@openora/core 0.4.1-canary.11 → 0.4.1-canary.111

package/dist/server/runtime/core-token-catalog.d.ts

@@ -0,0 +1,136 @@
+declare const coreTokenCatalog: {
+    ADMIN_GAME_REPORTING: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminGameReporting>;
+    ADMIN_GUARD: import("@openora/core/contracts").Token<import("../auth/admin-guard.js").AdminGuard>;
+    ADMIN_PERMISSION_RESOLVER: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminPermissionResolver>;
+    ADMIN_PLAYER_ACTIVITY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminPlayerActivity>;
+    ADMIN_ROLE_ASSIGNMENT_DIRECTORY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminRoleAssignmentDirectory>;
+    ADMIN_USER_DIRECTORY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminUserDirectory>;
+    ADMIN_WALLET_REPORTING: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminWalletReporting>;
+    AUDIT_WRITER: import("@openora/core/contracts").SealedToken<import("@openora/core/contracts").AuditWritePort>;
+    AUTH_SESSION: import("@openora/core/contracts").Token<import("../auth/session-resolver.js").SessionResolver>;
+    CACHE: import("@openora/core/contracts").Token<import("@openora/core/contracts").CacheAdapter>;
+    CHAT_BLOCK_WRITER: import("@openora/core/contracts").Token<import("@openora/core/contracts").ChatBlockWriter>;
+    CHAT_MODERATION: import("@openora/core/contracts").Token<import("@openora/core/contracts").ChatModeration, string>;
+    CHAT_REALTIME_CLIENT_AUTHORIZER: import("@openora/core/contracts").Token<import("@openora/core/contracts").RealtimeClientAuthorizer>;
+    CHAT_REALTIME_TRANSPORT: import("@openora/core/contracts").Token<import("@openora/core/contracts").RealtimeTransport>;
+    CHAT_ROOM_ACCESS: import("@openora/core/contracts").Token<import("@openora/core/contracts").ChatRoomAccess>;
+    CHAT_SYSTEM_WRITER: import("@openora/core/contracts").Token<import("@openora/core/contracts").ChatSystemWriter, string>;
+    DRIZZLE: import("@openora/core/contracts").Token<import("../db/drizzle.service.js").DrizzleService>;
+    EMAIL_TEMPLATE_RENDERER: import("@openora/core/contracts").Token<import("@openora/core/contracts").EmailTemplateRenderer>;
+    ERROR_TRACKING: import("@openora/core/contracts").Token<import("@openora/core/contracts").ErrorTrackingAdapter>;
+    EVENT_BUS: import("@openora/core/contracts").Token<import("../kernel/event-bus.js").EventBus>;
+    GAME_ADAPTER: import("@openora/core/contracts").Token<import("@openora/core/contracts").GameAdapter>;
+    GEO_CHECK_COMMANDS: import("@openora/core/contracts").Token<import("@openora/core/contracts").GeoCheckCommands>;
+    GEO_IP_ADAPTER: import("@openora/core/contracts").Token<import("@openora/core/contracts").GeoIpAdapter>;
+    IDENTITY_OPTIONS: import("@openora/core/contracts").Token<import("@openora/core/contracts").IdentityServiceOptions>;
+    IDENTITY_READER: import("@openora/core/contracts").Token<import("@openora/core/contracts").IdentityReader, string>;
+    IGAMING_CONFIG: import("@openora/core/contracts").Token<{
+        branding: {
+            name: string;
+            themePreset?: string | undefined;
+            supportEmail?: string | undefined;
+        };
+        currencies: string[];
+        jurisdictions: string[];
+        blockedCountries: string[];
+        limits: {
+            maxDepositPerDay?: number | undefined;
+            maxDepositPerMonth?: number | undefined;
+            maxLossPerDay?: number | undefined;
+            maxStakePerBet?: number | undefined;
+            sessionReminderMinutes?: number | undefined;
+        };
+        providers: {
+            payment?: string | undefined;
+            kyc?: string | undefined;
+            geoIp?: string | undefined;
+            aggregator?: string | undefined;
+            notification?: string | undefined;
+        };
+        enabledModules?: string[] | undefined;
+    }, string>;
+    JOB_QUEUE: import("@openora/core/contracts").Token<import("@openora/core/contracts").JobQueueAdapter>;
+    KYC_ADAPTER: import("@openora/core/contracts").Token<import("@openora/core/contracts").KycAdapter>;
+    KYC_STATUS_WRITER: import("@openora/core/contracts").Token<import("@openora/core/contracts").KycStatusWriter>;
+    KYC_WEBHOOK_VERIFIER: import("@openora/core/contracts").Token<import("@openora/core/contracts").KycWebhookVerifier>;
+    LOGIN_ENFORCEMENT: import("@openora/core/contracts").Token<import("@openora/core/contracts").LoginEnforcementPort>;
+    MESSAGE_BROKER: import("@openora/core/contracts").Token<import("@openora/core/contracts").MessageBrokerAdapter>;
+    NOTIFICATION_DELIVERY_ADAPTER: import("@openora/core/contracts").Token<import("@openora/core/contracts").NotificationDeliveryAdapter>;
+    OUTBOX: import("@openora/core/contracts").Token<import("@openora/core/contracts").OutboxWriter>;
+    PAYMENT_ADAPTER: import("@openora/core/contracts").Token<import("@openora/core/contracts").PaymentAdapter>;
+    PAYMENT_PROVIDERS: import("@openora/core/contracts").Token<import("@openora/core/contracts").PaymentProviderRegistry>;
+    PAYMENT_WEBHOOK_VERIFIER: import("@openora/core/contracts").Token<import("@openora/core/contracts").PaymentWebhookVerifier>;
+    PLATFORM_CONFIG: import("@openora/core/contracts").Token<{
+        features: Record<string, boolean>;
+        brands: {
+            id: string;
+            name: string;
+            themePreset?: string | undefined;
+            themeOverrides?: Record<string, string> | undefined;
+        }[];
+        rgLimits: Record<string, {
+            maxDepositPerDay?: number | undefined;
+            maxDepositPerMonth?: number | undefined;
+            maxLossPerDay?: number | undefined;
+            maxStakePerBet?: number | undefined;
+            sessionReminderMinutes?: number | undefined;
+        }>;
+        activeBrand?: string | undefined;
+        kyc?: {
+            gateWithdrawals: boolean;
+            provider?: string | undefined;
+            webhookSecretEnv?: string | undefined;
+            reverifyThresholds?: Record<string, string> | undefined;
+        } | undefined;
+        autoWithdrawal?: {
+            enabled: boolean;
+            dailyCapAmount?: string | undefined;
+            dailyCapCount?: number | undefined;
+        } | undefined;
+        wallet?: {
+            cryptoCurrencies?: string[] | undefined;
+            treasuryRefs?: Record<string, string> | undefined;
+            sweep?: {
+                cron: string;
+                feeMultiple: string;
+                batchSize: number;
+                concurrency: number;
+                unknownAfterMinutes: number;
+                staleRunAfterMinutes: number;
+            } | undefined;
+            reconciliation?: {
+                cron: string;
+                lookbackHours: number;
+                batchSize: number;
+                stuckAfterMinutes: number;
+                staleRunAfterMinutes: number;
+                alertThreshold: number;
+            } | undefined;
+        } | undefined;
+        registration?: {
+            termsVersion: string;
+            requireEmailVerification: boolean;
+        } | undefined;
+        supportedLanguages?: string[] | undefined;
+    }, string>;
+    PLAYER_ACTIVITY_TRACKER: import("@openora/core/contracts").Token<import("@openora/core/contracts").PlayerActivityTracker>;
+    PLAYER_PROVISIONING: import("@openora/core/contracts").Token<import("@openora/core/contracts").PlayerProvisioning>;
+    PLAYER_TAGS: import("@openora/core/contracts").Token<import("@openora/core/contracts").PlayerTags>;
+    PLAY_ELIGIBILITY: import("@openora/core/contracts").Token<import("@openora/core/contracts").PlayEligibilityPort>;
+    RATE_LIMITER: import("@openora/core/contracts").Token<import("@openora/core/contracts").RateLimiterAdapter<`register:${string}` | `login:${string}` | `enable2fa:${string}` | `verify2fa:${string}` | `disable2fa:${string}` | `pwreset-req:${string}` | `pwreset-verify:${string}` | `pwreset:${string}` | `change-password:${string}` | `email-verify:${string}` | `verify-email:${string}` | `wallet-mutation:${string}` | `wallet-webhook:${string}` | `chat-room-join:${string}` | `chat-send:${string}` | `report-access-denied:${string}`>>;
+    REALTIME_CLIENT_AUTHORIZER: import("@openora/core/contracts").Token<import("@openora/core/contracts").RealtimeClientAuthorizer>;
+    REALTIME_TRANSPORT: import("@openora/core/contracts").Token<import("@openora/core/contracts").RealtimeTransport>;
+    RNG_ADAPTER: import("@openora/core/contracts").Token<import("@openora/core/contracts").RngAdapter>;
+    SEND_EMAIL: import("@openora/core/contracts").Token<import("@openora/core/contracts").SendEmailPort>;
+    SESSION_COMMANDS: import("@openora/core/contracts").Token<import("@openora/core/contracts").SessionCommands>;
+    USER_COMMANDS: import("@openora/core/contracts").Token<import("@openora/core/contracts").UserCommands>;
+    SMS_ADAPTER: import("@openora/core/contracts").Token<import("@openora/core/contracts").SmsAdapter>;
+    SOCIAL_COMMANDS: import("@openora/core/contracts").Token<import("@openora/core/contracts").SocialCommands>;
+    TAG_EVALUATION_COMMANDS: import("@openora/core/contracts").Token<import("@openora/core/contracts").TagEvaluationCommands>;
+    WALLET_ASSET_CATALOG: import("@openora/core/contracts").Token<import("@openora/core/contracts").WalletAssetCatalog, string>;
+    WALLET_COMMANDS: import("@openora/core/contracts").Token<import("@openora/core/contracts").WalletCommands>;
+    WALLET_READER: import("@openora/core/contracts").Token<import("@openora/core/contracts").WalletReader, string>;
+};
+export type CoreTokenCatalog = typeof coreTokenCatalog;
+export {};
+//# sourceMappingURL=core-token-catalog.d.ts.map

package/dist/server/runtime/core-token-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-token-catalog.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/core-token-catalog.ts"],"names":[],"mappings":"AA0DA,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwDE,CAAC;AAEzB,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC"}

package/dist/server/runtime/core-token-catalog.js

@@ -0,0 +1,62 @@
+import { ADMIN_GAME_REPORTING, ADMIN_PERMISSION_RESOLVER, ADMIN_PLAYER_ACTIVITY, ADMIN_ROLE_ASSIGNMENT_DIRECTORY, ADMIN_USER_DIRECTORY, ADMIN_WALLET_REPORTING, AUDIT_WRITER, CACHE, CHAT_BLOCK_WRITER, CHAT_MODERATION, CHAT_REALTIME_CLIENT_AUTHORIZER, CHAT_REALTIME_TRANSPORT, CHAT_ROOM_ACCESS, CHAT_SYSTEM_WRITER, EMAIL_TEMPLATE_RENDERER, ERROR_TRACKING, GAME_ADAPTER, GEO_CHECK_COMMANDS, GEO_IP_ADAPTER, IDENTITY_OPTIONS, IDENTITY_READER, IGAMING_CONFIG, JOB_QUEUE, KYC_ADAPTER, KYC_STATUS_WRITER, KYC_WEBHOOK_VERIFIER, LOGIN_ENFORCEMENT, MESSAGE_BROKER, NOTIFICATION_DELIVERY_ADAPTER, OUTBOX, PAYMENT_ADAPTER, PAYMENT_PROVIDERS, PAYMENT_WEBHOOK_VERIFIER, PLATFORM_CONFIG, PLAYER_ACTIVITY_TRACKER, PLAYER_PROVISIONING, PLAYER_TAGS, PLAY_ELIGIBILITY, RATE_LIMITER, REALTIME_CLIENT_AUTHORIZER, REALTIME_TRANSPORT, RNG_ADAPTER, SEND_EMAIL, SESSION_COMMANDS, USER_COMMANDS, SMS_ADAPTER, SOCIAL_COMMANDS, TAG_EVALUATION_COMMANDS, WALLET_ASSET_CATALOG, WALLET_COMMANDS, WALLET_READER, } from '@openora/core/contracts';
+import { ADMIN_GUARD, AUTH_SESSION } from '../auth/index.js';
+import { DRIZZLE } from '../db/index.js';
+import { EVENT_BUS } from '../kernel/index.js';
+const coreTokenCatalog = {
+    ADMIN_GAME_REPORTING,
+    ADMIN_GUARD,
+    ADMIN_PERMISSION_RESOLVER,
+    ADMIN_PLAYER_ACTIVITY,
+    ADMIN_ROLE_ASSIGNMENT_DIRECTORY,
+    ADMIN_USER_DIRECTORY,
+    ADMIN_WALLET_REPORTING,
+    AUDIT_WRITER,
+    AUTH_SESSION,
+    CACHE,
+    CHAT_BLOCK_WRITER,
+    CHAT_MODERATION,
+    CHAT_REALTIME_CLIENT_AUTHORIZER,
+    CHAT_REALTIME_TRANSPORT,
+    CHAT_ROOM_ACCESS,
+    CHAT_SYSTEM_WRITER,
+    DRIZZLE,
+    EMAIL_TEMPLATE_RENDERER,
+    ERROR_TRACKING,
+    EVENT_BUS,
+    GAME_ADAPTER,
+    GEO_CHECK_COMMANDS,
+    GEO_IP_ADAPTER,
+    IDENTITY_OPTIONS,
+    IDENTITY_READER,
+    IGAMING_CONFIG,
+    JOB_QUEUE,
+    KYC_ADAPTER,
+    KYC_STATUS_WRITER,
+    KYC_WEBHOOK_VERIFIER,
+    LOGIN_ENFORCEMENT,
+    MESSAGE_BROKER,
+    NOTIFICATION_DELIVERY_ADAPTER,
+    OUTBOX,
+    PAYMENT_ADAPTER,
+    PAYMENT_PROVIDERS,
+    PAYMENT_WEBHOOK_VERIFIER,
+    PLATFORM_CONFIG,
+    PLAYER_ACTIVITY_TRACKER,
+    PLAYER_PROVISIONING,
+    PLAYER_TAGS,
+    PLAY_ELIGIBILITY,
+    RATE_LIMITER,
+    REALTIME_CLIENT_AUTHORIZER,
+    REALTIME_TRANSPORT,
+    RNG_ADAPTER,
+    SEND_EMAIL,
+    SESSION_COMMANDS,
+    USER_COMMANDS,
+    SMS_ADAPTER,
+    SOCIAL_COMMANDS,
+    TAG_EVALUATION_COMMANDS,
+    WALLET_ASSET_CATALOG,
+    WALLET_COMMANDS,
+    WALLET_READER,
+};
+//# sourceMappingURL=core-token-catalog.js.map

package/dist/server/runtime/core-token-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-token-catalog.js","sourceRoot":"","sources":["../../../src/server/runtime/core-token-catalog.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,qBAAqB,EACrB,+BAA+B,EAC/B,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,EACZ,KAAK,EACL,iBAAiB,EACjB,eAAe,EACf,+BAA+B,EAC/B,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,6BAA6B,EAC7B,MAAM,EACN,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,0BAA0B,EAC1B,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,eAAe,EACf,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,gBAAgB,GAAG;IACvB,oBAAoB;IACpB,WAAW;IACX,yBAAyB;IACzB,qBAAqB;IACrB,+BAA+B;IAC/B,oBAAoB;IACpB,sBAAsB;IACtB,YAAY;IACZ,YAAY;IACZ,KAAK;IACL,iBAAiB;IACjB,eAAe;IACf,+BAA+B;IAC/B,uBAAuB;IACvB,gBAAgB;IAChB,kBAAkB;IAClB,OAAO;IACP,uBAAuB;IACvB,cAAc;IACd,SAAS;IACT,YAAY;IACZ,kBAAkB;IAClB,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,cAAc;IACd,SAAS;IACT,WAAW;IACX,iBAAiB;IACjB,oBAAoB;IACpB,iBAAiB;IACjB,cAAc;IACd,6BAA6B;IAC7B,MAAM;IACN,eAAe;IACf,iBAAiB;IACjB,wBAAwB;IACxB,eAAe;IACf,uBAAuB;IACvB,mBAAmB;IACnB,WAAW;IACX,gBAAgB;IAChB,YAAY;IACZ,0BAA0B;IAC1B,kBAAkB;IAClB,WAAW;IACX,UAAU;IACV,gBAAgB;IAChB,aAAa;IACb,WAAW;IACX,eAAe;IACf,uBAAuB;IACvB,oBAAoB;IACpB,eAAe;IACf,aAAa;CACS,CAAC"}

package/dist/server/runtime/create-app.d.ts

@@ -1,8 +1,8 @@
-import type { ContractRouter } from '@orpc/contract';
 import { Hono } from 'hono';
 import { Container } from '../kernel/index.js';
 import { type IgamingConfig } from '@openora/core/contracts';
 import { type PluginEntry } from '../plugin-host/index.js';
+import type { CoreTokenCatalog } from './core-token-catalog.js';
 export type CreateAppConfig = {
     plugins: PluginEntry[];
     authSchema?: Record<string, unknown>;
@@ -11,42 +11,36 @@ export type CreateAppConfig = {
         origins?: string | string[];
     };
     databaseUrl?: string;
-    contract?: ContractRouter<any>;
-    openapi?: {
-        enabled?: boolean;
-        info?: {
-            title?: string;
-            version?: string;
-        };
-        outputPath?: string;
-    };
     igaming?: IgamingConfig;
     httpCache?: {
         paths?: string[];
         maxAgeSeconds?: number;
     } | false;
-    configure?: (container: Container) => void | Promise<void>;
     disableHealthModule?: boolean;
 };
 export type CreatedApp = {
     app: Hono;
-    container: Container;
+    container: Container<CoreTokenCatalog>;
     port: number;
     listen(): Promise<void>;
-    emitOpenApiSpec(): Promise<string | null>;
     close(): Promise<void>;
 };
 /**
  * The single composition root: wires the DI container, boots every plugin in
- * `config.plugins`, and mounts the resulting oRPC router on a Hono app. Seam
- * defaults auto-upgrade when env vars are set - `REDIS_URL` binds `JOB_QUEUE`/
- * `RATE_LIMITER`/`CACHE` to their Redis-backed drivers, `OUTBOX_ENABLED` (or
- * `AMQP_URL`/`RABBITMQ_URL`) enables the transactional outbox relay - otherwise
- * every seam stays in-process (zero deps for dev/test). `container.dispose()`
- * (via `close()`) runs disposers in REVERSE registration order, so DRIZZLE is
- * registered before JOB_QUEUE to guarantee workers drain before the DB closes.
- * A router namespace registered by more than one plugin throws at boot, not at
- * request time.
+ * `config.plugins`, and mounts the resulting oRPC router on a Hono app.
+ * Production is distributed-only (ADR-0030, superseding ADR-0010/0014/0016/0028):
+ * `REDIS_URL` auto-binds `JOB_QUEUE`/`RATE_LIMITER`/`CACHE`/`MESSAGE_BROKER` to their
+ * Redis-backed drivers - the broker being the `RedisStreamsBroker` reference driver,
+ * which an overlay (RabbitMQ/Kafka) or a test's `configure` callback can replace.
+ * `assertDurableSeamsBound` runs right after
+ * plugins + `configure` and throws a clear, actionable error listing every
+ * always-needed seam that still has no binding - it never falls back to an
+ * in-process realtime implementation. `OUTBOX_ENABLED` (or
+ * `AMQP_URL`/`RABBITMQ_URL`) enables the transactional outbox relay.
+ * `container.dispose()` (via `close()`) runs disposers in REVERSE registration
+ * order, so DRIZZLE is registered before JOB_QUEUE to guarantee workers drain
+ * before the DB closes. A router namespace registered by more than one plugin
+ * throws at boot, not at request time.
  */
-export declare function createApp(config: CreateAppConfig): Promise<CreatedApp>;
+export declare function createApp(config: CreateAppConfig, configure?: (container: Container<CoreTokenCatalog>) => void | Promise<void>): Promise<CreatedApp>;
 //# sourceMappingURL=create-app.d.ts.map

package/dist/server/runtime/create-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-app.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/create-app.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,EACL,SAAS,EAgBV,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAYL,KAAK,aAAa,EAEnB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBxE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,WAAW,EAAE,CAAC;IAOvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAErC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,IAAI,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;KAAE,CAAC;IAEjD,WAAW,CAAC,EAAE,MAAM,CAAC;IAKrB,QAAQ,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;IAE/B,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IAEF,OAAO,CAAC,EAAE,aAAa,CAAC;IAIxB,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IAEjE,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3D,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC;AAqDF;;;;;;;;;;;GAWG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CA+P5E"}
+{"version":3,"file":"create-app.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/create-app.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,EACL,SAAS,EAaV,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAWL,KAAK,aAAa,EAGnB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAGxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AA4ChE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,WAAW,EAAE,CAAC;IAOvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAErC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,IAAI,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;KAAE,CAAC;IAEjD,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,OAAO,CAAC,EAAE,aAAa,CAAC;IAIxB,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IAEjE,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,SAAS,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC;AAqDF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,eAAe,EACvB,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,gBAAgB,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAC3E,OAAO,CAAC,UAAU,CAAC,CAqSrB"}

package/dist/server/runtime/create-app.js

@@ -1,18 +1,20 @@
 import { OpenAPIHandler } from '@orpc/openapi/fetch';
+import { OpenAPIReferencePlugin } from '@orpc/openapi/plugins';
 import { implement, onError, ORPCError } from '@orpc/server';
 import { ResponseHeadersPlugin } from '@orpc/server/plugins';
+import { ZodToJsonSchemaConverter } from '@orpc/zod/zod4';
 import { Hono } from 'hono';
 import { cors } from 'hono/cors';
 import { etag } from 'hono/etag';
+import { HTTPException } from 'hono/http-exception';
 import { serve } from '@hono/node-server';
-import { resolve } from 'node:path';
-import { generateOpenApiSpec } from './openapi.js';
-import { Container, BullMqJobQueue, InMemoryBroker, InProcessCache, InProcessJobQueue, InProcessRateLimiter, InProcessRealtimeTransport, RedisCache, RedisRateLimiter, SseClientAuthorizer, createEventBus, createLogger, createRedisClient, withRequestContext, EVENT_BUS, } from '../kernel/index.js';
+import { Container, BullMqJobQueue, RedisCache, RedisRateLimiter, RedisStreamsBroker, createEventBus, createLogger, createRedisClient, withRequestContext, setErrorReporter, EVENT_BUS, extractClientMeta, } from '../kernel/index.js';
 import { randomUUID } from 'node:crypto';
-import { MESSAGE_BROKER, JOB_QUEUE, REALTIME_TRANSPORT, REALTIME_CLIENT_AUTHORIZER, OUTBOX, ADMIN_PERMISSION_RESOLVER, RATE_LIMITER, CACHE, composeContract, healthContract, IGAMING_CONFIG, PLATFORM_CONFIG, } from '@openora/core/contracts';
+import { MESSAGE_BROKER, JOB_QUEUE, OUTBOX, ADMIN_PERMISSION_RESOLVER, IDENTITY_READER, RATE_LIMITER, CACHE, ERROR_TRACKING, healthContract, IGAMING_CONFIG, PLATFORM_CONFIG, PLAYER_ACTIVITY_TRACKER, } from '@openora/core/contracts';
 import { DrizzleService, DRIZZLE, DrizzleOutboxWriter, OutboxRelay } from '../db/index.js';
 import { AdminGuard, ADMIN_GUARD, SessionResolver, AUTH_SESSION } from '../auth/index.js';
 import { loadPlugins } from '../plugin-host/index.js';
+import { assertDurableSeamsBound } from './assert-durable-seams.js';
 import { loadPlatformConfig, resolvePlatformConfigPath } from '../kernel/platform-config-loader.js';
 // Path prefixes safe to cache at the HTTP layer: public, non-personalized reads
 // only (lobby feeds, public CMS content, the game catalogue). NOTHING
@@ -31,6 +33,26 @@ const PUBLIC_HTTP_CACHE_PATHS = [
 ];
 const DEFAULT_HTTP_CACHE_MAX_AGE_SECONDS = 30;
 const DEFAULT_HTTP_CACHE_STALE_WHILE_REVALIDATE_SECONDS = 60;
+// Redis Streams consumer group name for MESSAGE_BROKER. Distinct deployments/services
+// sharing one Redis MUST use distinct names so their subscribers don't compete for
+// each other's events. The name is a durable identity: renaming it strands the old
+// group's pending (delivered-but-unacked) entries and starts the new one at `$`, so
+// it can never be derived from SERVICE_MANIFEST - that is a LIST of module ids
+// (see service-manifest.ts) whose value reorders and grows as modules move.
+// A split deployment must therefore name itself explicitly.
+function resolveServiceName() {
+    const serviceName = process.env['SERVICE_NAME'];
+    if (serviceName) {
+        return serviceName;
+    }
+    if (process.env['SERVICE_MANIFEST']) {
+        throw new Error('[create-app] SERVICE_MANIFEST is set but SERVICE_NAME is not. A split service needs a stable ' +
+            'name of its own: it becomes the MESSAGE_BROKER consumer group, and every service sharing a ' +
+            'group competes for the same events instead of each receiving a copy. Set SERVICE_NAME to a ' +
+            'stable identifier for this deployment (eg SERVICE_NAME=wallet).');
+    }
+    return 'monolith';
+}
 function headersToRecord(headers) {
     const out = {};
     headers.forEach((value, key) => {
@@ -82,17 +104,22 @@ async function captureRawBody(req) {
 }
 /**
  * The single composition root: wires the DI container, boots every plugin in
- * `config.plugins`, and mounts the resulting oRPC router on a Hono app. Seam
- * defaults auto-upgrade when env vars are set - `REDIS_URL` binds `JOB_QUEUE`/
- * `RATE_LIMITER`/`CACHE` to their Redis-backed drivers, `OUTBOX_ENABLED` (or
- * `AMQP_URL`/`RABBITMQ_URL`) enables the transactional outbox relay - otherwise
- * every seam stays in-process (zero deps for dev/test). `container.dispose()`
- * (via `close()`) runs disposers in REVERSE registration order, so DRIZZLE is
- * registered before JOB_QUEUE to guarantee workers drain before the DB closes.
- * A router namespace registered by more than one plugin throws at boot, not at
- * request time.
+ * `config.plugins`, and mounts the resulting oRPC router on a Hono app.
+ * Production is distributed-only (ADR-0030, superseding ADR-0010/0014/0016/0028):
+ * `REDIS_URL` auto-binds `JOB_QUEUE`/`RATE_LIMITER`/`CACHE`/`MESSAGE_BROKER` to their
+ * Redis-backed drivers - the broker being the `RedisStreamsBroker` reference driver,
+ * which an overlay (RabbitMQ/Kafka) or a test's `configure` callback can replace.
+ * `assertDurableSeamsBound` runs right after
+ * plugins + `configure` and throws a clear, actionable error listing every
+ * always-needed seam that still has no binding - it never falls back to an
+ * in-process realtime implementation. `OUTBOX_ENABLED` (or
+ * `AMQP_URL`/`RABBITMQ_URL`) enables the transactional outbox relay.
+ * `container.dispose()` (via `close()`) runs disposers in REVERSE registration
+ * order, so DRIZZLE is registered before JOB_QUEUE to guarantee workers drain
+ * before the DB closes. A router namespace registered by more than one plugin
+ * throws at boot, not at request time.
  */
-export async function createApp(config) {
+export async function createApp(config, configure) {
     if (config.databaseUrl) {
         process.env['DATABASE_URL'] = config.databaseUrl;
     }
@@ -102,35 +129,31 @@ export async function createApp(config) {
         container.onDispose(() => svc.dispose());
         return svc;
     });
-    container.register(MESSAGE_BROKER, () => {
-        const broker = new InMemoryBroker();
-        container.onDispose(() => broker.close());
-        return broker;
-    });
-    // Enabled when OUTBOX_ENABLED is set or a durable broker is configured (AMQP_URL) -
-    // a distributed deployment wants events that survive a crash between commit and
-    // publish. In the default in-process monolith it stays off, so emit() keeps its
-    // synchronous fan-out and emitInTransaction() guides callers to enable it.
+    // A distributed deployment wants events that survive a crash between commit and
+    // publish. Off by default: emit() keeps its best-effort fan-out and
+    // emitInTransaction() throws a guiding error until this is enabled.
+    // AMQP_URL/RABBITMQ_URL only signal the INTENT to run a RabbitMQ broker overlay -
+    // core binds no AMQP driver, so they enable the outbox and nothing else. The relay
+    // publishes to whatever MESSAGE_BROKER resolves to (the Redis Streams driver below,
+    // unless an overlay replaced it); set OUTBOX_ENABLED directly when that is the aim.
     const outboxEnabled = !!process.env['OUTBOX_ENABLED'] || !!process.env['AMQP_URL'] || !!process.env['RABBITMQ_URL'];
     if (outboxEnabled) {
         container.register(OUTBOX, () => new DrizzleOutboxWriter());
     }
     container.register(EVENT_BUS, (c) => createEventBus(c.get(MESSAGE_BROKER), createLogger('event-bus'), outboxEnabled ? c.get(OUTBOX) : undefined));
-    // Default in-process fan-out served as SSE; an overlay rebinds to a managed
-    // vendor (Ably/GetStream) without touching modules. See ADR-0007.
-    container.register(REALTIME_TRANSPORT, () => new InProcessRealtimeTransport());
-    // Default is first-party SSE (no token; the session cookie authorizes the stream).
-    // A managed-vendor overlay rebinds this to mint a per-player scoped token. See ADR-0007.
-    container.register(REALTIME_CLIENT_AUTHORIZER, () => new SseClientAuthorizer());
-    // When REDIS_URL is set, JOB_QUEUE, the rate limiter and cache bind to the shipped
-    // Redis reference adapters: BullMQ-backed durable jobs (survive restarts, real cron),
-    // distributed throttling and cross-replica cache invalidation - mirrors the AMQP_URL
-    // outbox precedent above. Otherwise the process-local in-process defaults stay (zero
-    // deps for dev/test). Either way a consumer overlay can rebind any of these tokens
-    // (plugins load after). The JOB_QUEUE disposer drains in-flight jobs before the DB
-    // closes (DRIZZLE is resolved before JOB_QUEUE below, and disposers run in reverse).
+    // When REDIS_URL is set, JOB_QUEUE, the rate limiter, the cache and the message
+    // broker bind to the shipped Redis reference adapters: BullMQ-backed durable jobs
+    // (survive restarts, real cron), distributed throttling, cross-replica cache
+    // invalidation and cross-replica events over Redis Streams. There is no in-process
+    // fallback (ADR-0030) - a deployment without REDIS_URL must bind these itself (an
+    // overlay, or a test's `configure` callback), or `assertDurableSeamsBound` below
+    // throws. The JOB_QUEUE disposer drains in-flight jobs before the DB closes (DRIZZLE
+    // is resolved before JOB_QUEUE below, and disposers run in reverse).
     const redisUrl = process.env['REDIS_URL'];
     if (redisUrl) {
+        // Resolved eagerly, before any client is opened: a misconfigured service name is
+        // a boot error, not a surprise on whichever code path resolves the broker first.
+        const serviceName = resolveServiceName();
         container.register(JOB_QUEUE, () => {
             const q = new BullMqJobQueue(redisUrl);
             container.onDispose(() => q.close());
@@ -140,22 +163,10 @@ export async function createApp(config) {
         container.onDispose(() => redis.close());
         container.register(RATE_LIMITER, () => new RedisRateLimiter(redis));
         container.register(CACHE, () => new RedisCache(redis));
-    }
-    else {
-        container.register(JOB_QUEUE, () => {
-            const q = new InProcessJobQueue(createLogger('job-queue'));
-            container.onDispose(() => q.close());
-            return q;
-        });
-        container.register(RATE_LIMITER, () => {
-            const limiter = new InProcessRateLimiter();
-            container.onDispose(() => limiter.close());
-            return limiter;
-        });
-        container.register(CACHE, () => {
-            const cache = new InProcessCache();
-            container.onDispose(() => cache.close());
-            return cache;
+        container.register(MESSAGE_BROKER, () => {
+            const broker = new RedisStreamsBroker(redis, { serviceName });
+            container.onDispose(() => broker.close());
+            return broker;
         });
     }
     // One shared better-auth instance for both the per-request middleware and AdminGuard -
@@ -164,7 +175,9 @@ export async function createApp(config) {
     container.register(AUTH_SESSION, (c) => new SessionResolver(c.get(DRIZZLE), config.authSchema));
     container.register(ADMIN_GUARD, (c) => new AdminGuard(c.get(DRIZZLE), c.get(AUTH_SESSION), 
     // has() avoids throwing on an unbound token so boot works without the iam module.
-    c.has(ADMIN_PERMISSION_RESOLVER) ? c.get(ADMIN_PERMISSION_RESOLVER) : undefined, c.get(EVENT_BUS)));
+    c.has(ADMIN_PERMISSION_RESOLVER) ? c.get(ADMIN_PERMISSION_RESOLVER) : undefined, c.get(EVENT_BUS), 
+    // has() avoids throwing on an unbound token so boot works without the identity module.
+    c.has(IDENTITY_READER) ? c.get(IDENTITY_READER) : undefined));
     if (config.igaming) {
         const igaming = config.igaming;
         container.register(IGAMING_CONFIG, () => igaming);
@@ -174,7 +187,13 @@ export async function createApp(config) {
     // or cwd discovery). See platform-config-loader.ts.
     container.register(PLATFORM_CONFIG, () => loadPlatformConfig(resolvePlatformConfigPath()));
     const registry = await loadPlugins(config.plugins, container);
-    await config.configure?.(container);
+    await configure?.(container);
+    assertDurableSeamsBound(container);
+    if (container.has(ERROR_TRACKING)) {
+        const tracker = container.get(ERROR_TRACKING);
+        setErrorReporter((error, context) => tracker.captureException(error, context));
+        container.onDispose(() => setErrorReporter(undefined));
+    }
     const bus = container.get(EVENT_BUS);
     for (const [event, handlers] of registry.events.getAll()) {
         for (const handler of handlers) {
@@ -209,16 +228,43 @@ export async function createApp(config) {
         });
     }
     const handler = new OpenAPIHandler(router, {
-        plugins: [new ResponseHeadersPlugin()],
+        plugins: [
+            new OpenAPIReferencePlugin({
+                docsPath: '/docs',
+                specPath: '/openapi.json',
+                schemaConverters: [new ZodToJsonSchemaConverter()],
+            }),
+            new ResponseHeadersPlugin(),
+        ],
         interceptors: [
             onError((error) => {
-                if (!(error instanceof ORPCError)) {
-                    createLogger('orpc').error({ err: error }, 'unhandled error');
+                // oRPC wraps a thrown native error (a DB failure, a bug) into an
+                // ORPCError('INTERNAL_SERVER_ERROR', { cause }). Report anything that is a
+                // server fault - a non-ORPCError, or an ORPCError with a 5xx status - and skip
+                // expected client errors (4xx: not-found, conflict, validation, rate-limit).
+                // Report the underlying `cause` so the tracker gets the real error + stack,
+                // not the generic wrapper.
+                if (error instanceof ORPCError && error.status < 500) {
+                    return;
                 }
+                const err = error instanceof ORPCError ? (error.cause ?? error) : error;
+                createLogger('orpc').error({ err }, 'unhandled error');
             }),
         ],
     });
     const app = new Hono();
+    // Outermost catch for errors thrown in the Hono middleware chain (session
+    // resolution, raw-body capture, etag/cache) - the one seam oRPC's onError
+    // interceptor never sees, since handler.handle turns route/service errors into
+    // responses. logger.error reports via the reporter; HTTPExceptions are deliberate
+    // outcomes, returned without reporting.
+    app.onError((err, c) => {
+        if (err instanceof HTTPException) {
+            return err.getResponse();
+        }
+        createLogger('http').error({ err, method: c.req.method, path: c.req.path }, 'unhandled request error');
+        return c.json({ error: 'Internal Server Error' }, 500);
+    });
     if (config.cors !== false) {
         const origins = config.cors === true || config.cors === undefined ? undefined : config.cors.origins;
         app.use('/*', cors({ origin: origins ?? ((origin) => origin), credentials: true }));
@@ -243,9 +289,21 @@ export async function createApp(config) {
             else {
                 await next();
             }
+            // An SSE body is a sequence of small frames that only mean anything on arrival, so any
+            // intermediary that compresses or buffers it holds every event until its own flush
+            // threshold. That is not hypothetical: Next's built-in gzip (and nginx's, and a CDN's)
+            // turned a sub-100ms balance push into an 11-second one, with the events arriving in
+            // batches. `no-transform` is the standards-defined opt-out every one of them honours,
+            // and `X-Accel-Buffering` covers nginx's separate proxy-buffering stage.
+            const isEventStream = (c.res.headers.get('content-type') ?? '').includes('text/event-stream');
+            if (isEventStream) {
+                c.res.headers.set('X-Accel-Buffering', 'no');
+            }
             c.res.headers.set('Cache-Control', isCacheable
                 ? `public, max-age=${maxAgeSeconds}, stale-while-revalidate=${staleWhileRevalidateSeconds}`
-                : 'no-store');
+                : isEventStream
+                    ? 'no-store, no-transform'
+                    : 'no-store');
         });
     }
     const sessions = container.get(AUTH_SESSION);
@@ -260,10 +318,11 @@ export async function createApp(config) {
         }
         const context = {
             request: { headers },
+            clientMeta: extractClientMeta(headers),
             rawBody: await captureRawBody(c.req.raw),
         };
         // Never identify from a client-supplied `x-user-id` header (W1, ADR-0019).
-        const userId = await sessions.resolveUserId(c.req.raw.headers);
+        const resolved = await sessions.resolveSession(c.req.raw.headers);
         const runHandler = async () => {
             const { matched, response } = await handler.handle(c.req.raw, { context });
             if (matched) {
@@ -273,13 +332,20 @@ export async function createApp(config) {
             return c.res;
         };
         const traceId = headers['x-trace-id'] ?? randomUUID();
-        if (!userId) {
+        if (!resolved) {
             // No valid session - context.auth stays undefined so getUserId 401s. Auth and
             // public routes still work. Run inside the request context for trace correlation.
-            return withRequestContext({ traceId }, runHandler);
+            return withRequestContext({ traceId, clientMeta: context.clientMeta }, runHandler);
+        }
+        const { userId } = resolved;
+        context.auth = resolved;
+        if (container.has(PLAYER_ACTIVITY_TRACKER)) {
+            container
+                .get(PLAYER_ACTIVITY_TRACKER)
+                .touchLastSeen(userId)
+                .catch((err) => createLogger('player-activity').error({ err }, 'touchLastSeen failed'));
         }
-        context.auth = { userId };
-        return withRequestContext({ userId, traceId }, runHandler);
+        return withRequestContext({ userId, traceId, clientMeta: context.clientMeta }, runHandler);
     });
     const port = config.port ?? Number(process.env['PORT_API'] ?? 3001);
     let server;
@@ -291,17 +357,6 @@ export async function createApp(config) {
             server = serve({ fetch: app.fetch, port });
             process.stdout.write(`API listening on :${port}\n`);
         },
-        async emitOpenApiSpec() {
-            if (config.openapi?.enabled === false) {
-                return null;
-            }
-            const outPath = await generateOpenApiSpec(config.contract ?? composeContract({}), {
-                info: config.openapi?.info,
-                outputPath: config.openapi?.outputPath ?? resolve(process.cwd(), 'docs/openapi.json'),
-            });
-            process.stdout.write(`OpenAPI spec written to ${outPath}\n`);
-            return outPath;
-        },
         async close() {
             server?.close();
             await container.dispose();