@openora/core 0.4.0

package/dist/contracts/adapters/cache.js

@@ -0,0 +1,9 @@
+// Cache seam. Hot, non-personalized reads (public catalogue/content feeds) load
+// through this adapter so the backend is swappable: the default binding is an
+// in-process TTL cache (zero deps), process-local so invalidation does NOT
+// propagate across replicas. Set REDIS_URL to bind the shipped Redis reference
+// adapter (cross-replica invalidation) with zero consumer code; rebind CACHE via
+// an overlay for any other backend.
+import { createToken } from './token.js';
+export const CACHE = createToken('CACHE');
+//# sourceMappingURL=cache.js.map

package/dist/contracts/adapters/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../src/contracts/adapters/cache.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,+EAA+E;AAC/E,iFAAiF;AACjF,oCAAoC;AACpC,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAQrD,MAAM,CAAC,MAAM,KAAK,GAAwB,WAAW,CAAC,OAAO,CAAC,CAAC"}

package/dist/contracts/adapters/email.d.ts

@@ -0,0 +1,10 @@
+import { type Token } from './token.js';
+export type SendEmailPort = {
+    send(input: {
+        to: string;
+        subject: string;
+        body: string;
+    }): Promise<void>;
+};
+export declare const SEND_EMAIL: Token<SendEmailPort>;
+//# sourceMappingURL=email.d.ts.map

package/dist/contracts/adapters/email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/email.ts"],"names":[],"mappings":"AAKA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,KAAK,CAAC,aAAa,CAA4C,CAAC"}

package/dist/contracts/adapters/email.js

@@ -0,0 +1,8 @@
+// Email-send seam. The identity module uses this to deliver password-reset and
+// verification emails. The default implementation delegates to
+// NOTIFICATION_DELIVERY_ADAPTER (log-to-stdout in dev); operators swap it via
+// an overlay: ctx.provide(SEND_EMAIL, () => new MyEmailAdapter())
+// Load your overlay AFTER the identity plugin in extensions.config.ts.
+import { createToken } from './token.js';
+export const SEND_EMAIL = createToken('SEND_EMAIL');
+//# sourceMappingURL=email.js.map

package/dist/contracts/adapters/email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../../src/contracts/adapters/email.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+DAA+D;AAC/D,8EAA8E;AAC9E,kEAAkE;AAClE,uEAAuE;AACvE,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAMrD,MAAM,CAAC,MAAM,UAAU,GAAyB,WAAW,CAAgB,YAAY,CAAC,CAAC"}

package/dist/contracts/adapters/game.d.ts

@@ -0,0 +1,10 @@
+import { type Token } from './token.js';
+export type GameAdapter = {
+    launchGame(gameId: string, userId: string, currency: string): Promise<{
+        launchUrl: string;
+        token: string;
+    }>;
+    endRound(externalRoundId: string): Promise<void>;
+};
+export declare const GAME_ADAPTER: Token<GameAdapter>;
+//# sourceMappingURL=game.d.ts.map

package/dist/contracts/adapters/game.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"game.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/game.ts"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,CACR,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,WAAW,CAA+B,CAAC"}

package/dist/contracts/adapters/game.js

@@ -0,0 +1,5 @@
+// Gaming integration seam. A game studio/RGS implements GameAdapter; bind a
+// concrete adapter to GAME_ADAPTER in the module's plugin.ts.
+import { createToken } from './token.js';
+export const GAME_ADAPTER = createToken('GAME_ADAPTER');
+//# sourceMappingURL=game.js.map

package/dist/contracts/adapters/game.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"game.js","sourceRoot":"","sources":["../../../src/contracts/adapters/game.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,8DAA8D;AAC9D,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAWrD,MAAM,CAAC,MAAM,YAAY,GAAuB,WAAW,CAAC,cAAc,CAAC,CAAC"}

package/dist/contracts/adapters/geo-ip.d.ts

@@ -0,0 +1,8 @@
+import { type Token } from './token.js';
+export type GeoIpAdapter = {
+    lookup(ipAddress: string): Promise<{
+        countryCode: string | null;
+    }>;
+};
+export declare const GEO_IP_ADAPTER: Token<GeoIpAdapter>;
+//# sourceMappingURL=geo-ip.d.ts.map

package/dist/contracts/adapters/geo-ip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"geo-ip.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/geo-ip.ts"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACpE,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,YAAY,CAAiC,CAAC"}

package/dist/contracts/adapters/geo-ip.js

@@ -0,0 +1,5 @@
+// Geo-IP seam. A vendor (eg MaxMind) implements GeoIpAdapter; bind a concrete
+// adapter to GEO_IP_ADAPTER in the compliance module's plugin.ts.
+import { createToken } from './token.js';
+export const GEO_IP_ADAPTER = createToken('GEO_IP_ADAPTER');
+//# sourceMappingURL=geo-ip.js.map

package/dist/contracts/adapters/geo-ip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"geo-ip.js","sourceRoot":"","sources":["../../../src/contracts/adapters/geo-ip.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,kEAAkE;AAClE,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAMrD,MAAM,CAAC,MAAM,cAAc,GAAwB,WAAW,CAAC,gBAAgB,CAAC,CAAC"}

package/dist/contracts/adapters/identity-reader.d.ts

@@ -0,0 +1,10 @@
+export type IdentityReader = {
+    /** Timestamp of the player's most recent session, or null if they have never logged in. Used for inactive evaluation. */
+    getLastLoginAt(userId: string): Promise<Date | null>;
+    /** Returns player user ids whose most recent session predates sinceDate. Used for the daily inactive batch sweep. */
+    getPlayerIdsInactiveSince(sinceDate: Date): Promise<string[]>;
+    /** Resolves the player profile id for a given auth user id, or null when no profile exists yet. */
+    getPlayerIdByUserId(userId: string): Promise<string | null>;
+};
+export declare const IDENTITY_READER: import("./token.js").Token<IdentityReader>;
+//# sourceMappingURL=identity-reader.d.ts.map

package/dist/contracts/adapters/identity-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-reader.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/identity-reader.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG;IAC3B,yHAAyH;IACzH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACrD,qHAAqH;IACrH,yBAAyB,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,mGAAmG;IACnG,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC7D,CAAC;AAEF,eAAO,MAAM,eAAe,4CAAiD,CAAC"}

package/dist/contracts/adapters/identity-reader.js

@@ -0,0 +1,3 @@
+import { createToken } from './token.js';
+export const IDENTITY_READER = createToken('IDENTITY_READER');
+//# sourceMappingURL=identity-reader.js.map

package/dist/contracts/adapters/identity-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-reader.js","sourceRoot":"","sources":["../../../src/contracts/adapters/identity-reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAWzC,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAiB,iBAAiB,CAAC,CAAC"}

package/dist/contracts/adapters/identity.d.ts

@@ -0,0 +1,18 @@
+import { type Token } from './token.js';
+export type IdentityLockoutOptions = {
+    enabled?: boolean;
+    maxAttempts?: number;
+    durationMs?: number;
+    bypassForAdmins?: boolean;
+};
+export type IdentityServiceOptions = {
+    lockout?: IdentityLockoutOptions;
+};
+export declare const IDENTITY_OPTIONS: Token<IdentityServiceOptions>;
+export type SessionCommands = {
+    revokeAll(userId: string, actorId?: string): Promise<{
+        success: boolean;
+    }>;
+};
+export declare const SESSION_COMMANDS: Token<SessionCommands>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/contracts/adapters/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/identity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,sBAAsB,CACF,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC5E,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,eAAe,CACF,CAAC"}

package/dist/contracts/adapters/identity.js

@@ -0,0 +1,6 @@
+// Identity options token. Downstream operators can provide this to configure
+// identity behaviors such as login rate-limiting/lockouts.
+import { createToken } from './token.js';
+export const IDENTITY_OPTIONS = createToken('IDENTITY_OPTIONS');
+export const SESSION_COMMANDS = createToken('SESSION_COMMANDS');
+//# sourceMappingURL=identity.js.map

package/dist/contracts/adapters/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/contracts/adapters/identity.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,2DAA2D;AAC3D,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAarD,MAAM,CAAC,MAAM,gBAAgB,GAC3B,WAAW,CAAyB,kBAAkB,CAAC,CAAC;AAM1D,MAAM,CAAC,MAAM,gBAAgB,GAC3B,WAAW,CAAkB,kBAAkB,CAAC,CAAC"}

package/dist/contracts/adapters/index.d.ts

@@ -0,0 +1,51 @@
+export type { AnyToken, Token, SealedToken, ClientPageToken } from './token.js';
+export { createToken, createSealedToken, createClientPageToken } from './token.js';
+export type { EventEnvelope, MessageBrokerAdapter, BrokerHandler, SubscribeOptions, } from './broker.js';
+export { MESSAGE_BROKER } from './broker.js';
+export type { OutboxWriter } from './outbox.js';
+export { OUTBOX } from './outbox.js';
+export type { WalletCommands, WalletDebitArgs, WalletDebitOutcome, WalletCreditArgs, WalletCreditOutcome, } from './wallet-commands.js';
+export { WALLET_COMMANDS } from './wallet-commands.js';
+export type { WalletReader } from './wallet-reader.js';
+export { WALLET_READER } from './wallet-reader.js';
+export type { IdentityReader } from './identity-reader.js';
+export { IDENTITY_READER } from './identity-reader.js';
+export type { JobQueueAdapter, QueueName, BackoffStrategy, EnqueueOptions, RepeatOptions, JobContext, JobHandler, WorkerOptions, WorkerRegistration, PayloadSchema, } from './job-queue.js';
+export { JOB_QUEUE, queue } from './job-queue.js';
+export type { RateLimiterAdapter, RateLimitOptions, RateLimitResult } from './rate-limit.js';
+export { RATE_LIMITER } from './rate-limit.js';
+export type { CacheAdapter } from './cache.js';
+export { CACHE } from './cache.js';
+export type { RealtimeTransport, RealtimePresence, RealtimeConnectionGrant, RealtimeClientAuthorizer, RealtimeClientAuthorizerInput, } from './realtime.js';
+export { REALTIME_TRANSPORT, REALTIME_CLIENT_AUTHORIZER } from './realtime.js';
+export type { GameAdapter } from './game.js';
+export { GAME_ADAPTER } from './game.js';
+export type { KycAdapter, KycVendorStatus, KycDocument, KycResult, KycStatusWriter, KycStatusSource, KycWebhookVerifier, } from './kyc.js';
+export { KYC_ADAPTER, KYC_STATUS_WRITER, KYC_WEBHOOK_VERIFIER } from './kyc.js';
+export type { PaymentAdapter } from './payment.js';
+export { PAYMENT_ADAPTER } from './payment.js';
+export type { GeoIpAdapter } from './geo-ip.js';
+export { GEO_IP_ADAPTER } from './geo-ip.js';
+export type { NotificationDeliveryAdapter } from './notification.js';
+export { NOTIFICATION_DELIVERY_ADAPTER } from './notification.js';
+export type { AggregatorAdapter, AggregatorGame, AggregatorWebhookVerifier } from './aggregator.js';
+export { AGGREGATOR_ADAPTER, AGGREGATOR_WEBHOOK_VERIFIER } from './aggregator.js';
+export type { RngAdapter } from './rng.js';
+export { RNG_ADAPTER } from './rng.js';
+export type { SendEmailPort } from './email.js';
+export { SEND_EMAIL } from './email.js';
+export type { AdminGrant, AdminPermissionResolver } from './admin-permission.js';
+export { ADMIN_PERMISSION_RESOLVER } from './admin-permission.js';
+export type { AuditWritePort, AuditAction, DirectAuditAction } from './audit.js';
+export { AUDIT_WRITER } from './audit.js';
+export type { PlayerTags } from './player-tags.js';
+export { PLAYER_TAGS } from './player-tags.js';
+export type { AdminUserRow, AdminUserListOptions, AdminUserDirectory, AdminPlayerSummary, } from './admin-user-directory.js';
+export { ADMIN_USER_DIRECTORY } from './admin-user-directory.js';
+export type { AdminTxRow, AdminTxDetail, AdminTxListOptions, AdminWalletReporting, } from './admin-wallet-reporting.js';
+export { ADMIN_WALLET_REPORTING } from './admin-wallet-reporting.js';
+export type { IdentityServiceOptions, IdentityLockoutOptions, SessionCommands, } from './identity.js';
+export { IDENTITY_OPTIONS, SESSION_COMMANDS } from './identity.js';
+export type { LoginEnforcementPort } from './login-enforcement.js';
+export { LOGIN_ENFORCEMENT } from './login-enforcement.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/contracts/adapters/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/index.ts"],"names":[],"mappings":"AAKA,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnF,YAAY,EACV,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,YAAY,EACV,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,YAAY,EACV,eAAe,EACf,SAAS,EACT,eAAe,EACf,cAAc,EACd,aAAa,EACb,UAAU,EACV,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAElD,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAE/E,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,YAAY,EACV,UAAU,EACV,eAAe,EACf,WAAW,EACX,SAAS,EACT,eAAe,EACf,eAAe,EACf,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAEhF,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,YAAY,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAElE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAElF,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,YAAY,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAElE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,YAAY,EACV,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,YAAY,EACV,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEnE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/contracts/adapters/index.js

@@ -0,0 +1,30 @@
+// @openora/core/contracts - the single home for vendor adapter interfaces (the swap
+// seams). A module's service depends on an adapter interface; an operator binds
+// a concrete implementation to its DI token in the module's plugin.ts. One file
+// per service category. See AGENTS.md "third-party integration" in the decision tree.
+export { createToken, createSealedToken, createClientPageToken } from './token.js';
+export { MESSAGE_BROKER } from './broker.js';
+export { OUTBOX } from './outbox.js';
+export { WALLET_COMMANDS } from './wallet-commands.js';
+export { WALLET_READER } from './wallet-reader.js';
+export { IDENTITY_READER } from './identity-reader.js';
+export { JOB_QUEUE, queue } from './job-queue.js';
+export { RATE_LIMITER } from './rate-limit.js';
+export { CACHE } from './cache.js';
+export { REALTIME_TRANSPORT, REALTIME_CLIENT_AUTHORIZER } from './realtime.js';
+export { GAME_ADAPTER } from './game.js';
+export { KYC_ADAPTER, KYC_STATUS_WRITER, KYC_WEBHOOK_VERIFIER } from './kyc.js';
+export { PAYMENT_ADAPTER } from './payment.js';
+export { GEO_IP_ADAPTER } from './geo-ip.js';
+export { NOTIFICATION_DELIVERY_ADAPTER } from './notification.js';
+export { AGGREGATOR_ADAPTER, AGGREGATOR_WEBHOOK_VERIFIER } from './aggregator.js';
+export { RNG_ADAPTER } from './rng.js';
+export { SEND_EMAIL } from './email.js';
+export { ADMIN_PERMISSION_RESOLVER } from './admin-permission.js';
+export { AUDIT_WRITER } from './audit.js';
+export { PLAYER_TAGS } from './player-tags.js';
+export { ADMIN_USER_DIRECTORY } from './admin-user-directory.js';
+export { ADMIN_WALLET_REPORTING } from './admin-wallet-reporting.js';
+export { IDENTITY_OPTIONS, SESSION_COMMANDS } from './identity.js';
+export { LOGIN_ENFORCEMENT } from './login-enforcement.js';
+//# sourceMappingURL=index.js.map

package/dist/contracts/adapters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/contracts/adapters/index.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gFAAgF;AAChF,gFAAgF;AAChF,sFAAsF;AAGtF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAQnF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AASrC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAcvD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAGlD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AASnC,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAG/E,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAWzC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAGhF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAGlE,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAGlF,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGvC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG1C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAQ/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAQjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAOrE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/contracts/adapters/job-queue.d.ts

@@ -0,0 +1,58 @@
+import { type Token } from './token.js';
+export type QueueName = string & {
+    readonly __brand: 'QueueName';
+};
+export declare const queue: (name: string) => QueueName;
+export type BackoffStrategy = {
+    type: 'fixed' | 'exponential';
+    delayMs: number;
+};
+export type EnqueueOptions = {
+    idempotencyKey?: string;
+    orderingKey?: string;
+    delayMs?: number;
+    attempts?: number;
+    backoff?: BackoffStrategy;
+    priority?: number;
+    ttlMs?: number;
+    meta?: Record<string, string | undefined>;
+};
+export type RepeatOptions = {
+    cron?: string;
+    everyMs?: number;
+    timezone?: string;
+};
+export type JobContext<T> = {
+    id: string;
+    name: QueueName;
+    payload: T;
+    attempt: number;
+    enqueuedAt: Date;
+    meta: Record<string, string | undefined>;
+};
+export type JobHandler<T> = (ctx: JobContext<T>) => void | Promise<void>;
+export type WorkerOptions = {
+    concurrency?: number;
+    serializeByOrderingKey?: boolean;
+};
+export type PayloadSchema<T> = {
+    parse(data: unknown): T;
+};
+export type WorkerRegistration<T> = {
+    queue: QueueName;
+    schema: PayloadSchema<T>;
+    handler: JobHandler<T>;
+    options?: WorkerOptions;
+    onDeadLetter?: (ctx: JobContext<T>, error: Error) => void | Promise<void>;
+};
+export type JobQueueAdapter = {
+    enqueue<T>(queue: QueueName, payload: T, opts?: EnqueueOptions): Promise<{
+        id: string;
+    }>;
+    schedule<T>(queue: QueueName, scheduleId: string, payload: T, repeat: RepeatOptions): Promise<void>;
+    unschedule(queue: QueueName, scheduleId: string): Promise<void>;
+    registerWorker<T>(registration: WorkerRegistration<T>): void;
+    close(): Promise<void>;
+};
+export declare const JOB_QUEUE: Token<JobQueueAdapter>;
+//# sourceMappingURL=job-queue.d.ts.map

package/dist/contracts/adapters/job-queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-queue.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/job-queue.ts"],"names":[],"mappings":"AASA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAIrD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AACnE,eAAO,MAAM,KAAK,GAAI,MAAM,MAAM,KAAG,SAA8B,CAAC;AAEpE,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,OAAO,GAAG,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,MAAM,MAAM,cAAc,GAAG;IAK3B,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAIF,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,IAAI,CAAC;IAEjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEzE,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC,CAAC;AAKF,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI;IAC7B,KAAK,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,CAAC;CACzB,CAAC;AAIF,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI;IAClC,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,CAAC,EAAE,aAAa,CAAC;IAGxB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEzF,QAAQ,CAAC,CAAC,EACR,KAAK,EAAE,SAAS,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,CAAC,EACV,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE,cAAc,CAAC,CAAC,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAE7D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,eAAe,CAA4B,CAAC"}

package/dist/contracts/adapters/job-queue.js

@@ -0,0 +1,13 @@
+// Background-job seam. Modules enqueue durable, retryable, schedulable work
+// through this adapter, so the queue driver is swappable: the default binding is
+// an in-process queue (zero dependencies - good for `pnpm dev`, seed and tests);
+// a downstream operator binds a durable driver (BullMQ/Redis is the reference
+// overlay) to JOB_QUEUE without touching modules. Delivery is at-least-once, so
+// handlers MUST be idempotent (use `idempotencyKey` + a DB guard for money jobs).
+// Distinct from MESSAGE_BROKER: the broker is "something happened" fan-out (the
+// EventBus facade); JOB_QUEUE is "execute this unit of work later, with delivery
+// and retry control". See ADR-0014.
+import { createToken } from './token.js';
+export const queue = (name) => name;
+export const JOB_QUEUE = createToken('JOB_QUEUE');
+//# sourceMappingURL=job-queue.js.map

package/dist/contracts/adapters/job-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-queue.js","sourceRoot":"","sources":["../../../src/contracts/adapters/job-queue.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,iFAAiF;AACjF,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,oCAAoC;AACpC,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAKrD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAa,EAAE,CAAC,IAAiB,CAAC;AAmFpE,MAAM,CAAC,MAAM,SAAS,GAA2B,WAAW,CAAC,WAAW,CAAC,CAAC"}

package/dist/contracts/adapters/kyc.d.ts

@@ -0,0 +1,45 @@
+import { type Token } from './token.js';
+import type { KycStatus, Player } from '../schemas/player.js';
+export type KycStatusSource = 'vendor' | 'manual' | 'webhook' | 'reverify';
+export type KycDocument = {
+    type: 'passport' | 'drivers_license' | 'national_id';
+    frontUrl: string;
+    backUrl?: string;
+};
+export type KycVendorStatus = 'pending' | 'approved' | 'rejected' | 'not_started';
+export type KycResult = {
+    referenceId: string;
+    status: KycVendorStatus;
+};
+export type KycAdapter = {
+    readonly autoApproves?: boolean;
+    submit(userId: string, documents: KycDocument[]): Promise<KycResult>;
+    getStatus(userId: string): Promise<KycVendorStatus>;
+    parseWebhook?(rawBody: string, headers: Record<string, string | string[] | undefined>): KycResult | null;
+};
+export declare const KYC_ADAPTER: Token<KycAdapter>;
+/**
+ * Single-writer port for `player.kycStatus`. The invariant is enforced structurally,
+ * not by a sealed token: pam owns the `player` table and binds the only implementation,
+ * so every status change (admin override, vendor decision, webhook, threshold re-KYC)
+ * routes through one write + one `compliance.kyc.updated` emit. An overlay MAY rebind
+ * this port, but it MUST preserve that audit emit - dropping it breaks the 5AMLD trail.
+ * `actorId` is the admin who acted, or null for a system change (vendor/webhook/re-KYC).
+ * `source` records what drove it. `tx` is the caller's active transaction handle to stay
+ * atomic with the caller's own writes (e.g. the player-management update), else the writer
+ * uses its own; typed `unknown` because this contracts-zone port cannot import drizzle's
+ * transaction type - matches the WALLET_COMMANDS convention.
+ */
+export type KycStatusWriter = {
+    setStatus(userId: Player['userId'], status: KycStatus, opts: {
+        actorId: Player['userId'] | null;
+        reason?: string;
+        source: KycStatusSource;
+    }, tx?: unknown): Promise<void>;
+};
+export declare const KYC_STATUS_WRITER: Token<KycStatusWriter>;
+export type KycWebhookVerifier = {
+    verify(rawBody: string, signature: string | null): boolean;
+};
+export declare const KYC_WEBHOOK_VERIFIER: Token<KycWebhookVerifier>;
+//# sourceMappingURL=kyc.d.ts.map

package/dist/contracts/adapters/kyc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kyc.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/kyc.ts"],"names":[],"mappings":"AAKA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;AAE3E,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,UAAU,GAAG,iBAAiB,GAAG,aAAa,CAAC;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;AAElF,MAAM,MAAM,SAAS,GAAG;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IAIvB,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACrE,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAIpD,YAAY,CAAC,CACX,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,SAAS,GAAG,IAAI,CAAC;CACrB,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CACP,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EACxB,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,eAAe,CAAA;KAAE,EACpF,EAAE,CAAC,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAoC,CAAC;AAM1F,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;CAC5D,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAuC,CAAC"}

package/dist/contracts/adapters/kyc.js

@@ -0,0 +1,10 @@
+// KYC/identity-verification seam. Intended real provider: SumSub (https://sumsub.com).
+// The identity module ships MockKycAdapter (auto-approves) as the default binding.
+// Override via overlay: ctx.provide(KYC_ADAPTER, () => new SumsubKycAdapter())
+// Load your overlay AFTER the identity plugin in extensions.config.ts (last registration wins).
+// See docs/adapters/kyc.md for the full binding guide.
+import { createToken } from './token.js';
+export const KYC_ADAPTER = createToken('KYC_ADAPTER');
+export const KYC_STATUS_WRITER = createToken('KYC_STATUS_WRITER');
+export const KYC_WEBHOOK_VERIFIER = createToken('KYC_WEBHOOK_VERIFIER');
+//# sourceMappingURL=kyc.js.map

package/dist/contracts/adapters/kyc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kyc.js","sourceRoot":"","sources":["../../../src/contracts/adapters/kyc.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,mFAAmF;AACnF,+EAA+E;AAC/E,gGAAgG;AAChG,uDAAuD;AACvD,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAkCrD,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC;AAuBzE,MAAM,CAAC,MAAM,iBAAiB,GAA2B,WAAW,CAAC,mBAAmB,CAAC,CAAC;AAU1F,MAAM,CAAC,MAAM,oBAAoB,GAA8B,WAAW,CAAC,sBAAsB,CAAC,CAAC"}

package/dist/contracts/adapters/login-enforcement.d.ts

@@ -0,0 +1,9 @@
+import { type Token } from './token.js';
+export type LoginEnforcementPort = {
+    block(userId: string, opts: {
+        until: Date | null;
+    }): Promise<void>;
+    unblock(userId: string): Promise<void>;
+};
+export declare const LOGIN_ENFORCEMENT: Token<LoginEnforcementPort>;
+//# sourceMappingURL=login-enforcement.d.ts.map

package/dist/contracts/adapters/login-enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-enforcement.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/login-enforcement.ts"],"names":[],"mappings":"AAMA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,oBAAoB,CAAoC,CAAC"}

package/dist/contracts/adapters/login-enforcement.js

@@ -0,0 +1,9 @@
+// Push port for Responsible-Gambling login enforcement. Owned + bound by the identity
+// module (it owns the `user` table); compliance depends only on this port to block or
+// unblock a player's login, never on the identity schema. `block` also revokes all of
+// the player's active sessions (the RG session-termination requirement). `until: null`
+// means an indefinite block (self-exclusion / permanent); a Date is the cooling-off
+// expiry the login gate auto-clears once elapsed. See ADR-0017.
+import { createToken } from './token.js';
+export const LOGIN_ENFORCEMENT = createToken('LOGIN_ENFORCEMENT');
+//# sourceMappingURL=login-enforcement.js.map

package/dist/contracts/adapters/login-enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-enforcement.js","sourceRoot":"","sources":["../../../src/contracts/adapters/login-enforcement.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,oFAAoF;AACpF,gEAAgE;AAChE,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAOrD,MAAM,CAAC,MAAM,iBAAiB,GAAgC,WAAW,CAAC,mBAAmB,CAAC,CAAC"}

package/dist/contracts/adapters/notification.d.ts

@@ -0,0 +1,6 @@
+import { type Token } from './token.js';
+export type NotificationDeliveryAdapter = {
+    sendEmail(to: string, subject: string, body: string): Promise<void>;
+};
+export declare const NOTIFICATION_DELIVERY_ADAPTER: Token<NotificationDeliveryAdapter>;
+//# sourceMappingURL=notification.d.ts.map

package/dist/contracts/adapters/notification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/notification.ts"],"names":[],"mappings":"AAKA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,2BAA2B,GAAG;IACxC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,KAAK,CAAC,2BAA2B,CAE5E,CAAC"}

package/dist/contracts/adapters/notification.js

@@ -0,0 +1,8 @@
+// Notification-delivery seam. Custom implementation expected (no prescribed vendor).
+// The notifications module ships MockNotificationDeliveryAdapter (logs to stdout) as default.
+// Override via overlay: ctx.provide(NOTIFICATION_DELIVERY_ADAPTER, () => new MyAdapter())
+// Load your overlay AFTER the notifications plugin in extensions.config.ts (last registration wins).
+// See docs/adapters/notification.md for the full binding guide.
+import { createToken } from './token.js';
+export const NOTIFICATION_DELIVERY_ADAPTER = createToken('NOTIFICATION_DELIVERY_ADAPTER');
+//# sourceMappingURL=notification.js.map

package/dist/contracts/adapters/notification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification.js","sourceRoot":"","sources":["../../../src/contracts/adapters/notification.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,8FAA8F;AAC9F,0FAA0F;AAC1F,qGAAqG;AACrG,gEAAgE;AAChE,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAMrD,MAAM,CAAC,MAAM,6BAA6B,GAAuC,WAAW,CAC1F,+BAA+B,CAChC,CAAC"}

package/dist/contracts/adapters/outbox.d.ts

@@ -0,0 +1,7 @@
+import { type Token } from './token.js';
+import type { EventEnvelope } from './broker.js';
+export type OutboxWriter = {
+    write(tx: unknown, envelope: EventEnvelope): Promise<void>;
+};
+export declare const OUTBOX: Token<OutboxWriter>;
+//# sourceMappingURL=outbox.d.ts.map

package/dist/contracts/adapters/outbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbox.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/outbox.ts"],"names":[],"mappings":"AAYA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,YAAY,CAAyB,CAAC"}

package/dist/contracts/adapters/outbox.js

@@ -0,0 +1,15 @@
+// Transactional-outbox seam. A money/critical service, INSIDE its db.transaction,
+// records the event through this port; the row commits atomically with the state
+// change. A relay then publishes it to the MESSAGE_BROKER after commit, closing
+// the gap where a crash between "state committed" and "event published" would
+// otherwise lose the event. This is the primitive that makes cross-service,
+// at-least-once domain events reliable - and the reason a module can be extracted
+// to its own process without dropping events. See ADR-0016.
+//
+// `tx` is the active transaction handle, typed `unknown` here to keep @openora/core/contracts
+// ORM-free; the Drizzle implementation in @openora/core/server narrows it. Services never touch
+// this port directly - they call EventBus.emitInTransaction(tx, ...), which builds
+// the envelope and delegates here.
+import { createToken } from './token.js';
+export const OUTBOX = createToken('OUTBOX');
+//# sourceMappingURL=outbox.js.map

package/dist/contracts/adapters/outbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbox.js","sourceRoot":"","sources":["../../../src/contracts/adapters/outbox.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,kFAAkF;AAClF,4DAA4D;AAC5D,EAAE;AACF,8FAA8F;AAC9F,gGAAgG;AAChG,mFAAmF;AACnF,mCAAmC;AACnC,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAOrD,MAAM,CAAC,MAAM,MAAM,GAAwB,WAAW,CAAC,QAAQ,CAAC,CAAC"}

package/dist/contracts/adapters/payment.d.ts

@@ -0,0 +1,13 @@
+import { type Token } from './token.js';
+export type PaymentAdapter = {
+    processDeposit(amount: number, currency: string, metadata: Record<string, unknown>): Promise<{
+        externalId: string;
+        status: string;
+    }>;
+    processWithdrawal(amount: number, currency: string, metadata: Record<string, unknown>): Promise<{
+        externalId: string;
+        status: string;
+    }>;
+};
+export declare const PAYMENT_ADAPTER: Token<PaymentAdapter>;
+//# sourceMappingURL=payment.d.ts.map

package/dist/contracts/adapters/payment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/payment.ts"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG;IAC3B,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEnD,iBAAiB,CACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,cAAc,CAAkC,CAAC"}

package/dist/contracts/adapters/payment.js

@@ -0,0 +1,5 @@
+// Payment seam. A PSP (card/bank/e-wallet) implements PaymentAdapter; bind a
+// concrete adapter to PAYMENT_ADAPTER in the wallet module's plugin.ts.
+import { createToken } from './token.js';
+export const PAYMENT_ADAPTER = createToken('PAYMENT_ADAPTER');
+//# sourceMappingURL=payment.js.map

package/dist/contracts/adapters/payment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment.js","sourceRoot":"","sources":["../../../src/contracts/adapters/payment.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,wEAAwE;AACxE,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAgBrD,MAAM,CAAC,MAAM,eAAe,GAA0B,WAAW,CAAC,iBAAiB,CAAC,CAAC"}

package/dist/contracts/adapters/player-tags.d.ts

@@ -0,0 +1,7 @@
+import { type Token } from './token.js';
+import type { TagKey } from '../schemas/tag.js';
+export type PlayerTags = {
+    getActiveTagKeys(userIds: readonly string[]): Promise<Map<string, TagKey[]>>;
+};
+export declare const PLAYER_TAGS: Token<PlayerTags>;
+//# sourceMappingURL=player-tags.d.ts.map

package/dist/contracts/adapters/player-tags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"player-tags.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/player-tags.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAIhD,MAAM,MAAM,UAAU,GAAG;IACvB,gBAAgB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;CAC9E,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC"}

package/dist/contracts/adapters/player-tags.js

@@ -0,0 +1,3 @@
+import { createToken } from './token.js';
+export const PLAYER_TAGS = createToken('PLAYER_TAGS');
+//# sourceMappingURL=player-tags.js.map

package/dist/contracts/adapters/player-tags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"player-tags.js","sourceRoot":"","sources":["../../../src/contracts/adapters/player-tags.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AASrD,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC"}

package/dist/contracts/adapters/rate-limit.d.ts

@@ -0,0 +1,15 @@
+import { type Token } from './token.js';
+export type RateLimitOptions = {
+    limit: number;
+    windowMs: number;
+    onUnavailable?: 'allow' | 'deny';
+};
+export type RateLimitResult = {
+    allowed: boolean;
+    retryAfterMs: number;
+};
+export type RateLimiterAdapter = {
+    consume(key: string, opts: RateLimitOptions): Promise<RateLimitResult>;
+};
+export declare const RATE_LIMITER: Token<RateLimiterAdapter>;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/contracts/adapters/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/rate-limit.ts"],"names":[],"mappings":"AAMA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,gBAAgB,GAAG;IAE7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IAKjB,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,OAAO,CAAC;IAEjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACxE,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,kBAAkB,CAA+B,CAAC"}

package/dist/contracts/adapters/rate-limit.js

@@ -0,0 +1,9 @@
+// Rate-limiter seam. Abuse-prone routes (auth flows, money mutations) consume
+// from this adapter so the throttling backend is swappable: the default binding
+// is an in-process fixed-window limiter (zero deps - good for `pnpm dev`, seed
+// and tests), process-local so it does NOT coordinate across replicas. Set
+// REDIS_URL to bind the shipped Redis reference adapter (distributed fixed-window)
+// with zero consumer code; rebind RATE_LIMITER via an overlay for any other backend.
+import { createToken } from './token.js';
+export const RATE_LIMITER = createToken('RATE_LIMITER');
+//# sourceMappingURL=rate-limit.js.map

package/dist/contracts/adapters/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/contracts/adapters/rate-limit.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,2EAA2E;AAC3E,mFAAmF;AACnF,qFAAqF;AACrF,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAuBrD,MAAM,CAAC,MAAM,YAAY,GAA8B,WAAW,CAAC,cAAc,CAAC,CAAC"}