@openora/core 0.4.1-canary.18 → 0.4.1-canary.180

package/dist/audit/plugin.js

@@ -1,12 +1,12 @@
-import { definePlugin, EVENT_BUS, DRIZZLE, ADMIN_GUARD, createLogger } from '@openora/core/server';
-import { AUDIT_WRITER } from '@openora/core/contracts';
+import { EVENT_BUS, DRIZZLE, ADMIN_GUARD, createLogger } from '@openora/core/server';
+import { AUDIT_WRITER, IDENTITY_READER } from '@openora/core/contracts';
 import { AuditService } from './service/audit.service.js';
 import { createAuditRouter } from './router/index.js';
 const str = (v) => (typeof v === 'string' ? v : null);
 function isRecord(v) {
     return typeof v === 'object' && v !== null;
 }
-function mapEventToRecord(topic, p) {
+export async function mapEventToRecord(topic, p) {
     const result = /\.(failed|rejected|declined)$/.test(topic) ? 'failure' : 'success';
     const base = {
         actorType: 'system',
@@ -25,20 +25,30 @@ function mapEventToRecord(topic, p) {
             actorType: p['actorId'] ? 'admin' : 'system',
             actorId: str(p['actorId']),
             resourceType: 'player',
-            resourceId: str(p['userId']),
-            before: { kycStatus: p['previousStatus'] ?? null },
-            after: { kycStatus: p['status'] ?? null },
+            resourceId: str(p['playerId']),
+            before: { kycStatus: p['previousStatus'] ?? null, tier: p['tier'] ?? null },
+            after: {
+                kycStatus: p['status'] ?? null,
+                tier: p['tier'] ?? null,
+                reason: p['reason'] ?? null,
+                source: p['source'] ?? null,
+            },
         };
     }
-    // Player submitted KYC documents. actorId = the player; resourceId = the player.
+    // Player submitted KYC documents. actorId = resourceId = the player (self-action),
+    // both resolved by the emitter as playerId.
     if (topic === 'compliance.kyc.submitted') {
         return {
             ...base,
             actorType: 'player',
-            actorId: str(p['userId']),
+            actorId: str(p['playerId']),
             resourceType: 'player',
-            resourceId: str(p['userId']),
-            after: { referenceId: p['referenceId'] ?? null, provider: p['provider'] ?? null },
+            resourceId: str(p['playerId']),
+            after: {
+                referenceId: p['referenceId'] ?? null,
+                provider: p['provider'] ?? null,
+                tier: p['tier'] ?? null,
+            },
         };
     }
     // System-driven re-KYC trigger. No admin actor; resource = the subject player.
@@ -47,11 +57,26 @@ function mapEventToRecord(topic, p) {
             ...base,
             actorType: 'system',
             resourceType: 'player',
-            resourceId: str(p['userId']),
-            after: { reason: p['reason'] ?? null },
+            resourceId: str(p['playerId']),
+            after: { reason: p['reason'] ?? null, tier: p['tier'] ?? null },
+        };
+    }
+    if (topic === 'compliance.kyc.high_risk_signal_detected') {
+        return {
+            ...base,
+            actorType: 'system',
+            resourceType: 'player',
+            resourceId: str(p['playerId']),
+            after: {
+                referenceId: p['referenceId'] ?? null,
+                tier: p['tier'] ?? null,
+                vpnOrTorDetected: p['vpnOrTorDetected'] ?? null,
+                dataCenterIpDetected: p['dataCenterIpDetected'] ?? null,
+                duplicateDeviceDetected: p['duplicateDeviceDetected'] ?? null,
+                highRiskCountryDetected: p['highRiskCountryDetected'] ?? null,
+            },
         };
     }
-    // Admin added/changed a geo (country) rule. resourceId = the country code.
     if (topic === 'compliance.geo-rule.added') {
         return {
             ...base,
@@ -62,13 +87,47 @@ function mapEventToRecord(topic, p) {
             after: { action: p['action'] ?? null },
         };
     }
-    // Player requested a withdrawal (funds held). actorId = the player; resourceId =
-    // the withdrawal transaction.
+    if (topic === 'compliance.game-geo-rule.upserted' ||
+        topic === 'compliance.game-geo-rule.deleted') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'game-geo-rule',
+            resourceId: str(p['ruleId']),
+            before: isRecord(p['before']) ? p['before'] : null,
+            after: {
+                state: isRecord(p['after']) ? p['after'] : null,
+                reason: p['reason'] ?? null,
+                gameId: p['gameId'] ?? null,
+                countryCode: p['countryCode'] ?? null,
+            },
+        };
+    }
+    if (topic === 'compliance.provider-geo-rule.upserted' ||
+        topic === 'compliance.provider-geo-rule.deleted') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'provider-geo-rule',
+            resourceId: str(p['ruleId']),
+            before: isRecord(p['before']) ? p['before'] : null,
+            after: {
+                state: isRecord(p['after']) ? p['after'] : null,
+                reason: p['reason'] ?? null,
+                providerId: p['providerId'] ?? null,
+                countryCode: p['countryCode'] ?? null,
+            },
+        };
+    }
+    // Player requested a withdrawal (funds held). actorId = the player (resolved
+    // playerId); resourceId = the withdrawal transaction.
     if (topic === 'wallet.withdrawal.requested') {
         return {
             ...base,
             actorType: 'player',
-            actorId: str(p['userId']),
+            actorId: str(p['playerId']),
             resourceType: 'withdrawal',
             resourceId: str(p['transactionId']),
             after: { amount: p['amount'], currency: p['currency'] },
@@ -76,13 +135,13 @@ function mapEventToRecord(topic, p) {
     }
     // Admin approve/reject of a withdrawal, or a PSP-rail failure on an approved one.
     // actorId = the reviewing admin; resourceId = the withdrawal transaction; reason
-    // carried on reject.
+    // carried on reject. `failed` has no adminId when auto-approved or webhook-rejected.
     if (topic === 'wallet.withdrawal.approved' ||
         topic === 'wallet.withdrawal.rejected' ||
         topic === 'wallet.withdrawal.failed') {
         return {
             ...base,
-            actorType: 'admin',
+            actorType: p['adminId'] ? 'admin' : 'system',
             actorId: str(p['adminId']),
             resourceType: 'withdrawal',
             resourceId: str(p['transactionId']),
@@ -131,19 +190,68 @@ function mapEventToRecord(topic, p) {
             after: { failedLoginAttempts: 0, lockoutUntil: null },
         };
     }
+    // Admin triggered a password-reset OTP send for a player. resource = the subject
+    // player; actor = the admin who acted.
+    if (topic === 'identity.password.admin_reset_requested') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            after: { email: p['email'] ?? null },
+        };
+    }
+    // actorId = the resolved playerId when the caller was a player, else the raw
+    // (admin) userId.
     if (topic === 'identity.user.unauthorized_access') {
         const resource = str(p['resource']) ?? 'admin';
         const action = str(p['action']);
         const role = p['role'] ? str(p['role']) : undefined;
+        const isPlayer = role === 'player';
         return {
             ...base,
-            actorType: role === 'player' ? 'player' : 'admin',
-            actorId: str(p['userId']),
+            actorType: isPlayer ? 'player' : 'admin',
+            actorId: isPlayer ? str(p['playerId']) : str(p['userId']),
             resourceType: resource,
             resourceId: action ? `${resource}:${action}` : null,
             result: 'failure',
         };
     }
+    // Player authenticated via SMS OTP. actorId = resource = the player; success outcome.
+    if (topic === 'identity.user.phone_login') {
+        return {
+            ...base,
+            actorType: 'player',
+            actorId: str(p['playerId']),
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            result: 'success',
+        };
+    }
+    // An OTP was issued (smsOtpSession row created/upserted). System-driven credential
+    // dispatch; resourceId = the user the code was sent for.
+    if (topic === 'identity.phone_otp.requested') {
+        return {
+            ...base,
+            actorType: 'system',
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            result: 'success',
+        };
+    }
+    // A pending OTP was cancelled. `max_attempts` is a system-driven security event
+    // (guessing exhausted); recorded as a failure with the reason for the trail.
+    if (topic === 'identity.phone_otp.cancelled') {
+        return {
+            ...base,
+            actorType: 'system',
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            result: 'failure',
+            after: { reason: p['reason'] ?? null },
+        };
+    }
     // A lockout is a system-driven security control: the subject is the resource, not the
     // actor, and it is a failure outcome (the base regex would otherwise mark it success).
     if (topic === 'identity.user.lockout.triggered') {
@@ -153,30 +261,167 @@ function mapEventToRecord(topic, p) {
             resourceType: 'user',
             resourceId: str(p['userId']),
             result: 'failure',
-            after: { lockoutUntil: p['lockoutUntil'] ?? null },
+            after: {
+                tier: p['tier'] ?? null,
+                lockoutUntil: p['lockoutUntil'] ?? null,
+            },
         };
     }
-    // Player/Admin revoked one or all of their own sessions, or an admin forced it.
+    // Player/Admin revoked one or all of their own sessions, an admin forced it, or
+    // AdminGuard forced it itself on a fingerprint mismatch (no actorId at all - never
+    // read the subject's own userId as a stand-in, that is what mislabels a
+    // system-triggered kill as a self-revoke). Self-revoke sends its own userId as
+    // actorId, so only a *different*, present actorId is an admin acting.
     if (topic === 'identity.session.revoked' || topic === 'identity.sessions.revoked_all') {
         const isSingle = topic === 'identity.session.revoked';
-        const actorId = p['actorId'] ? str(p['actorId']) : str(p['userId']);
-        const isForced = !!p['actorId'];
+        const rawActorId = p['actorId'];
+        const isSystem = rawActorId === undefined || rawActorId === null;
+        const isForced = !isSystem && rawActorId !== p['userId'];
+        const actorType = isSystem ? 'system' : isForced ? 'admin' : 'player';
+        const actorId = isSystem ? null : isForced ? str(rawActorId) : str(p['playerId']);
         return {
             ...base,
-            actorType: isForced ? 'admin' : 'player',
+            actorType,
             actorId,
             resourceType: isSingle ? 'session' : 'user',
             resourceId: isSingle ? str(p['sessionId']) : str(p['userId']),
         };
     }
-    // actorId = the player who (un)blocked; resource = the blocked player.
+    // actorId = the (un)blocking player's resolved playerId; resource = the
+    // blocked/unblocked player's resolved playerId.
     if (topic === 'chat.user.blocked' || topic === 'chat.user.unblocked') {
         return {
             ...base,
             actorType: 'player',
-            actorId: str(p['blockerId']),
+            actorId: str(p['actorPlayerId']),
+            resourceType: 'player',
+            resourceId: str(p['playerId']),
+        };
+    }
+    // actorId = the (un)ignoring player's resolved playerId; resource = the
+    // ignored/unignored player's resolved playerId.
+    if (topic === 'chat.user.ignored' || topic === 'chat.user.unignored') {
+        return {
+            ...base,
+            actorType: 'player',
+            actorId: str(p['actorPlayerId']),
             resourceType: 'player',
-            resourceId: str(p['blockedId']),
+            resourceId: str(p['playerId']),
+        };
+    }
+    // actorId = the moderator's resolved playerId; resource = the affected player in
+    // that room (not player-typed - resourceId stays the raw member userId).
+    if (topic === 'chat.room.member.kicked' || topic === 'chat.room.member.banned') {
+        return {
+            ...base,
+            actorType: 'player',
+            actorId: str(p['playerId']),
+            resourceType: 'chat_room_member',
+            resourceId: str(p['userId']),
+            after: { roomId: str(p['roomId']) },
+        };
+    }
+    // actorId = the creating/deleting player's resolved playerId; resource = the room.
+    if (topic === 'chat.private_room.created' || topic === 'chat.private_room.deleted') {
+        return {
+            ...base,
+            actorType: 'player',
+            actorId: str(p['playerId']),
+            resourceType: 'chat_room',
+            resourceId: str(p['roomId']),
+            ...(topic === 'chat.private_room.deleted'
+                ? {
+                    before: isRecord(p['before']) ? p['before'] : null,
+                    after: isRecord(p['after']) ? p['after'] : null,
+                }
+                : {}),
+        };
+    }
+    if (topic === 'chat.room.created' ||
+        topic === 'chat.room.updated' ||
+        topic === 'chat.room.deleted') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'chat_room',
+            resourceId: str(p['roomId']),
+            ...(topic === 'chat.room.created'
+                ? { after: { name: str(p['name']), slug: str(p['slug']), category: str(p['category']) } }
+                : {}),
+            ...(topic === 'chat.room.updated' || topic === 'chat.room.deleted'
+                ? { before: isRecord(p['before']) ? p['before'] : null }
+                : {}),
+            ...(topic === 'chat.room.updated' ? { after: isRecord(p['after']) ? p['after'] : null } : {}),
+        };
+    }
+    // actorId = the joining/leaving player's resolved playerId; resource is not
+    // player-typed - resourceId stays the raw member userId.
+    if (topic === 'chat.room.member.joined' || topic === 'chat.room.member.left') {
+        return {
+            ...base,
+            actorType: 'player',
+            actorId: str(p['playerId']),
+            resourceType: 'chat_room_member',
+            resourceId: str(p['userId']),
+            after: { roomId: str(p['roomId']) },
+        };
+    }
+    // actorId = the granting/revoking owner's resolved playerId, falling back to the raw acting
+    // user id when no player record backs them (the actor must never be lost on a permission
+    // change). resource = the member whose role moved; before/after carry the two roles.
+    if (topic === 'chat.room.member.role-changed') {
+        const actorPlayerId = str(p['playerId']);
+        return {
+            ...base,
+            actorType: actorPlayerId ? 'player' : 'admin',
+            actorId: actorPlayerId ?? str(p['changedBy']),
+            resourceType: 'chat_room_member',
+            resourceId: str(p['userId']),
+            before: { roomId: str(p['roomId']), role: str(p['previousRole']) },
+            after: { roomId: str(p['roomId']), role: str(p['role']) },
+        };
+    }
+    if (topic === 'chat.room.deletion.cancelled') {
+        return {
+            ...base,
+            actorType: 'system',
+            resourceType: 'chat_room',
+            resourceId: str(p['roomId']),
+            after: {
+                ownerId: str(p['ownerId']),
+                scheduledDeletionAt: null,
+                memberCount: Array.isArray(p['memberIds']) ? p['memberIds'].length : null,
+            },
+        };
+    }
+    if (topic === 'chat.room.ownership.transferred' || topic === 'chat.room.scheduled_for_deletion') {
+        return {
+            ...base,
+            actorType: 'system',
+            resourceType: 'chat_room',
+            resourceId: str(p['roomId']),
+            after: topic === 'chat.room.ownership.transferred'
+                ? {
+                    previousOwnerId: str(p['previousOwnerId']),
+                    newOwnerId: str(p['newOwnerId']),
+                    reason: p['reason'] ?? null,
+                }
+                : {
+                    previousOwnerId: str(p['previousOwnerId']),
+                    scheduledDeletionAt: p['scheduledDeletionAt'] ?? null,
+                    memberCount: Array.isArray(p['memberIds']) ? p['memberIds'].length : null,
+                },
+        };
+    }
+    if (topic === 'player.account.closed' || topic === 'player.account.reopened') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'player',
+            resourceId: str(p['playerId']),
+            after: { closed: topic === 'player.account.closed' },
         };
     }
     // actorType = admin (the only path flipping isActive is the back-office route);
@@ -193,6 +438,19 @@ function mapEventToRecord(topic, p) {
             after: { isActive },
         };
     }
+    // Admin changed a player's level via PlayerService.update(). resource = the
+    // subject player; before/after carry the level transition.
+    if (topic === 'player.level.changed') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'player',
+            resourceId: str(p['playerId']),
+            before: { level: p['previousLevel'] ?? null },
+            after: { level: p['newLevel'] ?? null },
+        };
+    }
     // System-automated or admin-manual tag assignment/removal.
     // actorId = SYSTEM_ACTOR_ID (zero UUID) for automated ops; admin user id for manual.
     if (topic === 'tag.player.assigned' || topic === 'tag.player.removed') {
@@ -207,20 +465,115 @@ function mapEventToRecord(topic, p) {
             after: { tagKey: p['tagKey'], reason: p['reason'] },
         };
     }
-    // Admin CMS page/banner CRUD. actorId = acting admin; resourceId = the page/banner.
+    // A player sent a friend request. actorId = the requester; resourceId = the
+    // friendship row; recipient carried in after so the trail shows who was notified.
+    if (topic === 'social.friend_request.sent') {
+        return {
+            ...base,
+            actorType: 'player',
+            actorId: str(p['requesterId']),
+            resourceType: 'friendship',
+            resourceId: str(p['friendshipId']),
+            after: { addresseeId: str(p['addresseeId']), status: 'pending' },
+        };
+    }
+    // A pending friend request became a friendship. actorId = whoever's action
+    // triggered the accept (accepterId - see events.ts for the mutual-request case).
+    if (topic === 'social.friend_request.accepted') {
+        return {
+            ...base,
+            actorType: 'player',
+            actorId: str(p['accepterId']),
+            resourceType: 'friendship',
+            resourceId: str(p['friendshipId']),
+            after: { status: 'accepted' },
+        };
+    }
+    if (topic === 'social.friendship.removed') {
+        const actorPlayerId = p['actorPlayerId'];
+        return {
+            ...base,
+            actorType: actorPlayerId ? 'player' : 'admin',
+            actorId: actorPlayerId ? str(actorPlayerId) : str(p['actorId']),
+            resourceType: 'friendship',
+            resourceId: str(p['friendshipId']),
+            after: { status: 'removed', reason: p['reason'] },
+        };
+    }
+    // A pending friend request was declined by its addressee - audit-only (see events.ts).
+    if (topic === 'social.friend_request.declined') {
+        return {
+            ...base,
+            actorType: 'player',
+            actorId: str(p['addresseeId']),
+            resourceType: 'friendship',
+            resourceId: str(p['friendshipId']),
+            after: { status: 'declined' },
+        };
+    }
+    // A pending friend request was cancelled by its requester - audit-only (see events.ts).
+    if (topic === 'social.friend_request.cancelled') {
+        return {
+            ...base,
+            actorType: 'player',
+            actorId: str(p['requesterId']),
+            resourceType: 'friendship',
+            resourceId: str(p['friendshipId']),
+            after: { status: 'cancelled' },
+        };
+    }
+    // Scheduled-banner mutations are auditable against the schedule row itself so an
+    // update remains attributable even when its configuration later changes state.
+    if (topic === 'cms.banner.schedule.created' || topic === 'cms.banner.schedule.updated') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'banner_schedule',
+            resourceId: str(p['bannerScheduleId']),
+            ...(topic === 'cms.banner.schedule.updated' && isRecord(p['before'])
+                ? { before: p['before'] }
+                : {}),
+            after: {
+                bannerConfigurationId: str(p['bannerConfigurationId']),
+                placement: str(p['placement']),
+                startsAt: str(p['startsAt']),
+                endsAt: str(p['endsAt']),
+            },
+        };
+    }
+    // Admin CMS page/banner CRUD. actorId = acting admin; resourceId = the page, banner
+    // configuration, or banner image (whichever id that topic's payload carries).
     if (topic === 'cms.page.created' ||
         topic === 'cms.page.updated' ||
         topic === 'cms.page.deleted' ||
-        topic === 'cms.banner.created' ||
-        topic === 'cms.banner.updated' ||
-        topic === 'cms.banner.deleted') {
+        topic === 'cms.banner.configuration.created' ||
+        topic === 'cms.banner.configuration.deleted' ||
+        topic === 'cms.banner.configuration.set_default' ||
+        topic === 'cms.banner.configuration.unset_default' ||
+        topic === 'cms.banner.image.set' ||
+        topic === 'cms.banner.image.deleted') {
         const isBanner = topic.startsWith('cms.banner.');
+        const bannerResourceId = topic === 'cms.banner.configuration.unset_default'
+            ? (str(p['previousBannerConfigurationId']) ?? str(p['placement']))
+            : (str(p['bannerImageId']) ?? str(p['bannerConfigurationId']));
         return {
             ...base,
             actorType: 'admin',
             actorId: str(p['actorId']),
             resourceType: isBanner ? 'banner' : 'page',
-            resourceId: str(isBanner ? p['bannerId'] : p['pageId']),
+            resourceId: isBanner ? bannerResourceId : str(p['pageId']),
+        };
+    }
+    if (topic === 'lobby.layout.updated') {
+        return {
+            ...base,
+            actorType: typeof p['actorId'] === 'string' ? 'admin' : 'system',
+            actorId: str(p['actorId']),
+            resourceType: 'lobby-layout',
+            resourceId: null,
+            before: isRecord(p['before']) ? p['before'] : null,
+            after: isRecord(p['after']) ? p['after'] : null,
         };
     }
     // System-generated in-app notification (fed by a wallet withdrawal event); the
@@ -245,27 +598,64 @@ function mapEventToRecord(topic, p) {
             after: isRecord(p['after']) ? p['after'] : null,
         };
     }
-    // RG admin actions. `userId` = subject player (resource), `actorId` = acting admin.
+    // Admin created or deleted a tag catalog definition (the tag itself, not a
+    // player assignment - see the tag.player.assigned/removed branch for that).
+    if (topic === 'tag.created' || topic === 'tag.deleted') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'tag',
+            resourceId: str(p['key']),
+        };
+    }
     // limit.set + lifted carry a before-snapshot so the regulatory export is diffable.
     if (topic === 'rg.limit.set' ||
+        topic === 'rg.limit.change_requested' ||
+        topic === 'rg.limit.change_confirmed' ||
+        topic === 'rg.limit.change_cancelled' ||
         topic === 'rg.cooling_off.activated' ||
         topic === 'rg.self_exclusion.activated' ||
-        topic === 'rg.self_exclusion.lifted') {
-        const before = topic === 'rg.limit.set'
+        topic === 'rg.self_exclusion.lifted' ||
+        topic === 'rg.cooling_off.lifted') {
+        const before = topic === 'rg.limit.set' || topic === 'rg.limit.change_confirmed'
             ? { amount: p['previousAmount'] ?? null, minutes: p['previousMinutes'] ?? null }
-            : topic === 'rg.self_exclusion.lifted'
+            : topic === 'rg.self_exclusion.lifted' || topic === 'rg.cooling_off.lifted'
                 ? { status: 'active' }
                 : null;
+        const initiatedBy = p['initiatedBy'];
         return {
             ...base,
-            actorType: 'admin',
+            actorType: initiatedBy === 'player' || initiatedBy === 'system' || initiatedBy === 'admin'
+                ? initiatedBy
+                : 'admin',
             actorId: str(p['actorId']),
             resourceType: 'player',
-            resourceId: str(p['userId']),
+            resourceId: str(p['playerId']),
             before,
             after: p,
         };
     }
+    if (topic === 'rg.limit.change_expired') {
+        return {
+            ...base,
+            actorType: 'system',
+            resourceType: 'player',
+            resourceId: str(p['playerId']),
+            before: { pendingAmount: p['requestedAmount'] ?? null },
+            after: p,
+        };
+    }
+    if (topic === 'rg.cooling_off.expired') {
+        return {
+            ...base,
+            actorType: 'system',
+            resourceType: 'player',
+            resourceId: str(p['playerId']),
+            before: { status: 'active' },
+            after: p,
+        };
+    }
     // System-driven login block on an excluded/cooled-off player. actorType is
     // 'system' (no admin acted here) and the outcome is a failure, not the base
     // regex's default 'success' (the topic doesn't end in failed/rejected/declined).
@@ -274,38 +664,384 @@ function mapEventToRecord(topic, p) {
             ...base,
             actorType: 'system',
             resourceType: 'player',
-            resourceId: str(p['userId']),
+            resourceId: str(p['playerId']),
+            result: 'failure',
+        };
+    }
+    // System-driven login rejection for a suspended/closed player account (Backoffice-
+    // initiated block, not an admin action happening right now) - actorType 'system',
+    // outcome 'failure'.
+    if (topic === 'player.login_blocked') {
+        return {
+            ...base,
+            actorType: 'system',
+            resourceType: 'player',
+            resourceId: str(p['playerId']),
             result: 'failure',
         };
     }
+    // System-driven: a reconciliation run's open findings exceeded the configured
+    // threshold. resource = the run itself; after carries counts only, NEVER a finding's
+    // payload (an address or tx hash must never reach the audit log through this event).
+    if (topic === 'wallet.reconciliation.alert') {
+        return {
+            ...base,
+            actorType: 'system',
+            resourceType: 'wallet_job_run',
+            resourceId: str(p['runId']),
+            after: { openFindings: p['openFindings'] ?? null, threshold: p['threshold'] ?? null },
+        };
+    }
+    // Backoffice game-catalog mutations. actorId = the acting admin; resource = the
+    // catalog row; before/after carry the config snapshot so visibility flips are diffable.
+    if (topic === 'gaming.provider.created') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'game_provider',
+            resourceId: str(p['providerId']),
+            after: {
+                slug: p['slug'] ?? null,
+                name: p['name'] ?? null,
+                aggregatorMappings: p['aggregatorMappings'] ?? [],
+                logoUrl: p['logoUrl'] ?? null,
+                metadata: p['metadata'] ?? null,
+                isActive: p['isActive'] ?? null,
+            },
+        };
+    }
+    if (topic === 'gaming.provider.updated') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'game_provider',
+            resourceId: str(p['providerId']),
+            before: isRecord(p['before']) ? p['before'] : null,
+            after: isRecord(p['after']) ? p['after'] : null,
+            correlationId: str(p['bulkOperationId']),
+        };
+    }
+    if (topic === 'gaming.category.created') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'game_category',
+            resourceId: str(p['categoryId']),
+            after: {
+                slug: p['slug'] ?? null,
+                name: p['name'] ?? null,
+                translations: p['translations'] ?? {},
+                icon: p['icon'] ?? null,
+                sortOrder: p['sortOrder'] ?? null,
+                isActive: p['isActive'] ?? null,
+            },
+        };
+    }
+    if (topic === 'gaming.category.updated') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'game_category',
+            resourceId: str(p['categoryId']),
+            before: isRecord(p['before']) ? p['before'] : null,
+            after: isRecord(p['after']) ? p['after'] : null,
+        };
+    }
+    if (topic === 'gaming.tag.created') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'game_tag',
+            resourceId: str(p['tagId']),
+            after: {
+                name: p['name'] ?? null,
+                type: p['type'] ?? null,
+                visibility: p['visibility'] ?? null,
+                metadata: p['metadata'] ?? null,
+            },
+        };
+    }
+    if (topic === 'gaming.tag.updated') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'game_tag',
+            resourceId: str(p['tagId']),
+            before: isRecord(p['before']) ? p['before'] : null,
+            after: isRecord(p['after']) ? p['after'] : null,
+        };
+    }
+    if (topic === 'gaming.tag.deleted') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'game_tag',
+            resourceId: str(p['tagId']),
+            before: isRecord(p['before']) ? p['before'] : null,
+            after: isRecord(p['after']) ? p['after'] : null,
+        };
+    }
+    if (topic === 'gaming.game.updated') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'game',
+            resourceId: str(p['gameId']),
+            before: isRecord(p['before']) ? p['before'] : null,
+            after: isRecord(p['after']) ? p['after'] : null,
+        };
+    }
+    if (topic === 'gaming.games.bulk_updated') {
+        const operation = p['operation'];
+        const linkIdsKey = operation === 'add_tags' ? 'tagIds' : 'categoryIds';
+        const before = operation === 'set_active'
+            ? {
+                isActive: !p['isActive'],
+                gameIds: Array.isArray(p['changedGameIds']) ? p['changedGameIds'] : [],
+                providerIds: Array.isArray(p['changedProviderIds']) ? p['changedProviderIds'] : [],
+            }
+            : {
+                addedLinks: (Array.isArray(p['addedLinks']) ? p['addedLinks'] : []).map((link) => ({ gameId: link['gameId'], [linkIdsKey]: [] })),
+            };
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'game',
+            resourceId: null,
+            before,
+            after: p,
+            correlationId: operation === 'set_active' ? str(p['bulkOperationId']) : null,
+        };
+    }
+    if (topic === 'gaming.game.availability_changed') {
+        return {
+            ...base,
+            actorType: 'system',
+            resourceType: 'game',
+            resourceId: str(p['gameId']),
+            before: isRecord(p['before']) ? p['before'] : null,
+            after: isRecord(p['after']) ? p['after'] : null,
+        };
+    }
     // Wallet events carry the txn ref in transactionId; surface it as resourceId so
     // a transaction reference is searchable (it otherwise stays buried in `after`).
+    // actorId = the resolved playerId (the wallet owner).
     if (topic.startsWith('wallet.')) {
         return {
             ...base,
             actorType: 'player',
-            actorId: str(p['userId']),
+            actorId: str(p['playerId']),
             resourceType: 'transaction',
             resourceId: str(p['transactionId']),
             after: p,
         };
     }
+    // Registration always precedes player-row creation (public sign-up only, no
+    // admin path): actorType stays 'player' even though playerId is legitimately
+    // null at emit time, before the async listener creates the row.
+    if (topic === 'identity.user.registered') {
+        return { ...base, actorId: str(p['playerId']), actorType: 'player' };
+    }
+    // A rejected attempt has no account behind it, so there is no actor to name - only the
+    // address that was tried, which `after` already carries. `resourceType` is narrowed off
+    // the default 'identity' so an auditor can pull registration attempts on their own.
+    if (topic === 'identity.user.registration.failed') {
+        return { ...base, resourceType: 'registration' };
+    }
+    // Admin-on-behalf topics: `userId` names the affected account, not the actor - the
+    // acting admin travels in its own `actorId` field, same as compliance.kyc.updated.
+    // Both also fire self-service: `disableTwoFactor` / `regenerateBackupCodes` tear down
+    // the caller's own trust with `actorId === userId`, and
+    // `identity.trusted_device.revoked` fires with no actorId at all when AdminGuard
+    // revokes the trust itself on a fingerprint mismatch. Same system/forced/self split
+    // as the session-revoked mapper above, so a self-teardown is never logged as an
+    // admin acting on the account.
+    if (topic === 'identity.2fa.reset' || topic === 'identity.trusted_device.revoked') {
+        const rawActorId = p['actorId'];
+        const isSystem = rawActorId === undefined || rawActorId === null;
+        const isForced = !isSystem && rawActorId !== p['userId'];
+        return {
+            ...base,
+            actorType: isSystem ? 'system' : isForced ? 'admin' : 'player',
+            actorId: isSystem ? null : isForced ? str(rawActorId) : str(p['playerId']),
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+        };
+    }
+    // Player (or admin, when no player row backs the account) replaced their login email.
+    // before/after carry the two addresses so the regulatory trail is diffable.
+    if (topic === 'identity.email.changed') {
+        const playerId = p['playerId'];
+        return {
+            ...base,
+            actorType: playerId ? 'player' : 'admin',
+            actorId: playerId ? str(playerId) : str(p['userId']),
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            before: { email: str(p['previousEmail']) },
+            after: { email: str(p['newEmail']) },
+        };
+    }
+    if (topic === 'identity.phone.verified') {
+        const playerId = p['playerId'];
+        return {
+            ...base,
+            actorType: playerId ? 'player' : 'admin',
+            actorId: playerId ? str(playerId) : str(p['userId']),
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            before: { phoneVerified: p['previousPhoneVerified'] ?? null },
+            after: { phoneVerified: true },
+        };
+    }
+    if (topic === 'identity.security.login_withdrawal_alerts.updated') {
+        const playerId = p['playerId'];
+        return {
+            ...base,
+            actorType: playerId ? 'player' : 'admin',
+            actorId: playerId ? str(playerId) : str(p['userId']),
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            before: { loginWithdrawalAlertsEnabled: p['previousEnabled'] ?? null },
+            after: { loginWithdrawalAlertsEnabled: p['enabled'] ?? null },
+        };
+    }
+    if (topic === 'identity.security.auto_logout.updated') {
+        const playerId = p['playerId'];
+        return {
+            ...base,
+            actorType: playerId ? 'player' : 'admin',
+            actorId: playerId ? str(playerId) : str(p['userId']),
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            before: { autoLogoutDuration: p['previousDuration'] ?? null },
+            after: { autoLogoutDuration: p['duration'] ?? null },
+        };
+    }
+    if (topic === 'identity.security.require_two_factor.updated') {
+        const playerId = p['playerId'];
+        return {
+            ...base,
+            actorType: playerId ? 'player' : 'admin',
+            actorId: playerId ? str(playerId) : str(p['userId']),
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            before: { requireTwoFactorOnLogin: p['previousEnabled'] ?? null },
+            after: { requireTwoFactorOnLogin: p['enabled'] ?? null },
+        };
+    }
+    if (topic === 'identity.security.withdrawal_pin.set') {
+        const playerId = p['playerId'];
+        return {
+            ...base,
+            actorType: playerId ? 'player' : 'admin',
+            actorId: playerId ? str(playerId) : str(p['userId']),
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            // Booleans only - the PIN and its hash never reach the audit trail.
+            before: { withdrawalPinSet: p['wasAlreadySet'] ?? null },
+            after: { withdrawalPinSet: true },
+        };
+    }
+    if (topic === 'identity.security.withdrawal_pin.removed') {
+        const playerId = p['playerId'];
+        return {
+            ...base,
+            actorType: playerId ? 'player' : 'admin',
+            actorId: playerId ? str(playerId) : str(p['userId']),
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            before: { withdrawalPinSet: true },
+            after: { withdrawalPinSet: false },
+        };
+    }
+    if (topic === 'identity.security.anti_phishing_code.set') {
+        const playerId = p['playerId'];
+        return {
+            ...base,
+            actorType: playerId ? 'player' : 'admin',
+            actorId: playerId ? str(playerId) : str(p['userId']),
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            // The code value never reaches the audit trail, only that it was set.
+            before: { antiPhishingCodeSet: p['wasAlreadySet'] ?? null },
+            after: { antiPhishingCodeSet: true },
+        };
+    }
+    // Shared identity self-action topics: the same `/identity/*` endpoints serve
+    // both player and admin accounts, so playerId only resolves for a player. A
+    // null playerId means the account has no player row - attribute to the
+    // admin's own userId instead of mislabeling them as a player.
+    if (topic === 'identity.user.login' ||
+        topic === 'identity.user.logout' ||
+        topic === 'identity.2fa.enabled' ||
+        topic === 'identity.2fa.disabled' ||
+        topic === 'identity.2fa.verified' ||
+        topic === 'identity.2fa.failed' ||
+        topic === 'identity.2fa.backup_codes_regenerated' ||
+        topic === 'identity.2fa.lockout.triggered' ||
+        topic === 'identity.2fa.enrollment_blocked' ||
+        topic === 'identity.session.fingerprint_mismatch' ||
+        topic === 'identity.trusted_device.added' ||
+        topic === 'identity.password.reset' ||
+        topic === 'identity.password.changed' ||
+        topic === 'identity.email.verified' ||
+        topic === 'identity.profile.updated') {
+        const playerId = p['playerId'];
+        return playerId
+            ? { ...base, actorId: str(playerId), actorType: 'player' }
+            : { ...base, actorId: str(p['userId']), actorType: 'admin' };
+    }
+    // Generic player-self-action fallback (gaming rounds, chat, self-service RG
+    // limits, ...): actorId = the resolved playerId.
     if (typeof p['userId'] === 'string') {
-        return { ...base, actorId: p['userId'], actorType: 'player' };
+        return { ...base, actorId: str(p['playerId']), actorType: 'player' };
     }
     return base;
 }
 const SUBSCRIBED_TOPICS = [
     'identity.user.registered',
+    'identity.user.registration.failed',
     'identity.user.login',
     'identity.user.login.failed',
     'identity.user.lockout.triggered',
     'identity.user.unlocked',
+    'identity.password.admin_reset_requested',
     'identity.user.logout',
+    'identity.user.phone_login',
+    'identity.phone_otp.requested',
+    'identity.phone_otp.cancelled',
     'identity.2fa.enabled',
     'identity.2fa.disabled',
+    'identity.2fa.verified',
+    'identity.2fa.failed',
+    'identity.2fa.backup_codes_regenerated',
+    'identity.2fa.reset',
+    'identity.2fa.lockout.triggered',
+    'identity.2fa.enrollment_blocked',
+    'identity.session.fingerprint_mismatch',
+    'identity.trusted_device.added',
+    'identity.trusted_device.revoked',
     'identity.password.reset',
+    'identity.password.changed',
     'identity.email.verified',
+    'identity.email.changed',
+    'identity.phone.verified',
+    'identity.security.login_withdrawal_alerts.updated',
+    'identity.security.auto_logout.updated',
+    'identity.security.require_two_factor.updated',
+    'identity.security.withdrawal_pin.set',
+    'identity.security.withdrawal_pin.removed',
+    'identity.security.anti_phishing_code.set',
     'identity.profile.updated',
     'identity.user.deactivated',
     'identity.user.reactivated',
@@ -317,31 +1053,80 @@ const SUBSCRIBED_TOPICS = [
     'wallet.withdrawal.requested',
     'wallet.withdrawal.approved',
     'wallet.withdrawal.rejected',
-    'wallet.withdrawal.failed',
+    // wallet.withdrawal.failed: NOT subscribed - WalletService.finalizeFailedWithdrawal
+    // writes this audit row itself via recordInTransaction, atomically with the refund
+    // credit (docs/standards/money.md). Subscribing here too would double-record it,
+    // and worse, on the same best-effort/after-commit timing the direct write exists
+    // to avoid. mapEventToRecord keeps its 'wallet.withdrawal.failed' branch - it is
+    // still unit-tested directly - it is just never reached through this subscription.
+    'wallet.reconciliation.alert',
     'gaming.round.started',
     'gaming.round.ended',
-    // chat.message.sent is intentionally NOT audited: it is high-volume content
-    // already persisted in chatMessage; the moderation/block actions are what we audit.
+    'lobby.layout.updated',
+    'gaming.provider.created',
+    'gaming.provider.updated',
+    'gaming.category.created',
+    'gaming.category.updated',
+    'gaming.tag.created',
+    'gaming.tag.updated',
+    'gaming.tag.deleted',
+    'gaming.game.updated',
+    'gaming.games.bulk_updated',
+    'gaming.game.availability_changed',
     'chat.user.blocked',
     'chat.user.unblocked',
+    'chat.user.ignored',
+    'chat.user.unignored',
+    'chat.private_room.created',
+    'chat.private_room.deleted',
+    'chat.room.created',
+    'chat.room.updated',
+    'chat.room.deleted',
+    'chat.room.member.joined',
+    'chat.room.member.left',
+    'chat.room.member.kicked',
+    'chat.room.member.banned',
+    // chat.gift.sent
+    // chat.rain.distributed
+    'chat.room.member.role-changed',
+    'chat.room.ownership.transferred',
+    'chat.room.scheduled_for_deletion',
+    'chat.room.deletion.cancelled',
+    'chat.user.mentioned',
     'compliance.limit.upserted',
     'compliance.limit.removed',
     'rg.limit.set',
+    'rg.limit.change_requested',
+    'rg.limit.change_confirmed',
+    'rg.limit.change_cancelled',
+    'rg.limit.change_expired',
     'rg.cooling_off.activated',
     'rg.self_exclusion.activated',
     'rg.self_exclusion.lifted',
+    'rg.cooling_off.lifted',
+    'rg.cooling_off.expired',
     'rg.exclusion.login_blocked',
     'compliance.kyc.updated',
     'compliance.kyc.submitted',
     'compliance.kyc.reverify_required',
+    'compliance.kyc.high_risk_signal_detected',
     'compliance.geo-rule.added',
+    'compliance.game-geo-rule.upserted',
+    'compliance.game-geo-rule.deleted',
+    'compliance.provider-geo-rule.upserted',
+    'compliance.provider-geo-rule.deleted',
     'cms.page.published',
     'cms.page.created',
     'cms.page.updated',
     'cms.page.deleted',
-    'cms.banner.created',
-    'cms.banner.updated',
-    'cms.banner.deleted',
+    'cms.banner.configuration.created',
+    'cms.banner.configuration.deleted',
+    'cms.banner.configuration.set_default',
+    'cms.banner.configuration.unset_default',
+    'cms.banner.image.set',
+    'cms.banner.image.deleted',
+    'cms.banner.schedule.created',
+    'cms.banner.schedule.updated',
     'notifications.created',
     'iam.invitation.accepted',
     'iam.role.created',
@@ -350,11 +1135,22 @@ const SUBSCRIBED_TOPICS = [
     'iam.role.permissions.changed',
     'iam.role.assigned',
     'iam.role.revoked',
+    'tag.created',
+    'tag.deleted',
     'tag.player.assigned',
     'tag.player.removed',
     'tag.rule.upserted',
+    'player.level.changed',
+    'player.login_blocked',
+    'player.account.closed',
+    'player.account.reopened',
+    'social.friend_request.sent',
+    'social.friend_request.accepted',
+    'social.friendship.removed',
+    'social.friend_request.declined',
+    'social.friend_request.cancelled',
 ];
-export default definePlugin({
+export default {
     id: 'audit',
     register(ctx) {
         const logger = createLogger('audit');
@@ -362,9 +1158,10 @@ export default definePlugin({
         // so svcRef is null at registration but set before any real event arrives.
         let svcRef = null;
         ctx.provideSealed(AUDIT_WRITER, (c) => {
-            const svc = new AuditService(c.get(DRIZZLE), c.get(EVENT_BUS));
+            const svc = new AuditService(c.get(DRIZZLE), c.get(EVENT_BUS), c.get(IDENTITY_READER));
             return {
                 record: (entry) => svc.record(entry).then(() => undefined),
+                recordInTransaction: (tx, entry) => svc.recordInTransaction(tx, entry).then(() => undefined),
             };
         });
         for (const topic of SUBSCRIBED_TOPICS) {
@@ -372,16 +1169,17 @@ export default definePlugin({
                 if (!svcRef || !isRecord(payload)) {
                     return;
                 }
-                void svcRef
-                    .record(mapEventToRecord(topic, payload))
+                const svc = svcRef;
+                void mapEventToRecord(topic, payload)
+                    .then((record) => svc.record(record))
                     .catch((err) => logger.error({ err, topic }, 'audit record failed'));
             });
         }
         ctx.routers.add('audit', (c) => {
-            const svc = new AuditService(c.get(DRIZZLE), c.get(EVENT_BUS));
+            const svc = new AuditService(c.get(DRIZZLE), c.get(EVENT_BUS), c.get(IDENTITY_READER));
             svcRef = svc;
             return createAuditRouter(svc, c.get(ADMIN_GUARD));
         });
     },
-});
+};
 //# sourceMappingURL=plugin.js.map