@openora/core 0.4.1-canary.39 → 0.4.1-canary.41

package/dist/compliance/schema/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/compliance/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,OAAO,EACP,OAAO,EACP,KAAK,EACL,SAAS,EACT,WAAW,EACX,KAAK,GACN,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,cAAc,GACf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAsB,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAG5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;AACnF,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAC9B,YAAY,EACZ;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1C,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC5C,OAAO,EAAE,OAAO,EAAE;IAClB,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9C,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,WAAW,CAAC,oCAAoC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAChF,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAC7C,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE;IACzC,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,8BAA8B,CAAC;IACpE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAChD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACpE,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CACpC,kBAAkB,EAClB;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC7B,MAAM,EAAE,qBAAqB,EAAE,CAAC,OAAO,EAAE;IACzC,aAAa,EAAE,KAAK,EAAE,CAAC,KAAK,EAAyC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3F,cAAc,EAAE,IAAI,EAAE;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC,OAAO,EAAE;IACvC,sFAAsF;IACtF,8DAA8D;IAC9D,eAAe,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACrE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5C,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,yCAAyC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;IAC1E,KAAK,CAAC,mCAAmC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IAC5D,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAClD,CACF,CAAC;AAEF,kFAAkF;AAClF,mFAAmF;AACnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAChC,cAAc,EACd;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,IAAI,EAAE,eAAe,EAAE,CAAC,OAAO,EAAE;IACjC,MAAM,EAAE,iBAAiB,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvD,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,WAAW,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,QAAQ,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IAClE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5C,QAAQ,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3C,YAAY,EAAE,IAAI,EAAE;IACpB,QAAQ,EAAE,IAAI,EAAE;IAChB,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC3B,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,CAAC,iCAAiC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;IAC/D,KAAK,CAAC,8BAA8B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC1D,WAAW,CAAC,8BAA8B,CAAC;SACxC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;SACpB,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,aAAa,CAAC;CACtC,CACF,CAAC;AAEF,gFAAgF;AAChF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,MAAM,GAAG,OAAO,CAC3B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,QAAQ,EAAE,UAAU,EAAE,CAAC,OAAO,EAAE;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,mFAAmF;IACnF,mFAAmF;IACnF,MAAM,EAAE,KAAK,EAAE;SACZ,KAAK,EAAgB;SACrB,OAAO,EAAE;SACT,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC;IAC5B,MAAM,EAAE,YAAY,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;CAC7C,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;IAChE,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;CAC9C,CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/compliance/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,OAAO,EACP,OAAO,EACP,KAAK,EACL,SAAS,EACT,WAAW,EACX,KAAK,GACN,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,cAAc,GAGf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAsB,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAG5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;AACnF,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAC9B,YAAY,EACZ;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1C,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC5C,OAAO,EAAE,OAAO,EAAE;IAClB,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9C,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,WAAW,CAAC,oCAAoC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAChF,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAC7C,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE;IACzC,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,8BAA8B,CAAC;IACpE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAChD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACpE,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CACpC,kBAAkB,EAClB;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC7B,MAAM,EAAE,qBAAqB,EAAE,CAAC,OAAO,EAAE;IACzC,aAAa,EAAE,KAAK,EAAE,CAAC,KAAK,EAAyC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3F,cAAc,EAAE,IAAI,EAAE;IACtB,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,EAAkB;IAC5C,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,EAAoB;IACzC,WAAW,EAAE,cAAc,EAAE,CAAC,OAAO,EAAE;IACvC,sFAAsF;IACtF,8DAA8D;IAC9D,eAAe,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACrD,kFAAkF;IAClF,mFAAmF;IACnF,iFAAiF;IACjF,yEAAyE;IACzE,mFAAmF;IACnF,kBAAkB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACrD,WAAW,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACrE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5C,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,yCAAyC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;IAC1E,KAAK,CAAC,mCAAmC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IAC5D,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAClD,CACF,CAAC;AAEF,kFAAkF;AAClF,mFAAmF;AACnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAChC,cAAc,EACd;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,IAAI,EAAE,eAAe,EAAE,CAAC,OAAO,EAAE;IACjC,MAAM,EAAE,iBAAiB,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvD,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,WAAW,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,QAAQ,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IAClE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5C,QAAQ,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3C,YAAY,EAAE,IAAI,EAAE;IACpB,QAAQ,EAAE,IAAI,EAAE;IAChB,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC3B,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,CAAC,iCAAiC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;IAC/D,KAAK,CAAC,8BAA8B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC1D,WAAW,CAAC,8BAA8B,CAAC;SACxC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;SACpB,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,aAAa,CAAC;CACtC,CACF,CAAC;AAEF,gFAAgF;AAChF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,MAAM,GAAG,OAAO,CAC3B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,QAAQ,EAAE,UAAU,EAAE,CAAC,OAAO,EAAE;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,mFAAmF;IACnF,mFAAmF;IACnF,MAAM,EAAE,KAAK,EAAE;SACZ,KAAK,EAAgB;SACrB,OAAO,EAAE;SACT,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC;IAC5B,MAAM,EAAE,YAAY,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;CAC7C,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;IAChE,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;CAC9C,CACF,CAAC"}

package/dist/compliance/service/kyc.service.d.ts

@@ -1,7 +1,8 @@
 import { DrizzleService, type EventBus } from '@openora/core/server';
-import type { KycAdapter, KycStatusWriter, KycVendorStatus, PlatformConfig, User, ClientMeta } from '@openora/core/contracts';
-import type { SubmitKycInput, PlayerKycView } from '../contract/index.js';
+import { type KycAdapter, type KycCheckResult, type KycDocument, type KycRiskSignals, type KycStatusWriter, type KycVendorStatus, type PlatformConfig, type User, ClientMeta } from '@openora/core/contracts';
+import type { SubmitKycInput, PlayerKycView, KycOverrideStatus, BulkApproveKycResult } from '../contract/index.js';
 import { type ReKycTrigger } from './re-kyc-trigger.js';
+export declare const PlayerNotFoundError: new (id: string) => Error;
 export declare const KycVerificationNotFoundError: new (id: string) => Error;
 /**
  * Owns the append-only `kyc_verification` history and the submit/reconcile/re-KYC
@@ -27,15 +28,21 @@ export declare class KycVerificationService {
     private get provider();
     submit(userId: User['id'], input: SubmitKycInput, meta?: ClientMeta): Promise<{
         verificationUrl: string | undefined;
-        status: "pending" | "not_started" | "verified" | "rejected" | "resubmission_requested" | "manually_overridden";
+        status: "pending" | "not_started" | "approved" | "verified" | "rejected" | "resubmission_requested" | "manually_overridden";
         id: string;
         userId: string;
+        checks: {
+            step: string;
+            status: "expired" | "unknown" | "not_started" | "approved" | "in_progress" | "in_review" | "declined";
+        }[] | null;
         provider: string;
         referenceId: string;
         triggeredBy: "manual" | "submission" | "reverify_threshold";
         documentTypes: ("passport" | "drivers_license" | "national_id")[];
         decisionReason: string | null;
+        riskSignals: KycRiskSignals | null;
         triggerDeposits: string | null;
+        decisionReceivedAt: Date | null;
         createdAt: string;
         updatedAt: string;
         submittedAt: string;
@@ -43,12 +50,42 @@ export declare class KycVerificationService {
     }>;
     /**
      * Idempotent vendor-decision apply (polling + webhook). No-op when the latest record
-     * already holds the mapped status.
+     * already holds the mapped status. `reason`/`documentTypes`/`riskSignals` are only
+     * overwritten when the caller supplies them, and `decidedAt` is stamped only on an
+     * actual decision, so a bare status reconcile never blanks out an earlier one. Emits
+     * `compliance.kyc.high_risk_signal_detected` when the supplied `riskSignals` (never a
+     * preserved prior value) trip `warrantsHighRiskTag`.
+     *
+     * `opts.receivedAt` (when the caller has it - the `kyc-decision-sync` job path always
+     * does, stamped at webhook-arrival time in the router, BEFORE the job queue can
+     * reorder anything) is a monotonicity guard: a decision older than the one already on
+     * file for this referenceId is refused, not applied. The job queue does not honour
+     * `orderingKey` (see bullmq-job-queue.ts), so two decisions for the same reference can
+     * reach here out of arrival order after a retry; without this guard the LATER-arriving
+     * (but actually OLDER) decision would win and silently overwrite a newer, correct one.
+     * A caller with no `receivedAt` (eg a direct `reconcile` call with no job path behind
+     * it) skips the guard entirely - always applies, exactly as before.
+     *
+     * A vendor `approved` is downgraded to `resubmission_requested` when the checks this
+     * call is about to persist (`opts.checks`, falling back to the existing row's `checks`
+     * when the caller supplies none - the SAME value written below, so the gate can never
+     * evaluate a different set of checks than the one that ends up on the row) contain any
+     * non-`approved` entry - see `compliance/AGENTS.md` > KYC workflow completeness.
      */
-    reconcile(referenceId: string, vendorStatus: KycVendorStatus, reason?: string): Promise<import("@openora/core/server").SerializedRow<{
-        status: "pending" | "not_started" | "verified" | "rejected" | "resubmission_requested" | "manually_overridden";
+    reconcile(referenceId: string, vendorStatus: KycVendorStatus, opts?: {
+        reason?: string;
+        documentTypes?: KycDocument['type'][];
+        riskSignals?: KycRiskSignals;
+        checks?: KycCheckResult[];
+        receivedAt?: Date;
+    }): Promise<import("@openora/core/server").SerializedRow<{
+        status: "pending" | "not_started" | "approved" | "verified" | "rejected" | "resubmission_requested" | "manually_overridden";
         id: string;
         userId: string;
+        checks: {
+            step: string;
+            status: "expired" | "unknown" | "not_started" | "approved" | "in_progress" | "in_review" | "declined";
+        }[] | null;
         createdAt: Date;
         updatedAt: Date;
         provider: string;
@@ -57,16 +94,124 @@ export declare class KycVerificationService {
         submittedAt: Date;
         documentTypes: ("passport" | "drivers_license" | "national_id")[];
         decisionReason: string | null;
+        riskSignals: KycRiskSignals | null;
         decidedAt: Date | null;
         triggerDeposits: string | null;
+        decisionReceivedAt: Date | null;
+    }, "createdAt" | "updatedAt" | "submittedAt" | "decidedAt"> | null>;
+    /**
+     * `kyc-decision-sync` job handler, run off the webhook request path. Enriches the
+     * reconcile through `resolveDecision`/`resolveRiskSignals` when the bound adapter
+     * implements them, falling back to a status-only reconcile when it does not. Errors
+     * (notably `PlayerNotFoundError`) propagate so the job queue retries the decision -
+     * see `compliance/AGENTS.md` > Webhook -> job flow. `receivedAt` is the webhook's
+     * arrival time (stamped by the router before enqueue, carried on the job payload) -
+     * passed through to `reconcile` as the monotonicity watermark so a job that runs
+     * out of arrival order (the driver ignores `orderingKey`) can't overwrite a newer
+     * decision with a stale one.
+     */
+    syncDecision(referenceId: string, status: KycVendorStatus, receivedAt?: Date): Promise<import("@openora/core/server").SerializedRow<{
+        status: "pending" | "not_started" | "approved" | "verified" | "rejected" | "resubmission_requested" | "manually_overridden";
+        id: string;
+        userId: string;
+        checks: {
+            step: string;
+            status: "expired" | "unknown" | "not_started" | "approved" | "in_progress" | "in_review" | "declined";
+        }[] | null;
+        createdAt: Date;
+        updatedAt: Date;
+        provider: string;
+        referenceId: string;
+        triggeredBy: "manual" | "submission" | "reverify_threshold";
+        submittedAt: Date;
+        documentTypes: ("passport" | "drivers_license" | "national_id")[];
+        decisionReason: string | null;
+        riskSignals: KycRiskSignals | null;
+        decidedAt: Date | null;
+        triggerDeposits: string | null;
+        decisionReceivedAt: Date | null;
     }, "createdAt" | "updatedAt" | "submittedAt" | "decidedAt"> | null>;
     getForPlayer(userId: User['id']): Promise<PlayerKycView>;
     /**
-     * Deposit-event hook: flips a currently-verified player to `resubmission_requested`
+     * Deposit-event hook: flips a currently-approved player to `resubmission_requested`
      * once cumulative deposits cross a fresh per-currency threshold band. Idempotent twice
-     * over: skips unless presently `verified`, and the watermark stops a re-verified
+     * over: skips unless presently approved, and the watermark stops a re-approved
      * high-roller re-firing on every later deposit.
      */
     handleDeposit(userId: User['id']): Promise<void>;
+    /**
+     * Shared transaction body for `requestResubmission`/`overrideStatus`: inserts the
+     * manual `kyc_verification` history row and calls `KYC_STATUS_WRITER.setStatus` in
+     * the SAME transaction (extracted so the two documented locking/idempotency rules
+     * in `compliance/AGENTS.md` > Admin KYC actions cannot silently diverge between the
+     * two call sites). Caller has already run the idempotency pre-check
+     * (`requirePlayerRowForUpdate` + a status compare) before calling this.
+     */
+    private applyManualDecision;
+    /**
+     * Admin-initiated: requests the player resubmit documents. Idempotent on a repeat
+     * call while the player is already at `resubmission_requested` - no duplicate history
+     * row, no duplicate `compliance.kyc.updated` emit. See `compliance/AGENTS.md` >
+     * Admin KYC actions for why the `FOR UPDATE` lock has to sit inside the transaction.
+     */
+    requestResubmission(userId: User['id'], reason: string, actorId: User['id']): Promise<import("@openora/core/server").SerializedRow<{
+        status: "pending" | "not_started" | "approved" | "verified" | "rejected" | "resubmission_requested" | "manually_overridden";
+        id: string;
+        userId: string;
+        checks: {
+            step: string;
+            status: "expired" | "unknown" | "not_started" | "approved" | "in_progress" | "in_review" | "declined";
+        }[] | null;
+        createdAt: Date;
+        updatedAt: Date;
+        provider: string;
+        referenceId: string;
+        triggeredBy: "manual" | "submission" | "reverify_threshold";
+        submittedAt: Date;
+        documentTypes: ("passport" | "drivers_license" | "national_id")[];
+        decisionReason: string | null;
+        riskSignals: KycRiskSignals | null;
+        decidedAt: Date | null;
+        triggerDeposits: string | null;
+        decisionReceivedAt: Date | null;
+    }, "createdAt" | "updatedAt" | "submittedAt" | "decidedAt">>;
+    /**
+     * Admin-initiated: forces the player to an operator-chosen status, guarded by the
+     * router's `compliance:override-limit`. `resolveManualStatus` remaps an `approved`
+     * choice to `manually_overridden`; every other choice is written verbatim. Idempotent
+     * on a repeat call resolving to the status the player already holds. Rationale for
+     * both: `compliance/AGENTS.md` > Admin KYC actions.
+     */
+    overrideStatus(userId: User['id'], status: KycOverrideStatus, reason: string, actorId: User['id']): Promise<import("@openora/core/server").SerializedRow<{
+        status: "pending" | "not_started" | "approved" | "verified" | "rejected" | "resubmission_requested" | "manually_overridden";
+        id: string;
+        userId: string;
+        checks: {
+            step: string;
+            status: "expired" | "unknown" | "not_started" | "approved" | "in_progress" | "in_review" | "declined";
+        }[] | null;
+        createdAt: Date;
+        updatedAt: Date;
+        provider: string;
+        referenceId: string;
+        triggeredBy: "manual" | "submission" | "reverify_threshold";
+        submittedAt: Date;
+        documentTypes: ("passport" | "drivers_license" | "national_id")[];
+        decisionReason: string | null;
+        riskSignals: KycRiskSignals | null;
+        decidedAt: Date | null;
+        triggerDeposits: string | null;
+        decisionReceivedAt: Date | null;
+    }, "createdAt" | "updatedAt" | "submittedAt" | "decidedAt">>;
+    /**
+     * Admin-initiated: approves every listed player through the same
+     * `overrideStatus('approved', ...)` path, so a bulk approval is recorded identically
+     * to a single one. Bounded fan-out with per-player error isolation - one failure is
+     * captured as a result row rather than aborting the batch, and the returned message
+     * is a fixed string, never the raw exception text (`compliance/AGENTS.md`).
+     */
+    bulkApprove(userIds: User['id'][], reason: string, actorId: User['id']): Promise<BulkApproveKycResult[]>;
+    private requirePlayerRowForUpdate;
+    private latestVerificationOrThrow;
 }
 //# sourceMappingURL=kyc.service.d.ts.map

package/dist/compliance/service/kyc.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kyc.service.d.ts","sourceRoot":"","sources":["../../../src/compliance/service/kyc.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EAId,KAAK,QAAQ,EACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,eAAe,EAEf,cAAc,EACd,IAAI,EACJ,UAAU,EACX,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAiC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAIvF,eAAO,MAAM,4BAA4B,2BAAuC,CAAC;AAyBjF;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,eAAe,CAAC;IAC9B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B,CAAC;AAEF,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkB;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAEhC,IAAI,EAAE,mBAAmB;IASrC,OAAO,KAAK,QAAQ,GAEnB;IAEK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,UAAU;;;;;;;;;;;;;;;;IAiCzE;;;OAGG;IAEG,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;IAgC7E,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IAS9D;;;;;OAKG;IACG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;CA+DvC"}
+{"version":3,"file":"kyc.service.d.ts","sourceRoot":"","sources":["../../../src/compliance/service/kyc.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EAMd,KAAK,QAAQ,EACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,EAEpB,KAAK,cAAc,EACnB,KAAK,IAAI,EACT,UAAU,EACX,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAiC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAYvF,eAAO,MAAM,mBAAmB,2BAA8B,CAAC;AAE/D,eAAO,MAAM,4BAA4B,2BAAuC,CAAC;AAyDjF;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,eAAe,CAAC;IAC9B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B,CAAC;AAEF,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkB;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAEhC,IAAI,EAAE,mBAAmB;IASrC,OAAO,KAAK,QAAQ,GAEnB;IAEK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,UAAU;;;;;;;;;;;;;;;;;;;;;;IA6CzE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IAEG,SAAS,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,eAAe,EAC7B,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,WAAW,CAAC,EAAE,cAAc,CAAC;QAC7B,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;QAC1B,UAAU,CAAC,EAAE,IAAI,CAAC;KACd;;;;;;;;;;;;;;;;;;;;;IA6ER;;;;;;;;;;OAUG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,IAAI;;;;;;;;;;;;;;;;;;;;;IAiB5E,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IAS9D;;;;;OAKG;IACG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;IAgEtC;;;;;;;OAOG;YACW,mBAAmB;IAoCjC;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;IAkBjF;;;;;;OAMG;IACG,cAAc,CAClB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;IAoBrB;;;;;;OAMG;IACG,WAAW,CACf,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAClB,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAiBpB,yBAAyB;YAazB,yBAAyB;CASxC"}

package/dist/compliance/service/kyc.service.js

@@ -1,4 +1,5 @@
-import { findOneOrThrow, makeNotFoundError, serializeRow, } from '@openora/core/server';
+import { createLogger, findOneOrThrow, makeNotFoundError, mapConcurrent, serializeRow, } from '@openora/core/server';
+import { normalizeKycStatus, } from '@openora/core/contracts';
 import { and, desc, eq, sql } from 'drizzle-orm';
 import { kycVerification } from '../schema/index.js';
 // Cross-domain reads via public /schema subpaths (ADR-0020); the wallet ledger is the
@@ -6,12 +7,16 @@ import { kycVerification } from '../schema/index.js';
 import { player } from '@openora/core/pam/schema/profile';
 import { wallet, walletTransaction } from '@openora/core/wallet/schema';
 import { CumulativeDepositReKycTrigger } from './re-kyc-trigger.js';
+const logger = createLogger('compliance-kyc');
 const DEFAULT_PROVIDER = 'mock';
+const MANUAL_PROVIDER = 'manual';
+const BULK_APPROVE_CONCURRENCY = 10;
+export const PlayerNotFoundError = makeNotFoundError('Player');
 export const KycVerificationNotFoundError = makeNotFoundError('KycVerification');
 function mapVendorStatus(vendor) {
     switch (vendor) {
         case 'approved':
-            return 'verified';
+            return 'approved';
         case 'rejected':
             return 'rejected';
         case 'pending':
@@ -21,7 +26,31 @@ function mapVendorStatus(vendor) {
     }
 }
 function isDecided(status) {
-    return status === 'verified' || status === 'rejected';
+    const normalized = normalizeKycStatus(status);
+    return (normalized === 'approved' || normalized === 'rejected' || normalized === 'manually_overridden');
+}
+function resolveManualStatus(status) {
+    return status === 'approved' ? 'manually_overridden' : status;
+}
+const HIGH_RISK_SIGNAL_KEYS = [
+    'duplicateDeviceDetected',
+    'highRiskCountryDetected',
+];
+function warrantsHighRiskTag(signals) {
+    return HIGH_RISK_SIGNAL_KEYS.some((key) => signals[key]);
+}
+const NO_STEPS_RESOLVED_CHECK = { step: 'workflow', status: 'unknown' };
+function findIncompleteCheck(checks) {
+    if (checks === undefined) {
+        return undefined;
+    }
+    if (checks.length === 0) {
+        return NO_STEPS_RESOLVED_CHECK;
+    }
+    return checks.find((check) => check.status !== 'approved');
+}
+function describeIncompleteCheck(check) {
+    return `Vendor reported approved but "${check.step}" has not reached a successful state (status: ${check.status})`;
 }
 function toDto(row) {
     return serializeRow(row, {
@@ -48,20 +77,30 @@ export class KycVerificationService {
     }
     async submit(userId, input, meta) {
         const result = await this.kycAdapter.submit(userId, input.documents.map((d) => ({ type: d.type, frontUrl: d.frontUrl, backUrl: d.backUrl })));
-        const status = mapVendorStatus(result.status);
+        const mappedStatus = mapVendorStatus(result.status);
+        const incompleteCheck = mappedStatus === 'approved' ? findIncompleteCheck(result.checks) : undefined;
+        const status = incompleteCheck ? 'resubmission_requested' : mappedStatus;
+        const decisionReason = incompleteCheck ? describeIncompleteCheck(incompleteCheck) : null;
         const decided = isDecided(status);
-        const row = findOneOrThrow(await this.drizzle.db
-            .insert(kycVerification)
-            .values({
-            userId,
-            provider: this.provider,
-            referenceId: result.referenceId,
-            status,
-            documentTypes: input.documents.map((d) => d.type),
-            triggeredBy: 'submission',
-            decidedAt: decided ? new Date() : null,
-        })
-            .returning(), new KycVerificationNotFoundError(userId));
+        const row = await this.drizzle.db.transaction(async (trx) => {
+            const inserted = findOneOrThrow(await trx
+                .insert(kycVerification)
+                .values({
+                userId,
+                provider: this.provider,
+                referenceId: result.referenceId,
+                status,
+                documentTypes: input.documents.map((d) => d.type),
+                decisionReason,
+                checks: result.checks ?? null,
+                triggeredBy: 'submission',
+                decidedAt: decided ? new Date() : null,
+                decisionReceivedAt: new Date(),
+            })
+                .returning(), new KycVerificationNotFoundError(userId));
+            await this.statusWriter.setStatus(userId, status, { actorId: null, source: 'vendor' }, trx);
+            return inserted;
+        });
         this.events.emit('compliance.kyc.submitted', {
             userId,
             referenceId: result.referenceId,
@@ -69,15 +108,34 @@ export class KycVerificationService {
             ip: meta?.ip ?? null,
             userAgent: meta?.userAgent ?? null,
         });
-        await this.statusWriter.setStatus(userId, status, { actorId: null, source: 'vendor' });
         return { ...toDto(row), verificationUrl: result.verificationUrl };
     }
     /**
      * Idempotent vendor-decision apply (polling + webhook). No-op when the latest record
-     * already holds the mapped status.
+     * already holds the mapped status. `reason`/`documentTypes`/`riskSignals` are only
+     * overwritten when the caller supplies them, and `decidedAt` is stamped only on an
+     * actual decision, so a bare status reconcile never blanks out an earlier one. Emits
+     * `compliance.kyc.high_risk_signal_detected` when the supplied `riskSignals` (never a
+     * preserved prior value) trip `warrantsHighRiskTag`.
+     *
+     * `opts.receivedAt` (when the caller has it - the `kyc-decision-sync` job path always
+     * does, stamped at webhook-arrival time in the router, BEFORE the job queue can
+     * reorder anything) is a monotonicity guard: a decision older than the one already on
+     * file for this referenceId is refused, not applied. The job queue does not honour
+     * `orderingKey` (see bullmq-job-queue.ts), so two decisions for the same reference can
+     * reach here out of arrival order after a retry; without this guard the LATER-arriving
+     * (but actually OLDER) decision would win and silently overwrite a newer, correct one.
+     * A caller with no `receivedAt` (eg a direct `reconcile` call with no job path behind
+     * it) skips the guard entirely - always applies, exactly as before.
+     *
+     * A vendor `approved` is downgraded to `resubmission_requested` when the checks this
+     * call is about to persist (`opts.checks`, falling back to the existing row's `checks`
+     * when the caller supplies none - the SAME value written below, so the gate can never
+     * evaluate a different set of checks than the one that ends up on the row) contain any
+     * non-`approved` entry - see `compliance/AGENTS.md` > KYC workflow completeness.
      */
     // referenceId is the KYC vendor's own reference, not an internal Uuid - stays a plain string.
-    async reconcile(referenceId, vendorStatus, reason) {
+    async reconcile(referenceId, vendorStatus, opts = {}) {
         const [existing] = await this.drizzle.db
             .select()
             .from(kycVerification)
@@ -87,22 +145,80 @@ export class KycVerificationService {
         if (!existing) {
             return null;
         }
-        const status = mapVendorStatus(vendorStatus);
+        const mappedStatus = mapVendorStatus(vendorStatus);
+        const persistedChecks = opts.checks ?? existing.checks ?? undefined;
+        const incompleteCheck = mappedStatus === 'approved' ? findIncompleteCheck(persistedChecks) : undefined;
+        const status = incompleteCheck ? 'resubmission_requested' : mappedStatus;
+        const reasonFromThisReconcile = incompleteCheck
+            ? describeIncompleteCheck(incompleteCheck)
+            : opts.reason;
+        const decisionReason = reasonFromThisReconcile ?? existing.decisionReason;
         if (existing.status === status && existing.decidedAt) {
             return toDto(existing);
         }
-        const row = findOneOrThrow(await this.drizzle.db
-            .update(kycVerification)
-            .set({ status, decisionReason: reason ?? null, decidedAt: new Date() })
-            .where(eq(kycVerification.id, existing.id))
-            .returning(), new KycVerificationNotFoundError(existing.id));
-        await this.statusWriter.setStatus(existing.userId, status, {
-            actorId: null,
-            source: 'webhook',
-            reason,
+        if (opts.receivedAt &&
+            existing.decisionReceivedAt &&
+            opts.receivedAt < existing.decisionReceivedAt) {
+            logger.warn({ referenceId, incoming: opts.receivedAt, current: existing.decisionReceivedAt }, 'stale KYC decision refused: a newer decision is already applied for this reference');
+            return toDto(existing);
+        }
+        const decided = isDecided(status);
+        const row = await this.drizzle.db.transaction(async (trx) => {
+            const updated = findOneOrThrow(await trx
+                .update(kycVerification)
+                .set({
+                status,
+                decisionReason,
+                documentTypes: opts.documentTypes ?? existing.documentTypes,
+                riskSignals: opts.riskSignals ?? existing.riskSignals,
+                checks: persistedChecks ?? null,
+                decidedAt: decided ? new Date() : existing.decidedAt,
+                decisionReceivedAt: opts.receivedAt ?? existing.decisionReceivedAt,
+            })
+                .where(eq(kycVerification.id, existing.id))
+                .returning(), new KycVerificationNotFoundError(existing.id));
+            await this.statusWriter.setStatus(existing.userId, status, { actorId: null, source: 'webhook', reason: reasonFromThisReconcile }, trx);
+            return updated;
         });
+        if (opts.riskSignals && warrantsHighRiskTag(opts.riskSignals)) {
+            this.events.emit('compliance.kyc.high_risk_signal_detected', {
+                userId: existing.userId,
+                referenceId,
+                vpnOrTorDetected: opts.riskSignals.vpnOrTorDetected,
+                dataCenterIpDetected: opts.riskSignals.dataCenterIpDetected,
+                duplicateDeviceDetected: opts.riskSignals.duplicateDeviceDetected,
+                highRiskCountryDetected: opts.riskSignals.highRiskCountryDetected,
+            });
+        }
         return toDto(row);
     }
+    /**
+     * `kyc-decision-sync` job handler, run off the webhook request path. Enriches the
+     * reconcile through `resolveDecision`/`resolveRiskSignals` when the bound adapter
+     * implements them, falling back to a status-only reconcile when it does not. Errors
+     * (notably `PlayerNotFoundError`) propagate so the job queue retries the decision -
+     * see `compliance/AGENTS.md` > Webhook -> job flow. `receivedAt` is the webhook's
+     * arrival time (stamped by the router before enqueue, carried on the job payload) -
+     * passed through to `reconcile` as the monotonicity watermark so a job that runs
+     * out of arrival order (the driver ignores `orderingKey`) can't overwrite a newer
+     * decision with a stale one.
+     */
+    async syncDecision(referenceId, status, receivedAt) {
+        const riskSignals = this.kycAdapter.resolveRiskSignals
+            ? await this.kycAdapter.resolveRiskSignals(referenceId)
+            : undefined;
+        if (!this.kycAdapter.resolveDecision) {
+            return this.reconcile(referenceId, status, { riskSignals, receivedAt });
+        }
+        const decision = await this.kycAdapter.resolveDecision(referenceId);
+        return this.reconcile(referenceId, decision.status, {
+            reason: decision.decisionReason,
+            documentTypes: decision.documentTypes,
+            checks: decision.checks,
+            riskSignals,
+            receivedAt,
+        });
+    }
     async getForPlayer(userId) {
         const rows = await this.drizzle.db
             .select()
@@ -112,9 +228,9 @@ export class KycVerificationService {
         return { current: rows[0] ? toDto(rows[0]) : null, history: rows.map(toDto) };
     }
     /**
-     * Deposit-event hook: flips a currently-verified player to `resubmission_requested`
+     * Deposit-event hook: flips a currently-approved player to `resubmission_requested`
      * once cumulative deposits cross a fresh per-currency threshold band. Idempotent twice
-     * over: skips unless presently `verified`, and the watermark stops a re-verified
+     * over: skips unless presently approved, and the watermark stops a re-approved
      * high-roller re-firing on every later deposit.
      */
     async handleDeposit(userId) {
@@ -122,7 +238,7 @@ export class KycVerificationService {
             .select({ currency: player.currency, kycStatus: player.kycStatus })
             .from(player)
             .where(eq(player.userId, userId));
-        if (!current || current.kycStatus !== 'verified') {
+        if (!current || normalizeKycStatus(current.kycStatus) !== 'approved') {
             return;
         }
         const [deposited] = await this.drizzle.db
@@ -164,5 +280,121 @@ export class KycVerificationService {
         });
         this.events.emit('compliance.kyc.reverify_required', { userId, reason });
     }
+    /**
+     * Shared transaction body for `requestResubmission`/`overrideStatus`: inserts the
+     * manual `kyc_verification` history row and calls `KYC_STATUS_WRITER.setStatus` in
+     * the SAME transaction (extracted so the two documented locking/idempotency rules
+     * in `compliance/AGENTS.md` > Admin KYC actions cannot silently diverge between the
+     * two call sites). Caller has already run the idempotency pre-check
+     * (`requirePlayerRowForUpdate` + a status compare) before calling this.
+     */
+    async applyManualDecision(trx, params) {
+        const inserted = findOneOrThrow(await trx
+            .insert(kycVerification)
+            .values({
+            userId: params.userId,
+            provider: MANUAL_PROVIDER,
+            referenceId: `${params.referenceIdPrefix}-${params.userId}-${Date.now()}`,
+            status: params.status,
+            documentTypes: [],
+            triggeredBy: 'manual',
+            decisionReason: params.reason,
+            decidedAt: params.decidedAt,
+        })
+            .returning(), new KycVerificationNotFoundError(params.userId));
+        await this.statusWriter.setStatus(params.userId, params.status, { actorId: params.actorId, reason: params.reason, source: 'manual' }, trx);
+        return toDto(inserted);
+    }
+    /**
+     * Admin-initiated: requests the player resubmit documents. Idempotent on a repeat
+     * call while the player is already at `resubmission_requested` - no duplicate history
+     * row, no duplicate `compliance.kyc.updated` emit. See `compliance/AGENTS.md` >
+     * Admin KYC actions for why the `FOR UPDATE` lock has to sit inside the transaction.
+     */
+    async requestResubmission(userId, reason, actorId) {
+        return this.drizzle.db.transaction(async (trx) => {
+            const current = await this.requirePlayerRowForUpdate(userId, trx);
+            if (normalizeKycStatus(current.kycStatus) === 'resubmission_requested') {
+                return toDto(await this.latestVerificationOrThrow(userId, trx));
+            }
+            return this.applyManualDecision(trx, {
+                userId,
+                status: 'resubmission_requested',
+                reason,
+                actorId,
+                referenceIdPrefix: 'manual-resubmit',
+                decidedAt: null,
+            });
+        });
+    }
+    /**
+     * Admin-initiated: forces the player to an operator-chosen status, guarded by the
+     * router's `compliance:override-limit`. `resolveManualStatus` remaps an `approved`
+     * choice to `manually_overridden`; every other choice is written verbatim. Idempotent
+     * on a repeat call resolving to the status the player already holds. Rationale for
+     * both: `compliance/AGENTS.md` > Admin KYC actions.
+     */
+    async overrideStatus(userId, status, reason, actorId) {
+        const resolvedStatus = resolveManualStatus(status);
+        return this.drizzle.db.transaction(async (trx) => {
+            const current = await this.requirePlayerRowForUpdate(userId, trx);
+            if (normalizeKycStatus(current.kycStatus) === normalizeKycStatus(resolvedStatus)) {
+                return toDto(await this.latestVerificationOrThrow(userId, trx));
+            }
+            return this.applyManualDecision(trx, {
+                userId,
+                status: resolvedStatus,
+                reason,
+                actorId,
+                referenceIdPrefix: 'manual-override',
+                decidedAt: isDecided(resolvedStatus) ? new Date() : null,
+            });
+        });
+    }
+    /**
+     * Admin-initiated: approves every listed player through the same
+     * `overrideStatus('approved', ...)` path, so a bulk approval is recorded identically
+     * to a single one. Bounded fan-out with per-player error isolation - one failure is
+     * captured as a result row rather than aborting the batch, and the returned message
+     * is a fixed string, never the raw exception text (`compliance/AGENTS.md`).
+     */
+    async bulkApprove(userIds, reason, actorId) {
+        return mapConcurrent(userIds, BULK_APPROVE_CONCURRENCY, async (userId) => {
+            try {
+                await this.overrideStatus(userId, 'approved', reason, actorId);
+                return { userId, success: true, error: null };
+            }
+            catch (err) {
+                // Fixed string on the wire, regardless of error type - never the raw exception
+                // text (it can carry the userId, eg PlayerNotFoundError, or a driver/constraint
+                // message). The distinction itself ("not found" vs some other failure) is
+                // already an existence oracle over an id an admin didn't otherwise confirm; the
+                // full error is logged server-side (with userId) for ops.
+                logger.error({ err, userId }, 'bulk KYC approve failed for player');
+                return { userId, success: false, error: 'Failed to approve KYC' };
+            }
+        });
+    }
+    async requirePlayerRowForUpdate(userId, tx) {
+        const rows = await tx
+            .select({ kycStatus: player.kycStatus })
+            .from(player)
+            .where(eq(player.userId, userId))
+            .for('update');
+        const row = rows[0];
+        if (!row) {
+            throw new PlayerNotFoundError(userId);
+        }
+        return row;
+    }
+    async latestVerificationOrThrow(userId, tx = this.drizzle.db) {
+        const rows = await tx
+            .select()
+            .from(kycVerification)
+            .where(eq(kycVerification.userId, userId))
+            .orderBy(desc(kycVerification.createdAt))
+            .limit(1);
+        return findOneOrThrow(rows, new KycVerificationNotFoundError(userId));
+    }
 }
 //# sourceMappingURL=kyc.service.js.map