@openora/core 0.4.1-canary.11 → 0.4.1-canary.111

package/dist/contracts/adapters/admin-game-reporting.d.ts

@@ -0,0 +1,43 @@
+import { type Token } from './token.js';
+import type { GameType } from '../schemas/game.js';
+/**
+ * Admin/back-office reporting over game performance. Owned + bound by the
+ * casino/gaming module (it owns the `game`/`gameRound` tables); the back-office
+ * depends only on this port, never on the gaming schema. A query port like
+ * ADMIN_WALLET_REPORTING. See ADR-0017/0025.
+ */
+export declare const GAME_PERFORMANCE_SORT_FIELDS: readonly ["name", "gameType", "volume", "revenue", "uniquePlayers", "roundsPlayed"];
+export type GamePerformanceSortBy = (typeof GAME_PERFORMANCE_SORT_FIELDS)[number];
+export type GamePerformanceFilter = {
+    dateFrom?: Date;
+    dateTo?: Date;
+    gameType?: GameType;
+    currency?: string;
+    sortBy?: GamePerformanceSortBy;
+    sortDir?: 'asc' | 'desc';
+};
+/**
+ * volume/revenue = SUM(gameRound.betAmount) / SUM(betAmount) - SUM(winAmount) over
+ * status='completed' rounds in range; revenue (GGR) can be negative. uniquePlayers/
+ * roundsPlayed are 0 for a game with no completed rounds in range - games are never
+ * omitted just because they had no activity in the requested window.
+ */
+export type GamePerformanceRow = {
+    gameId: string;
+    name: string;
+    gameType: GameType;
+    volume: string;
+    revenue: string;
+    uniquePlayers: number;
+    roundsPlayed: number;
+};
+export type PlayerGameStats = {
+    totalWagered: string;
+    totalBets: number;
+};
+export type AdminGameReporting = {
+    listGamePerformance(filter: GamePerformanceFilter): Promise<GamePerformanceRow[]>;
+    getPlayerStats(userId: string): Promise<PlayerGameStats>;
+};
+export declare const ADMIN_GAME_REPORTING: Token<AdminGameReporting>;
+//# sourceMappingURL=admin-game-reporting.d.ts.map

package/dist/contracts/adapters/admin-game-reporting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-game-reporting.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-game-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;;GAKG;AAEH,eAAO,MAAM,4BAA4B,qFAO/B,CAAC;AACX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AAElF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAClF,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1D,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAuC,CAAC"}

package/dist/contracts/adapters/admin-game-reporting.js

@@ -0,0 +1,17 @@
+import { createToken } from './token.js';
+/**
+ * Admin/back-office reporting over game performance. Owned + bound by the
+ * casino/gaming module (it owns the `game`/`gameRound` tables); the back-office
+ * depends only on this port, never on the gaming schema. A query port like
+ * ADMIN_WALLET_REPORTING. See ADR-0017/0025.
+ */
+export const GAME_PERFORMANCE_SORT_FIELDS = [
+    'name',
+    'gameType',
+    'volume',
+    'revenue',
+    'uniquePlayers',
+    'roundsPlayed',
+];
+export const ADMIN_GAME_REPORTING = createToken('ADMIN_GAME_REPORTING');
+//# sourceMappingURL=admin-game-reporting.js.map

package/dist/contracts/adapters/admin-game-reporting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-game-reporting.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-game-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAGrD;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,MAAM;IACN,UAAU;IACV,QAAQ;IACR,SAAS;IACT,eAAe;IACf,cAAc;CACN,CAAC;AAsCX,MAAM,CAAC,MAAM,oBAAoB,GAA8B,WAAW,CAAC,sBAAsB,CAAC,CAAC"}

package/dist/contracts/adapters/admin-permission.d.ts

@@ -1,10 +1,21 @@
+/**
+ * Port for DB-backed admin RBAC. A backoffice iam module binds a concrete
+ * resolver that reads role assignments + grants from its own tables; the
+ * AdminGuard (in @openora/core/server) depends only on this interface so the platform
+ * keeps working - falling back to the static roles - when no resolver is bound.
+ */
 import { type Token } from './token.js';
 export type AdminGrant = {
     resource: string;
     action: string;
 };
 export type AdminPermissionResolver = {
+    /**
+     * Returns the effective grants for an admin user, or null if the user has no
+     * DB-backed role assignment (caller should fall back to static roles).
+     */
     getGrants(userId: string): Promise<AdminGrant[] | null>;
+    isSuperAdmin(userId: string): Promise<boolean | null>;
 };
 export declare const ADMIN_PERMISSION_RESOLVER: Token<AdminPermissionResolver>;
 //# sourceMappingURL=admin-permission.d.ts.map

package/dist/contracts/adapters/admin-permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-permission.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-permission.ts"],"names":[],"mappings":"AAIA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,uBAAuB,GAAG;IAGpC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,uBAAuB,CAEpE,CAAC"}
+{"version":3,"file":"admin-permission.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-permission.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;OAGG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;IACxD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;CACvD,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,uBAAuB,CAEpE,CAAC"}

package/dist/contracts/adapters/admin-permission.js

@@ -1,7 +1,9 @@
-// Port for DB-backed admin RBAC. A backoffice iam module binds a concrete
-// resolver that reads role assignments + grants from its own tables; the
-// AdminGuard (in @openora/core/server) depends only on this interface so the platform
-// keeps working - falling back to the static roles - when no resolver is bound.
+/**
+ * Port for DB-backed admin RBAC. A backoffice iam module binds a concrete
+ * resolver that reads role assignments + grants from its own tables; the
+ * AdminGuard (in @openora/core/server) depends only on this interface so the platform
+ * keeps working - falling back to the static roles - when no resolver is bound.
+ */
 import { createToken } from './token.js';
 export const ADMIN_PERMISSION_RESOLVER = createToken('ADMIN_PERMISSION_RESOLVER');
 //# sourceMappingURL=admin-permission.js.map

package/dist/contracts/adapters/admin-permission.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-permission.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-permission.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,yEAAyE;AACzE,sFAAsF;AACtF,gFAAgF;AAChF,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAUrD,MAAM,CAAC,MAAM,yBAAyB,GAAmC,WAAW,CAClF,2BAA2B,CAC5B,CAAC"}
+{"version":3,"file":"admin-permission.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-permission.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAarD,MAAM,CAAC,MAAM,yBAAyB,GAAmC,WAAW,CAClF,2BAA2B,CAC5B,CAAC"}

package/dist/contracts/adapters/admin-player-activity.d.ts

@@ -0,0 +1,51 @@
+import { type Token } from './token.js';
+/**
+ * Admin/back-office reporting over player registration + engagement activity.
+ * Owned + bound by iam; it centralizes admin reporting concerns even though the
+ * underlying `user`/`session` tables belong to identity,
+ * read via that module's read-only /schema subpath); the back-office depends only
+ * on this port. A query port like ADMIN_WALLET_REPORTING/ADMIN_GAME_REPORTING.
+ * See ADR-0017/0025.
+ */
+export type PlayerActivityFilter = {
+    dateFrom?: Date;
+    dateTo?: Date;
+};
+/** One point per day (UTC, `YYYY-MM-DD`) within the requested range. */
+export type RegistrationsOverTimePoint = {
+    date: string;
+    registrations: number;
+};
+/** DAU/WAU/MAU for the trailing 1/7/30-day window ending on `date` (inclusive). */
+export type ActiveUsersTrendPoint = {
+    date: string;
+    dau: number;
+    wau: number;
+    mau: number;
+};
+/**
+ * One row per registration-day cohort (UTC day `user.createdAt` truncates to).
+ * `returnRate` = returned / cohortSize (0 when cohortSize is 0). `isComplete` is
+ * false while the cohort's [registration, registration + windowDays] window has
+ * not fully elapsed yet - such a row's low/zero rate is not yet meaningful and
+ * must be flagged rather than read as real churn.
+ */
+export type RetentionCohortRow = {
+    cohortDate: string;
+    cohortSize: number;
+    returned: number;
+    returnRate: number;
+    isComplete: boolean;
+};
+export type AdminPlayerActivity = {
+    getRegistrationsOverTime(filter: PlayerActivityFilter): Promise<RegistrationsOverTimePoint[]>;
+    getActiveUsersTrend(filter: PlayerActivityFilter): Promise<ActiveUsersTrendPoint[]>;
+    /**
+     * windowDays is always 7 or 30 (the two cohorts the ticket asks for); a plain
+     * number keeps the port from hard-coding a union it would need to duplicate again
+     * the moment a third window is added.
+     */
+    getRetentionCohorts(filter: PlayerActivityFilter, windowDays: 7 | 30): Promise<RetentionCohortRow[]>;
+};
+export declare const ADMIN_PLAYER_ACTIVITY: Token<AdminPlayerActivity>;
+//# sourceMappingURL=admin-player-activity.d.ts.map

package/dist/contracts/adapters/admin-player-activity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-player-activity.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-player-activity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;GAOG;AAEH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,MAAM,CAAC,EAAE,IAAI,CAAC;CACf,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,mFAAmF;AACnF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC;IAC9F,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACpF;;;;OAIG;IACH,mBAAmB,CACjB,MAAM,EAAE,oBAAoB,EAC5B,UAAU,EAAE,CAAC,GAAG,EAAE,GACjB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;CAClC,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,mBAAmB,CACvB,CAAC"}

package/dist/contracts/adapters/admin-player-activity.js

@@ -0,0 +1,3 @@
+import { createToken } from './token.js';
+export const ADMIN_PLAYER_ACTIVITY = createToken('ADMIN_PLAYER_ACTIVITY');
+//# sourceMappingURL=admin-player-activity.js.map

package/dist/contracts/adapters/admin-player-activity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-player-activity.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-player-activity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AA2DrD,MAAM,CAAC,MAAM,qBAAqB,GAChC,WAAW,CAAC,uBAAuB,CAAC,CAAC"}

package/dist/contracts/adapters/admin-role-assignment-directory.d.ts

@@ -0,0 +1,12 @@
+import { type Token } from './token.js';
+export type AdminRoleAssignmentSummary = {
+    userId: string;
+    roleId: string;
+    roleName: string;
+};
+export type AdminRoleAssignmentDirectory = {
+    /** Batch lookup; unknown/unassigned userIds are simply absent from the result. */
+    listByUserIds(userIds: readonly string[]): Promise<AdminRoleAssignmentSummary[]>;
+};
+export declare const ADMIN_ROLE_ASSIGNMENT_DIRECTORY: Token<AdminRoleAssignmentDirectory>;
+//# sourceMappingURL=admin-role-assignment-directory.d.ts.map

package/dist/contracts/adapters/admin-role-assignment-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-role-assignment-directory.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-role-assignment-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,kFAAkF;IAClF,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC;CAClF,CAAC;AAEF,eAAO,MAAM,+BAA+B,EAAE,KAAK,CAAC,4BAA4B,CAE/E,CAAC"}

package/dist/contracts/adapters/admin-role-assignment-directory.js

@@ -0,0 +1,3 @@
+import { createToken } from './token.js';
+export const ADMIN_ROLE_ASSIGNMENT_DIRECTORY = createToken('ADMIN_ROLE_ASSIGNMENT_DIRECTORY');
+//# sourceMappingURL=admin-role-assignment-directory.js.map

package/dist/contracts/adapters/admin-role-assignment-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-role-assignment-directory.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-role-assignment-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAarD,MAAM,CAAC,MAAM,+BAA+B,GAAwC,WAAW,CAC7F,iCAAiC,CAClC,CAAC"}

package/dist/contracts/adapters/admin-user-directory.d.ts

@@ -1,26 +1,48 @@
 import { type Token } from './token.js';
-import type { KycStatus } from '../schemas/player.js';
+import type { KycStatus, Player } from '../schemas/player.js';
 import type { UserRole } from '../schemas/iam.js';
+import type { ClientMeta } from '../schemas/common.js';
+import type { SortOrder } from '../kit.js';
+/**
+ * Admin/back-office view of the user directory. Owned + bound by the identity
+ * module (it owns the `user` table); the back-office (admin-console) depends only
+ * on this port, never on the identity schema, so it stays a clean, extractable
+ * module. A query/command port like WALLET_COMMANDS. See ADR-0017/0025.
+ */
 export type AdminUserRow = {
     id: string;
     email: string;
     name: string | null;
     createdAt: Date;
     isActive: boolean;
-    role: UserRole;
+    role: string;
     failedLoginAttempts?: number;
     lockoutUntil?: Date | null;
 };
+export declare const ADMIN_USER_SORT_BY_VALUES: readonly ["createdAt", "email", "name", "role", "isActive", "lastLockoutAt"];
+export type AdminUserSortBy = (typeof ADMIN_USER_SORT_BY_VALUES)[number];
 export type AdminUserListOptions = {
     page: number;
     limit: number;
     search?: string;
+    sortBy?: AdminUserSortBy;
+    sortOrder?: SortOrder;
 };
+/**
+ * Player-facing back-office enrichment (username + KYC). Lets a back-office
+ * consumer label a player row without reaching into the player/profile tables.
+ */
 export type AdminPlayerSummary = {
+    playerId: Player['id'];
     userId: string;
     username: string;
     email: string;
     kycStatus: KycStatus | null;
+    language: string | null;
+    avatarUrl: string | null;
+    createdAt: Date;
+    level: number;
+    currency: string;
 };
 export type AdminUserDirectory = {
     count(): Promise<number>;
@@ -29,12 +51,31 @@ export type AdminUserDirectory = {
         total: number;
     }>;
     get(id: string): Promise<AdminUserRow | null>;
+    lookupUsers(userIds: readonly string[]): Promise<AdminUserRow[]>;
+    /** actorId = the admin performing the change (for audit attribution on an isActive flip). */
     update(id: string, patch: {
         isActive?: boolean;
         role?: UserRole;
-    }, actorId: string): Promise<AdminUserRow | null>;
+    }, actorId: string, meta?: ClientMeta): Promise<AdminUserRow | null>;
+    /**
+     * Batch enrichment for back-office lists (eg the withdrawal queue). Returns one
+     * entry per resolvable id; unknown ids are omitted.
+     */
     lookupPlayers(userIds: readonly string[]): Promise<AdminPlayerSummary[]>;
-    findPlayerIds(query: string): Promise<string[]>;
+    /**
+     * Resolves a free-text player filter to a capped set of userIds, matched against
+     * email or the identity-owned username. Empty = all candidates.
+     * limit caps both sub-queries and the merged set; defaults to 1000 (the implementation cap).
+     */
+    findPlayerIds(query: string, limit?: number): Promise<string[]>;
+    /**
+     * Exact-match resolution by display name (case-insensitive) - for callers that
+     * already have a complete, known username (not a partial search term), eg chat
+     * commands' /donate, /block, /ignore. Distinct from findPlayerIds' capped fuzzy
+     * substring search: a short/common username can substring-collide with more than
+     * the 20-row cap of unrelated accounts and silently drop the real exact match.
+     */
+    getPlayerByUsername(username: string): Promise<AdminPlayerSummary | null>;
 };
 export declare const ADMIN_USER_DIRECTORY: Token<AdminUserDirectory>;
 //# sourceMappingURL=admin-user-directory.d.ts.map

package/dist/contracts/adapters/admin-user-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-user-directory.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-user-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAOlD,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAIpF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnF,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAE9C,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;KAAE,EAC9C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAGhC,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAGzE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACjD,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAuC,CAAC"}
+{"version":3,"file":"admin-user-directory.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-user-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;;GAKG;AAEH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,eAAO,MAAM,yBAAyB,8EAO5B,CAAC;AACX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnF,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC9C,WAAW,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACjE,6FAA6F;IAC7F,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;KAAE,EAC9C,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAChC;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzE;;;;OAIG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE;;;;;;OAMG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CAC3E,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAuC,CAAC"}

package/dist/contracts/adapters/admin-user-directory.js

@@ -1,3 +1,11 @@
 import { createToken } from './token.js';
+export const ADMIN_USER_SORT_BY_VALUES = [
+    'createdAt',
+    'email',
+    'name',
+    'role',
+    'isActive',
+    'lastLockoutAt',
+];
 export const ADMIN_USER_DIRECTORY = createToken('ADMIN_USER_DIRECTORY');
 //# sourceMappingURL=admin-user-directory.js.map

package/dist/contracts/adapters/admin-user-directory.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-user-directory.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-user-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAiDrD,MAAM,CAAC,MAAM,oBAAoB,GAA8B,WAAW,CAAC,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"admin-user-directory.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-user-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAwBrD,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,WAAW;IACX,OAAO;IACP,MAAM;IACN,MAAM;IACN,UAAU;IACV,eAAe;CACP,CAAC;AA6DX,MAAM,CAAC,MAAM,oBAAoB,GAA8B,WAAW,CAAC,sBAAsB,CAAC,CAAC"}

package/dist/contracts/adapters/admin-wallet-reporting.d.ts

@@ -1,5 +1,11 @@
 import { type Token } from './token.js';
 import type { WalletRail, WalletTransactionStatus, WalletTransactionType } from '../schemas/wallet-tx.js';
+import type { SortOrder } from '../kit.js';
+/**
+ * Admin/back-office reporting over wallet money movement. Owned + bound by the
+ * wallet module; the back-office depends only on this port, never on the wallet
+ * schema. A query port like WALLET_COMMANDS. See ADR-0017/0025.
+ */
 export type AdminTxRow = {
     id: string;
     userId: string;
@@ -13,10 +19,13 @@ export type AdminTxRow = {
 export type AdminTxDetail = AdminTxRow & {
     providerRefId: string | null;
     providerName: string | null;
+    /** UUID of the admin who reviewed the transaction (matches wallet.reviewedBy column). */
     reviewedBy: string | null;
     reviewedAt: Date | null;
     reviewReason: string | null;
 };
+export declare const ADMIN_TX_SORT_BY_VALUES: readonly ["createdAt", "amount", "type", "status", "currency", "rail", "reviewedAt"];
+export type AdminTxSortBy = (typeof ADMIN_TX_SORT_BY_VALUES)[number];
 export type AdminTxListOptions = {
     page: number;
     limit: number;
@@ -29,6 +38,8 @@ export type AdminTxListOptions = {
     dateTo?: Date;
     amountMin?: string;
     amountMax?: string;
+    sortBy?: AdminTxSortBy;
+    sortOrder?: SortOrder;
 };
 export type AdminWalletReporting = {
     totals(): Promise<{

package/dist/contracts/adapters/admin-wallet-reporting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-wallet-reporting.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-wallet-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EACV,UAAU,EACV,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,yBAAyB,CAAC;AAMjC,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,qBAAqB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,uBAAuB,CAAC;IAChC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG;IACvC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CACxB,CAAC"}
+{"version":3,"file":"admin-wallet-reporting.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-wallet-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EACV,UAAU,EACV,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;GAIG;AAEH,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,qBAAqB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,uBAAuB,CAAC;IAChC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG;IACvC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,yFAAyF;IACzF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,uBAAuB,sFAQ1B,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CACxB,CAAC"}

package/dist/contracts/adapters/admin-wallet-reporting.js

@@ -1,3 +1,12 @@
 import { createToken } from './token.js';
+export const ADMIN_TX_SORT_BY_VALUES = [
+    'createdAt',
+    'amount',
+    'type',
+    'status',
+    'currency',
+    'rail',
+    'reviewedAt',
+];
 export const ADMIN_WALLET_REPORTING = createToken('ADMIN_WALLET_REPORTING');
 //# sourceMappingURL=admin-wallet-reporting.js.map

package/dist/contracts/adapters/admin-wallet-reporting.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-wallet-reporting.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-wallet-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAmDrD,MAAM,CAAC,MAAM,sBAAsB,GACjC,WAAW,CAAC,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"admin-wallet-reporting.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-wallet-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAkCrD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,WAAW;IACX,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,UAAU;IACV,MAAM;IACN,YAAY;CACJ,CAAC;AAyBX,MAAM,CAAC,MAAM,sBAAsB,GACjC,WAAW,CAAC,wBAAwB,CAAC,CAAC"}

package/dist/contracts/adapters/aggregator.d.ts

@@ -1,3 +1,8 @@
+/**
+ * Igaming-aggregator seam. An aggregator fans out to many game providers'
+ * catalogues; bind a concrete adapter to AGGREGATOR_ADAPTER in the
+ * igaming-aggregator module's plugin.ts.
+ */
 import { type Token } from './token.js';
 export type AggregatorGame = {
     externalId: string;
@@ -14,6 +19,13 @@ export type AggregatorAdapter = {
     handleCallback(event: string, payload: unknown): Promise<void>;
 };
 export declare const AGGREGATOR_ADAPTER: Token<AggregatorAdapter>;
+/**
+ * Verifies the public M2M callback is genuinely from the aggregator. The default
+ * impl recomputes an HMAC-SHA256 over the raw request body and constant-time
+ * compares it against the `x-aggregator-signature` header; a vendor overlay can
+ * rebind it to match that vendor's scheme. Fails closed when the secret is unset,
+ * the signature header is absent, or the raw body was not captured.
+ */
 export type AggregatorWebhookVerifier = {
     verify(rawBody: string, signature: string | null): boolean;
 };

package/dist/contracts/adapters/aggregator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aggregator.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/aggregator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,eAAe,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,cAAc,EAAE,CAAA;KAAE,CAAC,CAAC;IACxD,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAqC,CAAC;AAO9F,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;CAC5D,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,KAAK,CAAC,yBAAyB,CAExE,CAAC"}
+{"version":3,"file":"aggregator.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/aggregator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,eAAe,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,cAAc,EAAE,CAAA;KAAE,CAAC,CAAC;IACxD,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAqC,CAAC;AAE9F;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;CAC5D,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,KAAK,CAAC,yBAAyB,CAExE,CAAC"}

package/dist/contracts/adapters/aggregator.js

@@ -1,6 +1,8 @@
-// Igaming-aggregator seam. An aggregator fans out to many game providers'
-// catalogues; bind a concrete adapter to AGGREGATOR_ADAPTER in the
-// igaming-aggregator module's plugin.ts.
+/**
+ * Igaming-aggregator seam. An aggregator fans out to many game providers'
+ * catalogues; bind a concrete adapter to AGGREGATOR_ADAPTER in the
+ * igaming-aggregator module's plugin.ts.
+ */
 import { createToken } from './token.js';
 export const AGGREGATOR_ADAPTER = createToken('AGGREGATOR_ADAPTER');
 export const AGGREGATOR_WEBHOOK_VERIFIER = createToken('AGGREGATOR_WEBHOOK_VERIFIER');

package/dist/contracts/adapters/aggregator.js.map

@@ -1 +1 @@
-{"version":3,"file":"aggregator.js","sourceRoot":"","sources":["../../../src/contracts/adapters/aggregator.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,mEAAmE;AACnE,yCAAyC;AACzC,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAgBrD,MAAM,CAAC,MAAM,kBAAkB,GAA6B,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAW9F,MAAM,CAAC,MAAM,2BAA2B,GAAqC,WAAW,CACtF,6BAA6B,CAC9B,CAAC"}
+{"version":3,"file":"aggregator.js","sourceRoot":"","sources":["../../../src/contracts/adapters/aggregator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAgBrD,MAAM,CAAC,MAAM,kBAAkB,GAA6B,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAa9F,MAAM,CAAC,MAAM,2BAA2B,GAAqC,WAAW,CACtF,6BAA6B,CAC9B,CAAC"}

package/dist/contracts/adapters/audit.d.ts

@@ -1,6 +1,24 @@
+/**
+ * Audit-write seam. AML/SAR audit writes are a regulator-mandated invariant under
+ * MGA/UKGC - the audit module binds the sole implementation via ctx.provideSealed()
+ * (bind-once, owner-only); no overlay can rebind it (ctx.provide() rejects any
+ * sealed token outright, and provideSealed() itself refuses a second bind). Other
+ * modules resolve this port read-only (container.get(AUDIT_WRITER)) to call it.
+ */
 import type { DomainEventName } from '../schemas/events.js';
+import type { ClientMeta } from '../schemas/common.js';
 import { type SealedToken } from './token.js';
-export type DirectAuditAction = 'admin.user.updated' | 'audit.export' | 'wallet.withdrawal.auto_approved' | 'wallet.auto_withdrawal_rule.set' | 'wallet.auto_withdrawal_rule.deleted';
+/**
+ * Admin actions that are recorded directly (not via a domain-event subscription)
+ * and so have no entry in `domainEventSchemas`. Add new direct actions here.
+ */
+export type DirectAuditAction = 'admin.user.updated' | 'admin.player.updated' | 'admin.player.removed' | 'admin.player_note.created' | 'audit.export' | 'compliance.kyc.bulk_approve' | 'wallet.withdrawal.auto_approved' | 'wallet.auto_withdrawal_rule.set' | 'wallet.auto_withdrawal_rule.deleted' | 'wallet.auto_withdrawal_config.set' | 'wallet.bonus_credit.created' | 'wallet.bonus_credit.completed' | 'wallet.bonus_rollover_config.set' | 'wallet.manual_adjustment.created' | 'wallet.withdrawal_address.created' | 'wallet.withdrawal_address.deleted' | 'wallet.custody.sweep_cycle' | 'wallet.custody.sweep' | 'wallet.reconciliation_finding.recorded' | 'wallet.reconciliation_run.skipped' | 'wallet.reconciliation_run.completed' | 'wallet.reconciliation_run.failed' | 'wallet.reconciliation_finding.resolved';
+/**
+ * Every value the audit `action` column legitimately holds: a cross-module domain
+ * event topic (recorded by the audit plugin's subscriptions) or a direct admin
+ * action. The `string & {}` arm keeps literal autocomplete while still accepting
+ * overlay-defined actions, so it constrains nothing at runtime - it just guides.
+ */
 export type AuditAction = DomainEventName | DirectAuditAction | (string & {});
 export type AuditWritePort = {
     record(entry: {
@@ -11,10 +29,18 @@ export type AuditWritePort = {
         resourceId?: string | null;
         before?: Record<string, unknown> | null;
         after?: Record<string, unknown> | null;
-        ip?: string | null;
-        userAgent?: string | null;
         correlationId?: string | null;
-    }): Promise<void>;
+    } & Partial<ClientMeta>): Promise<void>;
+    recordInTransaction(tx: unknown, entry: {
+        actorId?: string | null;
+        actorType: 'player' | 'admin' | 'system';
+        action: AuditAction;
+        resourceType: string;
+        resourceId?: string | null;
+        before?: Record<string, unknown> | null;
+        after?: Record<string, unknown> | null;
+        correlationId?: string | null;
+    } & Partial<ClientMeta>): Promise<void>;
 };
 export declare const AUDIT_WRITER: SealedToken<AuditWritePort>;
 //# sourceMappingURL=audit.d.ts.map

package/dist/contracts/adapters/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/audit.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAIjE,MAAM,MAAM,iBAAiB,GACzB,oBAAoB,GACpB,cAAc,GACd,iCAAiC,GACjC,iCAAiC,GACjC,qCAAqC,CAAC;AAM1C,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,iBAAiB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE9E,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,CAAC,KAAK,EAAE;QACZ,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,SAAS,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;QACzC,MAAM,EAAE,WAAW,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACvC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,cAAc,CACF,CAAC"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/audit.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAEjE;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB,oBAAoB,GACpB,sBAAsB,GACtB,sBAAsB,GACtB,2BAA2B,GAC3B,cAAc,GACd,6BAA6B,GAC7B,iCAAiC,GACjC,iCAAiC,GACjC,qCAAqC,GACrC,mCAAmC,GACnC,6BAA6B,GAC7B,+BAA+B,GAC/B,kCAAkC,GAClC,kCAAkC,GAClC,mCAAmC,GACnC,mCAAmC,GACnC,4BAA4B,GAC5B,sBAAsB,GACtB,wCAAwC,GACxC,mCAAmC,GACnC,qCAAqC,GACrC,kCAAkC,GAClC,wCAAwC,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,iBAAiB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE9E,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,CACJ,KAAK,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,SAAS,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;QACzC,MAAM,EAAE,WAAW,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,GAAG,OAAO,CAAC,UAAU,CAAC,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,mBAAmB,CACjB,EAAE,EAAE,OAAO,EACX,KAAK,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,SAAS,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;QACzC,MAAM,EAAE,WAAW,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,GAAG,OAAO,CAAC,UAAU,CAAC,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,cAAc,CACF,CAAC"}

package/dist/contracts/adapters/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/contracts/adapters/audit.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,iBAAiB,EAAoB,MAAM,YAAY,CAAC;AAgCjE,MAAM,CAAC,MAAM,YAAY,GACvB,iBAAiB,CAAiB,cAAc,CAAC,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/contracts/adapters/audit.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iBAAiB,EAAoB,MAAM,YAAY,CAAC;AAmEjE,MAAM,CAAC,MAAM,YAAY,GACvB,iBAAiB,CAAiB,cAAc,CAAC,CAAC"}

package/dist/contracts/adapters/broker.d.ts

@@ -1,15 +1,38 @@
+/**
+ * Message-broker seam. The EventBus (@openora/core/server) publishes/subscribes through this
+ * adapter, so the inter-module transport is swappable: the default binding is an
+ * in-process broker; a downstream operator binds a durable driver (RabbitMQ,
+ * Redpanda / Kafka API, NATS JetStream) to MESSAGE_BROKER in an overlay and every
+ * event flows through it - no module change. Delivery is at-least-once once a real
+ * broker is bound, so consumers must be idempotent. See ADR-0010 and ADR-0016.
+ */
 import { type Token } from './token.js';
+/**
+ * On-the-wire envelope that every remote adapter serializes. The EventBus
+ * builds this internally; module code never sees it (only the typed payload).
+ */
 export type EventEnvelope<T = unknown> = {
+    /** Consumer-side idempotency/dedup key (UUID per emission). */
     eventId: string;
+    /** Domain event name (eg "wallet.deposit.completed"). */
     topic: string;
+    /** The validated event payload (matches domainEventSchemas). */
     payload: T;
+    /** ISO-8601 timestamp of the emission. */
     occurredAt: string;
+    /** Monotonic integer for forward-compat payload evolution. */
     schemaVersion: number;
+    /** Maps to Kafka partition key / RabbitMQ routing key for per-user ordering guarantees. */
     orderingKey?: string;
+    /** Distributed trace correlation ID. */
     traceId?: string;
 };
 export type BrokerHandler = (envelope: EventEnvelope) => void | Promise<void>;
 export type SubscribeOptions = {
+    /**
+     * Forward hint for grouped consumers: Kafka consumer group / RabbitMQ queue group.
+     * When omitted, the adapter creates an exclusive per-process queue (fan-out).
+     */
     consumerGroup?: string;
 };
 export type MessageBrokerAdapter = {

package/dist/contracts/adapters/broker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/broker.ts"],"names":[],"mappings":"AAMA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAarD,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAI9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,MAAM,IAAI,CAAC;IACzF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,oBAAoB,CAAiC,CAAC"}
+{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/broker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD;;;GAGG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI;IACvC,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,OAAO,EAAE,CAAC,CAAC;IACX,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,CAAC;IACtB,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,MAAM,IAAI,CAAC;IACzF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,oBAAoB,CAAiC,CAAC"}

package/dist/contracts/adapters/broker.js

@@ -1,9 +1,11 @@
-// Message-broker seam. The EventBus (@openora/core/server) publishes/subscribes through this
-// adapter, so the inter-module transport is swappable: the default binding is an
-// in-process broker; a downstream operator binds a durable driver (RabbitMQ,
-// Redpanda / Kafka API, NATS JetStream) to MESSAGE_BROKER in an overlay and every
-// event flows through it - no module change. Delivery is at-least-once once a real
-// broker is bound, so consumers must be idempotent. See ADR-0010 and ADR-0016.
+/**
+ * Message-broker seam. The EventBus (@openora/core/server) publishes/subscribes through this
+ * adapter, so the inter-module transport is swappable: the default binding is an
+ * in-process broker; a downstream operator binds a durable driver (RabbitMQ,
+ * Redpanda / Kafka API, NATS JetStream) to MESSAGE_BROKER in an overlay and every
+ * event flows through it - no module change. Delivery is at-least-once once a real
+ * broker is bound, so consumers must be idempotent. See ADR-0010 and ADR-0016.
+ */
 import { createToken } from './token.js';
 export const MESSAGE_BROKER = createToken('MESSAGE_BROKER');
 //# sourceMappingURL=broker.js.map

package/dist/contracts/adapters/broker.js.map

@@ -1 +1 @@
-{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../../src/contracts/adapters/broker.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,iFAAiF;AACjF,6EAA6E;AAC7E,kFAAkF;AAClF,mFAAmF;AACnF,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAqCrD,MAAM,CAAC,MAAM,cAAc,GAAgC,WAAW,CAAC,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../../src/contracts/adapters/broker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAuCrD,MAAM,CAAC,MAAM,cAAc,GAAgC,WAAW,CAAC,gBAAgB,CAAC,CAAC"}

package/dist/contracts/adapters/cache.d.ts

@@ -1,9 +1,20 @@
+/**
+ * Cache seam. Hot, non-personalized reads (public catalogue/content feeds) load
+ * through this adapter so the backend is swappable: the default binding is an
+ * in-process TTL cache (zero deps), process-local so invalidation does NOT
+ * propagate across replicas. Set REDIS_URL to bind the shipped Redis reference
+ * adapter (cross-replica invalidation) with zero consumer code; rebind CACHE via
+ * an overlay for any other backend.
+ */
 import { type Token } from './token.js';
 export type CacheAdapter = {
     get<T>(key: string): Promise<T | undefined>;
     set<T>(key: string, value: T, opts: {
         ttlMs: number;
     }): Promise<void>;
+    setIfAbsent<T>(key: string, value: T, opts: {
+        ttlMs: number;
+    }): Promise<boolean>;
     delete(key: string | string[]): Promise<void>;
 };
 export declare const CACHE: Token<CacheAdapter>;

package/dist/contracts/adapters/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/cache.ts"],"names":[],"mappings":"AAMA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAC5C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C,CAAC;AAEF,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,YAAY,CAAwB,CAAC"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAC5C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C,CAAC;AAEF,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,YAAY,CAAwB,CAAC"}