@openora/core 0.4.1-canary.13 → 0.4.1-canary.130

package/dist/contracts/adapters/kyc.d.ts

@@ -5,24 +5,95 @@
  * Load your overlay AFTER the identity plugin in extensions.config.ts (last registration wins).
  * See docs/adapters/kyc.md for the full binding guide.
  */
+import * as z from 'zod';
 import { type Token } from './token.js';
-import type { KycStatus, Player } from '../schemas/player.js';
-export type KycStatusSource = 'vendor' | 'manual' | 'webhook' | 'reverify';
+import type { KycStatus, KycStatusSource, KycTier, Player } from '../schemas/player.js';
 export type KycDocument = {
     type: 'passport' | 'drivers_license' | 'national_id';
     frontUrl: string;
     backUrl?: string;
 };
-export type KycVendorStatus = 'pending' | 'approved' | 'rejected' | 'not_started';
+export declare const KYC_VENDOR_STATUSES: readonly ["pending", "approved", "rejected", "not_started"];
+export type KycVendorStatus = (typeof KYC_VENDOR_STATUSES)[number];
+/**
+ * Vendor-neutral outcome of a single workflow step (eg an ID check, a liveness check,
+ * an AML screen). `approved` is the only terminal-successful value; every other value
+ * (including `unknown`, used when a vendor reports a step status this platform does
+ * not recognize) means the step has not reached a successful state.
+ */
+export declare const KYC_CHECK_STATUSES: readonly ["not_started", "in_progress", "in_review", "approved", "declined", "expired", "unknown"];
+export declare const KycCheckStatusSchema: z.ZodEnum<{
+    expired: "expired";
+    unknown: "unknown";
+    not_started: "not_started";
+    approved: "approved";
+    in_progress: "in_progress";
+    in_review: "in_review";
+    declined: "declined";
+}>;
+export type KycCheckStatus = z.infer<typeof KycCheckStatusSchema>;
+/** One workflow step's outcome. `step` is a free-form, vendor-supplied label (eg Didit's `ID_VERIFICATION`). */
+export declare const KycCheckResultSchema: z.ZodObject<{
+    step: z.ZodString;
+    status: z.ZodEnum<{
+        expired: "expired";
+        unknown: "unknown";
+        not_started: "not_started";
+        approved: "approved";
+        in_progress: "in_progress";
+        in_review: "in_review";
+        declined: "declined";
+    }>;
+}, z.core.$strip>;
+export type KycCheckResult = z.infer<typeof KycCheckResultSchema>;
 export type KycResult = {
     referenceId: string;
     status: KycVendorStatus;
+    /**
+     * The tier this decision belongs to, when the adapter/vendor can attribute it. Omit when
+     * the vendor session is a shared workflow that decides both tiers together (see
+     * `docs/adapters/kyc.md`) - `KycVerificationService.reconcile` then fans the decision out
+     * to every `kyc_verification` row sharing this `referenceId`, exactly as before this field
+     * existed. Set it whenever the vendor CAN tell tiers apart, so reconcile only ever touches
+     * the row that actually ran that tier's checks.
+     */
+    tier?: KycTier;
     /**
      * Hosted verification URL to redirect the end user to, for vendors whose flow collects
      * documents on their own hosted page (eg Didit) rather than accepting them from our
      * backend. Omitted by document-forwarding vendors (eg SumSub, MockKycAdapter).
      */
     verificationUrl?: string;
+    /** Document types the vendor's decision covers, when it reports them. */
+    documentTypes?: KycDocument['type'][];
+    /** Vendor-supplied human-readable reason for the decision (eg a rejection cause). */
+    decisionReason?: string;
+    /**
+     * Per-step outcomes for every workflow step the vendor considers part of THIS
+     * session (eg Didit's decision `features` list) - vendor-neutral, and inherently
+     * self-updating when the vendor-side workflow graph changes, since it is derived
+     * from the same session's decision payload rather than a separately maintained
+     * step list. Omitted by vendors/adapters with no step-level granularity (eg
+     * MockKycAdapter, a document-forwarding vendor). The compliance completeness gate
+     * (`KycVerificationService.reconcile`) requires every entry to be `approved`
+     * before it lets a vendor `approved` status stand; a missing/incomplete step
+     * routes the decision to `resubmission_requested` instead.
+     */
+    checks?: KycCheckResult[];
+};
+/**
+ * Vendor-neutral device/IP risk signals resolved for a KYC verification session.
+ * Hosted-session vendors (eg Didit) extract these from their own session decision;
+ * document-forwarding vendors and MockKycAdapter have no session-level device/IP
+ * telemetry to report and omit the port method entirely rather than returning a
+ * default-false shape.
+ */
+export type KycRiskSignals = {
+    vpnOrTorDetected: boolean;
+    dataCenterIpDetected: boolean;
+    duplicateDeviceDetected: boolean;
+    highRiskCountryDetected: boolean;
+    deviceFingerprints: string[];
 };
 export type KycAdapter = {
     /**
@@ -31,22 +102,42 @@ export type KycAdapter = {
      * operator can't enable the gate yet leave verification a no-op. Real providers omit it.
      */
     readonly autoApproves?: boolean;
-    submit(userId: string, documents: KycDocument[]): Promise<KycResult>;
-    getStatus(userId: string): Promise<KycVendorStatus>;
+    submit(userId: string, documents: KycDocument[], tier: KycTier): Promise<KycResult>;
+    getStatus(userId: string, tier: KycTier): Promise<KycVendorStatus>;
     /**
      * Provider-specific normalization of a raw webhook into a vendor decision, or
      * null when the body is not a reconcilable decision. Optional - MockKycAdapter
      * omits it; the Didit/SumSub overlay implements it.
      */
     parseWebhook?(rawBody: string, headers: Record<string, string | string[] | undefined>): KycResult | null;
+    /**
+     * Fetches the full decision for a reference id - documentTypes, decisionReason,
+     * and the authoritative status - from the vendor. Optional: document-forwarding
+     * vendors and MockKycAdapter have nothing to resolve (the webhook/submit payload
+     * IS the decision); a hosted-session vendor (eg Didit) implements it so the
+     * `kyc-decision-sync` job can enrich the webhook's bare referenceId+status with
+     * the full decision off the request path, never awaited inline in the webhook
+     * handler (Didit's own SLA is ~5s with 2 retries - the webhook route must not
+     * inherit that latency).
+     */
+    resolveDecision?(referenceId: string): Promise<KycResult>;
+    /**
+     * Fetches device/IP risk signals for a reference id. Optional - the signals only
+     * exist as part of a vendor's hosted verification session, never at signup, so
+     * only a hosted-session vendor (eg Didit) implements it; document-forwarding
+     * vendors and MockKycAdapter omit it. Called by the `kyc-decision-sync` job
+     * alongside `resolveDecision`, off the webhook request path.
+     */
+    resolveRiskSignals?(referenceId: string): Promise<KycRiskSignals>;
 };
 export declare const KYC_ADAPTER: Token<KycAdapter>;
 /**
  * Single-writer port for `player.kycStatus`. The invariant is enforced structurally,
  * not by a sealed token: pam owns the `player` table and binds the only implementation,
- * so every status change (admin override, vendor decision, webhook, threshold re-KYC)
- * routes through one write + one `compliance.kyc.updated` emit. An overlay MAY rebind
- * this port, but it MUST preserve that audit emit - dropping it breaks the 5AMLD trail.
+ * so every Basic status change (admin override, vendor decision, webhook, threshold re-KYC)
+ * routes through one write. Compliance emits the corresponding `compliance.kyc.updated`
+ * event after its transaction commits. An overlay MAY rebind this port, but it MUST
+ * preserve the transition result or the audit trail cannot be emitted.
  * `actorId` is the admin who acted, or null for a system change (vendor/webhook/re-KYC).
  * `source` records what drove it. `tx` is the caller's active transaction handle to stay
  * atomic with the caller's own writes (e.g. the player-management update), else the writer
@@ -58,7 +149,11 @@ export type KycStatusWriter = {
         actorId: Player['userId'] | null;
         reason?: string;
         source: KycStatusSource;
-    }, tx?: unknown): Promise<void>;
+    }, tx?: unknown): Promise<KycStatusTransition | null>;
+};
+export type KycStatusTransition = {
+    playerId: Player['id'];
+    previousStatus: KycStatus;
 };
 export declare const KYC_STATUS_WRITER: Token<KycStatusWriter>;
 /**
@@ -68,10 +163,14 @@ export declare const KYC_STATUS_WRITER: Token<KycStatusWriter>;
  * unset, the signature is absent, or the raw body was not captured. Takes the full
  * headers map (not a pre-extracted value) because the signing header name is
  * vendor-specific - eg SumSub vs a hosted-session vendor each names it differently -
- * so each implementation extracts whatever header(s) it actually needs.
+ * so each implementation extracts whatever header(s) it actually needs. Async (a
+ * `boolean` return also satisfies the type) because a real implementation - the
+ * default `HmacKycWebhookVerifier` included - checks replay protection against a
+ * store, not just the signature bytes; a captured valid signature must not be
+ * honored forever.
  */
 export type KycWebhookVerifier = {
-    verify(rawBody: string, headers: Record<string, string | string[] | undefined>): boolean;
+    verify(rawBody: string, headers: Record<string, string | string[] | undefined>): boolean | Promise<boolean>;
 };
 export declare const KYC_WEBHOOK_VERIFIER: Token<KycWebhookVerifier>;
 //# sourceMappingURL=kyc.d.ts.map

package/dist/contracts/adapters/kyc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kyc.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/kyc.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;AAE3E,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,UAAU,GAAG,iBAAiB,GAAG,aAAa,CAAC;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;AAElF,MAAM,MAAM,SAAS,GAAG;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACrE,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACpD;;;;OAIG;IACH,YAAY,CAAC,CACX,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,SAAS,GAAG,IAAI,CAAC;CACrB,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CACP,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EACxB,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,eAAe,CAAA;KAAE,EACpF,EAAE,CAAC,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAoC,CAAC;AAE1F;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC;CAC1F,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAuC,CAAC"}
+{"version":3,"file":"kyc.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/kyc.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAExF,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,UAAU,GAAG,iBAAiB,GAAG,aAAa,CAAC;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,eAAO,MAAM,mBAAmB,6DAA8D,CAAC;AAC/F,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,oGAQrB,CAAC;AACX,eAAO,MAAM,oBAAoB;;;;;;;;EAA6B,CAAC;AAC/D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,gHAAgH;AAChH,eAAO,MAAM,oBAAoB;;;;;;;;;;;iBAG/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,MAAM,MAAM,SAAS,GAAG;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;IACxB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;IACtC,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,uBAAuB,EAAE,OAAO,CAAC;IACjC,uBAAuB,EAAE,OAAO,CAAC;IACjC,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpF,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACnE;;;;OAIG;IACH,YAAY,CAAC,CACX,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,SAAS,GAAG,IAAI,CAAC;IACpB;;;;;;;;;OASG;IACH,eAAe,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1D;;;;;;OAMG;IACH,kBAAkB,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACnE,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC;AAEzE;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CACP,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EACxB,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,eAAe,CAAA;KAAE,EACpF,EAAE,CAAC,EAAE,OAAO,GACX,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,cAAc,EAAE,SAAS,CAAC;CAC3B,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAoC,CAAC;AAE1F;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,CACJ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/B,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAuC,CAAC"}

package/dist/contracts/adapters/kyc.js

@@ -5,7 +5,30 @@
  * Load your overlay AFTER the identity plugin in extensions.config.ts (last registration wins).
  * See docs/adapters/kyc.md for the full binding guide.
  */
+import * as z from 'zod';
 import { createToken } from './token.js';
+export const KYC_VENDOR_STATUSES = ['pending', 'approved', 'rejected', 'not_started'];
+/**
+ * Vendor-neutral outcome of a single workflow step (eg an ID check, a liveness check,
+ * an AML screen). `approved` is the only terminal-successful value; every other value
+ * (including `unknown`, used when a vendor reports a step status this platform does
+ * not recognize) means the step has not reached a successful state.
+ */
+export const KYC_CHECK_STATUSES = [
+    'not_started',
+    'in_progress',
+    'in_review',
+    'approved',
+    'declined',
+    'expired',
+    'unknown',
+];
+export const KycCheckStatusSchema = z.enum(KYC_CHECK_STATUSES);
+/** One workflow step's outcome. `step` is a free-form, vendor-supplied label (eg Didit's `ID_VERIFICATION`). */
+export const KycCheckResultSchema = z.object({
+    step: z.string(),
+    status: KycCheckStatusSchema,
+});
 export const KYC_ADAPTER = createToken('KYC_ADAPTER');
 export const KYC_STATUS_WRITER = createToken('KYC_STATUS_WRITER');
 export const KYC_WEBHOOK_VERIFIER = createToken('KYC_WEBHOOK_VERIFIER');

package/dist/contracts/adapters/kyc.js.map

@@ -1 +1 @@
-{"version":3,"file":"kyc.js","sourceRoot":"","sources":["../../../src/contracts/adapters/kyc.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AA4CrD,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC;AAuBzE,MAAM,CAAC,MAAM,iBAAiB,GAA2B,WAAW,CAAC,mBAAmB,CAAC,CAAC;AAe1F,MAAM,CAAC,MAAM,oBAAoB,GAA8B,WAAW,CAAC,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"kyc.js","sourceRoot":"","sources":["../../../src/contracts/adapters/kyc.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AASrD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,CAAU,CAAC;AAG/F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,aAAa;IACb,aAAa;IACb,WAAW;IACX,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;CACD,CAAC;AACX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAG/D,gHAAgH;AAChH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,oBAAoB;CAC7B,CAAC,CAAC;AA6FH,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC;AA6BzE,MAAM,CAAC,MAAM,iBAAiB,GAA2B,WAAW,CAAC,mBAAmB,CAAC,CAAC;AAsB1F,MAAM,CAAC,MAAM,oBAAoB,GAA8B,WAAW,CAAC,sBAAsB,CAAC,CAAC"}

package/dist/contracts/adapters/login-enforcement.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Push port for Responsible-Gambling login enforcement. Owned + bound by the identity
+ * module (it owns the `user` table); compliance depends only on this port to block or
+ * unblock a player's login, never on the identity schema. `block` also revokes all of
+ * the player's active sessions (the RG session-termination requirement). `until: null`
+ * means an indefinite block (self-exclusion / permanent); a Date is the cooling-off
+ * expiry the login gate auto-clears once elapsed. See ADR-0017.
+ */
 import { type Token } from './token.js';
 export type LoginEnforcementPort = {
     block(userId: string, opts: {

package/dist/contracts/adapters/login-enforcement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-enforcement.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/login-enforcement.ts"],"names":[],"mappings":"AAMA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,oBAAoB,CAAoC,CAAC"}
+{"version":3,"file":"login-enforcement.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/login-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,oBAAoB,CAAoC,CAAC"}

package/dist/contracts/adapters/login-enforcement.js

@@ -1,9 +1,11 @@
-// Push port for Responsible-Gambling login enforcement. Owned + bound by the identity
-// module (it owns the `user` table); compliance depends only on this port to block or
-// unblock a player's login, never on the identity schema. `block` also revokes all of
-// the player's active sessions (the RG session-termination requirement). `until: null`
-// means an indefinite block (self-exclusion / permanent); a Date is the cooling-off
-// expiry the login gate auto-clears once elapsed. See ADR-0017.
+/**
+ * Push port for Responsible-Gambling login enforcement. Owned + bound by the identity
+ * module (it owns the `user` table); compliance depends only on this port to block or
+ * unblock a player's login, never on the identity schema. `block` also revokes all of
+ * the player's active sessions (the RG session-termination requirement). `until: null`
+ * means an indefinite block (self-exclusion / permanent); a Date is the cooling-off
+ * expiry the login gate auto-clears once elapsed. See ADR-0017.
+ */
 import { createToken } from './token.js';
 export const LOGIN_ENFORCEMENT = createToken('LOGIN_ENFORCEMENT');
 //# sourceMappingURL=login-enforcement.js.map

package/dist/contracts/adapters/login-enforcement.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-enforcement.js","sourceRoot":"","sources":["../../../src/contracts/adapters/login-enforcement.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,oFAAoF;AACpF,gEAAgE;AAChE,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAOrD,MAAM,CAAC,MAAM,iBAAiB,GAAgC,WAAW,CAAC,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"login-enforcement.js","sourceRoot":"","sources":["../../../src/contracts/adapters/login-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAOrD,MAAM,CAAC,MAAM,iBAAiB,GAAgC,WAAW,CAAC,mBAAmB,CAAC,CAAC"}

package/dist/contracts/adapters/mail.d.ts

@@ -0,0 +1,30 @@
+import { type Token } from './token.js';
+import type { MailTemplate } from '../schemas/mail.js';
+export type EmailMessage = {
+    to: string;
+    subject: string;
+    html: string;
+    text: string;
+};
+export type EmailSenderPort = {
+    send(message: EmailMessage): Promise<void>;
+};
+export type EmailSender = EmailSenderPort;
+export declare const EMAIL_SENDER: Token<EmailSenderPort>;
+export type MailToUserInput = {
+    userId: string;
+    template: MailTemplate;
+    idempotencyKey: string;
+};
+export type MailToAddressInput = {
+    email: string;
+    locale?: string;
+    template: MailTemplate;
+    idempotencyKey: string;
+};
+export type MailDispatchPort = {
+    toUser(input: MailToUserInput): Promise<void>;
+    toAddress(input: MailToAddressInput): Promise<void>;
+};
+export declare const MAIL_DISPATCH: Token<MailDispatchPort>;
+//# sourceMappingURL=mail.d.ts.map

package/dist/contracts/adapters/mail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/mail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAE1C,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,eAAe,CAAgD,CAAC;AAEjG,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,YAAY,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,SAAS,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,KAAK,CAAC,gBAAgB,CACF,CAAC"}

package/dist/contracts/adapters/mail.js

@@ -0,0 +1,4 @@
+import { createToken } from './token.js';
+export const EMAIL_SENDER = createToken('EMAIL_SENDER');
+export const MAIL_DISPATCH = createToken('MAIL_DISPATCH');
+//# sourceMappingURL=mail.js.map

package/dist/contracts/adapters/mail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail.js","sourceRoot":"","sources":["../../../src/contracts/adapters/mail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAgBrD,MAAM,CAAC,MAAM,YAAY,GAA2B,WAAW,CAAkB,cAAc,CAAC,CAAC;AAoBjG,MAAM,CAAC,MAAM,aAAa,GACxB,WAAW,CAAmB,eAAe,CAAC,CAAC"}

package/dist/contracts/adapters/outbox.d.ts

@@ -1,3 +1,17 @@
+/**
+ * Transactional-outbox seam. A money/critical service, INSIDE its db.transaction,
+ * records the event through this port; the row commits atomically with the state
+ * change. A relay then publishes it to the MESSAGE_BROKER after commit, closing
+ * the gap where a crash between "state committed" and "event published" would
+ * otherwise lose the event. This is the primitive that makes cross-service,
+ * at-least-once domain events reliable - and the reason a module can be extracted
+ * to its own process without dropping events. See ADR-0016.
+ *
+ * `tx` is the active transaction handle, typed `unknown` here to keep @openora/core/contracts
+ * ORM-free; the Drizzle implementation in @openora/core/server narrows it. Services never touch
+ * this port directly - they call EventBus.emitInTransaction(tx, ...), which builds
+ * the envelope and delegates here.
+ */
 import { type Token } from './token.js';
 import type { EventEnvelope } from './broker.js';
 export type OutboxWriter = {

package/dist/contracts/adapters/outbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"outbox.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/outbox.ts"],"names":[],"mappings":"AAYA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,YAAY,CAAyB,CAAC"}
+{"version":3,"file":"outbox.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/outbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,YAAY,CAAyB,CAAC"}

package/dist/contracts/adapters/outbox.js

@@ -1,15 +1,17 @@
-// Transactional-outbox seam. A money/critical service, INSIDE its db.transaction,
-// records the event through this port; the row commits atomically with the state
-// change. A relay then publishes it to the MESSAGE_BROKER after commit, closing
-// the gap where a crash between "state committed" and "event published" would
-// otherwise lose the event. This is the primitive that makes cross-service,
-// at-least-once domain events reliable - and the reason a module can be extracted
-// to its own process without dropping events. See ADR-0016.
-//
-// `tx` is the active transaction handle, typed `unknown` here to keep @openora/core/contracts
-// ORM-free; the Drizzle implementation in @openora/core/server narrows it. Services never touch
-// this port directly - they call EventBus.emitInTransaction(tx, ...), which builds
-// the envelope and delegates here.
+/**
+ * Transactional-outbox seam. A money/critical service, INSIDE its db.transaction,
+ * records the event through this port; the row commits atomically with the state
+ * change. A relay then publishes it to the MESSAGE_BROKER after commit, closing
+ * the gap where a crash between "state committed" and "event published" would
+ * otherwise lose the event. This is the primitive that makes cross-service,
+ * at-least-once domain events reliable - and the reason a module can be extracted
+ * to its own process without dropping events. See ADR-0016.
+ *
+ * `tx` is the active transaction handle, typed `unknown` here to keep @openora/core/contracts
+ * ORM-free; the Drizzle implementation in @openora/core/server narrows it. Services never touch
+ * this port directly - they call EventBus.emitInTransaction(tx, ...), which builds
+ * the envelope and delegates here.
+ */
 import { createToken } from './token.js';
 export const OUTBOX = createToken('OUTBOX');
 //# sourceMappingURL=outbox.js.map

package/dist/contracts/adapters/outbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"outbox.js","sourceRoot":"","sources":["../../../src/contracts/adapters/outbox.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,kFAAkF;AAClF,4DAA4D;AAC5D,EAAE;AACF,8FAA8F;AAC9F,gGAAgG;AAChG,mFAAmF;AACnF,mCAAmC;AACnC,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAOrD,MAAM,CAAC,MAAM,MAAM,GAAwB,WAAW,CAAC,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"outbox.js","sourceRoot":"","sources":["../../../src/contracts/adapters/outbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAOrD,MAAM,CAAC,MAAM,MAAM,GAAwB,WAAW,CAAC,QAAQ,CAAC,CAAC"}

package/dist/contracts/adapters/payment.d.ts

@@ -1,3 +1,8 @@
+/**
+ * Payment seam. A PSP (card/bank/e-wallet) or a custody/address-issuing crypto vendor
+ * implements PaymentAdapter; bind a concrete adapter to PAYMENT_ADAPTER in the wallet
+ * module's plugin.ts. See docs/adapters/payment.md for the full binding guide.
+ */
 import { type Token } from './token.js';
 /**
  * Normalized shape of an inbound payment-vendor webhook, produced by a
@@ -6,10 +11,17 @@ import { type Token } from './token.js';
  * event reports a status transition for a withdrawal already sent to the vendor via
  * `processWithdrawal`. `externalId` is the vendor's reference id for the underlying
  * settlement - the dedup key the wallet module reconciles against.
+ *
+ * A deposit carries `network` because an address does not identify a chain: an EVM vault
+ * hands out one address that is shared across every EVM chain AND every token on them, so
+ * `address` alone maps to many issued rows. Omitting it falls back to address-only lookup,
+ * which is safe only for a vendor that issues a distinct address per currency.
  */
 export type PaymentWebhookEvent = {
     kind: 'deposit';
     address: string;
+    network?: string;
+    tag?: string;
     amount: string;
     currency: string;
     txHash: string;
@@ -20,6 +32,46 @@ export type PaymentWebhookEvent = {
     status: 'processing' | 'completed' | 'failed';
     txHash?: string;
 };
+/**
+ * A balance sitting in a per-player custody container that is not yet in the pooled
+ * account withdrawals are paid from. Produced by `PaymentAdapter.listSweepableBalances`
+ * and handed back to `sweepToPool` unchanged.
+ */
+export type CustodyBalance = {
+    userId: string;
+    currency: string;
+    network: string;
+    amount: string;
+    /** Current network cost to move it, same units as `amount`. */
+    estimatedFee: string;
+};
+/**
+ * Name of the single default `PaymentAdapter`/`PaymentWebhookVerifier` binding, wrapped
+ * as one `PaymentProviderRegistry` entry so an operator with one vendor changes nothing.
+ */
+export declare const DEFAULT_PAYMENT_PROVIDER = "default";
+/** One named vendor binding: the adapter it settles through and the verifier for its webhooks. */
+export type PaymentProvider = {
+    adapter: PaymentAdapter;
+    webhookVerifier: PaymentWebhookVerifier;
+};
+/**
+ * Looks up a named vendor's adapter/verifier pair. `wallet_asset.providerName` is the
+ * key; a webhook route resolves both the verifier AND the adapter from the SAME entry so
+ * a request can never be verified against one vendor's key and parsed by another's
+ * format (signature confusion).
+ *
+ * Core only looks a name up here - it never discovers or enumerates vendors itself. The
+ * operator composes this map in their own plugin because `Container.register` is
+ * last-wins: two overlays each binding the single `PAYMENT_ADAPTER`/`PAYMENT_WEBHOOK_VERIFIER`
+ * tokens would clobber each other, so running a fiat PSP and a crypto custodian at once
+ * needs an operator-owned map from provider name to pair, not a second core-discovered
+ * binding slot.
+ */
+export type PaymentProviderRegistry = {
+    get(providerName: string): PaymentProvider | null;
+    names(): readonly string[];
+};
 export type PaymentAdapter = {
     processDeposit(amount: string, currency: string, metadata: Record<string, unknown>): Promise<{
         externalId: string;
@@ -42,11 +94,37 @@ export type PaymentAdapter = {
      * Issue (or return) a deposit address for this user/asset. Only implemented by
      * address-based deposit vendors (eg a custody/MPC crypto rail) - a synchronous PSP
      * or `MockPaymentAdapter` omits it. The wallet module persists the returned address
-     * so re-requesting the same (userId, currency) is idempotent without a second
+     * so re-requesting the same (userId, currency, network) is idempotent without a second
      * vendor call.
      */
-    issueDepositAddress?(userId: string, currency: string): Promise<{
+    issueDepositAddress?(userId: string, currency: string, network?: string): Promise<{
         address: string;
+        tag?: string;
+    }>;
+    /**
+     * Register a player's payout address with the vendor and return the id a withdrawal names as
+     * its destination. Implemented by a custody vendor that requires destinations to be approved
+     * before funds can reach them; a synchronous PSP, which pays to an address it is handed,
+     * omits it and the wallet module stores no provider id.
+     *
+     * Called on the address-book write path rather than at payout time on purpose: approval can
+     * need a human quorum, which must not sit inside a withdrawal that is already holding a
+     * player's funds. Implementations must be idempotent on
+     * (userId, currency, network, address, destinationTag) - a retried registration has to return
+     * the original id instead of creating a second destination that then needs its own approval.
+     *
+     * `destinationTag` is part of the destination, not a detail of it: on a tag/memo chain one
+     * address serves many accounts and the tag picks which, so two tags on the same address are
+     * two different beneficiaries and must whitelist as two different destinations.
+     */
+    whitelistWithdrawalAddress?(input: {
+        userId: string;
+        currency: string;
+        network: string;
+        address: string;
+        destinationTag?: string;
+    }): Promise<{
+        providerWalletId: string;
     }>;
     /**
      * Vendor-specific normalization of a raw webhook into a reconcilable event, or
@@ -54,6 +132,65 @@ export type PaymentAdapter = {
      * `MockPaymentAdapter` omits it; an address-based/async vendor overlay implements it.
      */
     parseWebhook?(rawBody: string, headers: Record<string, string | string[] | undefined>): PaymentWebhookEvent | null;
+    /**
+     * Whether this adapter can actually serve the given asset. The asset catalog is
+     * operator-editable at runtime, so an admin can name a (currency, network) pair the
+     * bound vendor has never heard of; the catalog's write path calls this first and
+     * rejects rather than letting the pair reach a player's deposit screen. Optional -
+     * an adapter that omits it is assumed to accept anything the operator configures.
+     */
+    supportsAsset?(currency: string, network: string): boolean;
+    /**
+     * Per-player balances the vendor holds that are not yet in the pooled account.
+     * Only meaningful for a custody vendor whose per-player deposit containers are
+     * distinct from the account withdrawals are paid out of - a synchronous PSP, which
+     * never holds a per-player balance, omits it.
+     */
+    listSweepableBalances?(): Promise<CustodyBalance[]>;
+    /**
+     * Move one player's balance into the pooled account. Implemented alongside
+     * `listSweepableBalances`; the caller owns the policy (dust floor, fee thresholds)
+     * and this only performs the transfer it is handed.
+     *
+     * `idempotencyKey` exists because a thrown call cannot be distinguished from a lost
+     * response - the vendor must dedupe the retry on this key rather than double-move
+     * funds. `poolRef` is an opaque vendor-side identifier for the destination pool,
+     * recorded so the ledger can evidence that player funds landed in the player pool and
+     * not an operator account - a regulator asks this.
+     */
+    sweepToPool?(balance: CustodyBalance, opts: {
+        idempotencyKey: string;
+        treasuryRef?: string;
+    }): Promise<{
+        externalId: string;
+        poolRef?: string;
+    }>;
+    /**
+     * Balance currently in the pooled account for this asset. Consulted only when a sweep
+     * is blocked by the fee ceiling, to decide whether paying a high fee beats running the
+     * pool dry. Omit it and the ceiling is absolute.
+     */
+    getPoolBalance?(currency: string, network: string): Promise<string>;
+    /**
+     * Vendor transactions in a window, normalized into the same events `parseWebhook`
+     * produces - reconciliation is that same normalization, polled instead of pushed.
+     * Implemented by a vendor whose ledger can be listed after the fact; a PSP that only
+     * pushes webhooks omits it.
+     */
+    listTransactions?(range: {
+        since: Date;
+        until: Date;
+    }): Promise<PaymentWebhookEvent[]>;
+    /**
+     * Targeted status lookup for a single withdrawal, or null when the vendor has no
+     * record of it. Not redundant with `listTransactions`: a withdrawal stuck in
+     * `processing` for days falls outside any sane reconciliation window, so finalizing
+     * it needs a direct lookup by `externalId`.
+     */
+    getWithdrawalStatus?(externalId: string): Promise<{
+        status: 'processing' | 'completed' | 'failed';
+        txHash?: string;
+    } | null>;
 };
 export declare const PAYMENT_ADAPTER: Token<PaymentAdapter>;
 /**
@@ -64,7 +201,8 @@ export declare const PAYMENT_ADAPTER: Token<PaymentAdapter>;
  * absent, or the raw body was not captured.
  */
 export type PaymentWebhookVerifier = {
-    verify(rawBody: string, headers: Record<string, string | string[] | undefined>): boolean;
+    verify(rawBody: string, headers: Record<string, string | string[] | undefined>): boolean | Promise<boolean>;
 };
 export declare const PAYMENT_WEBHOOK_VERIFIER: Token<PaymentWebhookVerifier>;
+export declare const PAYMENT_PROVIDERS: Token<PaymentProviderRegistry>;
 //# sourceMappingURL=payment.d.ts.map

package/dist/contracts/adapters/payment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payment.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/payment.ts"],"names":[],"mappings":"AAGA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,YAAY,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN,MAAM,MAAM,cAAc,GAAG;IAC3B,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEnD;;;;;;;;OAQG;IACH,iBAAiB,CACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEnD;;;;;;OAMG;IACH,mBAAmB,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAErF;;;;OAIG;IACH,YAAY,CAAC,CACX,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,mBAAmB,GAAG,IAAI,CAAC;CAC/B,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,cAAc,CAAkC,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC;CAC1F,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,sBAAsB,CAElE,CAAC"}
+{"version":3,"file":"payment.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/payment.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,YAAY,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAElD,kGAAkG;AAClG,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,cAAc,CAAC;IACxB,eAAe,EAAE,sBAAsB,CAAC;CACzC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAAC;IAClD,KAAK,IAAI,SAAS,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEnD;;;;;;;;OAQG;IACH,iBAAiB,CACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEnD;;;;;;OAMG;IACH,mBAAmB,CAAC,CAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE9C;;;;;;;;;;;;;;;OAeG;IACH,0BAA0B,CAAC,CAAC,KAAK,EAAE;QACjC,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC;QAAE,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE1C;;;;OAIG;IACH,YAAY,CAAC,CACX,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,mBAAmB,GAAG,IAAI,CAAC;IAE9B;;;;;;OAMG;IACH,aAAa,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAE3D;;;;;OAKG;IACH,qBAAqB,CAAC,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAEpD;;;;;;;;;;OAUG;IACH,WAAW,CAAC,CACV,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAErD;;;;OAIG;IACH,cAAc,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpE;;;;;OAKG;IACH,gBAAgB,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAEvF;;;;;OAKG;IACH,mBAAmB,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAChD,MAAM,EAAE,YAAY,GAAG,WAAW,GAAG,QAAQ,CAAC;QAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI,CAAC,CAAC;CACX,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,cAAc,CAAkC,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,CACJ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/B,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,sBAAsB,CAElE,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,uBAAuB,CAAoC,CAAC"}

package/dist/contracts/adapters/payment.js

@@ -1,7 +1,15 @@
-// Payment seam. A PSP (card/bank/e-wallet) or a custody/address-issuing crypto vendor
-// implements PaymentAdapter; bind a concrete adapter to PAYMENT_ADAPTER in the wallet
-// module's plugin.ts. See docs/adapters/payment.md for the full binding guide.
+/**
+ * Payment seam. A PSP (card/bank/e-wallet) or a custody/address-issuing crypto vendor
+ * implements PaymentAdapter; bind a concrete adapter to PAYMENT_ADAPTER in the wallet
+ * module's plugin.ts. See docs/adapters/payment.md for the full binding guide.
+ */
 import { createToken } from './token.js';
+/**
+ * Name of the single default `PaymentAdapter`/`PaymentWebhookVerifier` binding, wrapped
+ * as one `PaymentProviderRegistry` entry so an operator with one vendor changes nothing.
+ */
+export const DEFAULT_PAYMENT_PROVIDER = 'default';
 export const PAYMENT_ADAPTER = createToken('PAYMENT_ADAPTER');
 export const PAYMENT_WEBHOOK_VERIFIER = createToken('PAYMENT_WEBHOOK_VERIFIER');
+export const PAYMENT_PROVIDERS = createToken('PAYMENT_PROVIDERS');
 //# sourceMappingURL=payment.js.map

package/dist/contracts/adapters/payment.js.map

@@ -1 +1 @@
-{"version":3,"file":"payment.js","sourceRoot":"","sources":["../../../src/contracts/adapters/payment.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,sFAAsF;AACtF,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAoErD,MAAM,CAAC,MAAM,eAAe,GAA0B,WAAW,CAAC,iBAAiB,CAAC,CAAC;AAarF,MAAM,CAAC,MAAM,wBAAwB,GAAkC,WAAW,CAChF,0BAA0B,CAC3B,CAAC"}
+{"version":3,"file":"payment.js","sourceRoot":"","sources":["../../../src/contracts/adapters/payment.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AA+CrD;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AA2JlD,MAAM,CAAC,MAAM,eAAe,GAA0B,WAAW,CAAC,iBAAiB,CAAC,CAAC;AAgBrF,MAAM,CAAC,MAAM,wBAAwB,GAAkC,WAAW,CAChF,0BAA0B,CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAmC,WAAW,CAAC,mBAAmB,CAAC,CAAC"}

package/dist/contracts/adapters/play-eligibility.d.ts

@@ -0,0 +1,15 @@
+import { type Token } from './token.js';
+/**
+ * Read port for Responsible-Gambling play enforcement. Owned + bound by the identity
+ * module (it owns the `user` table and the `rgBlocked`/`rgBlockedUntil` projection that
+ * `LOGIN_ENFORCEMENT` writes). Gaming and wallet depend only on this port to refuse a
+ * wager, never on the identity schema.
+ *
+ * A cooling-off whose `rgBlockedUntil` has elapsed reports `false` without waiting for
+ * the expiry sweep, matching the login gate's lazy-expiry behaviour.
+ */
+export type PlayEligibilityPort = {
+    isRestricted(userId: string): Promise<boolean>;
+};
+export declare const PLAY_ELIGIBILITY: Token<PlayEligibilityPort>;
+//# sourceMappingURL=play-eligibility.d.ts.map