Sharique

$file

@@ -0,0 +1 @@
+$content

.dockerignore

@@ -0,0 +1,7 @@
+node_modules
+**/node_modules
+dist
+**/dist
+.test-dist
+**/.test-dist
+.env

.env.example

@@ -1,56 +1,67 @@
-# Synthetic mode is the default and requires no external credentials.
-DATABASE_URL=
-SUPABASE_URL=
-SUPABASE_ANON_KEY=
-SUPABASE_SERVICE_ROLE_KEY=
-BLOCKCHAIR_API_KEY=
-ETHERSCAN_API_KEY=
-KAFKA_BROKER_URL=
-ELASTICSEARCH_URL=
-ELASTICSEARCH_API_KEY=
-JWT_SECRET=
-CASHNET_DATA_MODE=synthetic
-
-
-# ============================================================================
-# CashNet Deployment Configuration
-# ============================================================================
-
-# API Server
-PORT=3000
-NODE_ENV=production
-LOG_LEVEL=info
+# CASHNET Environment Configuration
+# Copy to .env and fill in values. Never commit .env or credentials.
+
+# --- Required Supabase PostgreSQL connections ---
+# Runtime: use the least-privilege CASHNET login. For a persistent API on an
+# IPv4-only network, obtain Supavisor *session* pooler URL from Supabase
+# Connect (port 5432). Use the direct URL only where IPv6 (or the Supabase
+# IPv4 add-on) is available. Always retain sslmode=verify-full.
+DATABASE_URL=postgresql://cashnet.YOUR_PROJECT_REF:YOUR_RUNTIME_PASSWORD@YOUR_SUPABASE_POOLER_HOST:5432/postgres?sslmode=verify-full
+# Migrations, backup and restore: use the privileged direct connection from
+# Supabase Connect (or the documented session pooler fallback when direct IPv6
+# is unavailable). This URL is never supplied to the API container.
+CASHNET_MIGRATION_DATABASE_URL=postgresql://postgres:YOUR_MIGRATION_PASSWORD@db.YOUR_PROJECT_REF.supabase.co:5432/postgres?sslmode=verify-full
+# Migration authentication failures (PostgreSQL 28P01) must be corrected in
+# the Supabase secret manager; CASHNET never falls back to DATABASE_URL.
+# Download the project CA PEM in Supabase Dashboard > Database > SSL
+# Configuration. Store it outside the repository, with restrictive file ACLs.
+# CASHNET always validates this CA and the Supabase hostname; it never accepts
+# self-signed certificates or disables TLS verification.
+CASHNET_SUPABASE_CA_CERT_PATH=C:\secure-path\supabase-ca.pem
+PORT=5000
 
-# Model Service (Python Flask)
-PYTHON_SERVICE_URL=http://localhost:5000
-MODELS_DIR=./models
+# --- Data mode ---
+# synthetic (default): deterministic fixtures, no database required
+# authorized: real PostgreSQL-backed persistence
+CASHNET_DATA_MODE=authorized
 
-# Security & PII Masking
-ENABLE_PII_MASKING=true
-LOG_MASKED_FIELDS=false
+# --- Development authentication (never enable in production) ---
+CASHNET_DEV_AUTH_ENABLED=true
 
-# JWT/Auth Token Configuration
-JWT_EXPIRY_HOURS=24
-REFRESH_TOKEN_EXPIRY_DAYS=7
+# --- Production authentication / browser origins ---
+# CASHNET_JWT_ISSUERS=https://issuer.example
+# CASHNET_JWT_AUDIENCE=cashnet-api
+# CASHNET_JWKS_URI=https://issuer.example/.well-known/jwks.json
+# CASHNET_CORS_ALLOWED_ORIGINS=https://investigator.example
+# CASHNET_RATE_LIMIT_MAX_REQUESTS=120
 
-# CORS Configuration
-CORS_ORIGIN=http://localhost:3000,https://yourdomain.com
+# --- Runtime ---
+NODE_ENV=development
+LOG_LEVEL=info
 
-# Frontend Configuration
-REACT_APP_API_URL=http://localhost:3000/api
-REACT_APP_MODELS_URL=http://localhost:5000
-REACT_APP_ENVIRONMENT=development
+# Production deployment requirements (set only in the production secret/runtime
+# configuration; do not copy the development values above):
+# NODE_ENV=production
+# CASHNET_DEV_AUTH_ENABLED=false
 
-# Monitoring & Logging
-SENTRY_DSN=
-DATADOG_API_KEY=
-LOG_TO_FILE=false
+# --- Provider credentials (required for authorized collection) ---
+# ETHERSCAN_API_KEY=
+# ETHERSCAN_CHAIN_ID=1
+# BITCOIN_ESPLORA_BASE_URL=
+# TRONGRID_API_KEY=
+# TRONGRID_BASE_URL=https://api.trongrid.io
+# BSCSCAN_API_KEY=
+# POLYGONSCAN_API_KEY=
+# SOLANA_RPC_URL=https://approved-rpc.example
+# SOLANA_API_KEY=
 
-# Feature Flags
-FEATURE_MODEL_PREDICTIONS=true
-FEATURE_PII_MASKING=true
-FEATURE_LEGAL_HOLD=true
-FEATURE_AUDIT_TRAIL=true
+# --- Provider tuning ---
+# CASHNET_PROVIDER_TIMEOUT_MS=10000
+# CASHNET_PROVIDER_MAX_RETRIES=2
 
-# Deployment Target (render/heroku/aws/gcp)
-DEPLOYMENT_TARGET=render
+# --- Approved address-label dataset (Phase 5 intelligence) ---
+# CASHNET_LABEL_DATASET_APPROVED=true
+# CASHNET_LABEL_DATASET_PATH=
+# CASHNET_LABEL_DATASET_NAME=
+# CASHNET_LABEL_DATASET_VERSION=
+# CASHNET_LABEL_DATASET_LICENSE=

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,17 @@
+---
+name: Bug report
+about: Report a reproducible defect without sensitive data
+labels: bug
+---
+
+## Summary
+
+## Safe reproduction
+
+## Expected behavior
+
+## Actual behavior
+
+## Environment
+
+Do not include credentials, private keys, seed phrases, or real case data.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,15 @@
+---
+name: Phase-scoped feature request
+about: Propose an approved, bounded improvement
+labels: enhancement
+---
+
+## Problem
+
+## Proposed phase and scope
+
+## Architecture, provenance, and security impact
+
+## Acceptance criteria
+
+Do not propose provider credentials, real personal data, or unsupported attribution as issue content.

.github/pull_request_template.md

@@ -0,0 +1,18 @@
+## Summary
+
+Describe the change and the phase it belongs to.
+
+## Safety and data provenance
+
+- [ ] Legacy `/api/*` synthetic workflow remains unchanged, or the reason is documented.
+- [ ] No credentials, private keys, seed phrases, sensitive case data, or generated build artifacts are included.
+- [ ] Provider/dataset facts retain source and confidence semantics where applicable.
+- [ ] No unreviewed attribution or identity claim was introduced.
+
+## Verification
+
+- [ ] `pnpm run typecheck`
+- [ ] `pnpm -r --if-present run test`
+- [ ] `pnpm --filter @workspace/api-spec run codegen` (if contract changed)
+- [ ] `pnpm --filter @workspace/api-server run build`
+- [ ] `git diff --check`

.github/workflows/ci.yml

@@ -0,0 +1,133 @@
+name: CASHNET CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_DB: cashnet_test
+          POSTGRES_USER: cashnet
+          POSTGRES_PASSWORD: test_password
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U cashnet"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 11.19.0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm -r --if-present run lint
+
+      - name: Typecheck
+        run: pnpm run typecheck
+
+      - name: Test
+        run: pnpm -r --if-present run test
+        env:
+          DATABASE_URL: postgres://cashnet:test_password@localhost:5432/cashnet_test
+          # Disposable CI-only PostgreSQL compatibility service; production
+          # deployments use Supabase URLs injected by their secret manager.
+          CASHNET_MIGRATION_DATABASE_URL: postgres://cashnet:test_password@localhost:5432/cashnet_test
+          CASHNET_DATABASE_TEST_MODE: disposable-postgres
+          NODE_ENV: test
+
+      - name: Generate and validate OpenAPI clients
+        run: pnpm --filter @workspace/api-spec run codegen
+
+      - name: Build
+        run: pnpm --filter @workspace/api-server run build
+
+      # This is deliberately the same baseline-plus-ledger runner used by
+      # CASHNET deployments. Do not replace it with a loop over SQL files.
+      - name: Migrate clean PostgreSQL database
+        run: pnpm --filter @workspace/db run migrate
+        env:
+          DATABASE_URL: postgres://cashnet:test_password@localhost:5432/cashnet_test
+          CASHNET_MIGRATION_DATABASE_URL: postgres://cashnet:test_password@localhost:5432/cashnet_test
+          CASHNET_DATABASE_TEST_MODE: disposable-postgres
+          NODE_ENV: test
+
+      - name: Prove migration idempotency
+        run: pnpm --filter @workspace/db run migrate
+        env:
+          DATABASE_URL: postgres://cashnet:test_password@localhost:5432/cashnet_test
+          CASHNET_MIGRATION_DATABASE_URL: postgres://cashnet:test_password@localhost:5432/cashnet_test
+          CASHNET_DATABASE_TEST_MODE: disposable-postgres
+          NODE_ENV: test
+
+      - name: Git check
+        run: git diff --check
+
+  security:
+    runs-on: ubuntu-latest
+    needs: validate
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 11.19.0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      # High and critical vulnerabilities are release blockers. Low/moderate
+      # advisory noise is deliberately outside this mandatory gate.
+      - name: Dependency audit (high/critical policy)
+        run: pnpm audit --audit-level=high
+
+      - name: Reject hardcoded secrets
+        run: |
+          # Unit fixtures intentionally use inert strings such as "configured";
+          # scan deployable source, not test data.
+          if git grep -nI -E '(API[_-]?KEY|SECRET|PASSWORD|TOKEN)[[:space:]]*[:=][[:space:]]*"[^"[:space:]]{10,}"' -- Dockerfile docker-compose.yml .github artifacts lib scripts ':(exclude)*.test.ts'; then
+            echo "Potential hardcoded secret detected. Use server environment configuration instead."
+            exit 1
+          fi
+
+  container:
+    runs-on: ubuntu-latest
+    needs: validate
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build container
+        run: docker build -t cashnet:ci .
+
+      - name: Container scan
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: cashnet:ci
+          format: table
+          severity: CRITICAL,HIGH
+          exit-code: '1'

.gitignore

@@ -10,6 +10,7 @@ out-tsc
 
 # dependencies
 node_modules
+.test-dist
 
 # IDEs and editors
 /.idea
@@ -47,18 +48,22 @@ Thumbs.db
 # Replit
 .cache/
 .local/
-.venv/
-# Downloaded external datasets (regenerated by notebooks at runtime)
-**/DATA/external/
-**/data/external/
-generic
-docs
-data
-*.pyc
-.kiro
 
-!data/
-!data/reference/
-!data/reference/banks.json
-node.log
-py.log
+# CASHNET local configuration and read-only reference checkouts
+.env
+.env.*
+!.env.example
+references/
+opencode.json
+
+# Local/runtime artifacts
+.pnpm-store/
+server_log.txt
+.debug/
+
+
+# Local/runtime artifacts
+.pnpm-store/
+server_log.txt
+.debug/
+