@openora/core 0.4.1-canary.17 → 0.4.1-canary.170

package/dist/contracts/__tests__/identity.test.js

@@ -0,0 +1,54 @@
+import { describe, it, expect } from 'vitest';
+import { ChangePasswordInputSchema, LoginInputSchema, PasswordSchema, RegisterInputSchema, ResetPasswordInputSchema, } from '../schemas/identity.js';
+const OVER_LENGTH = 'a'.repeat(129);
+const registerInput = (password) => ({
+    email: 'player@example.com',
+    password,
+    username: 'new_player',
+    acceptedTerms: true,
+    acceptedAge: true,
+});
+describe('password rules', () => {
+    it('enforces the 12-character platform password policy on PasswordSchema', () => {
+        expect(PasswordSchema.safeParse('a'.repeat(11)).success).toBe(false);
+        expect(PasswordSchema.safeParse('a'.repeat(12)).success).toBe(true);
+    });
+    it('holds sign-up to the same bounds as the password reset flow', () => {
+        expect(RegisterInputSchema.safeParse(registerInput('short')).success).toBe(false);
+        expect(RegisterInputSchema.safeParse(registerInput('password123')).success).toBe(false);
+        expect(RegisterInputSchema.safeParse(registerInput('password1234')).success).toBe(true);
+    });
+    // better-auth caps at 128 itself, but only after the fact: on sign-up that surfaces as
+    // a generic "Registration is unavailable", and on reset it burns the one-time code
+    // first. Both must be rejected at the contract instead.
+    it.each([
+        ['register', () => RegisterInputSchema.safeParse(registerInput(OVER_LENGTH))],
+        [
+            'reset',
+            () => ResetPasswordInputSchema.safeParse({
+                email: 'player@example.com',
+                otp: '123456',
+                newPassword: OVER_LENGTH,
+            }),
+        ],
+        [
+            'change',
+            () => ChangePasswordInputSchema.safeParse({
+                currentPassword: 'password1234',
+                newPassword: OVER_LENGTH,
+            }),
+        ],
+    ])('rejects a password over 128 characters on %s', (_name, parse) => {
+        expect(parse().success).toBe(false);
+    });
+    // Sign-in is deliberately left uncapped: no longer password was ever storable, so a
+    // bound there could only narrow an existing contract for nothing.
+    it('does not cap the password on sign-in', () => {
+        const result = LoginInputSchema.safeParse({
+            email: 'player@example.com',
+            password: OVER_LENGTH,
+        });
+        expect(result.success).toBe(true);
+    });
+});
+//# sourceMappingURL=identity.test.js.map

package/dist/contracts/__tests__/identity.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.test.js","sourceRoot":"","sources":["../../../src/contracts/__tests__/identity.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAEpC,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,CAAC;IAC3C,KAAK,EAAE,oBAAoB;IAC3B,QAAQ;IACR,QAAQ,EAAE,YAAY;IACtB,aAAa,EAAE,IAAa;IAC5B,WAAW,EAAE,IAAa;CAC3B,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxF,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,uFAAuF;IACvF,mFAAmF;IACnF,wDAAwD;IACxD,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;QAC7E;YACE,OAAO;YACP,GAAG,EAAE,CACH,wBAAwB,CAAC,SAAS,CAAC;gBACjC,KAAK,EAAE,oBAAoB;gBAC3B,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,WAAW;aACzB,CAAC;SACL;QACD;YACE,QAAQ;YACR,GAAG,EAAE,CACH,yBAAyB,CAAC,SAAS,CAAC;gBAClC,eAAe,EAAE,cAAc;gBAC/B,WAAW,EAAE,WAAW;aACzB,CAAC;SACL;KACF,CAAC,CAAC,8CAA8C,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAClE,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,oFAAoF;IACpF,kEAAkE;IAClE,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC;YACxC,KAAK,EAAE,oBAAoB;YAC3B,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/contracts/__tests__/kit.test.js

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest';
 import { z } from 'zod';
-import { PageQuerySchema, paginated } from '../kit.js';
+import { PageQuerySchema, QueryBooleanSchema, createKebabSlugSchema, paginated } from '../kit.js';
 describe('PageQuerySchema', () => {
     it('defaults to page 1 / limit 100 when omitted', () => {
         expect(PageQuerySchema.parse({})).toEqual({ page: 1, limit: 100 });
@@ -24,4 +24,24 @@ describe('paginated', () => {
         expect(schema.safeParse({ items: [], total: 1.5, page: 1, limit: 100 }).success).toBe(false);
     });
 });
+describe('QueryBooleanSchema', () => {
+    it("coerces 'true'/'false' query strings to booleans", () => {
+        expect(QueryBooleanSchema.parse('true')).toBe(true);
+        expect(QueryBooleanSchema.parse('false')).toBe(false);
+        expect(QueryBooleanSchema.parse(true)).toBe(true);
+    });
+});
+describe('createKebabSlugSchema', () => {
+    it('accepts kebab-case and rejects leading/trailing hyphens', () => {
+        const schema = createKebabSlugSchema(64);
+        expect(schema.parse('pragmatic-play')).toBe('pragmatic-play');
+        expect(schema.safeParse('-bad').success).toBe(false);
+        expect(schema.safeParse('bad-').success).toBe(false);
+        expect(schema.safeParse('Bad_Slug').success).toBe(false);
+    });
+    it('enforces the max length', () => {
+        const schema = createKebabSlugSchema(4);
+        expect(schema.safeParse('abcde').success).toBe(false);
+    });
+});
 //# sourceMappingURL=kit.test.js.map

package/dist/contracts/__tests__/kit.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"kit.test.js","sourceRoot":"","sources":["../../../src/contracts/__tests__/kit.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACtE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"kit.test.js","sourceRoot":"","sources":["../../../src/contracts/__tests__/kit.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAElG,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACtE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9D,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/contracts/__tests__/player.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=player.test.d.ts.map

package/dist/contracts/__tests__/player.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"player.test.d.ts","sourceRoot":"","sources":["../../../src/contracts/__tests__/player.test.ts"],"names":[],"mappings":""}

package/dist/contracts/__tests__/player.test.js

@@ -0,0 +1,51 @@
+import { describe, it, expect } from 'vitest';
+import { MIN_PLAYER_AGE_YEARS, UpdatePlayerProfileInputSchema, isAdultDateOfBirth, } from '../schemas/player.js';
+const NOW = new Date('2026-08-24T00:00:00Z');
+function isoBirthday(yearsAgo, offsetDays = 0) {
+    const d = new Date(NOW);
+    d.setUTCFullYear(d.getUTCFullYear() - yearsAgo);
+    d.setUTCDate(d.getUTCDate() + offsetDays);
+    return d.toISOString().slice(0, 10);
+}
+describe('isAdultDateOfBirth', () => {
+    it('passes a player on their own 18th birthday', () => {
+        expect(isAdultDateOfBirth(isoBirthday(MIN_PLAYER_AGE_YEARS), NOW)).toBe(true);
+    });
+    it('rejects a player one day short of 18', () => {
+        expect(isAdultDateOfBirth(isoBirthday(MIN_PLAYER_AGE_YEARS, 1), NOW)).toBe(false);
+    });
+    it('rejects a date in the future', () => {
+        expect(isAdultDateOfBirth('2030-01-01', NOW)).toBe(false);
+    });
+});
+describe('UpdatePlayerProfileInputSchema', () => {
+    it('accepts the full profile the signup step collects', () => {
+        const input = {
+            firstName: 'Ada',
+            lastName: 'Lovelace',
+            dateOfBirth: '1990-05-17',
+            phone: '+441632960001',
+            country: 'GB',
+        };
+        expect(UpdatePlayerProfileInputSchema.parse(input)).toEqual(input);
+    });
+    it('accepts null to clear an optional field', () => {
+        expect(UpdatePlayerProfileInputSchema.safeParse({ phone: null }).success).toBe(true);
+    });
+    // Without this the handler reaches `db.update().set({})`, which drizzle rejects at
+    // runtime - a 500 on a form where the player simply changed nothing.
+    it('rejects an update that carries no fields', () => {
+        expect(UpdatePlayerProfileInputSchema.safeParse({}).success).toBe(false);
+    });
+    it('rejects a country display name instead of an ISO 3166-1 alpha-2 code', () => {
+        expect(UpdatePlayerProfileInputSchema.safeParse({ country: 'United Kingdom' }).success).toBe(false);
+    });
+    it('rejects a phone number that is not E.164', () => {
+        expect(UpdatePlayerProfileInputSchema.safeParse({ phone: '+44 1632 960001' }).success).toBe(false);
+    });
+    it('rejects a date of birth under the minimum age', () => {
+        const result = UpdatePlayerProfileInputSchema.safeParse({ dateOfBirth: '2020-01-01' });
+        expect(result.success).toBe(false);
+    });
+});
+//# sourceMappingURL=player.test.js.map

package/dist/contracts/__tests__/player.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"player.test.js","sourceRoot":"","sources":["../../../src/contracts/__tests__/player.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAE7C,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAU,GAAG,CAAC;IACnD,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,UAAU,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,kBAAkB,CAAC,WAAW,CAAC,oBAAoB,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,kBAAkB,CAAC,WAAW,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,kBAAkB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG;YACZ,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,UAAU;YACpB,WAAW,EAAE,YAAY;YACzB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,IAAI;SACd,CAAC;QAEF,MAAM,CAAC,8BAA8B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,8BAA8B,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,mFAAmF;IACnF,qEAAqE;IACrE,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,8BAA8B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,8BAA8B,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAC1F,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,8BAA8B,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CACzF,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QAEvF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/contracts/adapters/__tests__/geo-ip.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=geo-ip.test.d.ts.map

package/dist/contracts/adapters/__tests__/geo-ip.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"geo-ip.test.d.ts","sourceRoot":"","sources":["../../../../src/contracts/adapters/__tests__/geo-ip.test.ts"],"names":[],"mappings":""}

package/dist/contracts/adapters/__tests__/geo-ip.test.js

@@ -0,0 +1,13 @@
+import { describe, expect, it } from 'vitest';
+import { normalizeCountryCode } from '../geo-ip.js';
+describe('normalizeCountryCode', () => {
+    it('trims and uppercases valid country codes', () => {
+        expect(normalizeCountryCode(' us ')).toBe('US');
+    });
+    it('returns null for invalid adapter values', () => {
+        expect(normalizeCountryCode('USA')).toBeNull();
+        expect(normalizeCountryCode(null)).toBeNull();
+        expect(normalizeCountryCode(42)).toBeNull();
+    });
+});
+//# sourceMappingURL=geo-ip.test.js.map

package/dist/contracts/adapters/__tests__/geo-ip.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"geo-ip.test.js","sourceRoot":"","sources":["../../../../src/contracts/adapters/__tests__/geo-ip.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/contracts/adapters/__tests__/lobby-section-catalog.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=lobby-section-catalog.test.d.ts.map

package/dist/contracts/adapters/__tests__/lobby-section-catalog.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lobby-section-catalog.test.d.ts","sourceRoot":"","sources":["../../../../src/contracts/adapters/__tests__/lobby-section-catalog.test.ts"],"names":[],"mappings":""}

package/dist/contracts/adapters/__tests__/lobby-section-catalog.test.js

@@ -0,0 +1,25 @@
+import { describe, expect, it } from 'vitest';
+import * as z from 'zod';
+import { createLobbySectionCatalog, defineLobbySection } from '../lobby-section-catalog.js';
+const definition = defineLobbySection({
+    type: 'promotion-carousel',
+    configSchema: z.object({ campaignIds: z.array(z.string()) }).strict(),
+    async resolve(sections) {
+        return new Map(sections.map((section) => [section.id, { campaigns: section.config.campaignIds }]));
+    },
+});
+describe('lobby section catalog', () => {
+    it('preserves typed definition config behind the generic catalog port', async () => {
+        const catalog = createLobbySectionCatalog([definition]);
+        const registered = catalog.get('promotion-carousel');
+        if (!registered) {
+            throw new Error('definition was not registered');
+        }
+        const config = registered.parseConfig({ campaignIds: ['one'] });
+        expect(await registered.resolve([{ id: 'section', config }])).toEqual(new Map([['section', { campaigns: ['one'] }]]));
+    });
+    it('rejects duplicate section type registrations', () => {
+        expect(() => createLobbySectionCatalog([definition, definition])).toThrow('Duplicate lobby section definition');
+    });
+});
+//# sourceMappingURL=lobby-section-catalog.test.js.map

package/dist/contracts/adapters/__tests__/lobby-section-catalog.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lobby-section-catalog.test.js","sourceRoot":"","sources":["../../../../src/contracts/adapters/__tests__/lobby-section-catalog.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAE5F,MAAM,UAAU,GAAG,kBAAkB,CAAC;IACpC,IAAI,EAAE,oBAAoB;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACrE,KAAK,CAAC,OAAO,CAAC,QAAQ;QACpB,OAAO,IAAI,GAAG,CACZ,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CACnF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,OAAO,GAAG,yBAAyB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CACnE,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CACvE,oCAAoC,CACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/contracts/adapters/__tests__/rate-limit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=rate-limit.test.d.ts.map

package/dist/contracts/adapters/__tests__/rate-limit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.test.d.ts","sourceRoot":"","sources":["../../../../src/contracts/adapters/__tests__/rate-limit.test.ts"],"names":[],"mappings":""}

package/dist/contracts/adapters/__tests__/rate-limit.test.js

@@ -0,0 +1,13 @@
+import { describe, it, expect } from 'vitest';
+import { RATE_LIMIT_KEYS, makeRateLimitKey } from '../rate-limit.js';
+describe('makeRateLimitKey', () => {
+    it('joins a registered prefix with the id', () => {
+        expect(makeRateLimitKey(RATE_LIMIT_KEYS.PASSWORD_RESET, 'a@b.dev')).toBe('pwreset:a@b.dev');
+        expect(makeRateLimitKey(RATE_LIMIT_KEYS.PASSWORD_RESET_VERIFY, 'a@b.dev')).toBe('pwreset-verify:a@b.dev');
+        expect(makeRateLimitKey(RATE_LIMIT_KEYS.LOGIN, 'u1')).toBe('login:u1');
+    });
+    it('does not normalize the id (callers own normalization)', () => {
+        expect(makeRateLimitKey(RATE_LIMIT_KEYS.PASSWORD_RESET_REQUEST, 'A@B.DEV')).toBe('pwreset-req:A@B.DEV');
+    });
+});
+//# sourceMappingURL=rate-limit.test.js.map

package/dist/contracts/adapters/__tests__/rate-limit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.test.js","sourceRoot":"","sources":["../../../../src/contracts/adapters/__tests__/rate-limit.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAErE,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC5F,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAC7E,wBAAwB,CACzB,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAC9E,qBAAqB,CACtB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/contracts/adapters/__tests__/token.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=token.test.d.ts.map

package/dist/contracts/adapters/__tests__/token.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.test.d.ts","sourceRoot":"","sources":["../../../../src/contracts/adapters/__tests__/token.test.ts"],"names":[],"mappings":""}

package/dist/contracts/adapters/__tests__/token.test.js

@@ -0,0 +1,14 @@
+import { describe, it, expect } from 'vitest';
+import { createToken, createSealedToken, createClientPageToken } from '../token.js';
+describe('token descriptions', () => {
+    it('leaves a plain token description as given - it is what an unbound-port error prints', () => {
+        expect(createToken('PAYMENT_ADAPTER').description).toBe('PAYMENT_ADAPTER');
+    });
+    it('prefixes a sealed token so a regulator-mandated binding is obvious in a trace', () => {
+        expect(createSealedToken('ledger-writer').description).toBe('sealed:ledger-writer');
+    });
+    it('prefixes a client page token to mark it as a Tier 3 page override', () => {
+        expect(createClientPageToken('admin-users').description).toBe('page:admin-users');
+    });
+});
+//# sourceMappingURL=token.test.js.map

package/dist/contracts/adapters/__tests__/token.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.test.js","sourceRoot":"","sources":["../../../../src/contracts/adapters/__tests__/token.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/contracts/adapters/admin-game-reporting.d.ts

@@ -0,0 +1,43 @@
+import { type Token } from './token.js';
+import type { GameType } from '../schemas/game.js';
+/**
+ * Admin/back-office reporting over game performance. Owned + bound by the
+ * casino/gaming module (it owns the `game`/`gameRound` tables); the back-office
+ * depends only on this port, never on the gaming schema. A query port like
+ * ADMIN_WALLET_REPORTING. See ADR-0017/0025.
+ */
+export declare const GAME_PERFORMANCE_SORT_FIELDS: readonly ["name", "gameType", "volume", "revenue", "uniquePlayers", "roundsPlayed"];
+export type GamePerformanceSortBy = (typeof GAME_PERFORMANCE_SORT_FIELDS)[number];
+export type GamePerformanceFilter = {
+    dateFrom?: Date;
+    dateTo?: Date;
+    gameType?: GameType;
+    currency?: string;
+    sortBy?: GamePerformanceSortBy;
+    sortDir?: 'asc' | 'desc';
+};
+/**
+ * volume/revenue = SUM(gameRound.betAmount) / SUM(betAmount) - SUM(winAmount) over
+ * status='completed' rounds in range; revenue (GGR) can be negative. uniquePlayers/
+ * roundsPlayed are 0 for a game with no completed rounds in range - games are never
+ * omitted just because they had no activity in the requested window.
+ */
+export type GamePerformanceRow = {
+    gameId: string;
+    name: string;
+    gameType: GameType;
+    volume: string;
+    revenue: string;
+    uniquePlayers: number;
+    roundsPlayed: number;
+};
+export type PlayerGameStats = {
+    totalWagered: string;
+    totalBets: number;
+};
+export type AdminGameReporting = {
+    listGamePerformance(filter: GamePerformanceFilter): Promise<GamePerformanceRow[]>;
+    getPlayerStats(userId: string): Promise<PlayerGameStats>;
+};
+export declare const ADMIN_GAME_REPORTING: Token<AdminGameReporting>;
+//# sourceMappingURL=admin-game-reporting.d.ts.map

package/dist/contracts/adapters/admin-game-reporting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-game-reporting.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-game-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;;GAKG;AAEH,eAAO,MAAM,4BAA4B,qFAO/B,CAAC;AACX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AAElF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAClF,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1D,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAuC,CAAC"}

package/dist/contracts/adapters/admin-game-reporting.js

@@ -0,0 +1,17 @@
+import { createToken } from './token.js';
+/**
+ * Admin/back-office reporting over game performance. Owned + bound by the
+ * casino/gaming module (it owns the `game`/`gameRound` tables); the back-office
+ * depends only on this port, never on the gaming schema. A query port like
+ * ADMIN_WALLET_REPORTING. See ADR-0017/0025.
+ */
+export const GAME_PERFORMANCE_SORT_FIELDS = [
+    'name',
+    'gameType',
+    'volume',
+    'revenue',
+    'uniquePlayers',
+    'roundsPlayed',
+];
+export const ADMIN_GAME_REPORTING = createToken('ADMIN_GAME_REPORTING');
+//# sourceMappingURL=admin-game-reporting.js.map

package/dist/contracts/adapters/admin-game-reporting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-game-reporting.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-game-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAGrD;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,MAAM;IACN,UAAU;IACV,QAAQ;IACR,SAAS;IACT,eAAe;IACf,cAAc;CACN,CAAC;AAsCX,MAAM,CAAC,MAAM,oBAAoB,GAA8B,WAAW,CAAC,sBAAsB,CAAC,CAAC"}

package/dist/contracts/adapters/admin-permission.d.ts

@@ -1,10 +1,21 @@
+/**
+ * Port for DB-backed admin RBAC. A backoffice iam module binds a concrete
+ * resolver that reads role assignments + grants from its own tables; the
+ * AdminGuard (in @openora/core/server) depends only on this interface so the platform
+ * keeps working - falling back to the static roles - when no resolver is bound.
+ */
 import { type Token } from './token.js';
 export type AdminGrant = {
     resource: string;
     action: string;
 };
 export type AdminPermissionResolver = {
+    /**
+     * Returns the effective grants for an admin user, or null if the user has no
+     * DB-backed role assignment (caller should fall back to static roles).
+     */
     getGrants(userId: string): Promise<AdminGrant[] | null>;
+    isSuperAdmin(userId: string): Promise<boolean | null>;
 };
 export declare const ADMIN_PERMISSION_RESOLVER: Token<AdminPermissionResolver>;
 //# sourceMappingURL=admin-permission.d.ts.map

package/dist/contracts/adapters/admin-permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-permission.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-permission.ts"],"names":[],"mappings":"AAIA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,uBAAuB,GAAG;IAGpC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,uBAAuB,CAEpE,CAAC"}
+{"version":3,"file":"admin-permission.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-permission.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;OAGG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;IACxD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;CACvD,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,uBAAuB,CAEpE,CAAC"}

package/dist/contracts/adapters/admin-permission.js

@@ -1,7 +1,9 @@
-// Port for DB-backed admin RBAC. A backoffice iam module binds a concrete
-// resolver that reads role assignments + grants from its own tables; the
-// AdminGuard (in @openora/core/server) depends only on this interface so the platform
-// keeps working - falling back to the static roles - when no resolver is bound.
+/**
+ * Port for DB-backed admin RBAC. A backoffice iam module binds a concrete
+ * resolver that reads role assignments + grants from its own tables; the
+ * AdminGuard (in @openora/core/server) depends only on this interface so the platform
+ * keeps working - falling back to the static roles - when no resolver is bound.
+ */
 import { createToken } from './token.js';
 export const ADMIN_PERMISSION_RESOLVER = createToken('ADMIN_PERMISSION_RESOLVER');
 //# sourceMappingURL=admin-permission.js.map

package/dist/contracts/adapters/admin-permission.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-permission.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-permission.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,yEAAyE;AACzE,sFAAsF;AACtF,gFAAgF;AAChF,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAUrD,MAAM,CAAC,MAAM,yBAAyB,GAAmC,WAAW,CAClF,2BAA2B,CAC5B,CAAC"}
+{"version":3,"file":"admin-permission.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-permission.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAarD,MAAM,CAAC,MAAM,yBAAyB,GAAmC,WAAW,CAClF,2BAA2B,CAC5B,CAAC"}

package/dist/contracts/adapters/admin-player-activity.d.ts

@@ -0,0 +1,51 @@
+import { type Token } from './token.js';
+/**
+ * Admin/back-office reporting over player registration + engagement activity.
+ * Owned + bound by iam; it centralizes admin reporting concerns even though the
+ * underlying `user`/`session` tables belong to identity,
+ * read via that module's read-only /schema subpath); the back-office depends only
+ * on this port. A query port like ADMIN_WALLET_REPORTING/ADMIN_GAME_REPORTING.
+ * See ADR-0017/0025.
+ */
+export type PlayerActivityFilter = {
+    dateFrom?: Date;
+    dateTo?: Date;
+};
+/** One point per day (UTC, `YYYY-MM-DD`) within the requested range. */
+export type RegistrationsOverTimePoint = {
+    date: string;
+    registrations: number;
+};
+/** DAU/WAU/MAU for the trailing 1/7/30-day window ending on `date` (inclusive). */
+export type ActiveUsersTrendPoint = {
+    date: string;
+    dau: number;
+    wau: number;
+    mau: number;
+};
+/**
+ * One row per registration-day cohort (UTC day `user.createdAt` truncates to).
+ * `returnRate` = returned / cohortSize (0 when cohortSize is 0). `isComplete` is
+ * false while the cohort's [registration, registration + windowDays] window has
+ * not fully elapsed yet - such a row's low/zero rate is not yet meaningful and
+ * must be flagged rather than read as real churn.
+ */
+export type RetentionCohortRow = {
+    cohortDate: string;
+    cohortSize: number;
+    returned: number;
+    returnRate: number;
+    isComplete: boolean;
+};
+export type AdminPlayerActivity = {
+    getRegistrationsOverTime(filter: PlayerActivityFilter): Promise<RegistrationsOverTimePoint[]>;
+    getActiveUsersTrend(filter: PlayerActivityFilter): Promise<ActiveUsersTrendPoint[]>;
+    /**
+     * windowDays is always 7 or 30 (the two cohorts the ticket asks for); a plain
+     * number keeps the port from hard-coding a union it would need to duplicate again
+     * the moment a third window is added.
+     */
+    getRetentionCohorts(filter: PlayerActivityFilter, windowDays: 7 | 30): Promise<RetentionCohortRow[]>;
+};
+export declare const ADMIN_PLAYER_ACTIVITY: Token<AdminPlayerActivity>;
+//# sourceMappingURL=admin-player-activity.d.ts.map

package/dist/contracts/adapters/admin-player-activity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-player-activity.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-player-activity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;GAOG;AAEH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,MAAM,CAAC,EAAE,IAAI,CAAC;CACf,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,mFAAmF;AACnF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC;IAC9F,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACpF;;;;OAIG;IACH,mBAAmB,CACjB,MAAM,EAAE,oBAAoB,EAC5B,UAAU,EAAE,CAAC,GAAG,EAAE,GACjB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;CAClC,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,mBAAmB,CACvB,CAAC"}

package/dist/contracts/adapters/admin-player-activity.js

@@ -0,0 +1,3 @@
+import { createToken } from './token.js';
+export const ADMIN_PLAYER_ACTIVITY = createToken('ADMIN_PLAYER_ACTIVITY');
+//# sourceMappingURL=admin-player-activity.js.map

package/dist/contracts/adapters/admin-player-activity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-player-activity.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-player-activity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AA2DrD,MAAM,CAAC,MAAM,qBAAqB,GAChC,WAAW,CAAC,uBAAuB,CAAC,CAAC"}

package/dist/contracts/adapters/admin-role-assignment-directory.d.ts

@@ -0,0 +1,12 @@
+import { type Token } from './token.js';
+export type AdminRoleAssignmentSummary = {
+    userId: string;
+    roleId: string;
+    roleName: string;
+};
+export type AdminRoleAssignmentDirectory = {
+    /** Batch lookup; unknown/unassigned userIds are simply absent from the result. */
+    listByUserIds(userIds: readonly string[]): Promise<AdminRoleAssignmentSummary[]>;
+};
+export declare const ADMIN_ROLE_ASSIGNMENT_DIRECTORY: Token<AdminRoleAssignmentDirectory>;
+//# sourceMappingURL=admin-role-assignment-directory.d.ts.map

package/dist/contracts/adapters/admin-role-assignment-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-role-assignment-directory.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-role-assignment-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,kFAAkF;IAClF,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC;CAClF,CAAC;AAEF,eAAO,MAAM,+BAA+B,EAAE,KAAK,CAAC,4BAA4B,CAE/E,CAAC"}

package/dist/contracts/adapters/admin-role-assignment-directory.js

@@ -0,0 +1,3 @@
+import { createToken } from './token.js';
+export const ADMIN_ROLE_ASSIGNMENT_DIRECTORY = createToken('ADMIN_ROLE_ASSIGNMENT_DIRECTORY');
+//# sourceMappingURL=admin-role-assignment-directory.js.map

package/dist/contracts/adapters/admin-role-assignment-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-role-assignment-directory.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-role-assignment-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAarD,MAAM,CAAC,MAAM,+BAA+B,GAAwC,WAAW,CAC7F,iCAAiC,CAClC,CAAC"}

package/dist/contracts/adapters/admin-security.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Admin session-security seam. `AdminGuard` lives in the engine zone and may not
+ * import PAM tables (ADR-0019/0025), so the enrolment + fingerprint checks it runs
+ * on every admin request are resolved through this port. The identity module binds
+ * the implementation; when the module is absent the guard skips the checks.
+ */
+import { type Token } from './token.js';
+export type AdminSessionContext = {
+    userId: string;
+    sessionId: string | null;
+    ip: string | null;
+    userAgent: string | null;
+};
+export type AdminSecurityPolicy = {
+    /**
+     * Throws when the caller has no second factor configured, so a Backoffice
+     * account cannot reach any admin route before completing enrolment.
+     */
+    assertEnrolled(context: AdminSessionContext): Promise<void>;
+    /**
+     * Throws when the caller's session no longer matches the device it was issued
+     * to. Revokes the session before throwing, so the next request re-authenticates.
+     */
+    assertSessionIntact(context: AdminSessionContext): Promise<void>;
+};
+export declare const ADMIN_SECURITY_POLICY: Token<AdminSecurityPolicy>;
+//# sourceMappingURL=admin-security.d.ts.map

package/dist/contracts/adapters/admin-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-security.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-security.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,MAAM,CAAC;IAGf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;OAGG;IACH,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D;;;OAGG;IACH,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,mBAAmB,CACF,CAAC"}

package/dist/contracts/adapters/admin-security.js

@@ -0,0 +1,9 @@
+/**
+ * Admin session-security seam. `AdminGuard` lives in the engine zone and may not
+ * import PAM tables (ADR-0019/0025), so the enrolment + fingerprint checks it runs
+ * on every admin request are resolved through this port. The identity module binds
+ * the implementation; when the module is absent the guard skips the checks.
+ */
+import { createToken } from './token.js';
+export const ADMIN_SECURITY_POLICY = createToken('ADMIN_SECURITY_POLICY');
+//# sourceMappingURL=admin-security.js.map

package/dist/contracts/adapters/admin-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-security.js","sourceRoot":"","sources":["../../../src/contracts/adapters/admin-security.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAwBrD,MAAM,CAAC,MAAM,qBAAqB,GAChC,WAAW,CAAsB,uBAAuB,CAAC,CAAC"}