fraud-sim 0.2.0

package/examples/adaptive-attacker-demo/README.md

@@ -0,0 +1,61 @@
+# Adaptive attacker demo
+
+Runs the `adaptive-attacker` scenario against a small local target that blocks
+the attacker's opening move, so you can watch it adapt and break through.
+
+## Run it
+
+Two terminals.
+
+**Terminal 1 — start the demo target:**
+
+```bash
+npm run example:adaptive-target
+```
+
+It listens on `http://localhost:4100`.
+
+**Terminal 2 — run the attacker:**
+
+```bash
+npm run example:adaptive
+```
+
+By default this uses the **deterministic** (no-API) provider, so it needs no
+API key and produces the same result every run. To drive it with a real LLM,
+set an API key first:
+
+```bash
+OPENAI_API_KEY=sk-...        npm run example:adaptive
+# or
+ANTHROPIC_API_KEY=sk-ant-... npm run example:adaptive
+```
+
+## What you'll see
+
+```
+Round 1  Baseline attempt: residential-looking IP with a common browser user agent.
+         ip=197.211.62.14  device=(generated)…
+         → BLOCK   score 0.90  IP_REPUTATION, NEW_DEVICE
+
+Round 2  Last attempt was blocked … Rotating the device fingerprint and user agent.
+         ip=213.40.21.204  device=NEGxLVra8ZZa…
+         → ALLOW   score 0.20  NEW_DEVICE
+
+  Outcome: attacker_succeeded  (rounds: 2)
+```
+
+Round 1's baseline IP is on the target's reputation blocklist, so it's blocked.
+The attacker sees the block reasons, rotates everything, and round 2 gets
+through — because the target scores each attempt in isolation and can't tell a
+freshly-rotated login from a legitimate one. That weakness is the point: it's
+what a per-request defense misses and what the scenario is built to surface.
+
+## Notes
+
+- The target needs a moment to start listening. If terminal 2 shows
+  `NETWORK_ERROR` on the first rounds, the target wasn't up yet — start it
+  first and give it a second.
+- The demo target (`demo-target.js`) is intentionally naive. Make its rules
+  stricter (track IP /24 reuse, correlate device + IP, add step-up friction)
+  and re-run to see the attacker take more rounds — or get defeated.

package/examples/adaptive-attacker-demo/demo-target.js

@@ -0,0 +1,85 @@
+/**
+ * Demo target for the adaptive-attacker scenario.
+ *
+ * The stock mock target (examples/express-mock-target) is too permissive to
+ * show adaptation — a single rotated login passes it on the first try, so the
+ * attacker "wins" round 1 and never has to adapt. This target adds an
+ * IP-reputation rule that blocks the scenario's baseline IP, so the attacker
+ * gets blocked, sees why, rotates, and probes again — which is the whole point
+ * of the scenario.
+ *
+ * It is still a naive per-request defense with a real weakness: it scores each
+ * attempt in isolation, so an attacker who rotates IP and device on every
+ * attempt eventually presents a "clean" request it can't distinguish from a
+ * legitimate login. That weakness is what the adaptive attacker exploits.
+ *
+ * Run: node examples/adaptive-attacker-demo/demo-target.js
+ * Then: node examples/adaptive-attacker-demo/index.js   (in another terminal)
+ */
+
+import express from 'express';
+
+const app = express();
+app.use(express.json());
+
+// IPs (and their /24s) flagged as abusive. The scenario's default baselineIp
+// lives here so round 1 is always blocked on reputation.
+const KNOWN_BAD_IPS = new Set(['197.211.62.14']);
+const badSubnets = new Set([subnet24('197.211.62.14')]);
+
+// Devices this target has ever seen, per user.
+const devicesByUser = new Map();
+// Recent login count per user (decays).
+const loginsByUser = new Map();
+
+setInterval(() => {
+  for (const [user, count] of loginsByUser) {
+    const next = Math.floor(count * 0.5);
+    if (next === 0) loginsByUser.delete(user);
+    else loginsByUser.set(user, next);
+  }
+}, 60000);
+
+function subnet24(ip) {
+  return ip.split('.').slice(0, 3).join('.');
+}
+
+app.post('/score/login', (req, res) => {
+  const { user_id, ip_address, device_fingerprint } = req.body ?? {};
+  const reasons = [];
+  let score = 0;
+
+  // Rule: IP reputation. A known-bad IP (or one in a flagged /24) is a hard hit.
+  if (KNOWN_BAD_IPS.has(ip_address) || badSubnets.has(subnet24(ip_address ?? ''))) {
+    reasons.push({ code: 'IP_REPUTATION', weight: 0.7 });
+    score += 0.7;
+  }
+
+  // Rule: new device for this user.
+  const userDevices = devicesByUser.get(user_id) ?? new Set();
+  if (!userDevices.has(device_fingerprint)) {
+    reasons.push({ code: 'NEW_DEVICE', weight: 0.2 });
+    score += 0.2;
+    userDevices.add(device_fingerprint);
+    devicesByUser.set(user_id, userDevices);
+  }
+
+  // Rule: login velocity per user.
+  const logins = (loginsByUser.get(user_id) ?? 0) + 1;
+  loginsByUser.set(user_id, logins);
+  if (logins > 4) {
+    reasons.push({ code: 'LOGIN_VELOCITY_USER', weight: 0.35 });
+    score += 0.35;
+  }
+
+  const decision = score >= 0.6 ? 'BLOCK' : score >= 0.35 ? 'STEP_UP' : 'ALLOW';
+  res.json({ decision, risk_score: Math.min(score, 1), reasons });
+});
+
+app.get('/health', (req, res) => res.json({ status: 'ok' }));
+
+const PORT = process.env.PORT || 4100;
+app.listen(PORT, () => {
+  console.log(`Adaptive-attacker demo target listening on http://localhost:${PORT}`);
+  console.log('Now run:  node examples/adaptive-attacker-demo/index.js');
+});

package/examples/adaptive-attacker-demo/index.js

@@ -0,0 +1,83 @@
+/**
+ * Example: LLM adaptive attacker against a local demo target.
+ *
+ * Prerequisites:
+ *   1. Start the demo target:
+ *        node examples/adaptive-attacker-demo/demo-target.js
+ *   2. In another terminal, run this:
+ *        node examples/adaptive-attacker-demo/index.js
+ *
+ * By default this uses the deterministic (no-API) provider, so it runs
+ * anywhere with no API key and produces the same result every time. To use a
+ * real LLM, set one of:
+ *   OPENAI_API_KEY=sk-...       node examples/adaptive-attacker-demo/index.js
+ *   ANTHROPIC_API_KEY=sk-ant-... node examples/adaptive-attacker-demo/index.js
+ */
+
+import { run } from '../../src/index.js';
+import { httpAdapter } from '../../src/adapters/http.js';
+import { deterministic, openai, anthropic } from '../../src/llm/index.js';
+
+const target = httpAdapter({
+  baseUrl: process.env.TARGET_URL ?? 'http://localhost:4100',
+  endpoints: { scoreLogin: '/score/login' },
+});
+
+// Pick a provider from the environment; fall back to the deterministic one.
+let llm;
+if (process.env.OPENAI_API_KEY) {
+  llm = openai({ apiKey: process.env.OPENAI_API_KEY });
+} else if (process.env.ANTHROPIC_API_KEY) {
+  llm = anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
+} else {
+  llm = deterministic({ seed: 42 });
+}
+
+const C = {
+  block: '\x1b[31m',
+  stepUp: '\x1b[33m',
+  allow: '\x1b[32m',
+  dim: '\x1b[2m',
+  cyan: '\x1b[36m',
+  reset: '\x1b[0m',
+};
+const decisionColor = { BLOCK: C.block, STEP_UP: C.stepUp, ALLOW: C.allow };
+
+console.log(`\n=== Adaptive attacker (provider: ${llm.name}) ===\n`);
+
+const report = await run('adaptive-attacker', {
+  target,
+  llm,
+  options: { targetUserId: 'victim_user_001', maxRounds: 8, delayMs: 150 },
+  onEvent: (e) => {
+    if (e.type === 'attacker_adapts') {
+      console.log(`${C.cyan}Round ${e.round}${C.reset}  ${C.dim}${e.reasoning}${C.reset}`);
+      console.log(
+        `${C.dim}         ip=${e.parameters.ip}  device=${String(e.parameters.deviceFingerprint ?? '(generated)').slice(0, 12)}…${C.reset}`
+      );
+    } else if (e.type === 'response') {
+      const color = decisionColor[e.response.decision] ?? '';
+      const reasons = (e.response.reasons ?? []).map((r) => r.code).join(', ') || '—';
+      console.log(
+        `         → ${color}${e.response.decision.padEnd(7)}${C.reset} score ${e.response.riskScore?.toFixed(2) ?? '?'}  ${reasons}\n`
+      );
+    }
+  },
+});
+
+const outcomeColor = report.outcome === 'attacker_succeeded' ? C.block : C.allow;
+console.log('=== Report ===\n');
+console.log(`  Outcome:   ${outcomeColor}${report.outcome}${C.reset}`);
+console.log(`  Rounds:    ${report.rounds}`);
+console.log(`  Blocked:   ${report.blocked}   Step-up: ${report.stepUp}   Allowed: ${report.allowed}`);
+console.log(`  Duration:  ${report.durationMs}ms\n`);
+
+if (report.outcome === 'attacker_succeeded') {
+  console.log(
+    `${C.dim}  The attacker found a gap: the target scores each attempt in isolation,`
+  );
+  console.log(
+    `  so once the attacker rotated away from the flagged IP, a fresh login was`
+  );
+  console.log(`  indistinguishable from a legitimate one.${C.reset}\n`);
+}

package/examples/basic-credential-stuffing/index.js

@@ -0,0 +1,60 @@
+/**
+ * Example: Run credential stuffing against a local mock target.
+ *
+ * Prerequisite: Start the mock target first
+ *   npm run example:mock-target
+ *
+ * Then in another terminal:
+ *   npm run example:basic
+ */
+
+import { run } from '../../src/index.js';
+import { httpAdapter } from '../../src/adapters/http.js';
+
+const target = httpAdapter({
+  baseUrl: process.env.TARGET_URL ?? 'http://localhost:4000',
+  endpoints: {
+    scoreLogin: '/score/login',
+    scoreWithdrawal: '/score/withdrawal',
+  },
+});
+
+const events = [];
+
+console.log('\n=== Credential stuffing simulation ===\n');
+
+const report = await run('credential-stuffing', {
+  target,
+  options: {
+    targetUserId: 'victim_user_001',
+    attackerCount: 10,
+    attemptsPerIp: 3,
+    delayMs: 50,
+  },
+  onEvent: (e) => {
+    events.push(e);
+    if (e.type === 'response') {
+      const decisionColor = {
+        BLOCK: '\x1b[31m',    // red
+        STEP_UP: '\x1b[33m',  // yellow
+        ALLOW: '\x1b[32m',    // green
+        ERROR: '\x1b[35m',    // magenta
+      };
+      const color = decisionColor[e.response.decision] ?? '';
+      const reset = '\x1b[0m';
+      const reasons = (e.response.reasons ?? []).map((r) => r.code).join(', ') || '—';
+      console.log(
+        `  attempt ${String(e.round).padStart(3)}  ${color}${e.response.decision.padEnd(7)}${reset}  score ${e.response.riskScore?.toFixed(2) ?? '?'}  ${reasons}`
+      );
+    }
+  },
+});
+
+console.log('\n=== Report ===\n');
+console.log(`  Attempts:    ${report.attempts}`);
+console.log(`  Blocked:     ${report.blocked}`);
+console.log(`  Step-up:     ${report.stepUp}`);
+console.log(`  Allowed:     ${report.allowed}`);
+console.log(`  Block rate:  ${(report.blockRate * 100).toFixed(1)}%`);
+console.log(`  Duration:    ${report.durationMs}ms`);
+console.log();

package/examples/express-mock-target/server.js

@@ -0,0 +1,122 @@
+/**
+ * Mock fraud detection target for examples and integration tests.
+ *
+ * Implements a simple but realistic rules engine so scenarios produce
+ * meaningful block rates. This is NOT FriskLayer — it's a stripped-down
+ * pedagogical example showing the kind of system fraud-sim tests against.
+ *
+ * Run: `npm run example:mock-target`
+ * Then point a scenario at http://localhost:4000
+ */
+
+import express from 'express';
+
+const app = express();
+app.use(express.json());
+
+// In-memory state — naive but enough for demos
+const seen = {
+  devicesByUser: new Map(),     // userId → Set<deviceFp>
+  loginsByUser: new Map(),      // userId → number (count in last 10 min)
+  loginsByIp: new Map(),        // ip → number
+  payeesByUser: new Map(),      // userId → Set<payeeAccount>
+  newPayeesByUser: new Map(),   // userId → number of new payees in last 30 min
+};
+
+// Decay counters every minute
+setInterval(() => {
+  for (const map of [seen.loginsByUser, seen.loginsByIp, seen.newPayeesByUser]) {
+    for (const [key, count] of map) {
+      const next = Math.floor(count * 0.5);
+      if (next === 0) map.delete(key);
+      else map.set(key, next);
+    }
+  }
+}, 60000);
+
+app.post('/score/login', (req, res) => {
+  const { user_id, ip_address, device_fingerprint } = req.body ?? {};
+  const reasons = [];
+  let score = 0;
+
+  // Increment counters
+  seen.loginsByUser.set(user_id, (seen.loginsByUser.get(user_id) ?? 0) + 1);
+  seen.loginsByIp.set(ip_address, (seen.loginsByIp.get(ip_address) ?? 0) + 1);
+
+  // Rule: velocity per user
+  if ((seen.loginsByUser.get(user_id) ?? 0) > 5) {
+    reasons.push({ code: 'LOGIN_VELOCITY_USER', weight: 0.35 });
+    score += 0.35;
+  }
+
+  // Rule: velocity per IP
+  if ((seen.loginsByIp.get(ip_address) ?? 0) > 3) {
+    reasons.push({ code: 'LOGIN_VELOCITY_IP', weight: 0.4 });
+    score += 0.4;
+  }
+
+  // Rule: new device
+  const userDevices = seen.devicesByUser.get(user_id) ?? new Set();
+  if (!userDevices.has(device_fingerprint)) {
+    reasons.push({ code: 'NEW_DEVICE', weight: 0.25 });
+    score += 0.25;
+    userDevices.add(device_fingerprint);
+    seen.devicesByUser.set(user_id, userDevices);
+  }
+
+  const decision = score >= 0.65 ? 'BLOCK' : score >= 0.35 ? 'STEP_UP' : 'ALLOW';
+
+  res.json({
+    decision,
+    risk_score: Math.min(score, 1.0),
+    reasons,
+  });
+});
+
+app.post('/score/withdrawal', (req, res) => {
+  const { user_id, transaction } = req.body ?? {};
+  const reasons = [];
+  let score = 0;
+
+  // Rule: new payee
+  if (transaction?.is_new_payee) {
+    reasons.push({ code: 'NEW_PAYEE_FIRST_TXN', weight: 0.2 });
+    score += 0.2;
+
+    const newCount = (seen.newPayeesByUser.get(user_id) ?? 0) + 1;
+    seen.newPayeesByUser.set(user_id, newCount);
+
+    // Rule: drain pattern (3+ new payees within tracked window)
+    if (newCount >= 3) {
+      reasons.push({ code: 'DRAIN_PATTERN', weight: 0.6 });
+      score += 0.6;
+    }
+  }
+
+  // Rule: high amount + new payee
+  if (transaction?.is_new_payee && transaction.amount > 1000000) {
+    reasons.push({ code: 'NEW_PAYEE_HIGH_AMOUNT', weight: 0.4 });
+    score += 0.4;
+  }
+
+  const decision = score >= 0.65 ? 'BLOCK' : score >= 0.35 ? 'STEP_UP' : 'ALLOW';
+
+  res.json({
+    decision,
+    risk_score: Math.min(score, 1.0),
+    reasons,
+  });
+});
+
+app.post('/event/:type', (req, res) => {
+  // Accept and discard — this mock doesn't process side events
+  res.json({ ok: true });
+});
+
+app.get('/health', (req, res) => res.json({ status: 'ok' }));
+
+const PORT = process.env.PORT || 4000;
+app.listen(PORT, () => {
+  console.log(`Mock fraud target listening on http://localhost:${PORT}`);
+  console.log('Try: npm run example:basic in another terminal');
+});

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "fraud-sim",
+  "version": "0.2.0",
+  "description": "Realistic synthetic attack traffic for testing fintech fraud detection systems",
+  "type": "module",
+  "main": "src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./adapters": "./src/adapters/index.js",
+    "./streaming": "./src/streaming/index.js",
+    "./llm": "./src/llm/index.js"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    "src/",
+    "examples/",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "test": "cd test/unit && node --test",
+    "test:integration": "cd test/integration && node --test",
+    "test:all": "cd test && node --test",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "example:basic": "node examples/basic-credential-stuffing/index.js",
+    "example:drain": "node examples/account-drain-demo/index.js",
+    "example:mock-target": "node examples/express-mock-target/server.js",
+    "example:adaptive-target": "node examples/adaptive-attacker-demo/demo-target.js",
+    "example:adaptive": "node examples/adaptive-attacker-demo/index.js"
+  },
+  "keywords": [
+    "fraud",
+    "fraud-detection",
+    "security-testing",
+    "fintech",
+    "simulation",
+    "adversarial-testing",
+    "penetration-testing"
+  ],
+  "author": "Arthur (@arthurr-beep) <arthurraugustus@gmail.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/arthurr-beep/fraudsim.git"
+  },
+  "bugs": {
+    "url": "https://github.com/arthurr-beep/fraudsim/issues"
+  },
+  "homepage": "https://github.com/arthurr-beep/fraudsim#readme",
+  "devDependencies": {
+    "@eslint/js": "^9.39.5",
+    "eslint": "^9.39.5",
+    "express": "^4.21.0",
+    "globals": "^17.11.0"
+  }
+}

package/src/adapters/http.js

@@ -0,0 +1,132 @@
+/**
+ * HTTP target adapter — sends events to a REST API.
+ *
+ * Configurable for any target's response shape via the `responseMap` function.
+ * This is the key flexibility point that keeps fraud-sim target-agnostic:
+ * a user testing against Stripe Radar writes a different responseMap than
+ * one testing against an in-house system.
+ *
+ * @example
+ *   const target = httpAdapter({
+ *     baseUrl: 'https://api.frisklayer.com',
+ *     headers: { Authorization: `Bearer ${process.env.FRISKLAYER_KEY}` },
+ *     endpoints: {
+ *       scoreLogin:      '/v1/score/login',
+ *       scoreWithdrawal: '/v1/score/withdrawal',
+ *     },
+ *     responseMap: (raw) => ({
+ *       decision:  raw.decision,
+ *       riskScore: raw.risk_score,
+ *       reasons:   raw.reasons,
+ *       raw,
+ *     }),
+ *   });
+ */
+
+const DEFAULT_ENDPOINTS = {
+  scoreLogin: '/v1/score/login',
+  scoreWithdrawal: '/v1/score/withdrawal',
+  scoreAction: '/v1/score/action',
+  reportEvent: (type) => `/v1/event/${type}`,
+};
+
+// Default responseMap — works for snake_case APIs that match FriskLayer's shape.
+// Users with different APIs override this.
+const DEFAULT_RESPONSE_MAP = (raw) => ({
+  decision: raw.decision,
+  riskScore: raw.risk_score ?? raw.riskScore,
+  reasons: raw.reasons ?? [],
+  raw,
+});
+
+export function httpAdapter(config) {
+  if (!config || !config.baseUrl) {
+    throw new Error('httpAdapter requires { baseUrl }');
+  }
+
+  const baseUrl = config.baseUrl.replace(/\/$/, '');
+  const headers = {
+    'Content-Type': 'application/json',
+    ...(config.headers ?? {}),
+  };
+  const endpoints = { ...DEFAULT_ENDPOINTS, ...(config.endpoints ?? {}) };
+  const responseMap = config.responseMap ?? DEFAULT_RESPONSE_MAP;
+  const timeoutMs = config.timeoutMs ?? 5000;
+  const fetchImpl = config.fetch ?? globalThis.fetch;
+
+  if (!fetchImpl) {
+    throw new Error(
+      'No fetch implementation found. Use Node 20+, or pass { fetch } to httpAdapter.'
+    );
+  }
+
+  async function call(path, body) {
+    const url = `${baseUrl}${path}`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+
+    try {
+      const res = await fetchImpl(url, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify(body),
+        signal: controller.signal,
+      });
+
+      const raw = await res.json().catch(() => ({}));
+
+      if (!res.ok) {
+        // Non-2xx response — fraud detection systems often return 4xx/5xx
+        // for hard blocks. We surface this in the response, not as an error.
+        return {
+          decision: raw.decision ?? 'BLOCK',
+          riskScore: raw.risk_score ?? 1.0,
+          reasons: raw.reasons ?? [{ code: 'HTTP_ERROR', label: `HTTP ${res.status}` }],
+          raw,
+          httpStatus: res.status,
+        };
+      }
+
+      return responseMap(raw);
+    } catch (err) {
+      // Network-level failures — timeout, DNS, connection refused.
+      // We return a synthetic ERROR decision so scenarios can decide
+      // whether to continue or abort.
+      return {
+        decision: 'ERROR',
+        riskScore: null,
+        reasons: [{ code: 'NETWORK_ERROR', label: err.message }],
+        raw: { error: err.message },
+      };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  return {
+    async scoreLogin(payload) {
+      return call(endpoints.scoreLogin, payload);
+    },
+
+    async scoreWithdrawal(payload) {
+      return call(endpoints.scoreWithdrawal, payload);
+    },
+
+    async scoreAction(payload) {
+      return call(endpoints.scoreAction, payload);
+    },
+
+    async reportEvent(eventType, data) {
+      const path =
+        typeof endpoints.reportEvent === 'function'
+          ? endpoints.reportEvent(eventType)
+          : endpoints.reportEvent;
+      // Fire-and-forget — never block a scenario on a report
+      try {
+        await call(path, data);
+      } catch {
+        // Intentionally swallow — reports are not critical
+      }
+    },
+  };
+}

package/src/adapters/index.js

@@ -0,0 +1,23 @@
+/**
+ * Target adapters — the bridge between scenarios and the system under test.
+ *
+ * A TargetAdapter has this shape:
+ *   {
+ *     scoreLogin(payload)      => Promise<TargetResponse>
+ *     scoreWithdrawal(payload) => Promise<TargetResponse>
+ *     scoreAction(payload)     => Promise<TargetResponse>   // v0.3+
+ *     reportEvent(type, data)  => Promise<void>
+ *   }
+ *
+ * TargetResponse shape:
+ *   {
+ *     decision: 'ALLOW' | 'STEP_UP' | 'BLOCK' | string,
+ *     riskScore?: number,
+ *     reasons?: Array<{ code: string, label?: string, weight?: number }>,
+ *     raw?: object,
+ *   }
+ */
+
+export { httpAdapter } from './http.js';
+export { mockAdapter } from './mock.js';
+export { loggingAdapter } from './logging.js';

package/src/adapters/logging.js

@@ -0,0 +1,47 @@
+/**
+ * Logging adapter — logs payloads to a logger without sending anywhere.
+ *
+ * Used to inspect what a scenario produces before pointing at a real target.
+ * Returns ALLOW for every call by default.
+ *
+ * @example
+ *   import { loggingAdapter } from 'fraud-sim/adapters';
+ *
+ *   const target = loggingAdapter();
+ *   await run('credential-stuffing', { target, options: { ... } });
+ *   // → All payloads are printed to stdout; nothing is sent to the network
+ */
+
+export function loggingAdapter(config = {}) {
+  const logger = config.logger ?? console.log;
+  const defaultResponse = config.defaultResponse ?? {
+    decision: 'ALLOW',
+    riskScore: 0,
+    reasons: [],
+  };
+
+  function log(operation, payload) {
+    logger(`[fraud-sim:logging] ${operation}`, JSON.stringify(payload, null, 2));
+  }
+
+  return {
+    async scoreLogin(payload) {
+      log('scoreLogin', payload);
+      return defaultResponse;
+    },
+
+    async scoreWithdrawal(payload) {
+      log('scoreWithdrawal', payload);
+      return defaultResponse;
+    },
+
+    async scoreAction(payload) {
+      log('scoreAction', payload);
+      return defaultResponse;
+    },
+
+    async reportEvent(eventType, data) {
+      log(`reportEvent[${eventType}]`, data);
+    },
+  };
+}