CASHNET

CASHNET is a synthetic-data cybercrime financial intelligence platform for authorized investigators. It starts with a scam report and connects complaint indicators, account analysis, transactions, multi-hop fund flow, crypto tracing, VASP attribution, risk, geospatial prediction, ATM cash-out hotspots, intervention review, audit, and reporting.

All seeded intelligence is clearly marked SYNTHETIC or MODEL_INFERENCE. The application does not access NCRP, SAHYOG, bank systems, UPI, VASP systems, or government systems.

Project structure

artifacts/cashnet/        React + TypeScript investigator application
artifacts/api-server/    Express API and synthetic analytical provider
lib/api-spec/             OpenAPI source contract
lib/api-client-react/     Generated React Query client
lib/api-zod/              Generated validation schemas
lib/db/                   Optional Drizzle/PostgreSQL package
database/                 Portable schema and seed notes
docs/                     Architecture and provider replacement notes

Setup and run locally

pnpm install
pnpm --filter @workspace/api-server run dev
# in another terminal
PORT=4173 BASE_PATH=/ pnpm --filter @workspace/cashnet run dev

The Replit workflows already start both services with the correct ports and routing. The UI calls /api through the shared route.

Environment variables

Copy .env.example to .env when running outside Replit. Synthetic mode needs no API keys. Set CASHNET_DATA_MODE=synthetic to make the default explicit. Supabase and external provider variables are reserved for authorized future adapters; never expose service-role keys to the browser.

Supabase setup

The MVP uses an in-memory synthetic provider so it remains functional without Supabase. For a deployment that needs persistence, create a Supabase project, enable Auth and Storage, apply database/schema.sql to its PostgreSQL database, configure SUPABASE_URL and SUPABASE_ANON_KEY on the server, and keep SUPABASE_SERVICE_ROLE_KEY server-only. Add RLS policies before importing any real data. Do not mix user-provided/API records with synthetic records without retaining source_type.

Synthetic demo access

The default demo is intentionally open in synthetic mode so reviewers can run the workflow without credentials:

• Investigator: demo.investigator
• Role: INVESTIGATOR
• Case: CASE-CASHNET-001
• Report reference: NCRP-SYN-260818-001

Main workflow

Open a case from the Cases screen, inspect the complaint, run analysis, open Fund flow, press Play to follow timestamp order, and select the FIAT → CRYPTO CONVERSION event. The seeded event is 18 Aug 2026 · 10:11 UTC at VASP Alpha. Continue to Geo & prediction for ranked predicted ATM locations, then prepare and explicitly approve the intervention. Reports include the same case results and the disclaimer: “Analytical prediction — requires investigator validation.”

Major modules

• Complaint / Cases: report ingestion with indicators and masked identifiers.
• Financial intelligence: linked account inflow/outflow, velocity, fan-in/fan-out, and explainable risk indicators.
• Fund flow: relationship graph and synchronized timestamp timeline, including fiat-to-crypto and crypto-to-bank conversion edges.
• Crypto / VASP: wallet balances, chains, counterparties, VASP candidates, confidence, classification, and evidence.
• Risk: transparent analytical baseline with score, category, confidence, features, and model version.
• Geo & prediction: synthetic India coordinates, ATM/branch proximity, historical behavior features, ranked hotspots, probability, time window, and contributing factors.
• Action / intervention: latest credited account, synthetic bank/IFSC/branch resolution, draft → review → explicit approval. No automatic freeze, debit, seizure, contact, or submission is performed.
• Audit / reports: user actions and evidence-backed report sections with provenance labels.

Known limitations

The default server store is process-local and resets on restart. The map is rendered as a synthetic analytical surface rather than live map tiles. Kafka, Elasticsearch/Kibana, Supabase, banking APIs, blockchain APIs, and VASP APIs are interfaces/configuration points only. Predictions are a transparent baseline, not a validated operational model. Synthetic identifiers are not real accounts or ownership claims.

Replacing synthetic providers

Implement an adapter behind the existing API boundary for each authorized source: persist raw source reference and source_type=API, map provider errors to DATA SOURCE UNAVAILABLE, preserve unknown entities instead of guessing, and require credentials only through server environment/secrets. Add contract tests with recorded authorized fixtures, apply RLS and role checks, retain model provenance, and require investigator review before any intervention request is submitted through an institutional channel.# CASHNET