@openora/core 0.4.1-canary.39 → 0.4.1-canary.41

package/dist/pam/tag/__tests__/tag-evaluation.service.test.js

@@ -2,6 +2,10 @@ import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vites
 import { randomUUID } from 'node:crypto';
 import { and, eq, isNull, sql } from 'drizzle-orm';
 import { createTestDb } from '@openora/core/testing';
+import { user } from '@openora/core/pam/schema/identity';
+import { migrate as migrateIdentity } from '@openora/core/pam/migrate/identity';
+import { player } from '@openora/core/pam/schema/profile';
+import { migrate as migrateProfile } from '@openora/core/pam/migrate/profile';
 import { mock, makeEventBus } from '../../../testing/mock.js';
 import { TagEvaluationService } from '../service/tag-evaluation.service.js';
 import { SYSTEM_ACTOR_ID } from '../service/tag-mappers.js';
@@ -28,10 +32,18 @@ async function seedRule(key, overrides = {}) {
 }
 async function seedKycPendingRule(overrides = {}) {
     const kycPendingTag = await seedRule('kyc_pending', overrides);
-    const kycRejectedTag = await seedTagRow('kyc_rejected');
+    const kycRejectedTag = await seedRule('kyc_rejected');
     return { kycPendingTag, kycRejectedTag };
 }
-async function seedActiveAssignment(playerId, tagRow) {
+// onAuthenticatedLogin unconditionally tries to remove BOTH the inactive and
+// dormant_high_roller catalog tags on every login - both rows must exist regardless
+// of which one (if either) a given test actually cares about.
+async function seedLoginCleanupTags() {
+    const inactiveTag = await seedTagRow('inactive');
+    const dormantTag = await seedTagRow('dormant_high_roller');
+    return { inactiveTag, dormantTag };
+}
+async function seedActiveAssignment(playerId, tagRow, overrides = {}) {
     const [row] = await db.drizzle.db
         .insert(playerTag)
         .values({
@@ -40,6 +52,7 @@ async function seedActiveAssignment(playerId, tagRow) {
         assignReason: 'seed fixture',
         assignActor: 'manual',
         assignActorUserId: null,
+        ...overrides,
     })
         .returning();
     return row;
@@ -59,6 +72,40 @@ async function assignmentRow(playerId, tagRow) {
         .where(and(eq(playerTag.playerId, playerId), eq(playerTag.tagId, tagRow.id)));
     return row;
 }
+async function activeAssignmentRow(playerId, tagRow) {
+    const [row] = await db.drizzle.db
+        .select()
+        .from(playerTag)
+        .where(and(eq(playerTag.playerId, playerId), eq(playerTag.tagId, tagRow.id), isNull(playerTag.removedAt)));
+    return row;
+}
+async function seedUser(overrides = {}) {
+    const [row] = await db.drizzle.db
+        .insert(user)
+        .values({ name: 'Player', email: `${randomUUID()}@example.com`, ...overrides })
+        .returning();
+    return row;
+}
+async function seedPlayer(userId, overrides = {}) {
+    const [row] = await db.drizzle.db
+        .insert(player)
+        .values({ userId, displayName: 'Player', ...overrides })
+        .returning();
+    return row;
+}
+async function seedPlayerWithUser() {
+    const account = await seedUser();
+    const row = await seedPlayer(account.id);
+    return { account, player: row };
+}
+// Resolves identityReader.getPlayerIdByUserId for a fixed set of (userId, playerId)
+// pairs - the real TagService methods that join through the `player` table
+// (getActiveTagKeys, listActiveHoldersByTagKey) need actual player rows, so those
+// tests seed a real player and must resolve to its real id, not just echo the userId.
+function identityLookup(pairs) {
+    const map = new Map(pairs);
+    return vi.fn(async (uid) => map.get(uid) ?? null);
+}
 function makeServices(overrides = {}) {
     const events = makeEventBus();
     const tagService = new TagService(db.drizzle, events);
@@ -66,16 +113,29 @@ function makeServices(overrides = {}) {
     const walletReader = mock({
         getLifetimeDeposit: vi.fn().mockResolvedValue('0'),
         getWithdrawalCountInWindow: vi.fn().mockResolvedValue(0),
+        getWithdrawalCountsInWindow: vi.fn().mockResolvedValue(new Map()),
         ...overrides.walletReader,
     });
     const identityReader = mock({
         getLastLoginAt: vi.fn().mockResolvedValue(null),
         getPlayerIdsInactiveSince: vi.fn().mockResolvedValue([]),
         getPlayerIdByUserId: vi.fn(async (uid) => uid),
+        getPlayerKycStatusByUserId: vi.fn().mockResolvedValue('pending'),
+        getPlayerUserIdsSharingLoginIp: vi.fn().mockResolvedValue([]),
         ...overrides.identityReader,
     });
-    const service = new TagEvaluationService(tagService, ruleService, walletReader, identityReader);
-    return { service, walletReader, identityReader };
+    const adminUserDirectory = mock({
+        lookupPlayers: vi.fn().mockResolvedValue([]),
+        ...overrides.adminUserDirectory,
+    });
+    const service = new TagEvaluationService({
+        tag: tagService,
+        rule: ruleService,
+        walletReader,
+        identityReader,
+        adminUserDirectory,
+    });
+    return { service, tagService, ruleService, walletReader, identityReader, adminUserDirectory };
 }
 function depositPayload(userId, amount) {
     return { userId, amount: String(amount), currency: 'USD', transactionId: randomUUID() };
@@ -84,16 +144,23 @@ function withdrawalPayload(userId, amount) {
     return { userId, amount: String(amount), currency: 'USD', transactionId: randomUUID() };
 }
 function kycUpdatedPayload(userId, status) {
-    return { userId, actorId: SYSTEM_ACTOR_ID, status, previousStatus: 'pending' };
+    return {
+        userId,
+        actorId: SYSTEM_ACTOR_ID,
+        status,
+        previousStatus: 'pending',
+        reason: null,
+        source: 'webhook',
+    };
 }
 beforeAll(async () => {
-    db = await createTestDb([migrate]);
+    db = await createTestDb([migrateIdentity, migrateProfile, migrate]);
 });
 afterAll(async () => {
     await db.drop();
 });
 beforeEach(async () => {
-    await db.drizzle.db.execute(sql `TRUNCATE ${playerTag}, ${tagRule}, ${tag} RESTART IDENTITY CASCADE`);
+    await db.drizzle.db.execute(sql `TRUNCATE ${playerTag}, ${tagRule}, ${tag}, ${player}, ${user} RESTART IDENTITY CASCADE`);
 });
 describe('TagEvaluationService.onDepositCompleted (real PG)', () => {
     it('assigns large_depositor when a single deposit meets the amount threshold', async () => {
@@ -143,22 +210,52 @@ describe('TagEvaluationService.onDepositCompleted (real PG)', () => {
     });
 });
 describe('TagEvaluationService.onWithdrawalCompleted (real PG)', () => {
-    it('assigns high_risk when a single withdrawal meets the amount threshold', async () => {
+    it('assigns high_risk when a single withdrawal meets the amount threshold, recording the amount breach detail', async () => {
         const userId = randomUUID();
         const { service } = makeServices();
-        await seedRule('high_risk', { threshold: '1000' });
+        const highRisk = await seedRule('high_risk', { threshold: '1000' });
         await service.onWithdrawalCompleted(withdrawalPayload(userId, 1500));
         expect(await activeTagKeys(userId)).toContain('high_risk');
+        const row = await assignmentRow(userId, highRisk);
+        expect(row?.assignMetadata).toEqual({
+            amountBreach: { amount: '1500', threshold: '1000.00' },
+            countBreach: null,
+        });
     });
-    it('assigns high_risk when the withdrawal count in the window meets the threshold', async () => {
+    it('assigns high_risk when the withdrawal count in the window meets the threshold, recording the count breach detail', async () => {
         const userId = randomUUID();
         const { service, walletReader } = makeServices({
             walletReader: { getWithdrawalCountInWindow: vi.fn().mockResolvedValue(3) },
         });
-        await seedRule('high_risk', { threshold: '1000', thresholdDays: 7, thresholdCount: 3 });
+        const highRisk = await seedRule('high_risk', {
+            threshold: '1000',
+            thresholdDays: 7,
+            thresholdCount: 3,
+        });
         await service.onWithdrawalCompleted(withdrawalPayload(userId, 10));
         expect(walletReader.getWithdrawalCountInWindow).toHaveBeenCalledWith(userId, 7);
-        expect(await activeTagKeys(userId)).toContain('high_risk');
+        const row = await assignmentRow(userId, highRisk);
+        expect(row?.assignMetadata).toEqual({
+            amountBreach: null,
+            countBreach: { count: 3, thresholdCount: 3, thresholdDays: 7 },
+        });
+    });
+    it('records both breach details when both amount and frequency thresholds are met', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices({
+            walletReader: { getWithdrawalCountInWindow: vi.fn().mockResolvedValue(5) },
+        });
+        const highRisk = await seedRule('high_risk', {
+            threshold: '1000',
+            thresholdDays: 7,
+            thresholdCount: 3,
+        });
+        await service.onWithdrawalCompleted(withdrawalPayload(userId, 1500));
+        const row = await assignmentRow(userId, highRisk);
+        expect(row?.assignMetadata).toEqual({
+            amountBreach: { amount: '1500', threshold: '1000.00' },
+            countBreach: { count: 5, thresholdCount: 3, thresholdDays: 7 },
+        });
     });
     it('takes no action when neither threshold is met (risk designation requires admin clear)', async () => {
         const userId = randomUUID();
@@ -177,17 +274,150 @@ describe('TagEvaluationService.onWithdrawalCompleted (real PG)', () => {
         expect(walletReader.getWithdrawalCountInWindow).not.toHaveBeenCalled();
     });
 });
+describe('TagEvaluationService.onWithdrawalRequested (real PG)', () => {
+    it('assigns withdrawal_review when the withdrawal amount meets the threshold', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        await seedRule('withdrawal_review', { threshold: '5000' });
+        await service.onWithdrawalRequested(withdrawalPayload(userId, 5000));
+        expect(await activeTagKeys(userId)).toContain('withdrawal_review');
+    });
+    it('does not assign withdrawal_review when the amount is below threshold', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        await seedRule('withdrawal_review', { threshold: '5000' });
+        await service.onWithdrawalRequested(withdrawalPayload(userId, 4999));
+        expect(await activeTagKeys(userId)).not.toContain('withdrawal_review');
+    });
+    it('does nothing when the rule is disabled', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        await seedRule('withdrawal_review', { threshold: '5000', isEnabled: false });
+        await service.onWithdrawalRequested(withdrawalPayload(userId, 99999));
+        expect(await activeTagKeys(userId)).toEqual([]);
+    });
+    it('does nothing when the rule is absent', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        await service.onWithdrawalRequested(withdrawalPayload(userId, 99999));
+        expect(await activeTagKeys(userId)).toEqual([]);
+    });
+});
+describe('TagEvaluationService.evaluateWithdrawalRequested (real PG)', () => {
+    it('assigns withdrawal_review on the caller-supplied tx when the amount meets threshold', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        await seedRule('withdrawal_review', { threshold: '5000' });
+        await db.drizzle.db.transaction(async (trx) => {
+            await service.evaluateWithdrawalRequested(trx, { userId, amount: '5000' });
+        });
+        expect(await activeTagKeys(userId)).toContain('withdrawal_review');
+    });
+    it('does not assign when the amount is below threshold', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        await seedRule('withdrawal_review', { threshold: '5000' });
+        await db.drizzle.db.transaction(async (trx) => {
+            await service.evaluateWithdrawalRequested(trx, { userId, amount: '4999' });
+        });
+        expect(await activeTagKeys(userId)).not.toContain('withdrawal_review');
+    });
+    it('does nothing when the rule is disabled or absent', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        await db.drizzle.db.transaction(async (trx) => {
+            await service.evaluateWithdrawalRequested(trx, { userId, amount: '99999' });
+        });
+        expect(await activeTagKeys(userId)).toEqual([]);
+    });
+    it('is idempotent - swallows TagAlreadyInUseError when already assigned', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        await seedRule('withdrawal_review', { threshold: '5000' });
+        await expect(db.drizzle.db.transaction(async (trx) => {
+            await service.evaluateWithdrawalRequested(trx, { userId, amount: '5000' });
+            await service.evaluateWithdrawalRequested(trx, { userId, amount: '5000' });
+        })).resolves.toBeUndefined();
+        const rows = await db.drizzle.db.select().from(playerTag);
+        expect(rows).toHaveLength(1);
+    });
+    it('propagates an unexpected error (fail-closed: a review-gate failure must block the caller, not silently skip review)', async () => {
+        const userId = randomUUID();
+        const { service, tagService } = makeServices();
+        await seedRule('withdrawal_review', { threshold: '5000' });
+        vi.spyOn(tagService, 'assignPlayerTagInTx').mockRejectedValueOnce(new Error('db unavailable'));
+        await expect(db.drizzle.db.transaction(async (trx) => {
+            await service.evaluateWithdrawalRequested(trx, { userId, amount: '5000' });
+        })).rejects.toThrow('db unavailable');
+    });
+});
 describe('TagEvaluationService.onUserLogin (real PG)', () => {
     it('removes an active inactive-tag assignment when the player logs in', async () => {
         const userId = randomUUID();
         const { service } = makeServices();
-        const inactiveTag = await seedTagRow('inactive');
+        const { inactiveTag } = await seedLoginCleanupTags();
         await seedActiveAssignment(userId, inactiveTag);
         await service.onUserLogin({ userId });
         expect(await activeTagKeys(userId)).not.toContain('inactive');
         const row = await assignmentRow(userId, inactiveTag);
         expect(row).toMatchObject({ removalActor: 'scheduled', removalActorUserId: SYSTEM_ACTOR_ID });
     });
+    it('removes an active dormant_high_roller assignment when the player logs in', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        const { dormantTag } = await seedLoginCleanupTags();
+        await seedActiveAssignment(userId, dormantTag);
+        await service.onUserLogin({ userId });
+        expect(await activeTagKeys(userId)).not.toContain('dormant_high_roller');
+    });
+    it('is idempotent when dormant_high_roller was never assigned', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        await seedLoginCleanupTags();
+        await expect(service.onUserLogin({ userId })).resolves.toBeUndefined();
+    });
+    it('assigns multi_account and bonus_abuser to both player accounts when login IP is shared', async () => {
+        const userId = randomUUID();
+        const otherUserId = randomUUID();
+        const { service, identityReader } = makeServices({
+            identityReader: { getPlayerUserIdsSharingLoginIp: vi.fn().mockResolvedValue([otherUserId]) },
+        });
+        await seedLoginCleanupTags();
+        await seedRule('multi_account');
+        await seedRule('bonus_abuser');
+        await service.onUserLogin({ userId, ip: '203.0.113.10', userAgent: null });
+        expect(identityReader.getPlayerUserIdsSharingLoginIp).toHaveBeenCalledWith(userId, '203.0.113.10');
+        expect(await activeTagKeys(userId)).toEqual(expect.arrayContaining(['multi_account', 'bonus_abuser']));
+        expect(await activeTagKeys(otherUserId)).toEqual(expect.arrayContaining(['multi_account', 'bonus_abuser']));
+    });
+    it('does not evaluate shared-IP risk when login has no IP metadata', async () => {
+        const userId = randomUUID();
+        const { service, identityReader } = makeServices();
+        await seedLoginCleanupTags();
+        await seedRule('multi_account');
+        await seedRule('bonus_abuser');
+        await service.onUserLogin({ userId });
+        expect(identityReader.getPlayerUserIdsSharingLoginIp).not.toHaveBeenCalled();
+    });
+    it('uses the same shared-IP risk path for phone login', async () => {
+        const userId = randomUUID();
+        const otherUserId = randomUUID();
+        const { service, identityReader } = makeServices({
+            identityReader: { getPlayerUserIdsSharingLoginIp: vi.fn().mockResolvedValue([otherUserId]) },
+        });
+        await seedLoginCleanupTags();
+        await seedRule('multi_account');
+        await seedRule('bonus_abuser');
+        await service.onUserPhoneLogin({
+            userId,
+            method: 'phone',
+            ip: '203.0.113.11',
+            userAgent: null,
+        });
+        expect(identityReader.getPlayerUserIdsSharingLoginIp).toHaveBeenCalledWith(userId, '203.0.113.11');
+        expect(await activeTagKeys(userId)).toContain('multi_account');
+        expect(await activeTagKeys(otherUserId)).toContain('bonus_abuser');
+    });
 });
 describe('TagEvaluationService.onKycSubmitted (real PG)', () => {
     it('assigns kyc_pending when the rule is enabled', async () => {
@@ -197,14 +427,23 @@ describe('TagEvaluationService.onKycSubmitted (real PG)', () => {
         await service.onKycSubmitted({ userId, referenceId: 'ref-1', provider: 'sumsub' });
         expect(await activeTagKeys(userId)).toContain('kyc_pending');
     });
-    it('removes an existing kyc_rejected assignment on resubmission', async () => {
+    it('keeps kyc_rejected sticky on the resubmission path', async () => {
         const userId = randomUUID();
         const { service } = makeServices();
         const { kycRejectedTag } = await seedKycPendingRule();
         await seedActiveAssignment(userId, kycRejectedTag);
         await service.onKycSubmitted({ userId, referenceId: 'ref-1', provider: 'sumsub' });
         expect(await activeTagKeys(userId)).toContain('kyc_pending');
-        expect(await activeTagKeys(userId)).not.toContain('kyc_rejected');
+        expect(await activeTagKeys(userId)).toContain('kyc_rejected');
+    });
+    it('does not assign kyc_pending when the profile status is already terminal', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices({
+            identityReader: { getPlayerKycStatusByUserId: vi.fn().mockResolvedValue('verified') },
+        });
+        await seedKycPendingRule();
+        await service.onKycSubmitted({ userId, referenceId: 'ref-1', provider: 'sumsub' });
+        expect(await activeTagKeys(userId)).toEqual([]);
     });
     it('does nothing when kyc_pending rule is disabled', async () => {
         const userId = randomUUID();
@@ -243,17 +482,35 @@ describe('TagEvaluationService.onKycStatusUpdated (real PG)', () => {
         await service.onKycStatusUpdated(kycUpdatedPayload(userId, 'rejected'));
         expect(await activeTagKeys(userId)).toEqual(['kyc_rejected']);
     });
-    it('assigns kyc_pending on resubmission_requested', async () => {
+    it('assigns kyc_pending and keeps kyc_rejected on resubmission_requested', async () => {
         const userId = randomUUID();
         const { service } = makeServices();
-        await seedKycPendingRule();
+        const { kycRejectedTag } = await seedKycPendingRule();
+        await seedActiveAssignment(userId, kycRejectedTag);
         await service.onKycStatusUpdated(kycUpdatedPayload(userId, 'resubmission_requested'));
-        expect(await activeTagKeys(userId)).toContain('kyc_pending');
+        expect(await activeTagKeys(userId)).toEqual(expect.arrayContaining(['kyc_pending', 'kyc_rejected']));
+    });
+    it('does not assign kyc_pending on resubmission_requested when the rule is disabled', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        await seedRule('kyc_pending', { isEnabled: false });
+        await service.onKycStatusUpdated(kycUpdatedPayload(userId, 'resubmission_requested'));
+        expect(await activeTagKeys(userId)).toEqual([]);
+    });
+    it('does not assign kyc_rejected when the rejected rule is disabled', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        const kycPendingTag = await seedRule('kyc_pending');
+        await seedActiveAssignment(userId, kycPendingTag);
+        await seedRule('kyc_rejected', { isEnabled: false });
+        await service.onKycStatusUpdated(kycUpdatedPayload(userId, 'rejected'));
+        expect(await activeTagKeys(userId)).toEqual([]);
     });
     it('does nothing when kyc_pending rule is disabled', async () => {
         const userId = randomUUID();
         const { service } = makeServices();
         await seedRule('kyc_pending', { isEnabled: false });
+        await seedTagRow('kyc_rejected');
         await service.onKycStatusUpdated(kycUpdatedPayload(userId, 'verified'));
         expect(await activeTagKeys(userId)).toEqual([]);
     });
@@ -318,6 +575,349 @@ describe('TagEvaluationService.runDailyEvaluation (real PG)', () => {
         await service.runDailyEvaluation();
         expect(identityReader.getPlayerIdsInactiveSince).not.toHaveBeenCalled();
     });
+    describe('dormant_high_roller sweep (real PG)', () => {
+        it('assigns to inactive users who also hold high_roller', async () => {
+            const { account: a1, player: p1 } = await seedPlayerWithUser();
+            const { account: a2, player: p2 } = await seedPlayerWithUser();
+            const highRoller = await seedTagRow('high_roller');
+            await seedActiveAssignment(p1.id, highRoller);
+            const kycPending = await seedTagRow('kyc_pending');
+            await seedActiveAssignment(p2.id, kycPending);
+            await seedRule('dormant_high_roller', { thresholdDays: 60 });
+            const { service } = makeServices({
+                identityReader: {
+                    getPlayerIdsInactiveSince: vi.fn().mockResolvedValue([a1.id, a2.id]),
+                    getPlayerIdByUserId: identityLookup([
+                        [a1.id, p1.id],
+                        [a2.id, p2.id],
+                    ]),
+                },
+            });
+            await service.runDailyEvaluation();
+            expect(await activeTagKeys(p1.id)).toContain('dormant_high_roller');
+            expect(await activeTagKeys(p2.id)).not.toContain('dormant_high_roller');
+        });
+        it('does not assign to inactive users without high_roller', async () => {
+            const { account, player: seededPlayer } = await seedPlayerWithUser();
+            const vip = await seedTagRow('vip');
+            await seedActiveAssignment(seededPlayer.id, vip);
+            await seedRule('dormant_high_roller', { thresholdDays: 60 });
+            const { service } = makeServices({
+                identityReader: {
+                    getPlayerIdsInactiveSince: vi.fn().mockResolvedValue([account.id]),
+                    getPlayerIdByUserId: identityLookup([[account.id, seededPlayer.id]]),
+                },
+            });
+            await service.runDailyEvaluation();
+            expect(await activeTagKeys(seededPlayer.id)).not.toContain('dormant_high_roller');
+        });
+        it('does nothing when the rule is disabled', async () => {
+            await seedRule('dormant_high_roller', { thresholdDays: 60, isEnabled: false });
+            const { service, identityReader } = makeServices();
+            await service.runDailyEvaluation();
+            expect(identityReader.getPlayerIdsInactiveSince).not.toHaveBeenCalled();
+        });
+        it('does nothing when thresholdDays is null', async () => {
+            await seedRule('dormant_high_roller', { thresholdDays: null });
+            const { service, identityReader } = makeServices();
+            await service.runDailyEvaluation();
+            expect(identityReader.getPlayerIdsInactiveSince).not.toHaveBeenCalled();
+        });
+    });
+    describe('high_risk resweep (real PG)', () => {
+        const countOnlyMetadata = {
+            amountBreach: null,
+            countBreach: { count: 3, thresholdCount: 3, thresholdDays: 7 },
+        };
+        const amountBreachMetadata = {
+            amountBreach: { amount: '2000', threshold: '1000' },
+            countBreach: null,
+        };
+        async function seedHighRiskHolder(highRiskTag, metadata) {
+            const { account, player: seededPlayer } = await seedPlayerWithUser();
+            await seedActiveAssignment(seededPlayer.id, highRiskTag, { assignMetadata: metadata });
+            return { account, player: seededPlayer };
+        }
+        it('removes the tag from a holder when the recheck shows count below threshold', async () => {
+            const highRisk = await seedRule('high_risk', {
+                threshold: '1000',
+                thresholdDays: 7,
+                thresholdCount: 3,
+            });
+            const { account, player: seededPlayer } = await seedHighRiskHolder(highRisk, countOnlyMetadata);
+            const { service, walletReader } = makeServices({
+                walletReader: {
+                    getWithdrawalCountsInWindow: vi.fn().mockResolvedValue(new Map([[account.id, 1]])),
+                },
+                identityReader: { getPlayerIdByUserId: identityLookup([[account.id, seededPlayer.id]]) },
+            });
+            await service.runDailyEvaluation();
+            expect(walletReader.getWithdrawalCountsInWindow).toHaveBeenCalledWith([account.id], 7);
+            expect(await activeTagKeys(seededPlayer.id)).not.toContain('high_risk');
+        });
+        it('keeps the tag when the count is still at or above threshold', async () => {
+            const highRisk = await seedRule('high_risk', {
+                threshold: '1000',
+                thresholdDays: 7,
+                thresholdCount: 3,
+            });
+            const { account, player: seededPlayer } = await seedHighRiskHolder(highRisk, countOnlyMetadata);
+            const { service } = makeServices({
+                walletReader: {
+                    getWithdrawalCountsInWindow: vi.fn().mockResolvedValue(new Map([[account.id, 3]])),
+                },
+                identityReader: { getPlayerIdByUserId: identityLookup([[account.id, seededPlayer.id]]) },
+            });
+            await service.runDailyEvaluation();
+            expect(await activeTagKeys(seededPlayer.id)).toContain('high_risk');
+        });
+        it('treats a holder absent from the batched result as zero and removes the tag', async () => {
+            const highRisk = await seedRule('high_risk', {
+                threshold: '1000',
+                thresholdDays: 7,
+                thresholdCount: 3,
+            });
+            const { account, player: seededPlayer } = await seedHighRiskHolder(highRisk, countOnlyMetadata);
+            const { service } = makeServices({
+                walletReader: { getWithdrawalCountsInWindow: vi.fn().mockResolvedValue(new Map()) },
+                identityReader: { getPlayerIdByUserId: identityLookup([[account.id, seededPlayer.id]]) },
+            });
+            await service.runDailyEvaluation();
+            expect(await activeTagKeys(seededPlayer.id)).not.toContain('high_risk');
+        });
+        it('skips entirely when thresholdDays is null (amount-only rule, not resweepable)', async () => {
+            await seedRule('high_risk', { threshold: '1000', thresholdDays: null, thresholdCount: 3 });
+            const { service, walletReader } = makeServices();
+            await service.runDailyEvaluation();
+            expect(walletReader.getWithdrawalCountsInWindow).not.toHaveBeenCalled();
+        });
+        it('skips entirely when thresholdCount is null (no frequency dimension to resweep)', async () => {
+            await seedRule('high_risk', { threshold: '1000', thresholdDays: 7, thresholdCount: null });
+            const { service, walletReader } = makeServices();
+            await service.runDailyEvaluation();
+            expect(walletReader.getWithdrawalCountsInWindow).not.toHaveBeenCalled();
+        });
+        it('skips when the rule is disabled', async () => {
+            await seedRule('high_risk', {
+                threshold: '1000',
+                thresholdDays: 7,
+                thresholdCount: 3,
+                isEnabled: false,
+            });
+            const { service, walletReader } = makeServices();
+            await service.runDailyEvaluation();
+            expect(walletReader.getWithdrawalCountsInWindow).not.toHaveBeenCalled();
+        });
+        it('does nothing when there are no holders', async () => {
+            await seedRule('high_risk', { threshold: '1000', thresholdDays: 7, thresholdCount: 3 });
+            const { service, walletReader } = makeServices();
+            await service.runDailyEvaluation();
+            expect(walletReader.getWithdrawalCountsInWindow).not.toHaveBeenCalled();
+        });
+        it('falls back to per-holder getWithdrawalCountInWindow when the batched method is absent from the adapter', async () => {
+            const highRisk = await seedRule('high_risk', {
+                threshold: '1000',
+                thresholdDays: 7,
+                thresholdCount: 3,
+            });
+            const { account: a1, player: p1 } = await seedHighRiskHolder(highRisk, countOnlyMetadata);
+            const { account: a2, player: p2 } = await seedHighRiskHolder(highRisk, countOnlyMetadata);
+            const { service, walletReader } = makeServices({
+                // Simulate an external WalletReader implementation that predates the batched method.
+                walletReader: {
+                    getWithdrawalCountsInWindow: undefined,
+                    getWithdrawalCountInWindow: vi.fn(async (userId) => (userId === a1.id ? 1 : 5)),
+                },
+                identityReader: {
+                    getPlayerIdByUserId: identityLookup([
+                        [a1.id, p1.id],
+                        [a2.id, p2.id],
+                    ]),
+                },
+            });
+            await service.runDailyEvaluation();
+            expect(walletReader.getWithdrawalCountInWindow).toHaveBeenCalledWith(a1.id, 7);
+            expect(walletReader.getWithdrawalCountInWindow).toHaveBeenCalledWith(a2.id, 7);
+            expect(await activeTagKeys(p1.id)).not.toContain('high_risk');
+            expect(await activeTagKeys(p2.id)).toContain('high_risk');
+        });
+        it('does not remove a holder whose assignMetadata shows an amount breach, even when the windowed count is below threshold (bug-fix case)', async () => {
+            const highRisk = await seedRule('high_risk', {
+                threshold: '1000',
+                thresholdDays: 7,
+                thresholdCount: 3,
+            });
+            const { account, player: seededPlayer } = await seedHighRiskHolder(highRisk, amountBreachMetadata);
+            const { service } = makeServices({
+                walletReader: {
+                    getWithdrawalCountsInWindow: vi.fn().mockResolvedValue(new Map([[account.id, 0]])),
+                },
+                identityReader: { getPlayerIdByUserId: identityLookup([[account.id, seededPlayer.id]]) },
+            });
+            await service.runDailyEvaluation();
+            expect(await activeTagKeys(seededPlayer.id)).toContain('high_risk');
+        });
+        it('still removes a count-only-breach holder whose windowed count drops below threshold (existing behavior preserved)', async () => {
+            const highRisk = await seedRule('high_risk', {
+                threshold: '1000',
+                thresholdDays: 7,
+                thresholdCount: 3,
+            });
+            const { account, player: seededPlayer } = await seedHighRiskHolder(highRisk, countOnlyMetadata);
+            const { service } = makeServices({
+                walletReader: {
+                    getWithdrawalCountsInWindow: vi.fn().mockResolvedValue(new Map([[account.id, 1]])),
+                },
+                identityReader: { getPlayerIdByUserId: identityLookup([[account.id, seededPlayer.id]]) },
+            });
+            await service.runDailyEvaluation();
+            expect(await activeTagKeys(seededPlayer.id)).not.toContain('high_risk');
+        });
+        it('does not remove a holder with null assignMetadata (legacy row), even when below threshold', async () => {
+            const highRisk = await seedRule('high_risk', {
+                threshold: '1000',
+                thresholdDays: 7,
+                thresholdCount: 3,
+            });
+            const { account, player: seededPlayer } = await seedHighRiskHolder(highRisk, null);
+            const { service } = makeServices({
+                walletReader: {
+                    getWithdrawalCountsInWindow: vi.fn().mockResolvedValue(new Map([[account.id, 0]])),
+                },
+                identityReader: { getPlayerIdByUserId: identityLookup([[account.id, seededPlayer.id]]) },
+            });
+            await service.runDailyEvaluation();
+            expect(await activeTagKeys(seededPlayer.id)).toContain('high_risk');
+        });
+    });
+});
+describe('TagEvaluationService.onSelfExclusionActivated / onSelfExclusionLifted (real PG)', () => {
+    it('assigns self_excluded', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        await seedTagRow('self_excluded');
+        await service.onSelfExclusionActivated({
+            userId,
+            actorId: SYSTEM_ACTOR_ID,
+            reason: 'player requested self-exclusion',
+            exclusionId: randomUUID(),
+            isPermanent: false,
+            durationMonths: 6,
+            expiresAt: new Date().toISOString(),
+        });
+        expect(await activeTagKeys(userId)).toContain('self_excluded');
+    });
+    it('is idempotent when self_excluded is already assigned', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        const selfExcluded = await seedTagRow('self_excluded');
+        await seedActiveAssignment(userId, selfExcluded);
+        await expect(service.onSelfExclusionActivated({
+            userId,
+            actorId: SYSTEM_ACTOR_ID,
+            reason: 'player requested self-exclusion',
+            exclusionId: randomUUID(),
+            isPermanent: false,
+            durationMonths: 6,
+            expiresAt: null,
+        })).resolves.toBeUndefined();
+    });
+    it('removes self_excluded', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        const selfExcluded = await seedTagRow('self_excluded');
+        await seedActiveAssignment(userId, selfExcluded);
+        await service.onSelfExclusionLifted({
+            userId,
+            actorId: SYSTEM_ACTOR_ID,
+            reason: 'exclusion period expired',
+            exclusionId: randomUUID(),
+            kind: 'self_exclusion',
+        });
+        expect(await activeTagKeys(userId)).not.toContain('self_excluded');
+    });
+    it('is idempotent when self_excluded was never assigned', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        await seedTagRow('self_excluded');
+        await expect(service.onSelfExclusionLifted({
+            userId,
+            actorId: SYSTEM_ACTOR_ID,
+            reason: 'exclusion period expired',
+            exclusionId: randomUUID(),
+            kind: 'self_exclusion',
+        })).resolves.toBeUndefined();
+    });
+});
+describe('TagEvaluationService.onPlayerLevelChanged (real PG)', () => {
+    it('atomically replaces the level tag with the new level in the assign reason', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        const levelTag = await seedTagRow('level');
+        await seedActiveAssignment(userId, levelTag, { assignReason: 'player level set to 3' });
+        await service.onPlayerLevelChanged({
+            userId,
+            previousLevel: 3,
+            newLevel: 4,
+            actorId: SYSTEM_ACTOR_ID,
+        });
+        const row = await activeAssignmentRow(userId, levelTag);
+        expect(row).toMatchObject({
+            assignReason: 'player level set to 4',
+            assignActor: 'scheduled',
+            assignActorUserId: SYSTEM_ACTOR_ID,
+        });
+    });
+    it('swallows TagAlreadyInUseError when a concurrent replace wins the race', async () => {
+        const userId = randomUUID();
+        const { service } = makeServices();
+        const levelTag = await seedTagRow('level');
+        await expect(Promise.all([
+            service.onPlayerLevelChanged({
+                userId,
+                previousLevel: 0,
+                newLevel: 1,
+                actorId: SYSTEM_ACTOR_ID,
+            }),
+            service.onPlayerLevelChanged({
+                userId,
+                previousLevel: 0,
+                newLevel: 2,
+                actorId: SYSTEM_ACTOR_ID,
+            }),
+        ])).resolves.toEqual([undefined, undefined]);
+        const rows = await db.drizzle.db
+            .select()
+            .from(playerTag)
+            .where(and(eq(playerTag.playerId, userId), eq(playerTag.tagId, levelTag.id), isNull(playerTag.removedAt)));
+        expect(rows).toHaveLength(1);
+    });
+    it('rethrows unexpected errors from the replace', async () => {
+        const userId = randomUUID();
+        const { service, tagService } = makeServices();
+        await seedTagRow('level');
+        vi.spyOn(tagService, 'replacePlayerTag').mockRejectedValueOnce(new Error('connection lost'));
+        await expect(service.onPlayerLevelChanged({
+            userId,
+            previousLevel: 0,
+            newLevel: 1,
+            actorId: SYSTEM_ACTOR_ID,
+        })).rejects.toThrow('connection lost');
+    });
+    it('is a no-op when the playerId is unknown to the identity reader', async () => {
+        const userId = randomUUID();
+        const { service, tagService } = makeServices({
+            identityReader: { getPlayerIdByUserId: vi.fn().mockResolvedValue(null) },
+        });
+        const replaceSpy = vi.spyOn(tagService, 'replacePlayerTag');
+        await expect(service.onPlayerLevelChanged({
+            userId,
+            previousLevel: 3,
+            newLevel: 4,
+            actorId: SYSTEM_ACTOR_ID,
+        })).resolves.toBeUndefined();
+        expect(replaceSpy).not.toHaveBeenCalled();
+    });
 });
 describe('TagEvaluationService idempotency (real PG)', () => {
     it('swallows TagAlreadyInUseError when the tag is already active', async () => {
@@ -335,7 +935,7 @@ describe('TagEvaluationService idempotency (real PG)', () => {
     it('swallows TagAssignmentNotFoundError when nothing is assigned to remove', async () => {
         const userId = randomUUID();
         const { service } = makeServices();
-        await seedTagRow('inactive');
+        await seedLoginCleanupTags();
         await expect(service.onUserLogin({ userId })).resolves.toBeUndefined();
         expect(await activeTagKeys(userId)).toEqual([]);
     });