@openora/core 0.4.0

package/dist/compliance/service/rg.service.js

@@ -0,0 +1,266 @@
+import { createLogger, makeNotFoundError, makeConflictError, serializeRow, } from '@openora/core/server';
+import { and, eq, or, gt, lte, desc } from 'drizzle-orm';
+import { userLimit, rgExclusion } from '../schema/index.js';
+const logger = createLogger('compliance-rg');
+export const ExclusionNotFoundError = makeNotFoundError('Exclusion');
+export const ActiveExclusionError = makeConflictError('ActiveExclusionError', 'An active exclusion of this kind already exists for this player');
+export const PermanentExclusionLiftError = makeConflictError('PermanentExclusionLiftError', 'A permanent self-exclusion cannot be lifted');
+export const ExclusionPeriodNotElapsedError = makeConflictError('ExclusionPeriodNotElapsedError', 'The self-exclusion minimum period has not elapsed yet');
+const HOUR_MS = 60 * 60 * 1000;
+function addMonths(from, months) {
+    const d = new Date(from);
+    d.setMonth(d.getMonth() + months);
+    return d;
+}
+function toLimitDto(row) {
+    return {
+        id: row.id,
+        userId: row.userId,
+        type: row.type,
+        amount: row.amount,
+        period: row.period,
+        createdAt: row.createdAt.toISOString(),
+    };
+}
+function toExclusionDto(row) {
+    return serializeRow(row, {
+        dateFields: ['startsAt', 'expiresAt', 'liftedAt', 'createdAt', 'updatedAt'],
+    });
+}
+export class RgService {
+    drizzle;
+    events;
+    loginEnforcement;
+    email;
+    directory;
+    constructor(deps) {
+        this.drizzle = deps.drizzle;
+        this.events = deps.events;
+        this.loginEnforcement = deps.loginEnforcement;
+        this.email = deps.email ?? null;
+        this.directory = deps.directory ?? null;
+    }
+    async setPlayerLimit(userId, input, actorId) {
+        const [prior] = await this.drizzle.db
+            .select({ amount: userLimit.amount })
+            .from(userLimit)
+            .where(and(eq(userLimit.userId, userId), eq(userLimit.type, input.type), eq(userLimit.period, input.period)))
+            .limit(1);
+        const [row] = await this.drizzle.db
+            .insert(userLimit)
+            .values({ ...input, userId })
+            .onConflictDoUpdate({
+            target: [userLimit.userId, userLimit.type, userLimit.period],
+            set: { amount: input.amount },
+        })
+            .returning();
+        this.events.emit('rg.limit.set', {
+            userId,
+            actorId,
+            limitId: row.id,
+            type: input.type,
+            period: input.period,
+            amount: input.amount,
+            previousAmount: prior?.amount ?? null,
+        });
+        await this.notify(userId, 'Your gambling limit was updated', `A ${input.period} ${input.type} limit of ${input.amount} is now active on your account.`);
+        return toLimitDto(row);
+    }
+    async activateCoolingOff(userId, input, actorId) {
+        await this.assertNoActiveExclusion(userId, 'cooling_off');
+        const now = new Date();
+        const expiresAt = new Date(now.getTime() + input.durationHours * HOUR_MS);
+        const row = await this.drizzle.db.transaction(async (tx) => {
+            await this.expireLapsedCoolingOff(userId, tx, now);
+            const [r] = await tx
+                .insert(rgExclusion)
+                .values({
+                userId,
+                kind: 'cooling_off',
+                status: 'active',
+                reason: input.reason,
+                permanent: false,
+                startsAt: now,
+                expiresAt,
+                createdBy: actorId,
+            })
+                .returning();
+            await this.syncEnforcement(userId, tx);
+            return r;
+        });
+        this.events.emit('rg.cooling_off.activated', {
+            userId,
+            actorId,
+            exclusionId: row.id,
+            expiresAt: expiresAt.toISOString(),
+            reason: input.reason,
+        });
+        await this.notify(userId, 'Cooling-off period activated', `A cooling-off period is active on your account until ${expiresAt.toISOString()}.`);
+        return toExclusionDto(row);
+    }
+    async activateSelfExclusion(userId, input, actorId) {
+        await this.assertNoActiveExclusion(userId, 'self_exclusion');
+        const now = new Date();
+        const expiresAt = input.permanent || input.durationMonths === undefined
+            ? null
+            : addMonths(now, input.durationMonths);
+        const row = await this.drizzle.db.transaction(async (tx) => {
+            const [r] = await tx
+                .insert(rgExclusion)
+                .values({
+                userId,
+                kind: 'self_exclusion',
+                status: 'active',
+                reason: input.reason,
+                permanent: input.permanent,
+                startsAt: now,
+                expiresAt,
+                createdBy: actorId,
+            })
+                .returning();
+            await this.syncEnforcement(userId, tx);
+            return r;
+        });
+        this.events.emit('rg.self_exclusion.activated', {
+            userId,
+            actorId,
+            exclusionId: row.id,
+            permanent: input.permanent,
+            expiresAt: expiresAt ? expiresAt.toISOString() : null,
+            reason: input.reason,
+        });
+        await this.notify(userId, 'Self-exclusion activated', input.permanent
+            ? 'A permanent self-exclusion is now active on your account.'
+            : `A self-exclusion is active on your account until at least ${expiresAt.toISOString()}.`);
+        return toExclusionDto(row);
+    }
+    async liftSelfExclusion(userId, input, actorId) {
+        const [existing] = await this.drizzle.db
+            .select()
+            .from(rgExclusion)
+            .where(and(eq(rgExclusion.userId, userId), eq(rgExclusion.kind, 'self_exclusion'), eq(rgExclusion.status, 'active')))
+            .limit(1);
+        if (!existing)
+            throw new ExclusionNotFoundError(userId);
+        if (existing.permanent || existing.expiresAt === null)
+            throw new PermanentExclusionLiftError();
+        if (new Date() < existing.expiresAt)
+            throw new ExclusionPeriodNotElapsedError();
+        const now = new Date();
+        const row = await this.drizzle.db.transaction(async (tx) => {
+            const [r] = await tx
+                .update(rgExclusion)
+                .set({ status: 'lifted', liftedAt: now, liftedReason: input.reason, liftedBy: actorId })
+                .where(eq(rgExclusion.id, existing.id))
+                .returning();
+            // Recompute from what remains - a still-active cooling-off keeps its own block
+            // rather than being cleared by this lift.
+            await this.syncEnforcement(userId, tx);
+            return r;
+        });
+        this.events.emit('rg.self_exclusion.lifted', {
+            userId,
+            actorId,
+            exclusionId: row.id,
+            kind: 'self_exclusion',
+            reason: input.reason,
+        });
+        await this.notify(userId, 'Self-exclusion lifted', 'Your self-exclusion has been lifted and you can log in again.');
+        return toExclusionDto(row);
+    }
+    async getRgSection(userId) {
+        const now = new Date();
+        const [limits, exclusions] = await Promise.all([
+            this.drizzle.db.select().from(userLimit).where(eq(userLimit.userId, userId)),
+            this.drizzle.db
+                .select()
+                .from(rgExclusion)
+                .where(and(eq(rgExclusion.userId, userId), eq(rgExclusion.status, 'active')))
+                .orderBy(desc(rgExclusion.createdAt)),
+        ]);
+        // A lapsed cooling-off row stays `active` until the sweep expires it - treat it as
+        // not-active here so the section reflects the enforced state.
+        const coolingOff = exclusions.find((e) => e.kind === 'cooling_off' && e.expiresAt && e.expiresAt > now) ?? null;
+        const selfExclusion = exclusions.find((e) => e.kind === 'self_exclusion') ?? null;
+        return {
+            limits: limits.map(toLimitDto),
+            coolingOff: coolingOff ? toExclusionDto(coolingOff) : null,
+            selfExclusion: selfExclusion ? toExclusionDto(selfExclusion) : null,
+        };
+    }
+    // Background hygiene: transition truly-lapsed cooling-off rows to `expired` and
+    // recompute enforcement for the affected players. Called by the rg-monitor sweep.
+    async expireLapsedCoolingOffs() {
+        const now = new Date();
+        const lapsed = await this.drizzle.db
+            .update(rgExclusion)
+            .set({ status: 'expired' })
+            .where(and(eq(rgExclusion.kind, 'cooling_off'), eq(rgExclusion.status, 'active'), lte(rgExclusion.expiresAt, now)))
+            .returning({ userId: rgExclusion.userId });
+        for (const userId of new Set(lapsed.map((r) => r.userId))) {
+            await this.syncEnforcement(userId);
+        }
+    }
+    expireLapsedCoolingOff(userId, tx, now) {
+        return tx
+            .update(rgExclusion)
+            .set({ status: 'expired' })
+            .where(and(eq(rgExclusion.userId, userId), eq(rgExclusion.kind, 'cooling_off'), eq(rgExclusion.status, 'active'), lte(rgExclusion.expiresAt, now)));
+    }
+    // The single source of truth for the login block: derive it from the STRONGEST
+    // remaining active exclusion. An active self-exclusion (permanent or fixed-term)
+    // wins with an indefinite block; otherwise the longest active cooling-off; else clear.
+    async syncEnforcement(userId, db = this.drizzle.db) {
+        const now = new Date();
+        const active = await db
+            .select({ kind: rgExclusion.kind, expiresAt: rgExclusion.expiresAt })
+            .from(rgExclusion)
+            .where(and(eq(rgExclusion.userId, userId), eq(rgExclusion.status, 'active'), or(eq(rgExclusion.kind, 'self_exclusion'), gt(rgExclusion.expiresAt, now))));
+        if (active.some((e) => e.kind === 'self_exclusion')) {
+            await this.loginEnforcement.block(userId, { until: null });
+            return;
+        }
+        const expiries = active.filter((e) => e.expiresAt).map((e) => e.expiresAt.getTime());
+        if (expiries.length > 0) {
+            await this.loginEnforcement.block(userId, { until: new Date(Math.max(...expiries)) });
+            return;
+        }
+        await this.loginEnforcement.unblock(userId);
+    }
+    async assertNoActiveExclusion(userId, kind) {
+        const now = new Date();
+        const conditions = [
+            eq(rgExclusion.userId, userId),
+            eq(rgExclusion.kind, kind),
+            eq(rgExclusion.status, 'active'),
+        ];
+        // A lapsed-but-not-yet-swept cooling-off must not block a fresh one; a self-exclusion
+        // has no time-based lapse (only an explicit lift clears it).
+        if (kind === 'cooling_off')
+            conditions.push(gt(rgExclusion.expiresAt, now));
+        const [existing] = await this.drizzle.db
+            .select({ id: rgExclusion.id })
+            .from(rgExclusion)
+            .where(and(...conditions))
+            .limit(1);
+        if (existing)
+            throw new ActiveExclusionError();
+    }
+    // Best-effort player notification. Both the email port and the directory are optional
+    // (guarded by c.has at wiring). A lookup/send failure must not fail an RG action that
+    // already committed - log without PII (no email, no reason text) and move on.
+    async notify(userId, subject, body) {
+        if (!this.email || !this.directory)
+            return;
+        try {
+            const [summary] = await this.directory.lookupPlayers([userId]);
+            if (!summary?.email)
+                return;
+            await this.email.send({ to: summary.email, subject, body });
+        }
+        catch (err) {
+            logger.warn({ err, userId }, 'RG player notification failed');
+        }
+    }
+}
+//# sourceMappingURL=rg.service.js.map

package/dist/compliance/service/rg.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rg.service.js","sourceRoot":"","sources":["../../../src/compliance/service/rg.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,GAEb,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAMzD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAW5D,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAK7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CACnD,sBAAsB,EACtB,iEAAiE,CAClE,CAAC;AACF,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAC1D,6BAA6B,EAC7B,6CAA6C,CAC9C,CAAC;AACF,MAAM,CAAC,MAAM,8BAA8B,GAAG,iBAAiB,CAC7D,gCAAgC,EAChC,uDAAuD,CACxD,CAAC;AAEF,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/B,SAAS,SAAS,CAAC,IAAU,EAAE,MAAc;IAC3C,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU,CAAC,GAAkC;IACpD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,IAAqB;QAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,CAAC,MAAyB;QACrC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAoC;IAC1D,OAAO,YAAY,CAAC,GAAG,EAAE;QACvB,UAAU,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC;KAC5E,CAAC,CAAC;AACL,CAAC;AAUD,MAAM,OAAO,SAAS;IACH,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,gBAAgB,CAAuB;IACvC,KAAK,CAAuB;IAC5B,SAAS,CAA4B;IAEtD,YAAY,IAAmB;QAC7B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC9C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,KAA0B,EAC1B,OAAe;QAEf,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;aACpC,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAC9B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,SAAS,CAAC;aACjB,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC;aAC5B,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC;YAC5D,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;SAC9B,CAAC;aACD,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;YAC/B,MAAM;YACN,OAAO;YACP,OAAO,EAAE,GAAI,CAAC,EAAE;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,cAAc,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI;SACtC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CACf,MAAM,EACN,iCAAiC,EACjC,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,MAAM,iCAAiC,CAC1F,CAAC;QACF,OAAO,UAAU,CAAC,GAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,MAAc,EACd,KAA8B,EAC9B,OAAe;QAEf,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,aAAa,GAAG,OAAO,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACzD,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACnD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE;iBACjB,MAAM,CAAC,WAAW,CAAC;iBACnB,MAAM,CAAC;gBACN,MAAM;gBACN,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,GAAG;gBACb,SAAS;gBACT,SAAS,EAAE,OAAO;aACnB,CAAC;iBACD,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvC,OAAO,CAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;YAC3C,MAAM;YACN,OAAO;YACP,WAAW,EAAE,GAAG,CAAC,EAAE;YACnB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CACf,MAAM,EACN,8BAA8B,EAC9B,wDAAwD,SAAS,CAAC,WAAW,EAAE,GAAG,CACnF,CAAC;QACF,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,KAAiC,EACjC,OAAe;QAEf,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GACb,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;YACnD,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACzD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE;iBACjB,MAAM,CAAC,WAAW,CAAC;iBACnB,MAAM,CAAC;gBACN,MAAM;gBACN,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,GAAG;gBACb,SAAS;gBACT,SAAS,EAAE,OAAO;aACnB,CAAC;iBACD,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvC,OAAO,CAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;YAC9C,MAAM;YACN,OAAO;YACP,WAAW,EAAE,GAAG,CAAC,EAAE;YACnB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;YACrD,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CACf,MAAM,EACN,0BAA0B,EAC1B,KAAK,CAAC,SAAS;YACb,CAAC,CAAC,2DAA2D;YAC7D,CAAC,CAAC,6DAA6D,SAAU,CAAC,WAAW,EAAE,GAAG,CAC7F,CAAC;QACF,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,MAAc,EACd,KAA6B,EAC7B,OAAe;QAEf,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACrC,MAAM,EAAE;aACR,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,EACtC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CACjC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI;YAAE,MAAM,IAAI,2BAA2B,EAAE,CAAC;QAC/F,IAAI,IAAI,IAAI,EAAE,GAAG,QAAQ,CAAC,SAAS;YAAE,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAEhF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACzD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE;iBACjB,MAAM,CAAC,WAAW,CAAC;iBACnB,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;iBACvF,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;iBACtC,SAAS,EAAE,CAAC;YACf,+EAA+E;YAC/E,0CAA0C;YAC1C,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvC,OAAO,CAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;YAC3C,MAAM;YACN,OAAO;YACP,WAAW,EAAE,GAAG,CAAC,EAAE;YACnB,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CACf,MAAM,EACN,uBAAuB,EACvB,+DAA+D,CAChE,CAAC;QACF,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5E,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,MAAM,EAAE;iBACR,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;iBAC5E,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;SACxC,CAAC,CAAC;QACH,mFAAmF;QACnF,8DAA8D;QAC9D,MAAM,UAAU,GACd,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC;QAC/F,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,IAAI,CAAC;QAClF,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;YAC9B,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;YAC1D,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;SACpE,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,kFAAkF;IAClF,KAAK,CAAC,uBAAuB;QAC3B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACjC,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;aAC1B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,EACnC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EAChC,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,CAChC,CACF;aACA,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,MAAM,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAEO,sBAAsB,CAAC,MAAc,EAAE,EAAM,EAAE,GAAS;QAC9D,OAAO,EAAE;aACN,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;aAC1B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,EACnC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EAChC,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,CAChC,CACF,CAAC;IACN,CAAC;IAED,+EAA+E;IAC/E,iFAAiF;IACjF,uFAAuF;IAC/E,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,KAAc,IAAI,CAAC,OAAO,CAAC,EAAE;QACzE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;aACpE,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EAChC,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAC3E,CACF,CAAC;QACJ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,SAAkB,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,MAAc,EAAE,IAAyB;QAC7E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG;YACjB,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;YAC9B,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;YAC1B,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC;SACjC,CAAC;QACF,sFAAsF;QACtF,6DAA6D;QAC7D,IAAI,IAAI,KAAK,aAAa;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACrC,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;aAC9B,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;aACzB,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ;YAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACjD,CAAC;IAED,sFAAsF;IACtF,sFAAsF;IACtF,8EAA8E;IACtE,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,OAAe,EAAE,IAAY;QAChE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3C,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,EAAE,KAAK;gBAAE,OAAO;YAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;CACF"}

package/dist/compliance.d.ts

@@ -0,0 +1,4 @@
+export * from './compliance/sealed.js';
+export { assertSealedServicesBound } from './compliance/assert.js';
+export type { SealedContainerView } from './compliance/assert.js';
+//# sourceMappingURL=compliance.d.ts.map

package/dist/compliance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance.d.ts","sourceRoot":"","sources":["../src/compliance.ts"],"names":[],"mappings":"AACA,cAAc,wBAAwB,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/compliance.js

@@ -0,0 +1,4 @@
+// Regulator-mandated sealed-token list + assertSealedServicesBound guard (ADR-0025).
+export * from './compliance/sealed.js';
+export { assertSealedServicesBound } from './compliance/assert.js';
+//# sourceMappingURL=compliance.js.map

package/dist/compliance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance.js","sourceRoot":"","sources":["../src/compliance.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,cAAc,wBAAwB,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/contracts/__tests__/kit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=kit.test.d.ts.map

package/dist/contracts/__tests__/kit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kit.test.d.ts","sourceRoot":"","sources":["../../../src/contracts/__tests__/kit.test.ts"],"names":[],"mappings":""}

package/dist/contracts/__tests__/kit.test.js

@@ -0,0 +1,27 @@
+import { describe, it, expect } from 'vitest';
+import { z } from 'zod';
+import { PageQuerySchema, paginated } from '../kit.js';
+describe('PageQuerySchema', () => {
+    it('defaults to page 1 / limit 100 when omitted', () => {
+        expect(PageQuerySchema.parse({})).toEqual({ page: 1, limit: 100 });
+    });
+    it('coerces query-string values', () => {
+        expect(PageQuerySchema.parse({ page: '2', limit: '10' })).toEqual({ page: 2, limit: 10 });
+    });
+    it('caps limit at 100 and floors page at 1', () => {
+        expect(PageQuerySchema.safeParse({ limit: 101 }).success).toBe(false);
+        expect(PageQuerySchema.safeParse({ page: 0 }).success).toBe(false);
+    });
+});
+describe('paginated', () => {
+    it('wraps an item schema in the canonical envelope', () => {
+        const schema = paginated(z.object({ id: z.string() }));
+        const value = { items: [{ id: 'a' }], total: 1, page: 1, limit: 100 };
+        expect(schema.parse(value)).toEqual(value);
+    });
+    it('rejects a non-integer total', () => {
+        const schema = paginated(z.string());
+        expect(schema.safeParse({ items: [], total: 1.5, page: 1, limit: 100 }).success).toBe(false);
+    });
+});
+//# sourceMappingURL=kit.test.js.map

package/dist/contracts/__tests__/kit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kit.test.js","sourceRoot":"","sources":["../../../src/contracts/__tests__/kit.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACtE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/contracts/adapters/admin-permission.d.ts

@@ -0,0 +1,10 @@
+import { type Token } from './token.js';
+export type AdminGrant = {
+    resource: string;
+    action: string;
+};
+export type AdminPermissionResolver = {
+    getGrants(userId: string): Promise<AdminGrant[] | null>;
+};
+export declare const ADMIN_PERMISSION_RESOLVER: Token<AdminPermissionResolver>;
+//# sourceMappingURL=admin-permission.d.ts.map

package/dist/contracts/adapters/admin-permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-permission.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-permission.ts"],"names":[],"mappings":"AAIA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,uBAAuB,GAAG;IAGpC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,uBAAuB,CAEpE,CAAC"}

package/dist/contracts/adapters/admin-permission.js

@@ -0,0 +1,7 @@
+// Port for DB-backed admin RBAC. A backoffice iam module binds a concrete
+// resolver that reads role assignments + grants from its own tables; the
+// AdminGuard (in @openora/core/server) depends only on this interface so the platform
+// keeps working - falling back to the static roles - when no resolver is bound.
+import { createToken } from './token.js';
+export const ADMIN_PERMISSION_RESOLVER = createToken('ADMIN_PERMISSION_RESOLVER');
+//# sourceMappingURL=admin-permission.js.map

package/dist/contracts/adapters/admin-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-permission.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-permission.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,yEAAyE;AACzE,sFAAsF;AACtF,gFAAgF;AAChF,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAUrD,MAAM,CAAC,MAAM,yBAAyB,GAAmC,WAAW,CAClF,2BAA2B,CAC5B,CAAC"}

package/dist/contracts/adapters/admin-user-directory.d.ts

@@ -0,0 +1,40 @@
+import { type Token } from './token.js';
+import type { KycStatus } from '../schemas/player.js';
+import type { UserRole } from '../schemas/iam.js';
+export type AdminUserRow = {
+    id: string;
+    email: string;
+    name: string | null;
+    createdAt: Date;
+    isActive: boolean;
+    role: UserRole;
+    failedLoginAttempts?: number;
+    lockoutUntil?: Date | null;
+};
+export type AdminUserListOptions = {
+    page: number;
+    limit: number;
+    search?: string;
+};
+export type AdminPlayerSummary = {
+    userId: string;
+    username: string;
+    email: string;
+    kycStatus: KycStatus | null;
+};
+export type AdminUserDirectory = {
+    count(): Promise<number>;
+    list(opts: AdminUserListOptions): Promise<{
+        rows: AdminUserRow[];
+        total: number;
+    }>;
+    get(id: string): Promise<AdminUserRow | null>;
+    update(id: string, patch: {
+        isActive?: boolean;
+        role?: UserRole;
+    }, actorId: string): Promise<AdminUserRow | null>;
+    lookupPlayers(userIds: readonly string[]): Promise<AdminPlayerSummary[]>;
+    findPlayerIds(query: string): Promise<string[]>;
+};
+export declare const ADMIN_USER_DIRECTORY: Token<AdminUserDirectory>;
+//# sourceMappingURL=admin-user-directory.d.ts.map

package/dist/contracts/adapters/admin-user-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-user-directory.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-user-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAOlD,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAIpF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnF,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAE9C,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;KAAE,EAC9C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAGhC,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAGzE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACjD,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAuC,CAAC"}

package/dist/contracts/adapters/admin-user-directory.js

@@ -0,0 +1,3 @@
+import { createToken } from './token.js';
+export const ADMIN_USER_DIRECTORY = createToken('ADMIN_USER_DIRECTORY');
+//# sourceMappingURL=admin-user-directory.js.map

package/dist/contracts/adapters/admin-user-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-user-directory.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-user-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAiDrD,MAAM,CAAC,MAAM,oBAAoB,GAA8B,WAAW,CAAC,sBAAsB,CAAC,CAAC"}

package/dist/contracts/adapters/admin-wallet-reporting.d.ts

@@ -0,0 +1,45 @@
+import { type Token } from './token.js';
+import type { WalletRail, WalletTransactionStatus, WalletTransactionType } from '../schemas/wallet-tx.js';
+export type AdminTxRow = {
+    id: string;
+    userId: string;
+    type: WalletTransactionType;
+    amount: number;
+    currency: string;
+    status: WalletTransactionStatus;
+    rail: WalletRail | null;
+    createdAt: Date;
+};
+export type AdminTxDetail = AdminTxRow & {
+    providerRefId: string | null;
+    providerName: string | null;
+    reviewedBy: string | null;
+    reviewedAt: Date | null;
+    reviewReason: string | null;
+};
+export type AdminTxListOptions = {
+    page: number;
+    limit: number;
+    userIds?: string[];
+    type?: WalletTransactionType;
+    currency?: string;
+    rail?: WalletRail;
+    status?: WalletTransactionStatus;
+    dateFrom?: Date;
+    dateTo?: Date;
+    amountMin?: number;
+    amountMax?: number;
+};
+export type AdminWalletReporting = {
+    totals(): Promise<{
+        deposits: number;
+        withdrawals: number;
+    }>;
+    listTransactions(opts: AdminTxListOptions): Promise<{
+        rows: AdminTxRow[];
+        total: number;
+    }>;
+    getTransaction(id: string): Promise<AdminTxDetail | null>;
+};
+export declare const ADMIN_WALLET_REPORTING: Token<AdminWalletReporting>;
+//# sourceMappingURL=admin-wallet-reporting.d.ts.map

package/dist/contracts/adapters/admin-wallet-reporting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-wallet-reporting.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-wallet-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EACV,UAAU,EACV,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,yBAAyB,CAAC;AAMjC,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,qBAAqB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,uBAAuB,CAAC;IAChC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG;IACvC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CACxB,CAAC"}

package/dist/contracts/adapters/admin-wallet-reporting.js

@@ -0,0 +1,3 @@
+import { createToken } from './token.js';
+export const ADMIN_WALLET_REPORTING = createToken('ADMIN_WALLET_REPORTING');
+//# sourceMappingURL=admin-wallet-reporting.js.map

package/dist/contracts/adapters/admin-wallet-reporting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-wallet-reporting.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-wallet-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAmDrD,MAAM,CAAC,MAAM,sBAAsB,GACjC,WAAW,CAAC,wBAAwB,CAAC,CAAC"}

package/dist/contracts/adapters/aggregator.d.ts

@@ -0,0 +1,21 @@
+import { type Token } from './token.js';
+export type AggregatorGame = {
+    externalId: string;
+    name: string;
+    provider: string;
+    category: string;
+    thumbnailUrl?: string;
+    metadata?: Record<string, unknown>;
+};
+export type AggregatorAdapter = {
+    syncGameCatalog(): Promise<{
+        games: AggregatorGame[];
+    }>;
+    handleCallback(event: string, payload: unknown): Promise<void>;
+};
+export declare const AGGREGATOR_ADAPTER: Token<AggregatorAdapter>;
+export type AggregatorWebhookVerifier = {
+    verify(rawBody: string, signature: string | null): boolean;
+};
+export declare const AGGREGATOR_WEBHOOK_VERIFIER: Token<AggregatorWebhookVerifier>;
+//# sourceMappingURL=aggregator.d.ts.map

package/dist/contracts/adapters/aggregator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregator.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/aggregator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,eAAe,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,cAAc,EAAE,CAAA;KAAE,CAAC,CAAC;IACxD,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAqC,CAAC;AAO9F,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;CAC5D,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,KAAK,CAAC,yBAAyB,CAExE,CAAC"}

package/dist/contracts/adapters/aggregator.js

@@ -0,0 +1,7 @@
+// Igaming-aggregator seam. An aggregator fans out to many game providers'
+// catalogues; bind a concrete adapter to AGGREGATOR_ADAPTER in the
+// igaming-aggregator module's plugin.ts.
+import { createToken } from './token.js';
+export const AGGREGATOR_ADAPTER = createToken('AGGREGATOR_ADAPTER');
+export const AGGREGATOR_WEBHOOK_VERIFIER = createToken('AGGREGATOR_WEBHOOK_VERIFIER');
+//# sourceMappingURL=aggregator.js.map

package/dist/contracts/adapters/aggregator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregator.js","sourceRoot":"","sources":["../../../src/contracts/adapters/aggregator.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,mEAAmE;AACnE,yCAAyC;AACzC,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAgBrD,MAAM,CAAC,MAAM,kBAAkB,GAA6B,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAW9F,MAAM,CAAC,MAAM,2BAA2B,GAAqC,WAAW,CACtF,6BAA6B,CAC9B,CAAC"}

package/dist/contracts/adapters/audit.d.ts

@@ -0,0 +1,20 @@
+import type { DomainEventName } from '../schemas/events.js';
+import { type SealedToken } from './token.js';
+export type DirectAuditAction = 'admin.user.updated' | 'audit.export' | 'wallet.withdrawal.auto_approved' | 'wallet.auto_withdrawal_rule.set' | 'wallet.auto_withdrawal_rule.deleted';
+export type AuditAction = DomainEventName | DirectAuditAction | (string & {});
+export type AuditWritePort = {
+    record(entry: {
+        actorId?: string | null;
+        actorType: 'player' | 'admin' | 'system';
+        action: AuditAction;
+        resourceType: string;
+        resourceId?: string | null;
+        before?: Record<string, unknown> | null;
+        after?: Record<string, unknown> | null;
+        ip?: string | null;
+        userAgent?: string | null;
+        correlationId?: string | null;
+    }): Promise<void>;
+};
+export declare const AUDIT_WRITER: SealedToken<AuditWritePort>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/contracts/adapters/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/audit.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAIjE,MAAM,MAAM,iBAAiB,GACzB,oBAAoB,GACpB,cAAc,GACd,iCAAiC,GACjC,iCAAiC,GACjC,qCAAqC,CAAC;AAM1C,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,iBAAiB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE9E,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,CAAC,KAAK,EAAE;QACZ,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,SAAS,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;QACzC,MAAM,EAAE,WAAW,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACvC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,cAAc,CACF,CAAC"}

package/dist/contracts/adapters/audit.js

@@ -0,0 +1,3 @@
+import { createSealedToken } from './token.js';
+export const AUDIT_WRITER = createSealedToken('AUDIT_WRITER');
+//# sourceMappingURL=audit.js.map

package/dist/contracts/adapters/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/contracts/adapters/audit.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,iBAAiB,EAAoB,MAAM,YAAY,CAAC;AAgCjE,MAAM,CAAC,MAAM,YAAY,GACvB,iBAAiB,CAAiB,cAAc,CAAC,CAAC"}

package/dist/contracts/adapters/broker.d.ts

@@ -0,0 +1,21 @@
+import { type Token } from './token.js';
+export type EventEnvelope<T = unknown> = {
+    eventId: string;
+    topic: string;
+    payload: T;
+    occurredAt: string;
+    schemaVersion: number;
+    orderingKey?: string;
+    traceId?: string;
+};
+export type BrokerHandler = (envelope: EventEnvelope) => void | Promise<void>;
+export type SubscribeOptions = {
+    consumerGroup?: string;
+};
+export type MessageBrokerAdapter = {
+    publish(envelope: EventEnvelope): void | Promise<void>;
+    subscribe(topic: string, handler: BrokerHandler, options?: SubscribeOptions): () => void;
+    close(): Promise<void>;
+};
+export declare const MESSAGE_BROKER: Token<MessageBrokerAdapter>;
+//# sourceMappingURL=broker.d.ts.map

package/dist/contracts/adapters/broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/broker.ts"],"names":[],"mappings":"AAMA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAarD,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAI9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,MAAM,IAAI,CAAC;IACzF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,oBAAoB,CAAiC,CAAC"}

package/dist/contracts/adapters/broker.js

@@ -0,0 +1,9 @@
+// Message-broker seam. The EventBus (@openora/core/server) publishes/subscribes through this
+// adapter, so the inter-module transport is swappable: the default binding is an
+// in-process broker; a downstream operator binds a durable driver (RabbitMQ,
+// Redpanda / Kafka API, NATS JetStream) to MESSAGE_BROKER in an overlay and every
+// event flows through it - no module change. Delivery is at-least-once once a real
+// broker is bound, so consumers must be idempotent. See ADR-0010 and ADR-0016.
+import { createToken } from './token.js';
+export const MESSAGE_BROKER = createToken('MESSAGE_BROKER');
+//# sourceMappingURL=broker.js.map

package/dist/contracts/adapters/broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../../src/contracts/adapters/broker.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,iFAAiF;AACjF,6EAA6E;AAC7E,kFAAkF;AAClF,mFAAmF;AACnF,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAqCrD,MAAM,CAAC,MAAM,cAAc,GAAgC,WAAW,CAAC,gBAAgB,CAAC,CAAC"}

package/dist/contracts/adapters/cache.d.ts

@@ -0,0 +1,10 @@
+import { type Token } from './token.js';
+export type CacheAdapter = {
+    get<T>(key: string): Promise<T | undefined>;
+    set<T>(key: string, value: T, opts: {
+        ttlMs: number;
+    }): Promise<void>;
+    delete(key: string | string[]): Promise<void>;
+};
+export declare const CACHE: Token<CacheAdapter>;
+//# sourceMappingURL=cache.d.ts.map

package/dist/contracts/adapters/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/cache.ts"],"names":[],"mappings":"AAMA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAC5C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C,CAAC;AAEF,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,YAAY,CAAwB,CAAC"}