@voltro/plugin-sanctions 0.0.0-stage → 0.88.0

package/dist/service.js

@@ -0,0 +1,708 @@
+import { ACTION_KINDS as e, AppealSchema as t, CATEGORIES as n, CaseSchema as r, POINTS as i, ReportContextSchema as a, ReportSchema as o, SanctionSchema as s, SanctionScopeSchema as c } from "./contract.js";
+import { sanctionActionsTable as l, sanctionAdmissionsTable as u, sanctionAppealsTable as d, sanctionCasesTable as f, sanctionDeviceHintsTable as p, sanctionReportsTable as m, sanctionStrikesTable as h, sanctionTables as g } from "./entities.js";
+import { SanctionsError as _, sanctionsError as v } from "./errors.js";
+import { canonicalSanctionsRecords as ee, captureSanctionsAdmission as te, captureSanctionsAdmissionBatch as ne } from "./admission.server.js";
+import { createHash as y, createHmac as re } from "node:crypto";
+import { and as b, eq as x, or as S, queryFor as ie } from "@voltro/database";
+import { effectiveScopes as ae } from "@voltro/protocol";
+import { Effect as C, Schema as w } from "effect";
+import { prepareSqlMutation as oe } from "@voltro/database/sql";
+// src/service.ts
+var T = (e) => y("sha256").update(JSON.stringify(e)).digest("hex"), E = (e, t) => e + "_" + T(t).slice(0, 54), D = (e) => e instanceof _ ? e : v("unavailable"), O = (e) => C.tryPromise({
+	try: e,
+	catch: D
+}), k = (e) => C.try({
+	try: e,
+	catch: D
+}), A = (e) => {
+	if (typeof e != "string" || !e.trim() || e.length > 256 || e.includes("\0") || e === "~") throw v("invalid_input");
+}, j = (e) => {
+	if (e.type !== "user") throw v("identity_required");
+	return A(e.id), A(e.tenantId), e;
+}, M = (e) => {
+	if (e.type === "anonymous" || e.tenantId === null) throw v("identity_required");
+	return A(e.tenantId), e.tenantId;
+}, N = (e) => {
+	let t = M(e);
+	if (e.type !== "user" && e.type !== "serviceAccount" || !ae(e).some((e) => e === "sanctions:manage" || e === "admin:full")) throw v("forbidden");
+	return t;
+}, P = (e) => {
+	if (typeof e.id != "string" || !e.id) throw v("forbidden");
+	return e.id;
+}, F = (e, t) => {
+	let n = e[t];
+	if (typeof n != "string") throw v("unavailable");
+	return n;
+}, I = (e) => {
+	let t = e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : NaN;
+	if (!Number.isSafeInteger(t) || t < 0) throw v("unavailable");
+	return t;
+}, L = (e) => e === !0 || e === 1, R = (e, t, n = [], r = []) => {
+	let i = { ...t };
+	for (let e of n) i[e] = i[e] === null ? null : I(i[e]);
+	for (let e of r) i[e] = L(i[e]);
+	return w.decodeUnknownSync(e)(i);
+}, z = (e) => R(s, e, ["from", "until"], ["appealable"]), B = (e) => R(o, e, ["createdAt"]), se = (e) => R(r, e, ["decidedAt"]), V = (e) => R(t, e, ["createdAt", "decidedAt"]), H = (t, r, o) => {
+	let s = () => {
+		let e = r.now();
+		if (!Number.isSafeInteger(e) || e < 0 || e > 864e13) throw v("unavailable");
+		return e;
+	}, _ = (e, t = !1) => {
+		if (typeof e != "string" || !t && !e.trim() || [...e].length > r.maxTextLength || e.includes("\0")) throw v("invalid_input");
+		return e;
+	}, y = (e = {}) => {
+		let t = w.decodeUnknownSync(a)(e);
+		for (let e of [
+			t.channelId,
+			t.roomId,
+			t.matchId,
+			t.replayRef
+		]) e !== void 0 && A(e);
+		if ((t.messageIds?.length ?? 0) > r.maxContextMessageIds || new Set(t.messageIds).size !== (t.messageIds?.length ?? 0)) throw v("invalid_input");
+		return t.messageIds?.forEach(A), t;
+	}, ae = (e = {
+		channels: [],
+		queues: []
+	}) => {
+		let t = w.decodeUnknownSync(c)(e);
+		for (let e of [t.channels, t.queues]) {
+			if (e.length > 100 || new Set(e).size !== e.length) throw v("invalid_input");
+			e.forEach(A);
+		}
+		return {
+			channels: [...t.channels].sort(),
+			queues: [...t.queues].sort()
+		};
+	}, M = (e, t, n, i = r.maxExportRows + 1) => e.query(ie(t).where(n).orderBy("id", "asc").limit(i).descriptor), R = (e, t) => {
+		if (e.length > r.maxExportRows || e.some((e) => e.tenantId !== t)) throw v("export_limit");
+		return e;
+	}, H = async (e, t, n, r) => {
+		A(r);
+		let i = (await M(e, t, x("id", r), 1))[0];
+		if (!i || i.tenantId !== n) throw v("not_found");
+		return i;
+	}, U = (e, t) => E("sadmit", [e, t]), ce = async (e, n) => {
+		for (let r of [...new Set(n)].sort()) {
+			A(r);
+			let n = U(e, r);
+			try {
+				await t.insertIgnore(u.tableName, {
+					id: n,
+					tenantId: e,
+					subjectId: r,
+					admission: 0,
+					erased: !1,
+					metadata: {}
+				}, { conflictColumns: ["id"] });
+			} catch (i) {
+				let a = (await M(t, u, x("id", n), 1))[0];
+				if (!a || a.tenantId !== e || a.subjectId !== r && !L(a.erased)) throw i;
+			}
+		}
+	}, W = async (e, t, n, r = !1) => {
+		for (let i of [...new Set(n)].sort((e, n) => U(t, e) < U(t, n) ? -1 : 1)) {
+			let n = U(t, i);
+			if (await e.updateMany(u.tableName, { admission: 0 }, { where: x("id", n) }) !== 1) throw v("unavailable");
+			let a = await H(e, u, t, n);
+			if (L(a.erased)) {
+				if (!r) throw v("identity_required");
+			} else if (a.subjectId !== i) throw v("unavailable");
+		}
+	}, G = async (e, n, r) => (await ce(e, n), t.transactional(async (t) => (await W(t, e, n), r(t)))), K = async (e, t, n) => {
+		let r = (await M(e, u, x("id", U(t, n)), 1))[0];
+		if (r && (r.tenantId !== t || L(r.erased) || r.subjectId !== n)) throw v("identity_required");
+	}, q = (e, t, n) => {
+		let i = e.filter((e) => e.targetId === t && e.revokedAt === null && I(e.from) <= n && (e.until === null || I(e.until) > n));
+		if (i.length > r.maxActiveActions) throw v("unavailable");
+		return i;
+	}, J = (e, t, n) => e.filter((e) => e.targetId === t && I(e.decayAt) > n).reduce((e, t) => {
+		let n = Number(t.count);
+		if (!Number.isSafeInteger(n) || n < 0 || n > 1e6) throw v("unavailable");
+		return e + n;
+	}, 0), Y = (e) => {
+		let t = r.strategies.trustScore({
+			strikes: e,
+			verifiedAccountAgeMs: null,
+			verifiedPlatform: !1,
+			verifiedPaymentCount: 0
+		});
+		if (!Number.isSafeInteger(t) || t < 0 || t > 100) throw v("unavailable");
+		return t;
+	}, X = (e, t, n) => {
+		let i = [], a = !1;
+		for (let o of e) {
+			let e = r.strategies.enforcementPoints({
+				action: z(o),
+				point: t,
+				context: n
+			});
+			if (typeof e.denied != "boolean" || typeof e.shadow != "boolean") throw v("unavailable");
+			e.denied && i.push(F(o, "id")), e.shadow && t === "matchmaking" && (a = !0);
+		}
+		return {
+			allowed: i.length === 0,
+			actionIds: i,
+			shadow: a
+		};
+	}, Z = async (e, t, n) => q(R(await M(e, l, b(x("tenantId", t), x("targetId", n))), t), n, s()), Q = async (e, t, n) => Y(J(R(await M(e, h, b(x("tenantId", t), x("targetId", n))), t), n, s())), $ = async (e, t, n) => {
+		await K(e, t, n);
+		let r = R(await M(e, l, b(x("tenantId", t), x("targetId", n))), t), i = R(await M(e, h, b(x("tenantId", t), x("targetId", n))), t);
+		if (r.some((e) => e.targetId !== n) || i.some((e) => e.targetId !== n)) throw v("unavailable");
+		return {
+			actions: r,
+			strikes: i
+		};
+	}, le = {
+		read: (e, t) => {
+			try {
+				let n = j(structuredClone(e)), r = te(t, !1);
+				return O(async () => {
+					let e = await G(n.tenantId, [n.id], (e) => $(e, n.tenantId, n.id));
+					return {
+						allowed: X(q(e.actions, n.id, r.at), r.point, r.context).allowed,
+						trustScore: Y(J(e.strikes, n.id, r.at))
+					};
+				});
+			} catch (e) {
+				return C.fail(D(e));
+			}
+		},
+		prepare: (e, t) => {
+			try {
+				let n = j(structuredClone(e)), r = te(t, !0);
+				if (!r.expected) throw v("invalid_input");
+				return ue({
+					tenantId: n.tenantId,
+					point: r.point,
+					at: r.at,
+					context: r.context,
+					participants: [{
+						ownerId: n.id,
+						expected: r.expected
+					}]
+				});
+			} catch (e) {
+				return C.fail(D(e));
+			}
+		},
+		prepareMany: (e) => {
+			try {
+				return ue(ne(e));
+			} catch (e) {
+				return C.fail(D(e));
+			}
+		}
+	}, ue = (e) => O(async () => {
+		let n = e.participants.map((e) => e.ownerId), r = await G(e.tenantId, n, async (t) => {
+			let n = [];
+			for (let r of e.participants) n.push({
+				ownerId: r.ownerId,
+				rows: await $(t, e.tenantId, r.ownerId)
+			});
+			return n;
+		});
+		for (let [t, n] of e.participants.entries()) {
+			let i = r[t].rows, a = {
+				allowed: X(q(i.actions, n.ownerId, e.at), e.point, e.context ?? {}).allowed,
+				trustScore: Y(J(i.strikes, n.ownerId, e.at))
+			};
+			if (!a.allowed || !n.expected.allowed || a.allowed !== n.expected.allowed || a.trustScore !== n.expected.trustScore) throw v("forbidden");
+		}
+		let i = T(ee(r));
+		return oe(t, async (t) => {
+			await W(t, e.tenantId, n);
+			let r = [];
+			for (let n of e.participants) r.push({
+				ownerId: n.ownerId,
+				rows: await $(t, e.tenantId, n.ownerId)
+			});
+			if (T(ee(r)) !== i) throw v("conflict");
+		});
+	}), de = async (e, t, n) => {
+		let r = E("scase", [t, n]), i = (await M(e, f, x("id", r), 1))[0];
+		if (i) {
+			if (i.tenantId !== t || i.targetId !== n) throw v("unavailable");
+			return i;
+		}
+		return e.insert(f.tableName, {
+			id: r,
+			tenantId: t,
+			targetId: n,
+			reports: 0,
+			evidence: [],
+			trustScore: await Q(e, t, n),
+			state: "open",
+			decidedBy: null,
+			decidedAt: null,
+			version: 0,
+			metadata: {}
+		});
+	}, fe = (e, t, n) => C.suspend(() => r.strategies.evidenceCollector({
+		subject: e,
+		targetId: t,
+		context: n
+	})).pipe(C.flatMap((e) => k(() => {
+		if (!Array.isArray(e) || e.some((e) => typeof e != "object" || !e || Array.isArray(e)) || e.length > r.maxEvidenceRefs || Buffer.byteLength(JSON.stringify(e), "utf8") > 262144) throw v("invalid_input");
+		return e;
+	})), C.catchDefect(() => C.fail(v("unavailable")))), pe = async (t, n, i, a) => {
+		if (A(a.requestId), A(a.targetId), !e.includes(a.kind)) throw v("invalid_input");
+		_(a.reason), _(a.publicReason);
+		let o = a.durationMs ?? null, c = ae(a.scope), u = T([
+			a.targetId,
+			a.kind,
+			c,
+			o,
+			a.reason,
+			a.publicReason,
+			a.evidenceCaseId ?? null,
+			a.appealable ?? !0
+		]);
+		if (o !== null && (!Number.isSafeInteger(o) || o < 1 || o > 31536e7) || a.appealable !== void 0 && typeof a.appealable != "boolean") throw v("invalid_input");
+		let d = E("sact", [
+			n,
+			i,
+			a.targetId,
+			a.requestId
+		]), p = (await M(t, l, x("id", d), 1))[0];
+		if (p) {
+			if (p.tenantId !== n || p.targetId !== a.targetId || p.requestKey !== u || p.issuedBy !== i) throw v("conflict");
+			return z(p);
+		}
+		if ((await Z(t, n, a.targetId)).length >= r.maxActiveActions) throw v("unavailable");
+		if (a.evidenceCaseId !== void 0 && (await H(t, f, n, a.evidenceCaseId)).targetId !== a.targetId) throw v("forbidden");
+		let m = s();
+		if (o !== null && m + o > 864e13) throw v("invalid_input");
+		return z(await t.insert(l.tableName, {
+			id: d,
+			tenantId: n,
+			targetId: a.targetId,
+			kind: a.kind,
+			scope: c,
+			from: new Date(m),
+			until: o === null ? null : new Date(m + o),
+			reason: a.reason,
+			publicReason: a.publicReason,
+			issuedBy: i,
+			evidenceCaseId: a.evidenceCaseId ?? null,
+			appealable: a.appealable ?? !0,
+			revokedAt: null,
+			requestKey: u,
+			metadata: {}
+		}));
+	}, me = (e, t, n) => (A(n.targetId), G(e, [n.targetId, t], (r) => pe(r, e, t, n))), he = async (e, n, r) => {
+		let i = await H(t, l, e, r);
+		if (i.targetId === null) throw v("not_found");
+		return G(e, [F(i, "targetId"), n], async (t) => {
+			let n = await H(t, l, e, r);
+			if (n.targetId !== i.targetId) throw v("unavailable");
+			n.revokedAt === null && await t.update(l.tableName, r, { revokedAt: new Date(s()) });
+		});
+	}, ge = {
+		issue: (e, t) => O(async () => {
+			let { tenantId: n, operatorId: r } = structuredClone(e);
+			return A(n), A(r), me(n, r, structuredClone(t));
+		}),
+		revoke: (e, t) => O(async () => {
+			let { tenantId: n, operatorId: r } = structuredClone(e);
+			return A(n), A(r), A(t), he(n, r, t);
+		})
+	}, _e = {
+		active: (e) => O(async () => {
+			let n = j(e);
+			return await K(t, n.tenantId, n.id), (await Z(t, n.tenantId, n.id)).map(z);
+		}),
+		check: (e, n, r = {}) => O(async () => {
+			let a = j(e);
+			if (!i.includes(n)) throw v("invalid_input");
+			return r.channelId !== void 0 && A(r.channelId), r.queueId !== void 0 && A(r.queueId), await K(t, a.tenantId, a.id), X(await Z(t, a.tenantId, a.id), n, r);
+		}),
+		trust: (e) => O(async () => {
+			let n = j(e);
+			return await K(t, n.tenantId, n.id), Q(t, n.tenantId, n.id);
+		}),
+		recordSignal: (e, t) => C.gen(function* () {
+			yield* k(() => {
+				if (A(t.tenantId), A(t.targetId), A(t.requestId), e.type !== "system" && !(e.type === "serviceAccount" && e.tenantId === t.tenantId && e.scopes?.includes("sanctions:signals:write"))) throw v("forbidden");
+				if (!n.includes(t.category) || !Number.isFinite(t.confidence) || t.confidence < 0 || t.confidence > 1) throw v("invalid_input");
+			});
+			let i = yield* k(() => y(t.context)), a = yield* fe(e, t.targetId, i);
+			yield* O(() => G(t.tenantId, [t.targetId], async (e) => {
+				let n = E("srep", [
+					t.tenantId,
+					"system",
+					t.targetId,
+					t.requestId
+				]), o = T([
+					t.targetId,
+					t.category,
+					t.confidence,
+					i
+				]), c = (await M(e, m, x("id", n), 1))[0];
+				if (c) {
+					if (c.tenantId !== t.tenantId || c.targetId !== t.targetId || c.source !== "system" || c.requestKey !== o) throw v("conflict");
+					return;
+				}
+				let l = await de(e, t.tenantId, t.targetId), u = l.evidence;
+				if (Number(l.reports) >= r.maxReportsPerCase || u.length + a.length > r.maxEvidenceRefs) throw v("unavailable");
+				let d = !1;
+				if (t.confidence >= r.minimumSignalConfidence) {
+					let n = E("sstrike", [
+						t.tenantId,
+						t.targetId,
+						t.category
+					]), i = (await M(e, h, x("id", n), 1))[0];
+					if (i && (i.tenantId !== t.tenantId || i.targetId !== t.targetId || i.category !== t.category)) throw v("unavailable");
+					let a = (i && I(i.decayAt) > s() ? Number(i.count) : 0) + 1;
+					if (a > 1e6) throw v("unavailable");
+					let o = s();
+					if (o + r.strikeDecayMs > 864e13) throw v("unavailable");
+					let c = {
+						count: a,
+						lastAt: new Date(o),
+						decayAt: new Date(o + r.strikeDecayMs)
+					};
+					i ? await e.update(h.tableName, n, c) : await e.insert(h.tableName, {
+						id: n,
+						tenantId: t.tenantId,
+						targetId: t.targetId,
+						category: t.category,
+						...c,
+						metadata: {}
+					});
+					let u = r.strategies.escalationLadder({
+						category: t.category,
+						count: a,
+						confidence: t.confidence,
+						minimumConfidence: r.minimumSignalConfidence
+					});
+					u !== null && (await pe(e, t.tenantId, null, {
+						requestId: "signal:" + t.requestId,
+						targetId: t.targetId,
+						kind: u.kind,
+						durationMs: u.durationMs,
+						reason: "Trusted server signal: " + t.category,
+						publicReason: "Account policy violation",
+						evidenceCaseId: F(l, "id"),
+						appealable: !0
+					}), d = !0);
+				}
+				await e.insert(m.tableName, {
+					id: n,
+					tenantId: t.tenantId,
+					reporterId: null,
+					targetId: t.targetId,
+					category: t.category,
+					context: i,
+					note: "",
+					state: d ? "actioned" : "open",
+					assignee: null,
+					createdAt: new Date(s()),
+					caseId: l.id,
+					requestKey: o,
+					source: "system",
+					metadata: {}
+				}), await e.update(f.tableName, F(l, "id"), {
+					reports: Number(l.reports) + 1,
+					evidence: [...u, ...a],
+					trustScore: await Q(e, t.tenantId, t.targetId),
+					state: d ? "actioned" : "open",
+					version: Number(l.version) + 1
+				});
+			}));
+		})
+	}, ve = {
+		mine: (e) => _e.active(e),
+		report: (e, i) => C.gen(function* () {
+			let { who: a, ctx: c, note: l } = yield* k(() => {
+				let t = j(e);
+				if (A(i.requestId), A(i.targetId), t.id === i.targetId || !n.includes(i.category)) throw v("invalid_input");
+				return {
+					who: t,
+					ctx: y(i.context),
+					note: _(i.note ?? "", !0)
+				};
+			}), u = E("srep", [
+				a.tenantId,
+				a.id,
+				i.targetId,
+				i.requestId
+			]), d = T([
+				i.targetId,
+				i.category,
+				c,
+				l
+			]), p = yield* O(async () => {
+				let e = (await M(t, m, x("id", u), 1))[0];
+				if (!e) return null;
+				if (e.tenantId !== a.tenantId || e.reporterId !== a.id || e.targetId !== i.targetId || e.source !== "human" || e.requestKey !== d) throw v("conflict");
+				return B(e);
+			});
+			if (p !== null) return p;
+			let h = yield* o.consume("sanctions:report:" + T([a.tenantId, a.id]), {
+				limit: r.reportLimit,
+				windowMs: r.reportWindowMs,
+				algorithm: "fixed-window",
+				burst: r.reportLimit
+			}, s()).pipe(C.catchDefect(() => C.fail(v("unavailable"))));
+			if (h.failOpenReason !== void 0) return yield* C.fail(v("unavailable"));
+			if (!h.allowed) return yield* C.fail(v("rate_limited"));
+			let g = yield* fe(a, i.targetId, c);
+			return yield* O(() => G(a.tenantId, [a.id, i.targetId], async (e) => {
+				let t = (await M(e, m, x("id", u), 1))[0];
+				if (t) {
+					if (t.tenantId !== a.tenantId || t.reporterId !== a.id || t.targetId !== i.targetId || t.source !== "human" || t.requestKey !== d) throw v("conflict");
+					return B(t);
+				}
+				let n = await de(e, a.tenantId, i.targetId), o = n.evidence;
+				if (Number(n.reports) >= r.maxReportsPerCase || o.length + g.length > r.maxEvidenceRefs) throw v("unavailable");
+				let p = await e.insert(m.tableName, {
+					id: u,
+					tenantId: a.tenantId,
+					reporterId: a.id,
+					targetId: i.targetId,
+					category: i.category,
+					context: c,
+					note: l,
+					state: "open",
+					assignee: null,
+					createdAt: new Date(s()),
+					caseId: n.id,
+					requestKey: d,
+					source: "human",
+					metadata: {}
+				});
+				return await e.update(f.tableName, F(n, "id"), {
+					reports: Number(n.reports) + 1,
+					evidence: [...o, ...g],
+					trustScore: await Q(e, a.tenantId, i.targetId),
+					state: "open",
+					version: Number(n.version) + 1
+				}), B(p);
+			}));
+		}),
+		reportsMine: (e) => O(async () => {
+			let n = j(e);
+			return await K(t, n.tenantId, n.id), R(await M(t, m, b(x("tenantId", n.tenantId), x("reporterId", n.id)), r.pageSize), n.tenantId).filter((e) => e.reporterId === n.id && e.targetId !== null).map(B);
+		}),
+		appeal: (e, n) => O(async () => {
+			let r = j(e);
+			_(n.text);
+			let i = await H(t, l, r.tenantId, n.actionId);
+			if (i.targetId !== r.id || !L(i.appealable)) throw v("forbidden");
+			return G(r.tenantId, [r.id], async (e) => {
+				let t = await H(e, l, r.tenantId, n.actionId);
+				if (t.targetId !== r.id || !L(t.appealable)) throw v("forbidden");
+				let i = E("sappeal", [r.tenantId, n.actionId]), a = (await M(e, d, x("id", i), 1))[0];
+				if (a) {
+					if (a.tenantId !== r.tenantId || a.subjectId !== r.id || a.actionId !== n.actionId || a.text !== n.text) throw v("conflict");
+					return V(a);
+				}
+				return V(await e.insert(d.tableName, {
+					id: i,
+					tenantId: r.tenantId,
+					actionId: n.actionId,
+					subjectId: r.id,
+					text: n.text,
+					state: "pending",
+					decidedBy: null,
+					decidedAt: null,
+					outcome: null,
+					createdAt: new Date(s()),
+					metadata: {}
+				}));
+			});
+		}),
+		appealsMine: (e) => O(async () => {
+			let n = j(e);
+			return await K(t, n.tenantId, n.id), R(await M(t, d, b(x("tenantId", n.tenantId), x("subjectId", n.id)), r.pageSize), n.tenantId).filter((e) => e.subjectId === n.id).map(V);
+		}),
+		cases: (e) => O(async () => {
+			let n = N(e);
+			return await K(t, n, P(e)), R(await M(t, f, x("tenantId", n), r.pageSize), n).map(se);
+		}),
+		reviewCase: (e, n) => O(async () => {
+			let r = N(e);
+			if (!Number.isSafeInteger(n.baseVersion) || n.baseVersion < 0 || ![
+				"open",
+				"reviewing",
+				"actioned",
+				"dismissed"
+			].includes(n.state)) throw v("invalid_input");
+			let i = await H(t, f, r, n.caseId);
+			if (i.targetId === null) throw v("not_found");
+			return G(r, [F(i, "targetId"), P(e)], async (t) => {
+				let a = await H(t, f, r, n.caseId);
+				if (a.targetId !== i.targetId) throw v("unavailable");
+				if (a.version !== n.baseVersion) throw v("conflict");
+				let o = await t.update(f.tableName, n.caseId, {
+					state: n.state,
+					decidedBy: e.id,
+					decidedAt: new Date(s()),
+					version: n.baseVersion + 1
+				});
+				if (!o) throw v("unavailable");
+				return se(o);
+			});
+		}),
+		issue: (e, t) => O(async () => {
+			let n = N(e);
+			return me(n, P(e), t);
+		}),
+		revoke: (e, t) => O(async () => {
+			let n = N(e);
+			return he(n, P(e), t);
+		}),
+		appealsQueue: (e) => O(async () => {
+			let n = N(e);
+			return await K(t, n, P(e)), R(await M(t, d, b(x("tenantId", n), x("state", "pending")), r.pageSize), n).map(V);
+		}),
+		reviewAppeal: (e, n) => O(async () => {
+			let r = N(e);
+			if (!["upheld", "revoked"].includes(n.outcome)) throw v("invalid_input");
+			let i = await H(t, d, r, n.appealId);
+			if (i.subjectId === null) throw v("not_found");
+			return G(r, [F(i, "subjectId"), P(e)], async (t) => {
+				let a = await H(t, d, r, n.appealId), o = await H(t, l, r, F(a, "actionId"));
+				if (a.subjectId !== i.subjectId || o.targetId !== a.subjectId) throw v("unavailable");
+				if (a.state === "reviewed") {
+					if (a.outcome !== n.outcome) throw v("conflict");
+					return V(a);
+				}
+				n.outcome === "revoked" && o.revokedAt === null && await t.update(l.tableName, F(o, "id"), { revokedAt: new Date(s()) });
+				let c = await t.update(d.tableName, n.appealId, {
+					state: "reviewed",
+					outcome: n.outcome,
+					decidedBy: e.id,
+					decidedAt: new Date(s())
+				});
+				if (!c) throw v("unavailable");
+				return V(c);
+			});
+		})
+	}, ye = async (e, t) => {
+		if (t.tenantId === null) throw v("identity_required");
+		A(t.tenantId), A(t.subjectId);
+		let n = [
+			S(x("reporterId", t.subjectId), x("targetId", t.subjectId), x("assignee", t.subjectId)),
+			S(x("targetId", t.subjectId), x("decidedBy", t.subjectId)),
+			S(x("targetId", t.subjectId), x("issuedBy", t.subjectId)),
+			S(x("subjectId", t.subjectId), x("decidedBy", t.subjectId)),
+			x("targetId", t.subjectId),
+			x("subjectId", t.subjectId),
+			x("id", U(t.tenantId, t.subjectId))
+		], i = [
+			(e) => e.reporterId === t.subjectId || e.targetId === t.subjectId || e.assignee === t.subjectId,
+			(e) => e.targetId === t.subjectId || e.decidedBy === t.subjectId,
+			(e) => e.targetId === t.subjectId || e.issuedBy === t.subjectId,
+			(e) => e.subjectId === t.subjectId || e.decidedBy === t.subjectId,
+			(e) => e.targetId === t.subjectId,
+			(e) => e.subjectId === t.subjectId,
+			(e) => !0
+		], a = {}, o = 0;
+		for (let r = 0; r < g.length; r++) {
+			let s = g[r], c = R(await M(e, s, b(x("tenantId", t.tenantId), n[r])), t.tenantId).filter(i[r]);
+			o += c.length, a[s.tableName] = c;
+		}
+		if (o > r.maxExportRows) throw v("export_limit");
+		return a;
+	};
+	class be extends Error {}
+	let xe = (e, t) => [.../* @__PURE__ */ new Set([t, ...Object.values(e).flatMap((e) => e.flatMap((e) => [e.targetId, e.subjectId].filter((e) => typeof e == "string")))])];
+	return {
+		api: ve,
+		port: _e,
+		admission: le,
+		operator: ge,
+		recordDeviceHint: (e, t, n) => O(async () => {
+			if (A(t.tenantId), A(t.subjectId), _(t.deviceId), e.type !== "system" && !(e.type === "serviceAccount" && e.tenantId === t.tenantId && e.scopes?.includes("sanctions:devices:write"))) throw v("forbidden");
+			if (!(n instanceof Uint8Array) || n.byteLength < 32) throw v("invalid_input");
+			let r = re("sha256", n).update(JSON.stringify([t.tenantId, t.deviceId])).digest("hex");
+			await G(t.tenantId, [t.subjectId], async (e) => {
+				let n = E("sdhint", [
+					t.tenantId,
+					t.subjectId,
+					r
+				]), i = (await M(e, p, x("id", n), 1))[0];
+				if (i) {
+					if (i.tenantId !== t.tenantId || i.subjectId !== t.subjectId || i.deviceHash !== r) throw v("unavailable");
+				} else {
+					if (R(await M(e, p, b(x("tenantId", t.tenantId), x("subjectId", t.subjectId))), t.tenantId).length >= 100) throw v("unavailable");
+					await e.insert(p.tableName, {
+						id: n,
+						tenantId: t.tenantId,
+						subjectId: t.subjectId,
+						deviceHash: r,
+						firstSeen: new Date(s()),
+						metadata: {}
+					});
+				}
+			});
+		}),
+		exportSubject: (e) => O(() => t.transactional(async (t) => JSON.parse(JSON.stringify(await ye(t, e))))),
+		eraseSubject: (e) => O(async () => {
+			if (e.tenantId === null) throw v("identity_required");
+			A(e.tenantId), A(e.subjectId);
+			let n = e.tenantId;
+			for (let r = 0; r < 8; r++) {
+				let r = xe(await ye(t, e), e.subjectId);
+				await ce(n, r);
+				try {
+					await t.transactional(async (t) => {
+						await W(t, n, r, !0);
+						let i = await ye(t, e);
+						if (xe(i, e.subjectId).some((e) => !r.includes(e))) throw new be();
+						for (let n of i[m.tableName] ?? []) await t.update(m.tableName, F(n, "id"), {
+							reporterId: n.reporterId === e.subjectId ? null : n.reporterId,
+							targetId: n.targetId === e.subjectId ? null : n.targetId,
+							assignee: n.assignee === e.subjectId ? null : n.assignee,
+							note: "",
+							context: {},
+							requestKey: "",
+							metadata: {}
+						});
+						for (let n of i[f.tableName] ?? []) await t.update(f.tableName, F(n, "id"), {
+							targetId: n.targetId === e.subjectId ? null : n.targetId,
+							decidedBy: n.decidedBy === e.subjectId ? null : n.decidedBy,
+							evidence: [],
+							metadata: {},
+							version: Number(n.version) + 1
+						});
+						for (let n of i[l.tableName] ?? []) await t.update(l.tableName, F(n, "id"), {
+							targetId: n.targetId === e.subjectId ? null : n.targetId,
+							issuedBy: n.issuedBy === e.subjectId ? null : n.issuedBy,
+							reason: "",
+							publicReason: "",
+							requestKey: "",
+							metadata: {},
+							...n.targetId === e.subjectId ? {
+								revokedAt: n.revokedAt ?? new Date(s()),
+								scope: {
+									channels: [],
+									queues: []
+								}
+							} : {}
+						});
+						for (let n of i[d.tableName] ?? []) await t.update(d.tableName, F(n, "id"), {
+							subjectId: n.subjectId === e.subjectId ? null : n.subjectId,
+							decidedBy: n.decidedBy === e.subjectId ? null : n.decidedBy,
+							text: "",
+							metadata: {}
+						});
+						for (let e of i[h.tableName] ?? []) await t.delete(h.tableName, F(e, "id"));
+						for (let e of i[p.tableName] ?? []) await t.delete(p.tableName, F(e, "id"));
+						await t.update(u.tableName, U(n, e.subjectId), {
+							subjectId: null,
+							erased: !0,
+							metadata: {}
+						});
+					});
+					return;
+				} catch (e) {
+					if (!(e instanceof be)) throw e;
+				}
+			}
+			throw v("unavailable");
+		})
+	};
+};
+export { H as dataStoreSanctions };