protobuf-platform 1.2.669 → 1.2.671

package/AGENTS.md

@@ -2,14 +2,14 @@
 
 Read [Project Rules](../../platform-rules/PROJECT_RULES.md) for the canonical shared execution policy; this file specializes the protobuf commands.
 
-- Repository directory: `protobuf`; npm package: `protobuf-platform`. Work locally on `main`, never switch to local `staging`. The Project Rules' final push command targets `origin HEAD:staging` without changing this local branch; do not execute it without explicit push authorization. This is a contract package, not a running service; it owns no database, queues or migrations.
+- Repository directory: `protobuf`; npm package: `protobuf-platform`. Work locally on `main`, never switch to local `staging`, and never apply the service-staging push flow to this repository. Protobuf `main` mutation, publication and push follow the dedicated lifecycle in Project Rules. This is a contract package, not a running service; it owns no database, queues or migrations.
 - Inspect this repository first for every business master task. Reuse existing contracts when sufficient and record `PROTOBUF_CHANGE_NOT_REQUIRED` when no change is needed.
 - A new/material contract decision or breaking change needs explicit approval of that exact change; additive approval never authorizes breaking compatibility. If approval is missing, report `PROTOBUF_CHANGE_APPROVAL_REQUIRED` with the exact contract, insufficiency, compatibility and affected repositories. Contract work precedes dependent implementation.
 - Sources are domain `*.proto` files; `update_protobuf.sh` writes colocated `*_pb.js` and `*_grpc_pb.js`; `index.js` exports domain bindings.
 - npm with `package-lock.json`; generated output is CommonJS. Run `npm run proto:build`, inspect generated diff, and review old/new producer-consumer compatibility (field tags/types, optional/default behavior, enum values, RPC methods and exports). Fix Critical/Medium findings before committing.
 - The build script uses `~/node-x64/bin/npm`; `proto:build:x64` uses `~/node-v22.21.1-darwin-x64/bin/npm`. Verify the selected local runtime and grpc-tools binary. `proto:install:x64` deletes node_modules AND the lockfile: it is a recovery script, not ordinary dependency installation.
 - For a contract release, prepare one version bump with `npm version patch --no-git-tag-version` (or the already-approved version), verify package.json and package-lock.json agree, review generated/package contents, and create a local atomic commit including version files. Avoid a second bump if already prepared.
-- For an explicitly approved additive change, run `npm publish` after validation and the release commit, using existing authorized registry credentials. Do not run `npm run publish-update` after preparing the version: it would bump again. On an ambiguous result, inspect the registry before retrying; never blindly republish or bump.
+- For an approved contract release, run `npm publish` after validation and the release commit, using existing authorized registry credentials. Publication required by the approved contract is autonomous execution, including an approved breaking release after its compatibility/rollout decision; do not ask for a separate publication acknowledgement. Do not run `npm run publish-update` after preparing the version: it would bump again. On an ambiguous result, inspect the registry before retrying; never blindly republish or bump.
 - Local npm machine authentication was verified from this repository against `https://registry.npmjs.org/` on 2026-09-15; identity and package metadata resolved. Use the existing setup without requesting OTP or a manual publication handoff. This read-only check did not exercise publication permissions. If auth actually fails, diagnose the exact error and request only the minimum action needed to restore machine authentication; never expose a token.
 - Verify the exact release with `npm view protobuf-platform@<release-version> version`, then run only `sh sync_internal_libs.sh` directly in each affected service repository under the Project Rules. Verify installed/dependency/lockfile state and the expected contract, then continue the same master task automatically without a publication acknowledgement or manual sync handoff. Request human action only for genuinely unavailable authentication or permissions; never expose credentials.
 - package.json has no lint command; its test script is a failing placeholder. For documentation-only edits use diff/link review; generation is required when contracts change, not for editing these instructions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "protobuf-platform",
-  "version": "1.2.669",
+  "version": "1.2.671",
   "description": "Protobuf structures",
   "main": "index.js",
   "scripts": {

package/payment/payment.proto

@@ -614,6 +614,8 @@ message AttemptWithdrawalRequest {
     optional string request_currency = 39;
     optional string antifraud_session = 40;
     optional string user_agent = 41;
+    // Card security code for the withdrawal attempt. Consumers must keep it transient.
+    optional string cvv = 42;
 }
 message GetWithdrawalRequest {
     int32 id = 1;

package/payment/payment_pb.js

@@ -24791,7 +24791,8 @@ proto.payment.AttemptWithdrawalRequest.toObject = function(includeInstance, msg)
     cryptoWallet: jspb.Message.getFieldWithDefault(msg, 38, ""),
     requestCurrency: jspb.Message.getFieldWithDefault(msg, 39, ""),
     antifraudSession: jspb.Message.getFieldWithDefault(msg, 40, ""),
-    userAgent: jspb.Message.getFieldWithDefault(msg, 41, "")
+    userAgent: jspb.Message.getFieldWithDefault(msg, 41, ""),
+    cvv: jspb.Message.getFieldWithDefault(msg, 42, "")
   };
 
   if (includeInstance) {
@@ -24992,6 +24993,10 @@ proto.payment.AttemptWithdrawalRequest.deserializeBinaryFromReader = function(ms
       var value = /** @type {string} */ (reader.readString());
       msg.setUserAgent(value);
       break;
+    case 42:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setCvv(value);
+      break;
     default:
       reader.skipField();
       break;
@@ -25308,6 +25313,13 @@ proto.payment.AttemptWithdrawalRequest.serializeBinaryToWriter = function(messag
       f
     );
   }
+  f = /** @type {string} */ (jspb.Message.getField(message, 42));
+  if (f != null) {
+    writer.writeString(
+      42,
+      f
+    );
+  }
 };
 
 
@@ -26733,6 +26745,42 @@ proto.payment.AttemptWithdrawalRequest.prototype.hasUserAgent = function() {
 };
 
 
+/**
+ * optional string cvv = 42;
+ * @return {string}
+ */
+proto.payment.AttemptWithdrawalRequest.prototype.getCvv = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 42, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.payment.AttemptWithdrawalRequest} returns this
+ */
+proto.payment.AttemptWithdrawalRequest.prototype.setCvv = function(value) {
+  return jspb.Message.setField(this, 42, value);
+};
+
+
+/**
+ * Clears the field making it undefined.
+ * @return {!proto.payment.AttemptWithdrawalRequest} returns this
+ */
+proto.payment.AttemptWithdrawalRequest.prototype.clearCvv = function() {
+  return jspb.Message.setField(this, 42, undefined);
+};
+
+
+/**
+ * Returns whether this field is set.
+ * @return {boolean}
+ */
+proto.payment.AttemptWithdrawalRequest.prototype.hasCvv = function() {
+  return jspb.Message.getField(this, 42) != null;
+};
+
+
 
 
 

package/user/user.proto

@@ -7,6 +7,10 @@ service User {
     //Fetch settings for particular service
     rpc signUp(RegistrationRequest) returns (LoggedInResponse);
     rpc signIn(LoginRequest) returns (LoggedInResponse);
+    // Dedicated BackOffice batch import for player invitations.
+    rpc importPlayerInvitations(ImportPlayerInvitationsRequest) returns (ImportPlayerInvitationsResponse);
+    // Public neutral invitation activation. The token never contains an internal user id.
+    rpc activatePlayerInvitation(ActivatePlayerInvitationRequest) returns (ActivatePlayerInvitationResponse);
     rpc loginOrCreateTelegram(TelegramLoginRequest) returns (LoggedInResponse);
     rpc loginOrCreateTelegramOidc(TelegramOidcLoginRequest) returns (LoggedInResponse);
     rpc loginOrCreateGoogle(GoogleLoginRequest) returns (LoggedInResponse);
@@ -2657,3 +2661,59 @@ message PrecisionRgAdmissionResponse {
     string commit_receipt_id = 7;
     EvaluateResponsibleGamingDecisionResponse decision = 8;
 }
+
+message ImportPlayerInvitationsRequest {
+    bytes csv_bytes = 1;
+    bool dry_run = 2;
+    string batch_reference = 3;
+    optional string csv_file_name = 4;
+}
+
+message PlayerInvitationImportRowResult {
+    int32 row_number = 1;
+    string source_system = 2;
+    string external_player_id = 3;
+    string result_code = 4;
+    optional string error_code = 5;
+    optional string user_public_id = 6;
+    optional string stage = 7;
+    int64 duration_ms = 8;
+}
+
+message PlayerInvitationImportBatchSummary {
+    string batch_reference = 1;
+    bool dry_run = 2;
+    int32 total = 3;
+    int32 created = 4;
+    int32 already_imported = 5;
+    int32 conflicts = 6;
+    int32 failed = 7;
+    int32 ready_for_invitation = 8;
+    int64 duration_ms = 9;
+}
+
+message ImportPlayerInvitationsResponse {
+    PlayerInvitationImportBatchSummary summary = 1;
+    repeated PlayerInvitationImportRowResult rows = 2;
+    optional string invitation_csv_file_name = 3;
+    optional string invitation_csv_content = 4;
+}
+
+enum PlayerInvitationActivationOutcome {
+    PLAYER_INVITATION_ACTIVATION_OUTCOME_UNSPECIFIED = 0;
+    PLAYER_INVITATION_ACTIVATION_OUTCOME_ACTIVATED = 1;
+    PLAYER_INVITATION_ACTIVATION_OUTCOME_INVALID = 2;
+    PLAYER_INVITATION_ACTIVATION_OUTCOME_EXPIRED = 3;
+    PLAYER_INVITATION_ACTIVATION_OUTCOME_ALREADY_USED = 4;
+    PLAYER_INVITATION_ACTIVATION_OUTCOME_ALREADY_ACTIVATED = 5;
+}
+
+message ActivatePlayerInvitationRequest {
+    string token = 1;
+    string password = 2;
+}
+
+message ActivatePlayerInvitationResponse {
+    PlayerInvitationActivationOutcome outcome = 1;
+    optional string user_public_id = 2;
+}

package/user/user_grpc_pb.js

@@ -4,6 +4,28 @@
 var grpc = require('@grpc/grpc-js');
 var user_pb = require('./user_pb.js');
 
+function serialize_user_ActivatePlayerInvitationRequest(arg) {
+  if (!(arg instanceof user_pb.ActivatePlayerInvitationRequest)) {
+    throw new Error('Expected argument of type user.ActivatePlayerInvitationRequest');
+  }
+  return Buffer.from(arg.serializeBinary());
+}
+
+function deserialize_user_ActivatePlayerInvitationRequest(buffer_arg) {
+  return user_pb.ActivatePlayerInvitationRequest.deserializeBinary(new Uint8Array(buffer_arg));
+}
+
+function serialize_user_ActivatePlayerInvitationResponse(arg) {
+  if (!(arg instanceof user_pb.ActivatePlayerInvitationResponse)) {
+    throw new Error('Expected argument of type user.ActivatePlayerInvitationResponse');
+  }
+  return Buffer.from(arg.serializeBinary());
+}
+
+function deserialize_user_ActivatePlayerInvitationResponse(buffer_arg) {
+  return user_pb.ActivatePlayerInvitationResponse.deserializeBinary(new Uint8Array(buffer_arg));
+}
+
 function serialize_user_AdminResetResponsibleGamingPolicyRequest(arg) {
   if (!(arg instanceof user_pb.AdminResetResponsibleGamingPolicyRequest)) {
     throw new Error('Expected argument of type user.AdminResetResponsibleGamingPolicyRequest');
@@ -741,6 +763,28 @@ function deserialize_user_GrantUserRewardResponse(buffer_arg) {
   return user_pb.GrantUserRewardResponse.deserializeBinary(new Uint8Array(buffer_arg));
 }
 
+function serialize_user_ImportPlayerInvitationsRequest(arg) {
+  if (!(arg instanceof user_pb.ImportPlayerInvitationsRequest)) {
+    throw new Error('Expected argument of type user.ImportPlayerInvitationsRequest');
+  }
+  return Buffer.from(arg.serializeBinary());
+}
+
+function deserialize_user_ImportPlayerInvitationsRequest(buffer_arg) {
+  return user_pb.ImportPlayerInvitationsRequest.deserializeBinary(new Uint8Array(buffer_arg));
+}
+
+function serialize_user_ImportPlayerInvitationsResponse(arg) {
+  if (!(arg instanceof user_pb.ImportPlayerInvitationsResponse)) {
+    throw new Error('Expected argument of type user.ImportPlayerInvitationsResponse');
+  }
+  return Buffer.from(arg.serializeBinary());
+}
+
+function deserialize_user_ImportPlayerInvitationsResponse(buffer_arg) {
+  return user_pb.ImportPlayerInvitationsResponse.deserializeBinary(new Uint8Array(buffer_arg));
+}
+
 function serialize_user_IngestUserKycDocumentToProviderRequest(arg) {
   if (!(arg instanceof user_pb.IngestUserKycDocumentToProviderRequest)) {
     throw new Error('Expected argument of type user.IngestUserKycDocumentToProviderRequest');
@@ -2570,6 +2614,30 @@ signUp: {
     responseSerialize: serialize_user_LoggedInResponse,
     responseDeserialize: deserialize_user_LoggedInResponse,
   },
+  // Dedicated BackOffice batch import for player invitations.
+importPlayerInvitations: {
+    path: '/user.User/importPlayerInvitations',
+    requestStream: false,
+    responseStream: false,
+    requestType: user_pb.ImportPlayerInvitationsRequest,
+    responseType: user_pb.ImportPlayerInvitationsResponse,
+    requestSerialize: serialize_user_ImportPlayerInvitationsRequest,
+    requestDeserialize: deserialize_user_ImportPlayerInvitationsRequest,
+    responseSerialize: serialize_user_ImportPlayerInvitationsResponse,
+    responseDeserialize: deserialize_user_ImportPlayerInvitationsResponse,
+  },
+  // Public neutral invitation activation. The token never contains an internal user id.
+activatePlayerInvitation: {
+    path: '/user.User/activatePlayerInvitation',
+    requestStream: false,
+    responseStream: false,
+    requestType: user_pb.ActivatePlayerInvitationRequest,
+    responseType: user_pb.ActivatePlayerInvitationResponse,
+    requestSerialize: serialize_user_ActivatePlayerInvitationRequest,
+    requestDeserialize: deserialize_user_ActivatePlayerInvitationRequest,
+    responseSerialize: serialize_user_ActivatePlayerInvitationResponse,
+    responseDeserialize: deserialize_user_ActivatePlayerInvitationResponse,
+  },
   loginOrCreateTelegram: {
     path: '/user.User/loginOrCreateTelegram',
     requestStream: false,