@openora/core 0.4.1-canary.40 → 0.4.1-canary.42

package/dist/compliance/adapters/hmac-kyc-webhook-verifier.js

@@ -1,4 +1,6 @@
-import { createHmac, timingSafeEqual } from 'node:crypto';
+import { createHash, createHmac, timingSafeEqual } from 'node:crypto';
+import { createLogger } from '@openora/core/server';
+const logger = createLogger('hmac-kyc-webhook-verifier');
 function findHeader(headers, name) {
     const key = Object.keys(headers).find((k) => k.toLowerCase() === name.toLowerCase());
     if (!key) {
@@ -7,18 +9,43 @@ function findHeader(headers, name) {
     const raw = headers[key];
     return Array.isArray(raw) ? (raw[0] ?? null) : (raw ?? null);
 }
+// A captured, genuinely-valid (body, signature) pair never expires on its own - HMAC
+// has no built-in freshness. Reject a signature we've already accepted within this
+// window; only a matching duplicate landing INSIDE the window is ever rejected, which
+// comfortably covers a vendor's own legitimate retry burst (eg Didit's ~5s/2 retries)
+// while still closing most of the "resend a captured payload later" attack. Bounded,
+// not infinite: a store that never forgets grows without limit, and every accepted
+// decision beyond this window still passes through the compliance service's own
+// idempotent DB-guard (KycVerificationService.reconcile) plus its decision-monotonicity
+// check, which refuses to apply a decision older than the one already on file - genuine
+// defense in depth for a replay that outlives this cache entry.
+const REPLAY_WINDOW_MS = 10 * 60 * 1000;
+const REPLAY_CACHE_PREFIX = 'kyc-webhook-seen:';
 /**
  * Default KYC-webhook verifier: recomputes an HMAC-SHA256 of the raw request body
  * keyed by the configured secret and constant-time compares the hex digest against
  * the `x-kyc-signature` header (a leading `sha256=` is tolerated). Fails closed when
  * the secret is unset, the signature is absent, or the body was not captured.
+ *
+ * Also rejects a signature already seen within `REPLAY_WINDOW_MS`, via the `CACHE`
+ * seam - the same port already bound cross-instance when `REDIS_URL` is set (ADR-0028),
+ * so replay detection coordinates across replicas with zero extra wiring; the
+ * in-process default degrades sensibly to per-instance-only protection. A vendor
+ * (eg Didit) may sign only the body, never a timestamp, so a signed-timestamp
+ * freshness check is not an option here - the signature itself is the only
+ * authenticated, replay-detectable value. A `CACHE` failure degrades OPEN (logs and
+ * treats the delivery as unseen) rather than blocking every webhook on an unrelated
+ * infra blip - the signature check above remains the fail-closed primary control;
+ * this is a secondary, best-effort layer.
  */
 export class HmacKycWebhookVerifier {
     secret;
-    constructor(secret) {
+    cache;
+    constructor(secret, cache) {
         this.secret = secret;
+        this.cache = cache;
     }
-    verify(rawBody, headers) {
+    async verify(rawBody, headers) {
         const signature = findHeader(headers, 'x-kyc-signature');
         if (!this.secret || !signature) {
             return false;
@@ -29,10 +56,25 @@ export class HmacKycWebhookVerifier {
         const expected = createHmac('sha256', this.secret).update(rawBody, 'utf8').digest('hex');
         const expectedBuf = Buffer.from(expected, 'utf8');
         const providedBuf = Buffer.from(provided, 'utf8');
-        if (expectedBuf.length !== providedBuf.length) {
+        if (expectedBuf.length !== providedBuf.length || !timingSafeEqual(expectedBuf, providedBuf)) {
             return false;
         }
-        return timingSafeEqual(expectedBuf, providedBuf);
+        return this.acceptOnce(provided);
+    }
+    async acceptOnce(signature) {
+        const key = `${REPLAY_CACHE_PREFIX}${createHash('sha256').update(signature).digest('hex')}`;
+        try {
+            const seen = await this.cache.get(key);
+            if (seen) {
+                return false;
+            }
+            await this.cache.set(key, true, { ttlMs: REPLAY_WINDOW_MS });
+            return true;
+        }
+        catch (err) {
+            logger.warn({ err }, 'kyc webhook replay-check cache unavailable - degrading open');
+            return true;
+        }
     }
 }
 //# sourceMappingURL=hmac-kyc-webhook-verifier.js.map

package/dist/compliance/adapters/hmac-kyc-webhook-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"hmac-kyc-webhook-verifier.js","sourceRoot":"","sources":["../../../src/compliance/adapters/hmac-kyc-webhook-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG1D,SAAS,UAAU,CACjB,OAAsD,EACtD,IAAY;IAEZ,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IACJ;IAA7B,YAA6B,MAA0B;QAA1B,WAAM,GAAN,MAAM,CAAoB;IAAG,CAAC;IAE3D,MAAM,CAAC,OAAe,EAAE,OAAsD;QAC5E,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;YAC9C,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;YACnC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;CACF"}
+{"version":3,"file":"hmac-kyc-webhook-verifier.js","sourceRoot":"","sources":["../../../src/compliance/adapters/hmac-kyc-webhook-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,MAAM,GAAG,YAAY,CAAC,2BAA2B,CAAC,CAAC;AAEzD,SAAS,UAAU,CACjB,OAAsD,EACtD,IAAY;IAEZ,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,qFAAqF;AACrF,mFAAmF;AACnF,sFAAsF;AACtF,sFAAsF;AACtF,qFAAqF;AACrF,mFAAmF;AACnF,gFAAgF;AAChF,wFAAwF;AACxF,wFAAwF;AACxF,gEAAgE;AAChE,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEhD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,sBAAsB;IAEd;IACA;IAFnB,YACmB,MAA0B,EAC1B,KAAmB;QADnB,WAAM,GAAN,MAAM,CAAoB;QAC1B,UAAK,GAAL,KAAK,CAAc;IACnC,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,OAAe,EACf,OAAsD;QAEtD,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;YAC9C,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;YACnC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAC5F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,SAAiB;QACxC,MAAM,GAAG,GAAG,GAAG,mBAAmB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5F,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAO,GAAG,CAAC,CAAC;YAC7C,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,6DAA6D,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/compliance/contract/index.d.ts

@@ -18,6 +18,13 @@ export declare const KycDocumentSchema: z.ZodObject<{
     frontUrl: z.ZodString;
     backUrl: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+export declare const KycRiskSignalsSchema: z.ZodObject<{
+    vpnOrTorDetected: z.ZodBoolean;
+    dataCenterIpDetected: z.ZodBoolean;
+    duplicateDeviceDetected: z.ZodBoolean;
+    highRiskCountryDetected: z.ZodBoolean;
+    deviceFingerprints: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
 export declare const KycVerificationSchema: z.ZodObject<{
     id: z.ZodUUID;
     userId: z.ZodUUID;
@@ -26,6 +33,7 @@ export declare const KycVerificationSchema: z.ZodObject<{
     status: z.ZodEnum<{
         pending: "pending";
         not_started: "not_started";
+        approved: "approved";
         verified: "verified";
         rejected: "rejected";
         resubmission_requested: "resubmission_requested";
@@ -42,6 +50,25 @@ export declare const KycVerificationSchema: z.ZodObject<{
         submission: "submission";
         reverify_threshold: "reverify_threshold";
     }>;
+    riskSignals: z.ZodNullable<z.ZodObject<{
+        vpnOrTorDetected: z.ZodBoolean;
+        dataCenterIpDetected: z.ZodBoolean;
+        duplicateDeviceDetected: z.ZodBoolean;
+        highRiskCountryDetected: z.ZodBoolean;
+        deviceFingerprints: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    checks: z.ZodNullable<z.ZodArray<z.ZodObject<{
+        step: z.ZodString;
+        status: z.ZodEnum<{
+            expired: "expired";
+            unknown: "unknown";
+            not_started: "not_started";
+            approved: "approved";
+            in_progress: "in_progress";
+            in_review: "in_review";
+            declined: "declined";
+        }>;
+    }, z.core.$strip>>>;
     submittedAt: z.ZodISODateTime;
     decidedAt: z.ZodNullable<z.ZodISODateTime>;
     createdAt: z.ZodISODateTime;
@@ -67,6 +94,7 @@ export declare const SubmitKycOutputSchema: z.ZodObject<{
     status: z.ZodEnum<{
         pending: "pending";
         not_started: "not_started";
+        approved: "approved";
         verified: "verified";
         rejected: "rejected";
         resubmission_requested: "resubmission_requested";
@@ -83,6 +111,25 @@ export declare const SubmitKycOutputSchema: z.ZodObject<{
         submission: "submission";
         reverify_threshold: "reverify_threshold";
     }>;
+    riskSignals: z.ZodNullable<z.ZodObject<{
+        vpnOrTorDetected: z.ZodBoolean;
+        dataCenterIpDetected: z.ZodBoolean;
+        duplicateDeviceDetected: z.ZodBoolean;
+        highRiskCountryDetected: z.ZodBoolean;
+        deviceFingerprints: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    checks: z.ZodNullable<z.ZodArray<z.ZodObject<{
+        step: z.ZodString;
+        status: z.ZodEnum<{
+            expired: "expired";
+            unknown: "unknown";
+            not_started: "not_started";
+            approved: "approved";
+            in_progress: "in_progress";
+            in_review: "in_review";
+            declined: "declined";
+        }>;
+    }, z.core.$strip>>>;
     submittedAt: z.ZodISODateTime;
     decidedAt: z.ZodNullable<z.ZodISODateTime>;
     createdAt: z.ZodISODateTime;
@@ -99,6 +146,7 @@ export declare const PlayerKycViewSchema: z.ZodObject<{
         status: z.ZodEnum<{
             pending: "pending";
             not_started: "not_started";
+            approved: "approved";
             verified: "verified";
             rejected: "rejected";
             resubmission_requested: "resubmission_requested";
@@ -115,6 +163,25 @@ export declare const PlayerKycViewSchema: z.ZodObject<{
             submission: "submission";
             reverify_threshold: "reverify_threshold";
         }>;
+        riskSignals: z.ZodNullable<z.ZodObject<{
+            vpnOrTorDetected: z.ZodBoolean;
+            dataCenterIpDetected: z.ZodBoolean;
+            duplicateDeviceDetected: z.ZodBoolean;
+            highRiskCountryDetected: z.ZodBoolean;
+            deviceFingerprints: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        checks: z.ZodNullable<z.ZodArray<z.ZodObject<{
+            step: z.ZodString;
+            status: z.ZodEnum<{
+                expired: "expired";
+                unknown: "unknown";
+                not_started: "not_started";
+                approved: "approved";
+                in_progress: "in_progress";
+                in_review: "in_review";
+                declined: "declined";
+            }>;
+        }, z.core.$strip>>>;
         submittedAt: z.ZodISODateTime;
         decidedAt: z.ZodNullable<z.ZodISODateTime>;
         createdAt: z.ZodISODateTime;
@@ -128,6 +195,7 @@ export declare const PlayerKycViewSchema: z.ZodObject<{
         status: z.ZodEnum<{
             pending: "pending";
             not_started: "not_started";
+            approved: "approved";
             verified: "verified";
             rejected: "rejected";
             resubmission_requested: "resubmission_requested";
@@ -144,6 +212,25 @@ export declare const PlayerKycViewSchema: z.ZodObject<{
             submission: "submission";
             reverify_threshold: "reverify_threshold";
         }>;
+        riskSignals: z.ZodNullable<z.ZodObject<{
+            vpnOrTorDetected: z.ZodBoolean;
+            dataCenterIpDetected: z.ZodBoolean;
+            duplicateDeviceDetected: z.ZodBoolean;
+            highRiskCountryDetected: z.ZodBoolean;
+            deviceFingerprints: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        checks: z.ZodNullable<z.ZodArray<z.ZodObject<{
+            step: z.ZodString;
+            status: z.ZodEnum<{
+                expired: "expired";
+                unknown: "unknown";
+                not_started: "not_started";
+                approved: "approved";
+                in_progress: "in_progress";
+                in_review: "in_review";
+                declined: "declined";
+            }>;
+        }, z.core.$strip>>>;
         submittedAt: z.ZodISODateTime;
         decidedAt: z.ZodNullable<z.ZodISODateTime>;
         createdAt: z.ZodISODateTime;
@@ -152,6 +239,50 @@ export declare const PlayerKycViewSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type PlayerKycView = z.infer<typeof PlayerKycViewSchema>;
 export type KycVerification = z.infer<typeof KycVerificationSchema>;
+export declare const RequestKycResubmissionInputSchema: z.ZodObject<{
+    userId: z.ZodUUID;
+    reason: z.ZodString;
+}, z.core.$strip>;
+export type RequestKycResubmissionInput = z.infer<typeof RequestKycResubmissionInputSchema>;
+export declare const KycOverrideStatusSchema: z.ZodEnum<{
+    pending: "pending";
+    not_started: "not_started";
+    approved: "approved";
+    rejected: "rejected";
+    resubmission_requested: "resubmission_requested";
+}>;
+export type KycOverrideStatus = z.infer<typeof KycOverrideStatusSchema>;
+export declare const OverrideKycStatusInputSchema: z.ZodObject<{
+    userId: z.ZodUUID;
+    status: z.ZodEnum<{
+        pending: "pending";
+        not_started: "not_started";
+        approved: "approved";
+        rejected: "rejected";
+        resubmission_requested: "resubmission_requested";
+    }>;
+    reason: z.ZodString;
+}, z.core.$strip>;
+export type OverrideKycStatusInput = z.infer<typeof OverrideKycStatusInputSchema>;
+export declare const BulkApproveKycInputSchema: z.ZodObject<{
+    userIds: z.ZodArray<z.ZodUUID>;
+    reason: z.ZodString;
+}, z.core.$strip>;
+export type BulkApproveKycInput = z.infer<typeof BulkApproveKycInputSchema>;
+export declare const BulkApproveKycResultSchema: z.ZodObject<{
+    userId: z.ZodUUID;
+    success: z.ZodBoolean;
+    error: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type BulkApproveKycResult = z.infer<typeof BulkApproveKycResultSchema>;
+export declare const BulkApproveKycOutputSchema: z.ZodObject<{
+    results: z.ZodArray<z.ZodObject<{
+        userId: z.ZodUUID;
+        success: z.ZodBoolean;
+        error: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type BulkApproveKycOutput = z.infer<typeof BulkApproveKycOutputSchema>;
 export declare const GeoRuleSchema: z.ZodObject<{
     id: z.ZodUUID;
     countryCode: z.ZodString;
@@ -558,6 +689,7 @@ export declare const complianceContract: {
             status: z.ZodEnum<{
                 pending: "pending";
                 not_started: "not_started";
+                approved: "approved";
                 verified: "verified";
                 rejected: "rejected";
                 resubmission_requested: "resubmission_requested";
@@ -574,6 +706,25 @@ export declare const complianceContract: {
                 submission: "submission";
                 reverify_threshold: "reverify_threshold";
             }>;
+            riskSignals: z.ZodNullable<z.ZodObject<{
+                vpnOrTorDetected: z.ZodBoolean;
+                dataCenterIpDetected: z.ZodBoolean;
+                duplicateDeviceDetected: z.ZodBoolean;
+                highRiskCountryDetected: z.ZodBoolean;
+                deviceFingerprints: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            checks: z.ZodNullable<z.ZodArray<z.ZodObject<{
+                step: z.ZodString;
+                status: z.ZodEnum<{
+                    expired: "expired";
+                    unknown: "unknown";
+                    not_started: "not_started";
+                    approved: "approved";
+                    in_progress: "in_progress";
+                    in_review: "in_review";
+                    declined: "declined";
+                }>;
+            }, z.core.$strip>>>;
             submittedAt: z.ZodISODateTime;
             decidedAt: z.ZodNullable<z.ZodISODateTime>;
             createdAt: z.ZodISODateTime;
@@ -587,6 +738,7 @@ export declare const complianceContract: {
             status: z.ZodEnum<{
                 pending: "pending";
                 not_started: "not_started";
+                approved: "approved";
                 verified: "verified";
                 rejected: "rejected";
                 resubmission_requested: "resubmission_requested";
@@ -603,6 +755,25 @@ export declare const complianceContract: {
                 submission: "submission";
                 reverify_threshold: "reverify_threshold";
             }>;
+            riskSignals: z.ZodNullable<z.ZodObject<{
+                vpnOrTorDetected: z.ZodBoolean;
+                dataCenterIpDetected: z.ZodBoolean;
+                duplicateDeviceDetected: z.ZodBoolean;
+                highRiskCountryDetected: z.ZodBoolean;
+                deviceFingerprints: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            checks: z.ZodNullable<z.ZodArray<z.ZodObject<{
+                step: z.ZodString;
+                status: z.ZodEnum<{
+                    expired: "expired";
+                    unknown: "unknown";
+                    not_started: "not_started";
+                    approved: "approved";
+                    in_progress: "in_progress";
+                    in_review: "in_review";
+                    declined: "declined";
+                }>;
+            }, z.core.$strip>>>;
             submittedAt: z.ZodISODateTime;
             decidedAt: z.ZodNullable<z.ZodISODateTime>;
             createdAt: z.ZodISODateTime;
@@ -627,6 +798,7 @@ export declare const complianceContract: {
         status: z.ZodEnum<{
             pending: "pending";
             not_started: "not_started";
+            approved: "approved";
             verified: "verified";
             rejected: "rejected";
             resubmission_requested: "resubmission_requested";
@@ -643,6 +815,25 @@ export declare const complianceContract: {
             submission: "submission";
             reverify_threshold: "reverify_threshold";
         }>;
+        riskSignals: z.ZodNullable<z.ZodObject<{
+            vpnOrTorDetected: z.ZodBoolean;
+            dataCenterIpDetected: z.ZodBoolean;
+            duplicateDeviceDetected: z.ZodBoolean;
+            highRiskCountryDetected: z.ZodBoolean;
+            deviceFingerprints: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        checks: z.ZodNullable<z.ZodArray<z.ZodObject<{
+            step: z.ZodString;
+            status: z.ZodEnum<{
+                expired: "expired";
+                unknown: "unknown";
+                not_started: "not_started";
+                approved: "approved";
+                in_progress: "in_progress";
+                in_review: "in_review";
+                declined: "declined";
+            }>;
+        }, z.core.$strip>>>;
         submittedAt: z.ZodISODateTime;
         decidedAt: z.ZodNullable<z.ZodISODateTime>;
         createdAt: z.ZodISODateTime;
@@ -652,6 +843,127 @@ export declare const complianceContract: {
     kycWebhook: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodObject<{
         ok: z.ZodLiteral<true>;
     }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    requestKycResubmission: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        userId: z.ZodUUID;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        id: z.ZodUUID;
+        userId: z.ZodUUID;
+        provider: z.ZodString;
+        referenceId: z.ZodString;
+        status: z.ZodEnum<{
+            pending: "pending";
+            not_started: "not_started";
+            approved: "approved";
+            verified: "verified";
+            rejected: "rejected";
+            resubmission_requested: "resubmission_requested";
+            manually_overridden: "manually_overridden";
+        }>;
+        documentTypes: z.ZodArray<z.ZodEnum<{
+            passport: "passport";
+            drivers_license: "drivers_license";
+            national_id: "national_id";
+        }>>;
+        decisionReason: z.ZodNullable<z.ZodString>;
+        triggeredBy: z.ZodEnum<{
+            manual: "manual";
+            submission: "submission";
+            reverify_threshold: "reverify_threshold";
+        }>;
+        riskSignals: z.ZodNullable<z.ZodObject<{
+            vpnOrTorDetected: z.ZodBoolean;
+            dataCenterIpDetected: z.ZodBoolean;
+            duplicateDeviceDetected: z.ZodBoolean;
+            highRiskCountryDetected: z.ZodBoolean;
+            deviceFingerprints: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        checks: z.ZodNullable<z.ZodArray<z.ZodObject<{
+            step: z.ZodString;
+            status: z.ZodEnum<{
+                expired: "expired";
+                unknown: "unknown";
+                not_started: "not_started";
+                approved: "approved";
+                in_progress: "in_progress";
+                in_review: "in_review";
+                declined: "declined";
+            }>;
+        }, z.core.$strip>>>;
+        submittedAt: z.ZodISODateTime;
+        decidedAt: z.ZodNullable<z.ZodISODateTime>;
+        createdAt: z.ZodISODateTime;
+        updatedAt: z.ZodISODateTime;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    overrideKycStatus: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        userId: z.ZodUUID;
+        status: z.ZodEnum<{
+            pending: "pending";
+            not_started: "not_started";
+            approved: "approved";
+            rejected: "rejected";
+            resubmission_requested: "resubmission_requested";
+        }>;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        id: z.ZodUUID;
+        userId: z.ZodUUID;
+        provider: z.ZodString;
+        referenceId: z.ZodString;
+        status: z.ZodEnum<{
+            pending: "pending";
+            not_started: "not_started";
+            approved: "approved";
+            verified: "verified";
+            rejected: "rejected";
+            resubmission_requested: "resubmission_requested";
+            manually_overridden: "manually_overridden";
+        }>;
+        documentTypes: z.ZodArray<z.ZodEnum<{
+            passport: "passport";
+            drivers_license: "drivers_license";
+            national_id: "national_id";
+        }>>;
+        decisionReason: z.ZodNullable<z.ZodString>;
+        triggeredBy: z.ZodEnum<{
+            manual: "manual";
+            submission: "submission";
+            reverify_threshold: "reverify_threshold";
+        }>;
+        riskSignals: z.ZodNullable<z.ZodObject<{
+            vpnOrTorDetected: z.ZodBoolean;
+            dataCenterIpDetected: z.ZodBoolean;
+            duplicateDeviceDetected: z.ZodBoolean;
+            highRiskCountryDetected: z.ZodBoolean;
+            deviceFingerprints: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        checks: z.ZodNullable<z.ZodArray<z.ZodObject<{
+            step: z.ZodString;
+            status: z.ZodEnum<{
+                expired: "expired";
+                unknown: "unknown";
+                not_started: "not_started";
+                approved: "approved";
+                in_progress: "in_progress";
+                in_review: "in_review";
+                declined: "declined";
+            }>;
+        }, z.core.$strip>>>;
+        submittedAt: z.ZodISODateTime;
+        decidedAt: z.ZodNullable<z.ZodISODateTime>;
+        createdAt: z.ZodISODateTime;
+        updatedAt: z.ZodISODateTime;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    bulkApproveKyc: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        userIds: z.ZodArray<z.ZodUUID>;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        results: z.ZodArray<z.ZodObject<{
+            userId: z.ZodUUID;
+            success: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
 };
 export * from './limits.js';
 export * from './rg.js';

package/dist/compliance/contract/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/compliance/contract/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAYzB,eAAO,MAAM,qBAAqB;;;;EAA6B,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;EAA2B,CAAC;AAE7D,eAAO,MAAM,iBAAiB;;;;;;;;iBAI5B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAahC,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;iBAE/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,aAAa;;;;;;;;iBAKxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAIpD,eAAO,MAAM,qBAAqB;;;;;;iBAA0D,CAAC;AAC7F,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAQpE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwC9B,CAAC;AAEF,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/compliance/contract/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAazB,eAAO,MAAM,qBAAqB;;;;EAA6B,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;EAA2B,CAAC;AAE7D,eAAO,MAAM,iBAAiB;;;;;;;;iBAI5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;iBAM/B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAehC,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;iBAE/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIpE,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,uBAAuB;;;;;;EAA+D,CAAC;AACpG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;;;;;;;iBAIvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF,eAAO,MAAM,yBAAyB;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,0BAA0B;;;;;;iBAErC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,aAAa;;;;;;;;iBAKxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAIpD,eAAO,MAAM,qBAAqB;;;;;;iBAA0D,CAAC;AAC7F,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAQpE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuD9B,CAAC;AAEF,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC"}

package/dist/compliance/contract/index.js

@@ -1,6 +1,6 @@
 import { oc } from '@orpc/contract';
 import * as z from 'zod';
-import { UuidSchema, KycStatusSchema, TimestampSchema, CountryCodeSchema, GeoRuleActionSchema, } from '@openora/core/contracts';
+import { UuidSchema, KycStatusSchema, KycCheckResultSchema, TimestampSchema, CountryCodeSchema, GeoRuleActionSchema, } from '@openora/core/contracts';
 import { KYC_DOCUMENT_TYPES, KYC_TRIGGERED_BY } from './enums.js';
 import { LimitSchema, UpsertLimitInputSchema } from './limits.js';
 import { rgContract } from './rg.js';
@@ -11,6 +11,13 @@ export const KycDocumentSchema = z.object({
     frontUrl: z.string().min(1),
     backUrl: z.string().min(1).optional(),
 });
+export const KycRiskSignalsSchema = z.object({
+    vpnOrTorDetected: z.boolean(),
+    dataCenterIpDetected: z.boolean(),
+    duplicateDeviceDetected: z.boolean(),
+    highRiskCountryDetected: z.boolean(),
+    deviceFingerprints: z.array(z.string()),
+});
 export const KycVerificationSchema = z.object({
     id: UuidSchema,
     userId: UuidSchema,
@@ -20,6 +27,8 @@ export const KycVerificationSchema = z.object({
     documentTypes: z.array(KycDocumentTypeSchema),
     decisionReason: z.string().nullable(),
     triggeredBy: KycTriggeredBySchema,
+    riskSignals: KycRiskSignalsSchema.nullable(),
+    checks: z.array(KycCheckResultSchema).nullable(),
     submittedAt: TimestampSchema,
     decidedAt: TimestampSchema.nullable(),
     createdAt: TimestampSchema,
@@ -35,6 +44,34 @@ export const PlayerKycViewSchema = z.object({
     current: KycVerificationSchema.nullable(),
     history: z.array(KycVerificationSchema),
 });
+const NonEmptyReasonSchema = z.string().trim().min(1);
+export const RequestKycResubmissionInputSchema = z.object({
+    userId: UuidSchema,
+    reason: NonEmptyReasonSchema,
+});
+export const KycOverrideStatusSchema = KycStatusSchema.exclude(['verified', 'manually_overridden']);
+export const OverrideKycStatusInputSchema = z.object({
+    userId: UuidSchema,
+    status: KycOverrideStatusSchema,
+    reason: NonEmptyReasonSchema,
+});
+const MAX_BULK_KYC_APPROVE_USERS = 100;
+export const BulkApproveKycInputSchema = z.object({
+    userIds: z
+        .array(UuidSchema)
+        .min(1)
+        .max(MAX_BULK_KYC_APPROVE_USERS)
+        .refine((ids) => new Set(ids).size === ids.length, { message: 'userIds must be unique' }),
+    reason: NonEmptyReasonSchema,
+});
+export const BulkApproveKycResultSchema = z.object({
+    userId: UuidSchema,
+    success: z.boolean(),
+    error: z.string().nullable(),
+});
+export const BulkApproveKycOutputSchema = z.object({
+    results: z.array(BulkApproveKycResultSchema),
+});
 export const GeoRuleSchema = z.object({
     id: UuidSchema,
     countryCode: CountryCodeSchema,
@@ -78,6 +115,18 @@ export const complianceContract = {
         .route({ method: 'POST', path: '/compliance/kyc/webhook' })
         .input(z.record(z.string(), z.unknown()))
         .output(z.object({ ok: z.literal(true) })),
+    requestKycResubmission: oc
+        .route({ method: 'POST', path: '/compliance/players/{userId}/kyc/resubmit' })
+        .input(RequestKycResubmissionInputSchema)
+        .output(KycVerificationSchema),
+    overrideKycStatus: oc
+        .route({ method: 'POST', path: '/compliance/players/{userId}/kyc/override' })
+        .input(OverrideKycStatusInputSchema)
+        .output(KycVerificationSchema),
+    bulkApproveKyc: oc
+        .route({ method: 'POST', path: '/compliance/kyc/bulk-approve' })
+        .input(BulkApproveKycInputSchema)
+        .output(BulkApproveKycOutputSchema),
     ...rgContract,
 };
 export * from './limits.js';

package/dist/compliance/contract/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/compliance/contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EACL,UAAU,EACV,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,qBAAqB;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,UAAU;IACd,MAAM,EAAE,UAAU;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,eAAe;IACvB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,oBAAoB;IACjC,WAAW,EAAE,eAAe;IAC5B,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;CACtC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAChE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;CACxC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,UAAU;IACd,WAAW,EAAE,iBAAiB;IAC9B,MAAM,EAAE,mBAAmB;IAC3B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAGH,MAAM,sBAAsB,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAG7F,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAE/F,WAAW,EAAE,EAAE;SACZ,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;SACpD,KAAK,CAAC,sBAAsB,CAAC;SAC7B,MAAM,CAAC,WAAW,CAAC;IAEtB,WAAW,EAAE,EAAE;SACZ,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;SAC5D,KAAK,CAAC,sBAAsB,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEjD,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC;IAEjG,UAAU,EAAE,EAAE;SACX,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;SACxD,KAAK,CAAC,qBAAqB,CAAC;SAC5B,MAAM,CAAC,aAAa,CAAC;IAExB,YAAY,EAAE,EAAE;SACb,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;SACvD,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAEjC,YAAY,EAAE,EAAE;SACb,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC;SAClE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;SACvC,MAAM,CAAC,mBAAmB,CAAC;IAE9B,SAAS,EAAE,EAAE;SACV,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAClD,KAAK,CAAC,oBAAoB,CAAC;SAC3B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,UAAU,EAAE,EAAE;SACX,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;SAC1D,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;SACxC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE5C,GAAG,UAAU;CACd,CAAC;AAEF,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/compliance/contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EACL,UAAU,EACV,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,qBAAqB;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE;IACjC,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,UAAU;IACd,MAAM,EAAE,UAAU;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,eAAe;IACvB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,oBAAoB;IACjC,WAAW,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,eAAe;IAC5B,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;CACtC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAChE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;CACxC,CAAC,CAAC;AAIH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,oBAAoB;CAC7B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAGpG,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,oBAAoB;CAC7B,CAAC,CAAC;AAGH,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,UAAU,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,0BAA0B,CAAC;SAC/B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAC3F,MAAM,EAAE,oBAAoB;CAC7B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;CAC7C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,UAAU;IACd,WAAW,EAAE,iBAAiB;IAC9B,MAAM,EAAE,mBAAmB;IAC3B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAGH,MAAM,sBAAsB,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAG7F,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAE/F,WAAW,EAAE,EAAE;SACZ,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;SACpD,KAAK,CAAC,sBAAsB,CAAC;SAC7B,MAAM,CAAC,WAAW,CAAC;IAEtB,WAAW,EAAE,EAAE;SACZ,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;SAC5D,KAAK,CAAC,sBAAsB,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEjD,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC;IAEjG,UAAU,EAAE,EAAE;SACX,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;SACxD,KAAK,CAAC,qBAAqB,CAAC;SAC5B,MAAM,CAAC,aAAa,CAAC;IAExB,YAAY,EAAE,EAAE;SACb,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;SACvD,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAEjC,YAAY,EAAE,EAAE;SACb,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC;SAClE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;SACvC,MAAM,CAAC,mBAAmB,CAAC;IAE9B,SAAS,EAAE,EAAE;SACV,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAClD,KAAK,CAAC,oBAAoB,CAAC;SAC3B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,UAAU,EAAE,EAAE;SACX,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;SAC1D,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;SACxC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE5C,sBAAsB,EAAE,EAAE;SACvB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC;SAC5E,KAAK,CAAC,iCAAiC,CAAC;SACxC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,iBAAiB,EAAE,EAAE;SAClB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC;SAC5E,KAAK,CAAC,4BAA4B,CAAC;SACnC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,cAAc,EAAE,EAAE;SACf,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC;SAC/D,KAAK,CAAC,yBAAyB,CAAC;SAChC,MAAM,CAAC,0BAA0B,CAAC;IAErC,GAAG,UAAU;CACd,CAAC;AAEF,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC"}

package/dist/compliance/drizzle/migrations/0002_condemned_monster_badoon.sql

@@ -0,0 +1,3 @@
+ALTER TYPE "public"."kyc_verification_status" ADD VALUE 'approved' BEFORE 'verified';--> statement-breakpoint
+ALTER TABLE "kyc_verification" ADD COLUMN "risk_signals" jsonb;--> statement-breakpoint
+ALTER TABLE "kyc_verification" ADD COLUMN "decision_received_at" timestamp with time zone;

package/dist/compliance/drizzle/migrations/0003_public_spirit.sql

@@ -0,0 +1 @@
+ALTER TABLE "kyc_verification" ADD COLUMN "checks" jsonb;