@blamejs/core 0.7.103 → 0.7.105

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.7.x
 
+- **0.7.105** (2026-05-06) — `b.compliance.sanctions` — sanctions-list screening primitive. Operators handling KYC / payment / customer-onboarding flows screen names against the U.S. Treasury OFAC SDN list, EU CSL, UK HMT consolidated list, UN 1267 list, or operator-defined lists. The framework owns indexing + match algorithm; the operator owns the daily fetch + format-specific parsing (the framework intentionally does not vendor the list — it changes daily and has legal-distribution implications). **`b.compliance.sanctions.create({ entries, algorithm, fuzzy, ... })`** returns a screener with `screen(input)` (single record), `screenBulk(inputs)` (batch), `snapshot()` (rule-version digest for audit trails), `reload(newEntries)` (atomic index swap with diff), `entryById(id)` (lookup), and `size()`. Three match strategies: `exact` (fastest, no fuzz), `jaro-winkler` (default, threshold 0.85), `levenshtein` (edit-distance with cap). Match output: `{ match: bool, hits: [{ entryId, name, matchedOn, score, reason, listed, programs }], algorithm, ruleVersion, screenedAt }`. **`b.compliance.sanctions.fuzzy`** — pure algorithmic core: `normalize` (Unicode diacritic strip + lowercase + whitespace collapse), `tokenize`, `levenshtein` (cap + early-exit), `jaro` / `jaroWinkler`, `tokenSetSimilarity` (order-invariant bag-of-tokens), `substringContains` (token-bounded), `initialsMatch`. **`b.compliance.sanctions.aliases.expand(name, opts)`** — alias-expansion helper covering nicknames (Bill ↔ William, Mike ↔ Michael), transliteration variants (Mohamed ↔ Mohammed), reverse-order forms (Smith John / Smith, John), and initials (J. Smith). 32 built-in name pairs plus operator-extensible `extraPairs`. **`b.compliance.sanctions.fetcher.create({ screener, fetch, intervalMs, onRefreshed, onError })`** — periodic refresh worker that runs the operator's `fetch` callback, validates a non-empty result, and atomically reloads the screener via `screener.reload`. Audit emissions on every refresh state (`compliance.sanctions.refresh.started` / `completed` / `skipped` / `failed`). **Parser shims** for the canonical public list formats: `parseOfacCsvRow` / `parseOfacAliasRow` / `mergeAliases` (OFAC SDN), `parseEuCslEntry` (EU Consolidated Sanctions List XML), `parseUn1267Entry` (UN Security Council XML). Audit emissions: `compliance.sanctions.screened` (every screen call), `compliance.sanctions.matched` (when hits > 0). Test coverage: 39 cases across normalize / tokenize / Levenshtein / Jaro-Winkler / token-set / substring / initials / screen exact + jw + levenshtein / type filter / bulk / snapshot / reload / alias expansion / fetcher tick + failure modes.
+
+- **0.7.104** (2026-05-06) — `b.dsr` Data Subject Rights workflow primitive (~2000 LoC). End-to-end coordinator for GDPR Article 15-22 / CCPA / CPRA / LGPD / PIPEDA / UK-GDPR data-subject requests. **`b.dsr.create({ ticketStore, posture, identityResolver, sources, ... })`** returns a workflow instance with full ticket lifecycle: `submit(input)` resolves subject identity via the operator-supplied `identityResolver`, computes a posture-aware deadline (gdpr 30d / ccpa 45d / lgpd-br 15d / pipl-cn 15d / pipeda-ca 30d / appi-jp 30d / pdpa-sg 30d / uk-gdpr 30d), and persists a pending ticket. `process(ticketId, opts)` orchestrates per-source `query` (for access / portability / rectification) or `erase` (for erasure) callbacks; partial source failures land the ticket in `partially_completed` state with per-source error capture. `cancel` / `reject` (with required reason per GDPR) advance to terminal states. `expireOverdue()` sweep marks deadline-overdue tickets as `expired`. Seven request types: `access` / `erasure` / `portability` / `rectification` / `restriction` / `object` / `automated-decision`. **Verification ladder** (`minimal` / `secondary` / `strong`) per GDPR Art. 12(6) — minimum required level by request type with operator override; erasure / portability / rectification require `secondary` by default. **Receipt builder** (`buildReceipt(ticketId)`) — emits a canonical `blamejs.dsr.receipt/1` JSON envelope for completed/cancelled/rejected/expired tickets with optional operator-side `receiptSigner` hook for cryptographic attestation. **Portability bundle builder** (`buildPortabilityBundle(ticket)`) — `blamejs.dsr.portability/1` JSON shape with per-source data for access / portability requests. **Two ticket-store backends** ship: `memoryTicketStore()` for development / tests, `dbTicketStore({ db, table })` for production (auto-provisions a SQLite table with subject_email + status indexes, includes a `purgeExpired()` retention sweep). Audit emissions on every state transition (`dsr.ticket.submitted` / `in_progress` / `completed` / `partial` / `cancelled` / `rejected` / `expired` plus per-source `dsr.source.queried` / `erased` / `failed`). Test coverage: 38 cases across submit / process / cancel / reject / list / expire / portability / verification ladder / receipt / store backends.
+
 - **0.7.103** (2026-05-06) — W3C distributed tracing suite. End-to-end OTel-shaped tracing without a vendored OTel SDK: tracestate + Baggage parsers, span builder, OTLP/JSON exporter, HTTP-server span middleware, log correlation. **`b.observability.traceContext.parseTracestate / buildTracestate`** — W3C Trace Context §3.3 vendor data: enforces vendor-key shape (lcase-alnum + `_-*/`, optional `<tenant>@<system>`), value charset (printable ASCII excluding `,` and `=`), 32-entry cap, 512-char total cap, dup-key-keep-first per §3.3.1.5. **`b.observability.baggage.parse / build`** — W3C Baggage spec parser + builder for operator-supplied context (tenantId, region, experimentId, etc.) propagated across service boundaries. RFC 7230 tchar key grammar, percent-encoded UTF-8 values, optional per-entry properties (`key=value;property=value`), 64-entry / 8192-char caps. **`b.observability.tracer.create({ service, resource, onEnd })`** — OTel-shaped span builder. `tracer.start(name, opts)` returns a span with `setAttribute` / `setAttributes` / `addEvent` / `recordException` / `setStatus` / `end` / `isRecording` / `toJSON`. OTLP/JSON-compatible output (Trace v1) with `traceId` / `spanId` / `parentSpanId` / `name` / `kind` / `startTimeUnixNano` / `endTimeUnixNano` / `attributes` / `events` / `status` / `resource` / `scope` / `droppedAttributesCount` / `droppedEventsCount`. Attribute caps (128 keys, 1024-char values), event cap (128) per OTLP defaults. `tracer.startChildOf(parent, name)` derives child spans sharing the trace context. **`b.observability.tracer.spanToTraceparent(span)`** — emits the canonical W3C `traceparent` for outbound propagation. **`b.observability.otlpExporter.create({ endpoint, ... })`** — buffered OTLP/HTTP JSON span exporter. Batches spans (default 200), flushes on size + interval (default 5s), retries 5xx + 408/429 with exponential backoff, drops oldest on queue overflow (default 4096). Custom `fetchImpl` opt for testing or non-default HTTP transports; `allowedProtocols` opt for cleartext dev collectors. **`b.middleware.tracePropagate`** extended to also read inbound `tracestate` and stamp `req.trace.tracestate` as the parsed entries array (or `[]` when missing); when `setResponseHeader: true`, echoes both `traceparent` and `tracestate` on the response. **`b.middleware.spanHttpServer({ tracer, ... })`** — auto-creates a root server span per HTTP request, populates OTel `SEMCONV.HTTP_*` / `URL_*` / `SERVER_*` / `CLIENT_*` attributes, attaches the span to `req.span`, ends on response close, fires `onEnd(span.toJSON())` for export. `ignorePaths` (string + RegExp) keeps healthz / static-asset routes out of span volume; `captureRequestHeaders` / `captureResponseHeaders` lift named headers into the span as `http.request.header.*` / `http.response.header.*` attributes. **`b.middleware.traceLogCorrelation({ logger })`** — wraps a `b.log` instance for the request lifetime so every `info()` / `warn()` / `error()` / etc. emission inside the handler auto-includes `trace_id` + `span_id` from the active context (via `req.trace` + `req.span`). Pass-through when no trace context present. Internal sweep: `safeBuffer.TRACE_ID_HEX_RE` / `SPAN_ID_HEX_RE` / `RFC7230_TCHAR_RE` extracted as shared regex constants; `guard-mime` / `middleware/headers` / `observability` consolidated against the new shared constants.
 
 - **0.7.102** (2026-05-06) — `b.middleware.tracePropagate({ generateIfMissing, ... })` — middleware that consumes the inbound `traceparent` header per W3C Trace Context and stamps `req.trace = { traceId, parentId, sampled, hadUpstream }` for downstream handlers + propagation into outbound HTTP calls. `generateIfMissing: true` (default) synthesises a fresh trace when the inbound header is missing/malformed and stamps `hadUpstream: false`. `auditOnMissing: true` emits `system.trace.synthesised` audit events on every locally-originated trace. `setResponseHeader: true` echoes the resolved traceparent on the response (useful when the framework is the back-end of an L7 router that wants to log it). Composes with `b.observability.traceContext` (v0.7.101) for outbound propagation: downstream handlers read `req.trace.traceId` and pass it to `traceContext.build({ traceId: req.trace.traceId, parentId: traceContext.newParentId(), sampled: req.trace.sampled })` for the `traceparent` header on upstream calls.

package/index.js

@@ -213,6 +213,7 @@ var dualControl = require("./lib/dual-control");
 var retention = require("./lib/retention");
 var network = require("./lib/network");
 var cloudEvents = require("./lib/cloud-events");
+var dsr = require("./lib/dsr");
 var outbox = require("./lib/outbox");
 
 module.exports = {
@@ -361,6 +362,7 @@ module.exports = {
   retention:        retention,
   network:          network,
   cloudEvents:      cloudEvents,
+  dsr:              dsr,
   outbox:           outbox,
   ntpCheck:         ntpCheck,
   version:          constants.version,

package/lib/audit.js

@@ -210,6 +210,7 @@ var FRAMEWORK_NAMESPACES = [
                 //   (role-switching, RLS-shaped events)
   "dkim",       // b.mail.dkim (DKIM-Signature generation events)
   "dora",       // b.dora (DORA Article 17: dora.incident.classified / reported / draftFinal)
+  "dsr",        // b.dsr (Data Subject Rights workflow: dsr.ticket.* / dsr.source.*)
   "dual",       // b.dualControl (dual.grant.requested / approved / denied / consumed / expired / self_approval_denied)
   "mail",       // b.mail (b.mail-bounce uses "system.mail.*")
   "network",    // b.middleware.networkAllowlist (network.gate.denied)

package/lib/compliance-sanctions-aliases.js

@@ -0,0 +1,167 @@
+"use strict";
+/**
+ * Alias-expansion helpers for sanctions screening.
+ *
+ * The OFAC SDN list / EU CSL / UK HMT consolidated list publish a
+ * primary name + a small set of formal aliases per entry. Real-world
+ * input doesn't match those forms exactly: people use nicknames
+ * (Bill / William, Mike / Michael), transliteration variants
+ * (Mohamed / Mohammed / Muhammad), and initials (J. Smith).
+ *
+ * This module expands a candidate name into the set of plausible
+ * forms that should screen-match against the same SDN entry. Operators
+ * call expand() before screen() to broaden the match scope:
+ *
+ *   var aliases = b.compliance.sanctions.aliases.expand("Bill J. Smith");
+ *   var result = screener.screen({
+ *     name:    "Bill J. Smith",
+ *     aliases: aliases,
+ *   });
+ *
+ * The expansion is deterministic + idempotent. Operators with
+ * domain-specific names (Cyrillic / Arabic) extend via opts.extra.
+ */
+
+var fuzzy = require("./compliance-sanctions-fuzzy");
+
+// Common nickname → formal-name pairs. The framework ships a focused
+// table for English/European names; operators with non-Western lists
+// extend via opts.extraPairs at expand() time.
+var NICKNAME_PAIRS = Object.freeze([
+  ["bill",     "william"],
+  ["bob",      "robert"],
+  ["dick",     "richard"],
+  ["mike",     "michael"],
+  ["nick",     "nicholas"],
+  ["tom",      "thomas"],
+  ["jim",      "james"],
+  ["jack",     "john"],
+  ["chris",    "christopher"],
+  ["dan",      "daniel"],
+  ["dave",     "david"],
+  ["matt",     "matthew"],
+  ["alex",     "alexander"],
+  ["sam",      "samuel"],
+  ["pat",      "patrick"],
+  ["tony",     "anthony"],
+  ["ben",      "benjamin"],
+  ["joe",      "joseph"],
+  ["ed",       "edward"],
+  ["fred",     "frederick"],
+  ["greg",     "gregory"],
+  ["liz",      "elizabeth"],
+  ["beth",     "elizabeth"],
+  ["meg",      "margaret"],
+  ["maggie",   "margaret"],
+  ["kate",     "katherine"],
+  ["kathy",    "katherine"],
+  ["sue",      "susan"],
+  ["jen",      "jennifer"],
+  ["jenny",    "jennifer"],
+  ["nat",      "natalie"],
+  ["mohamed",  "mohammed"],
+  ["muhammad", "mohammed"],
+  ["abd",      "abdul"],
+  ["abu",      "abou"],
+  ["yusuf",    "yousef"],
+  ["yasin",    "yaseen"],
+  ["hussein",  "hussain"],
+]);
+
+function _expandNickname(token) {
+  var alts = [];
+  var lower = token.toLowerCase();
+  for (var i = 0; i < NICKNAME_PAIRS.length; i++) {
+    var pair = NICKNAME_PAIRS[i];
+    if (lower === pair[0]) alts.push(pair[1]);
+    else if (lower === pair[1]) alts.push(pair[0]);
+  }
+  return alts;
+}
+
+function _expandInitials(tokens) {
+  // Build "J. Smith" / "JS" forms
+  var alts = [];
+  if (tokens.length >= 2) {
+    var first = tokens[0];
+    var rest = tokens.slice(1).join(" ");
+    if (first.length > 1) {
+      // J Smith / J. Smith
+      alts.push(first.charAt(0) + " " + rest);
+      alts.push(first.charAt(0) + ". " + rest);
+    }
+    // Last + first
+    alts.push(tokens[tokens.length - 1] + " " + tokens.slice(0, -1).join(" "));
+    // Last, First
+    alts.push(tokens[tokens.length - 1] + ", " + tokens.slice(0, -1).join(" "));
+  }
+  if (tokens.length === 2) {
+    // Initials-only "JS"
+    alts.push(tokens[0].charAt(0) + tokens[1].charAt(0));
+  }
+  return alts;
+}
+
+function _expandTokenLevel(tokens) {
+  // For each token, swap with each plausible nickname/transliteration,
+  // emit the resulting full name.
+  var alts = [];
+  for (var i = 0; i < tokens.length; i++) {
+    var swaps = _expandNickname(tokens[i]);
+    for (var j = 0; j < swaps.length; j++) {
+      var newTokens = tokens.slice();
+      newTokens[i] = swaps[j];
+      alts.push(newTokens.join(" "));
+    }
+  }
+  return alts;
+}
+
+function expand(name, opts) {
+  opts = opts || {};
+  if (typeof name !== "string" || name.length === 0) return [];
+  var tokens = fuzzy.tokenize(name);
+  if (tokens.length === 0) return [];
+  var seen = Object.create(null);
+  var out = [];
+  function _add(s) {
+    if (typeof s !== "string" || s.length === 0) return;
+    var key = fuzzy.normalize(s);
+    if (key.length === 0) return;
+    if (seen[key]) return;
+    seen[key] = true;
+    out.push(s);
+  }
+  // 1. The original (normalised)
+  _add(tokens.join(" "));
+  // 2. Initial-form variants
+  var initials = _expandInitials(tokens);
+  for (var i = 0; i < initials.length; i++) _add(initials[i]);
+  // 3. Token-level nickname/transliteration swaps
+  var swaps = _expandTokenLevel(tokens);
+  for (var j = 0; j < swaps.length; j++) _add(swaps[j]);
+  // 4. Operator-supplied extras
+  if (Array.isArray(opts.extra)) {
+    for (var k = 0; k < opts.extra.length; k++) _add(opts.extra[k]);
+  }
+  if (Array.isArray(opts.extraPairs)) {
+    for (var p = 0; p < opts.extraPairs.length; p++) {
+      var pair = opts.extraPairs[p];
+      if (!Array.isArray(pair) || pair.length !== 2) continue;
+      for (var ti = 0; ti < tokens.length; ti++) {
+        var lower = tokens[ti].toLowerCase();
+        if (lower === pair[0]) {
+          var nt1 = tokens.slice(); nt1[ti] = pair[1]; _add(nt1.join(" "));
+        } else if (lower === pair[1]) {
+          var nt2 = tokens.slice(); nt2[ti] = pair[0]; _add(nt2.join(" "));
+        }
+      }
+    }
+  }
+  return out;
+}
+
+module.exports = {
+  expand:          expand,
+  NICKNAME_PAIRS:  NICKNAME_PAIRS,
+};

package/lib/compliance-sanctions-fetcher.js

@@ -0,0 +1,206 @@
+"use strict";
+/**
+ * b.compliance.sanctions.fetcher — periodic sanctions-list refresh
+ * helper.
+ *
+ * The framework intentionally does NOT vendor the sanctions list (it
+ * changes daily and has legal-distribution implications). Operators
+ * fetch from the canonical source on a schedule + reload the screener.
+ * This module wraps the schedule + comparison + reload-trigger logic
+ * so operators write one fetch callback instead of orchestrating it.
+ *
+ *   var fetcher = b.compliance.sanctions.fetcher.create({
+ *     screener:        sdnScreener,                // from sanctions.create
+ *     intervalMs:      C.TIME.hours(24),
+ *     fetch:           async function () {
+ *       // Operator-supplied: hits treasury.gov, parses CSV, returns
+ *       // canonical entry array.
+ *       var rows = await downloadSdnCsv();
+ *       return rows.map(b.compliance.sanctions.parseOfacCsvRow);
+ *     },
+ *     onRefreshed:     function (diff) {
+ *       log.info("SDN list refreshed", diff);
+ *     },
+ *     onError:         function (err) {
+ *       pagerDuty.alert("SDN list fetch failed", err);
+ *     },
+ *   });
+ *   fetcher.start();
+ *   ...
+ *   await fetcher.shutdown();
+ *
+ * Behavior:
+ *   - On each tick, run fetch(); if it returns a non-empty array,
+ *     swap the screener's index via screener.reload(entries).
+ *   - If fetch() throws or returns empty, skip the swap and emit an
+ *     audit event; the screener keeps the previous index. Operators
+ *     can configure onError for paging.
+ *   - Initial run is opt-in via opts.fetchOnStart (default true);
+ *     operators that prefer to seed the screener from a cached file
+ *     at boot pass false.
+ *
+ * Audit emissions:
+ *   compliance.sanctions.refresh.started   — every tick
+ *   compliance.sanctions.refresh.completed — successful refresh + diff
+ *   compliance.sanctions.refresh.skipped   — tick returned empty
+ *   compliance.sanctions.refresh.failed    — fetch threw
+ */
+
+var C = require("./constants");
+var lazyRequire = require("./lazy-require");
+var safeAsync = require("./safe-async");
+var validateOpts = require("./validate-opts");
+var { defineClass } = require("./framework-error");
+
+var SanctionsFetcherError = defineClass("SanctionsFetcherError", { alwaysPermanent: true });
+
+var audit = lazyRequire(function () { return require("./audit"); });
+var observability = lazyRequire(function () { return require("./observability"); });
+
+function create(opts) {
+  validateOpts.requireObject(opts, "compliance.sanctions.fetcher", SanctionsFetcherError);
+  validateOpts(opts, [
+    "screener", "intervalMs", "fetch",
+    "onRefreshed", "onError",
+    "fetchOnStart", "audit",
+  ], "compliance.sanctions.fetcher.create");
+
+  if (!opts.screener || typeof opts.screener.reload !== "function") {
+    throw new SanctionsFetcherError("sanctions-fetcher/bad-screener",
+      "fetcher.create: screener must be a sanctions.create() instance");
+  }
+  if (typeof opts.fetch !== "function") {
+    throw new SanctionsFetcherError("sanctions-fetcher/bad-fetch",
+      "fetcher.create: fetch must be an async function returning entry[]");
+  }
+  validateOpts.optionalPositiveFinite(opts.intervalMs,
+    "fetcher.create: intervalMs", SanctionsFetcherError, "sanctions-fetcher/bad-opts");
+  validateOpts.optionalFunction(opts.onRefreshed,
+    "fetcher.create: onRefreshed", SanctionsFetcherError, "sanctions-fetcher/bad-opts");
+  validateOpts.optionalFunction(opts.onError,
+    "fetcher.create: onError", SanctionsFetcherError, "sanctions-fetcher/bad-opts");
+
+  var intervalMs   = opts.intervalMs   || C.TIME.hours(24);
+  var fetchOnStart = opts.fetchOnStart !== false;
+  var auditOn      = opts.audit !== false;
+  var screener     = opts.screener;
+  var fetchFn      = opts.fetch;
+
+  var handle  = null;
+  var stopping = false;
+  var lastSuccess = null;
+  var lastError = null;
+  var refreshCount = 0;
+  var failureCount = 0;
+
+  function _emitAudit(action, outcome, metadata) {
+    if (!auditOn) return;
+    try {
+      audit().safeEmit({
+        action:   action,
+        outcome:  outcome,
+        metadata: metadata || {},
+      });
+    } catch (_e) { /* drop-silent */ }
+  }
+
+  function _emitMetric(verb, n) {
+    try { observability().safeEvent("compliance.sanctions.fetcher." + verb, n || 1, {}); }
+    catch (_e) { /* drop-silent */ }
+  }
+
+  async function _tick() {
+    if (stopping) return;
+    _emitAudit("compliance.sanctions.refresh.started", "success", {
+      algorithm: screener.algorithm,
+    });
+    var entries;
+    try {
+      entries = await fetchFn();
+    } catch (e) {
+      failureCount += 1;
+      lastError = (e && e.message) || String(e);
+      _emitAudit("compliance.sanctions.refresh.failed", "failure", {
+        error: lastError, algorithm: screener.algorithm,
+      });
+      _emitMetric("failed", 1);
+      if (typeof opts.onError === "function") {
+        try { opts.onError(e); } catch (_e2) { /* operator hook */ }
+      }
+      return;
+    }
+    if (!Array.isArray(entries) || entries.length === 0) {
+      _emitAudit("compliance.sanctions.refresh.skipped", "success", {
+        reason: "fetch-returned-empty", algorithm: screener.algorithm,
+      });
+      _emitMetric("skipped", 1);
+      return;
+    }
+    var diff;
+    try { diff = screener.reload(entries); }
+    catch (e) {
+      failureCount += 1;
+      lastError = (e && e.message) || String(e);
+      _emitAudit("compliance.sanctions.refresh.failed", "failure", {
+        error: lastError, phase: "reload", algorithm: screener.algorithm,
+      });
+      _emitMetric("failed", 1);
+      if (typeof opts.onError === "function") {
+        try { opts.onError(e); } catch (_e2) { /* operator hook */ }
+      }
+      return;
+    }
+    refreshCount += 1;
+    lastSuccess = Date.now();
+    _emitAudit("compliance.sanctions.refresh.completed", "success", {
+      algorithm: screener.algorithm,
+      added:     diff.addedIds.length,
+      removed:   diff.removedIds.length,
+      newSize:   diff.newSize,
+    });
+    _emitMetric("completed", 1);
+    if (typeof opts.onRefreshed === "function") {
+      try { opts.onRefreshed(diff); } catch (_e2) { /* operator hook */ }
+    }
+  }
+
+  function start() {
+    if (handle) return;
+    stopping = false;
+    if (fetchOnStart) {
+      // Fire-and-forget; the periodic ticker handles the rest.
+      _tick().catch(function () { /* drop-silent — see _tick */ });
+    }
+    handle = safeAsync.repeating(function () {
+      _tick().catch(function () { /* drop-silent */ });
+    }, intervalMs, { name: "sanctions-fetcher" });
+  }
+
+  async function shutdown() {
+    stopping = true;
+    if (handle) { handle.stop(); handle = null; }
+  }
+
+  function stats() {
+    return {
+      lastSuccess:  lastSuccess,
+      lastError:    lastError,
+      refreshCount: refreshCount,
+      failureCount: failureCount,
+      running:      handle !== null,
+    };
+  }
+
+  return {
+    start:      start,
+    shutdown:   shutdown,
+    stats:      stats,
+    // Test hook
+    _tickOnce:  _tick,
+  };
+}
+
+module.exports = {
+  create:                  create,
+  SanctionsFetcherError:   SanctionsFetcherError,
+};