@openora/core 0.4.1-canary.57 → 0.4.1-canary.59

package/dist/contracts/adapters/login-enforcement.js

@@ -1,9 +1,11 @@
-// Push port for Responsible-Gambling login enforcement. Owned + bound by the identity
-// module (it owns the `user` table); compliance depends only on this port to block or
-// unblock a player's login, never on the identity schema. `block` also revokes all of
-// the player's active sessions (the RG session-termination requirement). `until: null`
-// means an indefinite block (self-exclusion / permanent); a Date is the cooling-off
-// expiry the login gate auto-clears once elapsed. See ADR-0017.
+/**
+ * Push port for Responsible-Gambling login enforcement. Owned + bound by the identity
+ * module (it owns the `user` table); compliance depends only on this port to block or
+ * unblock a player's login, never on the identity schema. `block` also revokes all of
+ * the player's active sessions (the RG session-termination requirement). `until: null`
+ * means an indefinite block (self-exclusion / permanent); a Date is the cooling-off
+ * expiry the login gate auto-clears once elapsed. See ADR-0017.
+ */
 import { createToken } from './token.js';
 export const LOGIN_ENFORCEMENT = createToken('LOGIN_ENFORCEMENT');
 //# sourceMappingURL=login-enforcement.js.map

package/dist/contracts/adapters/login-enforcement.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-enforcement.js","sourceRoot":"","sources":["../../../src/contracts/adapters/login-enforcement.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,oFAAoF;AACpF,gEAAgE;AAChE,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAOrD,MAAM,CAAC,MAAM,iBAAiB,GAAgC,WAAW,CAAC,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"login-enforcement.js","sourceRoot":"","sources":["../../../src/contracts/adapters/login-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAOrD,MAAM,CAAC,MAAM,iBAAiB,GAAgC,WAAW,CAAC,mBAAmB,CAAC,CAAC"}

package/dist/contracts/adapters/notification.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Notification-delivery seam. Custom implementation expected (no prescribed vendor).
+ * The notifications module ships MockNotificationDeliveryAdapter (logs to stdout) as default.
+ * Override via overlay: ctx.provide(NOTIFICATION_DELIVERY_ADAPTER, () => new MyAdapter())
+ * Load your overlay AFTER the notifications plugin in extensions.config.ts (last registration wins).
+ * See docs/adapters/notification.md for the full binding guide.
+ */
 import { type Token } from './token.js';
 export type NotificationDeliveryAdapter = {
     sendEmail(to: string, subject: string, body: string): Promise<void>;

package/dist/contracts/adapters/notification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notification.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/notification.ts"],"names":[],"mappings":"AAKA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,2BAA2B,GAAG;IACxC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,KAAK,CAAC,2BAA2B,CAE5E,CAAC"}
+{"version":3,"file":"notification.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/notification.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,2BAA2B,GAAG;IACxC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,KAAK,CAAC,2BAA2B,CAE5E,CAAC"}

package/dist/contracts/adapters/notification.js

@@ -1,8 +1,10 @@
-// Notification-delivery seam. Custom implementation expected (no prescribed vendor).
-// The notifications module ships MockNotificationDeliveryAdapter (logs to stdout) as default.
-// Override via overlay: ctx.provide(NOTIFICATION_DELIVERY_ADAPTER, () => new MyAdapter())
-// Load your overlay AFTER the notifications plugin in extensions.config.ts (last registration wins).
-// See docs/adapters/notification.md for the full binding guide.
+/**
+ * Notification-delivery seam. Custom implementation expected (no prescribed vendor).
+ * The notifications module ships MockNotificationDeliveryAdapter (logs to stdout) as default.
+ * Override via overlay: ctx.provide(NOTIFICATION_DELIVERY_ADAPTER, () => new MyAdapter())
+ * Load your overlay AFTER the notifications plugin in extensions.config.ts (last registration wins).
+ * See docs/adapters/notification.md for the full binding guide.
+ */
 import { createToken } from './token.js';
 export const NOTIFICATION_DELIVERY_ADAPTER = createToken('NOTIFICATION_DELIVERY_ADAPTER');
 //# sourceMappingURL=notification.js.map

package/dist/contracts/adapters/notification.js.map

@@ -1 +1 @@
-{"version":3,"file":"notification.js","sourceRoot":"","sources":["../../../src/contracts/adapters/notification.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,8FAA8F;AAC9F,0FAA0F;AAC1F,qGAAqG;AACrG,gEAAgE;AAChE,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAMrD,MAAM,CAAC,MAAM,6BAA6B,GAAuC,WAAW,CAC1F,+BAA+B,CAChC,CAAC"}
+{"version":3,"file":"notification.js","sourceRoot":"","sources":["../../../src/contracts/adapters/notification.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAMrD,MAAM,CAAC,MAAM,6BAA6B,GAAuC,WAAW,CAC1F,+BAA+B,CAChC,CAAC"}

package/dist/contracts/adapters/outbox.d.ts

@@ -1,3 +1,17 @@
+/**
+ * Transactional-outbox seam. A money/critical service, INSIDE its db.transaction,
+ * records the event through this port; the row commits atomically with the state
+ * change. A relay then publishes it to the MESSAGE_BROKER after commit, closing
+ * the gap where a crash between "state committed" and "event published" would
+ * otherwise lose the event. This is the primitive that makes cross-service,
+ * at-least-once domain events reliable - and the reason a module can be extracted
+ * to its own process without dropping events. See ADR-0016.
+ *
+ * `tx` is the active transaction handle, typed `unknown` here to keep @openora/core/contracts
+ * ORM-free; the Drizzle implementation in @openora/core/server narrows it. Services never touch
+ * this port directly - they call EventBus.emitInTransaction(tx, ...), which builds
+ * the envelope and delegates here.
+ */
 import { type Token } from './token.js';
 import type { EventEnvelope } from './broker.js';
 export type OutboxWriter = {

package/dist/contracts/adapters/outbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"outbox.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/outbox.ts"],"names":[],"mappings":"AAYA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,YAAY,CAAyB,CAAC"}
+{"version":3,"file":"outbox.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/outbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,YAAY,CAAyB,CAAC"}

package/dist/contracts/adapters/outbox.js

@@ -1,15 +1,17 @@
-// Transactional-outbox seam. A money/critical service, INSIDE its db.transaction,
-// records the event through this port; the row commits atomically with the state
-// change. A relay then publishes it to the MESSAGE_BROKER after commit, closing
-// the gap where a crash between "state committed" and "event published" would
-// otherwise lose the event. This is the primitive that makes cross-service,
-// at-least-once domain events reliable - and the reason a module can be extracted
-// to its own process without dropping events. See ADR-0016.
-//
-// `tx` is the active transaction handle, typed `unknown` here to keep @openora/core/contracts
-// ORM-free; the Drizzle implementation in @openora/core/server narrows it. Services never touch
-// this port directly - they call EventBus.emitInTransaction(tx, ...), which builds
-// the envelope and delegates here.
+/**
+ * Transactional-outbox seam. A money/critical service, INSIDE its db.transaction,
+ * records the event through this port; the row commits atomically with the state
+ * change. A relay then publishes it to the MESSAGE_BROKER after commit, closing
+ * the gap where a crash between "state committed" and "event published" would
+ * otherwise lose the event. This is the primitive that makes cross-service,
+ * at-least-once domain events reliable - and the reason a module can be extracted
+ * to its own process without dropping events. See ADR-0016.
+ *
+ * `tx` is the active transaction handle, typed `unknown` here to keep @openora/core/contracts
+ * ORM-free; the Drizzle implementation in @openora/core/server narrows it. Services never touch
+ * this port directly - they call EventBus.emitInTransaction(tx, ...), which builds
+ * the envelope and delegates here.
+ */
 import { createToken } from './token.js';
 export const OUTBOX = createToken('OUTBOX');
 //# sourceMappingURL=outbox.js.map

package/dist/contracts/adapters/outbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"outbox.js","sourceRoot":"","sources":["../../../src/contracts/adapters/outbox.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,kFAAkF;AAClF,4DAA4D;AAC5D,EAAE;AACF,8FAA8F;AAC9F,gGAAgG;AAChG,mFAAmF;AACnF,mCAAmC;AACnC,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAOrD,MAAM,CAAC,MAAM,MAAM,GAAwB,WAAW,CAAC,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"outbox.js","sourceRoot":"","sources":["../../../src/contracts/adapters/outbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAOrD,MAAM,CAAC,MAAM,MAAM,GAAwB,WAAW,CAAC,QAAQ,CAAC,CAAC"}

package/dist/contracts/adapters/payment.d.ts

@@ -1,3 +1,8 @@
+/**
+ * Payment seam. A PSP (card/bank/e-wallet) or a custody/address-issuing crypto vendor
+ * implements PaymentAdapter; bind a concrete adapter to PAYMENT_ADAPTER in the wallet
+ * module's plugin.ts. See docs/adapters/payment.md for the full binding guide.
+ */
 import { type Token } from './token.js';
 /**
  * Normalized shape of an inbound payment-vendor webhook, produced by a

package/dist/contracts/adapters/payment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payment.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/payment.ts"],"names":[],"mappings":"AAGA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,YAAY,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN,MAAM,MAAM,cAAc,GAAG;IAC3B,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEnD;;;;;;;;OAQG;IACH,iBAAiB,CACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEnD;;;;;;OAMG;IACH,mBAAmB,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAErF;;;;OAIG;IACH,YAAY,CAAC,CACX,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,mBAAmB,GAAG,IAAI,CAAC;CAC/B,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,cAAc,CAAkC,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC;CAC1F,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,sBAAsB,CAElE,CAAC"}
+{"version":3,"file":"payment.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/payment.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,YAAY,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN,MAAM,MAAM,cAAc,GAAG;IAC3B,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEnD;;;;;;;;OAQG;IACH,iBAAiB,CACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEnD;;;;;;OAMG;IACH,mBAAmB,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAErF;;;;OAIG;IACH,YAAY,CAAC,CACX,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,mBAAmB,GAAG,IAAI,CAAC;CAC/B,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,cAAc,CAAkC,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC;CAC1F,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,sBAAsB,CAElE,CAAC"}

package/dist/contracts/adapters/payment.js

@@ -1,6 +1,8 @@
-// Payment seam. A PSP (card/bank/e-wallet) or a custody/address-issuing crypto vendor
-// implements PaymentAdapter; bind a concrete adapter to PAYMENT_ADAPTER in the wallet
-// module's plugin.ts. See docs/adapters/payment.md for the full binding guide.
+/**
+ * Payment seam. A PSP (card/bank/e-wallet) or a custody/address-issuing crypto vendor
+ * implements PaymentAdapter; bind a concrete adapter to PAYMENT_ADAPTER in the wallet
+ * module's plugin.ts. See docs/adapters/payment.md for the full binding guide.
+ */
 import { createToken } from './token.js';
 export const PAYMENT_ADAPTER = createToken('PAYMENT_ADAPTER');
 export const PAYMENT_WEBHOOK_VERIFIER = createToken('PAYMENT_WEBHOOK_VERIFIER');

package/dist/contracts/adapters/payment.js.map

@@ -1 +1 @@
-{"version":3,"file":"payment.js","sourceRoot":"","sources":["../../../src/contracts/adapters/payment.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,sFAAsF;AACtF,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAoErD,MAAM,CAAC,MAAM,eAAe,GAA0B,WAAW,CAAC,iBAAiB,CAAC,CAAC;AAarF,MAAM,CAAC,MAAM,wBAAwB,GAAkC,WAAW,CAChF,0BAA0B,CAC3B,CAAC"}
+{"version":3,"file":"payment.js","sourceRoot":"","sources":["../../../src/contracts/adapters/payment.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAoErD,MAAM,CAAC,MAAM,eAAe,GAA0B,WAAW,CAAC,iBAAiB,CAAC,CAAC;AAarF,MAAM,CAAC,MAAM,wBAAwB,GAAkC,WAAW,CAChF,0BAA0B,CAC3B,CAAC"}

package/dist/contracts/adapters/player-tags.d.ts

@@ -1,5 +1,9 @@
 import { type Token } from './token.js';
 import type { TagKey } from '../schemas/tag.js';
+/**
+ * Read-only seam letting the wallet auto-withdrawal evaluator query a player's tags
+ * without importing the tag module's schema (module isolation). Absent from the map == no active tags.
+ */
 export type PlayerTags = {
     getActiveTagKeys(userIds: readonly string[]): Promise<Map<string, TagKey[]>>;
 };

package/dist/contracts/adapters/player-tags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"player-tags.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/player-tags.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAIhD,MAAM,MAAM,UAAU,GAAG;IACvB,gBAAgB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;CAC9E,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC"}
+{"version":3,"file":"player-tags.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/player-tags.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,gBAAgB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;CAC9E,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC"}

package/dist/contracts/adapters/player-tags.js.map

@@ -1 +1 @@
-{"version":3,"file":"player-tags.js","sourceRoot":"","sources":["../../../src/contracts/adapters/player-tags.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AASrD,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC"}
+{"version":3,"file":"player-tags.js","sourceRoot":"","sources":["../../../src/contracts/adapters/player-tags.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAWrD,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC"}

package/dist/contracts/adapters/rate-limit.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Rate-limiter seam. Abuse-prone routes (auth flows, money mutations) consume
+ * from this adapter so the throttling backend is swappable: the default binding
+ * is an in-process fixed-window limiter (zero deps - good for `pnpm dev`, seed
+ * and tests), process-local so it does NOT coordinate across replicas. Set
+ * REDIS_URL to bind the shipped Redis reference adapter (distributed fixed-window)
+ * with zero consumer code; rebind RATE_LIMITER via an overlay for any other backend.
+ */
 import { type Token } from './token.js';
 export declare const RATE_LIMIT_KEYS: {
     readonly REGISTER: "register";
@@ -14,17 +22,26 @@ export declare const RATE_LIMIT_KEYS: {
     readonly WALLET_MUTATION: "wallet-mutation";
     readonly CHAT_ROOM_JOIN: "chat-room-join";
     readonly CHAT_SEND: "chat-send";
+    readonly REPORT_ACCESS_DENIED: "report-access-denied";
 };
 export type RateLimitKeyPrefix = (typeof RATE_LIMIT_KEYS)[keyof typeof RATE_LIMIT_KEYS];
 export type RateLimitKey = `${RateLimitKeyPrefix}:${string}`;
 export declare function makeRateLimitKey(prefix: RateLimitKeyPrefix, id: string): RateLimitKey;
 export type RateLimitOptions = {
+    /** Max allowed consumptions per window per key. */
     limit: number;
     windowMs: number;
+    /**
+     * What to do when the backing store is unreachable: 'allow' keeps availability
+     * (throttling pauses during an outage); 'deny' fails closed for keys where an
+     * unthrottled window is worse than a 429 (credential guessing). Default 'allow'.
+     * The in-process default is never unavailable, so it ignores this.
+     */
     onUnavailable?: 'allow' | 'deny';
 };
 export type RateLimitResult = {
     allowed: boolean;
+    /** Milliseconds until the window resets. 0 when allowed. */
     retryAfterMs: number;
 };
 export type RateLimiterAdapter<Key extends string = string> = {

package/dist/contracts/adapters/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/rate-limit.ts"],"names":[],"mappings":"AAMA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;CAelB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAExF,MAAM,MAAM,YAAY,GAAG,GAAG,kBAAkB,IAAI,MAAM,EAAE,CAAC;AAE7D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAErF;AAED,MAAM,MAAM,gBAAgB,GAAG;IAE7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IAKjB,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,OAAO,CAAC;IAEjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI;IAC5D,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACpE,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAA+B,CAAC"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;CAgBlB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAExF,MAAM,MAAM,YAAY,GAAG,GAAG,kBAAkB,IAAI,MAAM,EAAE,CAAC;AAE7D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAErF;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI;IAC5D,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACpE,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAA+B,CAAC"}

package/dist/contracts/adapters/rate-limit.js

@@ -1,9 +1,11 @@
-// Rate-limiter seam. Abuse-prone routes (auth flows, money mutations) consume
-// from this adapter so the throttling backend is swappable: the default binding
-// is an in-process fixed-window limiter (zero deps - good for `pnpm dev`, seed
-// and tests), process-local so it does NOT coordinate across replicas. Set
-// REDIS_URL to bind the shipped Redis reference adapter (distributed fixed-window)
-// with zero consumer code; rebind RATE_LIMITER via an overlay for any other backend.
+/**
+ * Rate-limiter seam. Abuse-prone routes (auth flows, money mutations) consume
+ * from this adapter so the throttling backend is swappable: the default binding
+ * is an in-process fixed-window limiter (zero deps - good for `pnpm dev`, seed
+ * and tests), process-local so it does NOT coordinate across replicas. Set
+ * REDIS_URL to bind the shipped Redis reference adapter (distributed fixed-window)
+ * with zero consumer code; rebind RATE_LIMITER via an overlay for any other backend.
+ */
 import { createToken } from './token.js';
 export const RATE_LIMIT_KEYS = {
     REGISTER: 'register',
@@ -20,6 +22,7 @@ export const RATE_LIMIT_KEYS = {
     WALLET_MUTATION: 'wallet-mutation',
     CHAT_ROOM_JOIN: 'chat-room-join',
     CHAT_SEND: 'chat-send',
+    REPORT_ACCESS_DENIED: 'report-access-denied',
 };
 export function makeRateLimitKey(prefix, id) {
     return `${prefix}:${id}`;

package/dist/contracts/adapters/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/contracts/adapters/rate-limit.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,2EAA2E;AAC3E,mFAAmF;AACnF,qFAAqF;AACrF,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAErD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,WAAW;IACvB,UAAU,EAAE,WAAW;IACvB,WAAW,EAAE,YAAY;IACzB,sBAAsB,EAAE,aAAa;IACrC,qBAAqB,EAAE,gBAAgB;IACvC,cAAc,EAAE,SAAS;IACzB,eAAe,EAAE,iBAAiB;IAClC,kBAAkB,EAAE,cAAc;IAClC,YAAY,EAAE,cAAc;IAC5B,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,SAAS,EAAE,WAAW;CACd,CAAC;AAMX,MAAM,UAAU,gBAAgB,CAAC,MAA0B,EAAE,EAAU;IACrE,OAAO,GAAG,MAAM,IAAI,EAAE,EAAE,CAAC;AAC3B,CAAC;AAwBD,MAAM,CAAC,MAAM,YAAY,GAA4C,WAAW,CAAC,cAAc,CAAC,CAAC"}
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/contracts/adapters/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAErD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,WAAW;IACvB,UAAU,EAAE,WAAW;IACvB,WAAW,EAAE,YAAY;IACzB,sBAAsB,EAAE,aAAa;IACrC,qBAAqB,EAAE,gBAAgB;IACvC,cAAc,EAAE,SAAS;IACzB,eAAe,EAAE,iBAAiB;IAClC,kBAAkB,EAAE,cAAc;IAClC,YAAY,EAAE,cAAc;IAC5B,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,SAAS,EAAE,WAAW;IACtB,oBAAoB,EAAE,sBAAsB;CACpC,CAAC;AAMX,MAAM,UAAU,gBAAgB,CAAC,MAA0B,EAAE,EAAU;IACrE,OAAO,GAAG,MAAM,IAAI,EAAE,EAAE,CAAC;AAC3B,CAAC;AA0BD,MAAM,CAAC,MAAM,YAAY,GAA4C,WAAW,CAAC,cAAc,CAAC,CAAC"}

package/dist/contracts/adapters/realtime.d.ts

@@ -1,39 +1,126 @@
+/**
+ * Realtime-transport seam. Client-facing push (live chat messages, PvP round
+ * state, live odds, big-win/jackpot feeds) flows through this adapter, so the
+ * transport is swappable: the default binding is a first-party in-process
+ * fan-out (served to clients as oRPC event-iterators over SSE); a downstream
+ * operator binds a managed transport (Ably / GetStream / PubNub) to
+ * REALTIME_TRANSPORT without touching modules. This realizes ADR-0007's
+ * `ChatTransportPort` as a generic primitive shared across modules - it is NOT
+ * the inter-module MESSAGE_BROKER (ADR-0010 #4 keeps client push separate from
+ * the event broker, which has delivery guarantees/acks). Money and moderation
+ * stay first-party domain logic; they are never delegated to the transport.
+ *
+ * CHAT_REALTIME_TRANSPORT / CHAT_REALTIME_CLIENT_AUTHORIZER are the SAME two
+ * port shapes, scoped to chat only. The chat module defaults them to whatever
+ * REALTIME_TRANSPORT/REALTIME_CLIENT_AUTHORIZER resolve to (so out of the box
+ * chat behaves identically to every other realtime consumer), but an operator
+ * can rebind just the CHAT_-prefixed tokens to run chat on a managed vendor
+ * (eg Ably) while KYC status updates and everything else stay first-party SSE
+ * - the two seams are independently swappable. `chat-commands` shares the SAME
+ * chat channels (gift claims, rain), so it consumes CHAT_REALTIME_TRANSPORT
+ * too, never the generic token.
+ */
 import { type Token } from './token.js';
+/**
+ * Optional presence capability. A first-party transport can offer a simple
+ * connected-member count; managed vendors provide richer presence. Kept optional
+ * (a capability flag, per ADR-0007) so the base port is the common denominator.
+ */
 export type RealtimePresence = {
+    /**
+     * `connectionId` distinguishes concurrent tabs for the same member. Counts remain
+     * per member, so one tab leaving never marks a user offline while another is active.
+     */
     join(channel: string, memberId: string, connectionId: string): void;
     leave(channel: string, memberId: string, connectionId: string): void;
     count(channel: string): number | Promise<number>;
 };
 export type RealtimeTransport = {
+    /**
+     * Fan a message out to every subscriber of `channel`. Best-effort, at-most-once
+     * for late joiners (the transport is not a system of record - persist first).
+     */
     publish<T>(channel: string, event: T): void | Promise<void>;
+    /**
+     * Subscribe a handler to a channel. Returns an unsubscribe fn the caller MUST
+     * invoke on teardown (eg an SSE handler on request abort).
+     */
     subscribe<T>(channel: string, handler: (event: T) => void): () => void;
+    /** Revoke managed-provider credentials for a client after access is removed. */
     revokeClient?: (clientId: string) => void | Promise<void>;
     presence?: RealtimePresence;
+    /**
+     * Returns the set of authenticated user IDs currently online in `channel`.
+     * Anonymous connections (memberIds beginning with 'anonymous:') are excluded.
+     */
     getOnlineUserIds(channel: string): Promise<string[]>;
 };
 export declare const REALTIME_TRANSPORT: Token<RealtimeTransport>;
+/** Chat-scoped realtime transport - see the module header comment above. */
 export declare const CHAT_REALTIME_TRANSPORT: Token<RealtimeTransport>;
-export type RealtimeConnectionGrant = {
+/**
+ * Client connection provisioning - the complement to REALTIME_TRANSPORT.
+ *
+ * REALTIME_TRANSPORT is how the SERVER fans a message out. This seam is how a
+ * CLIENT learns to CONNECT and receive. The two models differ by provider:
+ *   - first-party (default): the client pulls from our own API over SSE, so the
+ *     "grant" is just the stream path - no secret, the session cookie authorizes.
+ *   - managed vendor (Ably/GetStream/PubNub): the client connects DIRECTLY to the
+ *     vendor edge, so the backend must mint a per-player, capability-scoped token
+ *     (never ship the vendor API key to the browser). The grant carries that token.
+ * A downstream operator binds this token to its provider's authorizer without any
+ * module change; the chat module just hands the grant to the caller. See ADR-0007.
+ */
+/**
+ * What the client needs to start receiving, tagged by `provider` so a pluggable
+ * client-side adapter can pick the right transport. Open union - a new vendor adds
+ * its own variant without editing core.
+ */
+export type RealtimeConnectionGrant = 
+/** First-party SSE: subscribe by opening this event-iterator path on our API. */
+{
     provider: 'sse';
     streamPath: string;
     channels: string[];
-} | {
+}
+/**
+ * Ably: a signed TokenRequest the browser exchanges for a scoped token, plus the
+ * channels the player may subscribe to. `tokenRequest` is opaque here (the Ably
+ * SDK shape lives in the consumer, not in vendor-neutral core).
+ */
+ | {
     provider: 'ably';
     tokenRequest: unknown;
     channels: string[];
-} | {
+}
+/** Escape hatch for any other vendor (GetStream, PubNub, ...). */
+ | {
     provider: string;
     channels: string[];
     [key: string]: unknown;
 };
 export type RealtimeClientAuthorizerInput = {
+    /**
+     * The authenticated caller; becomes the vendor `clientId` so presence/identity
+     * is bound server-side and cannot be spoofed by the browser.
+     */
     userId: string;
+    /** A stable per-connection id from the client (defaults to userId when absent). */
     clientId: string;
+    /**
+     * The channels the caller is allowed to subscribe to (the module computes these
+     * from the player's access - eg the global channel plus their rooms).
+     */
     channels: string[];
 };
 export type RealtimeClientAuthorizer = {
+    /**
+     * Mint a connection grant for an authenticated caller. Async because a managed
+     * vendor signs a token request over its SDK.
+     */
     issueGrant(input: RealtimeClientAuthorizerInput): RealtimeConnectionGrant | Promise<RealtimeConnectionGrant>;
 };
 export declare const REALTIME_CLIENT_AUTHORIZER: Token<RealtimeClientAuthorizer>;
+/** Chat-scoped client authorizer - see the module header comment above. */
 export declare const CHAT_REALTIME_CLIENT_AUTHORIZER: Token<RealtimeClientAuthorizer>;
 //# sourceMappingURL=realtime.d.ts.map

package/dist/contracts/adapters/realtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/realtime.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAKrD,MAAM,MAAM,gBAAgB,GAAG;IAG7B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACpE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrE,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAG9B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG5D,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAEvE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAG5B,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAqC,CAAC;AAG9F,eAAO,MAAM,uBAAuB,EAAE,KAAK,CAAC,iBAAiB,CACrB,CAAC;AAiBzC,MAAM,MAAM,uBAAuB,GAE/B;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAI3D;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAE/D;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAErE,MAAM,MAAM,6BAA6B,GAAG;IAG1C,MAAM,EAAE,MAAM,CAAC;IAEf,QAAQ,EAAE,MAAM,CAAC;IAGjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAGrC,UAAU,CACR,KAAK,EAAE,6BAA6B,GACnC,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/D,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,KAAK,CAAC,wBAAwB,CAEtE,CAAC;AAGF,eAAO,MAAM,+BAA+B,EAAE,KAAK,CAAC,wBAAwB,CAE3E,CAAC"}
+{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/realtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;OAGG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACpE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrE,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D;;;OAGG;IACH,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACvE,gFAAgF;IAChF,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAqC,CAAC;AAE9F,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,EAAE,KAAK,CAAC,iBAAiB,CACrB,CAAC;AAEzC;;;;;;;;;;;;GAYG;AAEH;;;;GAIG;AACH,MAAM,MAAM,uBAAuB;AACjC,iFAAiF;AAC/E;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE;AAC7D;;;;GAIG;GACD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE;AACjE,kEAAkE;GAChE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAErE,MAAM,MAAM,6BAA6B,GAAG;IAC1C;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC;;;OAGG;IACH,UAAU,CACR,KAAK,EAAE,6BAA6B,GACnC,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/D,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,KAAK,CAAC,wBAAwB,CAEtE,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,+BAA+B,EAAE,KAAK,CAAC,wBAAwB,CAE3E,CAAC"}

package/dist/contracts/adapters/realtime.js

@@ -1,28 +1,30 @@
-// Realtime-transport seam. Client-facing push (live chat messages, PvP round
-// state, live odds, big-win/jackpot feeds) flows through this adapter, so the
-// transport is swappable: the default binding is a first-party in-process
-// fan-out (served to clients as oRPC event-iterators over SSE); a downstream
-// operator binds a managed transport (Ably / GetStream / PubNub) to
-// REALTIME_TRANSPORT without touching modules. This realizes ADR-0007's
-// `ChatTransportPort` as a generic primitive shared across modules - it is NOT
-// the inter-module MESSAGE_BROKER (ADR-0010 #4 keeps client push separate from
-// the event broker, which has delivery guarantees/acks). Money and moderation
-// stay first-party domain logic; they are never delegated to the transport.
-//
-// CHAT_REALTIME_TRANSPORT / CHAT_REALTIME_CLIENT_AUTHORIZER are the SAME two
-// port shapes, scoped to chat only. The chat module defaults them to whatever
-// REALTIME_TRANSPORT/REALTIME_CLIENT_AUTHORIZER resolve to (so out of the box
-// chat behaves identically to every other realtime consumer), but an operator
-// can rebind just the CHAT_-prefixed tokens to run chat on a managed vendor
-// (eg Ably) while KYC status updates and everything else stay first-party SSE
-// - the two seams are independently swappable. `chat-commands` shares the SAME
-// chat channels (gift claims, rain), so it consumes CHAT_REALTIME_TRANSPORT
-// too, never the generic token.
+/**
+ * Realtime-transport seam. Client-facing push (live chat messages, PvP round
+ * state, live odds, big-win/jackpot feeds) flows through this adapter, so the
+ * transport is swappable: the default binding is a first-party in-process
+ * fan-out (served to clients as oRPC event-iterators over SSE); a downstream
+ * operator binds a managed transport (Ably / GetStream / PubNub) to
+ * REALTIME_TRANSPORT without touching modules. This realizes ADR-0007's
+ * `ChatTransportPort` as a generic primitive shared across modules - it is NOT
+ * the inter-module MESSAGE_BROKER (ADR-0010 #4 keeps client push separate from
+ * the event broker, which has delivery guarantees/acks). Money and moderation
+ * stay first-party domain logic; they are never delegated to the transport.
+ *
+ * CHAT_REALTIME_TRANSPORT / CHAT_REALTIME_CLIENT_AUTHORIZER are the SAME two
+ * port shapes, scoped to chat only. The chat module defaults them to whatever
+ * REALTIME_TRANSPORT/REALTIME_CLIENT_AUTHORIZER resolve to (so out of the box
+ * chat behaves identically to every other realtime consumer), but an operator
+ * can rebind just the CHAT_-prefixed tokens to run chat on a managed vendor
+ * (eg Ably) while KYC status updates and everything else stay first-party SSE
+ * - the two seams are independently swappable. `chat-commands` shares the SAME
+ * chat channels (gift claims, rain), so it consumes CHAT_REALTIME_TRANSPORT
+ * too, never the generic token.
+ */
 import { createToken } from './token.js';
 export const REALTIME_TRANSPORT = createToken('REALTIME_TRANSPORT');
-// Chat-scoped realtime transport - see the module header comment above.
+/** Chat-scoped realtime transport - see the module header comment above. */
 export const CHAT_REALTIME_TRANSPORT = createToken('CHAT_REALTIME_TRANSPORT');
 export const REALTIME_CLIENT_AUTHORIZER = createToken('REALTIME_CLIENT_AUTHORIZER');
-// Chat-scoped client authorizer - see the module header comment above.
+/** Chat-scoped client authorizer - see the module header comment above. */
 export const CHAT_REALTIME_CLIENT_AUTHORIZER = createToken('CHAT_REALTIME_CLIENT_AUTHORIZER');
 //# sourceMappingURL=realtime.js.map

package/dist/contracts/adapters/realtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"realtime.js","sourceRoot":"","sources":["../../../src/contracts/adapters/realtime.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,oEAAoE;AACpE,wEAAwE;AACxE,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,gCAAgC;AAChC,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AA4BrD,MAAM,CAAC,MAAM,kBAAkB,GAA6B,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAE9F,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAClC,WAAW,CAAC,yBAAyB,CAAC,CAAC;AA8CzC,MAAM,CAAC,MAAM,0BAA0B,GAAoC,WAAW,CACpF,4BAA4B,CAC7B,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,+BAA+B,GAAoC,WAAW,CACzF,iCAAiC,CAClC,CAAC"}
+{"version":3,"file":"realtime.js","sourceRoot":"","sources":["../../../src/contracts/adapters/realtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAsCrD,MAAM,CAAC,MAAM,kBAAkB,GAA6B,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAE9F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAClC,WAAW,CAAC,yBAAyB,CAAC,CAAC;AA0DzC,MAAM,CAAC,MAAM,0BAA0B,GAAoC,WAAW,CACpF,4BAA4B,CAC7B,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,+BAA+B,GAAoC,WAAW,CACzF,iCAAiC,CAClC,CAAC"}

package/dist/contracts/adapters/rng.d.ts

@@ -1,3 +1,14 @@
+/**
+ * Random number generator seam. For dev / demo / non-certified game contexts.
+ *
+ * IMPORTANT: production game outcomes are governed by the SEALED
+ * `GAME_OUTCOME_AUTHORITY` token in `@openora/core/compliance` (regulator
+ * mandate - GLI / eCOGRA / BMM / iTechLabs). `RNG_ADAPTER` is NOT a substitute
+ * for a lab-certified RGS. Use this seam to swap deterministic mocks in tests,
+ * to plug in a seedable provider for replay debugging, or to back demo games
+ * that never resolve real money. Real-money RTP must flow through the sealed
+ * authority.
+ */
 import { type Token } from './token.js';
 export type RngAdapter = {
     /** Uniform float in [0, 1). */

package/dist/contracts/adapters/rng.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rng.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/rng.ts"],"names":[],"mappings":"AASA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG;IACvB,+BAA+B;IAC/B,SAAS,IAAI,MAAM,CAAC;IACpB,8CAA8C;IAC9C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACnD,qFAAqF;IACrF,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC"}
+{"version":3,"file":"rng.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/rng.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG;IACvB,+BAA+B;IAC/B,SAAS,IAAI,MAAM,CAAC;IACpB,8CAA8C;IAC9C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACnD,qFAAqF;IACrF,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC"}

package/dist/contracts/adapters/rng.js

@@ -1,12 +1,14 @@
-// Random number generator seam. For dev / demo / non-certified game contexts.
-//
-// IMPORTANT: production game outcomes are governed by the SEALED
-// `GAME_OUTCOME_AUTHORITY` token in `@openora/core/compliance` (regulator
-// mandate - GLI / eCOGRA / BMM / iTechLabs). `RNG_ADAPTER` is NOT a substitute
-// for a lab-certified RGS. Use this seam to swap deterministic mocks in tests,
-// to plug in a seedable provider for replay debugging, or to back demo games
-// that never resolve real money. Real-money RTP must flow through the sealed
-// authority.
+/**
+ * Random number generator seam. For dev / demo / non-certified game contexts.
+ *
+ * IMPORTANT: production game outcomes are governed by the SEALED
+ * `GAME_OUTCOME_AUTHORITY` token in `@openora/core/compliance` (regulator
+ * mandate - GLI / eCOGRA / BMM / iTechLabs). `RNG_ADAPTER` is NOT a substitute
+ * for a lab-certified RGS. Use this seam to swap deterministic mocks in tests,
+ * to plug in a seedable provider for replay debugging, or to back demo games
+ * that never resolve real money. Real-money RTP must flow through the sealed
+ * authority.
+ */
 import { createToken } from './token.js';
 export const RNG_ADAPTER = createToken('RNG_ADAPTER');
 //# sourceMappingURL=rng.js.map

package/dist/contracts/adapters/rng.js.map

@@ -1 +1 @@
-{"version":3,"file":"rng.js","sourceRoot":"","sources":["../../../src/contracts/adapters/rng.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,iEAAiE;AACjE,0EAA0E;AAC1E,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,aAAa;AACb,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAWrD,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC"}
+{"version":3,"file":"rng.js","sourceRoot":"","sources":["../../../src/contracts/adapters/rng.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAWrD,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC"}

package/dist/contracts/adapters/sms.d.ts

@@ -1,3 +1,9 @@
+/**
+ * SMS delivery seam. The phone-login OTP flow sends codes through this adapter so the
+ * transport is swappable: the platform default (bound in identity/plugin.ts) is a
+ * log-to-stdout mock, safe for dev/stage. A consumer overlay rebinds SMS_ADAPTER to a
+ * real vendor (Twilio, AWS SNS) in production. See AGENTS.md "third-party integration".
+ */
 import { type Token } from './token.js';
 export type SmsAdapter = {
     sendOtp(params: {

package/dist/contracts/adapters/sms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sms.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/sms.ts"],"names":[],"mappings":"AAIA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC"}
+{"version":3,"file":"sms.d.ts","sourceRoot":"","sources":["../../../src/contracts/adapters/sms.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC"}

package/dist/contracts/adapters/sms.js

@@ -1,7 +1,9 @@
-// SMS delivery seam. The phone-login OTP flow sends codes through this adapter so the
-// transport is swappable: the platform default (bound in identity/plugin.ts) is a
-// log-to-stdout mock, safe for dev/stage. A consumer overlay rebinds SMS_ADAPTER to a
-// real vendor (Twilio, AWS SNS) in production. See AGENTS.md "third-party integration".
+/**
+ * SMS delivery seam. The phone-login OTP flow sends codes through this adapter so the
+ * transport is swappable: the platform default (bound in identity/plugin.ts) is a
+ * log-to-stdout mock, safe for dev/stage. A consumer overlay rebinds SMS_ADAPTER to a
+ * real vendor (Twilio, AWS SNS) in production. See AGENTS.md "third-party integration".
+ */
 import { createToken } from './token.js';
 export const SMS_ADAPTER = createToken('SMS_ADAPTER');
 //# sourceMappingURL=sms.js.map

package/dist/contracts/adapters/sms.js.map

@@ -1 +1 @@
-{"version":3,"file":"sms.js","sourceRoot":"","sources":["../../../src/contracts/adapters/sms.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,kFAAkF;AAClF,sFAAsF;AACtF,wFAAwF;AACxF,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAMrD,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC"}
+{"version":3,"file":"sms.js","sourceRoot":"","sources":["../../../src/contracts/adapters/sms.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAMrD,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC"}

package/dist/contracts/adapters/tag-evaluation-commands.d.ts

@@ -1,3 +1,13 @@
+/**
+ * Tag-evaluation command port: wallet's withdraw() calls this synchronously, on its own
+ * transaction handle, so a withdrawal_review assignment is guaranteed to commit before
+ * maybeAutoApprove reads risk tags - closing the race an unawaited EventBus emit alone
+ * leaves open (`wallet.withdrawal.requested` is still fired for other consumers, but
+ * auto-approval's money decision must never depend on that fire-and-forget fan-out; see
+ * messaging-and-microservices "money never flows over events"). Mirrors the WALLET_COMMANDS
+ * command-port idiom (ADR-0017): `tx: unknown` so the caller's transaction handle threads
+ * through without either side importing the other's DB module.
+ */
 import { type Token } from './token.js';
 export type TagEvaluationWithdrawalRequestedArgs = {
     userId: string;