA8B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC1D,WAAW,CAAC,8BAA8B,CAAC;SACxC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;SACpB,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,aAAa,CAAC;CACtC,CACF,CAAC;AAEF,gFAAgF;AAChF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,MAAM,GAAG,OAAO,CAC3B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,QAAQ,EAAE,UAAU,EAAE,CAAC,OAAO,EAAE;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,mFAAmF;IACnF,mFAAmF;IACnF,MAAM,EAAE,KAAK,EAAE;SACZ,KAAK,EAAgB;SACrB,OAAO,EAAE;SACT,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC;IAC5B,MAAM,EAAE,YAAY,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;CAC7C,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;IAChE,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;CAC9C,CACF,CAAC"}

package/dist/compliance/sealed.d.ts

@@ -0,0 +1,74 @@
+import { type SealedToken } from '@openora/core/contracts';
+/**
+ * Self-exclusion + cool-off enforcement.
+ *
+ * UKGC LCCP Social Responsibility Code 3.5.3 / MGA Player Protection Directive /
+ * SE Spelinspektionen / DE GlüStV. Operators may not soften a self-excluded
+ * player's access to the platform.
+ */
+export declare const RG_SELF_EXCLUSION_SERVICE: SealedToken<unknown>;
+/**
+ * National self-exclusion register checks (cross-operator).
+ *
+ * UKGC GamStop, SE Spelpaus, DE OASIS, DK ROFUS. The central API call may not
+ * be stubbed or mocked away.
+ */
+export declare const NATIONAL_SE_REGISTRY: SealedToken<unknown>;
+/**
+ * AML transaction monitoring + SAR/STR write trail.
+ *
+ * FATF Recommendations (casino sector) / 5AMLD. Immutable, append-only,
+ * time-stamped.
+ */
+export declare const AML_SAR_WRITER: SealedToken<unknown>;
+/**
+ * Wallet / ledger writes.
+ *
+ * Double-entry money movement. Adjustments go through a sealed `manualAdjust`
+ * service with reason + approver - no direct ledger write from a plugin.
+ */
+export declare const LEDGER_WRITER: SealedToken<unknown>;
+/**
+ * Game round outcome / RNG / RTP.
+ *
+ * RGS / lab-certified (GLI, eCOGRA, BMM, iTechLabs). Operators cannot alter
+ * outcomes, payouts, or RTP from the backoffice.
+ */
+export declare const GAME_OUTCOME_AUTHORITY: SealedToken<unknown>;
+/**
+ * Bonus wagering math.
+ *
+ * Operators configure parameters (rollover multiplier, contribution per game,
+ * expiry); the calculation engine is sealed - regulators ask to see the
+ * formula and there must be one canonical impl.
+ */
+export declare const BONUS_WAGERING_ENGINE: SealedToken<unknown>;
+/**
+ * RG limit-increase cooling timer.
+ *
+ * UKGC customer-interaction guidance (24h cool-off on UK deposit limit
+ * increases) / DE GlüStV (7d). Operators cannot bypass the timer.
+ */
+export declare const RG_LIMIT_COOLING_TIMER: SealedToken<unknown>;
+/**
+ * Age verification gate.
+ *
+ * Cannot be conditionally skipped by a plugin.
+ */
+export declare const AGE_VERIFICATION_GATE: SealedToken<unknown>;
+/**
+ * Geo-blocking platform-level deny.
+ *
+ * Operators can add jurisdictions to deny; they cannot remove a platform-level
+ * deny (eg US, sanctions list - OFAC, EU restrictive measures).
+ */
+export declare const GEO_PLATFORM_DENY_LIST: SealedToken<unknown>;
+/**
+ * GDPR Art. 15 / 17 player data export + right-to-be-forgotten workflow.
+ *
+ * Operators may add steps (eg additional internal review) but may not remove.
+ */
+export declare const GDPR_DATA_RIGHTS_WORKFLOW: SealedToken<unknown>;
+export declare const SEALED_TOKENS: readonly SealedToken<unknown>[];
+export declare const IMPLEMENTED_SEALED_TOKENS: readonly SealedToken<unknown>[];
+//# sourceMappingURL=sealed.d.ts.map

package/dist/compliance/sealed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed.d.ts","sourceRoot":"","sources":["../../src/compliance/sealed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE5F;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,OAAO,CAE1D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,OAAO,CAErD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,OAAO,CAAuC,CAAC;AAExF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,OAAO,CAAsC,CAAC;AAOtF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,OAAO,CACX,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,OAAO,CACX,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,OAAO,CACX,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,OAAO,CACX,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,OAAO,CACX,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,OAAO,CAE1D,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,CAAC,OAAO,CAAC,EAYxD,CAAC;AAQF,eAAO,MAAM,yBAAyB,EAAE,SAAS,WAAW,CAAC,OAAO,CAAC,EAAmB,CAAC"}

package/dist/compliance/sealed.js

@@ -0,0 +1,96 @@
+import { AUDIT_WRITER, createSealedToken } from '@openora/core/contracts';
+/**
+ * Self-exclusion + cool-off enforcement.
+ *
+ * UKGC LCCP Social Responsibility Code 3.5.3 / MGA Player Protection Directive /
+ * SE Spelinspektionen / DE GlüStV. Operators may not soften a self-excluded
+ * player's access to the platform.
+ */
+export const RG_SELF_EXCLUSION_SERVICE = createSealedToken('rg-self-exclusion-service');
+/**
+ * National self-exclusion register checks (cross-operator).
+ *
+ * UKGC GamStop, SE Spelpaus, DE OASIS, DK ROFUS. The central API call may not
+ * be stubbed or mocked away.
+ */
+export const NATIONAL_SE_REGISTRY = createSealedToken('national-self-exclusion-registry');
+/**
+ * AML transaction monitoring + SAR/STR write trail.
+ *
+ * FATF Recommendations (casino sector) / 5AMLD. Immutable, append-only,
+ * time-stamped.
+ */
+export const AML_SAR_WRITER = createSealedToken('aml-sar-writer');
+/**
+ * Wallet / ledger writes.
+ *
+ * Double-entry money movement. Adjustments go through a sealed `manualAdjust`
+ * service with reason + approver - no direct ledger write from a plugin.
+ */
+export const LEDGER_WRITER = createSealedToken('ledger-writer');
+// AUDIT_WRITER (append-only, content-hashed audit log; plugins emit events, the
+// platform writes the log entries) is defined and bound as a SealedToken directly
+// at `@openora/core/contracts` `adapters/audit.ts` - re-exported here as part of
+// the canonical sealed list rather than declared as a second, parallel identity.
+/**
+ * Game round outcome / RNG / RTP.
+ *
+ * RGS / lab-certified (GLI, eCOGRA, BMM, iTechLabs). Operators cannot alter
+ * outcomes, payouts, or RTP from the backoffice.
+ */
+export const GAME_OUTCOME_AUTHORITY = createSealedToken('game-outcome-authority');
+/**
+ * Bonus wagering math.
+ *
+ * Operators configure parameters (rollover multiplier, contribution per game,
+ * expiry); the calculation engine is sealed - regulators ask to see the
+ * formula and there must be one canonical impl.
+ */
+export const BONUS_WAGERING_ENGINE = createSealedToken('bonus-wagering-engine');
+/**
+ * RG limit-increase cooling timer.
+ *
+ * UKGC customer-interaction guidance (24h cool-off on UK deposit limit
+ * increases) / DE GlüStV (7d). Operators cannot bypass the timer.
+ */
+export const RG_LIMIT_COOLING_TIMER = createSealedToken('rg-limit-cooling-timer');
+/**
+ * Age verification gate.
+ *
+ * Cannot be conditionally skipped by a plugin.
+ */
+export const AGE_VERIFICATION_GATE = createSealedToken('age-verification-gate');
+/**
+ * Geo-blocking platform-level deny.
+ *
+ * Operators can add jurisdictions to deny; they cannot remove a platform-level
+ * deny (eg US, sanctions list - OFAC, EU restrictive measures).
+ */
+export const GEO_PLATFORM_DENY_LIST = createSealedToken('geo-platform-deny-list');
+/**
+ * GDPR Art. 15 / 17 player data export + right-to-be-forgotten workflow.
+ *
+ * Operators may add steps (eg additional internal review) but may not remove.
+ */
+export const GDPR_DATA_RIGHTS_WORKFLOW = createSealedToken('gdpr-data-rights-workflow');
+export const SEALED_TOKENS = [
+    RG_SELF_EXCLUSION_SERVICE,
+    NATIONAL_SE_REGISTRY,
+    AML_SAR_WRITER,
+    LEDGER_WRITER,
+    AUDIT_WRITER,
+    GAME_OUTCOME_AUTHORITY,
+    BONUS_WAGERING_ENGINE,
+    RG_LIMIT_COOLING_TIMER,
+    AGE_VERIFICATION_GATE,
+    GEO_PLATFORM_DENY_LIST,
+    GDPR_DATA_RIGHTS_WORKFLOW,
+];
+// Sealed identities that currently have a real owning-module implementation bound
+// via ctx.provideSealed() - a subset of SEALED_TOKENS. The rest (self-exclusion
+// enforcement, ledger manualAdjust, the production RNG authority, ...) are
+// documented regulatory placeholders with no DI-resolvable implementation yet;
+// asserting their presence would fail every deployment. Add a token here only
+// once its owning module actually binds it via provideSealed().
+export const IMPLEMENTED_SEALED_TOKENS = [AUDIT_WRITER];
+//# sourceMappingURL=sealed.js.map

package/dist/compliance/sealed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed.js","sourceRoot":"","sources":["../../src/compliance/sealed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAoB,MAAM,yBAAyB,CAAC;AAE5F;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAyB,iBAAiB,CAC9E,2BAA2B,CAC5B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAyB,iBAAiB,CACzE,kCAAkC,CACnC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAyB,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;AAExF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAyB,iBAAiB,CAAC,eAAe,CAAC,CAAC;AAEtF,gFAAgF;AAChF,kFAAkF;AAClF,iFAAiF;AACjF,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAyB,iBAAiB,CAC9E,2BAA2B,CAC5B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAoC;IAC5D,yBAAyB;IACzB,oBAAoB;IACpB,cAAc;IACd,aAAa;IACb,YAAY;IACZ,sBAAsB;IACtB,qBAAqB;IACrB,sBAAsB;IACtB,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;CAC1B,CAAC;AAEF,kFAAkF;AAClF,gFAAgF;AAChF,2EAA2E;AAC3E,+EAA+E;AAC/E,8EAA8E;AAC9E,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAoC,CAAC,YAAY,CAAC,CAAC"}

package/dist/compliance/server.d.ts

@@ -0,0 +1,6 @@
+export { ComplianceService, LimitNotFoundError, LimitOwnershipError, } from './service/compliance.service.js';
+export { KycVerificationService } from './service/kyc.service.js';
+export { CumulativeDepositReKycTrigger, type ReKycTrigger, type ReKycPlayerSnapshot, } from './service/re-kyc-trigger.js';
+export { createComplianceRouter } from './router/index.js';
+export { default } from './plugin.js';
+//# sourceMappingURL=server.d.ts.map

package/dist/compliance/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/compliance/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,6BAA6B,EAC7B,KAAK,YAAY,EACjB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC"}

package/dist/compliance/server.js

@@ -0,0 +1,6 @@
+export { ComplianceService, LimitNotFoundError, LimitOwnershipError, } from './service/compliance.service.js';
+export { KycVerificationService } from './service/kyc.service.js';
+export { CumulativeDepositReKycTrigger, } from './service/re-kyc-trigger.js';
+export { createComplianceRouter } from './router/index.js';
+export { default } from './plugin.js';
+//# sourceMappingURL=server.js.map

package/dist/compliance/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/compliance/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,6BAA6B,GAG9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC"}

package/dist/compliance/service/compliance.service.d.ts

@@ -0,0 +1,56 @@
+import { DrizzleService, type EventBus } from '@openora/core/server';
+import type { UpsertLimitInput, Limit, AddGeoRuleInput } from '../contract/index.js';
+import { type GeoIpAdapter } from '@openora/core/contracts';
+export declare const LimitNotFoundError: new (id: string) => Error;
+export declare const LimitOwnershipError: new () => Error;
+export declare class ComplianceService {
+    private readonly drizzle;
+    private readonly events;
+    private readonly geoIp;
+    constructor(drizzle: DrizzleService, events: EventBus, geoIp?: GeoIpAdapter | null);
+    getLimitsForUser(userId: string): Promise<{
+        id: string;
+        userId: string;
+        type: Limit["type"];
+        amount: number;
+        period: Limit["period"];
+        createdAt: string;
+    }[]>;
+    upsertLimit(userId: string, input: UpsertLimitInput): Promise<{
+        id: string;
+        userId: string;
+        type: Limit["type"];
+        amount: number;
+        period: Limit["period"];
+        createdAt: string;
+    }>;
+    removeLimit(id: string, userId: string): Promise<{
+        success: true;
+    }>;
+    geoCheck(ipAddress: string): Promise<{
+        allowed: boolean;
+        countryCode: null;
+        reason: null;
+    } | {
+        allowed: boolean;
+        countryCode: string;
+        reason: null;
+    } | {
+        allowed: boolean;
+        countryCode: string;
+        reason: string;
+    }>;
+    addGeoRule(input: AddGeoRuleInput, actorId?: string): Promise<{
+        id: string;
+        countryCode: string;
+        action: "allow" | "block";
+        createdAt: string;
+    }>;
+    listGeoRules(): Promise<{
+        id: string;
+        countryCode: string;
+        action: "allow" | "block";
+        createdAt: string;
+    }[]>;
+}
+//# sourceMappingURL=compliance.service.d.ts.map

package/dist/compliance/service/compliance.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance.service.d.ts","sourceRoot":"","sources":["../../../src/compliance/service/compliance.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EAEd,KAAK,QAAQ,EAKd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAW,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,eAAO,MAAM,kBAAkB,2BAA6B,CAAC;AAE7D,eAAO,MAAM,mBAAmB,iBAA8B,CAAC;AAE/D,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAFL,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,QAAQ,EAChB,KAAK,GAAE,YAAY,GAAG,IAAW;IAG9C,gBAAgB,CAAC,MAAM,EAAE,MAAM;;;cAKjB,KAAK,CAAC,MAAM,CAAC;;gBAET,KAAK,CAAC,QAAQ,CAAC;;;IAKjC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB;;;cAalC,KAAK,CAAC,MAAM,CAAC;;gBAET,KAAK,CAAC,QAAQ,CAAC;;;IAKpC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAWnE,QAAQ,CAAC,SAAS,EAAE,MAAM;;;;;;;;;;;;;IA4B1B,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,MAAM;;;;;;IAiBnD,YAAY;;;;;;CAInB"}

package/dist/compliance/service/compliance.service.js

@@ -0,0 +1,94 @@
+import { findOneOrThrow, makeNotFoundError, makeOwnershipError, assertOwnership, serializeRow, } from '@openora/core/server';
+import { eq } from 'drizzle-orm';
+import { userLimit, geoRule } from '../schema/index.js';
+export const LimitNotFoundError = makeNotFoundError('Limit');
+export const LimitOwnershipError = makeOwnershipError('Limit');
+export class ComplianceService {
+    drizzle;
+    events;
+    geoIp;
+    constructor(drizzle, events, geoIp = null) {
+        this.drizzle = drizzle;
+        this.events = events;
+        this.geoIp = geoIp;
+    }
+    async getLimitsForUser(userId) {
+        const rows = await this.drizzle.db.select().from(userLimit).where(eq(userLimit.userId, userId));
+        return rows.map((r) => ({
+            id: r.id,
+            userId: r.userId,
+            type: r.type,
+            amount: r.amount,
+            period: r.period,
+            createdAt: r.createdAt.toISOString(),
+        }));
+    }
+    async upsertLimit(userId, input) {
+        const [row] = await this.drizzle.db
+            .insert(userLimit)
+            .values({ ...input, userId })
+            .onConflictDoUpdate({
+            target: [userLimit.userId, userLimit.type, userLimit.period],
+            set: { amount: input.amount },
+        })
+            .returning();
+        this.events.emit('compliance.limit.upserted', { userId, limitId: row.id });
+        return {
+            id: row.id,
+            userId: row.userId,
+            type: row.type,
+            amount: row.amount,
+            period: row.period,
+            createdAt: row.createdAt.toISOString(),
+        };
+    }
+    async removeLimit(id, userId) {
+        const existing = findOneOrThrow(await this.drizzle.db.select().from(userLimit).where(eq(userLimit.id, id)), new LimitNotFoundError(id));
+        assertOwnership(existing.userId, userId, new LimitOwnershipError());
+        await this.drizzle.db.delete(userLimit).where(eq(userLimit.id, id));
+        this.events.emit('compliance.limit.removed', { userId, limitId: id });
+        return { success: true };
+    }
+    async geoCheck(ipAddress) {
+        let countryCode = null;
+        if (this.geoIp) {
+            const result = await this.geoIp.lookup(ipAddress);
+            countryCode = result.countryCode;
+        }
+        if (!countryCode) {
+            return { allowed: true, countryCode: null, reason: null };
+        }
+        const [rule] = await this.drizzle.db
+            .select()
+            .from(geoRule)
+            .where(eq(geoRule.countryCode, countryCode));
+        if (!rule) {
+            return { allowed: true, countryCode, reason: null };
+        }
+        if (rule.action === 'block') {
+            return { allowed: false, countryCode, reason: `Country ${countryCode} is blocked` };
+        }
+        return { allowed: true, countryCode, reason: null };
+    }
+    async addGeoRule(input, actorId) {
+        const [row] = await this.drizzle.db
+            .insert(geoRule)
+            .values({ ...input })
+            .onConflictDoUpdate({
+            target: geoRule.countryCode,
+            set: { action: input.action },
+        })
+            .returning();
+        this.events.emit('compliance.geo-rule.added', {
+            countryCode: input.countryCode,
+            action: input.action,
+            actorId,
+        });
+        return serializeRow(row, { dateFields: ['createdAt'] });
+    }
+    async listGeoRules() {
+        const rows = await this.drizzle.db.select().from(geoRule);
+        return rows.map((r) => serializeRow(r, { dateFields: ['createdAt'] }));
+    }
+}
+//# sourceMappingURL=compliance.service.js.map

package/dist/compliance/service/compliance.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance.service.js","sourceRoot":"","sources":["../../../src/compliance/service/compliance.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,cAAc,EAEd,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,GACb,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAIxD,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAE/D,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IAHnB,YACmB,OAAuB,EACvB,MAAgB,EAChB,QAA6B,IAAI;QAFjC,YAAO,GAAP,OAAO,CAAgB;QACvB,WAAM,GAAN,MAAM,CAAU;QAChB,UAAK,GAAL,KAAK,CAA4B;IACjD,CAAC;IAEJ,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,IAAqB;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAyB;YACnC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,KAAuB;QACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,SAAS,CAAC;aACjB,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC;aAC5B,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC;YAC5D,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;SAC9B,CAAC;aACD,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,GAAI,CAAC,EAAE;YACX,MAAM,EAAE,GAAI,CAAC,MAAM;YACnB,IAAI,EAAE,GAAI,CAAC,IAAqB;YAChC,MAAM,EAAE,GAAI,CAAC,MAAM;YACnB,MAAM,EAAE,GAAI,CAAC,MAAyB;YACtC,SAAS,EAAE,GAAI,CAAC,SAAS,CAAC,WAAW,EAAE;SACxC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,MAAc;QAC1C,MAAM,QAAQ,GAAG,cAAc,CAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAC1E,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAC3B,CAAC;QACF,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,IAAI,WAAW,GAAkB,IAAI,CAAC;QAEtC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC5D,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACjC,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;QAE/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,WAAW,aAAa,EAAE,CAAC;QACtF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAsB,EAAE,OAAgB;QACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;aACpB,kBAAkB,CAAC;YAClB,MAAM,EAAE,OAAO,CAAC,WAAW;YAC3B,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;SAC9B,CAAC;aACD,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YAC5C,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO;SACR,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,GAAI,EAAE,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,CAAY,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,CAAY,CAAC,CAAC;IACpF,CAAC;CACF"}

package/dist/compliance/service/kyc.service.d.ts

@@ -0,0 +1,68 @@
+import { DrizzleService, type EventBus } from '@openora/core/server';
+import type { KycAdapter, KycStatusWriter, KycVendorStatus, PlatformConfig } from '@openora/core/contracts';
+import type { SubmitKycInput, PlayerKycView } from '../contract/index.js';
+import { type ReKycTrigger } from './re-kyc-trigger.js';
+/**
+ * Owns the append-only `kyc_verification` history and the submit/reconcile/re-KYC
+ * lifecycle. All `player.kycStatus` writes go through the injected KycStatusWriter
+ * (pam-owned single-writer seam); this service never touches the player table for writes.
+ */
+export type KycVerificationDeps = {
+    drizzle: DrizzleService;
+    events: EventBus;
+    kycAdapter: KycAdapter;
+    statusWriter: KycStatusWriter;
+    platformConfig?: PlatformConfig;
+    reKycTrigger?: ReKycTrigger;
+};
+export declare class KycVerificationService {
+    private readonly drizzle;
+    private readonly events;
+    private readonly kycAdapter;
+    private readonly statusWriter;
+    private readonly platformConfig?;
+    private readonly reKycTrigger;
+    constructor(deps: KycVerificationDeps);
+    private get provider();
+    submit(userId: string, input: SubmitKycInput): Promise<{
+        id: string;
+        userId: string;
+        provider: string;
+        referenceId: string;
+        status: "pending" | "not_started" | "verified" | "rejected" | "resubmission_requested" | "manually_overridden";
+        documentTypes: ("passport" | "drivers_license" | "national_id")[];
+        decisionReason: string | null;
+        triggeredBy: "manual" | "submission" | "reverify_threshold";
+        submittedAt: string;
+        decidedAt: string | null;
+        createdAt: string;
+        updatedAt: string;
+    }>;
+    /**
+     * Idempotent vendor-decision apply (polling + webhook). No-op when the latest record
+     * already holds the mapped status.
+     */
+    reconcile(referenceId: string, vendorStatus: KycVendorStatus, reason?: string): Promise<{
+        id: string;
+        userId: string;
+        provider: string;
+        referenceId: string;
+        status: "pending" | "not_started" | "verified" | "rejected" | "resubmission_requested" | "manually_overridden";
+        documentTypes: ("passport" | "drivers_license" | "national_id")[];
+        decisionReason: string | null;
+        triggeredBy: "manual" | "submission" | "reverify_threshold";
+        submittedAt: string;
+        decidedAt: string | null;
+        createdAt: string;
+        updatedAt: string;
+    } | null>;
+    getForPlayer(userId: string): Promise<PlayerKycView>;
+    /**
+     * Deposit-event hook: flips a currently-verified player to `resubmission_requested`
+     * once cumulative deposits cross a fresh per-currency threshold band. Idempotent twice
+     * over: skips unless presently `verified`, and the watermark stops a re-verified
+     * high-roller re-firing on every later deposit.
+     */
+    handleDeposit(userId: string): Promise<void>;
+}
+//# sourceMappingURL=kyc.service.d.ts.map

package/dist/compliance/service/kyc.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kyc.service.d.ts","sourceRoot":"","sources":["../../../src/compliance/service/kyc.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,eAAe,EAEf,cAAc,EACf,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAEV,cAAc,EACd,aAAa,EACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAiC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAsCvF;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,eAAe,CAAC;IAC9B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B,CAAC;AAEF,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkB;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAEhC,IAAI,EAAE,mBAAmB;IASrC,OAAO,KAAK,QAAQ,GAEnB;IAEK,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc;;;;;;;;;;;;;;IA4BlD;;;OAGG;IACG,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,MAAM;;;;;;;;;;;;;;IA2B7E,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAS1D;;;;;OAKG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM;CA2DnC"}