@openora/core 0.4.1-canary.14 → 0.4.1-canary.140

package/dist/wallet/service/swap.service.js

@@ -0,0 +1,283 @@
+import { assertRateLimit, createDomainError, createLogger, findOneOrThrow, makeConflictError, moneyToNumber, } from '@openora/core/server';
+import { makeRateLimitKey, RATE_LIMIT_KEYS, } from '@openora/core/contracts';
+import { and, eq } from 'drizzle-orm';
+import * as z from 'zod';
+import { wallet, walletTransaction } from '../schema/index.js';
+import { BonusRolloverLockedError, InsufficientBalanceError, IdempotencyKeyReuseError, WalletNotFoundError, balanceKey, creditWalletBalance, debitWithdrawableBalance, railFor, readLockedBonusAmount, readWalletBalance, } from './wallet.service.js';
+const logger = createLogger('wallet-swap');
+// Same policy as the other money mutations - a swap is one, and it also costs a vendor call.
+const SWAP_RATE_LIMIT = { limit: 30, windowMs: 60 * 1000 };
+export const SwapUnavailableError = makeConflictError('SwapUnavailableError', 'no swap vendor is configured');
+export const SwapPairUnsupportedError = createDomainError('SwapPairUnsupportedError', (from, to) => `swap pair ${from}->${to} is not supported`);
+// The vendor reported a fill but not what it filled. Nothing may be credited off a
+// missing number, so the swap stays `processing` for the webhook (or an operator) to
+// finish rather than guessing at the quoted amount.
+export const SwapFillAmountMissingError = createDomainError('SwapFillAmountMissingError', (externalId) => `swap ${externalId} completed without a fill amount`);
+/**
+ * The out-leg carries what the in-leg will need once the vendor settles - the ledger has
+ * no column for a swap's other side, and a webhook arriving hours later has nothing but
+ * this row to work from.
+ */
+const SwapLegMetadataSchema = z.object({
+    toCurrency: z.string(),
+    quoteId: z.string().optional(),
+});
+/**
+ * Currency swaps between a player's own balances, booked as two ledger legs: a `swap_out`
+ * debit written (and the funds held) before the vendor is called, and a `swap_in` credit
+ * written only against a number the vendor actually filled. The vendor call never runs
+ * inside a transaction - the hold commits first, exactly like a withdrawal, so a slow or
+ * hanging desk cannot pin a row lock.
+ *
+ * A vendor that fills asynchronously leaves the out-leg `processing` until its webhook
+ * lands (`reconcileSwapStatus`). Nothing sweeps those: the wallet reconciliation cycle
+ * only looks at withdrawals, so a vendor that never calls back leaves the player's funds
+ * held. Add a poll over `getSwapStatus` when a real desk with async fills is bound.
+ */
+export class SwapService {
+    drizzle;
+    events;
+    adapter;
+    platformConfig;
+    limiter;
+    constructor(deps) {
+        this.drizzle = deps.drizzle;
+        this.events = deps.events;
+        this.adapter = deps.adapter;
+        this.platformConfig = deps.platformConfig;
+        this.limiter = deps.limiter;
+    }
+    /**
+     * Player-scoped even though a price is not player-specific: a quote is a vendor call the
+     * desk bills for, so it is behind the session and the same per-player throttle the swap
+     * itself takes rather than an open pricing endpoint.
+     */
+    async quote({ userId, ...input }) {
+        await this.rateLimit(userId);
+        this.assertPair(input.fromCurrency, input.toCurrency);
+        const quote = await this.adapter.getQuote(input);
+        if (!quote) {
+            throw new SwapPairUnsupportedError(input.fromCurrency, input.toCurrency);
+        }
+        return quote;
+    }
+    async swap({ userId, fromCurrency, toCurrency, fromAmount, quoteId, idempotencyKey, }) {
+        await this.rateLimit(userId);
+        this.assertPair(fromCurrency, toCurrency);
+        // Phase one: hold the player's funds and commit. A `processing` out-leg is the record
+        // that money left the balance, so a crash before the vendor answers is visible rather
+        // than a silent gap.
+        const { row, replayed } = await this.drizzle.db.transaction(async (txn) => {
+            const current = findOneOrThrow(await txn.select().from(wallet).where(eq(wallet.userId, userId)).for('update'), new WalletNotFoundError(userId));
+            const existing = await this.findByIdempotencyKey(txn, current.id, idempotencyKey);
+            if (existing) {
+                this.assertReplayMatches(existing, fromAmount, fromCurrency);
+                return { row: existing, replayed: true };
+            }
+            const [inserted] = await txn
+                .insert(walletTransaction)
+                .values({
+                walletId: current.id,
+                type: 'swap_out',
+                amount: fromAmount,
+                currency: balanceKey(fromCurrency),
+                status: 'processing',
+                direction: 'debit',
+                rail: railFor(fromCurrency, this.platformConfig?.wallet?.cryptoCurrencies),
+                idempotencyKey,
+                metadata: JSON.stringify({ toCurrency: balanceKey(toCurrency), quoteId }),
+            })
+                .onConflictDoNothing()
+                .returning();
+            // Lost the race on the (walletId, idempotencyKey) unique index: the winner's row is
+            // the swap, and this request is a replay of it.
+            if (!inserted) {
+                const winner = findOneOrThrow(await this.findByIdempotencyKeyRows(txn, current.id, idempotencyKey), new IdempotencyKeyReuseError());
+                this.assertReplayMatches(winner, fromAmount, fromCurrency);
+                return { row: winner, replayed: true };
+            }
+            // Bonus-locked funds are not swappable, same as they are not withdrawable. The two
+            // refusals are told apart the way `withdraw` does it: a balance that covers the amount
+            // but a debit that did not land means rollover held it, and telling the player
+            // "insufficient balance" against a balance they can see would be a lie.
+            const debited = await debitWithdrawableBalance(txn, current.id, fromCurrency, fromAmount);
+            if (debited.length !== 1) {
+                const [available, locked] = await Promise.all([
+                    readWalletBalance(txn, current.id, fromCurrency),
+                    readLockedBonusAmount(txn, current.id, fromCurrency),
+                ]);
+                if (moneyToNumber(available) < moneyToNumber(fromAmount)) {
+                    throw new InsufficientBalanceError(available, fromAmount);
+                }
+                throw new BonusRolloverLockedError(locked);
+            }
+            return { row: inserted, replayed: false };
+        });
+        if (replayed) {
+            return this.toResult(row);
+        }
+        // Phase two, outside the transaction. The out-leg's id is the idempotency key the
+        // vendor must dedupe on, so a retried execute returns the original trade.
+        let execution;
+        try {
+            execution = await this.adapter.execute({
+                quoteId,
+                fromCurrency,
+                toCurrency,
+                fromAmount,
+                idempotencyKey: row.id,
+            });
+        }
+        catch (err) {
+            // No trade the vendor will honour - return the held funds before rethrowing.
+            await this.refund(row);
+            throw err;
+        }
+        if (execution.status === 'failed') {
+            await this.refund(row, execution.externalId);
+            return { transactionId: row.id, status: 'failed', toAmount: null };
+        }
+        if (execution.status === 'processing') {
+            await this.drizzle.db
+                .update(walletTransaction)
+                .set({ providerRefId: execution.externalId })
+                .where(eq(walletTransaction.id, row.id));
+            return { transactionId: row.id, status: 'processing', toAmount: null };
+        }
+        return this.settle(row, execution.externalId, execution.toAmount);
+    }
+    /** Vendor-driven settlement of a swap its `execute` left `processing`. */
+    async reconcileSwapStatus(event) {
+        const [row] = await this.drizzle.db
+            .select()
+            .from(walletTransaction)
+            .where(eq(walletTransaction.providerRefId, event.externalId));
+        if (!row || row.type !== 'swap_out') {
+            logger.warn({ externalId: event.externalId }, 'swap webhook: no matching swap for externalId');
+            return;
+        }
+        if (row.status !== 'processing') {
+            return;
+        }
+        if (event.status === 'completed') {
+            await this.settle(row, event.externalId, event.toAmount);
+            return;
+        }
+        if (event.status === 'failed') {
+            await this.refund(row, event.externalId);
+        }
+    }
+    // Credits the in-leg against the filled amount and closes the out-leg, in one
+    // transaction. The `status = 'processing'` guard is the payout guard: an execute
+    // response and a webhook racing on the same fill credit the player once.
+    async settle(out, externalId, toAmount) {
+        if (toAmount === undefined || Number(toAmount) <= 0) {
+            throw new SwapFillAmountMissingError(externalId);
+        }
+        const toCurrency = this.toCurrencyOf(out);
+        const settled = await this.drizzle.db.transaction(async (txn) => {
+            const flipped = await txn
+                .update(walletTransaction)
+                .set({ status: 'completed', providerRefId: externalId })
+                .where(and(eq(walletTransaction.id, out.id), eq(walletTransaction.status, 'processing')))
+                .returning({ id: walletTransaction.id });
+            if (flipped.length === 0) {
+                return false;
+            }
+            await creditWalletBalance(txn, out.walletId, toCurrency, toAmount);
+            await txn.insert(walletTransaction).values({
+                walletId: out.walletId,
+                type: 'swap_in',
+                amount: toAmount,
+                currency: balanceKey(toCurrency),
+                status: 'completed',
+                direction: 'credit',
+                rail: railFor(toCurrency, this.platformConfig?.wallet?.cryptoCurrencies),
+                // Not providerRefId: that column is globally unique, and the vendor's id already
+                // belongs to the out-leg. The in-leg points back at its own pair instead.
+                metadata: JSON.stringify({ swapTransactionId: out.id, externalId }),
+            });
+            return true;
+        });
+        if (settled) {
+            this.events.emit('wallet.swap.completed', {
+                userId: await this.userIdForWallet(out.walletId),
+                transactionId: out.id,
+                fromCurrency: out.currency,
+                fromAmount: out.amount,
+                toCurrency: balanceKey(toCurrency),
+                toAmount,
+            });
+        }
+        return { transactionId: out.id, status: 'completed', toAmount };
+    }
+    // Returns the held funds and closes the out-leg as `failed`. Guarded on `processing`
+    // so a refund can never run twice for one hold.
+    async refund(out, externalId) {
+        await this.drizzle.db.transaction(async (txn) => {
+            const flipped = await txn
+                .update(walletTransaction)
+                .set({ status: 'failed', ...(externalId ? { providerRefId: externalId } : {}) })
+                .where(and(eq(walletTransaction.id, out.id), eq(walletTransaction.status, 'processing')))
+                .returning({ id: walletTransaction.id });
+            if (flipped.length === 0) {
+                return;
+            }
+            await creditWalletBalance(txn, out.walletId, out.currency, out.amount);
+        });
+    }
+    assertPair(fromCurrency, toCurrency) {
+        if (balanceKey(fromCurrency) === balanceKey(toCurrency)) {
+            throw new SwapPairUnsupportedError(fromCurrency, toCurrency);
+        }
+        if (this.adapter.supportsPair && !this.adapter.supportsPair(fromCurrency, toCurrency)) {
+            throw new SwapPairUnsupportedError(fromCurrency, toCurrency);
+        }
+    }
+    // Written by this service one insert earlier, so a malformed value is a bug here, not
+    // untrusted input - but it still comes back from the DB as a string, so it is parsed
+    // rather than cast.
+    toCurrencyOf(out) {
+        const parsed = SwapLegMetadataSchema.safeParse(out.metadata ? JSON.parse(out.metadata) : null);
+        if (!parsed.success) {
+            throw new Error(`wallet swap: transaction ${out.id} has no target currency recorded`);
+        }
+        return parsed.data.toCurrency;
+    }
+    toResult(row) {
+        return { transactionId: row.id, status: row.status, toAmount: null };
+    }
+    assertReplayMatches(existing, fromAmount, fromCurrency) {
+        if (existing.type !== 'swap_out' ||
+            Number(existing.amount) !== Number(fromAmount) ||
+            existing.currency !== balanceKey(fromCurrency)) {
+            throw new IdempotencyKeyReuseError();
+        }
+    }
+    async findByIdempotencyKey(txn, walletId, idempotencyKey) {
+        const [row] = await this.findByIdempotencyKeyRows(txn, walletId, idempotencyKey);
+        return row;
+    }
+    findByIdempotencyKeyRows(txn, walletId, idempotencyKey) {
+        return txn
+            .select()
+            .from(walletTransaction)
+            .where(and(eq(walletTransaction.walletId, walletId), eq(walletTransaction.idempotencyKey, idempotencyKey)));
+    }
+    async userIdForWallet(walletId) {
+        const [row] = await this.drizzle.db
+            .select({ userId: wallet.userId })
+            .from(wallet)
+            .where(eq(wallet.id, walletId));
+        if (!row) {
+            throw new WalletNotFoundError(walletId);
+        }
+        return row.userId;
+    }
+    rateLimit(userId) {
+        return this.limiter
+            ? assertRateLimit(this.limiter, makeRateLimitKey(RATE_LIMIT_KEYS.WALLET_MUTATION, userId), SWAP_RATE_LIMIT)
+            : Promise.resolve();
+    }
+}
+//# sourceMappingURL=swap.service.js.map

package/dist/wallet/service/swap.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"swap.service.js","sourceRoot":"","sources":["../../../src/wallet/service/swap.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,aAAa,GAId,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,gBAAgB,EAChB,eAAe,GAShB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAuC,MAAM,oBAAoB,CAAC;AACpG,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,mBAAmB,EACnB,wBAAwB,EACxB,OAAO,EACP,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,eAAe,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC;AAE3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CACnD,sBAAsB,EACtB,8BAA8B,CAC/B,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CACvD,0BAA0B,EAC1B,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,aAAa,IAAI,KAAK,EAAE,mBAAmB,CAC1D,CAAC;AAEF,mFAAmF;AACnF,qFAAqF;AACrF,oDAAoD;AACpD,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CACzD,4BAA4B,EAC5B,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,UAAU,kCAAkC,CACrE,CAAC;AAEF;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AASH;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,WAAW;IACL,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,OAAO,CAAc;IACrB,cAAc,CAAkB;IAChC,OAAO,CAAoC;IAE5D,YAAY,IAMX;QACC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,EACV,MAAM,EACN,GAAG,KAAK,EAMT;QACC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,wBAAwB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EACT,MAAM,EACN,YAAY,EACZ,UAAU,EACV,UAAU,EACV,OAAO,EACP,cAAc,GAQf;QACC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAE1C,sFAAsF;QACtF,sFAAsF;QACtF,qBAAqB;QACrB,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACxE,MAAM,OAAO,GAAG,cAAc,CAC5B,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAC9E,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAChC,CAAC;YAEF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;YAClF,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;gBAC7D,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;YAED,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,GAAG;iBACzB,MAAM,CAAC,iBAAiB,CAAC;iBACzB,MAAM,CAAC;gBACN,QAAQ,EAAE,OAAO,CAAC,EAAE;gBACpB,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,UAAU,CAAC,YAAY,CAAC;gBAClC,MAAM,EAAE,YAAY;gBACpB,SAAS,EAAE,OAAO;gBAClB,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,gBAAgB,CAAC;gBAC1E,cAAc;gBACd,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;aAC1E,CAAC;iBACD,mBAAmB,EAAE;iBACrB,SAAS,EAAE,CAAC;YAEf,oFAAoF;YACpF,gDAAgD;YAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,MAAM,GAAG,cAAc,CAC3B,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,EACpE,IAAI,wBAAwB,EAAE,CAC/B,CAAC;gBACF,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;gBAC3D,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzC,CAAC;YAED,mFAAmF;YACnF,uFAAuF;YACvF,+EAA+E;YAC/E,wEAAwE;YACxE,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YAC1F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC5C,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC;oBAChD,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC;iBACrD,CAAC,CAAC;gBACH,IAAI,aAAa,CAAC,SAAS,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;oBACzD,MAAM,IAAI,wBAAwB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;gBAC5D,CAAC;gBACD,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAC7C,CAAC;YAED,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAED,kFAAkF;QAClF,0EAA0E;QAC1E,IAAI,SAAS,CAAC;QACd,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;gBACrC,OAAO;gBACP,YAAY;gBACZ,UAAU;gBACV,UAAU;gBACV,cAAc,EAAE,GAAG,CAAC,EAAE;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6EAA6E;YAC7E,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YAC7C,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;iBAClB,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC;iBAC5C,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3C,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACzE,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,mBAAmB,CAAC,KAAuB;QAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CACT,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAChC,+CAA+C,CAChD,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,iFAAiF;IACjF,yEAAyE;IACjE,KAAK,CAAC,MAAM,CAClB,GAAsB,EACtB,UAAuC,EACvC,QAA4B;QAE5B,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,0BAA0B,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9D,MAAM,OAAO,GAAG,MAAM,GAAG;iBACtB,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;iBACvD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;iBACxF,SAAS,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACnE,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;gBACzC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;gBAChC,MAAM,EAAE,WAAW;gBACnB,SAAS,EAAE,QAAQ;gBACnB,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,gBAAgB,CAAC;gBACxE,iFAAiF;gBACjF,0EAA0E;gBAC1E,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;aACpE,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBACxC,MAAM,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAChD,aAAa,EAAE,GAAG,CAAC,EAAE;gBACrB,YAAY,EAAE,GAAG,CAAC,QAAQ;gBAC1B,UAAU,EAAE,GAAG,CAAC,MAAM;gBACtB,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;gBAClC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IAClE,CAAC;IAED,qFAAqF;IACrF,gDAAgD;IACxC,KAAK,CAAC,MAAM,CAClB,GAAsB,EACtB,UAAwC;QAExC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,OAAO,GAAG,MAAM,GAAG;iBACtB,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;iBAC/E,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;iBACxF,SAAS,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,UAAU,CAAC,YAAoB,EAAE,UAAkB;QACzD,IAAI,UAAU,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,wBAAwB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,wBAAwB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,qFAAqF;IACrF,oBAAoB;IACZ,YAAY,CAAC,GAAsB;QACzC,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAC5C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAa,CAAC,CAAC,CAAC,IAAI,CAC5D,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,CAAC,EAAE,kCAAkC,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;IAChC,CAAC;IAEO,QAAQ,CAAC,GAAsB;QACrC,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvE,CAAC;IAEO,mBAAmB,CACzB,QAA2B,EAC3B,UAAkB,EAClB,YAAoB;QAEpB,IACE,QAAQ,CAAC,IAAI,KAAK,UAAU;YAC5B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC;YAC9C,QAAQ,CAAC,QAAQ,KAAK,UAAU,CAAC,YAAY,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,GAAc,EACd,QAAsB,EACtB,cAAgE;QAEhE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QACjF,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,wBAAwB,CAC9B,GAAc,EACd,QAAsB,EACtB,cAAgE;QAEhE,OAAO,GAAG;aACP,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACxC,EAAE,CAAC,iBAAiB,CAAC,cAAc,EAAE,cAAc,CAAC,CACrD,CACF,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,QAAsB;QAClD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aACjC,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAEO,SAAS,CAAC,MAAkB;QAClC,OAAO,IAAI,CAAC,OAAO;YACjB,CAAC,CAAC,eAAe,CACb,IAAI,CAAC,OAAO,EACZ,gBAAgB,CAAC,eAAe,CAAC,eAAe,EAAE,MAAM,CAAC,EACzD,eAAe,CAChB;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/wallet/service/wallet-commands.service.d.ts

@@ -1,8 +1,23 @@
-import type { WalletCommands, WalletDebitArgs, WalletDebitOutcome, WalletCreditArgs, WalletCreditOutcome } from '@openora/core/contracts';
-export declare const WalletCommandAmountError: new (operation: string, amount: string) => Error;
+import { type AuditWritePort, type PlayEligibilityPort, type RgLimitsPort, type PlatformConfig, type WalletCommands, type WalletDebitArgs, type WalletDebitOutcome, type WalletCreditArgs, type WalletCreditOutcome } from '@openora/core/contracts';
+export declare const WalletCommandAmountError: new (operation: string, amount: string) => Error & {
+    data?: Record<string, string>;
+};
+export declare const WalletRgRestrictedError: new () => Error & {
+    data?: Record<string, string>;
+};
 export declare class WalletCommandsService implements WalletCommands {
+    private readonly playEligibility;
+    private readonly audit;
+    private readonly platformConfig?;
+    private readonly rgLimits?;
+    constructor(playEligibility: PlayEligibilityPort, audit: AuditWritePort, platformConfig?: PlatformConfig | undefined, rgLimits?: RgLimitsPort | undefined);
     private writeLedgerRow;
-    debit(tx: unknown, { userId, amount, type }: WalletDebitArgs): Promise<WalletDebitOutcome>;
-    credit(tx: unknown, { userId, amount, type }: WalletCreditArgs): Promise<WalletCreditOutcome>;
+    private findByProviderRef;
+    debit(tx: unknown, { userId, amount, type, currency, providerRef }: WalletDebitArgs): Promise<WalletDebitOutcome>;
+    credit(tx: unknown, { userId, amount, currency, type, allowNewCurrency, allowNewWallet, providerRef, }: WalletCreditArgs): Promise<WalletCreditOutcome>;
+    private resolveOrOpenWallet;
+    private resolveRolloverMultiplier;
+    private createBonusCredit;
+    private applyBonusRolloverProgress;
 }
 //# sourceMappingURL=wallet-commands.service.d.ts.map

package/dist/wallet/service/wallet-commands.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wallet-commands.service.d.ts","sourceRoot":"","sources":["../../../src/wallet/service/wallet-commands.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EAEpB,MAAM,yBAAyB,CAAC;AAMjC,eAAO,MAAM,wBAAwB,kDAGpC,CAAC;AASF,qBAAa,qBAAsB,YAAW,cAAc;IAE1D,OAAO,CAAC,cAAc;IAgBhB,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoC1F,MAAM,CACV,EAAE,EAAE,OAAO,EACX,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,gBAAgB,GACzC,OAAO,CAAC,mBAAmB,CAAC;CA0BhC"}
+{"version":3,"file":"wallet-commands.service.d.ts","sourceRoot":"","sources":["../../../src/wallet/service/wallet-commands.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,cAAc,EAEnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EAGzB,MAAM,yBAAyB,CAAC;AA2BjC,eAAO,MAAM,wBAAwB;QAjCnB,CAAC;CAoClB,CAAC;AASF,eAAO,MAAM,uBAAuB;QA7ClB,CAAC;CAgDlB,CAAC;AAMF,qBAAa,qBAAsB,YAAW,cAAc;IAExD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAHT,eAAe,EAAE,mBAAmB,EACpC,KAAK,EAAE,cAAc,EACrB,cAAc,CAAC,EAAE,cAAc,YAAA,EAC/B,QAAQ,CAAC,EAAE,YAAY,YAAA;YAO5B,cAAc;YA+Cd,iBAAiB;IAWzB,KAAK,CACT,EAAE,EAAE,OAAO,EACX,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,eAAe,GAC/D,OAAO,CAAC,kBAAkB,CAAC;IAsExB,MAAM,CACV,EAAE,EAAE,OAAO,EACX,EACE,MAAM,EACN,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,EAAE,gBAAgB,GAClB,OAAO,CAAC,mBAAmB,CAAC;YAoDjB,mBAAmB;YAqBnB,yBAAyB;YAQzB,iBAAiB;YAoDjB,0BAA0B;CAoFzC"}

package/dist/wallet/service/wallet-commands.service.js

@@ -1,7 +1,8 @@
-import { createDomainError } from '@openora/core/server';
-import { and, eq, gte, sql } from 'drizzle-orm';
-import { wallet, walletTransaction } from '../schema/index.js';
-import { railFor } from './wallet.service.js';
+import { RgLimitExceededError, } from '@openora/core/contracts';
+import { createDomainError, makeConflictError, moneyToNumber, } from '@openora/core/server';
+import { and, asc, eq, sql } from 'drizzle-orm';
+import { wallet, walletTransaction, walletBonusCredit, walletBonusRolloverConfig, } from '../schema/index.js';
+import { creditWalletBalance, balanceKey, debitWithdrawableBalance, debitWalletBalance, providerRefCondition, railFor, readWalletBalance, } from './wallet.service.js';
 export const WalletCommandAmountError = createDomainError('WalletCommandAmountError', (operation, amount) => `wallet ${operation} amount must be positive (got ${amount})`);
 // Default in-process WALLET_COMMANDS implementation. Operates on the caller's
 // transaction handle, so a move commits or rolls back together with the caller's
@@ -10,67 +11,273 @@ export const WalletCommandAmountError = createDomainError('WalletCommandAmountEr
 // (status `completed`, internal settlement so no provider ref) so gameplay shows in
 // transaction history. The `balance >= amount` guard in the UPDATE makes concurrent
 // debits safe (a lost race updates zero rows and we report the shortfall).
+export const WalletRgRestrictedError = makeConflictError('WalletRgRestrictedError', 'wager is restricted by an active responsible-gambling exclusion');
+const DEFAULT_ROLLOVER_MULTIPLIER = '1';
 export class WalletCommandsService {
-    // Completed, internal-settlement ledger row (no provider ref) shared by every gameplay move.
-    writeLedgerRow(txn, row, type, amount) {
-        return txn.insert(walletTransaction).values({
+    playEligibility;
+    audit;
+    platformConfig;
+    rgLimits;
+    constructor(playEligibility, audit, platformConfig, rgLimits) {
+        this.playEligibility = playEligibility;
+        this.audit = audit;
+        this.platformConfig = platformConfig;
+        this.rgLimits = rgLimits;
+    }
+    // Completed ledger row shared by every gameplay move. `direction` is required (not
+    // optional) so a new call site can't compile without deciding it - `debit()` always
+    // passes 'debit', `credit()` always passes 'credit', including the gift/rain/tip legs
+    // that share one `type` for both sides of the transfer.
+    async writeLedgerRow(txn, row, type, amount, direction, providerRef) {
+        const insertQuery = txn.insert(walletTransaction).values({
             walletId: row.id,
             type,
             amount,
             currency: row.currency,
             status: 'completed',
-            rail: railFor(row.currency),
+            direction,
+            rail: railFor(row.currency, this.platformConfig?.wallet?.cryptoCurrencies),
+            providerName: providerRef?.providerName,
+            providerRefId: providerRef?.providerRefId,
+            externalRoundId: providerRef?.externalRoundId,
+            metadata: providerRef?.responseSnapshot !== undefined
+                ? JSON.stringify(providerRef.responseSnapshot)
+                : undefined,
         });
+        if (!providerRef) {
+            const [inserted] = await insertQuery.returning();
+            if (!inserted) {
+                throw new Error('wallet ledger row: insert returned no row');
+            }
+            return { row: inserted, replayed: false };
+        }
+        const [inserted] = await insertQuery.onConflictDoNothing().returning();
+        if (inserted) {
+            return { row: inserted, replayed: false };
+        }
+        const existing = await this.findByProviderRef(txn, providerRef);
+        if (!existing) {
+            throw new Error(`wallet ledger row: idempotency conflict but no row found (provider=${providerRef.providerName} ref=${providerRef.providerRefId})`);
+        }
+        return { row: existing, replayed: true };
+    }
+    async findByProviderRef(txn, providerRef) {
+        const [row] = await txn
+            .select()
+            .from(walletTransaction)
+            .where(providerRefCondition(providerRef.providerName, providerRef.providerRefId));
+        return row;
     }
-    async debit(tx, { userId, amount, type }) {
+    async debit(tx, { userId, amount, type, currency, providerRef }) {
         const txn = tx;
+        if (type === 'bet' && (await this.playEligibility.isRestricted(userId))) {
+            throw new WalletRgRestrictedError();
+        }
         // `loss` is informational (stake already left at bet time): 0-amount row, balance untouched. Every other debit is real money.
         if (type !== 'loss' && Number(amount) <= 0) {
             throw new WalletCommandAmountError('debit', amount);
         }
-        const [row] = await txn.select().from(wallet).where(eq(wallet.userId, userId));
+        const [row] = await txn.select().from(wallet).where(eq(wallet.userId, userId)).for('update');
         if (!row) {
             return { ok: false, available: '0' };
         }
-        const available = row.balance;
+        const debitCurrency = balanceKey(currency ?? row.currency);
+        const debitRow = { ...row, currency: debitCurrency };
+        const available = await readWalletBalance(txn, row.id, debitCurrency);
         if (type === 'loss') {
-            await this.writeLedgerRow(txn, row, 'loss', '0');
-            return { ok: true, newBalance: available };
+            await this.writeLedgerRow(txn, debitRow, 'loss', '0', 'debit', providerRef);
+            return { ok: true, newBalance: available, currency: debitCurrency };
+        }
+        // Must run before checkWager below - a replay must never re-evaluate the wager limit
+        // against spend it already committed.
+        if (providerRef && (await this.findByProviderRef(txn, providerRef))) {
+            return { ok: true, newBalance: available, currency: debitCurrency };
+        }
+        if (type === 'bet' && this.rgLimits) {
+            const decision = await this.rgLimits.checkWager(txn, userId, amount, currency ?? row.currency);
+            if (!decision.allowed) {
+                throw new RgLimitExceededError('wager_limit_exceeded', decision);
+            }
         }
         // The UPDATE ... RETURNING gives the new balance straight from Postgres numeric
         // arithmetic - no JS float math on either side of the debit.
-        const debited = await txn
-            .update(wallet)
-            .set({ balance: sql `${wallet.balance} - ${amount}::numeric` })
-            .where(and(eq(wallet.id, row.id), gte(wallet.balance, amount)))
-            .returning({ balance: wallet.balance });
-        const newBalance = debited[0]?.balance;
+        const debited = type === 'bet'
+            ? await debitWalletBalance(txn, row.id, debitCurrency, amount)
+            : await debitWithdrawableBalance(txn, row.id, debitCurrency, amount);
+        const newBalance = debited[0]?.amount;
         if (newBalance === undefined) {
             return { ok: false, available };
         }
-        await this.writeLedgerRow(txn, row, type, amount);
-        return { ok: true, newBalance };
+        await this.writeLedgerRow(txn, debitRow, type, amount, 'debit', providerRef);
+        if (type === 'bet') {
+            const completedBonusCredits = await this.applyBonusRolloverProgress(txn, {
+                userId,
+                currency: debitCurrency,
+                amount,
+            });
+            return { ok: true, newBalance, currency: debitCurrency, completedBonusCredits };
+        }
+        return { ok: true, newBalance, currency: debitCurrency };
     }
-    async credit(tx, { userId, amount, type }) {
+    async credit(tx, { userId, amount, currency, type, allowNewCurrency, allowNewWallet, providerRef, }) {
         const txn = tx;
         if (Number(amount) <= 0) {
             throw new WalletCommandAmountError('credit', amount);
         }
-        const [row] = await txn.select().from(wallet).where(eq(wallet.userId, userId));
-        // Fail closed: a credit never creates a wallet - a missing one is a caller bug.
+        const row = allowNewWallet
+            ? await this.resolveOrOpenWallet(txn, userId, currency)
+            : (await txn.select().from(wallet).where(eq(wallet.userId, userId)))[0];
         if (!row) {
             return { ok: false, reason: 'wallet not found' };
         }
-        const [credited] = await txn
-            .update(wallet)
-            .set({ balance: sql `${wallet.balance} + ${amount}::numeric` })
-            .where(eq(wallet.id, row.id))
-            .returning({ balance: wallet.balance });
+        if (!allowNewCurrency && balanceKey(row.currency) !== balanceKey(currency)) {
+            return { ok: false, reason: 'currency mismatch' };
+        }
+        const creditRow = { ...row, currency: balanceKey(currency) };
+        // Unlike debit(), credit() takes no row lock, so the ledger row is inserted (and its
+        // conflict resolved) before the balance mutation rather than after.
+        const { replayed } = await this.writeLedgerRow(txn, creditRow, type, amount, 'credit', providerRef);
+        if (replayed) {
+            const currentBalance = await readWalletBalance(txn, row.id, balanceKey(currency));
+            return { ok: true, newBalance: currentBalance };
+        }
+        const [credited] = await creditWalletBalance(txn, row.id, currency, amount);
         if (!credited) {
             throw new Error('wallet credit: no row');
         }
-        await this.writeLedgerRow(txn, row, type, amount);
-        return { ok: true, newBalance: credited.balance };
+        if (type === 'gift' || type === 'rain') {
+            await this.createBonusCredit(txn, {
+                walletId: row.id,
+                userId,
+                currency,
+                amount,
+                sourceType: type,
+            });
+        }
+        return { ok: true, newBalance: credited.amount };
+    }
+    async resolveOrOpenWallet(txn, userId, currency) {
+        const [existing] = await txn.select().from(wallet).where(eq(wallet.userId, userId));
+        if (existing) {
+            return existing;
+        }
+        const [created] = await txn
+            .insert(wallet)
+            .values({ userId, currency: balanceKey(currency) })
+            .onConflictDoNothing()
+            .returning();
+        if (created) {
+            return created;
+        }
+        const [raced] = await txn.select().from(wallet).where(eq(wallet.userId, userId));
+        return raced;
+    }
+    async resolveRolloverMultiplier(txn) {
+        const [row] = await txn
+            .select({ multiplier: walletBonusRolloverConfig.multiplier })
+            .from(walletBonusRolloverConfig)
+            .where(eq(walletBonusRolloverConfig.singletonKey, 'global'));
+        return row?.multiplier ?? DEFAULT_ROLLOVER_MULTIPLIER;
+    }
+    async createBonusCredit(txn, { walletId, userId, currency, amount, sourceType, }) {
+        const multiplier = await this.resolveRolloverMultiplier(txn);
+        const [creditRow] = await txn
+            .insert(walletBonusCredit)
+            .values({
+            walletId,
+            userId,
+            currency: balanceKey(currency),
+            sourceType,
+            creditedAmount: amount,
+            rolloverMultiplier: multiplier,
+            rolloverRequired: sql `(${amount}::numeric * ${multiplier}::numeric)`,
+            rolloverProgress: '0',
+            status: 'active',
+        })
+            .returning();
+        if (!creditRow) {
+            throw new Error('wallet bonus credit: no row');
+        }
+        await this.audit.recordInTransaction(txn, {
+            actorType: 'system',
+            action: 'wallet.bonus_credit.created',
+            resourceType: 'wallet_bonus_credit',
+            resourceId: creditRow.id,
+            after: {
+                userId,
+                currency: balanceKey(currency),
+                sourceType,
+                creditedAmount: amount,
+                rolloverMultiplier: multiplier,
+                rolloverRequired: creditRow.rolloverRequired,
+            },
+        });
+    }
+    async applyBonusRolloverProgress(txn, { userId, currency, amount }) {
+        const activeCredits = await txn
+            .select({ id: walletBonusCredit.id })
+            .from(walletBonusCredit)
+            .where(and(eq(walletBonusCredit.userId, userId), eq(walletBonusCredit.currency, balanceKey(currency)), eq(walletBonusCredit.status, 'active')))
+            .orderBy(asc(walletBonusCredit.createdAt), asc(walletBonusCredit.id));
+        const completed = [];
+        let remaining = amount;
+        for (const credit of activeCredits) {
+            if (moneyToNumber(remaining) <= 0) {
+                break;
+            }
+            const [locked] = await txn
+                .select({ rolloverProgress: walletBonusCredit.rolloverProgress })
+                .from(walletBonusCredit)
+                .where(and(eq(walletBonusCredit.id, credit.id), eq(walletBonusCredit.status, 'active')))
+                .for('update');
+            if (!locked) {
+                continue;
+            }
+            const [updated] = await txn
+                .update(walletBonusCredit)
+                .set({
+                rolloverProgress: sql `LEAST(${walletBonusCredit.rolloverRequired}, ${walletBonusCredit.rolloverProgress} + ${remaining}::numeric)`,
+                status: sql `(CASE WHEN ${walletBonusCredit.rolloverProgress} + ${remaining}::numeric >= ${walletBonusCredit.rolloverRequired} THEN 'completed' ELSE 'active' END)::wallet_bonus_credit_status`,
+                completedAt: sql `CASE WHEN ${walletBonusCredit.rolloverProgress} + ${remaining}::numeric >= ${walletBonusCredit.rolloverRequired} THEN now() ELSE ${walletBonusCredit.completedAt} END`,
+            })
+                .where(and(eq(walletBonusCredit.id, credit.id), eq(walletBonusCredit.status, 'active')))
+                .returning({
+                id: walletBonusCredit.id,
+                status: walletBonusCredit.status,
+                currency: walletBonusCredit.currency,
+                creditedAmount: walletBonusCredit.creditedAmount,
+                rolloverRequired: walletBonusCredit.rolloverRequired,
+                rolloverProgress: walletBonusCredit.rolloverProgress,
+                remainingAfter: sql `(${remaining}::numeric - (${walletBonusCredit.rolloverProgress} - ${locked.rolloverProgress}::numeric))::text`,
+            });
+            if (!updated) {
+                continue;
+            }
+            remaining = updated.remainingAfter;
+            if (updated.status === 'completed') {
+                completed.push({
+                    id: updated.id,
+                    currency: updated.currency,
+                    creditedAmount: updated.creditedAmount,
+                });
+                await this.audit.recordInTransaction(txn, {
+                    actorType: 'system',
+                    action: 'wallet.bonus_credit.completed',
+                    resourceType: 'wallet_bonus_credit',
+                    resourceId: updated.id,
+                    before: { status: 'active', rolloverProgress: locked.rolloverProgress },
+                    after: {
+                        userId,
+                        currency: updated.currency,
+                        creditedAmount: updated.creditedAmount,
+                        rolloverRequired: updated.rolloverRequired,
+                        rolloverProgress: updated.rolloverProgress,
+                        status: updated.status,
+                    },
+                });
+            }
+        }
+        return completed;
     }
 }
 //# sourceMappingURL=wallet-commands.service.js.map