{"command":"curl -fsS -o /dev/null -w \"api: %{http_code}\\n\" http://localhost:4006/health 2>&1; curl -fsS -o /dev/null -w \"portal: %{http_code}\\n\" http://localhost:3006 2>&1; curl -fsS -o /dev/null -w \"embed: %{http_code}\\n\" http://localhost:3106 2>&1; echo \"---dashboard---\"; curl -fsS -o /dev/null -w \"dash: %{http_code}\\n\" http://localhost:7777 2>&1","description":"Check current health of all services"}

{"command":"curl -fsS -X POST http://localhost:7777/api/api-action -H 'Content-Type: application/json' -d '{\"path\":\"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat\",\"action\":\"install\"}' 2>&1; echo \"---install kicked---\"","description":"Kick off API npm install via dashboard"}

{"command":"fd -H -t f 'AGENTS.md' /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat /Users/bakker/dev/gangkhar/sherpa-embed-api-458-credit-check-compliance-integrat /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat 2>/dev/null","description":"Find AGENTS.md files across worktrees"}

curl: (52) Empty reply from server
api: 000
portal: 200
embed: 200
---dashboard---
dash: 200

{"path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat","action":"install","status":"running","startedAt":1780262504121,"endedAt":null,"exitCode":null,"error":null,"logPath":"/var/folders/pr/7k4xc3v1715_0zbbw8tgwl5r0000gn/T/worktree-dashboard-logs/sherpa-api-api-458-credit-check-compliance-integrat-install.log","tail":""}---install kicked---

/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/lens/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/lens/journey/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/lens/optimizations/commission/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/lens/optimizations/commission/quote/model-server/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/lens/synthetic-client/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/mcp/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/mcp/openai/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/payments/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/pricing/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-embed-api-458-credit-check-compliance-integrat/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-embed-api-458-credit-check-compliance-integrat/public/templates/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/lens/optimizations/commission/AGENTS.md
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/lens/synthetic-client/AGENTS.md

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/AGENTS.md"}

1	# Sherpa API
2	
3	Fastify + TypeScript + Sequelize + PostgreSQL insurance platform API. Runs in Docker with `tsx` (no build step).
4	
5	Nested AGENTS.md files provide context for their directory subtrees:
6	- `src/AGENTS.md` - TypeScript, Fastify, architecture conventions
7	- `src/db/AGENTS.md` - Database, RLS, migrations
8	- `src/domains/lens/AGENTS.md` - Lens routes pattern
9	- `src/domains/lens/journey/AGENTS.md` - Journey events
10	- `src/domains/lens/optimizations/commission/AGENTS.md` - Commission optimizations
11	
12	## Critical Rules
13	
14	### No Defaults - Fail Fast
15	
16	NEVER inject default values. Explicit everything.
17	
18	```typescript
19	// FORBIDDEN
20	function process(data: string = 'default') {}
21	const value = input || 'default';
22	const port = process.env.PORT || 3000;
23	const { limit = 10 } = params;
24	interface Config { timeout?: number; }
25	
26	// REQUIRED
27	function process(data: string) {}
28	if (!input) throw new Error('input required');
29	const port = getRequired('PORT');
30	const { limit } = params;
31	if (!limit) throw new Error('limit required');
32	interface Config { timeout: number; }
33	```
34	
35	**Exception**: Discriminated unions with optional payload objects ARE allowed (type-safe, not defaults):
36	
37	```typescript
38	interface PricingConfig {
39	  kind: 'static' | 'linear';
40	  static?: { price: number };
41	  linear?: { basePrice: number; perUnit: number };
42	}
43	```
44	
45	### NO FUCKING DYNAMIC IMPORT AND FUCKING NEVER USE REQUIRE
46	
47	- NEVER `await import`, only `import ... from ''`
48	- NEVER `require()`, only `import ... from ''`
49	
50	Static imports fail fast on startup, enable tree-shaking, and TypeScript validates at build time.
51	
52	```typescript
53	// FORBIDDEN
54	await import('@/error/error.js')
55	require('./module')
56	if (condition) { const { Service } = await import('./service.js'); }
57	
58	// REQUIRED - static imports at top level
59	import { StatusError } from '@/error/error.js';
60	import { Client } from '@/models/Client.js';
61	```
62	
63	### No `any` Type
64	
65	```typescript
66	// FORBIDDEN
67	function process(data: any): any {}
68	
69	// REQUIRED
70	function process(data: Record<string, unknown>): unknown {}
71	```
72	
73	## Environment Variables
74	
75	**`env.reference` is the AUTHORITATIVE source for ALL environment variables.**
76	
77	- All new env vars MUST be added to `env.reference`
78	- K8s deployments automatically parse `env.reference` (see `k8s/sherpa-api.ts`)
79	- `DB_*` variables are automatically used for migrations
80	- Always use `getRequired()` from `lib.ts` at module scope
81	- Never use dotenv - containers handle env loading
82	- No default fallbacks - crash on startup if vars missing
83	
84	```typescript
85	// GOOD - module scope, validates on startup
86	import { getRequired } from '../lib.js';
87	const DB_HOST = getRequired('DB_HOST');
88	
89	// BAD - function scope with fallback
90	function connect() {
91	  const host = process.env.DB_HOST || 'localhost';
92	}
93	```
94	
95	Workflow: add to `env.reference` → copy to `.env` → K8s picks it up automatically.
96	
97	## Development Workflow
98	
99	### Starting and stopping
100	
101	```bash
102	make dev   # start full development environment (env sync, npm install, docker up, migrate, buckets)
103	make down  # stop and remove all containers
104	```
105	
106	### Docker-First
107	
108	All runtime commands run through Docker. Never install packages or run commands inside the container manually.
109	
110	```bash
111	# ALWAYS check running services first
112	docker compose ps
113	
114	# Package installation (NEVER outside Docker)
115	docker compose exec api npm install
116	docker compose exec api npm install some-package
117	
118	# Migrations
119	docker compose exec api npm run db:migrate:up
120	
121	# Type checking
122	docker compose exec api npm run type-check
123	
124	# Tests
125	docker compose exec api npm test
126	```
127	
128	### Never Kill Running Services
129	
130	Always `docker compose ps` FIRST. Never blindly restart. Watch mode is precious - don't kill it. Only start services if they're DOWN.
131	
132	### After Code Changes
133	
134	1. Run `npx eslint .`
135	2. Fix ALL eslint warnings until none remain
136	3. Restart server if needed
137	
138	### No Manual Database Modifications
139	
140	Database is recreated hourly from migrations. Never INSERT/UPDATE/DELETE manually. Read-only queries for debugging only.
141	
142	### Use DBeaver MCP for Ad-hoc Queries
143	
144	Use DBeaver MCP tools instead of raw psql/docker commands:
145	
146	```
147	# GOOD
148	mcp__dbeaver__execute_query  (for SELECT)
149	mcp__dbeaver__list_tables
150	mcp__dbeaver__get_table_schema
151	
152	# BAD
153	docker exec sherpa-pg-main psql -c "SELECT..."
154	```
155	
156	### File Search
157	
158	```bash
159	# REQUIRED - Rust tools (10x faster, respect .gitignore)
160	fd "pattern"      # Find files (not find)
161	fd -e ts          # Find by extension
162	rg "pattern"      # Search content (not grep)
163	rg -t ts "pattern" # Search TypeScript files
164	
165	# FORBIDDEN
166	find . -name "*.ts"
167	grep -r "pattern" .
168	```
169	
170	## Debugging
171	
172	Never guess solutions. Always debug first. Evidence first, solutions second.
173	
174	### Required Workflow
175	
176	1. **Add debug statements** - understand actual flow before changing anything
177	2. **Verify root cause with evidence** - run, check logs, reproduce
178	3. **Report findings before fixing** - document observed vs expected
179	4. **Ask for confirmation** - never implement without approval
180	
181	```typescript
182	// GOOD - Structured debug logging with request ID
183	fastify.log.info(`[DEBUG:${req.id}] Function: authenticateUser, Input: email=${email}`);
184	fastify.log.info(`[DEBUG:${req.id}] Database query result: user=${JSON.stringify(user)}`);
185	
186	// BAD
187	console.log('user:', user);
188	fastify.log.info('something wrong');
189	```
190	
191	### Bug Analysis Format
192	
193	```
194	BUG ANALYSIS:
195	- Issue: [description]
196	- Root Cause: [evidence-based cause]
197	- Evidence: [logs/data]
198	- Expected: [what should happen]
199	- Actual: [what happens]
200	
201	SUGGESTED SOLUTION:
202	1. [specific change]
203	2. [specific change]
204	
205	Do you want me to implement this fix?
206	```
207	
208	## Deployment
209	
210	- Run via `tsx` - no build step, no compilation
211	- Dev: `tsx watch src/service.ts`
212	- Prod: `tsx src/service.ts`
213	- Dev env: Docker Compose with `env_file: .env`
214	- Prod env: K8s runtime variables
215	- Never use dotenv
216	
217	## Testing
218	
219	Uses `node:test` (built-in, zero deps). See `TESTING.md` for full guidelines.
220	
221	- `*.apitest.ts` — runs against live Docker instance (API + DB)
222	- `*.test.ts` — isolated unit tests, no external deps
223	- Tests live in `test/` subfolder within their domain
224	- Use `describe()`, `test()`, `assert` from `node:assert/strict`
225	- Servertests use `src/test/http.ts` for HTTP helper
226	- `npm test` auto-delegates to Docker when run on host
227	- Files run in parallel across domains (`--test-concurrency=4`)
228	
229	### Running tests
230	
231	```bash
232	npm test                              # full suite
233	npm test -- src/domains/mcp           # scope to folder
234	npm test -- src/domains/mcp/test/hosts.apitest.ts  # single file
235	npm test -- -q                        # quiet (dots, errors only)
236	```
237	
238	One command, works from host or Docker. Do NOT run the full suite during development -- scope to your domain.
239	
240	## Change history
241	
242	For breaking changes and mindset shifts in a domain, check its `change-history/` folder — timestamped markdown files that explain what changed and why, written for future debugging rather than as a diff log.
243	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/AGENTS.md"}

1	# Source Code Conventions
2	
3	## TypeScript
4	
5	- **Strict types** - no `any`, use proper type definitions
6	- **Inferred return types** - let TypeScript infer when clear, explicit only when needed
7	- **ES modules** - `export function`, not `export default {}`. Import with `.js` extensions
8	- **Path aliases** - always `@/` instead of relative paths
9	- **Self-documenting code** - good naming over comments. Keep @jsdoc comments
10	- **All code must pass strict mode** - `npx tsc --noEmit`
11	
12	```typescript
13	// Imports - @/ alias, .js extension
14	import { User } from '@/types/user.js';
15	
16	// Functions - named exports, proper typing
17	export async function handler(req: FastifyRequest<{
18	  Body: CreateUserBody;
19	  Params: { id: string };
20	  Querystring: { limit: number };
21	}>, reply: FastifyReply) {}
22	```
23	
24	### Response Schemas
25	
26	ALWAYS `additionalProperties: true` on nested objects - Fastify strips unknown properties without it (silent data loss).
27	
28	```typescript
29	// BAD - nested object properties get stripped
30	event: { type: 'object' }
31	
32	// GOOD - preserves all nested data
33	event: { type: 'object', additionalProperties: true }
34	```
35	
36	### Typebox Entity Catalogue (`src/schemas/typebox/`)
37	
38	Every Sequelize model has a corresponding `<bucket>/<Entity>.ts` file that
39	exports three things:
40	
41	- `<Entity>Schema` — the Typebox schema (registered via `app.addSchema()` in
42	  `registerAllSchemas`, referenced from routes with `Type.Ref('<Entity>')`).
43	- `<Entity>PublicFields` — `as const` tuple of column names safe to expose on
44	  the wire. Must equal `Object.keys(Schema.properties)` (drift test enforces).
45	- `<Entity>PrivateFields` — `as const` tuple of columns that must NEVER leave
46	  the server (e.g. `requestHeaders`, `requestBody`, `password`, `*Token`,
47	  `azure*`, `deleted`).
48	
49	**Hard rule:** every column on a Sequelize model MUST be classified Public or
50	Private. The drift guard in `src/test/drift.apitest.ts` fails CI when a new
51	column is unclassified.
52	
53	Because every `<Entity>Schema` carries `additionalProperties: true`,
54	fast-json-stringify does NOT strip Private fields at serialisation. The
55	controller is responsible for filtering them out. The runtime guard in
56	`src/test/privateFields.apitest.ts` asserts the canonical GET endpoint for
57	each entity does in fact strip its `PrivateFields` from the response — extend
58	that test when a new entity gains Private columns.
59	
60	When adding a column to a Sequelize model:
61	
62	1. Decide Public or Private.
63	2. Add it to `<Entity>PublicFields` and `<Entity>Schema.properties` (Public)
64	   OR to `<Entity>PrivateFields` (Private). Never both.
65	3. If Private, ensure the controller stripping logic (typically
66	   `row.toJSON()` then `delete rowData.<field>`) covers it, and extend
67	   `privateFields.apitest.ts` if the entity does not already have coverage.
68	
69	### Interface Organization
70	
71	- Inline simple types: `{ taskId: string }` instead of separate interfaces
72	- Define interfaces in dedicated type files only when shared across modules
73	- Co-locate types immediately before their consuming functions
74	- Use `.js` extensions for type imports (required for ES modules)
75	
76	## Error Handling
77	
78	Always throw, never return errors. No catchAsync wrapper - Fastify supports async/await natively. Let errors bubble to Fastify's errorHandler.
79	
80	```typescript
81	// FORBIDDEN
82	if (!thing) {
83	  return res.code(404).send({ error: 'Not found' });
84	}
85	
86	// REQUIRED
87	throw new StatusError(404, 'Thing not found');
88	```
89	
90	## Code Quality
91	
92	- **Max 40 lines** per function body - externalize logic if longer
93	- **Pure functions** - predictable, single behavior
94	- **Single responsibility** - one function = one goal
95	- **Never nest** - flatten logic, reduce depth levels
96	- **Fail fast** - throw errors immediately, no intermediate variables for simple checks
97	- **One-line database calls** - direct `findOne()` instead of complex helpers
98	- **No conditional switching** - split functions instead
99	
100	## Logging
101	
102	- `fastify.log.info()` - never `console.log`
103	- `request.id` in all log lines
104	- No emojis in logs - break logging and grep in production
105	- Just throw errors, don't log and throw
106	
107	## Architecture
108	
109	### Code Organization
110	
111	- **Co-location over abstraction** - place types before consuming functions
112	- **Avoid separate `types.ts`** unless shared across modules
113	- **Eliminate empty abstractions** - remove unnecessary intermediate files
114	- **Complete refactors** - update all imports in the same change, no partial states
115	
116	### Route Organization
117	
118	- **No route prefixes** - use full routes like `/v1/users/profile`
119	- **Flat routes** in `routes/index.ts` - better for AI context
120	- **Minimal handlers** - delegate to services
121	
122	### File Naming
123	
124	- Pick one convention (camelCase, PascalCase, or snake_case)
125	- No suffixes - no Controller, Routes, Service. Path indicates purpose
126	- Fewer tokens = more AI context
127	
128	### File Organization
129	
130	- Single Dockerfile - override dev in docker-compose
131	- Single tsconfig.json
132	- Use library defaults - remove config files when possible
133	
134	### Naming Consistency
135	
136	- Same names everywhere - env vars, service names, container names
137	- Docker services match env file - no overrides in compose
138	
139	## Authentication System
140	
141	Auth is handled by `plugins/auth-v2.ts`, which calls `authenticateRequest()`. It tries four strategies in order: `X-Widget-Token` header → `Permit` → `Client` → `Bearer`. After authentication, `request.ident` (WHO) and `request.auth` (HOW) are set on the request.
142	
143	`request.ident: RequestIdentity` — `{ user: UserIdentity | null, org: OrganizationIdentity, client: ClientIdentity | null }`. `user` is null for client-only credentials with no bound user.
144	
145	`UserIdentity.id` is a `string` (UUID). All user IDs in the system are UUIDs — numeric IDs no longer appear in auth interfaces.
146	
147	`GET /v1/auth/session` — protected endpoint (requires `fastify.authenticate`). Returns `{ userId, organizationId, user, organization }`. Used by sherpa-mesh to validate incoming tokens. `userId` is null when there is no user context (client-only credentials). Add `additionalProperties: true` to any nested objects added to its response schema.
148	
149	### Comments and Documentation
150	
151	- Keep comments that explain business logic
152	- Remove obvious comments like "This is the taskId"
153	- If something needs explanatory comments, fix the naming instead
154	- Keep docs/jsdoc during refactors - don't delete them
155	
156	### Product setup completeness (pending)
157	
158	`ProductReadyBanner` currently determines product readiness by making 4 parallel API calls from the browser. This business logic belongs in a dedicated API endpoint: `GET /v1/plus/products/{id}/setup-status`.
159	
160	The endpoint should return a structured list of what's present and missing (required vs. warning), computed server-side. The portal consumes it instead of making 4 bespoke calls. The mesh portal agent calls it via `fetch_sherpa_api` to understand what a product still needs before proposing additional drafts.
161	
162	The distinction between required (Quote, Product Plan, Pricing) and warning (Policy, Pricing Table, Pricing Rule) is business knowledge — it belongs in the API, not in the model prompt or portal component.
163	
164	### Agent-facing field descriptions in TypeBox schemas
165	
166	The Sherpa Mesh portal agent reads field descriptions from the OpenAPI spec via `openapi_get` before proposing resource drafts. Descriptions are the agent's only guidance on valid values and business rules.
167	
168	Use these conventions in `src/schemas/plus/`:
169	
170	- `AUTO-DEFAULT: <how to derive it>. NEVER ask the use

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/AGENTS.md"}

1	# Database & Migrations
2	
3	## Tenant Isolation — Safe Model Pattern
4	
5	Organization context is enforced at the call site via `toSafeModel` wrappers. There is no CLS namespace and no ambient global state. Strict tenant RLS is active on every tenant-scoped table: `current_organization_in_scope("organizationId")` returns FALSE when `app.current_organization` / `app.current_organization_set` is unset, so an unpinned query sees zero rows.
6	
7	### How It Works
8	
9	- Every tenant-isolated model is wrapped with `toSafeModel` (`src/models/lib/safe-model.ts`)
10	- Every query requires an explicit `FastifyRequest` or `OrgCtx` as the first argument
11	- Safe-model opens a transaction and sets `app.current_organization` / `app.current_organization_set` / `app.scope_mode` via `SET LOCAL` before running the query
12	- `organizationId` is injected into where clauses / creation attributes automatically
13	- CI import guard (`scripts/check-internal-imports.sh`) prevents raw internal model imports
14	
15	### Three Access Patterns
16	
17	There are exactly three sanctioned ways to reach the database. Anything else fails CI or fails RLS (or both).
18	
19	```typescript
20	// 1. Authenticated / tenant-scoped — pass the FastifyRequest.
21	//    safe-model resolves the caller's org scope and pins the GUC for the txn.
22	const product = await Product.findOne(request, { where: { id } });
23	
24	// 2. Programmatic / fixed-org — pass { organizationId } (an OrgCtx).
25	//    Background jobs, scripts, webhook workers where the org is known.
26	const product = await Product.findOne({ organizationId }, { where: { id } });
27	
28	// 3. Genuinely cross-org — systemSequelize (BYPASSRLS user), raw SQL only.
29	//    Auth bootstrap, payment webhooks, cross-org batch sweeps.
30	// SAFE-SYSTEM: pre-auth token lookup, no request identity yet
31	const rows = await systemSequelize.query(sql, { replacements, type: QueryTypes.SELECT });
32	```
33	
34	When the ORM cannot express a tenant query (recursive CTEs, UPSERT-RETURNING, jsonb operators, multi-table aggregations), use `tenantQuery` — never raw `sequelize.query`:
35	
36	```typescript
37	import { tenantQuery } from '@/models/lib/db-query.js';
38	
39	const rows = await tenantQuery<Row[]>(
40	  request, // or { organizationId }
41	  `WITH RECURSIVE tree AS ( ... ) SELECT * FROM tree WHERE ...`,
42	  [parentId],
43	);
44	```
45	
46	`tenantQuery` resolves the caller's scope, opens a transaction, sets `app.current_organization` / `app.current_organization_set` / `app.scope_mode` via `SET LOCAL`, then runs the SQL on the tenant DB user. An explicit `"organizationId" = $n` predicate in the SQL is still recommended as defense-in-depth, but the GUC + RLS policy is the primary filter.
47	
48	### Model Categories
49	
50	There are two kinds of models, determined by whether the table has an `organizationId` column:
51	
52	| Category | Layout | Query shape | Examples |
53	| --- | --- | --- | --- |
54	| **Tenant-scoped** | `src/models/internal/_Foo.ts` (class) + `src/models/Foo.ts` (`toSafeModel(_Foo)`) | `Foo.findOne(ctxOrReq, { where: {...} })` | `Product`, `Policy`, `Claim`, `Pricing`, `UserOrganization` |
55	| **Cross-org / platform / reference** | Plain `@Table class Foo extends Model` in `src/models/Foo.ts`, no `internal/_Foo.ts` | `Foo.findOne({ where: {...} })` | `Organization`, `User`, `Country`, `Region`, `Partner`, `Module`, `Insurer`, `Scope`, `InvalidatedToken` |
56	
57	The rule is: **if the table has an `organizationId` column, it's tenant-scoped and must live in `internal/_Foo.ts`** (enforced by CI check 5 below). Cross-org models have no column to filter on and are therefore plain Sequelize classes with full `.findOne`/`.create`/etc. exposed. There is no `toSystemModel` wrapper — cross-org lookup of a tenant-scoped model goes through `systemSequelize.query` with a `// SAFE-SYSTEM:` annotation (see `authController.login()` for the canonical example).
58	
59	### Two Database Connections
60	
61	| Env Variable  | Connection        | RLS          | Purpose                                      |
62	| ------------- | ----------------- | ------------ | -------------------------------------------- |
63	| `DB_USER`     | `systemSequelize` | **Bypassed** | Pre-auth lookups, cross-org reads, migrations, admin scripts. Every call site must carry a `// SAFE-SYSTEM: <reason>` annotation. |
64	| `DB_APP_USER` | `sequelize`       | **Enforced** | All tenant-scoped data-plane operations. Reached only through safe-model wrappers or `tenantQuery` — never `sequelize.query` directly. |
65	
66	Environment-specific users:
67	
68	| Environment | DB_USER (bypass RLS)     | DB_APP_USER (RLS enforced) |
69	| ----------- | ------------------------ | -------------------------- |
70	| Local       | `sherpa_user`            | `sherpa_app`               |
71	| Development | `sherpa_api_development` | `sherpa_app_development`   |
72	| Staging     | `sherpa_api_staging`     | `sherpa_app_staging`       |
73	
74	### Transaction Rules
75	
76	```typescript
77	// Standard — no explicit transaction needed for single operations.
78	// safe-model opens its own txn and sets the org GUC inside it.
79	const product = await Product.findOne(request, { where: { id } });
80	
81	// Raw SQL on a tenant table — tenantQuery opens its own txn and sets the GUC.
82	// Do NOT wrap it in sequelize.transaction(...) for org context.
83	const rows = await tenantQuery<Row[]>(request, sql, [param]);
84	
85	// Atomic multi-write across several safe-model calls — explicit transaction
86	// for atomicity only. The org GUC is still pinned per-call by safe-model.
87	return sequelize.transaction(async (transaction) => {
88	  const claim = await Claim.create(request, { ... }, { transaction });
89	  await ClaimParameter.bulkCreate(request, [...], { transaction });
90	  return claim;
91	});
92	
93	// Background job / script — OrgCtx instead of request
94	const product = await Product.findOne({ organizationId }, { where: { id } });
95	```
96	
97	Explicit `sequelize.transaction(...)` is for multi-write atomicity, not for establishing org context. Org context is always set by safe-model (or `tenantQuery`) on the inner query's own transaction.
98	
99	### systemSequelize (Bypass RLS)
100	
101	Use ONLY for:
102	- Auth bootstrap (pre-auth lookups): `authController`, `routes/authRoutes`, `plugins/auth/*`, `services/azureAdService`
103	- Migrations/admin: `db/migrate.ts`, `db/umzug.ts`, maintenance scripts
104	- Cross-org registries that are platform-level by design: `domains/mcp/*`, org module/switching controllers
105	- Cross-org batch sweeps and pre-auth payment webhooks (e.g. Stripe events that arrive before a request identity exists)
106	- NEVER in data-plane controllers, services, or jobs after auth — use safe-model or `tenantQuery`
107	- Always parameterized — prevent SQL injection
108	- **Every call site must carry a `// SAFE-SYSTEM: <reason>` annotation** (enforced by CI, see guardrails below)
109	
110	### RLS Policy Template for New Tenant Tables
111	
112	RLS policies on tenant tables use `USING (current_organization_in_scope("organizationId"))`. The function returns FALSE when the GUC is unset, so every app-code path must pin the org via safe-model (which calls `withRls` internally) or `tenantQuery`. `systemSequelize` is the only legitimate bypass and requires a `// SAFE-SYSTEM:` annotation.
113	
114	Every new tenant-isolated table's migration MUST use this `USING` expression:
115	
116	```sql
117	CREATE POLICY tenant_isolation ON "NewTenantTable"
118	  FOR ALL
119	  USING (current_organization_in_scope("organizationId"));
120	```
121	
122	A bare `USING ("organizationId" = NULLIF(current_setting('app.current_organization', true), '')::uuid)` clause does not honor scope mode and will not see hierarchical descendants when the route opts in. Always use `current_organization_in_scope`. See `2026.05.21T00.00.01.fix-rls-no-guc-deny.ts` and `2026.05.25T00.00.01.scope-mode-strict-by-default-rls.ts` for the f

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/AGENTS.md"}

1	# AGENTS.md
2	
3	Sherpa Portal -- full-stack insurance platform.
4	
5	## Tech Stack
6	
7	- **Frontend**: Next.js 13+ (App Router), TypeScript, Tailwind CSS
8	- **Backend**: Node.js/Express.js, TypeScript
9	- **Database**: PostgreSQL
10	- **Caching**: ValKey (Redis-compatible)
11	- **State Management**: Zustand
12	- **i18n**: LMT (Language Model Translations)
13	
14	## Docker Services
15	
16	- `frontend`: Next.js app (port via PORT env var, default 3000)
17	- `backend`: Express.js API on port 4000
18	
19	## Directory Structure
20	
21	```
22	app/                    # Next.js 13+ App Router (frontend)
23	├── components/         # Reusable components
24	│   └── portal-assistant/  # Portal Sherpa AI assistant (see section below)
25	├── src/
26	│   ├── store/          # Zustand stores (including changeSetStore, draftResourceStore)
27	│   ├── utils/          # API client, env helpers, utilities (getMeshUrl in env.ts)
28	│   └── hooks/          # Custom React hooks
29	├── types/              # TypeScript type definitions
30	├── services/           # Frontend service modules
31	└── [feature]/          # Feature pages (dashboard, products, lens, etc.)
32	lib/lmt/                # LMT i18n runtime (t, client, server, config)
33	translations/           # Translation data
34	├── locales/            # Per-locale JSON (es_419.json, pt_BR.json)
35	├── generated/          # Auto-generated locale module
36	├── config.ts           # Translation pipeline config
37	├── keys.json           # Extracted key manifest
38	└── cache.json          # Pipeline cache
39	scripts/translate.ts    # LLM translation pipeline
40	k8s/                    # Kubernetes deployment (cdk8s)
41	```
42	
43	## Dev Commands
44	
45	```bash
46	npm run dev          # Start dev server
47	npm run dev:https    # Dev with HTTPS (requires SSL certs)
48	npm run build        # Production build
49	npm run start        # Production server
50	npm run translate    # Extract keys / incremental translation pipeline
51	npm run validate-translations # Validate locale coverage and key consistency
52	```
53	
54	## i18n — Write English, translations are automatic
55	
56	Every user-facing string must be wrapped with `t()`. Write in English — translations happen automatically in CI.
57	
58	```tsx
59	import { useTranslation } from "@gangkharai/lmt/client";
60	
61	const MyComponent = () => {
62	  const t = useTranslation();
63	  return <h1>{t('Insurance Products')}</h1>;
64	};
65	```
66	
67	### Patterns
68	
69	```tsx
70	<button>{t('Save')}</button>
71	<input placeholder={t('Search...')} />
72	showSuccessToast(t('Saved successfully'))
73	t('{count} products selected', { count: selected.length })
74	status === "active" ? t('Active') : t('Inactive')
75	<p>{t('File')}: <strong>{name}</strong> ({count} {t('rows')})</p>
76	```
77	
78	### What NOT to wrap
79	
80	CSS classes, routes, console.log, `throw new Error()`, API paths, object keys, enum identifiers, format strings, dynamic API content.
81	
82	### Validation command
83	
84	Run `npm run validate-translations` to validate translation keys/locales and catch invalid `t()` usage early.
85	
86	### AST audit for missing `t()` (non-grep)
87	
88	When translation gaps are scattered across many `.tsx` files, run an AST-based audit (TypeScript parser) instead of grep text matching.
89	
90	- Parse `app/**/*.tsx` with `typescript` and inspect `JsxText` + string literals in UI contexts (`jsx-text`, user-visible attrs like `placeholder`, `aria-label`, and toast/message calls).
91	- Ignore non-UI values (routes, object keys, API paths, regex patterns, technical identifiers, and format tokens).
92	- Only treat strings as missing when they are **not** already inside `t("...")`.
93	- Fix highest-confidence files first, then rerun the AST audit until no actionable candidates remain.
94	- After each batch: run `npx tsc --noEmit`, lint touched files, then run `npm run validate-translations`.
95	
96	### Translation Key Safety
97	
98	- Never call `t()` with variables or expressions like `t(label)`, `t(config.label)`, `t(source.label)`, `t(error)`.
99	- `t()` must receive a literal English string (or a literal template with params): `t('Paid')`, `t('{count} items', { count })`.
100	- If UI labels come from local config arrays, translate at definition time with literal keys, then render the translated value directly.
101	- If a value comes from API/user input, render it as-is (or map known enum values to literal `t('...')` keys), but do not pass raw dynamic values to `t()`.
102	- Keep local label definitions co-located in the component/function using them; do not split into external raw-value constants plus separate translation helper mappers.
103	
104	## CRITICAL: `"use client"` Directive
105	
106	**Every `.tsx` component that uses hooks, event handlers, browser APIs, or is imported by a `"use client"` file MUST have `"use client"` at the top.**
107	
108	Without it, Next.js treats the file as a server component. In production this causes:
109	
110	```
111	Application error: a client-side exception has occurred
112	```
113	
114	Browser console shows:
115	```
116	Error: `cookies` was called outside a request scope.
117	```
118	
119	This crashes the entire page. It **only happens in production/deployed builds**, never locally, making it extremely hard to catch before deploy.
120	
121	**Rule**: When creating or extracting any `.tsx` component, add `"use client"` unless it is exclusively rendered by server components (root layout, other server components). When in doubt, add it.
122	
123	See `.claude/skills/missing-use-client/SKILL.md` for full diagnostic details.
124	
125	## Code Quality
126	
127	Run after every change:
128	
129	```bash
130	npx eslint ./app
131	npx tsc
132	npx prettier --check
133	```
134	
135	Fix ALL eslint warnings until none remain, even if unrelated to your changes.
136	
137	## TypeScript
138	
139	- All code in TypeScript
140	- Define interfaces for all data structures
141	- **Never use `any`** -- use `unknown` for catch clauses, `Record<string, unknown>` for unknown objects, type guards for narrowing
142	- Always use `@` imports: `import xxx from '@/app/...'`
143	
144	## Environment Variables
145	
146	- **Server-side**: Use `getRequired()` from `app/src/utils/env.ts`
147	- **Client-side**: Use `process.env.NEXT_PUBLIC_*` directly (Next.js inlines at build time)
148	- **Never** use `getRequired()` with `NEXT_PUBLIC_*` variables
149	- **Never** use fallback values (`|| 'default'`) -- fail fast on missing config
150	
151	### URL Helpers (from `app/src/utils/env.ts`)
152	
153	- `getSherpaApiUrl()` -- API base URL
154	- `getAppUrl()` -- Application URLs (redirects, links)
155	- `getEmbedUrl()` -- Embed widget URLs
156	
157	These auto-detect HTTP/HTTPS based on environment and protocol.
158	
159	### Deprecated (DO NOT USE)
160	
161	- `NEXT_PUBLIC_SHERPA_API` → `getSherpaApiUrl()`
162	- `NEXT_PUBLIC_APP_URL` → `getAppUrl()`
163	- `NEXT_PUBLIC_EMBED_URL` → `getEmbedUrl()`
164	- `NEXT_PUBLIC_USE_HTTPS` → auto-detected
165	- `NEXT_PUBLIC_BACKEND_PORT` → included in URL variables
166	
167	## Dev flags
168	
169	Dev flags exist to **hide** features from non-developers. When a flag is
170	off, the gated feature must be invisible — no message, no hint that a
171	hidden surface exists, no breadcrumb pointing at `/dev/flags`.
172	
173	Gate at the **layout** of the route subtree, not in each `page.tsx`.
174	A client `layout.tsx` reads the flag, `router.push("/")`, and returns
175	`null` when off; every page under that layout drops the flag check
176	entirely. Server middleware is the wrong tool here — dev flags live in
177	`localStorage` and middleware can't see it.
178	
179	Canonical examples: `app/mcp/layout.tsx`, `app/lens/synthetic-client/layout.tsx`.
180	Never render a "this feature is behind a dev flag, enable it on …"
181	panel — that defeats the entire point of the flag.
182	
183	## Portal Sherpa (AI Assistant)
184	
185	The Portal Sherpa is a floating sidebar assistant embedded in the a

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/AGENTS.md"}

1	# AGENTS.md -- Frontend App
2	
3	## API Client
4	
5	Use the centralized client: `import api from '@/app/src/utils/api'`
6	
7	The client (`app/src/utils/api.ts`) automatically handles base URL (`getSherpaApiUrl()`), auth headers, error handling, and token refresh.
8	
9	### Path Construction
10	
11	- **DO NOT** include `/api` in calls (already in baseURL)
12	- **DO NOT** duplicate resource names
13	
14	```typescript
15	// WRONG
16	api.get('/data-model/data-model/categories')
17	
18	// RIGHT
19	api.get('/data-model/categories')
20	```
21	
22	### Response Structure
23	
24	```typescript
25	interface ApiResponse<T> {
26	  status: "success" | "error";
27	  data?: T;
28	  message?: string;
29	}
30	```
31	
32	Always check `status` before using data:
33	
34	```typescript
35	try {
36	  const response = await api.get("/data-model/categories");
37	  if (response.data.status === "success") {
38	    setData(response.data.data);
39	  } else {
40	    showErrorToast(response.data.message || "An error occurred");
41	  }
42	} catch (error) {
43	  console.error("API call failed:", error);
44	  showErrorToast("Failed to fetch data");
45	}
46	```
47	
48	### Backend Route Structure
49	
50	- Root handlers: `/`
51	- Sub-resource handlers: `/[sub-resource]`
52	- Entity handlers: `/[id]` or `/:id`
53	- Avoid redundant prefixes matching the mount path
54	
55	## Data Transformation
56	
57	When data passes between components or through adapter functions:
58	
59	- Examine transformation functions (like `convertToX` or adapters) carefully
60	- Ensure ALL properties from source objects are preserved in target interfaces
61	- Do not set important properties to `null` or strip them unless explicitly required
62	- Pay special attention to arrays, objects, and nested structures
63	
64	When debugging type issues:
65	1. Check interface definitions match actual data structure
66	2. Verify conversion/adapter functions preserve all needed properties
67	3. Use console logs to inspect structure at each step
68	4. Compare runtime data with interface definitions
69	
70	When using external data:
71	- Always validate interfaces match actual received data
72	- Never assume properties are present/absent without verifying
73	- Include interface properties for all fields needed downstream
74	
75	Working with options, dropdowns, and lookups:
76	- Ensure data structures with options arrays have that property in their interface
77	- Always preserve option arrays when transforming data
78	- Include proper fallback handling ordered by specificity
79	
80	## No Hardcoded Labels
81	
82	Never hardcode display labels, mappings, or options in component logic.
83	
84	- Use data-driven approaches for UI elements whose values may change
85	- Replace `type === 'X' ? 'Label X' : 'Label Y'` with lookups against settings data
86	- Reuse lookup functions across components that need the same mappings
87	
88	### Settings-driven UI
89	
90	- Extract display labels from settings data structures
91	- Use helper functions for consistent label lookups
92	- Fallback precedence: `settings → props → known patterns → generic formatting`
93	
94	### Initializing from existing data
95	
96	- Extract both values AND labels from the data source
97	- Avoid recreating label mappings that already exist in the data
98	- For tables/lists with existing data, reuse existing label patterns
99	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-embed-api-458-credit-check-compliance-integrat/AGENTS.md"}

1	# Sherpa Embed
2	
3	Preact-based embeddable insurance widget running in iframes with PostMessage communication.
4	
5	## Development Workflow
6	
7	### Setup
8	
9	```bash
10	npm install
11	cp env.reference .env
12	npm run dev
13	```
14	
15	### Commands
16	
17	```bash
18	npm run dev         # Start development server (http://localhost:3100)
19	npm run type-check  # TypeScript validation - MUST pass
20	npm run lint        # ESLint - MUST pass
21	npm run build       # Production build
22	npm run preview     # Test production build
23	```
24	
25	### Environment
26	
27	- Copy `env.reference` to `.env`
28	- Set `VITE_SHERPA_API` to your backend URL
29	- Never commit `.env` files
30	
31	### Testing
32	
33	Create test HTML file:
34	```html
35	<!DOCTYPE html>
36	<html>
37	<body>
38	  <iframe
39	    id="sherpa-embed"
40	    src="http://localhost:3100/quote?token=test&product=test"
41	    width="100%"
42	    height="600"
43	    sandbox="allow-scripts allow-forms">
44	  </iframe>
45	  <script src="http://localhost:3100/widget.js"></script>
46	</body>
47	</html>
48	```
49	
50	- Check console for PostMessage events
51	- Use Network tab to verify API calls
52	
53	### Deployment
54	
55	- Push to `development` branch
56	- GitHub Actions handles build and deployment
57	- Production deploys automatically via GitHub
58	
59	### Quality Gates
60	
61	- Zero TypeScript errors
62	- Zero ESLint errors
63	- All security patterns followed
64	
65	## Coding Standards
66	
67	### Core Principles
68	
69	- Write functional, minimal, vanilla code
70	- Prefer short, readable code over cleverness
71	- Never use default values - always require explicit values
72	- Never use `undefined` as a value
73	- Avoid `type` as a field name
74	- Throw every error - never swallow them
75	- Keep code modular and composable
76	- Professional code - no emojis or casual language
77	- Less is more - limit scope to what's asked
78	
79	### TypeScript Requirements
80	
81	- Zero TypeScript errors - code must pass `npm run type-check`
82	- Use strict types from `src/types/`
83	- Type imports: `import type { TypeName } from './types'`
84	- No `any` types
85	- Define interfaces for all props and API responses
86	
87	### Error Handling
88	
89	```typescript
90	// NEVER do this
91	try {
92	  const result = await apiCall();
93	  return result || 'default value';
94	} catch (err) {
95	  console.log('Error occurred');
96	  return null;
97	}
98	
99	// ALWAYS do this
100	const result = await apiCall();
101	if (!result) {
102	  throw new Error('API call returned no data');
103	}
104	return result;
105	```
106	
107	### Component Structure
108	
109	```typescript
110	import { useState } from 'preact/hooks';
111	import type { ComponentProps } from '../types/config';
112	
113	interface MyComponentProps {
114	  title: string;
115	  onAction: (data: unknown) => void;
116	}
117	
118	export default function MyComponent({ title, onAction }: MyComponentProps) {
119	  const [state, setState] = useState<string>('');
120	
121	  return (
122	    <article>
123	      <h2>{title}</h2>
124	    </article>
125	  );
126	}
127	```
128	
129	### File Organization
130	
131	- **Components**: `src/components/ComponentName.tsx`
132	- **Hooks**: `src/hooks/useHookName.ts`
133	- **Types**: `src/types/domain.ts`
134	- **Utils**: `src/utils/utilityName.ts`
135	
136	### API Integration
137	
138	- Always use `src/utils/apiClient.ts`
139	- Handle errors with hooks from `src/hooks/useApi.ts`
140	- Include TypeScript types from `src/types/api.ts`
141	- Never provide default API responses
142	
143	### Import Order
144	
145	1. External libraries (preact, etc.)
146	2. Internal utilities and hooks
147	3. Internal components
148	4. Type imports (with `type` keyword)
149	
150	### Performance
151	
152	- Keep bundle size minimal using Preact
153	- Use PostMessage efficiently for iframe communication
154	- Minimize DOM manipulations
155	
156	### Documentation
157	
158	- Code must be readable and self-explanatory
159	- Minimal documentation unless absolutely essential
160	- Never duplicate state in documentation - refer to files instead
161	- Keep TODOs unless implemented
162	- Move code with its comments - preserve critical comments verbatim
163	
164	### Validation
165	
166	- Use `src/utils/validation.ts` for all form validation
167	- Sanitize user inputs before API calls
168	- Never trust parent window data without validation
169	
170	## Security Patterns
171	
172	### Iframe Security
173	
174	```html
175	<iframe sandbox="allow-scripts allow-forms"></iframe>
176	```
177	
178	CSP headers in `index.html`:
179	- `default-src 'self'`
180	- `script-src 'self' 'unsafe-inline'`
181	- `connect-src 'self' http://localhost:4000 https://api.gangkhar.com`
182	
183	### Origin Validation
184	
185	ALL PostMessage communication MUST validate origins using `src/utils/security.ts`:
186	
187	```typescript
188	if (!validateOrigin(event.origin)) {
189	  throw new Error(`Unauthorized origin: ${event.origin}`);
190	}
191	```
192	
193	Update `ALLOWED_ORIGINS` in `src/utils/security.ts`:
194	```typescript
195	export const ALLOWED_ORIGINS = [
196	  'https://embed.gangkhar.com',
197	  'https://embed.dev.gangkhar.dev',
198	  'http://localhost:3100',
199	];
200	```
201	
202	### API Security
203	
204	Required headers in `src/utils/apiClient.ts`:
205	```typescript
206	headers['X-Widget-Token'] = this.widgetToken;
207	headers['Origin'] = window.location.origin;
208	if (this.parentDomain && this.parentDomain !== 'unknown') {
209	  headers['X-Parent-Domain'] = this.parentDomain;
210	}
211	```
212	
213	### Input Validation
214	
215	Use `src/utils/validation.ts` for ALL user inputs:
216	```typescript
217	const validation = validateFormData(formData, parameters);
218	if (!validation.isValid) {
219	  throw new Error(`Validation failed: ${validation.errors.join(', ')}`);
220	}
221	```
222	
223	XSS prevention:
224	```typescript
225	export const sanitizeString = (input: string): string => {
226	  return input
227	    .replace(/<script[^>]*>[\s\S]*?<\/script>/gi, '')
228	    .replace(/on\w+="[^"]*"/gi, '')
229	    .replace(/javascript:/gi, '')
230	    .trim();
231	};
232	```
233	
234	### Error Security
235	
236	Never expose sensitive information:
237	```typescript
238	// NEVER
239	throw new Error(`Database connection failed: ${dbError.message}`);
240	
241	// ALWAYS
242	throw new Error('Unable to process request');
243	```
244	
245	### Message Security
246	
247	Use structured messages from `src/types/events.ts`:
248	```typescript
249	const validTypes: MessageType[] = [
250	  'RESIZE_IFRAME',
251	  'WIDGET_LOADED',
252	  'WIDGET_ERROR',
253	  'QUOTE_COMPLETED',
254	  'POLICY_PURCHASED',
255	  'NAVIGATION_REQUEST'
256	];
257	```
258	
259	### Security Checklist
260	
261	- All origins validated
262	- CSP headers configured
263	- Widget tokens scoped
264	- Input validation on all forms
265	- Error messages user-safe
266	- PostMessage structure validated
267	- No sensitive data in logs
268	- Iframe sandbox configured
269	- Validate input sanitization
270	- Check error handling paths
271	
272	## Funnel Templates (HTML/CSS)
273	
274	Templates are stored per funnel in the API and rendered by `src/components/customizable-form/useTemplateParser.tsx`. The parser replaces well-known IDs/classes with dynamic data — **never hardcode runtime values (page titles, counters, error text) in template HTML or CSS pseudo-elements (`::before`/`::after content`)**, because they will appear identically on every page.
275	
276	### Dynamic placeholders the parser populates
277	
278	| Element | Source | Notes |
279	|---|---|---|
280	| `#header-title` | `formData.title` | Top-level header |
281	| `[id^="page-container-"]` | `formData.pages[*]` | One section per page; visibility toggled by `currentPage` |
282	| `#page-title` | `formData.pages[i].label` | Inside its `page-container-` |
283	| `#page-description` | `formData.pages[i].description` | Supports `{path}` interpolation + safe HTML subset |
284	| `[id^="category-container-"]` / `

{"command":"curl -fsS \"http://localhost:7777/api/api-action?path=/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat\" 2>&1 | head -c 800; echo","description":"Poll API install job status"}

{"path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat","action":"install","status":"done","startedAt":1780262504121,"endedAt":1780262510620,"exitCode":0,"error":null,"logPath":"/var/folders/pr/7k4xc3v1715_0zbbw8tgwl5r0000gn/T/worktree-dashboard-logs/sherpa-api-api-458-credit-check-compliance-integrat-install.log","tail":"\n> Sherpa [email protected] prepare\n> husky\n\ngit command not found\nadded 84 packages, removed 2 packages, changed 5 packages, and audited 934 packages in 4s\n\n221 packages are looking for funding\n  run `npm fund` for details\n\n5 moderate severity vulnerabilities\n\nTo address issues that do not require attention, run:\n  npm audit fix\n\nSome issues need review, and may require choosing\na different dependency.\n\nRun `npm audit` for detai

{"description":"Map compliance check framework (api)","subagent_type":"Explore","prompt":"Explore the sherpa-api worktree at /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat very thoroughly. I need a complete map of the existing **compliance check** framework — specifically the sanctions screening / OpenSanctions integration and the external-API-integration framework — because I'm adding a new \"credit_check\" compliance check type that reuses it.\n\nFind and report, with exact file paths and line numbers:\n1. Where compliance check TYPES are defined (sanctions, kyc, fraud, etc.) — enums, TypeBox schemas, Sequelize models, DB columns. Search for terms like \"sanction\", \"compliance\", \"kyc\", \"fraud\", \"screening\", \"checkType\", \"check_type\", \"OpenSanctions\".\n2. The Sequelize models + migrations involved (compliance check config per product/organization/outlet; compliance results persisted on policy/claim). Show the model files, their columns, and the migration files that created the tables.\n3. The \"external-API-integration\" framework: auth config, AI-assisted outgoing/incoming field mapping (request/response mapping). Search \"externalApi\", \"external_api\", \"fieldMapping\", \"field_mapping\", \"integration\", \"mapping\", \"requestMapping\", \"responseMapping\".\n4. Trigger events (new business / renewal / endorsement / claim) and outcome handling (auto-approve / review / auto-deny / manual override). Search \"trigger\", \"triggerEvent\", \"outcome\", \"auto_approve\", \"auto_deny\", \"review\", \"override\".\n5. How a compliance result (score/decision) gets persisted on a policy/claim and surfaced in notifications. Search \"notification\", \"compliance result\", \"score\", \"decision\".\n6. The routes/controllers that expose compliance config + results (TypeBox schemas, route registration in routes/index.ts).\n7. The TypeBox entity catalogue entries (src/schemas/typebox/) for any compliance entities, and their PublicFields/PrivateFields.\n\nReport the full picture: which files define the check-type enum/list, which model+migration store config and results, how the external API integration + AI mapping works, and exactly what I'd need to touch to add a \"credit_check\" type. Quote the key code (enum members, schema definitions, model columns) with file:line references. Be exhaustive — this is the core of the implementation."}

{"command":"find /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat -type f -name \"*.ts\" -o -name \"*.js\" -o -name \"*.json\" | head -50"}

/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.cursor/environment.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/knip.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/k8s/sherpa-api.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/k8s/package-lock.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/k8s/package.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/k8s/synth.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.mcp.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.claude/settings.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.claude/settings.local.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/docs/test-policies-data.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/package-lock.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/package.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/scripts/extract-product-labels.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/scripts/check-migration-tenant-rls.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.github/scripts/validate-deployment.js
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/tsconfig.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/lib.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.vscode/settings.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.vscode/extensions.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/helpers/generate-single-secret.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/generated/locales.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/common-labels.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/locales/es_419.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/locales/nl.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/locales/de.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/locales/fi.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/locales/it.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/locales/fr.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/locales/id.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/locales/pt_BR.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/locales/no.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/locales/da.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/locales/sv.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/cache.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/keys.json
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/config.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/translations/runtime-strings.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/types/dateConstraints.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/types/contracts.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/types/permissions.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/types/postcss-prefix-selector.d.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/types/pricing.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/types/templates.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/types/coverage-pricing.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/types/displayConditions.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/types/trail.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/types/rbac.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/types/calculation.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/types/fastify.ts

{"command":"ls -la /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/ | head -30"}

total 112
drwxr-xr-x@  30 bakker  staff    960 May 31 14:20 .
drwxr-xr-x@  45 bakker  staff   1440 May 31 14:21 ..
-rw-r--r--@   1 bakker  staff   7913 May 31 14:20 AGENTS.md
drwxr-xr-x@   5 bakker  staff    160 May 31 14:20 app
-rw-r--r--@   1 bakker  staff   5918 May 31 14:20 app.ts
drwxr-xr-x@   4 bakker  staff    128 May 31 14:20 config
drwxr-xr-x@   3 bakker  staff     96 May 31 14:20 constants
drwxr-xr-x@  75 bakker  staff   2400 May 31 14:20 controllers
drwxr-xr-x@   7 bakker  staff    224 May 31 14:20 db
drwxr-xr-x@  10 bakker  staff    320 May 31 14:20 domains
drwxr-xr-x@   4 bakker  staff    128 May 31 14:20 error
drwxr-xr-x@   6 bakker  staff    192 May 31 14:20 financials
drwxr-xr-x@   8 bakker  staff    256 May 31 14:20 integrations
-rw-r--r--@   1 bakker  staff    132 May 31 14:20 lifecycle.ts
-rw-r--r--@   1 bakker  staff   2625 May 31 14:20 logger.ts
drwxr-xr-x@ 119 bakker  staff   3808 May 31 14:20 models
-rw-r--r--@   1 bakker  staff   3616 May 31 14:20 persistentValkeyClient.ts
drwxr-xr-x@   9 bakker  staff    288 May 31 14:20 plugins
drwxr-xr-x@  36 bakker  staff   1152 May 31 14:20 routes
-rw-r--r--@   1 bakker  staff  19850 May 31 14:20 routes.ts
drwxr-xr-x@  21 bakker  staff    672 May 31 14:20 schemas
drwxr-xr-x@   9 bakker  staff    288 May 31 14:20 scripts
-rw-r--r--@   1 bakker  staff   3672 May 31 14:20 service.ts
drwxr-xr-x@  86 bakker  staff   2752 May 31 14:20 services
drwxr-xr-x@   7 bakker  staff    224 May 31 14:20 test
drwxr-xr-x@   5 bakker  staff    160 May 31 14:20 trail
drwxr-xr-x@  19 bakker  staff    608 May 31 14:20 types
drwxr-xr-x@  29 bakker  staff    928 May 31 14:20 utils
-rw-r--r--@   1 bakker  staff   3286 May 31 14:20 valkeyClient.ts

{"pattern":"sanction|compliance|kyc|fraud|screening|checkType|check_type|OpenSanctions","path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src","head_limit":0}

Found 63 files
sherpa-api-api-458-credit-check-compliance-integrat/src/utils/test/sanctionScreeningVisibility.test.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/utils/sanctionScreeningVisibility.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/test/drift.apitest.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/services/sanctionScreeningService.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/services/policyStatusService.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/services/policyRenewalService.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/services/policyIssuanceService.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/services/jobs/sanctionScreeningJob.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/services/jobs/index.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/services/complianceMessageService.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/services/claimRuleEvaluation.test.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/services/claimDocumentIntelligenceService.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/product/Product.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/org/Organization.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/integration/ExternalIntegrationRequestTemplate.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/integration/ExternalIntegrationEnvironment.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/integration/ExternalIntegrationCallLog.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/integration/ExternalIntegration.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/index.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/compliance/ComplianceCheck.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/policy.schemas.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/plus/product.schemas.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/routes/plus/sanctionScreeningRoutes.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/routes/plus/index.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/routes/plus/externalIntegrationsRoutes.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_Product.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_PolicyOrder.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_OrganizationPolicyStatus.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationCallLog.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegration.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ComplianceCheck.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/domains/payments/service.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/domains/payments/interface.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/domains/lens/flows/wasm/support.js
sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/test/runCheck.test.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/test/mapping.test.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runtime/fieldMappings.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runner.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/capabilities/runCheck.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/capabilities/registry.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/auth/strategy.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.08.add-compliance-blocked-lifecycle.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.07.add-integration-invocation-mode.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.06.add-compliance-pending-lifecycle.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.05.normalize-compliance-operation.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.04.rename-field-mappings-to-parties.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.03.add-claim-customer-and-extended-triggers.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.02.rename-sanction-screenings-to-compliance-checks.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.01.rename-screening-configuration-to-compliance-checks.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.14T00.00.11.create-external-integration-field-mappings.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.14T00.00.08.add-disable-sanction-screening-to-organizations.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.14T00.00.07.add-screening-config-to-products.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.14T00.00.06.create-sanction-screenings.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.14T00.00.04.create-external-integration-call-logs.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.14T00.00.01.create-external-integrations.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.03.15T00.00.01.create-employment-and-risk-screening-categories.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/db/AGENTS.md
sherpa-api-api-458-credit-check-compliance-integrat/src/controllers/sanctionScreeningController.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/controllers/productController.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/controllers/policyOrderController.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/controllers/externalIntegrationController.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/controllers/claimController.ts
sherpa-api-api-458-credit-check-compliance-integrat/src/controllers/bundlePolicyController.ts

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/compliance/ComplianceCheck.ts"}

1	import { Type, type Static } from '@sinclair/typebox';
2	import {
3	  Uuid,
4	  IsoDateTime,
5	  NullableUuid,
6	  NullableString,
7	  NullableIsoDateTime,
8	} from '../_helpers.js';
9	
10	export const ComplianceCheckPublicFields = [
11	  'id',
12	  'organizationId',
13	  'productId',
14	  'integrationId',
15	  'capability',
16	  'triggerType',
17	  'previousPolicyId',
18	  'rootPolicyId',
19	  'policyOrderId',
20	  'claimRecordId',
21	  'customerId',
22	  'issuanceContext',
23	  'screenedParties',
24	  'status',
25	  'outcome',
26	  'manualDecision',
27	  'manualDecisionBy',
28	  'manualDecisionAt',
29	  'manualDecisionNote',
30	  'findings',
31	  'rawResponse',
32	  'error',
33	  'correlationId',
34	  'createdAt',
35	  'updatedAt',
36	] as const;
37	
38	export const ComplianceCheckPrivateFields = [] as const;
39	
40	const ScreenedPartySchema = Type.Object(
41	  {
42	    role: Type.Union([
43	      Type.Literal('policyholder'),
44	      Type.Literal('insured'),
45	      Type.Literal('beneficiary'),
46	    ]),
47	    sourcePath: Type.String({
48	      description:
49	        'Policy/claim parameter path the party object was read from (e.g. "personal", "insureds.0").',
50	    }),
51	    data: Type.Object(
52	      {},
53	      {
54	        additionalProperties: true,
55	        description:
56	          'Raw DataModelField object forwarded to the provider. Field shape is open — every key on the source category is included verbatim.',
57	      },
58	    ),
59	  },
60	  { additionalProperties: true, description: 'A party sent to the compliance provider.' },
61	);
62	
63	const PartyCheckFindingSchema = Type.Object(
64	  {
65	    entityId: Type.String({ description: 'Provider-specific entity identifier.' }),
66	    entityName: Type.String(),
67	    score: Type.Number({ minimum: 0, maximum: 1 }),
68	    topics: Type.Array(Type.String()),
69	    datasets: Type.Array(Type.String()),
70	    sourceUrl: NullableString(),
71	  },
72	  {
73	    additionalProperties: true,
74	    description: 'Normalised match from the provider after response mapping.',
75	  },
76	);
77	
78	export const ComplianceCheckSchema = Type.Object(
79	  {
80	    id: Uuid({ description: 'Screening UUID.' }),
81	    organizationId: Uuid(),
82	    productId: Type.Integer({ description: 'Product the screening is associated with.' }),
83	    integrationId: Uuid({ description: 'Which ExternalIntegration produced this check.' }),
84	    capability: Type.String({ description: 'Capability that produced this row (sanction_screening, kyc, fraud_detection, ...).' }),
85	    triggerType: Type.Union([
86	      Type.Literal('NEW_BUSINESS'),
87	      Type.Literal('RENEWAL'),
88	      Type.Literal('ENDORSEMENT'),
89	      Type.Literal('CLAIM'),
90	      Type.Literal('MANUAL'),
91	    ]),
92	    previousPolicyId: NullableUuid({ description: 'Specific prior policy version being renewed.' }),
93	    rootPolicyId: NullableUuid({ description: 'Root policy family.' }),
94	    policyOrderId: NullableUuid({ description: 'PolicyOrder created from this check, when applicable.' }),
95	    claimRecordId: NullableUuid({ description: 'ClaimRecord this check is attached to (CLAIM trigger).' }),
96	    customerId: NullableUuid({ description: 'Customer this check is attached to (MANUAL trigger).' }),
97	    issuanceContext: Type.Object(
98	      {},
99	      {
100	        additionalProperties: true,
101	        description:
102	          'Snapshot of everything needed to resume PolicyOrder creation after screening clears.',
103	      },
104	    ),
105	    screenedParties: Type.Array(ScreenedPartySchema),
106	    status: Type.Union(
107	      [
108	        Type.Literal('pending'),
109	        Type.Literal('processing'),
110	        Type.Literal('completed'),
111	        Type.Literal('failed'),
112	      ],
113	      { description: 'Job lifecycle state.' },
114	    ),
115	    outcome: Type.Union(
116	      [
117	        Type.Null(),
118	        Type.Literal('pass'),
119	        Type.Literal('fail'),
120	        Type.Literal('review'),
121	      ],
122	      { description: 'Final outcome once status=completed; null otherwise.' },
123	    ),
124	    manualDecision: Type.Union(
125	      [Type.Null(), Type.Literal('approved'), Type.Literal('rejected')],
126	      { description: 'Manual decision for fail/review outcomes.' },
127	    ),
128	    manualDecisionBy: NullableUuid({ description: 'User who recorded the manual decision.' }),
129	    manualDecisionAt: NullableIsoDateTime(),
130	    manualDecisionNote: NullableString({ description: 'Free-text rationale for the decision.' }),
131	    findings: Type.Union([Type.Null(), Type.Array(PartyCheckFindingSchema)], {
132	      description: 'Provider matches after normalisation; null until completed.',
133	    }),
134	    rawResponse: Type.Union([Type.Null(), Type.Any()], {
135	      description:
136	        'Raw provider response. Stripped from customer responses; visible to CRM only.',
137	    }),
138	    error: NullableString({ description: 'Final error message when status=failed.' }),
139	    correlationId: NullableString({ description: 'Correlation ID linking this screening to its outbound calls.' }),
140	    createdAt: IsoDateTime(),
141	    updatedAt: IsoDateTime(),
142	  },
143	  {
144	    $id: 'ComplianceCheck',
145	    additionalProperties: true,
146	    description:
147	      'Per-issuance compliance check record. Created at the start of new-business or renewal issuance; gates downstream PolicyOrder creation.',
148	  },
149	);
150	
151	export type ComplianceCheck = Static<typeof ComplianceCheckSchema>;
152	

{"description":"Map compliance UI framework (portal)","subagent_type":"Explore","prompt":"Explore the sherpa-portal worktree at /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat very thoroughly. I'm adding a new \"credit_check\" compliance check type to the portal UI and need a complete map of the existing **compliance tab** and **external-API-integration builder** UI.\n\nFind and report, with exact file paths and line numbers:\n1. The compliance tab / compliance section UI — where compliance check types (sanctions, kyc, fraud) are listed, selected, and configured per product/organization/outlet. Search \"compliance\", \"sanction\", \"kyc\", \"fraud\", \"screening\", \"checkType\".\n2. The provider selector UI (e.g. OpenSanctions provider selection) and the external-API-integration builder component (auth config form, AI-assisted outgoing/incoming field mapping UI). Search \"provider\", \"integration\", \"fieldMapping\", \"mapping\", \"externalApi\", \"AI mapping\".\n3. Trigger-event configuration UI (new business / renewal / endorsement / claim) and outcome-handling UI (auto-approve / review / auto-deny / manual override). Search \"trigger\", \"outcome\", \"auto-approve\", \"review\", \"override\".\n4. Where compliance RESULTS (score/decision) are surfaced in the UI — the policy/claim detail compliance section, and any notifications. Search \"compliance result\", \"score\", \"decision\", \"notification\".\n5. The API client calls the compliance UI makes (which endpoints), the TypeScript types/interfaces for compliance config and results, and how check-type labels/options are defined (data-driven lookups per the No-Hardcoded-Labels rule).\n6. The exact files/components I'd touch to add \"credit_check\" as a new selectable check type with the same UX as sanctions.\n\nReport the full picture with file:line references and quote the key code (the check-type option list, the provider selector, the mapping builder component, the results display). Be exhaustive — I need to replicate the sanctions UX for credit_check."}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ComplianceCheck.ts"}

1	import { Table, Column, Model, DataType, ForeignKey, BelongsTo } from 'sequelize-typescript';
2	import { Organization } from '../Organization.js';
3	import { _Product } from './_Product.js';
4	import { _ExternalIntegration } from './_ExternalIntegration.js';
5	
6	export type ComplianceCheckTriggerType =
7	  | 'NEW_BUSINESS'
8	  | 'RENEWAL'
9	  | 'ENDORSEMENT'
10	  | 'CLAIM'
11	  | 'MANUAL';
12	export type ComplianceCheckStatus = 'pending' | 'processing' | 'completed' | 'failed';
13	export type ComplianceCheckOutcome = 'pass' | 'fail' | 'review';
14	export type ComplianceCheckManualDecision = 'approved' | 'rejected';
15	
16	/** One party sent to the compliance provider. `data` is the raw
17	 * DataModelField object (e.g. `personal` → `{firstName, lastName, birthDate,
18	 * idType, idNumber, ...}`); integrations pick what they need via outbound
19	 * field mappings. `sourcePath` is the policy-parameter path the data came
20	 * from, used for audit + UI traceback. */
21	export interface ScreenedParty {
22	  role: 'policyholder' | 'insured' | 'beneficiary';
23	  sourcePath: string;
24	  data: Record<string, unknown>;
25	}
26	
27	/** Normalised match returned by the provider after the runner applies its
28	 * inbound field mappings. Score 0-1 + topics drive outcomeRules bucketing.
29	 * Topic vocabulary is per-capability ('sanction' for screening, 'kyc.failed'
30	 * for KYC, 'fraud.high_risk' for fraud, ...). */
31	export interface ComplianceFinding {
32	  entityId: string;
33	  entityName: string;
34	  score: number;
35	  topics: string[];
36	  datasets: string[];
37	  sourceUrl: string | null;
38	}
39	
40	@Table({
41	  modelName: 'ComplianceCheck',
42	  tableName: 'ComplianceChecks',
43	  timestamps: true,
44	  indexes: [
45	    {
46	      fields: ['organizationId', 'capability', 'status', 'outcome', 'manualDecision'],
47	      name: 'idx_compliance_checks_org_capability_status',
48	    },
49	    {
50	      fields: ['rootPolicyId', 'createdAt'],
51	      name: 'idx_compliance_checks_root_policy_created',
52	    },
53	    {
54	      fields: ['previousPolicyId'],
55	      name: 'idx_compliance_checks_previous_policy_id',
56	    },
57	    {
58	      fields: ['policyOrderId'],
59	      name: 'idx_compliance_checks_policy_order_id',
60	    },
61	  ],
62	})
63	export class _ComplianceCheck extends Model {
64	  @Column({ type: DataType.UUID, defaultValue: DataType.UUIDV4, primaryKey: true })
65	  declare id: string;
66	
67	  @ForeignKey(() => Organization)
68	  @Column({ type: DataType.UUID, allowNull: false })
69	  declare organizationId: string;
70	
71	  @ForeignKey(() => _Product)
72	  @Column({ type: DataType.INTEGER, allowNull: false })
73	  declare productId: number;
74	
75	  @ForeignKey(() => _ExternalIntegration)
76	  @Column({ type: DataType.UUID, allowNull: false })
77	  declare integrationId: string;
78	
79	  /** Capability that produced this row (e.g. 'sanction_screening', 'kyc',
80	   * 'fraud_detection'). Matches the integration's capability and the key
81	   * under product.complianceChecks. */
82	  @Column({ type: DataType.STRING(50), allowNull: false, defaultValue: 'sanction_screening' })
83	  declare capability: string;
84	
85	  @Column({
86	    type: DataType.ENUM('NEW_BUSINESS', 'RENEWAL', 'ENDORSEMENT', 'CLAIM', 'MANUAL'),
87	    allowNull: false,
88	  })
89	  declare triggerType: ComplianceCheckTriggerType;
90	
91	  @Column({ type: DataType.UUID, allowNull: true })
92	  declare previousPolicyId: string | null;
93	
94	  @Column({ type: DataType.UUID, allowNull: true })
95	  declare rootPolicyId: string | null;
96	
97	  @Column({ type: DataType.UUID, allowNull: true })
98	  declare policyOrderId: string | null;
99	
100	  @Column({ type: DataType.UUID, allowNull: true })
101	  declare claimRecordId: string | null;
102	
103	  @Column({ type: DataType.UUID, allowNull: true })
104	  declare customerId: string | null;
105	
106	  @Column({ type: DataType.JSONB, allowNull: false })
107	  declare issuanceContext: Record<string, unknown>;
108	
109	  @Column({ type: DataType.JSONB, allowNull: false })
110	  declare screenedParties: ScreenedParty[];
111	
112	  @Column({
113	    type: DataType.ENUM('pending', 'processing', 'completed', 'failed'),
114	    allowNull: false,
115	    defaultValue: 'pending',
116	  })
117	  declare status: ComplianceCheckStatus;
118	
119	  @Column({ type: DataType.ENUM('pass', 'fail', 'review'), allowNull: true })
120	  declare outcome: ComplianceCheckOutcome | null;
121	
122	  @Column({ type: DataType.ENUM('approved', 'rejected'), allowNull: true })
123	  declare manualDecision: ComplianceCheckManualDecision | null;
124	
125	  @Column({ type: DataType.UUID, allowNull: true })
126	  declare manualDecisionBy: string | null;
127	
128	  @Column({ type: DataType.DATE, allowNull: true })
129	  declare manualDecisionAt: Date | null;
130	
131	  @Column({ type: DataType.TEXT, allowNull: true })
132	  declare manualDecisionNote: string | null;
133	
134	  @Column({ type: DataType.JSONB, allowNull: true })
135	  declare findings: ComplianceFinding[] | null;
136	
137	  @Column({ type: DataType.JSONB, allowNull: true })
138	  declare rawResponse: unknown | null;
139	
140	  @Column({ type: DataType.TEXT, allowNull: true })
141	  declare error: string | null;
142	
143	  @Column({ type: DataType.STRING(100), allowNull: true })
144	  declare correlationId: string | null;
145	
146	  @Column({ type: DataType.DATE, allowNull: false })
147	  declare createdAt: Date;
148	
149	  @Column({ type: DataType.DATE, allowNull: false })
150	  declare updatedAt: Date;
151	
152	  @BelongsTo(() => Organization, { foreignKey: 'organizationId', as: 'organization' })
153	  declare organization?: Organization;
154	
155	  @BelongsTo(() => _ExternalIntegration, { foreignKey: 'integrationId', as: 'integration' })
156	  declare integration?: _ExternalIntegration;
157	}
158	

{"command":"find /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat -type f -name \"*.tsx\" -o -name \"*.ts\" | head -30"}

/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/customers/[id]/page.tsx
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/customers/page.tsx
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/settings/page.tsx
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/policyStatus.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/claimRule.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/dateConstraints.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/cancellationTerm.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/navigation.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/insurer.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/suspensionTerm.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/product.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/contracts.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/template.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/permissions.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/parameters.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/pricing.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/widgetToken.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/claim.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/displayConditions.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/auditLog.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/paymentProvider.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/dataModel.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/policy.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/acceptance.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/quote.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/coveragePricing.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/financials.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/organization.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/user.ts

{"pattern":"compliance|sanction|kyc|fraud|screening|checkType","path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat","output_mode":"files_with_matches"}

{"pattern":"**/compliance*.{ts,tsx}","path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat"}

{"pattern":"**/provider*.{ts,tsx}","path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat"}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.02.rename-sanction-screenings-to-compliance-checks.ts"}

Found 40 files
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/sv.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/pt_BR.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/no.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/nl.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/it.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/id.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/fr.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/fi.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/es_419.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/de.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/da.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/keys.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/cache.json
sherpa-portal-api-458-credit-check-compliance-integrat/example/salida.json
sherpa-portal-api-458-credit-check-compliance-integrat/example/salida.html
sherpa-portal-api-458-credit-check-compliance-integrat/app/types/product.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/repairs/[deviceTypeId]/[defectId]/analysis/page.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/repairs/[deviceTypeId]/[defectId]/agent/page.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/repairs/screenInspection.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/repairs/damageInspection.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/purchaseProbability.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/externalIntegrationSmartSetup.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/externalIntegrationSmartImport.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/policy-management/screening/page.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/policy-management/policies/[policyId]/page.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/policy-management/claims/[claimId]/page.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/embed-customer-portal/templates/oyika/Coverage.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/constants/purchaseProbability.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/settings/GeneralTab.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/screening/SanctionScreeningPanel.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/policy-management/PolicyManagementShell.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/mcp/McpGuidance.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/compliance/ComplianceChecksSection.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/parsers.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/SmartSetupModal.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/EnvironmentsTab.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/IntegrationsTab.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/AppLayout.tsx

1	import { QueryInterface, DataTypes } from 'sequelize';
2	import type { MigrationFn } from 'umzug';
3	
4	/**
5	 * Rename SanctionScreenings → ComplianceChecks. The table holds rows for
6	 * any compliance-check capability (KYC, fraud, AML, identity verification)
7	 * — sanction screening was just the first.
8	 *
9	 * Adds a `capability` column so each row knows which capability produced
10	 * it. Existing rows get 'sanction_screening' as the default.
11	 *
12	 * Postgres carries RLS policies + foreign keys through ALTER TABLE RENAME,
13	 * so the existing tenant_isolation policy + indexes track the new table
14	 * name. Enum types and indexes are renamed explicitly for legibility.
15	 */
16	export const up: MigrationFn<QueryInterface> = async ({ context }) => {
17	  await context.sequelize.query(`ALTER TABLE "SanctionScreenings" RENAME TO "ComplianceChecks"`);
18	
19	  // Add the capability column. Backfill existing rows then enforce NOT NULL.
20	  await context.addColumn('ComplianceChecks', 'capability', {
21	    type: DataTypes.STRING(50),
22	    allowNull: true,
23	  });
24	  await context.sequelize.query(
25	    `UPDATE "ComplianceChecks" SET "capability" = 'sanction_screening' WHERE "capability" IS NULL`,
26	  );
27	  await context.sequelize.query(
28	    `ALTER TABLE "ComplianceChecks" ALTER COLUMN "capability" SET NOT NULL`,
29	  );
30	  await context.sequelize.query(
31	    `ALTER TABLE "ComplianceChecks" ALTER COLUMN "capability" SET DEFAULT 'sanction_screening'`,
32	  );
33	
34	  await context.addIndex('ComplianceChecks', {
35	    fields: ['organizationId', 'capability', 'status', 'outcome', 'manualDecision'],
36	    name: 'idx_compliance_checks_org_capability_status',
37	  });
38	
39	  // Rename enum types so future migrations + introspection are consistent.
40	  await context.sequelize.query(
41	    `ALTER TYPE "enum_SanctionScreenings_triggerType" RENAME TO "enum_ComplianceChecks_triggerType"`,
42	  );
43	  await context.sequelize.query(
44	    `ALTER TYPE "enum_SanctionScreenings_status" RENAME TO "enum_ComplianceChecks_status"`,
45	  );
46	  await context.sequelize.query(
47	    `ALTER TYPE "enum_SanctionScreenings_outcome" RENAME TO "enum_ComplianceChecks_outcome"`,
48	  );
49	  await context.sequelize.query(
50	    `ALTER TYPE "enum_SanctionScreenings_manualDecision" RENAME TO "enum_ComplianceChecks_manualDecision"`,
51	  );
52	
53	  // Rename indexes that carry the old table name.
54	  await context.sequelize.query(
55	    `ALTER INDEX IF EXISTS "idx_sanction_screenings_org_status_outcome" RENAME TO "idx_compliance_checks_org_status_outcome"`,
56	  );
57	  await context.sequelize.query(
58	    `ALTER INDEX IF EXISTS "idx_sanction_screenings_root_policy_created" RENAME TO "idx_compliance_checks_root_policy_created"`,
59	  );
60	  await context.sequelize.query(
61	    `ALTER INDEX IF EXISTS "idx_sanction_screenings_previous_policy_id" RENAME TO "idx_compliance_checks_previous_policy_id"`,
62	  );
63	  await context.sequelize.query(
64	    `ALTER INDEX IF EXISTS "idx_sanction_screenings_policy_order_id" RENAME TO "idx_compliance_checks_policy_order_id"`,
65	  );
66	
67	  // RLS policies move with the table in Postgres, but the grant doesn't —
68	  // re-issue dashboard_user SELECT on the renamed object.
69	  await context.sequelize.query(`GRANT SELECT ON "ComplianceChecks" TO dashboard_user`);
70	};
71	
72	export const down: MigrationFn<QueryInterface> = async () => {
73	  // Forward-only deployment
74	};
75	

sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/fast-glob/out/providers/provider.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/knip/node_modules/fast-glob/out/providers/provider.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@ai-sdk/provider-utils/src/types/provider-options.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@ai-sdk/provider-utils/src/provider-tool-factory.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@ai-sdk/provider/src/provider/v2/provider-v2.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@ai-sdk/provider/src/provider/v3/provider-v3.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/ai/src/types/provider-metadata.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/ai/src/registry/provider-registry.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/ai/src/types/provider.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@assistant-ui/core/dist/model-context/frame/provider.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@assistant-ui/core/src/model-context/frame/provider.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/core/build/types-ts3.8/utils/ai/providerSkip.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/core/build/types/utils/ai/providerSkip.d.ts

No files found

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/compliance/ComplianceChecksSection.tsx"}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.01.rename-screening-configuration-to-compliance-checks.ts"}

1	import { QueryInterface } from 'sequelize';
2	import type { MigrationFn } from 'umzug';
3	
4	/**
5	 * Generalise per-product compliance configuration. `screeningConfiguration`
6	 * was single-purpose (sanction screening only). Reshape into `complianceChecks`
7	 * — an object keyed by capability — so KYC, fraud, AML, etc. can live
8	 * alongside sanction screening without column proliferation.
9	 *
10	 *   before: {enabled, integrationId, fieldMappings, outcomeRules} | null
11	 *   after:  {sanction_screening: {enabled, integrationId, fieldMappings, outcomeRules}, ...} | null
12	 *
13	 * Existing rows keep their data under the `sanction_screening` key.
14	 */
15	export const up: MigrationFn<QueryInterface> = async ({ context }) => {
16	  await context.sequelize.query(
17	    `ALTER TABLE "Products" RENAME COLUMN "screeningConfiguration" TO "complianceChecks"`,
18	  );
19	  await context.sequelize.query(`
20	    UPDATE "Products"
21	    SET "complianceChecks" = jsonb_build_object('sanction_screening', "complianceChecks")
22	    WHERE "complianceChecks" IS NOT NULL
23	  `);
24	};
25	
26	export const down: MigrationFn<QueryInterface> = async () => {
27	  // Forward-only deployment
28	};
29	

1	"use client";
2	
3	import React, { useCallback, useEffect, useState } from "react";
4	
5	import {
6	  ShieldAlert,
7	  ShieldCheck,
8	  ShieldX,
9	  Loader2,
10	  ChevronDown,
11	} from "lucide-react";
12	
13	import SanctionScreeningPanel from "@/app/components/screening/SanctionScreeningPanel";
14	import api from "@/app/src/utils/api";
15	import { usePermission } from "@/app/src/hooks/usePermission";
16	import type { SanctionScreening, SanctionScreeningOutcome, SanctionScreeningStatus } from "@/app/types/admin";
17	import { PERMISSIONS } from "@/app/types/permissions";
18	import { useLMT } from "@/lib/lmt/config";
19	
20	interface ListResponse {
21	  status: "success" | "error";
22	  data?: SanctionScreening[];
23	}
24	
25	interface ComplianceChecksSectionProps {
26	  /** Pass policyId (the policy UUID stored on ComplianceCheck.policyOrderId) to scope
27	   * to a policy issuance flow; pass claimRecordId to scope to a Claim. */
28	  policyId?: string;
29	  claimRecordId?: string;
30	  /** Fired after any check is updated (decision recorded, rerun, etc.) so the
31	   *  parent page can refetch the policy/claim whose status may have changed. */
32	  onChanged?: () => void;
33	}
34	
35	function badgeClass(status: SanctionScreeningStatus, outcome: SanctionScreeningOutcome | null): string {
36	  if (outcome === "pass") return "bg-emerald-50 text-emerald-700 border-emerald-200";
37	  if (outcome === "review") return "bg-amber-50 text-amber-700 border-amber-200";
38	  if (outcome === "fail") return "bg-red-50 text-red-700 border-red-200";
39	  if (status === "processing") return "bg-blue-50 text-blue-700 border-blue-200";
40	  if (status === "pending") return "bg-gray-50 text-gray-700 border-gray-200";
41	  if (status === "failed") return "bg-red-50 text-red-700 border-red-200";
42	  return "bg-gray-50 text-gray-700 border-gray-200";
43	}
44	
45	type BadgeLabelKey =
46	  | "approved"
47	  | "rejected"
48	  | "pass"
49	  | "fail"
50	  | "review"
51	  | "processing"
52	  | "pending"
53	  | "error";
54	
55	function badgeLabelKey(row: SanctionScreening): BadgeLabelKey {
56	  if (row.manualDecision === "approved") return "approved";
57	  if (row.manualDecision === "rejected") return "rejected";
58	  if (row.outcome === "pass") return "pass";
59	  if (row.outcome === "fail") return "fail";
60	  if (row.outcome === "review") return "review";
61	  if (row.status === "processing") return "processing";
62	  if (row.status === "pending") return "pending";
63	  return "error";
64	}
65	
66	
67	const ComplianceChecksSection: React.FC<ComplianceChecksSectionProps> = ({
68	  policyId,
69	  claimRecordId,
70	  onChanged,
71	}) => {
72	  const { t } = useLMT();
73	  // lmt-translate requires literal arguments. Map known capabilities to literal
74	  // calls; unknown ones fall back to the raw slug.
75	  const capabilityLabel = (capability: string | undefined): string => {
76	    switch (capability) {
77	      case "sanction_screening":
78	        return t("Sanction Screening");
79	      case "pep":
80	        return t("PEP");
81	      case "kyc":
82	        return t("KYC");
83	      case "adverse_media":
84	        return t("Adverse Media");
85	      case "fraud_detection":
86	        return t("Fraud Detection");
87	      case undefined:
88	      case "":
89	        return t("Compliance");
90	      default:
91	        return capability;
92	    }
93	  };
94	  const badgeLabel = (row: SanctionScreening): string => {
95	    switch (badgeLabelKey(row)) {
96	      case "approved":
97	        return t("approved");
98	      case "rejected":
99	        return t("rejected");
100	      case "pass":
101	        return t("pass");
102	      case "fail":
103	        return t("fail");
104	      case "review":
105	        return t("review");
106	      case "processing":
107	        return t("processing");
108	      case "pending":
109	        return t("pending");
110	      case "error":
111	        return t("error");
112	    }
113	  };
114	  const canDecide = usePermission(PERMISSIONS.integrations.update.value);
115	  const [rows, setRows] = useState<SanctionScreening[]>([]);
116	  const [loading, setLoading] = useState(false);
117	  const [error, setError] = useState("");
118	  const [expanded, setExpanded] = useState<Record<string, boolean>>({});
119	
120	  const load = useCallback(async () => {
121	    if (!policyId && !claimRecordId) return;
122	    try {
123	      setLoading(true);
124	      setError("");
125	      const params: Record<string, unknown> = { limit: 50 };
126	      if (claimRecordId) params.claimRecordId = claimRecordId;
127	      // Policy UUID is stored on ComplianceCheck.policyOrderId (legacy column name).
128	      if (policyId) params.policyOrderId = policyId;
129	      const res = await api.get<ListResponse>("/sanction-screenings", { params });
130	      setRows(res.data.data ?? []);
131	    } catch {
132	      setError(t("Failed to load compliance checks"));
133	    } finally {
134	      setLoading(false);
135	    }
136	  }, [policyId, claimRecordId, t]);
137	
138	  useEffect(() => {
139	    void load();
140	  }, [load]);
141	
142	  if (!policyId && !claimRecordId) return null;
143	  if (!loading && rows.length === 0 && !error) return null;
144	
145	  return (
146	    <div className="rounded-lg border border-gray-200 bg-white shadow-sm">
147	      <div className="rounded-t-lg border-b border-gray-100 bg-gradient-to-r from-gray-50 to-white p-4">
148	        <div className="flex items-center gap-2">
149	          <ShieldCheck className="h-5 w-5 text-gray-700" />
150	          <h2 className="text-lg font-medium text-gray-900">{t("Compliance")}</h2>
151	          {rows.length > 0 && (
152	            <span className="ml-2 rounded-full bg-gray-100 px-2 py-0.5 text-xs text-gray-700">
153	              {rows.length}
154	            </span>
155	          )}
156	        </div>
157	      </div>
158	
159	      <div className="space-y-2 p-4">
160	        {loading && rows.length === 0 && (
161	          <div className="flex items-center gap-2 text-sm text-gray-600">
162	            <Loader2 className="h-4 w-4 animate-spin" />
163	            {t("Loading...")}
164	          </div>
165	        )}
166	        {error && (
167	          <div className="rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700">
168	            {error}
169	          </div>
170	        )}
171	        {rows.map((row) => {
172	          const isOpen = !!expanded[row.id];
173	          const Icon = row.outcome === "pass" || row.manualDecision === "approved"
174	            ? ShieldCheck
175	            : row.outcome === "fail" || row.manualDecision === "rejected"
176	              ? ShieldX
177	              : ShieldAlert;
178	          return (
179	            <div key={row.id} className="overflow-hidden rounded-md border border-gray-200">
180	              <button
181	                type="button"
182	                onClick={() => setExpanded((prev) => ({ ...prev, [row.id]: !prev[row.id] }))}
183	                className="flex w-full items-center justify-between px-3 py-2 text-left hover:bg-gray-50"
184	              >
185	                <div className="flex items-center gap-2">
186	                  <Icon className="h-4 w-4 text-gray-700" />
187	                  <span className="text-sm font-medium text-gray-900">
188	                    {capabilityLabel(row.capability)}
189	                  </span>
190	                  <span className="text-[10px] uppercase tracking-wide text-gray-400">
191	                    {row.triggerType}
192	                  </span>
193	                </div>
194	                <div className="flex items-center gap-2 text-xs">
195	                  <span
196	                    className={`inline-flex items-center rounded-full border px-2 py-0.5 font-medium ${badgeClass(
197	                      row.status,
198	                      row.outcome,
199	                    )}`}
200	                  >
201	                    {badgeLabel(row)}
202	     

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx"}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/screening/SanctionScreeningPanel.tsx"}

1	"use client";
2	
3	import React, { useCallback, useEffect, useRef, useState } from "react";
4	
5	import {
6	  ShieldAlert,
7	  ShieldCheck,
8	  ShieldX,
9	  Loader2,
10	  CheckCircle2,
11	  XCircle,
12	  Clock,
13	  ChevronDown,
14	  ChevronRight,
15	  Copy,
16	  Paperclip,
17	  X,
18	  MessageSquare,
19	} from "lucide-react";
20	
21	import { Button } from "@/app/components/ui/button";
22	import {
23	  Dialog,
24	  DialogContent,
25	  DialogFooter,
26	  DialogHeader,
27	  DialogTitle,
28	} from "@/app/components/ui/dialog";
29	import { Textarea } from "@/app/components/ui/textarea";
30	import api from "@/app/src/utils/api";
31	import type {
32	  SanctionScreening,
33	  SanctionScreeningOutcome,
34	  SanctionScreeningStatus,
35	} from "@/app/types/admin";
36	import { useLMT } from "@/lib/lmt/config";
37	
38	interface ScreeningResponse {
39	  status: "success" | "error";
40	  data?: SanctionScreening;
41	}
42	
43	interface SanctionScreeningPanelProps {
44	  screeningId: string;
45	  canDecide?: boolean;
46	  /** Fired on every load (initial mount + refresh). Use for read-only mirroring. */
47	  onUpdated?: (row: SanctionScreening) => void;
48	  /** Fired only after a user-driven mutation (decision/rerun). Use to refresh
49	   *  upstream views without triggering an unmount-remount on accordion expand. */
50	  onMutated?: (row: SanctionScreening | null) => void;
51	}
52	
53	function statusBadgeClass(status: SanctionScreeningStatus): string {
54	  if (status === "completed") return "bg-green-50 text-green-700 border-green-200";
55	  if (status === "processing") return "bg-blue-50 text-blue-700 border-blue-200";
56	  if (status === "pending") return "bg-amber-50 text-amber-700 border-amber-200";
57	  return "bg-red-50 text-red-700 border-red-200";
58	}
59	
60	function outcomeBadgeClass(outcome: SanctionScreeningOutcome | null): string {
61	  if (outcome === "pass") return "bg-green-50 text-green-700 border-green-200";
62	  if (outcome === "review") return "bg-orange-50 text-orange-700 border-orange-200";
63	  if (outcome === "fail") return "bg-red-50 text-red-700 border-red-200";
64	  return "bg-gray-50 text-gray-600 border-gray-200";
65	}
66	
67	function partyDisplayName(data: Record<string, unknown>): string {
68	  const first = typeof data.firstName === "string" ? data.firstName : "";
69	  const last = typeof data.lastName === "string" ? data.lastName : "";
70	  const full = `${first} ${last}`.trim();
71	  if (full) return full;
72	  if (typeof data.companyName === "string") return data.companyName;
73	  if (typeof data.name === "string") return data.name;
74	  if (typeof data.email === "string") return data.email;
75	  return "(unnamed)";
76	}
77	
78	const SanctionScreeningPanel: React.FC<SanctionScreeningPanelProps> = ({
79	  screeningId,
80	  canDecide,
81	  onUpdated,
82	  onMutated,
83	}) => {
84	  const { t } = useLMT();
85	  // lmt-translate requires literal arguments; map known capability ids to
86	  // literal calls and fall back to the raw slug for unknown ones.
87	  const capabilityLabel = (capability: string | undefined): string => {
88	    switch (capability) {
89	      case "sanction_screening":
90	        return t("Sanction Screening");
91	      case "pep":
92	        return t("PEP Check");
93	      case "kyc":
94	        return t("KYC Verification");
95	      case "adverse_media":
96	        return t("Adverse Media");
97	      case "fraud_detection":
98	        return t("Fraud Detection");
99	      case undefined:
100	      case "":
101	        return t("Compliance");
102	      default:
103	        return capability;
104	    }
105	  };
106	  const statusLabel = (status: SanctionScreeningStatus): string => {
107	    switch (status) {
108	      case "pending":
109	        return t("pending");
110	      case "processing":
111	        return t("processing");
112	      case "completed":
113	        return t("completed");
114	      case "failed":
115	        return t("failed");
116	    }
117	  };
118	  const outcomeLabel = (outcome: SanctionScreeningOutcome): string => {
119	    switch (outcome) {
120	      case "pass":
121	        return t("pass");
122	      case "fail":
123	        return t("fail");
124	      case "review":
125	        return t("review");
126	    }
127	  };
128	  const decisionLabel = (decision: "approved" | "rejected"): string => {
129	    switch (decision) {
130	      case "approved":
131	        return t("approved");
132	      case "rejected":
133	        return t("rejected");
134	    }
135	  };
136	  const [row, setRow] = useState<SanctionScreening | null>(null);
137	  const [loading, setLoading] = useState(false);
138	  const [error, setError] = useState("");
139	  const [decisionOpen, setDecisionOpen] = useState<"approve" | "reject" | "request_info" | null>(null);
140	  const [decisionMessage, setDecisionMessage] = useState("");
141	  const [decisionFiles, setDecisionFiles] = useState<File[]>([]);
142	  const [submitting, setSubmitting] = useState(false);
143	  const decisionFileRef = useRef<HTMLInputElement>(null);
144	  const [rawOpen, setRawOpen] = useState(false);
145	  const [contextOpen, setContextOpen] = useState(false);
146	  const [copied, setCopied] = useState(false);
147	
148	  // Stash onUpdated in a ref so the `load` callback identity stays stable
149	  // across parent re-renders. Otherwise an inline-defined onUpdated would
150	  // invalidate `load` on every render and the useEffect below would re-fetch
151	  // in a loop.
152	  const onUpdatedRef = useRef(onUpdated);
153	  useEffect(() => {
154	    onUpdatedRef.current = onUpdated;
155	  }, [onUpdated]);
156	
157	  const load = useCallback(async () => {
158	    try {
159	      setLoading(true);
160	      setError("");
161	      const res = await api.get<ScreeningResponse>(`/sanction-screenings/${screeningId}`);
162	      const fetched = res.data.data ?? null;
163	      setRow(fetched);
164	      if (fetched) onUpdatedRef.current?.(fetched);
165	    } catch {
166	      setError(t("Failed to load screening"));
167	    } finally {
168	      setLoading(false);
169	    }
170	  }, [screeningId, t]);
171	
172	  useEffect(() => {
173	    void load();
174	  }, [load]);
175	
176	  const defaultMessageFor = (kind: "approve" | "reject" | "request_info"): string => {
177	    if (kind === "approve") {
178	      return t(
179	        "Good news — your application passed our compliance review and is now active. You will receive a confirmation shortly.",
180	      );
181	    }
182	    if (kind === "reject") {
183	      return t(
184	        "We were unable to approve your application after our compliance review. If you would like to discuss this decision please reply to this message.",
185	      );
186	    }
187	    return "";
188	  };
189	
190	  const uploadDecisionFiles = async (): Promise<
191	    { blobPath: string; filename: string; contentType: string }[]
192	  > => {
193	    if (decisionFiles.length === 0) return [];
194	    const folderId = crypto.randomUUID().replace(/-/g, "");
195	    const urlRes = await api.post(
196	      "/data/upload-urls",
197	      {
198	        origin: "compliance-decision",
199	        files: decisionFiles.map((f) => ({
200	          path: `compliance/${folderId}/${f.name}`,
201	          contentType: f.type || "application/octet-stream",
202	        })),
203	      },
204	      { sherpaAdmin: false },
205	    );
206	    const signed = urlRes.data.files as Array<{ id: string; uploadUrl: string; path: string }>;
207	    const uploaded: { blobPath: string; filename: string; contentType: string }[] = [];
208	    for (let i = 0; i < signed.length; i++) {
209	      const { uploadUrl, path } = signed[i];
210	      const putRes = await fetch(uploadUrl, {
211	        method: "PUT",
212	        body: decisionFiles[i],
213	        headers: {
214	          "Content-Type": decisionFiles[i].type || "application/octet-stream",
215	          "x-ms-blob-type": "BlockBlob",
216	        },
217	      });
218	      if (!putRes.ok) {
219	        throw

1	"use client";
2	
3	import React, { useCallback, useEffect, useState } from "react";
4	
5	import {
6	  Activity,
7	  AlertTriangle,
8	  Check,
9	  Eye,
10	  Loader2,
11	  Lock,
12	  Plus,
13	  ShieldCheck,
14	  Trash2,
15	  UserCheck,
16	  Users,
17	  X,
18	  type LucideIcon,
19	} from "lucide-react";
20	
21	import { Button } from "@/app/components/ui/button";
22	import { Input } from "@/app/components/ui/input";
23	import { Switch } from "@/app/components/ui/switch";
24	import { showErrorToast, showSuccessToast } from "@/app/components/Toast";
25	import api from "@/app/src/utils/api";
26	import type {
27	  ComplianceTrigger,
28	  ProductCapabilityConfig,
29	  ProductComplianceChecks,
30	  ProductData,
31	} from "@/app/types/product";
32	import type { ExternalIntegration } from "@/app/types/admin";
33	import { useLMT } from "@/lib/lmt/config";
34	
35	// Capability registry. Each entry renders as a section in the Compliance
36	// panel. Adding a new capability here surfaces it in the UI immediately —
37	// no other code changes required as long as the backend has the capability
38	// registered (see sherpa-api domains/integrations/runner.ts).
39	type CapabilityKey =
40	  | "sanction_screening"
41	  | "pep"
42	  | "kyc"
43	  | "adverse_media"
44	  | "fraud_detection";
45	
46	interface CapabilityDef {
47	  key: CapabilityKey;
48	  icon: LucideIcon;
49	  defaultTriggers: ComplianceTrigger[];
50	  defaultOutcomeRules: ProductCapabilityConfig["outcomeRules"];
51	}
52	const CAPABILITY_REGISTRY: CapabilityDef[] = [
53	  {
54	    key: "sanction_screening",
55	    icon: ShieldCheck,
56	    defaultTriggers: ["NEW_BUSINESS", "RENEWAL"],
57	    defaultOutcomeRules: {
58	      passWhen: { maxScore: 0.5 },
59	      failWhen: { minScore: 0.85, onTopics: ["sanction"] },
60	    },
61	  },
62	  {
63	    key: "pep",
64	    icon: Eye,
65	    defaultTriggers: ["NEW_BUSINESS", "RENEWAL"],
66	    defaultOutcomeRules: {
67	      passWhen: { maxScore: 0.5 },
68	      failWhen: { minScore: 0.85, onTopics: ["role.pep"] },
69	    },
70	  },
71	  {
72	    key: "kyc",
73	    icon: UserCheck,
74	    defaultTriggers: ["NEW_BUSINESS"],
75	    defaultOutcomeRules: {
76	      passWhen: { maxScore: 0.5 },
77	      failWhen: { minScore: 0.85, onTopics: ["kyc.failed", "kyc.fraud"] },
78	    },
79	  },
80	  {
81	    key: "adverse_media",
82	    icon: AlertTriangle,
83	    defaultTriggers: ["NEW_BUSINESS", "RENEWAL"],
84	    defaultOutcomeRules: {
85	      passWhen: { maxScore: 0.5 },
86	      failWhen: { minScore: 0.85, onTopics: ["adverse_media"] },
87	    },
88	  },
89	  {
90	    key: "fraud_detection",
91	    icon: Activity,
92	    defaultTriggers: ["CLAIM"],
93	    defaultOutcomeRules: {
94	      passWhen: { maxScore: 0.5 },
95	      failWhen: { minScore: 0.85, onTopics: ["fraud.high_risk"] },
96	    },
97	  },
98	];
99	
100	// Hook-bound text for each capability. lmt-translate requires literal arguments,
101	// so labels and blurbs live here as switch branches keyed off the capability id.
102	function useCapabilityText() {
103	  const { t } = useLMT();
104	  const label = (key: CapabilityKey): string => {
105	    switch (key) {
106	      case "sanction_screening":
107	        return t("Sanction Screening");
108	      case "pep":
109	        return t("PEP Check");
110	      case "kyc":
111	        return t("KYC Verification");
112	      case "adverse_media":
113	        return t("Adverse Media");
114	      case "fraud_detection":
115	        return t("Fraud Detection");
116	    }
117	  };
118	  const blurb = (key: CapabilityKey): string => {
119	    switch (key) {
120	      case "sanction_screening":
121	        return t("Run policy parties against OFAC / EU / UK / OS sanction lists. Blocking matches halt the gate.");
122	      case "pep":
123	        return t("Check if parties are Politically Exposed Persons or close associates. Often runs alongside sanctions.");
124	      case "kyc":
125	        return t("Verify the policyholder's identity (document + selfie or data + bureau check) at onboarding.");
126	      case "adverse_media":
127	        return t("Scan news + watchlists for negative coverage of the parties (regulatory enforcement, criminal proceedings).");
128	      case "fraud_detection":
129	        return t("Score the party / claim for fraud risk via an external bureau. Typically runs at claim creation.");
130	    }
131	  };
132	  return { label, blurb };
133	}
134	
135	const ALL_TRIGGERS: ComplianceTrigger[] = [
136	  "NEW_BUSINESS",
137	  "RENEWAL",
138	  "ENDORSEMENT",
139	  "CLAIM",
140	  "MANUAL",
141	];
142	
143	// Person-shaped DataModel categories (other than `personal`, the
144	// policyholder which is always screened). Push a new entry here when a
145	// person-category lands in the DataModel (e.g. `family`, `insureds`).
146	const ADDITIONAL_PARTY_CATEGORIES: string[] = [];
147	
148	const DEFAULT_PARTIES: ProductCapabilityConfig["parties"] = {
149	  policyholder: "personal",
150	  additional: [],
151	};
152	
153	function buildDefaultConfig(cap: CapabilityDef): ProductCapabilityConfig {
154	  return {
155	    enabled: false,
156	    integrationId: "",
157	    triggers: [...cap.defaultTriggers],
158	    parties: { ...DEFAULT_PARTIES, additional: [...DEFAULT_PARTIES.additional] },
159	    outcomeRules: structuredClone(cap.defaultOutcomeRules),
160	    autoReject: false,
161	    messages: { fail: null, review: null },
162	  };
163	}
164	
165	// Backfill missing keys on persisted rows written before the parties/triggers
166	// refactor. Persisted values win; defaults plug the holes.
167	function mergeWithDefaults(
168	  cap: CapabilityDef,
169	  persisted: ProductCapabilityConfig | undefined,
170	): ProductCapabilityConfig {
171	  const defaults = buildDefaultConfig(cap);
172	  if (!persisted) return defaults;
173	  return {
174	    enabled: persisted.enabled ?? defaults.enabled,
175	    integrationId: persisted.integrationId ?? defaults.integrationId,
176	    triggers: Array.isArray(persisted.triggers) ? persisted.triggers : defaults.triggers,
177	    parties: {
178	      policyholder: persisted.parties?.policyholder ?? defaults.parties.policyholder,
179	      additional: Array.isArray(persisted.parties?.additional)
180	        ? persisted.parties.additional
181	        : defaults.parties.additional,
182	    },
183	    outcomeRules: {
184	      passWhen: {
185	        maxScore:
186	          persisted.outcomeRules?.passWhen?.maxScore ?? defaults.outcomeRules.passWhen.maxScore,
187	      },
188	      failWhen: {
189	        minScore:
190	          persisted.outcomeRules?.failWhen?.minScore ?? defaults.outcomeRules.failWhen.minScore,
191	        onTopics: Array.isArray(persisted.outcomeRules?.failWhen?.onTopics)
192	          ? persisted.outcomeRules.failWhen.onTopics
193	          : defaults.outcomeRules.failWhen.onTopics,
194	      },
195	    },
196	    autoReject: persisted.autoReject ?? defaults.autoReject,
197	    messages: {
198	      fail: persisted.messages?.fail ?? defaults.messages?.fail ?? null,
199	      review: persisted.messages?.review ?? defaults.messages?.review ?? null,
200	    },
201	  };
202	}
203	
204	interface ProductResponse {
205	  status: "success" | "error";
206	  data?: ProductData;
207	}
208	
209	interface IntegrationsResponse {
210	  status: "success" | "error";
211	  data?: ExternalIntegration[];
212	}
213	
214	interface Props {
215	  productId: string;
216	}
217	
218	const ProductCompliancePanel: React.FC<Props> = ({ productId }) => {
219	  const { t } = useLMT();
220	  const { label: capLabel } = useCapabilityText();
221	  const [product, setProduct] = useState<ProductData | null>(null);
222	  const [integrations, setIntegrations] = useState<ExternalIntegration[]>([]);
223	  const [checks, setChecks] = useState<ProductComplianceChecks>({});
224	  const [activeKey, setActiveKey] = useState<string | null>(null);
225	  const [loading, setLoading] = useState(true);
226	  const [saving, setSaving] = useState(false);
227	  const [error, setErr

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegration.ts"}

1	import { Table, Column, Model, DataType, ForeignKey, BelongsTo, HasMany } from 'sequelize-typescript';
2	import { Organization } from '../Organization.js';
3	import { _ExternalIntegrationEnvironment } from './_ExternalIntegrationEnvironment.js';
4	
5	@Table({
6	  modelName: 'ExternalIntegration',
7	  timestamps: true,
8	  indexes: [
9	    {
10	      fields: ['organizationId', 'capability', 'active'],
11	      name: 'idx_external_integration_org_capability_active',
12	    },
13	    {
14	      unique: true,
15	      fields: ['organizationId', 'slug'],
16	      name: 'unique_external_integration_org_slug',
17	    },
18	  ],
19	})
20	export class _ExternalIntegration extends Model {
21	  @Column({
22	    type: DataType.UUID,
23	    defaultValue: DataType.UUIDV4,
24	    primaryKey: true,
25	  })
26	  declare id: string;
27	
28	  @ForeignKey(() => Organization)
29	  @Column({
30	    type: DataType.UUID,
31	    allowNull: false,
32	  })
33	  declare organizationId: string;
34	
35	  @Column({
36	    type: DataType.STRING(255),
37	    allowNull: false,
38	    validate: { notEmpty: true, len: [1, 255] },
39	  })
40	  declare name: string;
41	
42	  @Column({
43	    type: DataType.STRING(100),
44	    allowNull: false,
45	    validate: { notEmpty: true, len: [1, 100] },
46	  })
47	  declare slug: string;
48	
49	  @Column({
50	    type: DataType.STRING(64),
51	    allowNull: false,
52	  })
53	  declare capability: string;
54	
55	  @Column({
56	    type: DataType.ENUM('generic_rest'),
57	    allowNull: false,
58	  })
59	  declare kind: 'generic_rest';
60	
61	  @Column({
62	    type: DataType.ENUM('test', 'staging', 'production'),
63	    allowNull: false,
64	    defaultValue: 'production',
65	  })
66	  declare defaultEnvironment: 'test' | 'staging' | 'production';
67	
68	  // How the runner is invoked from the compliance gate:
69	  //   sync  → run inline; outcome known before the customer's payment step
70	  //           (right for sub-second APIs like OpenSanctions, fraud scoring).
71	  //   async → enqueue a BullMQ job; policy parks in compliance_pending and
72	  //           SetupIntent captures the card while the worker runs.
73	  // `syncTimeoutMs` caps the inline call so a slow provider never hangs the
74	  // customer — on timeout the gate falls back to async semantics.
75	  @Column({
76	    type: DataType.ENUM('sync', 'async'),
77	    allowNull: false,
78	    defaultValue: 'sync',
79	  })
80	  declare invocationMode: 'sync' | 'async';
81	
82	  @Column({
83	    type: DataType.INTEGER,
84	    allowNull: false,
85	    defaultValue: 5000,
86	  })
87	  declare syncTimeoutMs: number;
88	
89	  @Column({
90	    type: DataType.BOOLEAN,
91	    allowNull: false,
92	    defaultValue: true,
93	  })
94	  declare active: boolean;
95	
96	  @Column({
97	    type: DataType.DATE,
98	    allowNull: false,
99	  })
100	  declare createdAt: Date;
101	
102	  @Column({
103	    type: DataType.DATE,
104	    allowNull: false,
105	  })
106	  declare updatedAt: Date;
107	
108	  @BelongsTo(() => Organization, { foreignKey: 'organizationId', as: 'organization' })
109	  declare organization?: Organization;
110	
111	  @HasMany(() => _ExternalIntegrationEnvironment, { foreignKey: 'integrationId', as: 'environments' })
112	  declare environments?: _ExternalIntegrationEnvironment[];
113	}
114	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runtime/fieldMappings.ts"}

1	/**
2	 * Field-mapping runtime — consumes ExternalIntegrationFieldMappings rows to
3	 * (a) build outbound request bodies from the typed capability input, and
4	 * (b) normalise inbound provider responses into the runner output shape.
5	 *
6	 * Reads source values from issuance context via either the dataModelField
7	 * name (lower-cased / dotted) or an explicit customFieldName path. Targets
8	 * are JSONPath-lite expressions evaluated with the same parser as
9	 * `mapping.ts` — kept narrow on purpose.
10	 */
11	
12	import type { _ExternalIntegrationFieldMapping } from '@/models/ExternalIntegrationFieldMapping.js';
13	import type { DataModelField } from '@/models/DataModelField.js';
14	
15	export type FieldMappingWithRef = _ExternalIntegrationFieldMapping & {
16	  dataModelField?: DataModelField | null;
17	};
18	
19	type PathStep = { key: string } | { index: number };
20	
21	/**
22	 * Tokenise a JSONPath-lite expression into a flat step list. Supports
23	 *   foo            -> [{key:'foo'}]
24	 *   foo.bar        -> [{key:'foo'}, {key:'bar'}]
25	 *   foo[0]         -> [{key:'foo'}, {index:0}]
26	 *   foo[0][1]      -> [{key:'foo'}, {index:0}, {index:1}]
27	 *   foo.bar[2].baz -> [{key:'foo'}, {key:'bar'}, {index:2}, {key:'baz'}]
28	 *
29	 * Leading "$." (or just "$") is stripped. Numeric segments are treated as
30	 * keys (not indices) when they appear after a "." separator, which lets us
31	 * still read e.g. parties.0.firstName against arrays via the Array branch
32	 * in readByPath. Bracket syntax `[N]` is the canonical array-index form.
33	 */
34	function parsePath(path: string): PathStep[] {
35	  let p = path;
36	  if (p.startsWith('$.')) p = p.slice(2);
37	  else if (p.startsWith('$')) p = p.slice(1);
38	  const steps: PathStep[] = [];
39	  const re = /([^.\[\]]+)|\[(\d+)\]/g;
40	  let m: RegExpExecArray | null;
41	  while ((m = re.exec(p)) !== null) {
42	    if (m[1] !== undefined) steps.push({ key: m[1] });
43	    else if (m[2] !== undefined) steps.push({ index: Number(m[2]) });
44	  }
45	  return steps;
46	}
47	
48	function readByPath(source: Record<string, unknown>, path: string): unknown {
49	  const steps = parsePath(path);
50	  let cursor: unknown = source;
51	  for (const step of steps) {
52	    if (cursor === null || cursor === undefined) return undefined;
53	    if ('index' in step) {
54	      if (!Array.isArray(cursor)) return undefined;
55	      cursor = cursor[step.index];
56	    } else if (typeof cursor === 'object') {
57	      if (Array.isArray(cursor)) {
58	        const asIndex = Number(step.key);
59	        if (!Number.isFinite(asIndex)) return undefined;
60	        cursor = cursor[asIndex];
61	      } else {
62	        cursor = (cursor as Record<string, unknown>)[step.key];
63	      }
64	    } else {
65	      return undefined;
66	    }
67	  }
68	  return cursor;
69	}
70	
71	function setByPath(target: Record<string, unknown>, path: string, value: unknown): void {
72	  const steps = parsePath(path);
73	  if (steps.length === 0) return;
74	  let cursor: unknown = target;
75	  for (let i = 0; i < steps.length - 1; i++) {
76	    const step = steps[i];
77	    const next = steps[i + 1];
78	    const wantArray = 'index' in next;
79	    if ('index' in step) {
80	      if (!Array.isArray(cursor)) return;
81	      if (cursor[step.index] === undefined || cursor[step.index] === null) {
82	        (cursor as unknown[])[step.index] = wantArray ? [] : {};
83	      } else if (wantArray && !Array.isArray(cursor[step.index])) {
84	        (cursor as unknown[])[step.index] = [];
85	      } else if (!wantArray && (typeof cursor[step.index] !== 'object' || Array.isArray(cursor[step.index]))) {
86	        (cursor as unknown[])[step.index] = {};
87	      }
88	      cursor = (cursor as unknown[])[step.index];
89	    } else {
90	      const obj = cursor as Record<string, unknown>;
91	      const cur = obj[step.key];
92	      if (cur === undefined || cur === null) {
93	        obj[step.key] = wantArray ? [] : {};
94	      } else if (wantArray && !Array.isArray(cur)) {
95	        obj[step.key] = [];
96	      } else if (!wantArray && (typeof cur !== 'object' || Array.isArray(cur))) {
97	        obj[step.key] = {};
98	      }
99	      cursor = obj[step.key];
100	    }
101	  }
102	  const last = steps[steps.length - 1];
103	  if ('index' in last) {
104	    if (Array.isArray(cursor)) (cursor as unknown[])[last.index] = value;
105	  } else {
106	    (cursor as Record<string, unknown>)[last.key] = value;
107	  }
108	}
109	
110	function applyTransformation(
111	  value: unknown,
112	  fn: string | null,
113	  enumMapping: Record<string, string> | null,
114	): unknown {
115	  if (value === null || value === undefined) return value;
116	  if (enumMapping) {
117	    const key = typeof value === 'string' ? value : typeof value === 'number' ? String(value) : null;
118	    if (key !== null && key in enumMapping) {
119	      return enumMapping[key];
120	    }
121	  }
122	  if (!fn) return value;
123	  switch (fn) {
124	    case 'dateFormat': {
125	      // Pass through ISO-8601 / YYYY-MM-DD. Adapters can override later if a
126	      // provider needs a non-ISO shape.
127	      if (typeof value === 'string') return value;
128	      if (value instanceof Date) return value.toISOString().slice(0, 10);
129	      return value;
130	    }
131	    case 'enumMapping':
132	      // Already handled above via enumMapping object; if no mapping matched,
133	      // return original.
134	      return value;
135	    case 'currencyFormat':
136	    case 'phoneFormat':
137	    case 'booleanMapping':
138	    case 'genderMapping':
139	    case 'civilStatusMapping':
140	    case 'identificationTypeMapping':
141	    case 'statusMapping':
142	      // Stub: future transformers — return value unchanged so admins can declare
143	      // intent without breaking the call path. Add specific implementations as
144	      // capabilities/providers demand them.
145	      return value;
146	    default:
147	      return value;
148	  }
149	}
150	
151	/**
152	 * Resolve the source path on the capability input for a request-direction
153	 * mapping. Preference order:
154	 *   1. customFieldName — explicit dotted path (e.g. "parties.0.firstName").
155	 *   2. dataModelField.name — looked up against the issuance input by name.
156	 *      For capabilities whose typed input is shaped around an array (e.g.
157	 *      sanction_screening → {parties:[...]}), the runner passes a
158	 *      `dataModelFieldSourcePrefix` so a DataModelField named "firstName"
159	 *      resolves at "parties.0.firstName" instead of the root.
160	 *   3. defaultValue — fallback when no source resolved.
161	 */
162	function resolveRequestSource(
163	  mapping: FieldMappingWithRef,
164	  input: Record<string, unknown>,
165	  dataModelFieldSourcePrefix: string,
166	): unknown {
167	  let value: unknown = undefined;
168	  if (mapping.customFieldName) {
169	    value = readByPath(input, mapping.customFieldName);
170	  } else if (mapping.dataModelField?.name) {
171	    const name = mapping.dataModelField.name;
172	    if (dataModelFieldSourcePrefix) {
173	      value = readByPath(input, `${dataModelFieldSourcePrefix}.${name}`);
174	    }
175	    if (value === undefined || value === null) {
176	      value = readByPath(input, name);
177	    }
178	  }
179	  if (value === undefined || value === null) {
180	    return mapping.defaultValue ?? null;
181	  }
182	  return value;
183	}
184	
185	export interface BuildRequestBodyOptions {
186	  /**
187	   * Prefix prepended when resolving a DataModelField source via name. Use
188	   * "parties.0" for sanction_screening so DataModelField references resolve
189	   * against the first party object instead of the typed-input root.
190	   */
191	  dataModelFieldSourcePrefix?: string;
192	}
193	
194	/**
195	 * Build an outbound request body from `direction=request` field mappings. Each
196	 * mapping reads a value from the typed capability input (or a default) and
197	 * sets it at the JSONPath-lite

{"pattern":"fieldMapping|externalIntegration|integration.*builder|mapping|provider","path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat","output_mode":"files_with_matches","head_limit":50}

Found 50 files limit: 50
sherpa-portal-api-458-credit-check-compliance-integrat/package-lock.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/sv.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/pt_BR.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/no.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/nl.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/it.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/id.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/fr.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/fi.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/es_419.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/de.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/locales/da.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/keys.json
sherpa-portal-api-458-credit-check-compliance-integrat/translations/cache.json
sherpa-portal-api-458-credit-check-compliance-integrat/rfc/ideas/organization-resolution-and-auth-policy.md
sherpa-portal-api-458-credit-check-compliance-integrat/rfc/ideas/dependency-cleanup.md
sherpa-portal-api-458-credit-check-compliance-integrat/public/shared/carrefour/carrefour-vtex-integration-flow.html
sherpa-portal-api-458-credit-check-compliance-integrat/package.json
sherpa-portal-api-458-credit-check-compliance-integrat/app/utils/countryUtils.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/types/paymentProvider.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/types/claimPayout.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/src/utils/pricingTableRuleUtils.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/settings/page.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/register/account/page.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/partnerSmartImport.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/externalIntegrationSmartSetup.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/externalIntegrationSmartImport.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/products/[id]/funnel-templates/page.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/products/[id]/embed/page.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/policy-management/policies/[policyId]/cancel/page.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/policy-management/claims/[claimId]/page.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/lib/lmt-common-labels.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/lens/optimizations/commission/AGENTS.md
sherpa-portal-api-458-credit-check-compliance-integrat/app/customer-portal/templates/ueno/CancelPolicy.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/customer-portal/templates/o2/CancelPolicy.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/customer-portal/templates/anvnordic/CancelPolicy.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/customer-portal/policies/[policyId]/cancel/DefaultCancelPolicy.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/customer-portal/claims/[claimId]/DefaultClaimDetails.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/customer-portal/PortalLayout.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/settings/PaymentProvidersTab.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/pricing/TableFileUploader.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/pricing/PricingTableEditor.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/pricing/PricingTab.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/pricing/PricingRules.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/pricing/PricingRuleEditor.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/pricing/PricingFunctionEditor.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/pricing/PriceCalculationBreakdown.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/pricing/PremiumColumnsSelector.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/coverage/CoveragePricingTab.tsx

{"pattern":"**/integration*.{ts,tsx}","path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat"}

sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry-internal/feedback/build/npm/types-ts3.8/core/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry-internal/feedback/build/npm/types-ts3.8/modal/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry-internal/feedback/build/npm/types-ts3.8/screenshot/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry-internal/feedback/build/npm/types/core/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry-internal/feedback/build/npm/types/modal/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry-internal/feedback/build/npm/types/screenshot/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry-internal/replay/build/npm/types-ts3.8/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry-internal/replay/build/npm/types/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/browser/build/npm/types-ts3.8/integrations/featureFlags/growthbook/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/browser/build/npm/types-ts3.8/integrations/featureFlags/launchdarkly/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/browser/build/npm/types-ts3.8/integrations/featureFlags/openfeature/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/browser/build/npm/types-ts3.8/integrations/featureFlags/statsig/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/browser/build/npm/types-ts3.8/integrations/featureFlags/unleash/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/browser/build/npm/types-ts3.8/profiling/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/browser/build/npm/types/integrations/featureFlags/growthbook/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/browser/build/npm/types/integrations/featureFlags/launchdarkly/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/browser/build/npm/types/integrations/featureFlags/openfeature/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/browser/build/npm/types/integrations/featureFlags/statsig/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/browser/build/npm/types/integrations/featureFlags/unleash/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/browser/build/npm/types/profiling/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/core/build/types-ts3.8/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/core/build/types-ts3.8/types-hoist/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/core/build/types/integration.d.ts
sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@sentry/core/build/types/types-hoist/integration.d.ts

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/capabilities/runCheck.ts"}

1	import { StatusError } from '@/error/error.js';
2	import type { _Product, ProductCapabilityConfig } from '@/models/Product.js';
3	import type {
4	  ScreenedParty,
5	  ComplianceFinding,
6	  ComplianceCheckOutcome,
7	} from '@/models/ComplianceCheck.js';
8	import { invoke } from '../runner.js';
9	import { getCapability, type CapabilityId } from './registry.js';
10	
11	export interface RunCheckInvocation {
12	  capability: CapabilityId;
13	  organizationId: string;
14	  product: _Product;
15	  parameters: Record<string, unknown>;
16	  correlationId: string;
17	}
18	
19	export interface RunCheckResult {
20	  integrationId: string;
21	  screenedParties: ScreenedParty[];
22	  findings: ComplianceFinding[];
23	  outcome: ComplianceCheckOutcome;
24	  rawResponse: unknown;
25	  httpStatus: number | null;
26	  durationMs: number;
27	  attempts: number;
28	}
29	
30	// Resolve a Product's capability config or throw a 400 if the capability is
31	// not enabled on the product.
32	export function requireCapabilityConfig(
33	  product: _Product,
34	  capability: CapabilityId,
35	): ProductCapabilityConfig {
36	  const config = product.complianceChecks?.[capability];
37	  if (!config) {
38	    throw new StatusError(400, `Product ${product.id} has no ${capability} compliance check`);
39	  }
40	  if (!config.enabled) {
41	    throw new StatusError(400, `Product ${product.id} ${capability} is disabled`);
42	  }
43	  return config;
44	}
45	
46	function readPath(source: Record<string, unknown>, path: string): unknown {
47	  let cursor: unknown = source;
48	  for (const seg of path.split('.')) {
49	    if (cursor === null || cursor === undefined || typeof cursor !== 'object') return undefined;
50	    cursor = (cursor as Record<string, unknown>)[seg];
51	  }
52	  return cursor;
53	}
54	
55	function asPartyObject(value: unknown): Record<string, unknown> | null {
56	  if (value === null || typeof value !== 'object' || Array.isArray(value)) return null;
57	  return value as Record<string, unknown>;
58	}
59	
60	// Extract screened parties from policy/claim parameters using the product's
61	// per-capability `parties` config. Each path resolves to a DataModelField
62	// object (e.g. `personal`); the integration's outbound mappings decide which
63	// fields are forwarded to the provider.
64	export function extractScreenedParties(
65	  parameters: Record<string, unknown>,
66	  config: ProductCapabilityConfig,
67	): ScreenedParty[] {
68	  const out: ScreenedParty[] = [];
69	  const policyholder = asPartyObject(readPath(parameters, config.parties.policyholder));
70	  if (policyholder) {
71	    out.push({ role: 'policyholder', sourcePath: config.parties.policyholder, data: policyholder });
72	  }
73	  for (const path of config.parties.additional) {
74	    const value = readPath(parameters, path);
75	    if (Array.isArray(value)) {
76	      value.forEach((entry, i) => {
77	        const party = asPartyObject(entry);
78	        if (party) out.push({ role: 'insured', sourcePath: `${path}.${i}`, data: party });
79	      });
80	    } else {
81	      const party = asPartyObject(value);
82	      if (party) out.push({ role: 'insured', sourcePath: path, data: party });
83	    }
84	  }
85	  return out;
86	}
87	
88	function isFindingArray(value: unknown): value is unknown[] {
89	  return Array.isArray(value);
90	}
91	
92	// Normalise the provider's match list into the canonical finding shape.
93	// Accepts either canonical (entityId/entityName) or provider-native (id/caption/name).
94	function normaliseFindings(rawMatches: unknown): ComplianceFinding[] {
95	  if (!isFindingArray(rawMatches)) return [];
96	  const out: ComplianceFinding[] = [];
97	  for (const item of rawMatches) {
98	    if (item === null || typeof item !== 'object') continue;
99	    const m = item as Record<string, unknown>;
100	    const entityId = typeof m.entityId === 'string' ? m.entityId : typeof m.id === 'string' ? m.id : null;
101	    const entityName =
102	      typeof m.entityName === 'string'
103	        ? m.entityName
104	        : typeof m.caption === 'string'
105	          ? m.caption
106	          : typeof m.name === 'string'
107	            ? m.name
108	            : null;
109	    const score = typeof m.score === 'number' ? m.score : null;
110	    if (!entityId || !entityName || score === null) continue;
111	    out.push({
112	      entityId,
113	      entityName,
114	      score,
115	      topics: Array.isArray(m.topics) ? m.topics.filter((t): t is string => typeof t === 'string') : [],
116	      datasets: Array.isArray(m.datasets) ? m.datasets.filter((d): d is string => typeof d === 'string') : [],
117	      sourceUrl: typeof m.sourceUrl === 'string' ? m.sourceUrl : null,
118	    });
119	  }
120	  return out;
121	}
122	
123	// Bucket findings into pass / fail / review using the product's outcomeRules.
124	export function applyOutcomeRules(
125	  findings: ComplianceFinding[],
126	  config: ProductCapabilityConfig,
127	): ComplianceCheckOutcome {
128	  if (findings.length === 0) return 'pass';
129	  let topScore = 0;
130	  const allTopics = new Set<string>();
131	  for (const f of findings) {
132	    if (f.score > topScore) topScore = f.score;
133	    for (const t of f.topics) allTopics.add(t);
134	  }
135	  const failRule = config.outcomeRules.failWhen;
136	  if (topScore >= failRule.minScore) return 'fail';
137	  for (const forbidden of failRule.onTopics) {
138	    if (allTopics.has(forbidden)) return 'fail';
139	  }
140	  const passRule = config.outcomeRules.passWhen;
141	  if (topScore < passRule.maxScore) return 'pass';
142	  return 'review';
143	}
144	
145	// Run a compliance check for any registered capability against a product.
146	// Capability handlers share this single pipeline: extract parties → invoke
147	// the integration → normalise findings → apply outcome rules.
148	export async function runComplianceCheck(invocation: RunCheckInvocation): Promise<RunCheckResult> {
149	  const config = requireCapabilityConfig(invocation.product, invocation.capability);
150	  const parties = extractScreenedParties(invocation.parameters, config);
151	  if (parties.length === 0) {
152	    throw new StatusError(
153	      400,
154	      `Product ${invocation.product.id} ${invocation.capability} parties paths produced no screenable parties from the provided parameters`,
155	    );
156	  }
157	  const capabilityDef = getCapability(invocation.capability);
158	  const result = await invoke({
159	    organizationId: invocation.organizationId,
160	    capability: invocation.capability,
161	    operation: capabilityDef.operation,
162	    input: { parties },
163	    correlationId: invocation.correlationId,
164	  });
165	  const findings = normaliseFindings(result.output.matches);
166	  const outcome = applyOutcomeRules(findings, config);
167	  return {
168	    integrationId: result.integrationId,
169	    screenedParties: parties,
170	    findings,
171	    outcome,
172	    rawResponse: result.rawResponseBody,
173	    httpStatus: result.httpStatus,
174	    durationMs: result.durationMs,
175	    attempts: result.attempts,
176	  };
177	}
178	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/IntegrationsTab.tsx","limit":100}

1	"use client";
2	
3	import React, { useCallback, useEffect, useState } from "react";
4	
5	import Link from "next/link";
6	import { Plus } from "lucide-react";
7	
8	import ConfirmDialog from "./ConfirmDialog";
9	
10	import { Button } from "@/app/components/ui/button";
11	import {
12	  Dialog,
13	  DialogContent,
14	  DialogFooter,
15	  DialogHeader,
16	  DialogTitle,
17	} from "@/app/components/ui/dialog";
18	import { Input } from "@/app/components/ui/input";
19	import api from "@/app/src/utils/api";
20	import type {
21	  ExternalIntegration,
22	  CreateExternalIntegration,
23	  UpdateExternalIntegration,
24	  IntegrationCapability,
25	  IntegrationInvocationMode,
26	  IntegrationKind,
27	} from "@/app/types/admin";
28	import { CAPABILITY_DEFAULT_INVOCATION_MODE } from "@/app/types/admin";
29	import { useLMT } from "@/lib/lmt/config";
30	
31	interface IntegrationsResponse {
32	  status: "success" | "error";
33	  data?: ExternalIntegration[];
34	}
35	
36	const CAPABILITIES: IntegrationCapability[] = [
37	  "sanction_screening",
38	  "pep",
39	  "kyc",
40	  "adverse_media",
41	  "fraud_detection",
42	];
43	const KINDS: IntegrationKind[] = ["generic_rest"];
44	const INVOCATION_MODES: IntegrationInvocationMode[] = ["sync", "async"];
45	
46	const IntegrationsTab: React.FC = () => {
47	  const { t } = useLMT();
48	  const [integrations, setIntegrations] = useState<ExternalIntegration[]>([]);
49	  const [loading, setLoading] = useState(false);
50	  const [error, setError] = useState<string>("");
51	  const [formOpen, setFormOpen] = useState(false);
52	  const [editing, setEditing] = useState<ExternalIntegration | null>(null);
53	  const [name, setName] = useState("");
54	  const [slug, setSlug] = useState("");
55	  const [capability, setCapability] = useState<IntegrationCapability>("sanction_screening");
56	  const [kind, setKind] = useState<IntegrationKind>("generic_rest");
57	  const [active, setActive] = useState(true);
58	  const [invocationMode, setInvocationMode] = useState<IntegrationInvocationMode>("sync");
59	  const [syncTimeoutMs, setSyncTimeoutMs] = useState<number>(5000);
60	  const [deleteId, setDeleteId] = useState<string | null>(null);
61	
62	  const load = useCallback(async () => {
63	    try {
64	      setLoading(true);
65	      setError("");
66	      const res = await api.get<IntegrationsResponse>("/external-integrations");
67	      setIntegrations(res.data.data || []);
68	    } catch {
69	      setError(t("Failed to fetch external integrations"));
70	    } finally {
71	      setLoading(false);
72	    }
73	  }, [t]);
74	
75	  useEffect(() => {
76	    void load();
77	  }, [load]);
78	
79	  const openCreate = () => {
80	    setEditing(null);
81	    setName("");
82	    setSlug("");
83	    setCapability("sanction_screening");
84	    setKind("generic_rest");
85	    setActive(true);
86	    setInvocationMode(CAPABILITY_DEFAULT_INVOCATION_MODE.sanction_screening);
87	    setSyncTimeoutMs(5000);
88	    setFormOpen(true);
89	  };
90	
91	  const openEdit = (row: ExternalIntegration) => {
92	    setEditing(row);
93	    setName(row.name);
94	    setSlug(row.slug);
95	    setCapability(row.capability);
96	    setKind(row.kind);
97	    setActive(row.active);
98	    setInvocationMode(row.invocationMode);
99	    setSyncTimeoutMs(row.syncTimeoutMs);
100	    setFormOpen(true);

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/SmartSetupModal.tsx","limit":150}

1	"use client";
2	
3	import React, { useCallback, useEffect, useMemo, useState } from "react";
4	
5	import { CheckCircle2, Loader2, Sparkles, Wand2, XCircle } from "lucide-react";
6	
7	import { Button } from "@/app/components/ui/button";
8	import {
9	  Dialog,
10	  DialogContent,
11	  DialogFooter,
12	  DialogHeader,
13	  DialogTitle,
14	} from "@/app/components/ui/dialog";
15	import { Input } from "@/app/components/ui/input";
16	import { Textarea } from "@/app/components/ui/textarea";
17	import api, { nextApi } from "@/app/src/utils/api";
18	import type {
19	  AuthType,
20	  CreateExternalIntegrationFieldMapping,
21	  ExternalIntegrationAuthConfig,
22	  ExternalIntegrationEnvironment,
23	  ExternalIntegrationRequestTemplate,
24	  IntegrationCapability,
25	  IntegrationEnvironment,
26	  IntegrationHttpMethod,
27	  RetryPolicy,
28	  TokenType,
29	} from "@/app/types/admin";
30	import { useLMT } from "@/lib/lmt/config";
31	import {
32	  detectAndParse,
33	  pickOperationFromArtifact,
34	  type ImportArtifact,
35	} from "@/app/components/admin/integrations/parsers";
36	import type { DataModelFieldLite } from "@/app/components/admin/integrations/FieldMappingsEditor";
37	
38	const ENVIRONMENTS: IntegrationEnvironment[] = ["test", "staging", "production"];
39	
40	interface Bundle {
41	  environment: {
42	    environment: IntegrationEnvironment;
43	    baseUrl: string;
44	    authEndpoint: string | null;
45	    tokenEndpoint: string | null;
46	  };
47	  authConfig: {
48	    authType: AuthType;
49	    tokenType: TokenType;
50	    authorizationHeaderFormat: string;
51	    credentialHint: string;
52	  };
53	  requestTemplate: {
54	    operation: string;
55	    httpMethod: IntegrationHttpMethod;
56	    urlTemplate: string;
57	    requestHeadersTemplate: Record<string, string> | null;
58	    requestBodyTemplate: Record<string, unknown> | null;
59	    responseMapping: Record<string, string>;
60	    errorMapping: Record<string, string> | null;
61	    timeoutMs: number;
62	    retryPolicy: RetryPolicy | null;
63	  };
64	  fieldMappings: CreateExternalIntegrationFieldMapping[];
65	}
66	
67	type ConflictMode = "reuse" | "replace" | "create";
68	
69	interface Conflicts {
70	  environment?: { existing: ExternalIntegrationEnvironment; mode: ConflictMode };
71	  authConfig?: { existing: ExternalIntegrationAuthConfig; mode: ConflictMode };
72	  requestTemplate?: { existing: ExternalIntegrationRequestTemplate; mode: ConflictMode };
73	}
74	
75	interface SmartSetupModalProps {
76	  open: boolean;
77	  onOpenChange: (v: boolean) => void;
78	  integrationId: string;
79	  capability: IntegrationCapability;
80	  dataModelFields: DataModelFieldLite[];
81	  onCompleted: () => void;
82	}
83	
84	const AUTH_TYPES: AuthType[] = [
85	  "api_key",
86	  "client_credentials",
87	  "username_password",
88	  "basic_auth",
89	  "oauth2_code",
90	  "custom",
91	];
92	
93	type CredentialKey =
94	  | "username"
95	  | "password"
96	  | "clientId"
97	  | "clientSecret"
98	  | "apiKey"
99	  | "refreshToken"
100	  | "token";
101	
102	interface CredentialFieldDef {
103	  key: CredentialKey;
104	  type: "text" | "password";
105	}
106	
107	const credentialFieldsByAuthType: Record<AuthType, CredentialFieldDef[]> = {
108	  api_key: [{ key: "apiKey", type: "password" }],
109	  client_credentials: [
110	    { key: "clientId", type: "text" },
111	    { key: "clientSecret", type: "password" },
112	  ],
113	  username_password: [
114	    { key: "username", type: "text" },
115	    { key: "password", type: "password" },
116	  ],
117	  basic_auth: [
118	    { key: "username", type: "text" },
119	    { key: "password", type: "password" },
120	  ],
121	  oauth2_code: [
122	    { key: "clientId", type: "text" },
123	    { key: "clientSecret", type: "password" },
124	    { key: "refreshToken", type: "password" },
125	  ],
126	  custom: [{ key: "token", type: "password" }],
127	};
128	
129	const SmartSetupModal: React.FC<SmartSetupModalProps> = ({
130	  open,
131	  onOpenChange,
132	  integrationId,
133	  capability,
134	  dataModelFields,
135	  onCompleted,
136	}) => {
137	  const { t } = useLMT();
138	  const [step, setStep] = useState<"paste" | "preview" | "creating" | "done">("paste");
139	  const [source, setSource] = useState("");
140	  const [responseSample, setResponseSample] = useState("");
141	  const [artifact, setArtifact] = useState<ImportArtifact>({
142	    format: "raw",
143	    request: null,
144	    operations: [],
145	    hint: "",
146	    raw: "",
147	    redactedSource: "",
148	    hadSecrets: false,
149	  });
150	  const [openApiOperationKey, setOpenApiOperationKey] = useState<string>("");

{"command":"find /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations -type f -name \"*.tsx\" -o -name \"*.ts\""}

/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/FieldMappingsEditor.tsx
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/SmartSetupModal.tsx
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/parsers.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/TestTab.tsx
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/CallLogsTab.tsx
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/AuthConfigsTab.tsx
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/RequestTemplatesTab.tsx
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/EnvironmentsTab.tsx

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/capabilities/registry.ts"}

1	// Capability registry — every external compliance check (sanctions, KYC,
2	// fraud, etc.) registers here. ComplianceChecks.capability stores which one.
3	
4	export type CapabilityId = string;
5	
6	export type ComplianceTrigger =
7	  | 'NEW_BUSINESS'
8	  | 'RENEWAL'
9	  | 'ENDORSEMENT'
10	  | 'CLAIM'
11	  | 'MANUAL';
12	
13	export interface CapabilityDefinition {
14	  readonly id: CapabilityId;
15	  readonly label: string;
16	  readonly operation: string;
17	  readonly defaultTriggers: ReadonlyArray<ComplianceTrigger>;
18	}
19	
20	const REGISTRY: Map<CapabilityId, CapabilityDefinition> = new Map();
21	
22	export function registerCapability(definition: CapabilityDefinition): void {
23	  REGISTRY.set(definition.id, definition);
24	}
25	
26	export function getCapability(id: CapabilityId): CapabilityDefinition {
27	  const found = REGISTRY.get(id);
28	  if (!found) throw new Error(`Unknown capability: ${id}`);
29	  return found;
30	}
31	
32	export function listCapabilities(): CapabilityDefinition[] {
33	  return Array.from(REGISTRY.values());
34	}
35	
36	export function isCapabilityRegistered(id: string): boolean {
37	  return REGISTRY.has(id);
38	}
39	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/FieldMappingsEditor.tsx","limit":250}

{"command":"grep -r \"registerCapability\" /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src --include=\"*.ts\" | head -20"}

1	"use client";
2	
3	import React, { useState } from "react";
4	
5	import { ChevronDown, Plus, Trash2 } from "lucide-react";
6	
7	import { Button } from "@/app/components/ui/button";
8	import { Input } from "@/app/components/ui/input";
9	import { Textarea } from "@/app/components/ui/textarea";
10	import type {
11	  CreateExternalIntegrationFieldMapping,
12	  FieldMappingDirection,
13	  FieldMappingTransformation,
14	} from "@/app/types/admin";
15	import { useLMT } from "@/lib/lmt/config";
16	
17	export interface DataModelFieldLite {
18	  id: number;
19	  name: string;
20	  label: string;
21	  type?: string;
22	}
23	
24	const TRANSFORMATIONS: (FieldMappingTransformation | "")[] = [
25	  "",
26	  "dateFormat",
27	  "enumMapping",
28	  "currencyFormat",
29	  "phoneFormat",
30	  "booleanMapping",
31	  "genderMapping",
32	  "civilStatusMapping",
33	  "identificationTypeMapping",
34	  "statusMapping",
35	];
36	
37	interface Props {
38	  direction: FieldMappingDirection;
39	  mappings: CreateExternalIntegrationFieldMapping[];
40	  onChange: (mappings: CreateExternalIntegrationFieldMapping[]) => void;
41	  dataModelFields: DataModelFieldLite[];
42	}
43	
44	const FieldMappingsEditor: React.FC<Props> = ({
45	  direction,
46	  mappings,
47	  onChange,
48	  dataModelFields,
49	}) => {
50	  const { t } = useLMT();
51	  const rows = mappings.filter((m) => m.direction === direction);
52	  const otherDirection = mappings.filter((m) => m.direction !== direction);
53	  const [expandedIndex, setExpandedIndex] = useState<number | null>(null);
54	
55	  const update = (
56	    indexInDirection: number,
57	    patch: Partial<CreateExternalIntegrationFieldMapping>,
58	  ) => {
59	    const next = [...rows];
60	    next[indexInDirection] = { ...next[indexInDirection], ...patch };
61	    onChange([...otherDirection, ...next]);
62	  };
63	
64	  const remove = (indexInDirection: number) => {
65	    const next = rows.filter((_, i) => i !== indexInDirection);
66	    onChange([...otherDirection, ...next]);
67	    if (expandedIndex === indexInDirection) setExpandedIndex(null);
68	  };
69	
70	  const add = () => {
71	    const blank: CreateExternalIntegrationFieldMapping = {
72	      direction,
73	      providerFieldPath: direction === "request" ? "$.field" : "$.providerField",
74	      dataModelFieldId: null,
75	      customFieldName: "",
76	      transformationFunction: null,
77	      enumMapping: null,
78	      isRequired: false,
79	      defaultValue: null,
80	    };
81	    onChange([...otherDirection, ...rows, blank]);
82	    setExpandedIndex(rows.length);
83	  };
84	
85	  const isRequest = direction === "request";
86	  const arrow = isRequest ? "→" : "←";
87	  const badgeText = isRequest ? "OUT" : "IN";
88	  const badgeClass = isRequest
89	    ? "bg-emerald-50 text-emerald-700 ring-emerald-200"
90	    : "bg-blue-50 text-blue-700 ring-blue-200";
91	
92	  return (
93	    <div>
94	      <div className="mb-2 flex items-baseline justify-between">
95	        <h3 className="text-sm font-medium text-gray-900">
96	          {isRequest ? t("Outbound") : t("Inbound")}
97	        </h3>
98	        <span className="text-xs text-gray-500">
99	          {isRequest ? t("our data → provider body") : t("provider response → our shape")}
100	        </span>
101	      </div>
102	
103	      <div className="overflow-hidden rounded-lg border border-gray-200">
104	        {rows.length === 0 ? (
105	          <div className="px-3 py-6 text-center text-xs text-gray-500">
106	            {t("No mappings yet.")}
107	          </div>
108	        ) : (
109	          <ul className="divide-y divide-gray-200">
110	            {rows.map((row, i) => {
111	              const dmf = dataModelFields.find((d) => d.id === row.dataModelFieldId);
112	              const isExpanded = expandedIndex === i;
113	              const hasDataModel = row.dataModelFieldId !== null;
114	              const targetSummary = dmf?.name ?? row.customFieldName ?? "—";
115	              const hasExtras =
116	                (row.defaultValue && row.defaultValue.length > 0) ||
117	                row.isRequired ||
118	                row.transformationFunction === "enumMapping";
119	
120	              return (
121	                <li key={i} className="bg-white">
122	                  <div className="flex items-center gap-2 px-3 py-2 text-sm">
123	                    <span
124	                      className={`inline-flex items-center rounded px-1.5 py-0.5 font-mono text-[10px] font-semibold ring-1 ring-inset ${badgeClass}`}
125	                    >
126	                      {badgeText}
127	                    </span>
128	
129	                    <Input
130	                      value={row.providerFieldPath}
131	                      onChange={(e) => update(i, { providerFieldPath: e.target.value })}
132	                      placeholder="$.path"
133	                      className="h-8 flex-1 font-mono text-xs"
134	                    />
135	
136	                    <span className="text-gray-400">{arrow}</span>
137	
138	                    {hasDataModel ? (
139	                      <select
140	                        className="h-8 min-w-0 max-w-[180px] flex-1 truncate rounded-md border border-gray-300 bg-white px-2 text-xs"
141	                        value={String(row.dataModelFieldId ?? "")}
142	                        onChange={(e) => {
143	                          const v = e.target.value;
144	                          update(i, {
145	                            dataModelFieldId: v === "" ? null : Number(v),
146	                            customFieldName: v === "" ? row.customFieldName : null,
147	                          });
148	                        }}
149	                      >
150	                        {dataModelFields.map((f) => (
151	                          <option key={f.id} value={f.id}>
152	                            {f.name}
153	                          </option>
154	                        ))}
155	                        <option value="">— {t("custom")} —</option>
156	                      </select>
157	                    ) : (
158	                      <Input
159	                        value={row.customFieldName ?? ""}
160	                        onChange={(e) => update(i, { customFieldName: e.target.value || null })}
161	                        placeholder={isRequest ? "parties.0.firstName" : "entityId"}
162	                        className="h-8 flex-1 font-mono text-xs"
163	                        list={`dmf-${direction}-${i}`}
164	                      />
165	                    )}
166	
167	                    <select
168	                      className="h-8 w-24 rounded-md border border-gray-300 bg-white px-2 text-xs text-gray-700"
169	                      value={row.transformationFunction ?? ""}
170	                      onChange={(e) =>
171	                        update(i, {
172	                          transformationFunction:
173	                            e.target.value === ""
174	                              ? null
175	                              : (e.target.value as FieldMappingTransformation),
176	                        })
177	                      }
178	                    >
179	                      {TRANSFORMATIONS.map((tr) => (
180	                        <option key={tr || "none"} value={tr}>
181	                          {tr || t("none")}
182	                        </option>
183	                      ))}
184	                    </select>
185	
186	                    <button
187	                      type="button"
188	                      onClick={() =>
189	                        update(i, {
190	                          dataModelFieldId: hasDataModel ? null : dataModelFields[0]?.id ?? null,
191	                          customFieldName: hasDataModel ? "" : null,
192	                        })
193	                      }
194	                      className="text-[11px] text-gray-400 hover:text-gray-700"
195	                      title={hasDataModel ? t("Switch to custom path"

/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/capabilities/registry.ts:export function registerCapability(definition: CapabilityDefinition): void {
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runner.ts:import { registerCapability, type CapabilityId } from './capabilities/registry.js';
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runner.ts:registerCapability({
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runner.ts:registerCapability({
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runner.ts:registerCapability({
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runner.ts:registerCapability({
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runner.ts:registerCapability({

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts","limit":400}

1	export type DisableClaimAiAssessmentMode = "none" | "customer" | "all";
2	
3	export type OrganizationType = "insurer" | "broker" | "affinity";
4	
5	export interface Organization {
6	  id: string;
7	  name: string;
8	  displayName?: string;
9	  description?: string;
10	  portalDomain: string;
11	  portalUrl: string;
12	  apiUrl?: string;
13	  portalType: "customer" | "crm";
14	  portalMode: "standalone" | "embedded";
15	  active: boolean;
16	  timezone?: string;
17	  settings?: Record<string, unknown>;
18	  disableClaimAiAssessment?: DisableClaimAiAssessmentMode;
19	  disableClaimMessages?: boolean;
20	  organizationType: OrganizationType;
21	  parentOrganizationId: string | null;
22	  disablePolicyMessages?: boolean;
23	  createdAt: string;
24	  updatedAt: string;
25	}
26	
27	import { RoleLevel } from './permissions';
28	
29	export type CreateOrganization = Omit<
30	  Organization,
31	  "id" | "createdAt" | "updatedAt" | "organizationType" | "parentOrganizationId"
32	> & {
33	  organizationType?: OrganizationType;
34	  parentOrganizationId?: string | null;
35	};
36	export type UpdateOrganization = Partial<CreateOrganization>;
37	
38	export type ModuleCategory = "core" | "business" | "admin" | "analytics" | "integration";
39	
40	export interface ModuleDef {
41	  id: number;
42	  key: string;
43	  name: string;
44	  description?: string;
45	  icon?: string;
46	  route: string;
47	  category: ModuleCategory;
48	  sortOrder?: number;
49	  requiredRole?: RoleLevel;
50	  active: boolean;
51	}
52	
53	export type CreateModuleDef = Omit<ModuleDef, "id">;
54	export type UpdateModuleDef = Partial<CreateModuleDef>;
55	
56	export interface Partner {
57	  id: string;
58	  name: string;
59	  createdAt: string;
60	  updatedAt: string;
61	}
62	
63	export type CreatePartner = Omit<Partner, "id" | "createdAt" | "updatedAt">;
64	export type UpdatePartner = Partial<CreatePartner>;
65	
66	export type PartnerEnvironmentType = "test" | "staging" | "production";
67	
68	export interface PartnerEnvironment {
69	  id: string;
70	  partnerId: string;
71	  environment: PartnerEnvironmentType;
72	  baseUrl: string;
73	  authEndpoint?: string;
74	  tokenEndpoint?: string;
75	}
76	
77	export type CreatePartnerEnvironment = Omit<PartnerEnvironment, "id">;
78	export type UpdatePartnerEnvironment = Partial<CreatePartnerEnvironment>;
79	
80	export type AuthType =
81	  | "client_credentials"
82	  | "username_password"
83	  | "api_key"
84	  | "basic_auth"
85	  | "oauth2_code"
86	  | "custom";
87	
88	export type TokenType = "bearer" | "basic" | "custom";
89	
90	export interface PartnerAuthConfig {
91	  id: string;
92	  partnerEnvironmentId: string;
93	  authType: AuthType;
94	  tokenType: TokenType;
95	  authorizationHeaderFormat?: string;
96	  encryptedCredentials?: string;
97	  active: boolean;
98	}
99	
100	export interface CreatePartnerAuthConfig {
101	  partnerEnvironmentId: string;
102	  authType:
103	    | "client_credentials"
104	    | "username_password"
105	    | "api_key"
106	    | "basic_auth"
107	    | "oauth2_code"
108	    | "custom";
109	  tokenType: "bearer" | "basic" | "custom";
110	  authorizationHeaderFormat?: string;
111	  active: boolean;
112	  // Credential fields (based on authType)
113	  username?: string;
114	  password?: string;
115	  clientId?: string;
116	  clientSecret?: string;
117	  apiKey?: string;
118	}
119	
120	export interface UpdatePartnerAuthConfig {
121	  authType?:
122	    | "client_credentials"
123	    | "username_password"
124	    | "api_key"
125	    | "basic_auth"
126	    | "oauth2_code"
127	    | "custom";
128	  tokenType?: "bearer" | "basic" | "custom";
129	  authorizationHeaderFormat?: string;
130	  active?: boolean;
131	  // Credential fields (only sent if updating)
132	  username?: string;
133	  password?: string;
134	  clientId?: string;
135	  clientSecret?: string;
136	  apiKey?: string;
137	}
138	
139	export interface OrganizationModuleAssignment {
140	  id: number;
141	  organizationId: string;
142	  moduleId: number;
143	  active: boolean;
144	  settings?: Record<string, unknown>;
145	  usePartnerApi?: boolean;
146	  lastAccessed?: string;
147	}
148	
149	export type CreateOrganizationModuleAssignment = Omit<OrganizationModuleAssignment, "id">;
150	export type UpdateOrganizationModuleAssignment = Partial<CreateOrganizationModuleAssignment>;
151	
152	export type HttpMethod = "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
153	
154	export interface ModuleEndpoint {
155	  id: number;
156	  moduleId: number;
157	  method: HttpMethod;
158	  urlPattern: string;
159	  controller?: string;
160	  apiVersion?: string;
161	  functionName?: string;
162	  description?: string;
163	}
164	
165	export type CreateModuleEndpoint = Omit<ModuleEndpoint, "id">;
166	export type UpdateModuleEndpoint = Partial<CreateModuleEndpoint>;
167	
168	export interface PartnerEndpointMapping {
169	  id: number;
170	  partnerId: string;
171	  moduleEndpointId: number;
172	  urlPattern?: string;
173	  active?: boolean;
174	  executionOrder?: number;
175	  excludeFromAutoLoading?: boolean;
176	  httpMethod?: HttpMethod;
177	  urlTemplate?: string;
178	  requestBodyTemplate?: string | null;
179	  responseMapping?: string | null;
180	  dependsOnEndpoint?: number | null;
181	  parameterTransformations?: string | null;
182	}
183	
184	export type CreatePartnerEndpointMapping = Omit<PartnerEndpointMapping, "id">;
185	export type UpdatePartnerEndpointMapping = Partial<CreatePartnerEndpointMapping>;
186	
187	export interface PartnerFieldMapping {
188	  id: number;
189	  partnerEndpointMappingId: number;
190	  partnerFieldPath: string;
191	  dataModelFieldId?: number;
192	  customFieldName?: string;
193	  transformationFunction?: string;
194	  isRequired?: boolean;
195	  defaultValue?: string;
196	  enumMapping?: Record<string, string> | null;
197	  direction?: "request" | "response";
198	}
199	
200	export type CreatePartnerFieldMapping = Omit<PartnerFieldMapping, "id">;
201	export type UpdatePartnerFieldMapping = Partial<CreatePartnerFieldMapping>;
202	
203	export interface ProductModulePartner {
204	  id: number;
205	  productId: number;
206	  moduleId: number;
207	  partnerId: string;
208	  module?: ModuleDef;
209	  partner?: Partner;
210	  createdAt?: string;
211	  updatedAt?: string;
212	}
213	
214	export type CreateProductModulePartner = Omit<
215	  ProductModulePartner,
216	  "id" | "module" | "partner" | "createdAt" | "updatedAt"
217	>;
218	export type UpdateProductModulePartner = Partial<Pick<ProductModulePartner, "partnerId">>;
219	
220	export interface PagedResponse<T> {
221	  status: "success" | "error";
222	  data?: {
223	    items: T[];
224	    total: number;
225	    page: number;
226	    pageSize: number;
227	  };
228	  message?: string;
229	}
230	
231	export interface ListResponse<T> {
232	  status: "success" | "error";
233	  data?: T[];
234	  message?: string;
235	}
236	
237	// ─── External integrations (outbound third-party API framework) ──────────────
238	
239	export type IntegrationCapability =
240	  | "sanction_screening"
241	  | "pep"
242	  | "kyc"
243	  | "adverse_media"
244	  | "fraud_detection";
245	
246	// Operations a capability supports. Today every compliance capability has a
247	// single 'check' operation; widen this when a capability gains more.
248	export const CAPABILITY_OPERATIONS: Record<IntegrationCapability, readonly string[]> = {
249	  sanction_screening: ["check"],
250	  pep: ["check"],
251	  kyc: ["check"],
252	  adverse_media: ["check"],
253	  fraud_detection: ["check"],
254	};
255	export type IntegrationKind = "generic_rest";
256	export type IntegrationEnvironment = "test" | "staging" | "production";
257	
258	export type IntegrationInvocationMode = "sync" | "async";
259	
260	// Sensible per-capability defaults. Slow review-style providers default to
261	// async so the customer isn't blocked behind document review.
262	export const CAPABILITY_DEFAULT_INVOCATION_MODE: Record<IntegrationCapability, IntegrationInvocationMode> = {
263	  sanction_

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runner.ts","limit":250}

1	import crypto from 'node:crypto';
2	import { StatusError } from '@/error/error.js';
3	import { ExternalIntegration } from '@/models/ExternalIntegration.js';
4	import type { _ExternalIntegration } from '@/models/ExternalIntegration.js';
5	import { ExternalIntegrationEnvironment } from '@/models/ExternalIntegrationEnvironment.js';
6	import type { _ExternalIntegrationEnvironment } from '@/models/ExternalIntegrationEnvironment.js';
7	import { ExternalIntegrationAuthConfig } from '@/models/ExternalIntegrationAuthConfig.js';
8	import type { _ExternalIntegrationAuthConfig } from '@/models/ExternalIntegrationAuthConfig.js';
9	import { getKind, registerKind } from './kinds/registry.js';
10	import { genericRestAdapter } from './kinds/genericRest/adapter.js';
11	import { registerCapability, type CapabilityId } from './capabilities/registry.js';
12	
13	// Boot the runtime registries once at module load.
14	registerKind('generic_rest', genericRestAdapter);
15	registerCapability({
16	  id: 'sanction_screening',
17	  label: 'Sanction Screening',
18	  operation: 'check',
19	  defaultTriggers: ['NEW_BUSINESS', 'RENEWAL'],
20	});
21	registerCapability({
22	  id: 'pep',
23	  label: 'PEP Check',
24	  operation: 'check',
25	  defaultTriggers: ['NEW_BUSINESS', 'RENEWAL'],
26	});
27	registerCapability({
28	  id: 'kyc',
29	  label: 'KYC Verification',
30	  operation: 'check',
31	  defaultTriggers: ['NEW_BUSINESS'],
32	});
33	registerCapability({
34	  id: 'adverse_media',
35	  label: 'Adverse Media',
36	  operation: 'check',
37	  defaultTriggers: ['NEW_BUSINESS', 'RENEWAL'],
38	});
39	registerCapability({
40	  id: 'fraud_detection',
41	  label: 'Fraud Detection',
42	  operation: 'check',
43	  defaultTriggers: ['CLAIM'],
44	});
45	
46	export interface InvokeArgs {
47	  organizationId: string;
48	  capability: CapabilityId;
49	  operation: string;
50	  input: Record<string, unknown>;
51	  environmentOverride?: 'test' | 'staging' | 'production';
52	  correlationId?: string;
53	  integrationSlug?: string;
54	}
55	
56	export interface InvokeRunnerResult {
57	  integrationId: string;
58	  integrationSlug: string;
59	  output: Record<string, unknown>;
60	  httpStatus: number | null;
61	  durationMs: number;
62	  attempts: number;
63	  rawResponseBody: unknown;
64	  correlationId: string;
65	}
66	
67	async function resolveIntegration(args: InvokeArgs): Promise<_ExternalIntegration> {
68	  const where: Record<string, unknown> = {
69	    capability: args.capability,
70	    active: true,
71	  };
72	  if (args.integrationSlug) where.slug = args.integrationSlug;
73	
74	  const candidates = await ExternalIntegration.findAll(
75	    { organizationId: args.organizationId },
76	    {
77	      where,
78	      order: [['createdAt', 'ASC']],
79	    },
80	  );
81	  if (candidates.length === 0) {
82	    throw new StatusError(
83	      404,
84	      `No active ExternalIntegration for capability ${args.capability} (org ${args.organizationId})`,
85	    );
86	  }
87	  if (candidates.length > 1 && !args.integrationSlug) {
88	    throw new StatusError(
89	      409,
90	      `Multiple active integrations for capability ${args.capability}; pass integrationSlug to disambiguate`,
91	    );
92	  }
93	  return candidates[0];
94	}
95	
96	async function resolveEnvironment(
97	  integration: _ExternalIntegration,
98	  override: 'test' | 'staging' | 'production' | undefined,
99	): Promise<_ExternalIntegrationEnvironment> {
100	  const environment = override ?? integration.defaultEnvironment;
101	  const env = await ExternalIntegrationEnvironment.findOne(
102	    { organizationId: integration.organizationId },
103	    { where: { integrationId: integration.id, environment } },
104	  );
105	  if (!env) {
106	    throw new StatusError(
107	      404,
108	      `Integration ${integration.slug} has no environment ${environment}`,
109	    );
110	  }
111	  return env;
112	}
113	
114	async function resolveAuthConfig(
115	  env: _ExternalIntegrationEnvironment,
116	  organizationId: string,
117	): Promise<_ExternalIntegrationAuthConfig> {
118	  const config = await ExternalIntegrationAuthConfig.findOne(
119	    { organizationId },
120	    {
121	      where: { environmentId: env.id, active: true },
122	      order: [['createdAt', 'DESC']],
123	    },
124	  );
125	  if (!config) {
126	    throw new StatusError(400, `Environment ${env.id} has no active auth config`);
127	  }
128	  return config;
129	}
130	
131	// Execute a capability operation against the integration configured for the
132	// caller's organisation. Returns mapped output + raw response.
133	export async function invoke(args: InvokeArgs): Promise<InvokeRunnerResult> {
134	  const integration = await resolveIntegration(args);
135	  const environment = await resolveEnvironment(integration, args.environmentOverride);
136	  const authConfig = await resolveAuthConfig(environment, integration.organizationId);
137	  const adapter = getKind(integration.kind);
138	  const correlationId = args.correlationId ?? crypto.randomUUID();
139	
140	  const result = await adapter({
141	    integration,
142	    environment,
143	    authConfig,
144	    operation: args.operation,
145	    input: args.input,
146	    correlationId,
147	  });
148	
149	  return {
150	    integrationId: integration.id,
151	    integrationSlug: integration.slug,
152	    output: result.output,
153	    httpStatus: result.httpStatus,
154	    durationMs: result.durationMs,
155	    attempts: result.attempts,
156	    rawResponseBody: result.rawResponseBody,
157	    correlationId,
158	  };
159	}
160	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts","offset":400,"limit":300}

400	  customFieldName: string | null;
401	  transformationFunction: FieldMappingTransformation | null;
402	  enumMapping: Record<string, string> | null;
403	  isRequired: boolean;
404	  defaultValue: string | null;
405	}
406	
407	export type IntegrationCallStatus = "success" | "error" | "timeout" | "circuit_open";
408	
409	export interface ExternalIntegrationCallLog {
410	  id: string;
411	  integrationId: string;
412	  organizationId: string;
413	  capability: IntegrationCapability;
414	  operation: string;
415	  correlationId: string;
416	  status: IntegrationCallStatus;
417	  httpStatus: number | null;
418	  durationMs: number;
419	  attempts: number;
420	  requestExcerpt: Record<string, unknown> | null;
421	  responseExcerpt: Record<string, unknown> | null;
422	  errorMessage: string | null;
423	  createdAt: string;
424	}
425	
426	// ─── Sanction screening ───────────────────────────────────────────────────────
427	
428	export type SanctionScreeningStatus =
429	  | "pending"
430	  | "processing"
431	  | "completed"
432	  | "failed";
433	export type SanctionScreeningOutcome = "pass" | "fail" | "review";
434	export type SanctionScreeningManualDecision = "approved" | "rejected";
435	export type SanctionScreeningTriggerType =
436	  | "NEW_BUSINESS"
437	  | "RENEWAL"
438	  | "ENDORSEMENT"
439	  | "CLAIM"
440	  | "MANUAL";
441	
442	export interface ScreenedParty {
443	  role: "policyholder" | "insured" | "beneficiary";
444	  sourcePath: string;
445	  data: Record<string, unknown>;
446	}
447	
448	export interface ScreeningFinding {
449	  entityId: string;
450	  entityName: string;
451	  score: number;
452	  topics: string[];
453	  datasets: string[];
454	  sourceUrl: string | null;
455	}
456	
457	export interface SanctionScreening {
458	  id: string;
459	  organizationId: string;
460	  productId: number;
461	  integrationId: string;
462	  capability: string;
463	  triggerType: SanctionScreeningTriggerType;
464	  previousPolicyId: string | null;
465	  rootPolicyId: string | null;
466	  policyOrderId: string | null;
467	  claimRecordId: string | null;
468	  customerId: string | null;
469	  issuanceContext: Record<string, unknown>;
470	  screenedParties: ScreenedParty[];
471	  status: SanctionScreeningStatus;
472	  outcome: SanctionScreeningOutcome | null;
473	  manualDecision: SanctionScreeningManualDecision | null;
474	  manualDecisionBy: string | null;
475	  manualDecisionAt: string | null;
476	  manualDecisionNote: string | null;
477	  findings: ScreeningFinding[] | null;
478	  rawResponse: unknown;
479	  error: string | null;
480	  correlationId: string | null;
481	  createdAt: string;
482	  updatedAt: string;
483	}
484	

{"pattern":"SanctionScreening|interface.*Screening","path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts","output_mode":"content","head_limit":100}

428:export type SanctionScreeningStatus =
433:export type SanctionScreeningOutcome = "pass" | "fail" | "review";
434:export type SanctionScreeningManualDecision = "approved" | "rejected";
435:export type SanctionScreeningTriggerType =
448:export interface ScreeningFinding {
457:export interface SanctionScreening {
463:  triggerType: SanctionScreeningTriggerType;
471:  status: SanctionScreeningStatus;
472:  outcome: SanctionScreeningOutcome | null;
473:  manualDecision: SanctionScreeningManualDecision | null;

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_Product.ts","limit":300}

1	'use strict';
2	import {
3	  Table,
4	  Column,
5	  Model,
6	  BelongsTo,
7	  ForeignKey,
8	  DataType,
9	  HasMany,
10	} from 'sequelize-typescript';
11	import { _CommissionStructure } from './_CommissionStructure.js';
12	import { Country } from '../Country';
13	import { Insurer } from '../Insurer.js';
14	import { InsuranceType } from '../InsuranceType';
15	import { Organization } from '../Organization';
16	import { _Policy } from './_Policy.js';
17	import { _ProductModulePartner } from './_ProductModulePartner.js';
18	import { ProductOptimization } from '../ProductOptimization.js';
19	import { _ProductPlan } from './_ProductPlan.js';
20	import { _ProductSetting } from './_ProductSetting.js';
21	import { _Quote } from './_Quote.js';
22	import { _Simulation } from './_Simulation.js';
23	import { User } from '../User';
24	
25	export interface ProductDocumentRef {
26	  key: string;
27	  label: string;
28	  dataFileId: string;
29	  locale: string;
30	  order: number;
31	}
32	
33	export type ComplianceTrigger =
34	  | 'NEW_BUSINESS'
35	  | 'RENEWAL'
36	  | 'ENDORSEMENT'
37	  | 'CLAIM'
38	  | 'MANUAL';
39	
40	// Per-capability compliance config. `parties` lists DataModelField paths
41	// (e.g. 'personal', 'insureds'); runner reads each path and forwards it to
42	// the integration's outbound mapping, which handles provider translation.
43	export interface ProductCapabilityConfig {
44	  enabled: boolean;
45	  integrationId: string;
46	  triggers: ComplianceTrigger[];
47	  parties: {
48	    policyholder: string;
49	    additional: string[];
50	  };
51	  outcomeRules: {
52	    passWhen: { maxScore: number };
53	    failWhen: { minScore: number; onTopics: string[] };
54	  };
55	  // When outcome=fail, automatically transition the parent policy to
56	  // compliance_blocked instead of leaving it parked for manual admin review.
57	  autoReject?: boolean;
58	  // Plain-text messages sent to the customer (portal notification + email).
59	  // `fail` fires only when autoReject is true and outcome=fail. `review` fires
60	  // when outcome=review OR outcome=fail with autoReject=false.
61	  messages?: {
62	    fail?: string | null;
63	    review?: string | null;
64	  };
65	}
66	
67	export type ProductComplianceChecks = Record<string, ProductCapabilityConfig>;
68	
69	@Table({
70	  modelName: 'Product',
71	  paranoid: true,
72	  indexes: [
73	    {
74	      unique: true,
75	      fields: ['productName', 'organizationId', 'version'],
76	      name: 'unique_product_name_organization_version',
77	    },
78	    {
79	      fields: ['insuranceTypeId'],
80	      name: 'idx_product_insurance_type',
81	    },
82	    {
83	      fields: ['country'],
84	      name: 'idx_product_country',
85	    },
86	    {
87	      fields: ['organizationId', 'startDate', 'endDate'],
88	      name: 'idx_product_date_range',
89	    },
90	  ],
91	})
92	export class _Product extends Model {
93	  @Column({
94	    type: DataType.INTEGER,
95	    autoIncrement: true,
96	    primaryKey: true,
97	  })
98	  declare id: number;
99	  @Column({
100	    type: DataType.STRING,
101	    allowNull: false,
102	    validate: {
103	      notEmpty: true,
104	    },
105	  })
106	  declare productTitle: string;
107	
108	  @Column({
109	    type: DataType.STRING,
110	    allowNull: false,
111	    validate: {
112	      notEmpty: true,
113	    },
114	  })
115	  declare productName: string;
116	
117	  @Column({
118	    type: DataType.TEXT,
119	    allowNull: true,
120	  })
121	  declare productDescription?: string;
122	
123	  @ForeignKey(() => Country)
124	  @Column({
125	    type: DataType.STRING(2),
126	    allowNull: false,
127	    defaultValue: 'US',
128	    validate: {
129	      isUppercase: true,
130	      len: [2, 2],
131	    },
132	  })
133	  declare country: string;
134	
135	  @Column({
136	    type: DataType.JSONB,
137	    allowNull: false,
138	    defaultValue: [],
139	  })
140	  declare availableCountries: string[];
141	
142	  @ForeignKey(() => InsuranceType)
143	  @Column({
144	    type: DataType.INTEGER,
145	    allowNull: false,
146	  })
147	  declare insuranceTypeId: number;
148	
149	  @Column({
150	    type: DataType.STRING,
151	    allowNull: false,
152	    defaultValue: 'USD',
153	  })
154	  declare currency: string;
155	
156	  @Column({
157	    type: DataType.STRING,
158	    allowNull: false,
159	    defaultValue: 'USD',
160	  })
161	  declare inputCurrency: string;
162	
163	  @Column({
164	    type: DataType.ENUM('prefix', 'suffix'),
165	    allowNull: false,
166	    defaultValue: 'prefix',
167	  })
168	  declare currencyPosition: 'prefix' | 'suffix';
169	
170	  @Column({
171	    type: DataType.STRING(1),
172	    allowNull: false,
173	    defaultValue: ',',
174	    validate: {
175	      isIn: [['.', ',']],
176	    },
177	  })
178	  declare decimalSeparator: string;
179	
180	  @Column({
181	    type: DataType.STRING(1),
182	    allowNull: false,
183	    defaultValue: '.',
184	    validate: {
185	      isIn: [['.', ',']],
186	    },
187	  })
188	  declare groupSeparator: string;
189	
190	  @Column({
191	    type: DataType.INTEGER,
192	    allowNull: false,
193	    defaultValue: 2,
194	  })
195	  declare decimalsAmount: number;
196	
197	  @Column({
198	    type: DataType.ENUM(
199	      'DD/MM/YYYY',
200	      'DD-MM-YYYY',
201	      'DD.MM.YYYY',
202	      'DD MMMM YYYY',
203	      'MM/DD/YYYY',
204	      'MM-DD-YYYY',
205	      'MMMM DD, YYYY',
206	      'YYYY-MM-DD'
207	    ),
208	    allowNull: false,
209	    defaultValue: 'DD/MM/YYYY',
210	  })
211	  declare dateFormat: 'DD/MM/YYYY' | 'DD-MM-YYYY' | 'DD.MM.YYYY' | 'DD MMMM YYYY' | 'MM/DD/YYYY' | 'MM-DD-YYYY' | 'MMMM DD, YYYY' | 'YYYY-MM-DD';
212	
213	  @Column({
214	    type: DataType.BOOLEAN,
215	    allowNull: false,
216	    defaultValue: true,
217	  })
218	  declare active: boolean;
219	
220	  @Column({
221	    type: DataType.STRING(50),
222	    allowNull: false,
223	    defaultValue: 'internal',
224	  })
225	  declare paymentProvider: string;
226	
227	  @Column({
228	    type: DataType.JSONB,
229	    allowNull: false,
230	    defaultValue: [],
231	  })
232	  declare paymentMethods: string[];
233	
234	  @Column({
235	    type: DataType.JSONB,
236	    allowNull: true,
237	  })
238	  declare activeLocales: string[] | null;
239	
240	  @Column({
241	    type: DataType.JSONB,
242	    allowNull: true,
243	  })
244	  declare translationOverrides: Record<string, Record<string, string>> | null;
245	
246	  @Column({
247	    type: DataType.STRING(10),
248	    allowNull: false,
249	    defaultValue: 'en',
250	  })
251	  declare sourceLocale: string;
252	
253	  @Column({
254	    type: DataType.STRING(32),
255	    allowNull: false,
256	    defaultValue: 'redirect',
257	    validate: {
258	      isIn: [['redirect', 'iframe']],
259	    },
260	  })
261	  declare paymentUiMode: 'redirect' | 'iframe';
262	
263	  @Column({
264	    type: DataType.BOOLEAN,
265	    allowNull: false,
266	    defaultValue: true,
267	  })
268	  declare isEmbedded: boolean;
269	
270	  @Column({
271	    type: DataType.STRING,
272	    allowNull: true,
273	  })
274	  declare primaryProductTitle?: string;
275	
276	  @ForeignKey(() => User)
277	  @Column({
278	    type: DataType.UUID,
279	    allowNull: true,
280	  })
281	  declare userId?: string;
282	
283	  @ForeignKey(() => Organization)
284	  @Column({
285	    type: DataType.UUID,
286	    allowNull: false,
287	  })
288	  declare organizationId: string;
289	
290	  @ForeignKey(() => Insurer)
291	  @Column({
292	    type: DataType.INTEGER,
293	    allowNull: true,
294	  })
295	  declare insurerId?: number;
296	
297	  @Column({
298	    type: DataType.BOOLEAN,
299	    allowNull: false,
300	    defaultValue: false,

{"pattern":"ProductComplianceChecks|ProductCapabilityConfig|ComplianceTrigger","path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/product.ts","output_mode":"content","head_limit":150}

64:  complianceChecks?: ProductComplianceChecks | null;
67:export type ComplianceTrigger =
74:export interface ProductCapabilityConfig {
77:  triggers: ComplianceTrigger[];
93:export type ProductComplianceChecks = Record<string, ProductCapabilityConfig>;

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_Product.ts","offset":300,"limit":200}

300	    defaultValue: false,
301	  })
302	  declare autoCreatePolicy: boolean;
303	
304	  @Column({
305	    type: DataType.BOOLEAN,
306	    allowNull: false,
307	    defaultValue: false,
308	  })
309	  declare sendEmails: boolean;
310	
311	  /**
312	   * When true and the product is consumed by the automated CSV/SFTP import
313	   * (see `automatedPolicyService`), each imported row produces a PolicyOrder
314	   * in the org's PENDING lifecycle category instead of the org's ACTIVE
315	   * default. The customer is then driven to the existing /accept flow (which
316	   * mints an embed-checkout session and collects payment) before the policy
317	   * activates. Klimber-style integrations that bill outside Sherpa keep this
318	   * false; bank-of-the-loan integrations (premium collected directly by
319	   * Sherpa, no API on the partner side) flip it to true.
320	   */
321	  @Column({
322	    type: DataType.BOOLEAN,
323	    allowNull: false,
324	    defaultValue: false,
325	  })
326	  declare collectsPaymentOnImport: boolean;
327	
328	  @Column({
329	    type: DataType.INTEGER,
330	    allowNull: false,
331	    defaultValue: 1,
332	  })
333	  declare version: number;
334	
335	  @Column({
336	    type: DataType.DATE,
337	    allowNull: false,
338	  })
339	  declare startDate: Date;
340	
341	  @Column({
342	    type: DataType.DATE,
343	    allowNull: true,
344	  })
345	  declare endDate: Date | null;
346	
347	  @Column({
348	    type: DataType.BIGINT,
349	    allowNull: true,
350	  })
351	  declare policyNumberSequence: number | null;
352	
353	  @Column({
354	    type: DataType.STRING(20),
355	    allowNull: true,
356	  })
357	  declare policyNumberPrefix: string | null;
358	
359	  @Column({
360	    type: DataType.INTEGER,
361	    allowNull: true,
362	    defaultValue: 1000,
363	  })
364	  declare invoiceNumberSequence: number | null;
365	
366	  @Column({
367	    type: DataType.INTEGER,
368	    allowNull: true,
369	  })
370	  declare renewalWindowDays: number | null;
371	
372	  @Column({
373	    type: DataType.JSONB,
374	    allowNull: false,
375	    defaultValue: [],
376	  })
377	  declare documents: ProductDocumentRef[];
378	
379	  @Column({
380	    type: DataType.JSONB,
381	    allowNull: true,
382	  })
383	  declare complianceChecks: ProductComplianceChecks | null;
384	
385	  @Column({
386	    type: DataType.JSONB,
387	    allowNull: false,
388	    defaultValue: [],
389	  })
390	  declare displayCurrencies: string[];
391	
392	  @Column({
393	    type: DataType.JSONB,
394	    allowNull: false,
395	    defaultValue: [],
396	  })
397	  declare pricingCurrencies: string[];
398	
399	  @BelongsTo(() => User)
400	  declare user?: User;
401	
402	  @BelongsTo(() => Organization)
403	  declare organization?: Organization;
404	
405	  @BelongsTo(() => InsuranceType)
406	  declare insuranceType?: InsuranceType;
407	
408	  @BelongsTo(() => Country)
409	  declare countryData?: Country;
410	
411	  @BelongsTo(() => Insurer)
412	  declare insurer?: Insurer;
413	
414	  @HasMany(() => _Quote)
415	  declare quotes?: _Quote[];
416	
417	  @HasMany(() => _ProductPlan)
418	  declare productPlans?: _ProductPlan[];
419	
420	  // Add proper HasMany relationships for the missing models
421	  @HasMany(() => _Policy, {
422	    foreignKey: 'productId',
423	    as: 'policies',
424	  })
425	  declare policies?: _Policy[];
426	
427	  @HasMany(() => _CommissionStructure, {
428	    foreignKey: 'productId',
429	    as: 'commissionStructures',
430	  })
431	  declare commissionStructures?: _CommissionStructure[];
432	
433	  @HasMany(() => _Simulation, {
434	    foreignKey: 'productId',
435	    as: 'simulations',
436	  })
437	  declare simulations?: _Simulation[];
438	
439	  @HasMany(() => _ProductModulePartner, {
440	    foreignKey: 'productId',
441	    as: 'productModulePartners',
442	  })
443	  declare productModulePartners?: _ProductModulePartner[];
444	
445	  @HasMany(() => _ProductSetting)
446	  declare settings?: _ProductSetting[];
447	
448	  @HasMany(() => ProductOptimization)
449	  declare productOptimizations?: ProductOptimization[];
450	}
451	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/product.ts","limit":120}

1	export interface ProductData {
2	  id: number;
3	  productTitle: string;
4	  productName: string;
5	  productDescription: string | null;
6	  country: string;
7	  availableCountries?: string[];
8	  productType: string;
9	  currency: string;
10	  inputCurrency?: string;
11	  displayCurrencies?: string[];
12	  pricingCurrencies?: string[];
13	  active: boolean;
14	  version: number;
15	  startDate: string;
16	  endDate: string | null;
17	  isCurrent?: boolean;
18	  userId?: string;
19	  createdAt: string;
20	  updatedAt: string;
21	  isEmbedded?: boolean;
22	  primaryProductTitle?: string;
23	  insuranceTypeId?: string;
24	  insuranceType?: {
25	    id: number;
26	    name: string;
27	    title: string;
28	  };
29	  organizationId?: string;
30	  organization?: {
31	    id: string;
32	    name: string;
33	    displayName: string;
34	  };
35	  policyNumberPrefix?: string;
36	  policyNumberSequence?: string;
37	  autoCreatePolicy?: boolean;
38	  sendEmails?: boolean;
39	  collectsPaymentOnImport?: boolean;
40	  renewalWindowDays?: number;
41	  insurerId?: number;
42	  insurer?: {
43	    id: number;
44	    name: string;
45	  };
46	  currencyPosition?: "prefix" | "suffix";
47	  decimalSeparator?: string;
48	  groupSeparator?: string;
49	  decimalsAmount?: number;
50	  dateFormat?: string;
51	  paymentProvider?: string;
52	  paymentMethods?: string[];
53	  activeLocales?: string[] | null;
54	  sourceLocale?: string;
55	  translationOverrides?: Record<string, Record<string, string>> | null;
56	  paymentUiMode?: "redirect" | "iframe";
57	  user?: {
58	    id: string;
59	    firstName: string;
60	    lastName: string;
61	    email: string;
62	  };
63	  documents?: ProductDocument[];
64	  complianceChecks?: ProductComplianceChecks | null;
65	}
66	
67	export type ComplianceTrigger =
68	  | "NEW_BUSINESS"
69	  | "RENEWAL"
70	  | "ENDORSEMENT"
71	  | "CLAIM"
72	  | "MANUAL";
73	
74	export interface ProductCapabilityConfig {
75	  enabled: boolean;
76	  integrationId: string;
77	  triggers: ComplianceTrigger[];
78	  parties: {
79	    policyholder: string;
80	    additional: string[];
81	  };
82	  outcomeRules: {
83	    passWhen: { maxScore: number };
84	    failWhen: { minScore: number; onTopics: string[] };
85	  };
86	  autoReject?: boolean;
87	  messages?: {
88	    fail?: string | null;
89	    review?: string | null;
90	  };
91	}
92	
93	export type ProductComplianceChecks = Record<string, ProductCapabilityConfig>;
94	
95	export interface ProductDocument {
96	  key: string;
97	  label: string;
98	  dataFileId: string;
99	  locale: string;
100	  order: number;
101	}
102	
103	export interface ProductListResponse {
104	  status: string;
105	  data: {
106	    products: ProductData[];
107	    currentPage: number;
108	    totalPages: number;
109	    totalCount: number;
110	  };
111	}
112	
113	export interface ProductLibraryTemplate {
114	  title?: string;
115	  name?: string;
116	  description?: string | null;
117	  templateType?: string;
118	  active?: boolean;
119	}
120	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes/plus/sanctionScreeningRoutes.ts","limit":150}

1	import type { FastifyInstance, FastifyPluginAsync } from 'fastify';
2	import { Type } from '@sinclair/typebox';
3	import Valkey from 'iovalkey';
4	import { getRequired } from '../../../lib.js';
5	import { StatusError } from '@/error/error.js';
6	import logger from '@/logger';
7	import { ComplianceCheck } from '@/models/ComplianceCheck.js';
8	import { screeningChannel } from '@/services/sanctionScreeningService.js';
9	import {
10	  listScreenings,
11	  pendingReviewCount,
12	  getScreeningById,
13	  decideScreening,
14	  rerunComplianceCheckHandler,
15	  type DecisionBody,
16	  type ListScreeningsQuery,
17	} from '@/controllers/sanctionScreeningController.js';
18	import { PERMISSIONS } from '@/types/permissions.js';
19	
20	const VALKEY_HOST = getRequired('VALKEY_HOST');
21	const VALKEY_PORT = parseInt(getRequired('VALKEY_PORT'));
22	const VALKEY_DB = parseInt(getRequired('VALKEY_DB'));
23	
24	const decisionBodySchema = {
25	  type: 'object',
26	  required: ['decision', 'note'],
27	  additionalProperties: false,
28	  properties: {
29	    decision: { type: 'string', enum: ['approve', 'reject', 'request_info'] },
30	    note: { type: ['string', 'null'], maxLength: 4000 },
31	    message: { type: ['string', 'null'], maxLength: 8000 },
32	    attachments: {
33	      type: 'array',
34	      items: {
35	        type: 'object',
36	        required: ['blobPath', 'filename', 'contentType'],
37	        additionalProperties: false,
38	        properties: {
39	          blobPath: { type: 'string', maxLength: 1000 },
40	          filename: { type: 'string', maxLength: 500 },
41	          contentType: { type: 'string', maxLength: 200 },
42	        },
43	      },
44	      maxItems: 10,
45	    },
46	  },
47	} as const;
48	
49	export const sanctionScreeningRoutes: FastifyPluginAsync = async (fastify: FastifyInstance) => {
50	  // Read endpoints (list / get / SSE) are accessible to any authenticated user
51	  // in the caller's organisation — tenant scoping is enforced by the
52	  // safe-model wrapper. Decision and rerun endpoints keep their own
53	  // requirePermission(integrations.update) preHandlers below.
54	  fastify.addHook('preHandler', fastify.authenticate);
55	
56	  fastify.get<{ Querystring: ListScreeningsQuery }>('/', {
57	    schema: {
58	      description:
59	        'List sanction screenings for the caller\'s organisation. Use `pendingReview=true` for the admin queue: outcomes that block (fail or review) and have no manual decision yet.',
60	      tags: ['Sherpa Plus — Sanction Screening'],
61	      security: [{ clientCredentials: [] }],
62	      querystring: {
63	        type: 'object',
64	        required: ['limit'],
65	        additionalProperties: false,
66	        properties: {
67	          status: { type: 'string', enum: ['pending', 'processing', 'completed', 'failed'] },
68	          outcome: { type: 'string', enum: ['pass', 'fail', 'review'] },
69	          manualDecision: { type: 'string', enum: ['approved', 'rejected', 'none'] },
70	          productId: { type: 'integer' },
71	          triggerType: { type: 'string', enum: ['NEW_BUSINESS', 'RENEWAL', 'ENDORSEMENT', 'CLAIM', 'MANUAL'] },
72	          capability: { type: 'string' },
73	          claimRecordId: { type: 'string', format: 'uuid' },
74	          policyOrderId: { type: 'string', format: 'uuid' },
75	          pendingReview: { type: 'boolean' },
76	          limit: { type: 'integer', minimum: 1, maximum: 200 },
77	        },
78	      },
79	      response: {
80	        200: {
81	          type: 'object',
82	          additionalProperties: true,
83	          properties: {
84	            status: { type: 'string', example: 'success' },
85	            data: { type: 'array', items: Type.Ref('ComplianceCheck') },
86	          },
87	        },
88	      },
89	    },
90	  }, listScreenings);
91	
92	  fastify.get('/pending-review-count', {
93	    schema: {
94	      description:
95	        'Count of compliance checks awaiting manual review (blocking outcomes fail/review with no decision yet). Scoped to the caller\'s organisation. Used to badge the Compliance Checks queue.',
96	      tags: ['Sherpa Plus — Sanction Screening'],
97	      security: [{ clientCredentials: [] }],
98	      response: {
99	        200: {
100	          type: 'object',
101	          additionalProperties: false,
102	          properties: {
103	            status: { type: 'string', example: 'success' },
104	            data: {
105	              type: 'object',
106	              additionalProperties: false,
107	              properties: { count: { type: 'integer' } },
108	            },
109	          },
110	        },
111	      },
112	    },
113	  }, pendingReviewCount);
114	
115	  fastify.get<{ Params: { id: string } }>('/:id', {
116	    schema: {
117	      description: 'Fetch a single sanction screening by UUID.',
118	      tags: ['Sherpa Plus — Sanction Screening'],
119	      security: [{ clientCredentials: [] }],
120	      params: {
121	        type: 'object',
122	        required: ['id'],
123	        properties: { id: { type: 'string', format: 'uuid' } },
124	      },
125	      response: {
126	        200: {
127	          type: 'object',
128	          additionalProperties: true,
129	          properties: {
130	            status: { type: 'string', example: 'success' },
131	            data: Type.Ref('ComplianceCheck'),
132	          },
133	        },
134	      },
135	    },
136	  }, getScreeningById);
137	
138	  fastify.post<{ Params: { id: string }; Body: DecisionBody }>('/:id/decision', {
139	    schema: {
140	      description:
141	        'Record an admin decision (approve / reject) for a screening with outcome=fail or outcome=review. Approval unblocks the gated PolicyOrder creation by enqueuing the issuance completion job. Rejection leaves the screening blocked permanently.',
142	      tags: ['Sherpa Plus — Sanction Screening'],
143	      security: [{ clientCredentials: [] }],
144	      params: {
145	        type: 'object',
146	        required: ['id'],
147	        properties: { id: { type: 'string', format: 'uuid' } },
148	      },
149	      body: decisionBodySchema,
150	      response: {

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/policy-management/screening/page.tsx"}

1	"use client";
2	
3	import React, { useCallback, useEffect, useState } from "react";
4	
5	import { ShieldAlert, Loader2 } from "lucide-react";
6	
7	import SanctionScreeningPanel from "@/app/components/screening/SanctionScreeningPanel";
8	import AppLayout from "@/app/components/AppLayout";
9	import { ProtectedRoute } from "@/app/components/ProtectedRoute";
10	import { CRMOnlyRoute } from "@/app/components/UserTypeRoute";
11	import PolicyManagementShell from "@/app/components/policy-management/PolicyManagementShell";
12	import api from "@/app/src/utils/api";
13	import { usePermission } from "@/app/src/hooks/usePermission";
14	import type { SanctionScreening, ScreenedParty } from "@/app/types/admin";
15	
16	function partySummary(p: ScreenedParty): string {
17	  const first = typeof p.data.firstName === "string" ? p.data.firstName : "";
18	  const last = typeof p.data.lastName === "string" ? p.data.lastName : "";
19	  const full = `${first} ${last}`.trim();
20	  if (full) return full;
21	  if (typeof p.data.companyName === "string") return p.data.companyName;
22	  if (typeof p.data.name === "string") return p.data.name;
23	  return p.sourcePath;
24	}
25	import { PERMISSIONS } from "@/app/types/permissions";
26	import { useLMT } from "@/lib/lmt/config";
27	
28	interface ListResponse {
29	  status: "success" | "error";
30	  data?: SanctionScreening[];
31	}
32	
33	const ScreeningQueuePage: React.FC = () => {
34	  const { t } = useLMT();
35	  const canDecide = usePermission(PERMISSIONS.integrations.update.value);
36	  const [rows, setRows] = useState<SanctionScreening[]>([]);
37	  const [loading, setLoading] = useState(false);
38	  const [error, setError] = useState("");
39	  const [selected, setSelected] = useState<string | null>(null);
40	
41	  const capabilityLabel = (capability: string | undefined): string => {
42	    switch (capability) {
43	      case "sanction_screening":
44	        return t("Sanction Screening");
45	      case "pep":
46	        return t("PEP Check");
47	      case "kyc":
48	        return t("KYC Verification");
49	      case "adverse_media":
50	        return t("Adverse Media");
51	      case "fraud_detection":
52	        return t("Fraud Detection");
53	      case undefined:
54	      case "":
55	        return t("Compliance");
56	      default:
57	        return capability;
58	    }
59	  };
60	
61	  const load = useCallback(async () => {
62	    try {
63	      setLoading(true);
64	      setError("");
65	      const res = await api.get<ListResponse>("/sanction-screenings", {
66	        params: { pendingReview: true, limit: 50 },
67	      });
68	      const list = res.data.data ?? [];
69	      setRows(list);
70	      setSelected((current: string | null) =>
71	        current === null && list.length > 0 ? list[0].id : current,
72	      );
73	    } catch {
74	      setError(t("Failed to load compliance checks"));
75	    } finally {
76	      setLoading(false);
77	    }
78	  }, [t]);
79	
80	  useEffect(() => {
81	    void load();
82	  }, [load]);
83	
84	  return (
85	    <ProtectedRoute>
86	      <CRMOnlyRoute>
87	        <AppLayout>
88	          <PolicyManagementShell active="screening">
89	            <div className="space-y-4">
90	              <div className="flex items-start justify-between">
91	                <div className="flex items-center gap-2">
92	                  <ShieldAlert className="h-5 w-5 text-orange-600" />
93	                  <div>
94	                    <h2 className="text-lg font-semibold">{t("Compliance Checks Queue")}</h2>
95	                    <p className="mt-1 text-sm text-gray-600">
96	                      {t(
97	                        "Pending review and failed compliance checks. Users with the right permission can approve or reject to unblock the gated PolicyOrder.",
98	                      )}
99	                    </p>
100	                  </div>
101	                </div>
102	              </div>
103	
104	              {error && (
105	                <div className="rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700">
106	                  {error}
107	                </div>
108	              )}
109	
110	              <div className="grid grid-cols-1 gap-4 lg:grid-cols-[400px_1fr]">
111	                <div className="overflow-hidden rounded-lg border border-gray-200 bg-white">
112	                  {loading && rows.length === 0 && (
113	                    <div className="flex items-center gap-2 p-4 text-sm text-gray-600">
114	                      <Loader2 className="h-4 w-4 animate-spin" />
115	                      {t("Loading compliance checks...")}
116	                    </div>
117	                  )}
118	                  {!loading && rows.length === 0 && (
119	                    <div className="p-6 text-center text-sm text-gray-500">
120	                      {t("No compliance checks awaiting review.")}
121	                    </div>
122	                  )}
123	                  <ul className="divide-y divide-gray-200">
124	                    {rows.map((row) => (
125	                      <li key={row.id}>
126	                        <button
127	                          type="button"
128	                          onClick={() => setSelected(row.id)}
129	                          className={`w-full px-4 py-3 text-left hover:bg-gray-50 ${
130	                            selected === row.id ? "bg-amber-50" : ""
131	                          }`}
132	                        >
133	                          <div className="flex items-center justify-between">
134	                            <div className="flex items-center gap-2">
135	                              <span className="rounded-full border border-gray-200 bg-gray-50 px-2 py-0.5 text-xs font-medium text-gray-700">
136	                                {capabilityLabel(row.capability)}
137	                              </span>
138	                              <span className="text-xs text-gray-500">{row.triggerType}</span>
139	                            </div>
140	                            <div className="text-xs">
141	                              {row.outcome === "fail" ? (
142	                                <span className="rounded-full border border-red-200 bg-red-50 px-2 py-0.5 font-medium text-red-700">
143	                                  {t("fail")}
144	                                </span>
145	                              ) : (
146	                                <span className="rounded-full border border-orange-200 bg-orange-50 px-2 py-0.5 font-medium text-orange-700">
147	                                  {t("review")}
148	                                </span>
149	                              )}
150	                            </div>
151	                          </div>
152	                          <div className="mt-1 truncate text-sm font-medium text-gray-900">
153	                            {row.screenedParties.length > 0
154	                              ? partySummary(row.screenedParties[0])
155	                              : row.id}
156	                          </div>
157	                          <div className="mt-0.5 text-xs text-gray-500">
158	                            {new Date(row.createdAt).toLocaleString()}
159	                          </div>
160	                        </button>
161	                      </li>
162	                    ))}
163	                  </ul>
164	                </div>
165	
166	                <div>
167	                  {selected ? (
168	                    <SanctionScreeningPanel
169	                      screeningId={selected}
170	                      canDecide={canDecide}
171	                      onUpdated={() => {
172	                        void load();
173	                      }}
174	                    />
175	                  ) : (
176	                    <div className="rounded-lg border border-gray-200 bg-white p-6 text-center text-sm text-gray-500">
177	                      {t("Select a compliance check to view details.")}
178	 

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/policy-management/policies/[policyId]/page.tsx","limit":100}

1	"use client";
2	
3	import React, { useEffect, useState, useCallback, useRef } from "react";
4	import { useRouter, useSearchParams, useParams, usePathname } from "next/navigation";
5	import {
6	  ArrowLeft,
7	  Calendar,
8	  Check,
9	  Clock,
10	  DollarSign,
11	  Download,
12	  Edit,
13	  Save,
14	  User,
15	  MapPin,
16	  Phone,
17	  Mail,
18	  CreditCard,
19	  XCircle,
20	  Pause,
21	  Play,
22	  ChevronDown,
23	  Tag,
24	  Trash2,
25	  Receipt,
26	  FileWarning,
27	  ExternalLink,
28	  MessageSquare,
29	  Paperclip,
30	} from "lucide-react";
31	
32	import AppLayout from "@/app/components/AppLayout";
33	import { ProtectedRoute } from "@/app/components/ProtectedRoute";
34	import { CRMOnlyRoute } from "@/app/components/UserTypeRoute";
35	import api from "@/app/src/utils/api";
36	import { showSuccessToast, showErrorToast } from "@/app/components/Toast";
37	import { Button } from "@/app/components/ui/button";
38	import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/app/components/ui/tooltip";
39	import {
40	  Dialog,
41	  DialogTrigger,
42	  DialogContent,
43	  DialogHeader,
44	  DialogTitle,
45	  DialogDescription,
46	  DialogFooter,
47	} from "@/app/components/ui/dialog";
48	import { X } from "lucide-react";
49	import { getSherpaApiUrl } from "@/app/src/utils/env";
50	import { getValidAccessToken } from "@/app/src/utils/api";
51	import {
52	  mergeCustomerData,
53	  getDisplayPhone,
54	  getDisplayAddress,
55	} from "@/app/utils/customerDataUtils";
56	import CoverageDetailsSection from "@/app/components/policies/CoverageDetailsSection";
57	import ComplianceChecksSection from "@/app/components/compliance/ComplianceChecksSection";
58	import PolicyVersionSwitcher from "@/app/components/policies/PolicyVersionSwitcher";
59	import { CurrencyDisplay, buildDisplayCurrencySource } from "@/app/components/ui/currencyDisplay";
60	
61	import { formatDateDynamic } from "@/app/utils/dateFormat";
62	import { useTranslation } from "@gangkharai/lmt/client";
63	import useAuthStore from "@/app/src/store/authStore";
64	import { isAggregatedView, getOrgLabel } from "@/app/utils/aggregatedView";
65	import BundleDiscountSection from "@/app/components/policies/BundleDiscountSection";
66	import type { PolicyBundleInfo } from "@/app/types/bundle";
67	import { usePolicyStatuses } from "@/app/src/hooks/usePolicyStatuses";
68	import DeleteRecordDialog from "@/app/components/policy-management/DeleteRecordDialog";
69	import { usePermission, PERMISSIONS } from "@/app/src/rbac";
70	import { Tabs, TabsList, TabsTrigger, TabsContent } from "@/app/components/ui/tabs";
71	import PolicyMessageThread from "@/app/components/policies/PolicyMessageThread";
72	import PolicyAttachmentList from "@/app/components/policies/PolicyAttachmentList";
73	
74	interface PolicyOrder {
75	  id: number;
76	  policyId: string;
77	  quoteId: string;
78	  productName: string;
79	  productPlanName: string;
80	  status: string;
81	  inceptionDate: string;
82	  effectiveDate?: string;
83	  issueDate: string;
84	  expiryDate: string;
85	  policyNumber: string;
86	  insurance: any;
87	  version?: number;
88	  transactionType?: string;
89	  hasActiveSuspensionTerms?: boolean;
90	  parameters?: {
91	    personal?: {
92	      firstName?: string;
93	      lastName?: string;
94	      email?: string;
95	      birthDate?: string;
96	      gender?: string;
97	      mobilePhone?: string;
98	      address?: {
99	        streetName?: string;
100	        city?: string;

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/sanctionScreeningService.ts","limit":200}

1	import crypto from 'node:crypto';
2	import logger from '@/logger';
3	import { StatusError } from '@/error/error.js';
4	import valkeyClient from '@/valkeyClient.js';
5	import { ComplianceCheck } from '@/models/ComplianceCheck.js';
6	import type { _ComplianceCheck } from '@/models/ComplianceCheck.js';
7	import type {
8	  ComplianceCheckTriggerType,
9	  ScreenedParty,
10	  ComplianceFinding,
11	  ComplianceCheckOutcome,
12	} from '@/models/ComplianceCheck.js';
13	import { Product } from '@/models/Product.js';
14	import { Organization } from '@/models/Organization.js';
15	import {
16	  shouldRunSanctionScreening,
17	  type DisableSanctionScreeningMode,
18	} from '@/utils/sanctionScreeningVisibility.js';
19	import { runComplianceCheck, extractScreenedParties } from '@/domains/integrations/capabilities/runCheck.js';
20	import { enqueueSanctionScreening } from '@/services/jobs/sanctionScreeningJob.js';
21	import { onComplianceCheckCleared, onComplianceCheckBlocked } from '@/services/policyIssuanceService.js';
22	import { notifyComplianceOutcome } from '@/services/complianceMessageService.js';
23	import { sendPolicyMessage } from '@/services/policyMessageService.js';
24	import { sendClaimMessage } from '@/services/claimMessageService.js';
25	import { PolicyOrder } from '@/models/PolicyOrder.js';
26	
27	export type ComplianceCheckParent =
28	  | {
29	      kind: 'policy';
30	      previousPolicyId: string | null;
31	      rootPolicyId: string | null;
32	    }
33	  | {
34	      kind: 'claim';
35	      claimRecordId: string;
36	      customerId: string | null;
37	    };
38	
39	export interface StartCheckInput {
40	  organizationId: string;
41	  productId: number;
42	  capability: string;
43	  triggerType: ComplianceCheckTriggerType;
44	  parent: ComplianceCheckParent;
45	  /** Snapshot needed to resume the parent flow (issuance/claim approval) after the check clears. */
46	  issuanceContext: Record<string, unknown>;
47	  /** Policy/claim parameters that the capability's `parties` paths read from. */
48	  parameters: Record<string, unknown>;
49	}
50	
51	export function screeningChannel(screeningId: string): string {
52	  return `screening:${screeningId}`;
53	}
54	
55	export function screeningPublicChannel(screeningId: string): string {
56	  return `screening:public:${screeningId}`;
57	}
58	
59	async function publishCrm(screeningId: string, payload: Record<string, unknown>): Promise<void> {
60	  try {
61	    await valkeyClient.client?.publish(screeningChannel(screeningId), JSON.stringify(payload));
62	  } catch (err) {
63	    logger.warn({ err, screeningId }, 'Failed to publish screening CRM SSE event');
64	  }
65	}
66	
67	async function publishPublic(
68	  screeningId: string,
69	  payload: { type: string; data: { status: 'processing' | 'cleared' | 'blocked' } },
70	): Promise<void> {
71	  try {
72	    await valkeyClient.client?.publish(screeningPublicChannel(screeningId), JSON.stringify(payload));
73	  } catch (err) {
74	    logger.warn({ err, screeningId }, 'Failed to publish screening public SSE event');
75	  }
76	}
77	
78	async function getOrgScreeningMode(organizationId: string): Promise<DisableSanctionScreeningMode> {
79	  const org = await Organization.findByPk(organizationId);
80	  if (!org) throw new StatusError(404, `Organization ${organizationId} not found`);
81	  return org.disableSanctionScreening;
82	}
83	
84	/**
85	 * Create a ComplianceCheck row in `pending` state for the given capability,
86	 * capturing the parent context (policy or claim) for later resumption.
87	 * Does NOT enqueue the job — the caller does that immediately afterwards so
88	 * the row is visible before the worker may grab it.
89	 */
90	export async function startComplianceCheck(
91	  input: StartCheckInput,
92	): Promise<_ComplianceCheck> {
93	  const mode = await getOrgScreeningMode(input.organizationId);
94	  if (!shouldRunSanctionScreening(mode)) {
95	    throw new StatusError(403, 'Compliance checks are disabled for this organisation');
96	  }
97	
98	  const product = await Product.findOne(
99	    { organizationId: input.organizationId },
100	    { where: { id: input.productId } },
101	  );
102	  if (!product) {
103	    throw new StatusError(404, `Product ${input.productId} not found`);
104	  }
105	  const config = product.complianceChecks?.[input.capability];
106	  if (!config || !config.enabled) {
107	    throw new StatusError(
108	      400,
109	      `Product ${input.productId} does not have ${input.capability} enabled`,
110	    );
111	  }
112	
113	  const parties = extractScreenedParties(input.parameters, config);
114	  if (parties.length === 0) {
115	    throw new StatusError(
116	      400,
117	      `Cannot run ${input.capability}: product ${input.productId} parties paths produced no screenable parties from the supplied parameters`,
118	    );
119	  }
120	
121	  const correlationId = crypto.randomUUID();
122	  const row = await ComplianceCheck.create(
123	    { organizationId: input.organizationId },
124	    {
125	      productId: input.productId,
126	      integrationId: config.integrationId,
127	      capability: input.capability,
128	      triggerType: input.triggerType,
129	      previousPolicyId: input.parent.kind === 'policy' ? input.parent.previousPolicyId : null,
130	      rootPolicyId: input.parent.kind === 'policy' ? input.parent.rootPolicyId : null,
131	      policyOrderId: null,
132	      claimRecordId: input.parent.kind === 'claim' ? input.parent.claimRecordId : null,
133	      customerId: input.parent.kind === 'claim' ? input.parent.customerId : null,
134	      issuanceContext: input.issuanceContext,
135	      screenedParties: parties,
136	      status: 'pending',
137	      outcome: null,
138	      manualDecision: null,
139	      manualDecisionBy: null,
140	      manualDecisionAt: null,
141	      manualDecisionNote: null,
142	      findings: null,
143	      rawResponse: null,
144	      error: null,
145	      correlationId,
146	    },
147	  );
148	
149	  return row;
150	}
151	
152	/**
153	 * Run the screening job for a SanctionScreening row. Idempotent — refuses to
154	 * run if the row is already in a terminal state.
155	 *
156	 * `organizationId` comes from the BullMQ job payload (the enqueuer captured
157	 * it from the FastifyRequest that started the screening). The safe-model
158	 * wrapper scopes all DB calls to that org so the worker honours tenant
159	 * isolation even though it has no FastifyRequest of its own.
160	 *
161	 * On `pass` / `fail` / `review`: emits SSE; the customer's portal handles
162	 * resubmission. On unexpected error: marks status=failed with error message.
163	 */
164	export async function processScreening(screeningId: string, organizationId: string): Promise<void> {
165	  const ctx = { organizationId };
166	  const row = await ComplianceCheck.findByPk(ctx, screeningId);
167	  if (!row) {
168	    logger.warn({ screeningId }, 'processScreening: row not found, skipping');
169	    return;
170	  }
171	  if (row.status === 'completed' || row.status === 'failed') {
172	    logger.info({ screeningId, status: row.status }, 'processScreening: terminal status, skipping');
173	    return;
174	  }
175	
176	  await row.update({ status: 'processing' });
177	  await publishCrm(screeningId, {
178	    type: 'screening_started',
179	    data: { screeningId },
180	  });
181	  await publishPublic(screeningId, { type: 'screening_status_changed', data: { status: 'processing' } });
182	
183	  const product = await Product.findOne(
184	    { organizationId: row.organizationId },
185	    { where: { id: row.productId } },
186	  );
187	  if (!product) {
188	    await markFailed(row, `Product ${row.productId} disappeared during screening`);
189	    return;
190	  }
191	
192	  try {
193	    const result = await runComplianceCheck({
194	      capability: row.capability,
195	      organizationId: row.organizationId,
196	      product,
197	      parameters: extractParametersFromContext(row.issuanceContext),
198	      correlationId: row.correlationId ?

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/sanctionScreeningService.ts","offset":200,"limit":200}

200	
201	    await row.update({
202	      status: 'completed',
203	      outcome: result.outcome,
204	      findings: result.findings,
205	      rawResponse: result.rawResponse,
206	      integrationId: result.integrationId,
207	    });
208	    await publishCrm(screeningId, {
209	      type: 'screening_completed',
210	      data: { screeningId, outcome: result.outcome },
211	    });
212	    await publishPublic(screeningId, {
213	      type: 'screening_status_changed',
214	      data: { status: result.outcome === 'pass' ? 'cleared' : 'blocked' },
215	    });
216	
217	    if (result.outcome === 'pass') {
218	      await onComplianceCheckCleared(screeningId, row.organizationId);
219	    } else {
220	      await dispatchOutcomeSideEffects(row, result.outcome);
221	    }
222	  } catch (err) {
223	    const message = err instanceof Error ? err.message : String(err);
224	    await markFailed(row, message);
225	  }
226	}
227	
228	async function dispatchOutcomeSideEffects(
229	  row: _ComplianceCheck,
230	  outcome: 'fail' | 'review',
231	): Promise<void> {
232	  const product = await Product.findOne(
233	    { organizationId: row.organizationId },
234	    { where: { id: row.productId } },
235	  );
236	  const config = product?.complianceChecks?.[row.capability];
237	  const autoReject = outcome === 'fail' && config?.autoReject === true;
238	
239	  if (autoReject && row.policyOrderId) {
240	    await onComplianceCheckBlocked(row.id, row.organizationId);
241	  }
242	
243	  const mode = autoReject ? 'fail' : 'review';
244	  const configured = mode === 'fail' ? config?.messages?.fail : config?.messages?.review;
245	  await notifyComplianceOutcome(row, row.organizationId, mode, configured ?? null);
246	}
247	
248	async function markFailed(row: _ComplianceCheck, message: string): Promise<void> {
249	  await row.update({ status: 'failed', error: message });
250	  await publishCrm(row.id, { type: 'screening_failed', data: { screeningId: row.id, error: message } });
251	  await publishPublic(row.id, { type: 'screening_status_changed', data: { status: 'blocked' } });
252	  logger.error({ screeningId: row.id, error: message }, 'Sanction screening failed');
253	}
254	
255	export interface ApplyManualDecisionInput {
256	  screeningId: string;
257	  organizationId: string;
258	  decision: 'approve' | 'reject' | 'request_info';
259	  userId: string;
260	  note: string | null;
261	  message?: string | null;
262	  attachments?: Array<{ blobPath: string; filename: string; contentType: string }>;
263	}
264	
265	/**
266	 * Apply an admin's approve / reject / request_info action to a screening.
267	 * Only valid for outcomes that block (`fail`, `review`).
268	 *
269	 * approve / reject persist a manualDecision and trigger the policy
270	 * transition (clear or block). request_info leaves manualDecision null
271	 * and just relays a message to the customer so they can supply more
272	 * information; the screening stays open for a follow-up decision.
273	 *
274	 * If a message is supplied it is delivered via the parent's message
275	 * thread (PolicyMessage for policy parents, ClaimMessage for claims) so
276	 * the customer gets a portal notification + email with attachments and
277	 * the operator's reply is captured on the same thread.
278	 *
279	 * Tenant-scoped via the safe-model wrapper so the caller's organization
280	 * is enforced at the DB layer.
281	 */
282	export async function applyManualDecision(input: ApplyManualDecisionInput): Promise<_ComplianceCheck> {
283	  const ctx = { organizationId: input.organizationId };
284	  const row = await ComplianceCheck.findByPk(ctx, input.screeningId);
285	  if (!row) throw new StatusError(404, 'Screening not found');
286	  if (row.status !== 'completed') {
287	    throw new StatusError(409, `Screening is in status ${row.status}; only completed screenings can be decided`);
288	  }
289	  if (row.outcome === 'pass') {
290	    throw new StatusError(409, 'Screening already passed; no manual decision needed');
291	  }
292	
293	  const requestInfo = input.decision === 'request_info';
294	  if (!requestInfo && row.manualDecision !== null) {
295	    throw new StatusError(409, `Screening already has a manual decision: ${row.manualDecision}`);
296	  }
297	  if (requestInfo && !input.message?.trim()) {
298	    throw new StatusError(400, 'A message is required when requesting more information');
299	  }
300	
301	  let persisted: 'approved' | 'rejected' | null = null;
302	  if (!requestInfo) {
303	    persisted = input.decision === 'approve' ? 'approved' : 'rejected';
304	    // Atomic transition: only update if no decision has been recorded yet.
305	    // The null guard above is a fast-path; this WHERE clause is the canonical
306	    // race protection against concurrent admin decisions. The safe-model
307	    // wrapper enforces organizationId on top of id + manualDecision IS NULL.
308	    const [updatedCount] = await ComplianceCheck.update(
309	      ctx,
310	      {
311	        manualDecision: persisted,
312	        manualDecisionBy: input.userId,
313	        manualDecisionAt: new Date(),
314	        manualDecisionNote: input.note,
315	      },
316	      {
317	        where: {
318	          id: row.id,
319	          manualDecision: null,
320	        },
321	      },
322	    );
323	    if (updatedCount === 0) {
324	      throw new StatusError(409, 'Screening was decided concurrently; refresh and retry');
325	    }
326	    await row.reload();
327	
328	    await publishCrm(row.id, {
329	      type: 'screening_decision',
330	      data: { screeningId: row.id, manualDecision: persisted, by: input.userId },
331	    });
332	    await publishPublic(row.id, {
333	      type: 'screening_status_changed',
334	      data: { status: persisted === 'approved' ? 'cleared' : 'blocked' },
335	    });
336	  } else {
337	    await publishCrm(row.id, {
338	      type: 'screening_info_requested',
339	      data: { screeningId: row.id, by: input.userId },
340	    });
341	  }
342	
343	  const body = input.message?.trim();
344	  if (body) {
345	    await deliverDecisionMessage(row, input.organizationId, input.userId, body, input.attachments ?? []);
346	  }
347	
348	  if (persisted === 'approved') {
349	    await onComplianceCheckCleared(row.id, row.organizationId);
350	  } else if (persisted === 'rejected' && row.policyOrderId) {
351	    await onComplianceCheckBlocked(row.id, row.organizationId);
352	  }
353	
354	  return row;
355	}
356	
357	async function deliverDecisionMessage(
358	  row: _ComplianceCheck,
359	  organizationId: string,
360	  userId: string,
361	  body: string,
362	  attachments: Array<{ blobPath: string; filename: string; contentType: string }>,
363	): Promise<void> {
364	  try {
365	    if (row.claimRecordId) {
366	      await sendClaimMessage(row.claimRecordId, 'crm_user', userId, body, attachments, organizationId);
367	      return;
368	    }
369	    if (row.policyOrderId) {
370	      // policyOrderId on ComplianceCheck stores the PolicyOrder.policyId UUID,
371	      // not the numeric primary key.
372	      const policyOrder = await PolicyOrder.findOne(
373	        { organizationId },
374	        { where: { policyId: row.policyOrderId } },
375	      );
376	      if (policyOrder) {
377	        await sendPolicyMessage(policyOrder.policyId, 'crm_user', userId, body, attachments, organizationId);
378	      } else {
379	        logger.warn({ screeningId: row.id, policyOrderId: row.policyOrderId }, 'deliverDecisionMessage: PolicyOrder not found for policyId');
380	      }
381	      return;
382	    }
383	    logger.warn({ screeningId: row.id }, 'deliverDecisionMessage: no parent (claim/policy) attached to compliance check');
384	  } catch (err) {
385	    logger.warn({ err, screeningId: row.id }, 'Failed to deliver compliance decision message');
386	  }
387	}
388	
389	/**
390	 * Reset a screening so it can be re-attempted (typically after a transient
391	 * provider error). Only allowed when status=failed or outcome=review with no
392	 * decision yet

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/IntegrationsTab.tsx","offset":100,"limit":300}

100	    setFormOpen(true);
101	  };
102	
103	  const submit = async () => {
104	    try {
105	      setLoading(true);
106	      setError("");
107	      const payload = {
108	        name,
109	        slug,
110	        capability,
111	        kind,
112	        // First env created via Smart Setup or Environments tab becomes the
113	        // default automatically (server-side). When the integration is brand
114	        // new we still need to send *something* matching the column's NOT
115	        // NULL + ENUM constraint — "production" is the safe placeholder; it
116	        // is overwritten the moment the first env row lands.
117	        defaultEnvironment: editing ? editing.defaultEnvironment : "production" as const,
118	        active,
119	        invocationMode,
120	        syncTimeoutMs,
121	      };
122	      if (editing) {
123	        const update: UpdateExternalIntegration = payload;
124	        await api.put(`/external-integrations/${editing.id}`, update);
125	      } else {
126	        const create: CreateExternalIntegration = payload;
127	        await api.post(`/external-integrations`, create);
128	      }
129	      setFormOpen(false);
130	      setEditing(null);
131	      await load();
132	    } catch {
133	      setError(t("Failed to save external integration"));
134	    } finally {
135	      setLoading(false);
136	    }
137	  };
138	
139	  const confirmDelete = async () => {
140	    if (!deleteId) return;
141	    try {
142	      setLoading(true);
143	      await api.delete(`/external-integrations/${deleteId}`);
144	      setDeleteId(null);
145	      await load();
146	    } catch {
147	      setError(t("Failed to delete external integration"));
148	    } finally {
149	      setLoading(false);
150	    }
151	  };
152	
153	  return (
154	    <div className="space-y-4">
155	      <div className="flex items-start justify-between">
156	        <div>
157	          <h2 className="text-xl font-semibold">{t("External Integrations")}</h2>
158	          <p className="mt-1 text-sm text-gray-600">
159	            {t(
160	              "Configure outbound third-party API integrations (sanction screening, fraud detection, KYC, ...). Generic REST providers can be added without writing code.",
161	            )}
162	          </p>
163	        </div>
164	        <Button onClick={openCreate}>
165	          <Plus className="mr-2 h-4 w-4" />
166	          {t("Add Integration")}
167	        </Button>
168	      </div>
169	
170	      {error && (
171	        <div className="rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700">
172	          {error}
173	        </div>
174	      )}
175	
176	      <div className="overflow-hidden rounded-lg border border-gray-200 bg-white">
177	        <table className="min-w-full divide-y divide-gray-200">
178	          <thead className="bg-gray-50">
179	            <tr>
180	              <th className="px-4 py-2 text-left text-xs font-semibold uppercase text-gray-500">
181	                {t("Name")}
182	              </th>
183	              <th className="px-4 py-2 text-left text-xs font-semibold uppercase text-gray-500">
184	                {t("Slug")}
185	              </th>
186	              <th className="px-4 py-2 text-left text-xs font-semibold uppercase text-gray-500">
187	                {t("Capability")}
188	              </th>
189	              <th className="px-4 py-2 text-left text-xs font-semibold uppercase text-gray-500">
190	                {t("Kind")}
191	              </th>
192	              <th className="px-4 py-2 text-left text-xs font-semibold uppercase text-gray-500">
193	                {t("Default Env")}
194	              </th>
195	              <th className="px-4 py-2 text-left text-xs font-semibold uppercase text-gray-500">
196	                {t("Status")}
197	              </th>
198	              <th className="px-4 py-2"></th>
199	            </tr>
200	          </thead>
201	          <tbody className="divide-y divide-gray-200">
202	            {loading && integrations.length === 0 && (
203	              <tr>
204	                <td colSpan={7} className="px-4 py-6 text-center text-sm text-gray-500">
205	                  {t("Loading integrations...")}
206	                </td>
207	              </tr>
208	            )}
209	            {!loading && integrations.length === 0 && (
210	              <tr>
211	                <td colSpan={7} className="px-4 py-6 text-center text-sm text-gray-500">
212	                  {t("No integrations configured yet.")}
213	                </td>
214	              </tr>
215	            )}
216	            {integrations.map((row) => (
217	              <tr key={row.id} className="hover:bg-gray-50">
218	                <td className="px-4 py-2 text-sm font-medium text-gray-900">
219	                  <Link
220	                    href={`/admin/integrations/${row.id}`}
221	                    className="text-blue-600 hover:underline"
222	                  >
223	                    {row.name}
224	                  </Link>
225	                </td>
226	                <td className="px-4 py-2 text-sm text-gray-700">{row.slug}</td>
227	                <td className="px-4 py-2 text-sm text-gray-700">{row.capability}</td>
228	                <td className="px-4 py-2 text-sm text-gray-700">{row.kind}</td>
229	                <td className="px-4 py-2 text-sm text-gray-700">{row.defaultEnvironment}</td>
230	                <td className="px-4 py-2 text-sm">
231	                  {row.active ? (
232	                    <span className="inline-flex items-center rounded-full bg-green-50 px-2 py-0.5 text-xs font-medium text-green-700">
233	                      {t("Active")}
234	                    </span>
235	                  ) : (
236	                    <span className="inline-flex items-center rounded-full bg-gray-100 px-2 py-0.5 text-xs font-medium text-gray-600">
237	                      {t("Inactive")}
238	                    </span>
239	                  )}
240	                </td>
241	                <td className="px-4 py-2 text-right text-sm">
242	                  <Button variant="outline" size="sm" onClick={() => openEdit(row)}>
243	                    {t("Edit")}
244	                  </Button>{" "}
245	                  <Button
246	                    variant="red"
247	                    size="sm"
248	                    onClick={() => setDeleteId(row.id)}
249	                  >
250	                    {t("Delete")}
251	                  </Button>
252	                </td>
253	              </tr>
254	            ))}
255	          </tbody>
256	        </table>
257	      </div>
258	
259	      <Dialog open={formOpen} onOpenChange={setFormOpen}>
260	        <DialogContent>
261	          <DialogHeader>
262	            <DialogTitle>
263	              {editing ? t("Edit Integration") : t("Add Integration")}
264	            </DialogTitle>
265	          </DialogHeader>
266	          <div className="space-y-3">
267	            <label className="block text-sm">
268	              <span className="text-gray-700">{t("Name")}</span>
269	              <Input
270	                value={name}
271	                onChange={(e) => setName(e.target.value)}
272	                placeholder={t("OpenSanctions")}
273	              />
274	            </label>
275	            <label className="block text-sm">
276	              <span className="text-gray-700">{t("Slug")}</span>
277	              <Input
278	                value={slug}
279	                onChange={(e) => setSlug(e.target.value)}
280	                placeholder={t("opensanctions")}
281	              />
282	            </label>
283	            <label className="block text-sm">
284	              <span className="text-gray-700">{t("Capability")}</span>
285	              <select
286	                className="mt-1 block w-full rounded-md border border-gray-300 px-3 py-2 text-sm"
287	                value={capability}
288	                onChange={(e) => {
289	                  const next = e.target.value a

{"command":"grep -n \"startComplianceCheck\\|triggerType\\|ComplianceCheckTriggerType\" /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/policyIssuanceService.ts | head -40"}

24:import type { ComplianceCheckTriggerType } from '@/models/ComplianceCheck.js';
38:  startComplianceCheck,
59:  triggerType: ComplianceCheckTriggerType;
161:  const enabled = enabledCapabilitiesFor(product, input.triggerType);
186:      input.triggerType === 'RENEWAL'
195:            triggerType: 'RENEWAL',
213:      triggerType: input.triggerType,
218:    const check = await startComplianceCheck(startInput);
251:        triggerType: input.triggerType,

{"command":"find /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app -type d -name integrations"}

/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/admin/integrations
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/RequestTemplatesTab.tsx","limit":200}

1	"use client";
2	
3	import React, { useCallback, useEffect, useState } from "react";
4	
5	import { Plus, Sparkles, Trash2 } from "lucide-react";
6	
7	import ConfirmDialog from "@/app/components/admin/ConfirmDialog";
8	import { Button } from "@/app/components/ui/button";
9	import {
10	  Dialog,
11	  DialogContent,
12	  DialogFooter,
13	  DialogHeader,
14	  DialogTitle,
15	} from "@/app/components/ui/dialog";
16	import { Input } from "@/app/components/ui/input";
17	import { Textarea } from "@/app/components/ui/textarea";
18	import api, { nextApi } from "@/app/src/utils/api";
19	import { CAPABILITY_OPERATIONS } from "@/app/types/admin";
20	import type {
21	  CreateExternalIntegrationFieldMapping,
22	  CreateExternalIntegrationRequestTemplate,
23	  ExternalIntegrationFieldMapping,
24	  ExternalIntegrationRequestTemplate,
25	  FieldMappingTransformation,
26	  IntegrationCapability,
27	  IntegrationHttpMethod,
28	  RetryPolicy,
29	} from "@/app/types/admin";
30	import { useLMT } from "@/lib/lmt/config";
31	import FieldMappingsEditor, {
32	  type DataModelFieldLite,
33	} from "@/app/components/admin/integrations/FieldMappingsEditor";
34	
35	interface ListResponse {
36	  status: "success" | "error";
37	  data?: ExternalIntegrationRequestTemplate[];
38	}
39	
40	interface LlmGenerateResponse {
41	  status: string;
42	  data?: { text: string };
43	}
44	
45	const HTTP_METHODS: IntegrationHttpMethod[] = ["GET", "POST", "PUT", "PATCH", "DELETE"];
46	
47	const DEFAULT_RETRY_POLICY: RetryPolicy = {
48	  attempts: 3,
49	  initialDelayMs: 500,
50	  backoffMultiplier: 2,
51	  maxDelayMs: 5000,
52	  retryOnStatuses: [502, 503, 504],
53	};
54	
55	type EditorMode = "structured" | "json" | "ai";
56	type AiPanelState = "closed" | "open";
57	
58	interface ListMappingsResponse {
59	  status: "success" | "error";
60	  data?: ExternalIntegrationFieldMapping[];
61	}
62	
63	interface ListDataModelFieldsResponse {
64	  status: "success" | "error";
65	  data?: DataModelFieldLite[];
66	}
67	
68	interface Props {
69	  integrationId: string;
70	  capability: IntegrationCapability;
71	}
72	
73	interface KvRow {
74	  key: string;
75	  value: string;
76	}
77	
78	function objectToKvRows(obj: Record<string, string> | null): KvRow[] {
79	  if (!obj) return [];
80	  return Object.entries(obj).map(([key, value]) => ({ key, value: String(value) }));
81	}
82	
83	function kvRowsToObject(rows: KvRow[]): Record<string, string> {
84	  const out: Record<string, string> = {};
85	  for (const r of rows) {
86	    if (r.key.trim().length === 0) continue;
87	    out[r.key] = r.value;
88	  }
89	  return out;
90	}
91	
92	function tryParseJson<T>(text: string, fallback: T): { ok: true; value: T } | { ok: false; error: string } {
93	  const trimmed = text.trim();
94	  if (trimmed.length === 0) {
95	    return { ok: true, value: fallback };
96	  }
97	  try {
98	    return { ok: true, value: JSON.parse(trimmed) as T };
99	  } catch (err) {
100	    return { ok: false, error: err instanceof Error ? err.message : String(err) };
101	  }
102	}
103	
104	function stripCodeFences(text: string): string {
105	  let s = text.trim();
106	  if (s.startsWith("```json")) s = s.slice(7);
107	  else if (s.startsWith("```")) s = s.slice(3);
108	  if (s.endsWith("```")) s = s.slice(0, -3);
109	  return s.trim();
110	}
111	
112	interface ParsedCurl {
113	  url: string;
114	  method: string;
115	  headers: Record<string, string>;
116	  body: string | null;
117	}
118	
119	/**
120	 * Best-effort cURL splitter for the Generate-with-AI tab. Joins line
121	 * continuations, drops the leading `curl`, then walks the tokens picking
122	 * out -X / -H / -d/--data/--data-raw / --data-binary. The first non-flag
123	 * token is treated as the URL. Strips Authorization headers — the runner
124	 * injects auth at call time so they should not survive into the template.
125	 */
126	function tryParseCurl(input: string): ParsedCurl | null {
127	  const trimmed = input.trim();
128	  if (!/^curl\b/i.test(trimmed)) return null;
129	
130	  const joined = trimmed.replace(/\\\s*\n/g, " ");
131	  const tokens: string[] = [];
132	  let cursor = 0;
133	  while (cursor < joined.length) {
134	    while (cursor < joined.length && /\s/.test(joined[cursor])) cursor++;
135	    if (cursor >= joined.length) break;
136	    const ch = joined[cursor];
137	    if (ch === "'" || ch === '"') {
138	      const quote = ch;
139	      cursor++;
140	      let value = "";
141	      while (cursor < joined.length && joined[cursor] !== quote) {
142	        if (joined[cursor] === "\\" && cursor + 1 < joined.length) {
143	          value += joined[cursor + 1];
144	          cursor += 2;
145	        } else {
146	          value += joined[cursor];
147	          cursor++;
148	        }
149	      }
150	      cursor++;
151	      tokens.push(value);
152	    } else {
153	      let value = "";
154	      while (cursor < joined.length && !/\s/.test(joined[cursor])) {
155	        value += joined[cursor];
156	        cursor++;
157	      }
158	      tokens.push(value);
159	    }
160	  }
161	
162	  if (tokens.length === 0 || tokens[0].toLowerCase() !== "curl") return null;
163	
164	  let url = "";
165	  let method = "GET";
166	  let body: string | null = null;
167	  const headers: Record<string, string> = {};
168	
169	  for (let i = 1; i < tokens.length; i++) {
170	    const t = tokens[i];
171	    if (t === "-X" || t === "--request") {
172	      method = (tokens[++i] ?? "GET").toUpperCase();
173	    } else if (t === "-H" || t === "--header") {
174	      const raw = tokens[++i] ?? "";
175	      const idx = raw.indexOf(":");
176	      if (idx > 0) {
177	        const key = raw.slice(0, idx).trim();
178	        const value = raw.slice(idx + 1).trim();
179	        if (key.toLowerCase() !== "authorization") {
180	          headers[key] = value;
181	        }
182	      }
183	    } else if (t === "-d" || t === "--data" || t === "--data-raw" || t === "--data-binary") {
184	      body = tokens[++i] ?? "";
185	      if (method === "GET") method = "POST";
186	    } else if (t === "-b" || t === "--cookie" || t === "--cookie-jar" || t === "-c") {
187	      // Skip cookies — sensitive + transient.
188	      i++;
189	    } else if (t === "-u" || t === "--user" || t === "-A" || t === "--user-agent" || t === "--referer" || t === "-e") {
190	      // Skip auth / UA-style flags — runner provides its own context.
191	      i++;
192	    } else if (t.startsWith("-")) {
193	      // Unknown flag — skip the next token only if it doesn't look like a URL.
194	      const next = tokens[i + 1];
195	      if (next && !/^https?:\/\//i.test(next)) {
196	        i++;
197	      }
198	    } else if (!url) {
199	      url = t;
200	    }

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationEnvironment.ts"}

1	import { Table, Column, Model, DataType, ForeignKey, BelongsTo, HasMany } from 'sequelize-typescript';
2	import { _ExternalIntegration } from './_ExternalIntegration.js';
3	import { _ExternalIntegrationAuthConfig } from './_ExternalIntegrationAuthConfig.js';
4	
5	@Table({
6	  modelName: 'ExternalIntegrationEnvironment',
7	  timestamps: true,
8	  indexes: [
9	    {
10	      fields: ['integrationId'],
11	      name: 'idx_external_integration_environment_integration_id',
12	    },
13	    {
14	      unique: true,
15	      fields: ['integrationId', 'environment'],
16	      name: 'unique_external_integration_environment',
17	    },
18	  ],
19	})
20	export class _ExternalIntegrationEnvironment extends Model {
21	  @Column({
22	    type: DataType.UUID,
23	    defaultValue: DataType.UUIDV4,
24	    primaryKey: true,
25	  })
26	  declare id: string;
27	
28	  @ForeignKey(() => _ExternalIntegration)
29	  @Column({
30	    type: DataType.UUID,
31	    allowNull: false,
32	  })
33	  declare integrationId: string;
34	
35	  @Column({
36	    type: DataType.ENUM('test', 'staging', 'production'),
37	    allowNull: false,
38	  })
39	  declare environment: 'test' | 'staging' | 'production';
40	
41	  @Column({
42	    type: DataType.STRING(500),
43	    allowNull: false,
44	    validate: { notEmpty: true, len: [1, 500] },
45	  })
46	  declare baseUrl: string;
47	
48	  @Column({
49	    type: DataType.STRING(500),
50	    allowNull: true,
51	  })
52	  declare authEndpoint: string | null;
53	
54	  @Column({
55	    type: DataType.STRING(500),
56	    allowNull: true,
57	  })
58	  declare tokenEndpoint: string | null;
59	
60	  @Column({
61	    type: DataType.DATE,
62	    allowNull: false,
63	  })
64	  declare createdAt: Date;
65	
66	  @Column({
67	    type: DataType.DATE,
68	    allowNull: false,
69	  })
70	  declare updatedAt: Date;
71	
72	  @BelongsTo(() => _ExternalIntegration, { foreignKey: 'integrationId', as: 'integration' })
73	  declare integration?: _ExternalIntegration;
74	
75	  @HasMany(() => _ExternalIntegrationAuthConfig, { foreignKey: 'environmentId', as: 'authConfigs' })
76	  declare authConfigs?: _ExternalIntegrationAuthConfig[];
77	}
78	

{"command":"find /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/admin -name \"*.tsx\" -o -name \"*.ts\" | head -20"}

/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/admin/integrations/[id]/page.tsx
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/admin/page.tsx

{"command":"find /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models -name \"*ExternalIntegrationAuthConfig*\" -type f"}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/admin/integrations"}

/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationAuthConfig.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/ExternalIntegrationAuthConfig.ts

EISDIR: illegal operation on a directory, read '/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/admin/integrations'

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/admin/integrations/[id]/page.tsx","limit":200}

1	"use client";
2	
3	import React, { useCallback, useEffect, useState } from "react";
4	
5	import Link from "next/link";
6	import { useParams, useRouter, useSearchParams } from "next/navigation";
7	import { ArrowLeft, Loader2, Settings, Wand2 } from "lucide-react";
8	
9	import { AdminOnlyRoute } from "@/app/components/AdminOnlyRoute";
10	import AppLayout from "@/app/components/AppLayout";
11	import EnvironmentsTab from "@/app/components/admin/integrations/EnvironmentsTab";
12	import AuthConfigsTab from "@/app/components/admin/integrations/AuthConfigsTab";
13	import RequestTemplatesTab from "@/app/components/admin/integrations/RequestTemplatesTab";
14	import TestTab from "@/app/components/admin/integrations/TestTab";
15	import CallLogsTab from "@/app/components/admin/integrations/CallLogsTab";
16	import SmartSetupModal from "@/app/components/admin/integrations/SmartSetupModal";
17	import { Button } from "@/app/components/ui/button";
18	import api from "@/app/src/utils/api";
19	import type { ExternalIntegration } from "@/app/types/admin";
20	import { useLMT } from "@/lib/lmt/config";
21	import type { DataModelFieldLite } from "@/app/components/admin/integrations/FieldMappingsEditor";
22	
23	interface IntegrationResponse {
24	  status: "success" | "error";
25	  data?: ExternalIntegration;
26	}
27	
28	interface DataModelFieldsResponse {
29	  status: "success" | "error";
30	  data?: DataModelFieldLite[];
31	}
32	
33	type TabKey = "environments" | "auth" | "templates" | "test" | "logs";
34	const TAB_KEYS: TabKey[] = ["environments", "auth", "templates", "test", "logs"];
35	
36	const IntegrationDetailPage: React.FC = () => {
37	  const { t } = useLMT();
38	  // lmt-translate scans for translate calls and rejects non-literal arguments,
39	  // so we switch over the tab key and hand each branch a literal label.
40	  const tabLabel = (key: TabKey): string => {
41	    switch (key) {
42	      case "environments":
43	        return t("Environments");
44	      case "auth":
45	        return t("Auth Configs");
46	      case "templates":
47	        return t("Request Templates");
48	      case "test":
49	        return t("Test");
50	      case "logs":
51	        return t("Call Logs");
52	    }
53	  };
54	  const params = useParams<{ id: string }>();
55	  const router = useRouter();
56	  const searchParams = useSearchParams();
57	  const id = params.id;
58	
59	  const initialTab = (searchParams.get("tab") as TabKey) || "environments";
60	  const [activeTab, setActiveTab] = useState<TabKey>(initialTab);
61	  const [integration, setIntegration] = useState<ExternalIntegration | null>(null);
62	  const [loading, setLoading] = useState(false);
63	  const [error, setError] = useState("");
64	  const [smartSetupOpen, setSmartSetupOpen] = useState(false);
65	  const [dataModelFields, setDataModelFields] = useState<DataModelFieldLite[]>([]);
66	  const [tabsRefreshKey, setTabsRefreshKey] = useState(0);
67	
68	  const load = useCallback(async () => {
69	    try {
70	      setLoading(true);
71	      setError("");
72	      const res = await api.get<IntegrationResponse>(`/external-integrations/${id}`);
73	      setIntegration(res.data.data ?? null);
74	    } catch {
75	      setError(t("Failed to load integration"));
76	    } finally {
77	      setLoading(false);
78	    }
79	  }, [id, t]);
80	
81	  useEffect(() => {
82	    void load();
83	  }, [load]);
84	
85	  useEffect(() => {
86	    void (async () => {
87	      try {
88	        const res = await api.get<DataModelFieldsResponse>("/data-model/fields");
89	        setDataModelFields(res.data.data ?? []);
90	      } catch {
91	        // Editor falls back to customFieldName paths when DataModelFields can't load.
92	      }
93	    })();
94	  }, []);
95	
96	  const switchTab = (key: TabKey) => {
97	    setActiveTab(key);
98	    const url = new URL(window.location.href);
99	    url.searchParams.set("tab", key);
100	    router.replace(`${url.pathname}${url.search}`, { scroll: false });
101	  };
102	
103	  return (
104	    <AdminOnlyRoute>
105	      <AppLayout>
106	        <div className="mx-auto max-w-5xl space-y-6 p-6">
107	          <div>
108	            <Link
109	              href="/admin?tab=integrations"
110	              className="inline-flex items-center text-sm text-gray-500 hover:text-gray-900"
111	            >
112	              <ArrowLeft className="mr-1 h-4 w-4" />
113	              {t("Back to integrations")}
114	            </Link>
115	          </div>
116	
117	          {error && (
118	            <div className="rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700">
119	              {error}
120	            </div>
121	          )}
122	
123	          {loading && !integration && (
124	            <div className="flex items-center gap-2 text-sm text-gray-600">
125	              <Loader2 className="h-4 w-4 animate-spin" />
126	              {t("Loading...")}
127	            </div>
128	          )}
129	
130	          {integration && (
131	            <>
132	              {/* Header */}
133	              <div>
134	                <h1 className="text-2xl font-semibold tracking-tight text-gray-900">
135	                  {integration.name}
136	                </h1>
137	                <p className="mt-1 text-sm text-gray-500">
138	                  <span className="font-mono">{integration.slug}</span>
139	                  {" · "}
140	                  {integration.capability}
141	                  {" · "}
142	                  {integration.kind}
143	                  {" · "}
144	                  {t("default env")}: {integration.defaultEnvironment}
145	                  {" · "}
146	                  <span
147	                    className={
148	                      integration.active ? "text-emerald-700" : "text-gray-500"
149	                    }
150	                  >
151	                    {integration.active ? t("Active") : t("Inactive")}
152	                  </span>
153	                </p>
154	              </div>
155	
156	              {/* Smart Setup hero */}
157	              <div className="rounded-2xl border border-gray-200 bg-gradient-to-br from-purple-50 via-white to-blue-50 p-6 shadow-sm">
158	                <div className="flex items-start gap-4">
159	                  <div className="rounded-lg bg-purple-100 p-2 text-purple-700">
160	                    <Wand2 className="h-6 w-6" />
161	                  </div>
162	                  <div className="flex-1">
163	                    <div className="text-lg font-semibold text-gray-900">
164	                      {t("Smart Setup")}
165	                    </div>
166	                    <p className="mt-1 text-sm text-gray-600">
167	                      {t(
168	                        "Paste a cURL command, Postman collection, or OpenAPI spec. The AI configures the environment, authentication, request template, and field mappings for you in one go.",
169	                      )}
170	                    </p>
171	                    <div className="mt-3">
172	                      <Button onClick={() => setSmartSetupOpen(true)}>
173	                        <Wand2 className="mr-2 h-4 w-4" />
174	                        {t("Smart Setup with AI")}
175	                      </Button>
176	                    </div>
177	                  </div>
178	                </div>
179	              </div>
180	
181	              {/* Settings — always visible */}
182	              <div className="rounded-2xl border border-gray-200 bg-white p-1 shadow-sm">
183	                <div className="border-b border-gray-200 px-4 pt-3 pb-2">
184	                  <div className="flex items-center gap-2 text-sm font-semibold text-gray-700">
185	                    <Settings className="h-4 w-4" />
186	                    {t("Settings")}
187	                  </div>
188	                  <p className="mt-0.5 text-xs text-gray-500">
189	                    {t(
190	                      "Manage environments, auth configs, request templates, run tests, and review call lo

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationAuthConfig.ts"}

1	import { Table, Column, Model, DataType, ForeignKey, BelongsTo } from 'sequelize-typescript';
2	import { _ExternalIntegrationEnvironment } from './_ExternalIntegrationEnvironment.js';
3	
4	export type ExternalIntegrationAuthType =
5	  | 'client_credentials'
6	  | 'username_password'
7	  | 'api_key'
8	  | 'basic_auth'
9	  | 'oauth2_code'
10	  | 'custom';
11	
12	export type ExternalIntegrationTokenType = 'bearer' | 'basic' | 'custom';
13	
14	@Table({
15	  modelName: 'ExternalIntegrationAuthConfig',
16	  timestamps: true,
17	  indexes: [
18	    {
19	      fields: ['environmentId'],
20	      name: 'idx_external_integration_auth_config_environment_id',
21	    },
22	    {
23	      fields: ['active'],
24	      name: 'idx_external_integration_auth_config_active',
25	    },
26	  ],
27	})
28	export class _ExternalIntegrationAuthConfig extends Model {
29	  @Column({
30	    type: DataType.UUID,
31	    defaultValue: DataType.UUIDV4,
32	    primaryKey: true,
33	  })
34	  declare id: string;
35	
36	  @ForeignKey(() => _ExternalIntegrationEnvironment)
37	  @Column({
38	    type: DataType.UUID,
39	    allowNull: false,
40	  })
41	  declare environmentId: string;
42	
43	  @Column({
44	    type: DataType.ENUM(
45	      'client_credentials',
46	      'username_password',
47	      'api_key',
48	      'basic_auth',
49	      'oauth2_code',
50	      'custom',
51	    ),
52	    allowNull: false,
53	  })
54	  declare authType: ExternalIntegrationAuthType;
55	
56	  @Column({
57	    type: DataType.ENUM('bearer', 'basic', 'custom'),
58	    allowNull: false,
59	    defaultValue: 'bearer',
60	  })
61	  declare tokenType: ExternalIntegrationTokenType;
62	
63	  @Column({
64	    type: DataType.STRING(255),
65	    allowNull: false,
66	    defaultValue: 'Bearer {token}',
67	  })
68	  declare authorizationHeaderFormat: string;
69	
70	  @Column({
71	    type: DataType.TEXT,
72	    allowNull: false,
73	  })
74	  declare encryptedCredentials: string;
75	
76	  @Column({
77	    type: DataType.BOOLEAN,
78	    allowNull: false,
79	    defaultValue: true,
80	  })
81	  declare active: boolean;
82	
83	  @Column({
84	    type: DataType.DATE,
85	    allowNull: false,
86	  })
87	  declare createdAt: Date;
88	
89	  @Column({
90	    type: DataType.DATE,
91	    allowNull: false,
92	  })
93	  declare updatedAt: Date;
94	
95	  @BelongsTo(() => _ExternalIntegrationEnvironment, { foreignKey: 'environmentId', as: 'environment' })
96	  declare environment?: _ExternalIntegrationEnvironment;
97	}
98	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/externalIntegrationSmartSetup.ts","limit":100}

1	export type IntegrationCapability = "sanction_screening";
2	export type IntegrationHttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
3	export type SmartSetupSourceKind = "curl" | "postman" | "openapi" | "raw";
4	
5	export interface SmartSetupDataModelFieldRef {
6	  id: number;
7	  name: string;
8	  label: string;
9	  description?: string;
10	  type?: string;
11	}
12	
13	export interface ExternalIntegrationSmartSetupInput {
14	  capability: IntegrationCapability;
15	  /** "screen" for sanction_screening today. Capabilities define their own operation names. */
16	  operation: string;
17	  sourceKind: SmartSetupSourceKind;
18	  /** Raw text of the imported source (cURL string, Postman JSON, OpenAPI JSON/YAML). */
19	  source: string;
20	  /** Pre-extracted hint when the client has already parsed enough to identify
21	   * a single endpoint (e.g. OpenAPI operation `POST /match/{dataset}`). */
22	  sourceHint?: string;
23	  /** Sample JSON response if the user pasted one alongside the import — used
24	   * for both responseMapping inference and to seed the inbound field mappings. */
25	  jsonResponseInput?: string;
26	  dataModelFields: SmartSetupDataModelFieldRef[];
27	}
28	
29	export interface LLMConfig {
30	  model: string;
31	  thinkingLevel: string;
32	  prompt: string;
33	  temperature: number;
34	  maxTokens: number;
35	}
36	
37	const CAPABILITY_OUTPUT_CONTRACT: Record<IntegrationCapability, string> = {
38	  sanction_screening: `
39	The integration runner invokes operation='screen' with this typed input shape:
40	  {
41	    "parties": [
42	      { "role": "policyholder" | "insured" | "beneficiary",
43	        "firstName": string, "lastName": string,
44	        "dateOfBirth": string | null, "nationality": string | null }
45	    ]
46	  }
47	
48	The runner expects the rendered response to expose a 'matches' key
49	containing an array of objects with at least:
50	  { "entityId": string, "entityName": string, "score": number,
51	    "topics": string[], "datasets": string[], "sourceUrl": string | null }
52	
53	The responseMapping field MUST lift the provider's matches array under the
54	key "matches". Inbound field mappings then alias each match's provider
55	fields onto entityId / entityName / score / topics / datasets / sourceUrl.
56	`,
57	};
58	
59	export function buildExternalIntegrationSmartSetupPrompt(
60	  input: ExternalIntegrationSmartSetupInput,
61	): LLMConfig {
62	  const { capability, operation, sourceKind, source, sourceHint, jsonResponseInput, dataModelFields } =
63	    input;
64	
65	  const dataModelFieldsReference =
66	    dataModelFields.length > 0
67	      ? dataModelFields
68	          .map((f) => {
69	            const parts = [
70	              `${f.name} (ID: ${f.id})`,
71	              `Label: "${f.label}"`,
72	              f.description ? `Description: "${f.description}"` : null,
73	              f.type ? `Type: ${f.type}` : null,
74	            ].filter(Boolean);
75	            return `  - ${parts.join(", ")}`;
76	          })
77	          .join("\n")
78	      : "  (no DataModel fields supplied — fall back to customFieldName paths)";
79	
80	  const capabilityContract =
81	    CAPABILITY_OUTPUT_CONTRACT[capability] ??
82	    `Project-defined capability '${capability}'. Use sensible defaults; the responseMapping must expose the keys the runner expects for this capability.`;
83	
84	  const sourceLabel = {
85	    curl: "cURL command",
86	    postman: "Postman collection (v2.1)",
87	    openapi: "OpenAPI 3.x specification",
88	    raw: "Raw integration source",
89	  }[sourceKind];
90	
91	  const prompt = `You are an API-integration onboarding expert. The user pasted a ${sourceLabel} for a third-party API. Produce a single JSON bundle that configures Sherpa's external-integration runner end-to-end: environment, auth config, request template, and field mappings. The bundle is consumed by an admin UI which previews and then persists each row.
92	
93	CAPABILITY: ${capability}
94	OPERATION: ${operation}
95	${capabilityContract}
96	
97	${sourceHint ? `OPERATION HINT: ${sourceHint}\n` : ""}SOURCE (${sourceKind}):
98	${source}
99	${jsonResponseInput ? `\nSAMPLE JSON RESPONSE (for response shape + inbound mappings):\n${jsonResponseInput}\n` : ""}
100	

{"command":"find /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models -name \"*FieldMapping*\" -o -name \"*Parties*\" | head -10"}

/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/ExternalIntegrationFieldMapping.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/PartnerFieldMapping.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationFieldMapping.ts

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationFieldMapping.ts"}

1	import { Table, Column, Model, DataType, ForeignKey, BelongsTo } from 'sequelize-typescript';
2	import { _ExternalIntegrationRequestTemplate } from './_ExternalIntegrationRequestTemplate.js';
3	import { DataModelField } from '../DataModelField.js';
4	
5	export type ExternalIntegrationFieldMappingDirection = 'request' | 'response';
6	
7	@Table({
8	  modelName: 'ExternalIntegrationFieldMapping',
9	  timestamps: true,
10	  indexes: [
11	    {
12	      fields: ['requestTemplateId', 'direction'],
13	      name: 'idx_external_integration_field_mappings_template_direction',
14	    },
15	    {
16	      fields: ['dataModelFieldId'],
17	      name: 'idx_external_integration_field_mappings_data_model_field',
18	    },
19	  ],
20	})
21	export class _ExternalIntegrationFieldMapping extends Model {
22	  @Column({
23	    type: DataType.UUID,
24	    defaultValue: DataType.UUIDV4,
25	    primaryKey: true,
26	  })
27	  declare id: string;
28	
29	  @ForeignKey(() => _ExternalIntegrationRequestTemplate)
30	  @Column({ type: DataType.UUID, allowNull: false })
31	  declare requestTemplateId: string;
32	
33	  @Column({
34	    type: DataType.ENUM('request', 'response'),
35	    allowNull: false,
36	  })
37	  declare direction: ExternalIntegrationFieldMappingDirection;
38	
39	  @Column({ type: DataType.STRING(500), allowNull: false })
40	  declare providerFieldPath: string;
41	
42	  @ForeignKey(() => DataModelField)
43	  @Column({ type: DataType.INTEGER, allowNull: true })
44	  declare dataModelFieldId: number | null;
45	
46	  @Column({ type: DataType.STRING(255), allowNull: true })
47	  declare customFieldName: string | null;
48	
49	  @Column({ type: DataType.STRING(100), allowNull: true })
50	  declare transformationFunction: string | null;
51	
52	  @Column({ type: DataType.JSONB, allowNull: true })
53	  declare enumMapping: Record<string, string> | null;
54	
55	  @Column({ type: DataType.BOOLEAN, allowNull: false, defaultValue: false })
56	  declare isRequired: boolean;
57	
58	  @Column({ type: DataType.TEXT, allowNull: true })
59	  declare defaultValue: string | null;
60	
61	  @Column({ type: DataType.DATE, allowNull: false })
62	  declare createdAt: Date;
63	
64	  @Column({ type: DataType.DATE, allowNull: false })
65	  declare updatedAt: Date;
66	
67	  @BelongsTo(() => _ExternalIntegrationRequestTemplate, {
68	    foreignKey: 'requestTemplateId',
69	    as: 'requestTemplate',
70	  })
71	  declare requestTemplate?: _ExternalIntegrationRequestTemplate;
72	
73	  @BelongsTo(() => DataModelField, { foreignKey: 'dataModelFieldId', as: 'dataModelField' })
74	  declare dataModelField?: DataModelField;
75	}
76	

{"command":"grep -r \"credit_check\" /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app --include=\"*.ts\" --include=\"*.tsx\" | head -20"}

(Bash completed with no output)

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationRequestTemplate.ts"}

{"pattern":"CAPABILITY_REGISTRY|CAPABILITIES.*sanction|fraud_detection","path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat","output_mode":"files_with_matches"}

1	import { Table, Column, Model, DataType, ForeignKey, BelongsTo } from 'sequelize-typescript';
2	import { _ExternalIntegration } from './_ExternalIntegration.js';
3	
4	export type ExternalIntegrationHttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
5	
6	/**
7	 * Per-attempt retry policy applied by the runner. All fields required to keep
8	 * behaviour explicit — there is no implicit retry policy.
9	 */
10	export interface RetryPolicy {
11	  attempts: number;        // total attempts (1 = no retry)
12	  initialDelayMs: number;  // first backoff delay
13	  backoffMultiplier: number; // delay *= multiplier per retry (e.g. 2 for exp)
14	  maxDelayMs: number;      // cap on delay between retries
15	  retryOnStatuses: number[]; // e.g. [429, 502, 503, 504]
16	}
17	
18	@Table({
19	  modelName: 'ExternalIntegrationRequestTemplate',
20	  timestamps: true,
21	  indexes: [
22	    {
23	      fields: ['integrationId'],
24	      name: 'idx_external_integration_request_template_integration_id',
25	    },
26	    {
27	      unique: true,
28	      fields: ['integrationId', 'operation'],
29	      name: 'unique_external_integration_request_template_op',
30	    },
31	  ],
32	})
33	export class _ExternalIntegrationRequestTemplate extends Model {
34	  @Column({
35	    type: DataType.UUID,
36	    defaultValue: DataType.UUIDV4,
37	    primaryKey: true,
38	  })
39	  declare id: string;
40	
41	  @ForeignKey(() => _ExternalIntegration)
42	  @Column({
43	    type: DataType.UUID,
44	    allowNull: false,
45	  })
46	  declare integrationId: string;
47	
48	  @Column({
49	    type: DataType.STRING(100),
50	    allowNull: false,
51	    validate: { notEmpty: true, len: [1, 100] },
52	  })
53	  declare operation: string;
54	
55	  @Column({
56	    type: DataType.ENUM('GET', 'POST', 'PUT', 'PATCH', 'DELETE'),
57	    allowNull: false,
58	  })
59	  declare httpMethod: ExternalIntegrationHttpMethod;
60	
61	  @Column({
62	    type: DataType.STRING(1000),
63	    allowNull: false,
64	    validate: { notEmpty: true, len: [1, 1000] },
65	  })
66	  declare urlTemplate: string;
67	
68	  @Column({
69	    type: DataType.JSONB,
70	    allowNull: true,
71	  })
72	  declare requestHeadersTemplate: Record<string, string> | null;
73	
74	  @Column({
75	    type: DataType.JSONB,
76	    allowNull: true,
77	  })
78	  declare requestBodyTemplate: Record<string, unknown> | null;
79	
80	  @Column({
81	    type: DataType.JSONB,
82	    allowNull: false,
83	  })
84	  declare responseMapping: Record<string, string>;
85	
86	  @Column({
87	    type: DataType.JSONB,
88	    allowNull: true,
89	  })
90	  declare errorMapping: Record<string, string> | null;
91	
92	  @Column({
93	    type: DataType.INTEGER,
94	    allowNull: false,
95	    defaultValue: 10000,
96	    validate: { min: 100, max: 120000 },
97	  })
98	  declare timeoutMs: number;
99	
100	  @Column({
101	    type: DataType.JSONB,
102	    allowNull: true,
103	  })
104	  declare retryPolicy: RetryPolicy | null;
105	
106	  @Column({
107	    type: DataType.DATE,
108	    allowNull: false,
109	  })
110	  declare createdAt: Date;
111	
112	  @Column({
113	    type: DataType.DATE,
114	    allowNull: false,
115	  })
116	  declare updatedAt: Date;
117	
118	  @BelongsTo(() => _ExternalIntegration, { foreignKey: 'integrationId', as: 'integration' })
119	  declare integration?: _ExternalIntegration;
120	}
121	

Found 6 files
sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts
sherpa-portal-api-458-credit-check-compliance-integrat/app/policy-management/screening/page.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/screening/SanctionScreeningPanel.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/compliance/ComplianceChecksSection.tsx
sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/IntegrationsTab.tsx

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationCallLog.ts"}

1	import { Table, Column, Model, DataType, ForeignKey, BelongsTo } from 'sequelize-typescript';
2	import { _ExternalIntegration } from './_ExternalIntegration.js';
3	import { Organization } from '../Organization.js';
4	
5	export type ExternalIntegrationCallStatus = 'success' | 'error' | 'timeout' | 'circuit_open';
6	
7	@Table({
8	  modelName: 'ExternalIntegrationCallLog',
9	  timestamps: false,
10	  indexes: [
11	    {
12	      fields: ['integrationId', 'createdAt'],
13	      name: 'idx_external_integration_call_log_integration_created',
14	    },
15	    {
16	      fields: ['organizationId', 'createdAt'],
17	      name: 'idx_external_integration_call_log_org_created',
18	    },
19	    {
20	      fields: ['correlationId'],
21	      name: 'idx_external_integration_call_log_correlation_id',
22	    },
23	  ],
24	})
25	export class _ExternalIntegrationCallLog extends Model {
26	  @Column({
27	    type: DataType.UUID,
28	    defaultValue: DataType.UUIDV4,
29	    primaryKey: true,
30	  })
31	  declare id: string;
32	
33	  @ForeignKey(() => _ExternalIntegration)
34	  @Column({
35	    type: DataType.UUID,
36	    allowNull: false,
37	  })
38	  declare integrationId: string;
39	
40	  @ForeignKey(() => Organization)
41	  @Column({
42	    type: DataType.UUID,
43	    allowNull: false,
44	  })
45	  declare organizationId: string;
46	
47	  @Column({
48	    type: DataType.ENUM('sanction_screening'),
49	    allowNull: false,
50	  })
51	  declare capability: 'sanction_screening';
52	
53	  @Column({
54	    type: DataType.STRING(100),
55	    allowNull: false,
56	  })
57	  declare operation: string;
58	
59	  @Column({
60	    type: DataType.STRING(100),
61	    allowNull: false,
62	  })
63	  declare correlationId: string;
64	
65	  @Column({
66	    type: DataType.ENUM('success', 'error', 'timeout', 'circuit_open'),
67	    allowNull: false,
68	  })
69	  declare status: ExternalIntegrationCallStatus;
70	
71	  @Column({
72	    type: DataType.INTEGER,
73	    allowNull: true,
74	  })
75	  declare httpStatus: number | null;
76	
77	  @Column({
78	    type: DataType.INTEGER,
79	    allowNull: false,
80	  })
81	  declare durationMs: number;
82	
83	  @Column({
84	    type: DataType.INTEGER,
85	    allowNull: false,
86	    defaultValue: 1,
87	  })
88	  declare attempts: number;
89	
90	  @Column({
91	    type: DataType.JSONB,
92	    allowNull: true,
93	  })
94	  declare requestExcerpt: Record<string, unknown> | null;
95	
96	  @Column({
97	    type: DataType.JSONB,
98	    allowNull: true,
99	  })
100	  declare responseExcerpt: Record<string, unknown> | null;
101	
102	  @Column({
103	    type: DataType.TEXT,
104	    allowNull: true,
105	  })
106	  declare errorMessage: string | null;
107	
108	  @Column({
109	    type: DataType.DATE,
110	    allowNull: false,
111	  })
112	  declare createdAt: Date;
113	
114	  @BelongsTo(() => _ExternalIntegration, { foreignKey: 'integrationId', as: 'integration' })
115	  declare integration?: _ExternalIntegration;
116	}
117	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/integration/ExternalIntegration.ts","limit":200}

1	import { Type, type Static } from '@sinclair/typebox';
2	import { Uuid, IsoDateTime } from '../_helpers.js';
3	
4	export const ExternalIntegrationPublicFields = [
5	  'id',
6	  'organizationId',
7	  'name',
8	  'slug',
9	  'capability',
10	  'kind',
11	  'defaultEnvironment',
12	  'active',
13	  'invocationMode',
14	  'syncTimeoutMs',
15	  'createdAt',
16	  'updatedAt',
17	] as const;
18	
19	export const ExternalIntegrationPrivateFields = [] as const;
20	
21	export const ExternalIntegrationSchema = Type.Object(
22	  {
23	    id: Uuid({ description: 'External integration UUID.' }),
24	    organizationId: Uuid({ description: 'Owning organisation.' }),
25	    name: Type.String({
26	      minLength: 1,
27	      maxLength: 255,
28	      description: 'Human-readable integration name.',
29	      example: 'OpenSanctions',
30	    }),
31	    slug: Type.String({
32	      minLength: 1,
33	      maxLength: 100,
34	      description: 'Slug used by capability handlers to resolve this integration.',
35	      example: 'opensanctions',
36	    }),
37	    capability: Type.String({
38	      description: 'Which capability contract this integration fulfils (sanction_screening, pep, kyc, adverse_media, fraud_detection).',
39	    }),
40	    kind: Type.Union(
41	      [Type.Literal('generic_rest')],
42	      {
43	        description:
44	          'How the runner talks to the provider. "generic_rest" uses templated config; vendor-coded kinds may be added later.',
45	      },
46	    ),
47	    defaultEnvironment: Type.Union(
48	      [Type.Literal('test'), Type.Literal('staging'), Type.Literal('production')],
49	      { description: 'Default environment used when the consumer does not specify one.' },
50	    ),
51	    active: Type.Boolean({ description: 'Whether the runner should consider this integration.' }),
52	    invocationMode: Type.Union(
53	      [Type.Literal('sync'), Type.Literal('async')],
54	      { description: 'How the compliance gate invokes this integration. sync = inline call; async = enqueue + park policy in compliance_pending.' },
55	    ),
56	    syncTimeoutMs: Type.Integer({
57	      minimum: 100,
58	      maximum: 60000,
59	      description: 'Inline-call timeout for sync mode. On expiry the gate falls back to async semantics.',
60	    }),
61	    createdAt: IsoDateTime({ description: 'Creation timestamp.' }),
62	    updatedAt: IsoDateTime({ description: 'Last update timestamp.' }),
63	  },
64	  {
65	    $id: 'ExternalIntegration',
66	    additionalProperties: true,
67	    description:
68	      'Per-organisation outbound third-party integration (sanction screening, fraud, KYC, ...). Groups environments, auth configs and templates used by the integration runner.',
69	  },
70	);
71	
72	export type ExternalIntegration = Static<typeof ExternalIntegrationSchema>;
73	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/complianceMessageService.ts"}

1	import logger from '@/logger.js';
2	import valkeyClient from '@/valkeyClient.js';
3	import { CustomerNotification, type CustomerNotificationType } from '@/models/CustomerNotification.js';
4	import { Customer } from '@/models/Customer.js';
5	import { PolicyOrder } from '@/models/PolicyOrder.js';
6	import { ClaimRecord } from '@/models/ClaimRecord.js';
7	import { Product } from '@/models/Product.js';
8	import { Insurer } from '@/models/Insurer.js';
9	import type { _ComplianceCheck } from '@/models/ComplianceCheck.js';
10	import { sendEmail } from './emailService.js';
11	
12	export type ComplianceOutcomeMode = 'fail' | 'review';
13	
14	interface NotifyTarget {
15	  customer: { id: string; email: string; firstName: string | null; lastName: string | null; getFullName(): string };
16	  policyId: string | null;
17	  claimRecordId: string | null;
18	  notificationType: CustomerNotificationType;
19	}
20	
21	function customerNotifyChannel(customerId: string): string {
22	  return `claim:notify:${customerId}`;
23	}
24	
25	function wrapEmailHtml(content: string): string {
26	  return `<!DOCTYPE html>
27	<html>
28	<head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"></head>
29	<body style="margin:0;padding:0;background-color:#F7F8F9;font-family:Arial,sans-serif;">
30	<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background-color:#F7F8F9;">
31	<tr><td align="center" style="padding:30px 0;">
32	  <table role="presentation" width="500" cellpadding="0" cellspacing="0" style="background-color:#ffffff;border-radius:4px;">
33	    <tr><td style="background-color:#2563eb;padding:24px 30px;border-radius:4px 4px 0 0;">
34	      <span style="color:#ffffff;font-size:20px;font-weight:bold;font-family:Arial,sans-serif;">Sherpa Insurance</span>
35	    </td></tr>
36	    <tr><td style="padding:30px;color:#333333;font-size:14px;line-height:1.6;font-family:Arial,sans-serif;">
37	      ${content}
38	    </td></tr>
39	    <tr><td style="border-top:1px solid #e8e8e8;padding:20px 30px;text-align:center;color:#999999;font-size:12px;font-family:Arial,sans-serif;">
40	      &copy; ${new Date().getFullYear()} Sherpa Insurance. All rights reserved.
41	    </td></tr>
42	  </table>
43	</td></tr>
44	</table>
45	</body>
46	</html>`;
47	}
48	
49	async function resolveTarget(
50	  check: _ComplianceCheck,
51	  organizationId: string,
52	): Promise<NotifyTarget | null> {
53	  const ctx = { organizationId };
54	
55	  if (check.claimRecordId) {
56	    const claim = await ClaimRecord.findByPk(ctx, check.claimRecordId);
57	    if (!claim) return null;
58	    const policyOrder = await PolicyOrder.findOne(ctx, { where: { policyId: claim.policyId } });
59	    const customerId = check.customerId ?? policyOrder?.customerId ?? null;
60	    if (!customerId) return null;
61	    const customer = await Customer.findByPk(ctx, customerId);
62	    if (!customer || !customer.email) return null;
63	    return {
64	      customer,
65	      policyId: null,
66	      claimRecordId: claim.id,
67	      notificationType: 'claim_message',
68	    };
69	  }
70	
71	  if (check.policyOrderId) {
72	    const policyOrder = await PolicyOrder.findByPk(ctx, check.policyOrderId);
73	    if (!policyOrder?.customerId) return null;
74	    const customer = await Customer.findByPk(ctx, policyOrder.customerId);
75	    if (!customer || !customer.email) return null;
76	    return {
77	      customer,
78	      policyId: policyOrder.policyId,
79	      claimRecordId: null,
80	      notificationType: 'policy_message',
81	    };
82	  }
83	
84	  return null;
85	}
86	
87	function defaultMessage(mode: ComplianceOutcomeMode): { title: string; body: string } {
88	  if (mode === 'fail') {
89	    return {
90	      title: 'Your application could not be approved',
91	      body: 'We were unable to approve your application at this time. If you have questions please contact our support team.',
92	    };
93	  }
94	  return {
95	    title: 'Your application is under review',
96	    body: 'Your application requires additional review. We will notify you as soon as the review is complete.',
97	  };
98	}
99	
100	export async function notifyComplianceOutcome(
101	  check: _ComplianceCheck,
102	  organizationId: string,
103	  mode: ComplianceOutcomeMode,
104	  configuredMessage: string | null | undefined,
105	): Promise<void> {
106	  const target = await resolveTarget(check, organizationId);
107	  if (!target) {
108	    logger.info(
109	      { checkId: check.id, mode },
110	      'notifyComplianceOutcome: no resolvable customer; skipping notification',
111	    );
112	    return;
113	  }
114	
115	  const { title: defaultTitle, body: defaultBody } = defaultMessage(mode);
116	  const body = configuredMessage?.trim() || defaultBody;
117	  const title = defaultTitle;
118	
119	  const ctx = { organizationId };
120	  const notification = await CustomerNotification.create(ctx, {
121	    organizationId,
122	    customerId: target.customer.id,
123	    type: target.notificationType,
124	    claimRecordId: target.claimRecordId,
125	    claimMessageId: null,
126	    policyId: target.policyId,
127	    policyMessageId: null,
128	    title,
129	    body,
130	  });
131	
132	  try {
133	    await valkeyClient.client?.publish(
134	      customerNotifyChannel(target.customer.id),
135	      JSON.stringify({
136	        type: 'notification',
137	        data: {
138	          id: notification.id,
139	          type: target.notificationType,
140	          claimRecordId: target.claimRecordId,
141	          claimMessageId: null,
142	          policyId: target.policyId,
143	          policyMessageId: null,
144	          title,
145	          body,
146	          readAt: null,
147	          createdAt: notification.createdAt,
148	        },
149	      }),
150	    );
151	  } catch (err) {
152	    logger.warn({ err, customerId: target.customer.id }, 'Failed to publish compliance notification');
153	  }
154	
155	  const product = await Product.findByPk(ctx, check.productId, {
156	    include: [{ model: Insurer, as: 'insurer', attributes: ['name', 'email'] }],
157	  });
158	  let fromAddress: string | undefined;
159	  if (product?.insurer?.email) {
160	    fromAddress = `"${product.insurer.name}" <${product.insurer.email}>`;
161	  }
162	
163	  const customerName = target.customer.getFullName();
164	  const safeBody = body.replace(/\n/g, '<br/>');
165	  const html = wrapEmailHtml(`
166	    <p style="margin:0 0 16px;">Hello ${customerName},</p>
167	    <p style="margin:0 0 16px;">${safeBody}</p>
168	  `);
169	  const text = `Hello ${customerName},\n\n${body}`;
170	
171	  sendEmail(target.customer.email, title, text, html, undefined, fromAddress).catch((err) => {
172	    logger.warn(
173	      { err, customerId: target.customer.id, checkId: check.id },
174	      'Failed to send compliance outcome email',
175	    );
176	  });
177	}
178	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.06.add-compliance-pending-lifecycle.ts"}

1	import { QueryInterface } from 'sequelize';
2	import type { MigrationFn } from 'umzug';
3	
4	/**
5	 * Add `compliance_pending` to the policy-status lifecycle category enum and
6	 * seed a default `compliance_pending` row for every existing organisation so
7	 * the compliance gate can always park a policy in a real, queryable state.
8	 *
9	 * Also add `complianceCheckIds` JSONB on PolicyOrders so a freshly-parked
10	 * policy can carry the {capability: checkId} map needed to activate it once
11	 * the checks clear.
12	 */
13	export const up: MigrationFn<QueryInterface> = async ({ context }) => {
14	  await context.sequelize.query(`
15	    ALTER TYPE "enum_OrganizationPolicyStatuses_lifecycleCategory"
16	    ADD VALUE IF NOT EXISTS 'compliance_pending';
17	  `);
18	
19	  await context.sequelize.query(`
20	    INSERT INTO "OrganizationPolicyStatuses"
21	      ("id", "organizationId", code, label, color, "lifecycleCategory",
22	       "sortOrder", "isDefault", "isSystem", "createdAt", "updatedAt")
23	    SELECT
24	      gen_random_uuid(),
25	      o.id,
26	      'compliance_pending',
27	      'Compliance Review',
28	      '#F97316',
29	      'compliance_pending',
30	      12,
31	      true,
32	      true,
33	      NOW(),
34	      NOW()
35	    FROM "Organizations" o
36	    WHERE NOT EXISTS (
37	      SELECT 1 FROM "OrganizationPolicyStatuses" s
38	      WHERE s."organizationId" = o.id
39	        AND s."lifecycleCategory" = 'compliance_pending'
40	    )
41	  `);
42	
43	  await context.sequelize.query(`
44	    ALTER TABLE "PolicyOrders"
45	    ADD COLUMN IF NOT EXISTS "complianceCheckIds" JSONB;
46	  `);
47	  await context.sequelize.query(`
48	    ALTER TABLE "PolicyOrders"
49	    ADD COLUMN IF NOT EXISTS "pendingActivationStatus" VARCHAR(64);
50	  `);
51	};
52	
53	export const down: MigrationFn<QueryInterface> = async () => {
54	  // Forward-only deployment.
55	};
56	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.08.add-compliance-blocked-lifecycle.ts"}

1	import { QueryInterface } from 'sequelize';
2	import type { MigrationFn } from 'umzug';
3	
4	/**
5	 * Add `compliance_blocked` lifecycle category so policies with a terminal-fail
6	 * compliance outcome (fail / rejected) park in a distinct, queryable state
7	 * rather than mingling with the manual-review queue.
8	 *
9	 *   compliance_pending  → reviewable (worker still running, outcome=review,
10	 *                         or any check awaiting admin attention).
11	 *   compliance_blocked  → auto-denied (every blocking outcome is terminal
12	 *                         fail/rejected); admin can still override.
13	 *
14	 * Seeds a default `compliance_blocked` row for every existing org.
15	 */
16	export const up: MigrationFn<QueryInterface> = async ({ context }) => {
17	  await context.sequelize.query(`
18	    ALTER TYPE "enum_OrganizationPolicyStatuses_lifecycleCategory"
19	    ADD VALUE IF NOT EXISTS 'compliance_blocked';
20	  `);
21	
22	  await context.sequelize.query(`
23	    INSERT INTO "OrganizationPolicyStatuses"
24	      ("id", "organizationId", code, label, color, "lifecycleCategory",
25	       "sortOrder", "isDefault", "isSystem", "createdAt", "updatedAt")
26	    SELECT
27	      gen_random_uuid(),
28	      o.id,
29	      'compliance_blocked',
30	      'Compliance Denied',
31	      '#DC2626',
32	      'compliance_blocked',
33	      13,
34	      true,
35	      true,
36	      NOW(),
37	      NOW()
38	    FROM "Organizations" o
39	    WHERE NOT EXISTS (
40	      SELECT 1 FROM "OrganizationPolicyStatuses" s
41	      WHERE s."organizationId" = o.id
42	        AND s."lifecycleCategory" = 'compliance_blocked'
43	    )
44	  `);
45	};
46	
47	export const down: MigrationFn<QueryInterface> = async () => {
48	  // Forward-only deployment.
49	};
50	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.03.add-claim-customer-and-extended-triggers.ts"}

1	import { QueryInterface } from 'sequelize';
2	import type { MigrationFn } from 'umzug';
3	
4	// Adds polymorphic parent FKs (claimRecordId, customerId) and extends
5	// triggerType with CLAIM/ENDORSEMENT/MANUAL so ComplianceChecks can gate
6	// claim creation and one-off manual checks, not just policy issuance.
7	// Idempotent — uses IF NOT EXISTS guards so re-applying is safe.
8	export const up: MigrationFn<QueryInterface> = async ({ context }) => {
9	  await context.sequelize.query(
10	    `ALTER TABLE "ComplianceChecks" ADD COLUMN IF NOT EXISTS "claimRecordId" UUID REFERENCES "ClaimRecords"("id") ON DELETE SET NULL`,
11	  );
12	  await context.sequelize.query(
13	    `ALTER TABLE "ComplianceChecks" ADD COLUMN IF NOT EXISTS "customerId" UUID REFERENCES "Customers"("id") ON DELETE SET NULL`,
14	  );
15	
16	  await context.sequelize.query(
17	    `CREATE INDEX IF NOT EXISTS "idx_compliance_checks_claim_record_id" ON "ComplianceChecks" ("claimRecordId")`,
18	  );
19	  await context.sequelize.query(
20	    `CREATE INDEX IF NOT EXISTS "idx_compliance_checks_customer_id" ON "ComplianceChecks" ("customerId")`,
21	  );
22	
23	  await context.sequelize.query(
24	    `ALTER TYPE "enum_ComplianceChecks_triggerType" ADD VALUE IF NOT EXISTS 'ENDORSEMENT'`,
25	  );
26	  await context.sequelize.query(
27	    `ALTER TYPE "enum_ComplianceChecks_triggerType" ADD VALUE IF NOT EXISTS 'CLAIM'`,
28	  );
29	  await context.sequelize.query(
30	    `ALTER TYPE "enum_ComplianceChecks_triggerType" ADD VALUE IF NOT EXISTS 'MANUAL'`,
31	  );
32	};
33	
34	export const down: MigrationFn<QueryInterface> = async () => {
35	  // Forward-only deployment
36	};
37	

{"command":"grep -n \"sanction\\|compliance\\|externalIntegration\" /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes/index.ts"}

Exit code 2
grep: /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes/index.ts: No such file or directory

{"command":"ls -la /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes/ | head -30"}

total 816
drwxr-xr-x@ 36 bakker  staff   1152 May 31 14:20 .
drwxr-xr-x@ 30 bakker  staff    960 May 31 14:20 ..
-rw-r--r--@  1 bakker  staff   9199 May 31 14:20 addressRoutes.ts
-rw-r--r--@  1 bakker  staff  35767 May 31 14:20 authRoutes.ts
-rw-r--r--@  1 bakker  staff   1770 May 31 14:20 azureAdRoutes.ts
-rw-r--r--@  1 bakker  staff  26981 May 31 14:20 bundleRoutes.ts
-rw-r--r--@  1 bakker  staff   2140 May 31 14:20 claimRetryPayment.apitest.ts
-rw-r--r--@  1 bakker  staff  25907 May 31 14:20 claimRoutes.ts
-rw-r--r--@  1 bakker  staff   5315 May 31 14:20 customerPortalRoutes.ts
-rw-r--r--@  1 bakker  staff  26993 May 31 14:20 customerSelfRoutes.ts
-rw-r--r--@  1 bakker  staff   4771 May 31 14:20 customerTemplateRoutes.ts
-rw-r--r--@  1 bakker  staff   9425 May 31 14:20 dataModelRoutes.ts
-rw-r--r--@  1 bakker  staff   2709 May 31 14:20 docsPdfRoutes.apitest.ts
-rw-r--r--@  1 bakker  staff   4558 May 31 14:20 docsPdfRoutes.ts
-rw-r--r--@  1 bakker  staff  21600 May 31 14:20 embedCheckoutRoutes.test.ts
-rw-r--r--@  1 bakker  staff  33295 May 31 14:20 embedCheckoutRoutes.ts
-rw-r--r--@  1 bakker  staff  10962 May 31 14:20 funnelTemplateSetRoutes.ts
-rw-r--r--@  1 bakker  staff   9040 May 31 14:20 funnelTemplatesRoutes.ts
-rw-r--r--@  1 bakker  staff   3623 May 31 14:20 health.ts
drwxr-xr-x@  3 bakker  staff     96 May 31 14:20 lib
-rw-r--r--@  1 bakker  staff   2711 May 31 14:20 organizationRoutes.apitest.ts
-rw-r--r--@  1 bakker  staff   3115 May 31 14:20 organizationRoutes.ts
-rw-r--r--@  1 bakker  staff   6061 May 31 14:20 organizationSwitchingRoutes.ts
drwxr-xr-x@ 64 bakker  staff   2048 May 31 14:20 plus
-rw-r--r--@  1 bakker  staff   2770 May 31 14:20 policyAcceptanceRoutes.ts
-rw-r--r--@  1 bakker  staff   1727 May 31 14:20 policyPdfDownloadRoutes.ts
-rw-r--r--@  1 bakker  staff  48111 May 31 14:20 policyRoutes.ts
-rw-r--r--@  1 bakker  staff   4337 May 31 14:20 policyStatusRoutes.ts
-rw-r--r--@  1 bakker  staff   3204 May 31 14:20 productApiRoutes.ts

{"command":"grep -n \"sanction\\|compliance\\|externalIntegration\" /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes.ts"}

(Bash completed with no output)

{"command":"ls -la /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes/plus/ | grep -i \"sanction\\|compliance\\|integration\""}

-rw-r--r--@  1 bakker  staff  31036 May 31 14:20 externalIntegrationsRoutes.ts
-rw-r--r--@  1 bakker  staff   8973 May 31 14:20 sanctionScreeningRoutes.ts

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes/plus/externalIntegrationsRoutes.ts","limit":200}

1	import type { FastifyInstance, FastifyPluginAsync } from 'fastify';
2	import { Type } from '@sinclair/typebox';
3	import {
4	  listExternalIntegrations,
5	  getExternalIntegrationById,
6	  createExternalIntegration,
7	  updateExternalIntegration,
8	  deleteExternalIntegration,
9	  listEnvironments,
10	  createEnvironment,
11	  updateEnvironment,
12	  deleteEnvironment,
13	  listAuthConfigs,
14	  createAuthConfig,
15	  updateAuthConfig,
16	  deleteAuthConfig,
17	  listCallLogs,
18	  type CreateExternalIntegrationBody,
19	  type CreateEnvironmentBody,
20	  type CreateAuthConfigBody,
21	} from '@/controllers/externalIntegrationController.js';
22	import {
23	  listRequestTemplates,
24	  createRequestTemplate,
25	  updateRequestTemplate,
26	  deleteRequestTemplate,
27	  testIntegration,
28	  type CreateRequestTemplateBody,
29	  type TestIntegrationBody,
30	} from '@/controllers/externalIntegrationRequestTemplateController.js';
31	import {
32	  listFieldMappings,
33	  createFieldMapping,
34	  updateFieldMapping,
35	  deleteFieldMapping,
36	  bulkReplaceFieldMappings,
37	  type CreateFieldMappingBody,
38	  type BulkReplaceFieldMappingsBody,
39	} from '@/controllers/externalIntegrationFieldMappingController.js';
40	import { PERMISSIONS } from '@/types/permissions.js';
41	
42	const ENVIRONMENT_ENUM = ['test', 'staging', 'production'] as const;
43	const CAPABILITY_ENUM = [
44	  'sanction_screening',
45	  'pep',
46	  'kyc',
47	  'adverse_media',
48	  'fraud_detection',
49	] as const;
50	const KIND_ENUM = ['generic_rest'] as const;
51	const INVOCATION_MODE_ENUM = ['sync', 'async'] as const;
52	const AUTH_TYPE_ENUM = [
53	  'client_credentials',
54	  'username_password',
55	  'api_key',
56	  'basic_auth',
57	  'oauth2_code',
58	  'custom',
59	] as const;
60	const TOKEN_TYPE_ENUM = ['bearer', 'basic', 'custom'] as const;
61	const HTTP_METHOD_ENUM = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'] as const;
62	
63	const retryPolicySchema = {
64	  type: ['object', 'null'],
65	  required: ['attempts', 'initialDelayMs', 'backoffMultiplier', 'maxDelayMs', 'retryOnStatuses'],
66	  additionalProperties: true,
67	  properties: {
68	    attempts: { type: 'integer', minimum: 1, maximum: 10 },
69	    initialDelayMs: { type: 'integer', minimum: 0, maximum: 60000 },
70	    backoffMultiplier: { type: 'number', minimum: 1, maximum: 10 },
71	    maxDelayMs: { type: 'integer', minimum: 0, maximum: 60000 },
72	    retryOnStatuses: {
73	      type: 'array',
74	      items: { type: 'integer', minimum: 100, maximum: 599 },
75	    },
76	  },
77	} as const;
78	
79	const requestTemplateCreateSchema = {
80	  type: 'object',
81	  required: [
82	    'integrationId',
83	    'operation',
84	    'httpMethod',
85	    'urlTemplate',
86	    'requestHeadersTemplate',
87	    'requestBodyTemplate',
88	    'responseMapping',
89	    'errorMapping',
90	    'timeoutMs',
91	    'retryPolicy',
92	  ],
93	  additionalProperties: false,
94	  properties: {
95	    integrationId: { type: 'string', format: 'uuid' },
96	    operation: { type: 'string', minLength: 1, maxLength: 100 },
97	    httpMethod: { type: 'string', enum: [...HTTP_METHOD_ENUM] },
98	    urlTemplate: { type: 'string', minLength: 1, maxLength: 1000 },
99	    requestHeadersTemplate: { type: ['object', 'null'], additionalProperties: { type: 'string' } },
100	    requestBodyTemplate: { type: ['object', 'null'], additionalProperties: true },
101	    responseMapping: { type: 'object', additionalProperties: { type: 'string' } },
102	    errorMapping: { type: ['object', 'null'], additionalProperties: { type: 'string' } },
103	    timeoutMs: { type: 'integer', minimum: 100, maximum: 120000 },
104	    retryPolicy: retryPolicySchema,
105	  },
106	} as const;
107	
108	const requestTemplateUpdateSchema = {
109	  type: 'object',
110	  additionalProperties: false,
111	  properties: {
112	    operation: { type: 'string', minLength: 1, maxLength: 100 },
113	    httpMethod: { type: 'string', enum: [...HTTP_METHOD_ENUM] },
114	    urlTemplate: { type: 'string', minLength: 1, maxLength: 1000 },
115	    requestHeadersTemplate: { type: ['object', 'null'], additionalProperties: { type: 'string' } },
116	    requestBodyTemplate: { type: ['object', 'null'], additionalProperties: true },
117	    responseMapping: { type: 'object', additionalProperties: { type: 'string' } },
118	    errorMapping: { type: ['object', 'null'], additionalProperties: { type: 'string' } },
119	    timeoutMs: { type: 'integer', minimum: 100, maximum: 120000 },
120	    retryPolicy: retryPolicySchema,
121	  },
122	} as const;
123	
124	const testIntegrationSchema = {
125	  type: 'object',
126	  required: ['operation', 'input', 'environment'],
127	  additionalProperties: false,
128	  properties: {
129	    operation: { type: 'string', minLength: 1, maxLength: 100 },
130	    input: { type: 'object', additionalProperties: true },
131	    environment: { type: ['string', 'null'], enum: [...ENVIRONMENT_ENUM, null] },
132	  },
133	} as const;
134	
135	const integrationCreateSchema = {
136	  type: 'object',
137	  required: ['name', 'slug', 'capability', 'kind', 'defaultEnvironment', 'active'],
138	  additionalProperties: false,
139	  properties: {
140	    name: { type: 'string', minLength: 1, maxLength: 255 },
141	    slug: { type: 'string', minLength: 1, maxLength: 100, pattern: '^[a-z0-9][a-z0-9-]*$' },
142	    capability: { type: 'string', enum: [...CAPABILITY_ENUM] },
143	    kind: { type: 'string', enum: [...KIND_ENUM] },
144	    defaultEnvironment: { type: 'string', enum: [...ENVIRONMENT_ENUM] },
145	    active: { type: 'boolean' },
146	    invocationMode: { type: 'string', enum: [...INVOCATION_MODE_ENUM] },
147	    syncTimeoutMs: { type: 'integer', minimum: 100, maximum: 60000 },
148	  },
149	} as const;
150	
151	const integrationUpdateSchema = {
152	  type: 'object',
153	  additionalProperties: false,
154	  properties: {
155	    name: { type: 'string', minLength: 1, maxLength: 255 },
156	    slug: { type: 'string', minLength: 1, maxLength: 100, pattern: '^[a-z0-9][a-z0-9-]*$' },
157	    capability: { type: 'string', enum: [...CAPABILITY_ENUM] },
158	    kind: { type: 'string', enum: [...KIND_ENUM] },
159	    defaultEnvironment: { type: 'string', enum: [...ENVIRONMENT_ENUM] },
160	    active: { type: 'boolean' },
161	    invocationMode: { type: 'string', enum: [...INVOCATION_MODE_ENUM] },
162	    syncTimeoutMs: { type: 'integer', minimum: 100, maximum: 60000 },
163	  },
164	} as const;
165	
166	const environmentCreateSchema = {
167	  type: 'object',
168	  required: ['integrationId', 'environment', 'baseUrl', 'authEndpoint', 'tokenEndpoint'],
169	  additionalProperties: false,
170	  properties: {
171	    integrationId: { type: 'string', format: 'uuid' },
172	    environment: { type: 'string', enum: [...ENVIRONMENT_ENUM] },
173	    baseUrl: { type: 'string', minLength: 1, maxLength: 500, format: 'uri' },
174	    authEndpoint: { type: ['string', 'null'], maxLength: 500 },
175	    tokenEndpoint: { type: ['string', 'null'], maxLength: 500 },
176	  },
177	} as const;
178	
179	const environmentUpdateSchema = {
180	  type: 'object',
181	  additionalProperties: false,
182	  properties: {
183	    environment: { type: 'string', enum: [...ENVIRONMENT_ENUM] },
184	    baseUrl: { type: 'string', minLength: 1, maxLength: 500, format: 'uri' },
185	    authEndpoint: { type: ['string', 'null'], maxLength: 500 },
186	    tokenEndpoint: { type: ['string', 'null'], maxLength: 500 },
187	  },
188	} as const;
189	
190	const authConfigCreateSchema = {
191	  type: 'object',
192	  required: ['environmentId', 'authType', 'tokenType', 'authorizationHeaderFormat', 'active'],
193	  additionalProperties: false,
194	  properties: {
195	    environmentId: { type: 'string', format: 'uuid' },
196	    authType: { type: 'string', enum: [...AUTH_TYPE_ENUM] },
197	    tokenType: { type: 'string', enum: [...TOKEN_TYPE_ENUM] },
198	    authorizationHeaderFormat: { type: 'string', minLength: 1, maxLength: 255 },
199	    active: { type: 'boole

{"command":"grep -n \"sanction_screening\\|capability\" /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationCallLog.ts"}

48:    type: DataType.ENUM('sanction_screening'),
51:  declare capability: 'sanction_screening';

{"command":"ls -la /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/ | tail -20"}

-rw-r--r--@   1 bakker  staff   1887 May 31 14:20 2026.05.21T00.00.02.upgrade-singleton-rls-to-scope-function.ts
-rw-r--r--@   1 bakker  staff    409 May 31 14:20 2026.05.24T00.00.01.add-product-source-locale.ts
-rw-r--r--@   1 bakker  staff    434 May 31 14:20 2026.05.24T00.00.02.add-organization-supported-locales.ts
-rw-r--r--@   1 bakker  staff    510 May 31 14:20 2026.05.24T00.00.03.drop-organization-supported-locales.ts
-rw-r--r--@   1 bakker  staff   2198 May 31 14:20 2026.05.25T00.00.01.scope-mode-strict-by-default-rls.ts
-rw-r--r--@   1 bakker  staff   1356 May 31 14:20 2026.05.26T00.00.01.add-org-read-at-to-messages.ts
-rw-r--r--@   1 bakker  staff    706 May 31 14:20 2026.05.26T00.00.02.add-policy-status-label-translations.ts
-rw-r--r--@   1 bakker  staff    740 May 31 14:20 2026.05.27T00.00.01.add-quote-email-template-type.ts
-rw-r--r--@   1 bakker  staff   5301 May 31 14:20 2026.05.27T00.00.02.seed-quote-email-template.ts
-rw-r--r--@   1 bakker  staff   3922 May 31 14:20 2026.05.27T00.00.03.widen-name-address-patterns-to-unicode.ts
-rw-r--r--@   1 bakker  staff   1976 May 31 14:20 2026.05.27T00.00.04.seed-awaiting-acceptance-policy-status.ts
-rw-r--r--@   1 bakker  staff   6673 May 31 14:20 2026.05.27T00.00.05.create-policy-acceptance-configs.ts
-rw-r--r--@   1 bakker  staff    456 May 31 14:20 2026.05.28T00.00.00.add-collects-payment-on-import-to-products.ts
-rw-r--r--@   1 bakker  staff   1229 May 31 14:20 2026.05.28T00.00.01.add-payment-invite-email-template-type.ts
-rw-r--r--@   1 bakker  staff   1614 May 31 14:20 2026.05.29T00.00.01.add-policy-customer-language.ts
-rw-r--r--@   1 bakker  staff   1602 May 31 14:20 2026.05.29T00.00.02.add-message-translation-fields.ts
-rw-r--r--@   1 bakker  staff   2868 May 31 14:20 2026.05.30T00.00.00.create-payout-category-and-fields.ts
-rw-r--r--@   1 bakker  staff   2492 May 31 14:20 2026.05.30T00.00.01.localize-default-checkout-premium-prefix.ts
-rw-r--r--@   1 bakker  staff   3032 May 31 14:20 abandonedPolicyStatus.apitest.ts
drwxr-xr-x@   3 bakker  staff     96 May 31 14:20 seed

{"command":"grep -n \"ProductCapabilityConfig\\|complianceChecks\" /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/product/Product.ts | head -20"}

38:  'complianceChecks',
171:    complianceChecks: Type.Union(

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/product/Product.ts","limit":250}

1	import { Type, type Static } from '@sinclair/typebox';
2	import { Uuid, IsoDateTime, NullableString, NullableInteger } from '../_helpers.js';
3	
4	export const ProductPublicFields = [
5	  'id',
6	  'productTitle',
7	  'productName',
8	  'productDescription',
9	  'country',
10	  'insuranceTypeId',
11	  'currency',
12	  'inputCurrency',
13	  'currencyPosition',
14	  'decimalSeparator',
15	  'groupSeparator',
16	  'decimalsAmount',
17	  'dateFormat',
18	  'active',
19	  'paymentProvider',
20	  'paymentMethods',
21	  'paymentUiMode',
22	  'isEmbedded',
23	  'primaryProductTitle',
24	  'userId',
25	  'organizationId',
26	  'insurerId',
27	  'autoCreatePolicy',
28	  'sendEmails',
29	  'collectsPaymentOnImport',
30	  'version',
31	  'startDate',
32	  'endDate',
33	  'policyNumberSequence',
34	  'policyNumberPrefix',
35	  'invoiceNumberSequence',
36	  'renewalWindowDays',
37	  'documents',
38	  'complianceChecks',
39	  'createdAt',
40	  'updatedAt',
41	  'deletedAt',
42	] as const;
43	
44	export const ProductPrivateFields = [] as const;
45	
46	const ProductDocumentRefSchema = Type.Object(
47	  {
48	    key: Type.String({ description: 'Stable key identifying the document slot.', example: 'policy_wording' }),
49	    label: Type.String({ description: 'Human-readable label for the document.', example: 'Policy Wording' }),
50	    dataFileId: Type.String({ description: 'Reference to the underlying DataFile id.' }),
51	    locale: Type.String({ description: 'Locale this document is published for.', example: 'en' }),
52	    order: Type.Integer({ description: 'Sort order within the product documents list.', example: 0 }),
53	  },
54	  { additionalProperties: true, description: 'Reference to a product-level document.' },
55	);
56	
57	export const ProductSchema = Type.Object(
58	  {
59	    id: Type.Integer({ description: 'Product ID.', example: 42 }),
60	    productTitle: Type.String({
61	      minLength: 1,
62	      description: 'Display title of the product.',
63	      example: 'Travel Insurance',
64	    }),
65	    productName: Type.String({
66	      minLength: 1,
67	      description: 'Machine-readable product key (unique per organization + version).',
68	      example: 'travel_insurance_es',
69	    }),
70	    productDescription: Type.Optional(NullableString({ description: 'Free-form product description.' })),
71	    country: Type.String({
72	      minLength: 2,
73	      maxLength: 2,
74	      description: 'ISO-3166 alpha-2 country code (uppercase).',
75	      example: 'US',
76	    }),
77	    insuranceTypeId: Type.Integer({ description: 'FK to InsuranceType.' }),
78	    currency: Type.String({ description: 'Display currency (ISO-4217).', example: 'USD' }),
79	    inputCurrency: Type.String({ description: 'Input/quoting currency (ISO-4217).', example: 'USD' }),
80	    currencyPosition: Type.Union(
81	      [Type.Literal('prefix'), Type.Literal('suffix')],
82	      { description: 'Position of the currency symbol relative to the amount.' },
83	    ),
84	    decimalSeparator: Type.String({
85	      minLength: 1,
86	      maxLength: 1,
87	      description: "Single-character decimal separator ('.' or ',').",
88	      example: ',',
89	    }),
90	    groupSeparator: Type.String({
91	      minLength: 1,
92	      maxLength: 1,
93	      description: "Single-character thousands separator ('.' or ',').",
94	      example: '.',
95	    }),
96	    decimalsAmount: Type.Integer({
97	      description: 'Number of decimal places used when rendering amounts.',
98	      example: 2,
99	    }),
100	    dateFormat: Type.Union(
101	      [
102	        Type.Literal('DD/MM/YYYY'),
103	        Type.Literal('DD-MM-YYYY'),
104	        Type.Literal('DD.MM.YYYY'),
105	        Type.Literal('DD MMMM YYYY'),
106	        Type.Literal('MM/DD/YYYY'),
107	        Type.Literal('MM-DD-YYYY'),
108	        Type.Literal('MMMM DD, YYYY'),
109	        Type.Literal('YYYY-MM-DD'),
110	      ],
111	      { description: 'Date display format.' },
112	    ),
113	    active: Type.Boolean({ description: 'Whether this product is active.' }),
114	    paymentProvider: Type.String({
115	      maxLength: 50,
116	      description: "Payment provider key (e.g. 'internal', 'stripe').",
117	      example: 'stripe',
118	    }),
119	    paymentMethods: Type.Array(Type.String(), {
120	      description:
121	        'Active payment methods for this product (e.g. card, ideal). Empty array means all provider-enabled methods.',
122	      example: ['card', 'ideal'],
123	    }),
124	    paymentUiMode: Type.Union(
125	      [Type.Literal('redirect'), Type.Literal('iframe')],
126	      {
127	        description:
128	          'Controls how the customer-facing payment UI is presented after policy creation. `redirect` returns a Stripe-hosted checkout URL the consumer redirects the browser to (legacy default). `iframe` creates an EmbedCheckoutSession and returns its id so the consumer mounts the in-page Stripe PaymentElement via sherpa-embed.',
129	        default: 'redirect',
130	      },
131	    ),
132	    isEmbedded: Type.Boolean({ description: 'Whether this product is intended for embedded usage.' }),
133	    primaryProductTitle: Type.Optional(
134	      NullableString({ description: 'Title of the primary product (for embedded products).' }),
135	    ),
136	    userId: Type.Optional(
137	      Type.Union([Type.String({ format: 'uuid' }), Type.Null()], {
138	        description: 'Owning user UUID (optional).',
139	      }),
140	    ),
141	    organizationId: Uuid({ description: 'Owning organization UUID.' }),
142	    insurerId: Type.Optional(NullableInteger({ description: 'FK to Insurer.' })),
143	    autoCreatePolicy: Type.Boolean({
144	      description: 'Whether quotes automatically convert into policies on payment.',
145	    }),
146	    sendEmails: Type.Boolean({ description: 'Whether transactional emails are sent for this product.' }),
147	    collectsPaymentOnImport: Type.Boolean({
148	      description:
149	        'When true, automated CSV imports create PolicyOrders in the org PENDING lifecycle category instead of ACTIVE, and the customer is driven to /accept to pay before the policy activates. Default false.',
150	    }),
151	    version: Type.Integer({ description: 'Product version number.', example: 1 }),
152	    startDate: IsoDateTime({ description: 'When this product version becomes available.' }),
153	    endDate: Type.Union([IsoDateTime(), Type.Null()], {
154	      description: 'When this product version expires (null = ongoing).',
155	    }),
156	    policyNumberSequence: Type.Union([Type.Integer(), Type.Null()], {
157	      description: 'Next policy sequence number (BIGINT).',
158	    }),
159	    policyNumberPrefix: Type.Union([Type.String({ maxLength: 20 }), Type.Null()], {
160	      description: 'Optional prefix prepended to generated policy numbers.',
161	    }),
162	    invoiceNumberSequence: Type.Union([Type.Integer(), Type.Null()], {
163	      description: 'Next invoice sequence number.',
164	    }),
165	    renewalWindowDays: Type.Union([Type.Integer(), Type.Null()], {
166	      description: 'Days before expiry to initiate renewal.',
167	    }),
168	    documents: Type.Array(ProductDocumentRefSchema, {
169	      description: 'Ordered list of product-level document references.',
170	    }),
171	    complianceChecks: Type.Union(
172	      [Type.Object({}, { additionalProperties: true }), Type.Null()],
173	      {
174	        description:
175	          'Per-product compliance check configuration, keyed by capability (sanction_screening, kyc, fraud, ...). Each entry maps a capability onto an active ExternalIntegration plus its field mappings and outcome rules.',
176	      },
177	    ),
178	    createdAt: IsoDateTime({ description: 'Creation timestamp.' }),
179	    updatedAt: IsoDateTime({ description: 'Last update timestamp.' }),
180	    deletedAt: Type.Optional(
181	      Type.Union([IsoDateTime(), Type.Null()], {
182	        description: 'Soft-delete timestamp (paranoid). Null when not deleted.',
183	      }),
1

{"command":"find /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations -name \"*.test.ts\""}

/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/test/mapping.test.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/test/audit.test.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/test/runCheck.test.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/test/credentials.test.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/test/templating.test.ts

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/test/runCheck.test.ts","limit":150}

1	import { describe, test } from 'node:test';
2	import assert from 'node:assert/strict';
3	import {
4	  extractScreenedParties,
5	  applyOutcomeRules,
6	} from '@/domains/integrations/capabilities/runCheck.js';
7	import type { ProductCapabilityConfig } from '@/models/internal/_Product.js';
8	import type { ComplianceFinding } from '@/models/ComplianceCheck.js';
9	
10	const baseConfig: ProductCapabilityConfig = {
11	  enabled: true,
12	  integrationId: 'integration-uuid',
13	  triggers: ['NEW_BUSINESS', 'RENEWAL'],
14	  parties: {
15	    policyholder: 'personal',
16	    additional: ['insureds'],
17	  },
18	  outcomeRules: {
19	    passWhen: { maxScore: 0.7 },
20	    failWhen: { minScore: 0.9, onTopics: ['sanctioned'] },
21	  },
22	};
23	
24	describe('extractScreenedParties', () => {
25	  test('extracts the policyholder when present', () => {
26	    const parties = extractScreenedParties(
27	      {
28	        personal: {
29	          firstName: 'Alice',
30	          lastName: 'Brown',
31	          birthDate: '1985-04-12',
32	          nationality: 'AR',
33	        },
34	      },
35	      baseConfig,
36	    );
37	    assert.equal(parties.length, 1);
38	    assert.equal(parties[0].role, 'policyholder');
39	    assert.equal(parties[0].sourcePath, 'personal');
40	    assert.equal((parties[0].data as Record<string, unknown>).firstName, 'Alice');
41	  });
42	
43	  test('extracts additional parties from an array path', () => {
44	    const parties = extractScreenedParties(
45	      {
46	        personal: { firstName: 'Alice', lastName: 'Brown' },
47	        insureds: [
48	          { firstName: 'Bob', lastName: 'Brown' },
49	          { firstName: 'Carol', lastName: 'Brown' },
50	        ],
51	      },
52	      baseConfig,
53	    );
54	    assert.equal(parties.length, 3);
55	    assert.equal(parties[1].role, 'insured');
56	    assert.equal(parties[1].sourcePath, 'insureds.0');
57	    assert.equal(parties[2].sourcePath, 'insureds.1');
58	  });
59	
60	  test('skips paths that resolve to non-objects', () => {
61	    const parties = extractScreenedParties({ personal: 'not an object' }, baseConfig);
62	    assert.equal(parties.length, 0);
63	  });
64	});
65	
66	describe('applyOutcomeRules', () => {
67	  function finding(score: number, topics: string[] = []): ComplianceFinding {
68	    return { entityId: 'x', entityName: 'y', score, topics, datasets: [], sourceUrl: null };
69	  }
70	
71	  test('pass when no findings', () => {
72	    assert.equal(applyOutcomeRules([], baseConfig), 'pass');
73	  });
74	  test('pass when top score below maxScore', () => {
75	    assert.equal(applyOutcomeRules([finding(0.3), finding(0.5)], baseConfig), 'pass');
76	  });
77	  test('fail when top score >= minScore', () => {
78	    assert.equal(applyOutcomeRules([finding(0.95)], baseConfig), 'fail');
79	  });
80	  test('fail when forbidden topic appears even at lower score', () => {
81	    assert.equal(applyOutcomeRules([finding(0.5, ['sanctioned'])], baseConfig), 'fail');
82	  });
83	  test('review when between thresholds', () => {
84	    assert.equal(applyOutcomeRules([finding(0.8)], baseConfig), 'review');
85	  });
86	});
87	

Perfect! Now I have enough information. Let me create a comprehensive report with all the file references and code snippets:

## Comprehensive Compliance Tab & External-API-Integration Builder UI Map

I've thoroughly explored the sherpa-portal worktree and mapped the entire compliance system. Here's the complete picture:

---

### 1. CHECK-TYPE REGISTRY (Where "credit_check" Would Be Added)

**File:** `/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx` (lines 39–98)

```typescript
// Lines 39-44: Check-type enum
type CapabilityKey =
  | "sanction_screening"
  | "pep"
  | "kyc"
  | "adverse_media"
  | "fraud_detection";

// Lines 52-98: CAPABILITY_REGISTRY — the single source of truth for check types
interface CapabilityDef {
  key: CapabilityKey;
  icon: LucideIcon;
  defaultTriggers: ComplianceTrigger[];
  defaultOutcomeRules: ProductCapabilityConfig["outcomeRules"];
}

const CAPABILITY_REGISTRY: CapabilityDef[] = [
  {
    key: "sanction_screening",
    icon: ShieldCheck,
    defaultTriggers: ["NEW_BUSINESS", "RENEWAL"],
    defaultOutcomeRules: {
      passWhen: { maxScore: 0.5 },
      failWhen: { minScore: 0.85, onTopics: ["sanction"] },
    },
  },
  {
    key: "fraud_detection",
    icon: Activity,
    defaultTriggers: ["CLAIM"],
    defaultOutcomeRules: {
      passWhen: { maxScore: 0.5 },
      failWhen: { minScore: 0.85, onTopics: ["fraud.high_risk"] },
    },
  },
  // ... KYC, PEP, Adverse Media
];
```

**To add credit_check:** Add a new entry to `CAPABILITY_REGISTRY` with an icon, default triggers (NEW_BUSINESS/RENEWAL), and outcome rules. Pick a unique icon from lucide-react.

**Label/Translation Hook:** Lines 102–133 use `useCapabilityText()` which maps capability IDs to translated labels:

```typescript
function useCapabilityText() {
  const { t } = useLMT();
  const label = (key: CapabilityKey): string => {
    switch (key) {
      case "sanction_screening": return t("Sanction Screening");
      case "fraud_detection": return t("Fraud Detection");
      // ADD HERE: case "credit_check": return t("Credit Check");
    }
  };
  const blurb = (key: CapabilityKey): string => {
    switch (key) {
      case "fraud_detection": return t("Score the party / claim for fraud risk via an external bureau...");
      // ADD HERE: case "credit_check": return t("Your blurb...");
    }
  };
}
```

---

### 2. COMPLIANCE TAB UI — Product Compliance Panel

**File:** `/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx`

**Main Components:**

- **`CapabilityTabs`** (lines 415–501): Renders the tab bar with configured capabilities. Each tab shows an icon, label, and a dot (green=enabled+integration, amber=has integration, gray=unconfigured).
- **`CapabilitySection`** (lines 567–882): The main editor panel for a selected capability, with:
  - **Integration selector** (lines 655–683): A dropdown listing active `ExternalIntegration` objects filtered by capability.
  - **Triggers UI** (lines 686–715): Checkboxes for `NEW_BUSINESS`, `RENEWAL`, `ENDORSEMENT`, `CLAIM`, `MANUAL`.
  - **Outcome rules** (lines 764–879): Visual threshold sliders (pass/review/fail buckets) and topic-matching rules.
  - **Auto-reject & messages** (lines 784–835): Toggles and textareas for custom rejection/review messages.

**API Calls:**
- Line 234: `api.get<IntegrationsResponse>("/external-integrations")` — fetch all active integrations.
- Line 295: `api.put<ProductResponse>(`/products/${productId}`, { complianceChecks: ... })` — save compliance config.

**Data Models:**

From `/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/product.ts` (lines 67–93):

```typescript
export type ComplianceTrigger =
  | "NEW_BUSINESS"
  | "RENEWAL"
  | "ENDORSEMENT"
  | "CLAIM"
  | "MANUAL";

export interface ProductCapabilityConfig {
  enabled: boolean;
  integrationId: string;
  triggers: ComplianceTrigger[];
  parties: {
    policyholder: string;
    additional: string[];
  };
  outcomeRules: {
    passWhen: { maxScore: number };
    failWhen: { minScore: number; onTopics: string[] };
  };
  autoReject?: boolean;
  messages?: {
    fail?: string | null;
    review?: string | null;
  };
}

export type ProductComplianceChecks = Record<string, ProductCapabilityConfig>;
```

---

### 3. COMPLIANCE CHECKS SECTION — Results Display (Policy Detail)

**File:** `/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/compliance/ComplianceChecksSection.tsx`

**Purpose:** Displays compliance check results on the policy detail page.

**Key Elements:**

- **Lines 75–93**: `capabilityLabel()` switch maps capability IDs to display labels (same pattern as ProductCompliancePanel).
- **Lines 171–224**: Row rendering loop. Each check displays:
  - **Status badge** (pending/processing/completed/failed)
  - **Outcome badge** (pass/fail/review)
  - **Manual decision badge** (approved/rejected if admin has acted)
  - **Expandable detail panel** (SanctionScreeningPanel component)

**API Call:** Line 129: `api.get<ListResponse>("/sanction-screenings", { params: { policyOrderId: policyId } })`

**Data Type:** `SanctionScreening` from `/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts` (lines 457–483):

```typescript
export interface SanctionScreening {
  id: string;
  organizationId: string;
  capability: string; // "sanction_screening", "fraud_detection", "kyc", etc.
  triggerType: SanctionScreeningTriggerType; // NEW_BUSINESS, RENEWAL, CLAIM, etc.
  status: SanctionScreeningStatus; // pending | processing | completed | failed
  outcome: SanctionScreeningOutcome | null; // pass | fail | review
  manualDecision: SanctionScreeningManualDecision | null; // approved | rejected
  manualDecisionBy: string | null;
  manualDecisionNote: string | null;
  findings: ScreeningFinding[] | null;
  screenedParties: ScreenedParty[];
  rawResponse: unknown;
  issuanceContext: Record<string, unknown>;
  error: string | null;
  createdAt: string;
  updatedAt: string;
}
```

---

### 4. SCREENING RESULTS DETAIL PANEL

**File:** `/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/screening/SanctionScreeningPanel.tsx`

**Responsibility:** Renders individual screening result with findings, manual override actions, and messaging.

**Key Sections:**

- **Lines 87–105**: Capability label mapping (same pattern).
- **Lines 310–355**: Status/outcome badge display.
- **Lines 375–409**: Screened parties list (names, roles, source paths).
- **Lines 411–452**: Findings list (match entities, scores, topics, datasets, source URLs).
- **Lines 516–528**: Manual decision buttons (Approve/Reject/Request Info) — only visible if `canDecide` permission + check is pending review.
- **Lines 540–647**: Decision dialog modal with message textarea, file attachment, and submission.

**API Calls:**
- Line 161: `api.get<ScreeningResponse>(`/sanction-screenings/${screeningId}`)`
- Line 242: `api.post(`/sanction-screenings/${screeningId}/decision`, { decision, note, message, attachments })`
- Line 275: `api.post(`/sanction-screenings/${screeningId}/rerun`)`

**Decision Types:** `"approve" | "reject" | "request_info"` (lines 139, 260).

---

### 5. EXTERNAL INTEGRATIONS TAB — Provider & Integration Builder

**File:** `/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/IntegrationsTab.tsx`

**Purpose:** CRUD for ExternalIntegration records. Lists available providers (e.g., OpenSanctions) and routes to detail page.

**Key UI:**

- **Lines 36–42**: Capability enum (list of selectable check types).
- **Lines 153–384**: Main tab with table listing all integrations, Create/Edit dialog.
- **Dialog fields** (lines 266–360):
  - `name` (e.g., "OpenSanctions")
  - `slug` (e.g., "opensanctions"

Excellent! Now I have a comprehensive understanding. Let me create a final comprehensive report by compiling all the information I've gathered.

## Comprehensive Compliance Check Framework Map

Based on my thorough exploration of the sherpa-api worktree, here's the complete picture of the compliance check framework:

---

### 1. CAPABILITY TYPES DEFINITION

**Where capabilities are registered:**
- `/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runner.ts:15-44` — capability registration at module boot

**Registered capabilities (enum-like, string-based):**
```typescript
// src/domains/integrations/runner.ts:15-44
registerCapability({
  id: 'sanction_screening',
  label: 'Sanction Screening',
  operation: 'check',
  defaultTriggers: ['NEW_BUSINESS', 'RENEWAL'],
});
registerCapability({
  id: 'pep',
  label: 'PEP Check',
  operation: 'check',
  defaultTriggers: ['NEW_BUSINESS', 'RENEWAL'],
});
registerCapability({
  id: 'kyc',
  label: 'KYC Verification',
  operation: 'check',
  defaultTriggers: ['NEW_BUSINESS'],
});
registerCapability({
  id: 'adverse_media',
  label: 'Adverse Media',
  operation: 'check',
  defaultTriggers: ['NEW_BUSINESS', 'RENEWAL'],
});
registerCapability({
  id: 'fraud_detection',
  label: 'Fraud Detection',
  operation: 'check',
  defaultTriggers: ['CLAIM'],
});
```

**Capability registry interface:**
- `/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/capabilities/registry.ts` — defines `CapabilityDefinition` interface with fields: `id`, `label`, `operation`, `defaultTriggers`

**Trigger types (enum):**
- `/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ComplianceCheck.ts:6-11`
```typescript
export type ComplianceCheckTriggerType =
  | 'NEW_BUSINESS'
  | 'RENEWAL'
  | 'ENDORSEMENT'
  | 'CLAIM'
  | 'MANUAL';
```

**Status enum:**
- `/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ComplianceCheck.ts:12`
```typescript
export type ComplianceCheckStatus = 'pending' | 'processing' | 'completed' | 'failed';
```

**Outcome enum:**
- `/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ComplianceCheck.ts:13`
```typescript
export type ComplianceCheckOutcome = 'pass' | 'fail' | 'review';
```

**Manual decision enum:**
- `/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ComplianceCheck.ts:14`
```typescript
export type ComplianceCheckManualDecision = 'approved' | 'rejected';
```

**Route-level capability enum for API input:**
- `/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes/plus/externalIntegrationsRoutes.ts:43-49`
```typescript
const CAPABILITY_ENUM = [
  'sanction_screening',
  'pep',
  'kyc',
  'adverse_media',
  'fraud_detection',
] as const;
```

---

### 2. SEQUELIZE MODELS & DB SCHEMA

**ComplianceCheck Model (primary compliance record):**
- File: `/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ComplianceCheck.ts`
- Table name: `ComplianceChecks`
- Key columns:
  - `id` (UUID, PK)
  - `organizationId` (UUID, FK → Organization)
  - `productId` (INTEGER, FK → Product)
  - `integrationId` (UUID, FK → ExternalIntegration)
  - `capability` (STRING(50), NOT NULL, DEFAULT 'sanction_screening') — **the key that determines check type**
  - `triggerType` (ENUM: NEW_BUSINESS, RENEWAL, ENDORSEMENT, CLAIM, MANUAL)
  - `previousPolicyId` (UUID, nullable) — for RENEWAL trigger
  - `rootPolicyId` (UUID, nullable) — policy family root
  - `policyOrderId` (UUID, nullable) — gated PolicyOrder ID
  - `claimRecordId` (UUID, nullable) — for CLAIM trigger
  - `customerId` (UUID, nullable) — for MANUAL trigger
  - `issuanceContext` (JSONB) — snapshot for resuming parent flow
  - `screenedParties` (JSONB array of ScreenedParty objects)
  - `status` (ENUM: pending, processing, completed, failed)
  - `outcome` (ENUM: pass, fail, review; nullable until completed)
  - `manualDecision` (ENUM: approved, rejected; nullable)
  - `manualDecisionBy` (UUID, nullable)
  - `manualDecisionAt` (DATE, nullable)
  - `manualDecisionNote` (TEXT, nullable)
  - `findings` (JSONB array of ComplianceFinding objects; null until completed)
  - `rawResponse` (JSONB, nullable) — stripped from customer responses
  - `error` (TEXT, nullable) — failure message
  - `correlationId` (STRING(100), nullable) — links to outbound calls
  - `createdAt`, `updatedAt` (DATE)

**Indexes:**
- `idx_compliance_checks_org_capability_status` on (organizationId, capability, status, outcome, manualDecision)
- `idx_compliance_checks_root_policy_created` on (rootPolicyId, createdAt)
- `idx_compliance_checks_previous_policy_id` on (previousPolicyId)
- `idx_compliance_checks_policy_order_id` on (policyOrderId)

**Product Model (compliance config per product):**
- File: `/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_Product.ts:383`
- Column: `complianceChecks` (JSONB, nullable)
- Structure: `{ [capability]: ProductCapabilityConfig, ... }`

**ProductCapabilityConfig interface:**
- File: `/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_Product.ts:43-65`
```typescript
interface ProductCapabilityConfig {
  enabled: boolean;
  integrationId: string;
  triggers: ComplianceTrigger[];
  parties: {
    policyholder: string;  // path like 'personal'
    additional: string[];  // paths like ['insureds']
  };
  outcomeRules: {
    passWhen: { maxScore: number };
    failWhen: { minScore: number; onTopics: string[] };
  };
  autoReject?: boolean;  // auto-deny on fail
  messages?: {
    fail?: string | null;
    review?: string | null;
  };
}
```

**ExternalIntegration Model:**
- File: `/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegration.ts`
- Table: `ExternalIntegrations`
- Key columns:
  - `id` (UUID, PK)
  - `organizationId` (UUID, FK)
  - `capability` (STRING(64)) — matches CapabilityId
  - `kind` (ENUM: 'generic_rest')
  - `defaultEnvironment` (ENUM: test, staging, production)
  - `invocationMode` (ENUM: sync, async)
  - `syncTimeoutMs` (INTEGER, DEFAULT 5000)
  - `active` (BOOLEAN, DEFAULT true)

**ExternalIntegrationEnvironment Model:**
- File: `/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationEnvironment.ts`
- Table: `ExternalIntegrationEnvironments`
- Links integration to test/staging/production endpoints
- Key columns: `id`, `integrationId`, `environment`, `baseUrl`, `authEndpoint`, `tokenEndpoint`

**ExternalIntegrationAuthConfig Model:**
- File: `/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationAuthConfig.ts`
- Table: `ExternalIntegrationAuthConfigs`
- Key columns:
  - `authType` (ENUM: client_credentials, username_password, api_key, basic_auth, oauth2_code, custom)
  - `tokenType` (ENUM: bearer, basic, custom)
  - `authorizationHeaderFormat` (STRING(255), DEFAULT 'Bearer {token}')
  - `encryptedCredentials` (TEXT) — vault-encrypted secrets

**ExternalIntegrationRequestTemplate Model:**
- File: `/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationRequestTemplate.ts`
- Table: `ExternalIntegrationRequestTemplates`
- Per-operation config for calling the provider
- Key columns:
  - `integrationId` (UUID, FK)
  - `operation` (STRING(100), UNIQUE per integration)
  - `httpMethod` (ENUM: GET, POST, PUT, PATCH, DELETE)
  - `urlTemplate` (STRING(1000))
  - `requestHeadersTemplate` (JSONB, nullable)
  - `requestBodyTemplate` (JSONB, nullable)
  - `responseMapping` (JSONB) — **maps provider response to output shape**
  - `errorMapping` (JSONB,

{"command":"curl -fsS -X POST http://localhost:7777/api/api-action -H 'Content-Type: application/json' -d '{\"path\":\"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat\",\"action\":\"migrate\"}' 2>&1; echo \"---migrate kicked---\"","description":"Kick off DB migrate via dashboard"}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationCallLog.ts"}

{"path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat","action":"migrate","status":"running","startedAt":1780262705209,"endedAt":null,"exitCode":null,"error":null,"logPath":"/var/folders/pr/7k4xc3v1715_0zbbw8tgwl5r0000gn/T/worktree-dashboard-logs/sherpa-api-api-458-credit-check-compliance-integrat-migrate.log","tail":""}---migrate kicked---

1	import { Table, Column, Model, DataType, ForeignKey, BelongsTo } from 'sequelize-typescript';
2	import { _ExternalIntegration } from './_ExternalIntegration.js';
3	import { Organization } from '../Organization.js';
4	
5	export type ExternalIntegrationCallStatus = 'success' | 'error' | 'timeout' | 'circuit_open';
6	
7	@Table({
8	  modelName: 'ExternalIntegrationCallLog',
9	  timestamps: false,
10	  indexes: [
11	    {
12	      fields: ['integrationId', 'createdAt'],
13	      name: 'idx_external_integration_call_log_integration_created',
14	    },
15	    {
16	      fields: ['organizationId', 'createdAt'],
17	      name: 'idx_external_integration_call_log_org_created',
18	    },
19	    {
20	      fields: ['correlationId'],
21	      name: 'idx_external_integration_call_log_correlation_id',
22	    },
23	  ],
24	})
25	export class _ExternalIntegrationCallLog extends Model {
26	  @Column({
27	    type: DataType.UUID,
28	    defaultValue: DataType.UUIDV4,
29	    primaryKey: true,
30	  })
31	  declare id: string;
32	
33	  @ForeignKey(() => _ExternalIntegration)
34	  @Column({
35	    type: DataType.UUID,
36	    allowNull: false,
37	  })
38	  declare integrationId: string;
39	
40	  @ForeignKey(() => Organization)
41	  @Column({
42	    type: DataType.UUID,
43	    allowNull: false,
44	  })
45	  declare organizationId: string;
46	
47	  @Column({
48	    type: DataType.ENUM('sanction_screening'),
49	    allowNull: false,
50	  })
51	  declare capability: 'sanction_screening';
52	
53	  @Column({
54	    type: DataType.STRING(100),
55	    allowNull: false,
56	  })
57	  declare operation: string;
58	
59	  @Column({
60	    type: DataType.STRING(100),
61	    allowNull: false,
62	  })
63	  declare correlationId: string;
64	
65	  @Column({
66	    type: DataType.ENUM('success', 'error', 'timeout', 'circuit_open'),
67	    allowNull: false,
68	  })
69	  declare status: ExternalIntegrationCallStatus;
70	
71	  @Column({
72	    type: DataType.INTEGER,
73	    allowNull: true,
74	  })
75	  declare httpStatus: number | null;
76	
77	  @Column({
78	    type: DataType.INTEGER,
79	    allowNull: false,
80	  })
81	  declare durationMs: number;
82	
83	  @Column({
84	    type: DataType.INTEGER,
85	    allowNull: false,
86	    defaultValue: 1,
87	  })
88	  declare attempts: number;
89	
90	  @Column({
91	    type: DataType.JSONB,
92	    allowNull: true,
93	  })
94	  declare requestExcerpt: Record<string, unknown> | null;
95	
96	  @Column({
97	    type: DataType.JSONB,
98	    allowNull: true,
99	  })
100	  declare responseExcerpt: Record<string, unknown> | null;
101	
102	  @Column({
103	    type: DataType.TEXT,
104	    allowNull: true,
105	  })
106	  declare errorMessage: string | null;
107	
108	  @Column({
109	    type: DataType.DATE,
110	    allowNull: false,
111	  })
112	  declare createdAt: Date;
113	
114	  @BelongsTo(() => _ExternalIntegration, { foreignKey: 'integrationId', as: 'integration' })
115	  declare integration?: _ExternalIntegration;
116	}
117	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runner.ts","limit":60}

1	import crypto from 'node:crypto';
2	import { StatusError } from '@/error/error.js';
3	import { ExternalIntegration } from '@/models/ExternalIntegration.js';
4	import type { _ExternalIntegration } from '@/models/ExternalIntegration.js';
5	import { ExternalIntegrationEnvironment } from '@/models/ExternalIntegrationEnvironment.js';
6	import type { _ExternalIntegrationEnvironment } from '@/models/ExternalIntegrationEnvironment.js';
7	import { ExternalIntegrationAuthConfig } from '@/models/ExternalIntegrationAuthConfig.js';
8	import type { _ExternalIntegrationAuthConfig } from '@/models/ExternalIntegrationAuthConfig.js';
9	import { getKind, registerKind } from './kinds/registry.js';
10	import { genericRestAdapter } from './kinds/genericRest/adapter.js';
11	import { registerCapability, type CapabilityId } from './capabilities/registry.js';
12	
13	// Boot the runtime registries once at module load.
14	registerKind('generic_rest', genericRestAdapter);
15	registerCapability({
16	  id: 'sanction_screening',
17	  label: 'Sanction Screening',
18	  operation: 'check',
19	  defaultTriggers: ['NEW_BUSINESS', 'RENEWAL'],
20	});
21	registerCapability({
22	  id: 'pep',
23	  label: 'PEP Check',
24	  operation: 'check',
25	  defaultTriggers: ['NEW_BUSINESS', 'RENEWAL'],
26	});
27	registerCapability({
28	  id: 'kyc',
29	  label: 'KYC Verification',
30	  operation: 'check',
31	  defaultTriggers: ['NEW_BUSINESS'],
32	});
33	registerCapability({
34	  id: 'adverse_media',
35	  label: 'Adverse Media',
36	  operation: 'check',
37	  defaultTriggers: ['NEW_BUSINESS', 'RENEWAL'],
38	});
39	registerCapability({
40	  id: 'fraud_detection',
41	  label: 'Fraud Detection',
42	  operation: 'check',
43	  defaultTriggers: ['CLAIM'],
44	});
45	
46	export interface InvokeArgs {
47	  organizationId: string;
48	  capability: CapabilityId;
49	  operation: string;
50	  input: Record<string, unknown>;
51	  environmentOverride?: 'test' | 'staging' | 'production';
52	  correlationId?: string;
53	  integrationSlug?: string;
54	}
55	
56	export interface InvokeRunnerResult {
57	  integrationId: string;
58	  integrationSlug: string;
59	  output: Record<string, unknown>;
60	  httpStatus: number | null;

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/capabilities/registry.ts"}

1	// Capability registry — every external compliance check (sanctions, KYC,
2	// fraud, etc.) registers here. ComplianceChecks.capability stores which one.
3	
4	export type CapabilityId = string;
5	
6	export type ComplianceTrigger =
7	  | 'NEW_BUSINESS'
8	  | 'RENEWAL'
9	  | 'ENDORSEMENT'
10	  | 'CLAIM'
11	  | 'MANUAL';
12	
13	export interface CapabilityDefinition {
14	  readonly id: CapabilityId;
15	  readonly label: string;
16	  readonly operation: string;
17	  readonly defaultTriggers: ReadonlyArray<ComplianceTrigger>;
18	}
19	
20	const REGISTRY: Map<CapabilityId, CapabilityDefinition> = new Map();
21	
22	export function registerCapability(definition: CapabilityDefinition): void {
23	  REGISTRY.set(definition.id, definition);
24	}
25	
26	export function getCapability(id: CapabilityId): CapabilityDefinition {
27	  const found = REGISTRY.get(id);
28	  if (!found) throw new Error(`Unknown capability: ${id}`);
29	  return found;
30	}
31	
32	export function listCapabilities(): CapabilityDefinition[] {
33	  return Array.from(REGISTRY.values());
34	}
35	
36	export function isCapabilityRegistered(id: string): boolean {
37	  return REGISTRY.has(id);
38	}
39	

{"command":"rg -li 'sanction|screening|compliance|credit_check|credit check' /Users/bakker/dev/gangkhar/sherpa-embed-api-458-credit-check-compliance-integrat/src 2>/dev/null | head -30; echo \"---embed sanctions refs above (if any)---\"","description":"Check embed for sanctions/compliance surface"}

/Users/bakker/dev/gangkhar/sherpa-embed-api-458-credit-check-compliance-integrat/src/pages/checkout/StripeCheckout.tsx
/Users/bakker/dev/gangkhar/sherpa-embed-api-458-credit-check-compliance-integrat/src/lib/apiErrorStatics.generated.ts
/Users/bakker/dev/gangkhar/sherpa-embed-api-458-credit-check-compliance-integrat/src/lib/apiErrorTemplates.generated.ts
---embed sanctions refs above (if any)---

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat\necho \"=== CallLog.create call sites ===\"; rg -n 'CallLog' src --type ts -l\necho \"=== capability enum in migrations ===\"; rg -n \"ENUM|enum|capability\" src/db/migrations 2>/dev/null | rg -i 'call.?log|capability' | head -40","description":"Find CallLog writers + capability enum migrations"}

=== CallLog.create call sites ===
src/routes/plus/externalIntegrationsRoutes.ts
src/services/embedCheckoutSessionService.test.ts
src/models/db.ts
src/services/embedCheckoutDedupService.test.ts
src/schemas/typebox/integration/index.ts
src/schemas/typebox/integration/ExternalIntegrationCallLog.ts
src/models/ExternalIntegrationCallLog.ts
src/db/migrations/2026.05.14T00.00.04.create-external-integration-call-logs.ts
src/models/internal/_ExternalIntegrationCallLog.ts
src/controllers/externalIntegrationController.ts
src/test/drift.apitest.ts
src/domains/integrations/runtime/audit.ts
src/domains/integrations/kinds/genericRest/adapter.ts
=== capability enum in migrations ===
src/db/migrations/2026.05.14T00.00.11.create-external-integration-field-mappings.ts:8: * direction='request': read from the typed capability input (e.g. screening
src/db/migrations/2026.05.14T00.00.11.create-external-integration-field-mappings.ts:13: * transformation, and write under the canonical key the capability handler
src/db/migrations/2026.05.19T00.00.06.add-compliance-pending-lifecycle.ts:10: * policy can carry the {capability: checkId} map needed to activate it once
src/db/migrations/2026.05.19T00.00.01.rename-screening-configuration-to-compliance-checks.ts:7: * — an object keyed by capability — so KYC, fraud, AML, etc. can live
src/db/migrations/2026.05.14T00.00.01.create-external-integrations.ts:13:      IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'enum_ExternalIntegrations_capability') THEN
src/db/migrations/2026.05.14T00.00.01.create-external-integrations.ts:14:        CREATE TYPE "enum_ExternalIntegrations_capability" AS ENUM ('sanction_screening');
src/db/migrations/2026.05.14T00.00.01.create-external-integrations.ts:62:    capability: {
src/db/migrations/2026.05.14T00.00.01.create-external-integrations.ts:93:    fields: ['organizationId', 'capability', 'active'],
src/db/migrations/2026.05.14T00.00.01.create-external-integrations.ts:94:    name: 'idx_external_integration_org_capability_active',
src/db/migrations/2026.05.19T00.00.04.rename-field-mappings-to-parties.ts:5: * Replace per-capability rigid `fieldMappings` (firstName/lastName/dateOfBirth/
src/db/migrations/2026.05.19T00.00.04.rename-field-mappings-to-parties.ts:12: *   before per-capability: { fieldMappings: { firstName, lastName, dateOfBirth, nationality, additionalParties } }
src/db/migrations/2026.05.19T00.00.04.rename-field-mappings-to-parties.ts:13: *   after  per-capability: { parties:       { policyholder, additional } }
src/db/migrations/2026.05.19T00.00.05.normalize-compliance-operation.ts:6: * capability is a compliance check. The capability registry was renamed to
src/db/migrations/2026.05.19T00.00.05.normalize-compliance-operation.ts:7: * use `operation = 'check'` for every compliance capability (sanction_screening,
src/db/migrations/2026.05.19T00.00.05.normalize-compliance-operation.ts:20:          AND i.capability::text IN (
src/db/migrations/2026.05.19T00.00.07.add-integration-invocation-mode.ts:8: * Defaults are derived from the capability: APIs that resolve in <1s
src/db/migrations/2026.05.19T00.00.07.add-integration-invocation-mode.ts:14: * Also widens the `capability` column from a frozen `sanction_screening`-only
src/db/migrations/2026.05.19T00.00.07.add-integration-invocation-mode.ts:20:    ALTER COLUMN capability TYPE VARCHAR(64) USING capability::text;
src/db/migrations/2026.05.19T00.00.07.add-integration-invocation-mode.ts:22:  await context.sequelize.query(`DROP TYPE IF EXISTS "enum_ExternalIntegrations_capability";`);
src/db/migrations/2026.05.19T00.00.07.add-integration-invocation-mode.ts:45:    WHERE capability IN ('kyc', 'adverse_media');
src/db/migrations/2026.05.14T00.00.05.create-external-integration-request-templates.ts:7: * capability input via mustache-style placeholder substitution + JSONPath-lite
src/db/migrations/2026.05.14T00.00.04.create-external-integration-call-logs.ts:13:      IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'enum_ExternalIntegrationCallLogs_status') THEN
src/db/migrations/2026.05.14T00.00.04.create-external-integration-call-logs.ts:14:        CREATE TYPE "enum_ExternalIntegrationCallLogs_status" AS ENUM ('success', 'error', 'timeout', 'circuit_open');
src/db/migrations/2026.05.14T00.00.04.create-external-integration-call-logs.ts:41:    capability: {
src/db/migrations/2026.05.14T00.00.04.create-external-integration-call-logs.ts:42:      type: DataTypes.ENUM('sanction_screening'),
src/db/migrations/2026.05.14T00.00.04.create-external-integration-call-logs.ts:54:      type: DataTypes.ENUM('success', 'error', 'timeout', 'circuit_open'),
src/db/migrations/2026.05.19T00.00.02.rename-sanction-screenings-to-compliance-checks.ts:6: * any compliance-check capability (KYC, fraud, AML, identity verification)
src/db/migrations/2026.05.19T00.00.02.rename-sanction-screenings-to-compliance-checks.ts:9: * Adds a `capability` column so each row knows which capability produced
src/db/migrations/2026.05.19T00.00.02.rename-sanction-screenings-to-compliance-checks.ts:19:  // Add the capability column. Backfill existing rows then enforce NOT NULL.
src/db/migrations/2026.05.19T00.00.02.rename-sanction-screenings-to-compliance-checks.ts:20:  await context.addColumn('ComplianceChecks', 'capability', {
src/db/migrations/2026.05.19T00.00.02.rename-sanction-screenings-to-compliance-checks.ts:25:    `UPDATE "ComplianceChecks" SET "capability" = 'sanction_screening' WHERE "capability" IS NULL`,
src/db/migrations/2026.05.19T00.00.02.rename-sanction-screenings-to-compliance-checks.ts:28:    `ALTER TABLE "ComplianceChecks" ALTER COLUMN "capability" SET NOT NULL`,
src/db/migrations/2026.05.19T00.00.02.rename-sanction-screenings-to-compliance-checks.ts:31:    `ALTER TABLE "ComplianceChecks" ALTER COLUMN "capability" SET DEFAULT 'sanction_screening'`,
src/db/migrations/2026.05.19T00.00.02.rename-sanction-screenings-to-compliance-checks.ts:35:    fields: ['organizationId', 'capability', 'status', 'outcome', 'manualDecision'],
src/db/migrations/2026.05.19T00.00.02.rename-sanction-screenings-to-compliance-checks.ts:36:    name: 'idx_compliance_checks_org_capability_status',

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat\necho \"=== migration files mentioning call-log ===\"; fd -e ts . src/db/migrations | rg -i 'call.?log|integration'\necho \"=== CAPABILITY_ENUM usage in routes ===\"; rg -n 'CAPABILITY_ENUM|listCapabilities|capabilities' src/routes/plus/externalIntegrationsRoutes.ts | head -30","description":"List integration migrations + route capability usage"}

=== migration files mentioning call-log ===
src/db/migrations/2026.05.14T00.00.01.create-external-integrations.ts
src/db/migrations/2026.05.14T00.00.02.create-external-integration-environments.ts
src/db/migrations/2026.05.14T00.00.03.create-external-integration-auth-configs.ts
src/db/migrations/2026.05.14T00.00.04.create-external-integration-call-logs.ts
src/db/migrations/2026.05.14T00.00.05.create-external-integration-request-templates.ts
src/db/migrations/2026.05.14T00.00.11.create-external-integration-field-mappings.ts
src/db/migrations/2026.05.19T00.00.07.add-integration-invocation-mode.ts
=== CAPABILITY_ENUM usage in routes ===
43:const CAPABILITY_ENUM = [
142:    capability: { type: 'string', enum: [...CAPABILITY_ENUM] },
157:    capability: { type: 'string', enum: [...CAPABILITY_ENUM] },

{"command":"curl -fsS \"http://localhost:7777/api/api-action?path=/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat\" 2>&1 | head -c 600; echo","description":"Poll migrate job status"}

{"path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat","action":"migrate","status":"done","startedAt":1780262705209,"endedAt":1780262706147,"exitCode":0,"error":null,"logPath":"/var/folders/pr/7k4xc3v1715_0zbbw8tgwl5r0000gn/T/worktree-dashboard-logs/sherpa-api-api-458-credit-check-compliance-integrat-migrate.log","tail":"\n> Sherpa [email protected] db:migrate:up\n> tsx src/db/migrate.ts up\n\n"}

{"command":"curl -fsS -X POST http://localhost:7777/api/restart -H 'Content-Type: application/json' -d '{\"paths\":[\"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat\"]}' 2>&1 | head -c 400; echo \"---restart kicked---\"","description":"Restart API dev server via dashboard"}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runtime/audit.ts"}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.07.add-integration-invocation-mode.ts"}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes/plus/externalIntegrationsRoutes.ts","limit":175}

{"results":[{"path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat","ok":true,"freedPort":4006,"readyMs":46484}]}---restart kicked---

1	import type { _ExternalIntegrationCallLog } from '@/models/ExternalIntegrationCallLog.js';
2	import { _ExternalIntegrationCallLog as CallLog } from '@/models/ExternalIntegrationCallLog.js';
3	import type { ExternalIntegrationCallStatus } from '@/models/ExternalIntegrationCallLog.js';
4	
5	const MAX_EXCERPT_BYTES = 8 * 1024;
6	
7	// Header names to drop entirely from the excerpt.
8	const HEADER_BLOCKLIST = new Set([
9	  'authorization',
10	  'cookie',
11	  'set-cookie',
12	  'x-api-key',
13	  'x-auth-token',
14	  'proxy-authorization',
15	]);
16	
17	// Keys whose values should be redacted when found in JSON request/response
18	// bodies. Case-insensitive substring match.
19	const KEY_REDACTION_FRAGMENTS = [
20	  'password',
21	  'secret',
22	  'token',
23	  'apikey',
24	  'api_key',
25	  'authorization',
26	];
27	
28	function shouldRedactKey(key: string): boolean {
29	  const lower = key.toLowerCase();
30	  for (const fragment of KEY_REDACTION_FRAGMENTS) {
31	    if (lower.includes(fragment)) return true;
32	  }
33	  return false;
34	}
35	
36	function redactObject(value: unknown): unknown {
37	  if (value === null || value === undefined) return value;
38	  if (typeof value !== 'object') return value;
39	  if (Array.isArray(value)) return value.map((v) => redactObject(v));
40	  const out: Record<string, unknown> = {};
41	  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
42	    out[k] = shouldRedactKey(k) ? '[REDACTED]' : redactObject(v);
43	  }
44	  return out;
45	}
46	
47	function redactHeaders(headers: Record<string, string>): Record<string, string> {
48	  const out: Record<string, string> = {};
49	  for (const [k, v] of Object.entries(headers)) {
50	    out[k] = HEADER_BLOCKLIST.has(k.toLowerCase()) ? '[REDACTED]' : v;
51	  }
52	  return out;
53	}
54	
55	function truncate(json: unknown): unknown {
56	  const serialised = JSON.stringify(json);
57	  if (serialised === undefined) return null;
58	  if (serialised.length <= MAX_EXCERPT_BYTES) return json;
59	  return { _truncated: true, _bytes: serialised.length, preview: serialised.slice(0, MAX_EXCERPT_BYTES) };
60	}
61	
62	export interface CallLogInput {
63	  integrationId: string;
64	  organizationId: string;
65	  capability: string;
66	  operation: string;
67	  correlationId: string;
68	  status: ExternalIntegrationCallStatus;
69	  httpStatus: number | null;
70	  durationMs: number;
71	  attempts: number;
72	  request: { method: string; url: string; headers: Record<string, string>; body?: unknown };
73	  response: { headers: Record<string, string>; body?: unknown } | null;
74	  errorMessage: string | null;
75	}
76	
77	/**
78	 * Build a sanitised, truncated audit log row from a runner call attempt. Does
79	 * NOT write to the database — callers pass the result to {@link writeCallLog}.
80	 */
81	export function buildCallLog(input: CallLogInput): Parameters<typeof CallLog.create>[0] {
82	  const requestExcerpt = {
83	    method: input.request.method,
84	    url: input.request.url,
85	    headers: redactHeaders(input.request.headers),
86	    body: input.request.body !== undefined ? truncate(redactObject(input.request.body)) : null,
87	  };
88	  const responseExcerpt = input.response
89	    ? {
90	        headers: redactHeaders(input.response.headers),
91	        body: input.response.body !== undefined ? truncate(redactObject(input.response.body)) : null,
92	      }
93	    : null;
94	
95	  return {
96	    integrationId: input.integrationId,
97	    organizationId: input.organizationId,
98	    capability: input.capability,
99	    operation: input.operation,
100	    correlationId: input.correlationId,
101	    status: input.status,
102	    httpStatus: input.httpStatus,
103	    durationMs: input.durationMs,
104	    attempts: input.attempts,
105	    requestExcerpt,
106	    responseExcerpt,
107	    errorMessage: input.errorMessage,
108	  };
109	}
110	
111	/**
112	 * Persist a call-log row. Wrapped in try/catch — audit writes must never break
113	 * the calling integration. Failures are logged via the provided logger
114	 * function (the runner passes fastify.log.warn).
115	 */
116	export async function writeCallLog(
117	  row: Parameters<typeof CallLog.create>[0],
118	  onError: (err: unknown) => void,
119	): Promise<_ExternalIntegrationCallLog | null> {
120	  try {
121	    const created = await CallLog.create(row);
122	    return created;
123	  } catch (err) {
124	    onError(err);
125	    return null;
126	  }
127	}
128	
129	// Exposed for tests only.
130	export const _internal = { redactObject, redactHeaders, truncate, shouldRedactKey };
131	

1	import { QueryInterface } from 'sequelize';
2	import type { MigrationFn } from 'umzug';
3	
4	/**
5	 * Add per-integration `invocationMode` (sync | async) and `syncTimeoutMs`
6	 * so admins can pick how the compliance gate invokes each provider.
7	 *
8	 * Defaults are derived from the capability: APIs that resolve in <1s
9	 * (sanction screening, PEP, fraud detection) default to `sync` so the
10	 * customer's payment step sees the outcome immediately. Slower review-style
11	 * capabilities (KYC, adverse media) default to `async`, parking the policy
12	 * in compliance_pending until the worker completes.
13	 *
14	 * Also widens the `capability` column from a frozen `sanction_screening`-only
15	 * ENUM to STRING(64) so new capabilities can land without a migration.
16	 */
17	export const up: MigrationFn<QueryInterface> = async ({ context }) => {
18	  await context.sequelize.query(`
19	    ALTER TABLE "ExternalIntegrations"
20	    ALTER COLUMN capability TYPE VARCHAR(64) USING capability::text;
21	  `);
22	  await context.sequelize.query(`DROP TYPE IF EXISTS "enum_ExternalIntegrations_capability";`);
23	
24	  await context.sequelize.query(`
25	    DO $$
26	    BEGIN
27	      IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'enum_ExternalIntegrations_invocationMode') THEN
28	        CREATE TYPE "enum_ExternalIntegrations_invocationMode" AS ENUM ('sync', 'async');
29	      END IF;
30	    END $$;
31	  `);
32	  await context.sequelize.query(`
33	    ALTER TABLE "ExternalIntegrations"
34	    ADD COLUMN IF NOT EXISTS "invocationMode" "enum_ExternalIntegrations_invocationMode"
35	      NOT NULL DEFAULT 'sync';
36	  `);
37	  await context.sequelize.query(`
38	    ALTER TABLE "ExternalIntegrations"
39	    ADD COLUMN IF NOT EXISTS "syncTimeoutMs" INTEGER NOT NULL DEFAULT 5000;
40	  `);
41	
42	  await context.sequelize.query(`
43	    UPDATE "ExternalIntegrations"
44	    SET "invocationMode" = 'async'
45	    WHERE capability IN ('kyc', 'adverse_media');
46	  `);
47	
48	  await context.sequelize.query(`
49	    ALTER TABLE "PolicyOrders"
50	    ADD COLUMN IF NOT EXISTS "setupIntentRef" VARCHAR(255);
51	  `);
52	  await context.sequelize.query(`
53	    ALTER TABLE "PolicyOrders"
54	    ADD COLUMN IF NOT EXISTS "paymentCustomerRef" VARCHAR(255);
55	  `);
56	};
57	
58	export const down: MigrationFn<QueryInterface> = async () => {
59	  // Forward-only deployment.
60	};
61	

1	import type { FastifyInstance, FastifyPluginAsync } from 'fastify';
2	import { Type } from '@sinclair/typebox';
3	import {
4	  listExternalIntegrations,
5	  getExternalIntegrationById,
6	  createExternalIntegration,
7	  updateExternalIntegration,
8	  deleteExternalIntegration,
9	  listEnvironments,
10	  createEnvironment,
11	  updateEnvironment,
12	  deleteEnvironment,
13	  listAuthConfigs,
14	  createAuthConfig,
15	  updateAuthConfig,
16	  deleteAuthConfig,
17	  listCallLogs,
18	  type CreateExternalIntegrationBody,
19	  type CreateEnvironmentBody,
20	  type CreateAuthConfigBody,
21	} from '@/controllers/externalIntegrationController.js';
22	import {
23	  listRequestTemplates,
24	  createRequestTemplate,
25	  updateRequestTemplate,
26	  deleteRequestTemplate,
27	  testIntegration,
28	  type CreateRequestTemplateBody,
29	  type TestIntegrationBody,
30	} from '@/controllers/externalIntegrationRequestTemplateController.js';
31	import {
32	  listFieldMappings,
33	  createFieldMapping,
34	  updateFieldMapping,
35	  deleteFieldMapping,
36	  bulkReplaceFieldMappings,
37	  type CreateFieldMappingBody,
38	  type BulkReplaceFieldMappingsBody,
39	} from '@/controllers/externalIntegrationFieldMappingController.js';
40	import { PERMISSIONS } from '@/types/permissions.js';
41	
42	const ENVIRONMENT_ENUM = ['test', 'staging', 'production'] as const;
43	const CAPABILITY_ENUM = [
44	  'sanction_screening',
45	  'pep',
46	  'kyc',
47	  'adverse_media',
48	  'fraud_detection',
49	] as const;
50	const KIND_ENUM = ['generic_rest'] as const;
51	const INVOCATION_MODE_ENUM = ['sync', 'async'] as const;
52	const AUTH_TYPE_ENUM = [
53	  'client_credentials',
54	  'username_password',
55	  'api_key',
56	  'basic_auth',
57	  'oauth2_code',
58	  'custom',
59	] as const;
60	const TOKEN_TYPE_ENUM = ['bearer', 'basic', 'custom'] as const;
61	const HTTP_METHOD_ENUM = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'] as const;
62	
63	const retryPolicySchema = {
64	  type: ['object', 'null'],
65	  required: ['attempts', 'initialDelayMs', 'backoffMultiplier', 'maxDelayMs', 'retryOnStatuses'],
66	  additionalProperties: true,
67	  properties: {
68	    attempts: { type: 'integer', minimum: 1, maximum: 10 },
69	    initialDelayMs: { type: 'integer', minimum: 0, maximum: 60000 },
70	    backoffMultiplier: { type: 'number', minimum: 1, maximum: 10 },
71	    maxDelayMs: { type: 'integer', minimum: 0, maximum: 60000 },
72	    retryOnStatuses: {
73	      type: 'array',
74	      items: { type: 'integer', minimum: 100, maximum: 599 },
75	    },
76	  },
77	} as const;
78	
79	const requestTemplateCreateSchema = {
80	  type: 'object',
81	  required: [
82	    'integrationId',
83	    'operation',
84	    'httpMethod',
85	    'urlTemplate',
86	    'requestHeadersTemplate',
87	    'requestBodyTemplate',
88	    'responseMapping',
89	    'errorMapping',
90	    'timeoutMs',
91	    'retryPolicy',
92	  ],
93	  additionalProperties: false,
94	  properties: {
95	    integrationId: { type: 'string', format: 'uuid' },
96	    operation: { type: 'string', minLength: 1, maxLength: 100 },
97	    httpMethod: { type: 'string', enum: [...HTTP_METHOD_ENUM] },
98	    urlTemplate: { type: 'string', minLength: 1, maxLength: 1000 },
99	    requestHeadersTemplate: { type: ['object', 'null'], additionalProperties: { type: 'string' } },
100	    requestBodyTemplate: { type: ['object', 'null'], additionalProperties: true },
101	    responseMapping: { type: 'object', additionalProperties: { type: 'string' } },
102	    errorMapping: { type: ['object', 'null'], additionalProperties: { type: 'string' } },
103	    timeoutMs: { type: 'integer', minimum: 100, maximum: 120000 },
104	    retryPolicy: retryPolicySchema,
105	  },
106	} as const;
107	
108	const requestTemplateUpdateSchema = {
109	  type: 'object',
110	  additionalProperties: false,
111	  properties: {
112	    operation: { type: 'string', minLength: 1, maxLength: 100 },
113	    httpMethod: { type: 'string', enum: [...HTTP_METHOD_ENUM] },
114	    urlTemplate: { type: 'string', minLength: 1, maxLength: 1000 },
115	    requestHeadersTemplate: { type: ['object', 'null'], additionalProperties: { type: 'string' } },
116	    requestBodyTemplate: { type: ['object', 'null'], additionalProperties: true },
117	    responseMapping: { type: 'object', additionalProperties: { type: 'string' } },
118	    errorMapping: { type: ['object', 'null'], additionalProperties: { type: 'string' } },
119	    timeoutMs: { type: 'integer', minimum: 100, maximum: 120000 },
120	    retryPolicy: retryPolicySchema,
121	  },
122	} as const;
123	
124	const testIntegrationSchema = {
125	  type: 'object',
126	  required: ['operation', 'input', 'environment'],
127	  additionalProperties: false,
128	  properties: {
129	    operation: { type: 'string', minLength: 1, maxLength: 100 },
130	    input: { type: 'object', additionalProperties: true },
131	    environment: { type: ['string', 'null'], enum: [...ENVIRONMENT_ENUM, null] },
132	  },
133	} as const;
134	
135	const integrationCreateSchema = {
136	  type: 'object',
137	  required: ['name', 'slug', 'capability', 'kind', 'defaultEnvironment', 'active'],
138	  additionalProperties: false,
139	  properties: {
140	    name: { type: 'string', minLength: 1, maxLength: 255 },
141	    slug: { type: 'string', minLength: 1, maxLength: 100, pattern: '^[a-z0-9][a-z0-9-]*$' },
142	    capability: { type: 'string', enum: [...CAPABILITY_ENUM] },
143	    kind: { type: 'string', enum: [...KIND_ENUM] },
144	    defaultEnvironment: { type: 'string', enum: [...ENVIRONMENT_ENUM] },
145	    active: { type: 'boolean' },
146	    invocationMode: { type: 'string', enum: [...INVOCATION_MODE_ENUM] },
147	    syncTimeoutMs: { type: 'integer', minimum: 100, maximum: 60000 },
148	  },
149	} as const;
150	
151	const integrationUpdateSchema = {
152	  type: 'object',
153	  additionalProperties: false,
154	  properties: {
155	    name: { type: 'string', minLength: 1, maxLength: 255 },
156	    slug: { type: 'string', minLength: 1, maxLength: 100, pattern: '^[a-z0-9][a-z0-9-]*$' },
157	    capability: { type: 'string', enum: [...CAPABILITY_ENUM] },
158	    kind: { type: 'string', enum: [...KIND_ENUM] },
159	    defaultEnvironment: { type: 'string', enum: [...ENVIRONMENT_ENUM] },
160	    active: { type: 'boolean' },
161	    invocationMode: { type: 'string', enum: [...INVOCATION_MODE_ENUM] },
162	    syncTimeoutMs: { type: 'integer', minimum: 100, maximum: 60000 },
163	  },
164	} as const;
165	
166	const environmentCreateSchema = {
167	  type: 'object',
168	  required: ['integrationId', 'environment', 'baseUrl', 'authEndpoint', 'tokenEndpoint'],
169	  additionalProperties: false,
170	  properties: {
171	    integrationId: { type: 'string', format: 'uuid' },
172	    environment: { type: 'string', enum: [...ENVIRONMENT_ENUM] },
173	    baseUrl: { type: 'string', minLength: 1, maxLength: 500, format: 'uri' },
174	    authEndpoint: { type: ['string', 'null'], maxLength: 500 },
175	    tokenEndpoint: { type: ['string', 'null'], maxLength: 500 },

{"command":"echo \"=== health re-check ===\"; curl -fsS -o /dev/null -w \"api/health: %{http_code}\\n\" http://localhost:4006/health 2>&1; curl -fsS -o /dev/null -w \"portal: %{http_code}\\n\" http://localhost:3006 2>&1; curl -fsS -o /dev/null -w \"embed: %{http_code}\\n\" http://localhost:3106 2>&1\necho \"=== test worktree readiness ===\"; cd /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat 2>/dev/null && test -d node_modules && echo \"node_modules: present\" || echo \"node_modules: MISSING\"; test -f playwright/.auth/user.json && echo \"auth state: present\" || echo \"auth state: missing\"","description":"Re-verify stack health + test worktree"}

=== health re-check ===
curl: (22) The requested URL returned error: 404
api/health: 404
portal: 200
embed: 200
=== test worktree readiness ===
node_modules: MISSING
auth state: missing

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/integration/ExternalIntegrationCallLog.ts"}

1	import { Type, type Static } from '@sinclair/typebox';
2	import { Uuid, IsoDateTime, NullableInteger, NullableString } from '../_helpers.js';
3	
4	export const ExternalIntegrationCallLogPublicFields = [
5	  'id',
6	  'integrationId',
7	  'organizationId',
8	  'capability',
9	  'operation',
10	  'correlationId',
11	  'status',
12	  'httpStatus',
13	  'durationMs',
14	  'attempts',
15	  'requestExcerpt',
16	  'responseExcerpt',
17	  'errorMessage',
18	  'createdAt',
19	] as const;
20	
21	export const ExternalIntegrationCallLogPrivateFields = [] as const;
22	
23	export const ExternalIntegrationCallLogSchema = Type.Object(
24	  {
25	    id: Uuid({ description: 'Call log UUID.' }),
26	    integrationId: Uuid({ description: 'ExternalIntegration that produced the call.' }),
27	    organizationId: Uuid({ description: 'Owning organisation.' }),
28	    capability: Type.Union(
29	      [Type.Literal('sanction_screening')],
30	      { description: 'Capability the call was made under.' },
31	    ),
32	    operation: Type.String({
33	      maxLength: 100,
34	      description: 'Capability-defined opcode (e.g. "screen").',
35	    }),
36	    correlationId: Type.String({
37	      maxLength: 100,
38	      description: 'Correlation ID propagated as X-Correlation-Id; links Sherpa request to provider call.',
39	    }),
40	    status: Type.Union(
41	      [
42	        Type.Literal('success'),
43	        Type.Literal('error'),
44	        Type.Literal('timeout'),
45	        Type.Literal('circuit_open'),
46	      ],
47	      { description: 'Final disposition of the call.' },
48	    ),
49	    httpStatus: NullableInteger({
50	      minimum: 100,
51	      maximum: 599,
52	      description: 'HTTP status code if the call reached the network.',
53	    }),
54	    durationMs: Type.Integer({ minimum: 0, description: 'Total wall-clock duration of the call attempt.' }),
55	    attempts: Type.Integer({ minimum: 1, description: 'How many attempts were made before terminal status.' }),
56	    requestExcerpt: Type.Union(
57	      [Type.Object({}, { additionalProperties: true }), Type.Null()],
58	      { description: 'Redacted excerpt of the request (truncated to 8KB).' },
59	    ),
60	    responseExcerpt: Type.Union(
61	      [Type.Object({}, { additionalProperties: true }), Type.Null()],
62	      { description: 'Redacted excerpt of the response (truncated to 8KB).' },
63	    ),
64	    errorMessage: NullableString({ description: 'Final error message if status != success.' }),
65	    createdAt: IsoDateTime({ description: 'Timestamp when the call was made.' }),
66	  },
67	  {
68	    $id: 'ExternalIntegrationCallLog',
69	    additionalProperties: true,
70	    description:
71	      'Per-call audit log for outbound calls made by the integration runner. Bodies are redacted and truncated.',
72	  },
73	);
74	
75	export type ExternalIntegrationCallLog = Static<typeof ExternalIntegrationCallLogSchema>;
76	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/externalIntegrationSmartSetup.ts"}

1	export type IntegrationCapability = "sanction_screening";
2	export type IntegrationHttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
3	export type SmartSetupSourceKind = "curl" | "postman" | "openapi" | "raw";
4	
5	export interface SmartSetupDataModelFieldRef {
6	  id: number;
7	  name: string;
8	  label: string;
9	  description?: string;
10	  type?: string;
11	}
12	
13	export interface ExternalIntegrationSmartSetupInput {
14	  capability: IntegrationCapability;
15	  /** "screen" for sanction_screening today. Capabilities define their own operation names. */
16	  operation: string;
17	  sourceKind: SmartSetupSourceKind;
18	  /** Raw text of the imported source (cURL string, Postman JSON, OpenAPI JSON/YAML). */
19	  source: string;
20	  /** Pre-extracted hint when the client has already parsed enough to identify
21	   * a single endpoint (e.g. OpenAPI operation `POST /match/{dataset}`). */
22	  sourceHint?: string;
23	  /** Sample JSON response if the user pasted one alongside the import — used
24	   * for both responseMapping inference and to seed the inbound field mappings. */
25	  jsonResponseInput?: string;
26	  dataModelFields: SmartSetupDataModelFieldRef[];
27	}
28	
29	export interface LLMConfig {
30	  model: string;
31	  thinkingLevel: string;
32	  prompt: string;
33	  temperature: number;
34	  maxTokens: number;
35	}
36	
37	const CAPABILITY_OUTPUT_CONTRACT: Record<IntegrationCapability, string> = {
38	  sanction_screening: `
39	The integration runner invokes operation='screen' with this typed input shape:
40	  {
41	    "parties": [
42	      { "role": "policyholder" | "insured" | "beneficiary",
43	        "firstName": string, "lastName": string,
44	        "dateOfBirth": string | null, "nationality": string | null }
45	    ]
46	  }
47	
48	The runner expects the rendered response to expose a 'matches' key
49	containing an array of objects with at least:
50	  { "entityId": string, "entityName": string, "score": number,
51	    "topics": string[], "datasets": string[], "sourceUrl": string | null }
52	
53	The responseMapping field MUST lift the provider's matches array under the
54	key "matches". Inbound field mappings then alias each match's provider
55	fields onto entityId / entityName / score / topics / datasets / sourceUrl.
56	`,
57	};
58	
59	export function buildExternalIntegrationSmartSetupPrompt(
60	  input: ExternalIntegrationSmartSetupInput,
61	): LLMConfig {
62	  const { capability, operation, sourceKind, source, sourceHint, jsonResponseInput, dataModelFields } =
63	    input;
64	
65	  const dataModelFieldsReference =
66	    dataModelFields.length > 0
67	      ? dataModelFields
68	          .map((f) => {
69	            const parts = [
70	              `${f.name} (ID: ${f.id})`,
71	              `Label: "${f.label}"`,
72	              f.description ? `Description: "${f.description}"` : null,
73	              f.type ? `Type: ${f.type}` : null,
74	            ].filter(Boolean);
75	            return `  - ${parts.join(", ")}`;
76	          })
77	          .join("\n")
78	      : "  (no DataModel fields supplied — fall back to customFieldName paths)";
79	
80	  const capabilityContract =
81	    CAPABILITY_OUTPUT_CONTRACT[capability] ??
82	    `Project-defined capability '${capability}'. Use sensible defaults; the responseMapping must expose the keys the runner expects for this capability.`;
83	
84	  const sourceLabel = {
85	    curl: "cURL command",
86	    postman: "Postman collection (v2.1)",
87	    openapi: "OpenAPI 3.x specification",
88	    raw: "Raw integration source",
89	  }[sourceKind];
90	
91	  const prompt = `You are an API-integration onboarding expert. The user pasted a ${sourceLabel} for a third-party API. Produce a single JSON bundle that configures Sherpa's external-integration runner end-to-end: environment, auth config, request template, and field mappings. The bundle is consumed by an admin UI which previews and then persists each row.
92	
93	CAPABILITY: ${capability}
94	OPERATION: ${operation}
95	${capabilityContract}
96	
97	${sourceHint ? `OPERATION HINT: ${sourceHint}\n` : ""}SOURCE (${sourceKind}):
98	${source}
99	${jsonResponseInput ? `\nSAMPLE JSON RESPONSE (for response shape + inbound mappings):\n${jsonResponseInput}\n` : ""}
100	
101	AVAILABLE DATA MODEL FIELDS (use these for inbound semantic matches; for outbound, prefer the canonical capability input fields like parties.0.firstName):
102	${dataModelFieldsReference}
103	
104	YOUR TASKS:
105	
106	1. ENVIRONMENT
107	   - environment: "test" by default. If the source URL contains "sandbox" / "staging" / "stage", use that label; if "prod" / "production" / no qualifier, use "production".
108	   - baseUrl: the URL up to and including the host (https://host[:port]). No path. Strip trailing slash.
109	   - authEndpoint: when the source declares a separate authorize endpoint (e.g. OpenAPI security flow with authorizationUrl), put the absolute URL here; else null.
110	   - tokenEndpoint: same idea for token endpoints (OAuth tokenUrl); else null.
111	
112	2. AUTH CONFIG
113	   Detect the auth scheme from the source:
114	   - api_key: Authorization header like "ApiKey ..." or "Bearer ..." with a single opaque token; or query/header named X-API-Key.
115	   - client_credentials: OAuth2 with tokenUrl that exchanges client_id + client_secret for a Bearer token.
116	   - username_password: HTTP Basic-shaped flow that exchanges username + password for a token.
117	   - basic_auth: raw HTTP Basic header.
118	   - oauth2_code: OAuth2 authorization-code flow (requires refresh token storage).
119	   - custom: anything else.
120	   Emit:
121	   - authType: one of the above.
122	   - tokenType: "bearer" for "Bearer ..." headers, "basic" for "Basic ...", "custom" otherwise.
123	   - authorizationHeaderFormat: the exact header template the runner should produce — use the literal "{token}" placeholder where the resolved token slots in (e.g. "Bearer {token}", "ApiKey {token}").
124	   - credentialHint: a short string telling the admin which credential field they need to fill before this auth config is functional (e.g. "Paste your provider API key here", "Provide clientId + clientSecret"). The runtime does NOT consume this — it is shown verbatim to the admin.
125	
126	3. REQUEST TEMPLATE
127	   The user is configuring ONE operation (${operation}). Pick the most likely endpoint from the source — for OpenAPI / Postman with multiple endpoints, prefer the one whose name/summary or tag matches the capability (e.g. for sanction_screening: /match, /screen, /search).
128	   - operation: ${operation}
129	   - httpMethod: GET | POST | PUT | PATCH | DELETE
130	   - urlTemplate: path relative to baseUrl (e.g. "match/default"). NO leading slash.
131	   - requestHeadersTemplate: object of header→value. Skip Authorization (the runner injects it). Keep things like Accept / Content-Type. Null if none.
132	   - requestBodyTemplate: literal JSON scaffolding values the provider expects to be hard-coded (e.g. a fixed "version" or "queryName"). Use null when every value is supplied by field mappings.
133	   - responseMapping: keys exposed to the capability handler → JSONPath strings ("$." prefixed). For sanction_screening MUST include a "matches" key.
134	   - errorMapping: optional canonical error keys → JSONPath in provider error payload.
135	   - timeoutMs: 10000 unless the source suggests otherwise.
136	   - retryPolicy: default
137	     {"attempts":3,"initialDelayMs":500,"backoffMultiplier":2,"maxDelayMs":5000,"retryOnStatuses":[502,503,504]}
138	
139	4. FIELD MAPPINGS
140	   Outbound (direction="request") rows pull from the typed capability input and place values inside the outbound request body. Inbound (direction="response") rows normalise each provider response element under the canonical capability shape.
141	
142	   Outbound rules
143	   - providerFieldPath: JSONPath-lite target on the request body, e.g. "$.queries.q1.properties.firstName[0]".
144	   - dataModelFieldId: integer id from AVAILABLE 

{"command":"echo \"=== api root ===\"; curl -fsS -o /dev/null -w \"api/: %{http_code}\\n\" http://localhost:4006/ 2>&1; curl -fsS -o /dev/null -w \"api/docs: %{http_code}\\n\" http://localhost:4006/docs 2>&1; curl -fsS -o /dev/null -w \"api/v1/external-integrations: %{http_code}\\n\" http://localhost:4006/v1/external-integrations 2>&1","description":"Confirm API is actually serving"}

Exit code 22
=== api root ===
api/: 200
api/docs: 200
curl: (22) The requested URL returned error: 404
api/v1/external-integrations: 404

{"command":"npm install 2>&1 | tail -5; echo \"=== install exit: $? ===\"","description":"Install test worktree deps","run_in_background":true}

<tool_use_error>Cancelled: parallel tool call Bash(echo "=== api root ==="; curl -fsS -o /d…) errored</tool_use_error>

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/compliance/ComplianceCheck.ts"}

<tool_use_error>Cancelled: parallel tool call Bash(echo "=== api root ==="; curl -fsS -o /d…) errored</tool_use_error>

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat\necho \"=== buildExternalIntegrationSmartSetupPrompt call sites ===\"; rg -n 'buildExternalIntegrationSmartSetupPrompt|ExternalIntegrationSmartSetupInput|IntegrationCapability' app --type ts -l | head\necho \"=== how capability is passed in SmartSetupModal ===\"; rg -n 'capability|buildExternalIntegrationSmartSetupPrompt|IntegrationCapability' app/components/admin/integrations/SmartSetupModal.tsx | head -30","description":"Find smart-setup prompt call sites + capability flow"}

<tool_use_error>Cancelled: parallel tool call Bash(echo "=== api root ==="; curl -fsS -o /d…) errored</tool_use_error>

{"command":"npm install 2>&1 | tail -4; echo \"=== test npm install exit: $? ===\"","description":"Install test worktree deps (background)","run_in_background":true}

Command running in background with ID: bznpaulzj. Output is being written to: /private/tmp/claude-501/-Users-bakker-dev-gangkhar/b101c917-945f-4560-bcd9-4ef963e5d941/tasks/bznpaulzj.output. You will be notified when it completes. To check interim output, use Read on that file path.

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/compliance/ComplianceCheck.ts"}

1	import { Type, type Static } from '@sinclair/typebox';
2	import {
3	  Uuid,
4	  IsoDateTime,
5	  NullableUuid,
6	  NullableString,
7	  NullableIsoDateTime,
8	} from '../_helpers.js';
9	
10	export const ComplianceCheckPublicFields = [
11	  'id',
12	  'organizationId',
13	  'productId',
14	  'integrationId',
15	  'capability',
16	  'triggerType',
17	  'previousPolicyId',
18	  'rootPolicyId',
19	  'policyOrderId',
20	  'claimRecordId',
21	  'customerId',
22	  'issuanceContext',
23	  'screenedParties',
24	  'status',
25	  'outcome',
26	  'manualDecision',
27	  'manualDecisionBy',
28	  'manualDecisionAt',
29	  'manualDecisionNote',
30	  'findings',
31	  'rawResponse',
32	  'error',
33	  'correlationId',
34	  'createdAt',
35	  'updatedAt',
36	] as const;
37	
38	export const ComplianceCheckPrivateFields = [] as const;
39	
40	const ScreenedPartySchema = Type.Object(
41	  {
42	    role: Type.Union([
43	      Type.Literal('policyholder'),
44	      Type.Literal('insured'),
45	      Type.Literal('beneficiary'),
46	    ]),
47	    sourcePath: Type.String({
48	      description:
49	        'Policy/claim parameter path the party object was read from (e.g. "personal", "insureds.0").',
50	    }),
51	    data: Type.Object(
52	      {},
53	      {
54	        additionalProperties: true,
55	        description:
56	          'Raw DataModelField object forwarded to the provider. Field shape is open — every key on the source category is included verbatim.',
57	      },
58	    ),
59	  },
60	  { additionalProperties: true, description: 'A party sent to the compliance provider.' },
61	);
62	
63	const PartyCheckFindingSchema = Type.Object(
64	  {
65	    entityId: Type.String({ description: 'Provider-specific entity identifier.' }),
66	    entityName: Type.String(),
67	    score: Type.Number({ minimum: 0, maximum: 1 }),
68	    topics: Type.Array(Type.String()),
69	    datasets: Type.Array(Type.String()),
70	    sourceUrl: NullableString(),
71	  },
72	  {
73	    additionalProperties: true,
74	    description: 'Normalised match from the provider after response mapping.',
75	  },
76	);
77	
78	export const ComplianceCheckSchema = Type.Object(
79	  {
80	    id: Uuid({ description: 'Screening UUID.' }),
81	    organizationId: Uuid(),
82	    productId: Type.Integer({ description: 'Product the screening is associated with.' }),
83	    integrationId: Uuid({ description: 'Which ExternalIntegration produced this check.' }),
84	    capability: Type.String({ description: 'Capability that produced this row (sanction_screening, kyc, fraud_detection, ...).' }),
85	    triggerType: Type.Union([
86	      Type.Literal('NEW_BUSINESS'),
87	      Type.Literal('RENEWAL'),
88	      Type.Literal('ENDORSEMENT'),
89	      Type.Literal('CLAIM'),
90	      Type.Literal('MANUAL'),
91	    ]),
92	    previousPolicyId: NullableUuid({ description: 'Specific prior policy version being renewed.' }),
93	    rootPolicyId: NullableUuid({ description: 'Root policy family.' }),
94	    policyOrderId: NullableUuid({ description: 'PolicyOrder created from this check, when applicable.' }),
95	    claimRecordId: NullableUuid({ description: 'ClaimRecord this check is attached to (CLAIM trigger).' }),
96	    customerId: NullableUuid({ description: 'Customer this check is attached to (MANUAL trigger).' }),
97	    issuanceContext: Type.Object(
98	      {},
99	      {
100	        additionalProperties: true,
101	        description:
102	          'Snapshot of everything needed to resume PolicyOrder creation after screening clears.',
103	      },
104	    ),
105	    screenedParties: Type.Array(ScreenedPartySchema),
106	    status: Type.Union(
107	      [
108	        Type.Literal('pending'),
109	        Type.Literal('processing'),
110	        Type.Literal('completed'),
111	        Type.Literal('failed'),
112	      ],
113	      { description: 'Job lifecycle state.' },
114	    ),
115	    outcome: Type.Union(
116	      [
117	        Type.Null(),
118	        Type.Literal('pass'),
119	        Type.Literal('fail'),
120	        Type.Literal('review'),
121	      ],
122	      { description: 'Final outcome once status=completed; null otherwise.' },
123	    ),
124	    manualDecision: Type.Union(
125	      [Type.Null(), Type.Literal('approved'), Type.Literal('rejected')],
126	      { description: 'Manual decision for fail/review outcomes.' },
127	    ),
128	    manualDecisionBy: NullableUuid({ description: 'User who recorded the manual decision.' }),
129	    manualDecisionAt: NullableIsoDateTime(),
130	    manualDecisionNote: NullableString({ description: 'Free-text rationale for the decision.' }),
131	    findings: Type.Union([Type.Null(), Type.Array(PartyCheckFindingSchema)], {
132	      description: 'Provider matches after normalisation; null until completed.',
133	    }),
134	    rawResponse: Type.Union([Type.Null(), Type.Any()], {
135	      description:
136	        'Raw provider response. Stripped from customer responses; visible to CRM only.',
137	    }),
138	    error: NullableString({ description: 'Final error message when status=failed.' }),
139	    correlationId: NullableString({ description: 'Correlation ID linking this screening to its outbound calls.' }),
140	    createdAt: IsoDateTime(),
141	    updatedAt: IsoDateTime(),
142	  },
143	  {
144	    $id: 'ComplianceCheck',
145	    additionalProperties: true,
146	    description:
147	      'Per-issuance compliance check record. Created at the start of new-business or renewal issuance; gates downstream PolicyOrder creation.',
148	  },
149	);
150	
151	export type ComplianceCheck = Static<typeof ComplianceCheckSchema>;
152	

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat\necho \"=== smart-setup call sites ===\"; rg -n 'buildExternalIntegrationSmartSetupPrompt|externalIntegrationSmartSetup' app --type ts -l\necho \"=== capability flow in SmartSetupModal ===\"; rg -n 'capability|IntegrationCapability|SmartSetupInput' app/components/admin/integrations/SmartSetupModal.tsx | head -25","description":"Find smart-setup prompt call sites + capability flow"}

=== smart-setup call sites ===
app/api/llm/generate/route.ts
app/prompts/externalIntegrationSmartSetup.ts
app/components/admin/integrations/SmartSetupModal.tsx
=== capability flow in SmartSetupModal ===
24:  IntegrationCapability,
79:  capability: IntegrationCapability;
133:  capability,
216:          capability,

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/api/llm/generate/route.ts"}

1	import { getSherpaApiUrl } from "@/app/src/utils/env";
2	import { buildPatternGenerationPrompt, buildEnumGenerationPrompt } from "@/app/prompts/fieldPatternGeneration";
3	import { buildEnumOptionsGenerationPrompt } from "@/app/prompts/enumOptionsGeneration";
4	import { buildPartnerSmartImportPrompt } from "@/app/prompts/partnerSmartImport";
5	import { buildPricingTableGenerationPrompt } from "@/app/prompts/pricingTableGeneration";
6	import { buildPurchaseProbabilityPrompt } from "@/app/prompts/purchaseProbability";
7	import { buildExternalIntegrationSmartImportPrompt } from "@/app/prompts/externalIntegrationSmartImport";
8	import { buildExternalIntegrationSmartSetupPrompt } from "@/app/prompts/externalIntegrationSmartSetup";
9	
10	export const runtime = "nodejs";
11	export const dynamic = "force-dynamic";
12	
13	const promptBuilders: Record<string, (input: any) => any> = {
14	  buildPatternGenerationPrompt,
15	  buildEnumGenerationPrompt,
16	  buildEnumOptionsGenerationPrompt,
17	  buildPartnerSmartImportPrompt,
18	  buildPricingTableGenerationPrompt,
19	  buildPurchaseProbabilityPrompt,
20	  buildExternalIntegrationSmartImportPrompt,
21	  buildExternalIntegrationSmartSetupPrompt,
22	};
23	
24	export async function POST(req: Request) {
25	  const upstreamUrl = `${getSherpaApiUrl()}/v1/plus/llm/generate`;
26	  
27	  try {
28	    const body = await req.json();
29	    const { promptBuilder, ...input } = body;
30	
31	    const builderFn = promptBuilders[promptBuilder];
32	    if (!builderFn) {
33	      return new Response(
34	        JSON.stringify({ status: "error", message: `Unknown promptBuilder: ${promptBuilder}` }),
35	        { status: 400, headers: { "content-type": "application/json" } }
36	      );
37	    }
38	
39	    const config = builderFn(input);
40	
41	    const authorization = req.headers.get("authorization");
42	    if (!authorization) {
43	      return new Response(
44	        JSON.stringify({ status: "error", message: "Unauthorized" }),
45	        { status: 401, headers: { "content-type": "application/json" } }
46	      );
47	    }
48	
49	    const upstreamRes = await fetch(upstreamUrl, {
50	      method: "POST",
51	      headers: {
52	        "content-type": "application/json",
53	        "authorization": authorization,
54	      },
55	      body: JSON.stringify(config),
56	    });
57	
58	    const data = await upstreamRes.json();
59	
60	    return new Response(JSON.stringify(data), {
61	      status: upstreamRes.status,
62	      headers: {
63	        "content-type": "application/json",
64	      },
65	    });
66	  } catch (error) {
67	    console.error("LLM Generate Error:", error);
68	    return new Response(
69	      JSON.stringify({ status: "error", message: "Internal server error" }),
70	      { status: 500, headers: { "content-type": "application/json" } }
71	    );
72	  }
73	}
74	
75	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/SmartSetupModal.tsx","offset":200,"limit":30}

200	  }, [artifact, openApiOperationKey]);
201	
202	  const operationName = "check";
203	
204	  const analyze = async () => {
205	    if (!source.trim()) {
206	      setError(t("Paste a cURL command, Postman collection, or OpenAPI spec first."));
207	      return;
208	    }
209	    try {
210	      setGenerating(true);
211	      setError("");
212	      const llmRes = await nextApi.post<{ status: string; data?: { text: string } }>(
213	        "/api/llm/generate",
214	        {
215	          promptBuilder: "buildExternalIntegrationSmartSetupPrompt",
216	          capability,
217	          operation: operationName,
218	          sourceKind: artifact.format,
219	          source: artifact.redactedSource || source,
220	          sourceHint,
221	          jsonResponseInput: responseSample || undefined,
222	          dataModelFields,
223	        },
224	      );
225	      const text = llmRes.data?.text;
226	      if (!text) {
227	        setError(t("AI returned an empty response."));
228	        return;
229	      }

{"command":"PRIMARY=/Users/bakker/dev/gangkhar/sherpa-test/playwright/.auth/user.json\nDEST=/Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/playwright/.auth\nif [ -f \"$PRIMARY\" ]; then mkdir -p \"$DEST\" && cp \"$PRIMARY\" \"$DEST/user.json\" && echo \"auth seeded from primary\"; else echo \"PRIMARY auth state NOT present — will run setup project\"; fi","description":"Seed Playwright auth state from primary test repo"}

auth seeded from primary

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat && npx playwright install chromium 2>&1 | tail -5; echo \"=== playwright chromium install exit: $? ===\"","description":"Install Playwright chromium (background)","run_in_background":true}

Command running in background with ID: b2ntr3cam. Output is being written to: /private/tmp/claude-501/-Users-bakker-dev-gangkhar/b101c917-945f-4560-bcd9-4ef963e5d941/tasks/b2ntr3cam.output. You will be notified when it completes. To check interim output, use Read on that file path.

{"tasks":"[\n{\"content\":\"API: register credit_check capability in runner.ts\",\"status\":\"in_progress\",\"priority\":\"high\",\"id\":\"api-runner\"},\n{\"content\":\"API: add credit_check to CAPABILITY_ENUM in externalIntegrationsRoutes.ts\",\"status\":\"pending\",\"priority\":\"high\",\"id\":\"api-routes\"},\n{\"content\":\"API: migration to widen ExternalIntegrationCallLogs.capability ENUM->VARCHAR(64)\",\"status\":\"pending\",\"priority\":\"high\",\"id\":\"api-migration\"},\n{\"content\":\"API: update _ExternalIntegrationCallLog model + TypeBox schema capability to string\",\"status\":\"pending\",\"priority\":\"high\",\"id\":\"api-model\"},\n{\"content\":\"Portal: add credit_check to admin.ts capability types/records\",\"status\":\"pending\",\"priority\":\"high\",\"id\":\"portal-types\"},\n{\"content\":\"Portal: ProductCompliancePanel registry + labels for credit_check\",\"status\":\"pending\",\"priority\":\"high\",\"id\":\"portal-panel\"},\n{\"content\":\"Portal: IntegrationsTab + 3 capabilityLabel switches for credit_check\",\"status\":\"pending\",\"priority\":\"high\",\"id\":\"portal-labels\"},\n{\"content\":\"Portal: credit_check output contract in smart-setup prompt\",\"status\":\"pending\",\"priority\":\"medium\",\"id\":\"portal-prompt\"},\n{\"content\":\"Test: sherpa-test spec for credit_check compliance type\",\"status\":\"pending\",\"priority\":\"medium\",\"id\":\"test-spec\"},\n{\"content\":\"Run migrate, re-verify stack, iterative-review skill\",\"status\":\"pending\",\"priority\":\"high\",\"id\":\"review\"},\n{\"content\":\"Browser proof (Playwright) of portal credit_check UI + screenshots\",\"status\":\"pending\",\"priority\":\"high\",\"id\":\"proof\"},\n{\"content\":\"Commit+push all repos, comment, flip labels\",\"status\":\"pending\",\"priority\":\"high\",\"id\":\"ship\"}\n]"}

<tool_use_error>InputValidationError: TaskCreate failed due to the following issues:
The required parameter `subject` is missing
The required parameter `description` is missing
An unexpected parameter `tasks` was provided

This tool's schema was not sent to the API — it was not in the discovered-tool set derived from message history. Without the schema in your prompt, typed parameters (arrays, numbers, booleans) get emitted as strings and the client-side parser rejects them. Load the tool first: call ToolSearch with query "select:TaskCreate", then retry this call.</tool_use_error>

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx","offset":36,"limit":100}

36	// panel. Adding a new capability here surfaces it in the UI immediately —
37	// no other code changes required as long as the backend has the capability
38	// registered (see sherpa-api domains/integrations/runner.ts).
39	type CapabilityKey =
40	  | "sanction_screening"
41	  | "pep"
42	  | "kyc"
43	  | "adverse_media"
44	  | "fraud_detection";
45	
46	interface CapabilityDef {
47	  key: CapabilityKey;
48	  icon: LucideIcon;
49	  defaultTriggers: ComplianceTrigger[];
50	  defaultOutcomeRules: ProductCapabilityConfig["outcomeRules"];
51	}
52	const CAPABILITY_REGISTRY: CapabilityDef[] = [
53	  {
54	    key: "sanction_screening",
55	    icon: ShieldCheck,
56	    defaultTriggers: ["NEW_BUSINESS", "RENEWAL"],
57	    defaultOutcomeRules: {
58	      passWhen: { maxScore: 0.5 },
59	      failWhen: { minScore: 0.85, onTopics: ["sanction"] },
60	    },
61	  },
62	  {
63	    key: "pep",
64	    icon: Eye,
65	    defaultTriggers: ["NEW_BUSINESS", "RENEWAL"],
66	    defaultOutcomeRules: {
67	      passWhen: { maxScore: 0.5 },
68	      failWhen: { minScore: 0.85, onTopics: ["role.pep"] },
69	    },
70	  },
71	  {
72	    key: "kyc",
73	    icon: UserCheck,
74	    defaultTriggers: ["NEW_BUSINESS"],
75	    defaultOutcomeRules: {
76	      passWhen: { maxScore: 0.5 },
77	      failWhen: { minScore: 0.85, onTopics: ["kyc.failed", "kyc.fraud"] },
78	    },
79	  },
80	  {
81	    key: "adverse_media",
82	    icon: AlertTriangle,
83	    defaultTriggers: ["NEW_BUSINESS", "RENEWAL"],
84	    defaultOutcomeRules: {
85	      passWhen: { maxScore: 0.5 },
86	      failWhen: { minScore: 0.85, onTopics: ["adverse_media"] },
87	    },
88	  },
89	  {
90	    key: "fraud_detection",
91	    icon: Activity,
92	    defaultTriggers: ["CLAIM"],
93	    defaultOutcomeRules: {
94	      passWhen: { maxScore: 0.5 },
95	      failWhen: { minScore: 0.85, onTopics: ["fraud.high_risk"] },
96	    },
97	  },
98	];
99	
100	// Hook-bound text for each capability. lmt-translate requires literal arguments,
101	// so labels and blurbs live here as switch branches keyed off the capability id.
102	function useCapabilityText() {
103	  const { t } = useLMT();
104	  const label = (key: CapabilityKey): string => {
105	    switch (key) {
106	      case "sanction_screening":
107	        return t("Sanction Screening");
108	      case "pep":
109	        return t("PEP Check");
110	      case "kyc":
111	        return t("KYC Verification");
112	      case "adverse_media":
113	        return t("Adverse Media");
114	      case "fraud_detection":
115	        return t("Fraud Detection");
116	    }
117	  };
118	  const blurb = (key: CapabilityKey): string => {
119	    switch (key) {
120	      case "sanction_screening":
121	        return t("Run policy parties against OFAC / EU / UK / OS sanction lists. Blocking matches halt the gate.");
122	      case "pep":
123	        return t("Check if parties are Politically Exposed Persons or close associates. Often runs alongside sanctions.");
124	      case "kyc":
125	        return t("Verify the policyholder's identity (document + selfie or data + bureau check) at onboarding.");
126	      case "adverse_media":
127	        return t("Scan news + watchlists for negative coverage of the parties (regulatory enforcement, criminal proceedings).");
128	      case "fraud_detection":
129	        return t("Score the party / claim for fraud risk via an external bureau. Typically runs at claim creation.");
130	    }
131	  };
132	  return { label, blurb };
133	}
134	
135	const ALL_TRIGGERS: ComplianceTrigger[] = [

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts","offset":237,"limit":35}

237	// ─── External integrations (outbound third-party API framework) ──────────────
238	
239	export type IntegrationCapability =
240	  | "sanction_screening"
241	  | "pep"
242	  | "kyc"
243	  | "adverse_media"
244	  | "fraud_detection";
245	
246	// Operations a capability supports. Today every compliance capability has a
247	// single 'check' operation; widen this when a capability gains more.
248	export const CAPABILITY_OPERATIONS: Record<IntegrationCapability, readonly string[]> = {
249	  sanction_screening: ["check"],
250	  pep: ["check"],
251	  kyc: ["check"],
252	  adverse_media: ["check"],
253	  fraud_detection: ["check"],
254	};
255	export type IntegrationKind = "generic_rest";
256	export type IntegrationEnvironment = "test" | "staging" | "production";
257	
258	export type IntegrationInvocationMode = "sync" | "async";
259	
260	// Sensible per-capability defaults. Slow review-style providers default to
261	// async so the customer isn't blocked behind document review.
262	export const CAPABILITY_DEFAULT_INVOCATION_MODE: Record<IntegrationCapability, IntegrationInvocationMode> = {
263	  sanction_screening: "sync",
264	  pep: "sync",
265	  fraud_detection: "sync",
266	  kyc: "async",
267	  adverse_media: "async",
268	};
269	
270	export interface ExternalIntegration {
271	  id: string;

{"skill":"github-ticket-implementer","args":"Implement gangkharai/sherpa-api#458 \"Credit-check compliance integration\" full-stack across the worktree set. Backend: /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat. Portal: /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat. Plan already mapped: add \"credit_check\" as a new compliance capability reusing the generic external-API-integration + compliance-tab framework (sibling of sanction_screening/pep/kyc/fraud_detection). API edits: register capability in domains/integrations/runner.ts; add to CAPABILITY_ENUM in routes/plus/externalIntegrationsRoutes.ts; new migration to widen ExternalIntegrationCallLogs.capability ENUM('sanction_screening')->VARCHAR(64) (mirrors migration 2026.05.19T00.00.07 which already widened ExternalIntegrations.capability); update _ExternalIntegrationCallLog model + TypeBox schema capability to string. Portal edits: add credit_check to admin.ts IntegrationCapability + CAPABILITY_OPERATIONS + CAPABILITY_DEFAULT_INVOCATION_MODE; ProductCompliancePanel CapabilityKey + CAPABILITY_REGISTRY + useCapabilityText label/blurb; IntegrationsTab CAPABILITIES; capabilityLabel switches in ComplianceChecksSection, SanctionScreeningPanel, policy-management/screening/page; add credit_check output contract to prompts/externalIntegrationSmartSetup.ts. Credit check uses normalized risk-score semantics (0-1, higher=riskier) mirroring fraud_detection so the existing outcome-rule engine works unchanged. Tests in sherpa-test. Then iterative-review skill, browser proof, commit/push."}

Launching skill: github-ticket-implementer

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runner.ts","old_string":"registerCapability({\n  id: 'fraud_detection',\n  label: 'Fraud Detection',\n  operation: 'check',\n  defaultTriggers: ['CLAIM'],\n});","new_string":"registerCapability({\n  id: 'fraud_detection',\n  label: 'Fraud Detection',\n  operation: 'check',\n  defaultTriggers: ['CLAIM'],\n});\nregisterCapability({\n  id: 'credit_check',\n  label: 'Credit Check',\n  operation: 'check',\n  defaultTriggers: ['NEW_BUSINESS', 'RENEWAL'],\n});"}

The file /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runner.ts has been updated successfully. (file state is current in your context — no need to Read it back)

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes/plus/externalIntegrationsRoutes.ts","old_string":"const CAPABILITY_ENUM = [\n  'sanction_screening',\n  'pep',\n  'kyc',\n  'adverse_media',\n  'fraud_detection',\n] as const;","new_string":"const CAPABILITY_ENUM = [\n  'sanction_screening',\n  'pep',\n  'kyc',\n  'adverse_media',\n  'fraud_detection',\n  'credit_check',\n] as const;"}

The file /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes/plus/externalIntegrationsRoutes.ts has been updated successfully. (file state is current in your context — no need to Read it back)

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationCallLog.ts","old_string":"  @Column({\n    type: DataType.ENUM('sanction_screening'),\n    allowNull: false,\n  })\n  declare capability: 'sanction_screening';","new_string":"  @Column({\n    type: DataType.STRING(64),\n    allowNull: false,\n  })\n  declare capability: string;"}

The file /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationCallLog.ts has been updated successfully. (file state is current in your context — no need to Read it back)

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/integration/ExternalIntegrationCallLog.ts","old_string":"    capability: Type.Union(\n      [Type.Literal('sanction_screening')],\n      { description: 'Capability the call was made under.' },\n    ),","new_string":"    capability: Type.String({\n      maxLength: 64,\n      description: 'Capability the call was made under (sanction_screening, kyc, fraud_detection, credit_check, ...).',\n    }),"}

The file /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/integration/ExternalIntegrationCallLog.ts has been updated successfully. (file state is current in your context — no need to Read it back)

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && fd -e ts . src/db/migrations | sort | tail -4","description":"Find latest migration filename for ordering"}

src/db/migrations/2026.05.30T00.00.00.create-payout-category-and-fields.ts
src/db/migrations/2026.05.30T00.00.01.localize-default-checkout-premium-prefix.ts
src/db/migrations/abandonedPolicyStatus.apitest.ts
src/db/migrations/seed/countries-regions-data.ts

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.31T00.00.01.widen-call-log-capability.ts","content":"import { QueryInterface } from 'sequelize';\nimport type { MigrationFn } from 'umzug';\n\n/**\n * Widen `ExternalIntegrationCallLogs.capability` from a frozen\n * `sanction_screening`-only ENUM to VARCHAR(64), matching the sibling\n * `ExternalIntegrations.capability` column that was widened in\n * 2026.05.19T00.00.07. The runner writes the live capability id on every\n * outbound call (see domains/integrations/runtime/audit.ts), so audit rows for\n * any non-sanction capability (kyc, fraud_detection, credit_check, ...) were\n * silently dropped by the ENUM constraint inside writeCallLog's catch. Credit\n * check lands as a new capability and needs its calls logged like the rest.\n */\nexport const up: MigrationFn<QueryInterface> = async ({ context }) => {\n  await context.sequelize.query(`\n    ALTER TABLE \"ExternalIntegrationCallLogs\"\n    ALTER COLUMN capability TYPE VARCHAR(64) USING capability::text;\n  `);\n  await context.sequelize.query(\n    `DROP TYPE IF EXISTS \"enum_ExternalIntegrationCallLogs_capability\";`,\n  );\n};\n\nexport const down: MigrationFn<QueryInterface> = async () => {\n  // Forward-only deployment.\n};\n"}

File created successfully at: /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.31T00.00.01.widen-call-log-capability.ts (file state is current in your context — no need to Read it back)

{"command":"curl -fsS -X POST http://localhost:7777/api/api-action -H 'Content-Type: application/json' -d '{\"path\":\"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat\",\"action\":\"migrate\"}' 2>&1 | head -c 300; echo \" ---migrate kicked---\"","description":"Run new migration via dashboard"}

{"path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat","action":"migrate","status":"running","startedAt":1780263054786,"endedAt":null,"exitCode":null,"error":null,"logPath":"/var/folders/pr/7k4xc3v1715_0zbbw8tgwl5r0000gn/T/worktree-dashboard-logs/sherpa-api-api-458- ---migrate kicked---

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts","old_string":"export type IntegrationCapability =\n  | \"sanction_screening\"\n  | \"pep\"\n  | \"kyc\"\n  | \"adverse_media\"\n  | \"fraud_detection\";\n\n// Operations a capability supports. Today every compliance capability has a\n// single 'check' operation; widen this when a capability gains more.\nexport const CAPABILITY_OPERATIONS: Record<IntegrationCapability, readonly string[]> = {\n  sanction_screening: [\"check\"],\n  pep: [\"check\"],\n  kyc: [\"check\"],\n  adverse_media: [\"check\"],\n  fraud_detection: [\"check\"],\n};","new_string":"export type IntegrationCapability =\n  | \"sanction_screening\"\n  | \"pep\"\n  | \"kyc\"\n  | \"adverse_media\"\n  | \"fraud_detection\"\n  | \"credit_check\";\n\n// Operations a capability supports. Today every compliance capability has a\n// single 'check' operation; widen this when a capability gains more.\nexport const CAPABILITY_OPERATIONS: Record<IntegrationCapability, readonly string[]> = {\n  sanction_screening: [\"check\"],\n  pep: [\"check\"],\n  kyc: [\"check\"],\n  adverse_media: [\"check\"],\n  fraud_detection: [\"check\"],\n  credit_check: [\"check\"],\n};"}

The file /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts has been updated successfully. (file state is current in your context — no need to Read it back)

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts","old_string":"export const CAPABILITY_DEFAULT_INVOCATION_MODE: Record<IntegrationCapability, IntegrationInvocationMode> = {\n  sanction_screening: \"sync\",\n  pep: \"sync\",\n  fraud_detection: \"sync\",\n  kyc: \"async\",\n  adverse_media: \"async\",\n};","new_string":"export const CAPABILITY_DEFAULT_INVOCATION_MODE: Record<IntegrationCapability, IntegrationInvocationMode> = {\n  sanction_screening: \"sync\",\n  pep: \"sync\",\n  fraud_detection: \"sync\",\n  credit_check: \"sync\",\n  kyc: \"async\",\n  adverse_media: \"async\",\n};"}

The file /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts has been updated successfully. (file state is current in your context — no need to Read it back)

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat && rg -n 'lucide-react' app/components/products/ProductCompliancePanel.tsx","description":"Find lucide import line in ProductCompliancePanel"}

19:} from "lucide-react";

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx","offset":1,"limit":20}

1	"use client";
2	
3	import React, { useCallback, useEffect, useState } from "react";
4	
5	import {
6	  Activity,
7	  AlertTriangle,
8	  Check,
9	  Eye,
10	  Loader2,
11	  Lock,
12	  Plus,
13	  ShieldCheck,
14	  Trash2,
15	  UserCheck,
16	  Users,
17	  X,
18	  type LucideIcon,
19	} from "lucide-react";
20	

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx","old_string":"  Activity,\n  AlertTriangle,\n  Check,\n  Eye,","new_string":"  Activity,\n  AlertTriangle,\n  Check,\n  CreditCard,\n  Eye,"}

The file /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx has been updated successfully. (file state is current in your context — no need to Read it back)

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx","old_string":"type CapabilityKey =\n  | \"sanction_screening\"\n  | \"pep\"\n  | \"kyc\"\n  | \"adverse_media\"\n  | \"fraud_detection\";","new_string":"type CapabilityKey =\n  | \"sanction_screening\"\n  | \"pep\"\n  | \"kyc\"\n  | \"adverse_media\"\n  | \"fraud_detection\"\n  | \"credit_check\";"}

The file /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx has been updated successfully. (file state is current in your context — no need to Read it back)

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx","old_string":"  {\n    key: \"fraud_detection\",\n    icon: Activity,\n    defaultTriggers: [\"CLAIM\"],\n    defaultOutcomeRules: {\n      passWhen: { maxScore: 0.5 },\n      failWhen: { minScore: 0.85, onTopics: [\"fraud.high_risk\"] },\n    },\n  },\n];","new_string":"  {\n    key: \"fraud_detection\",\n    icon: Activity,\n    defaultTriggers: [\"CLAIM\"],\n    defaultOutcomeRules: {\n      passWhen: { maxScore: 0.5 },\n      failWhen: { minScore: 0.85, onTopics: [\"fraud.high_risk\"] },\n    },\n  },\n  {\n    key: \"credit_check\",\n    icon: CreditCard,\n    defaultTriggers: [\"NEW_BUSINESS\", \"RENEWAL\"],\n    defaultOutcomeRules: {\n      passWhen: { maxScore: 0.5 },\n      failWhen: { minScore: 0.85, onTopics: [\"credit.high_risk\"] },\n    },\n  },\n];"}

The file /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx has been updated successfully. (file state is current in your context — no need to Read it back)

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx","old_string":"      case \"fraud_detection\":\n        return t(\"Fraud Detection\");\n    }\n  };","new_string":"      case \"fraud_detection\":\n        return t(\"Fraud Detection\");\n      case \"credit_check\":\n        return t(\"Credit Check\");\n    }\n  };"}

The file /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx has been updated successfully. (file state is current in your context — no need to Read it back)

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx","old_string":"      case \"fraud_detection\":\n        return t(\"Score the party / claim for fraud risk via an external bureau. Typically runs at claim creation.\");\n    }\n  };","new_string":"      case \"fraud_detection\":\n        return t(\"Score the party / claim for fraud risk via an external bureau. Typically runs at claim creation.\");\n      case \"credit_check\":\n        return t(\"Score the policyholder's credit risk via an external bureau at new business / renewal. High-risk scores halt the gate for review.\");\n    }\n  };"}

The file /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx has been updated successfully. (file state is current in your context — no need to Read it back)

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/IntegrationsTab.tsx","offset":34,"limit":16}

34	}
35	
36	const CAPABILITIES: IntegrationCapability[] = [
37	  "sanction_screening",
38	  "pep",
39	  "kyc",
40	  "adverse_media",
41	  "fraud_detection",
42	];
43	const KINDS: IntegrationKind[] = ["generic_rest"];
44	const INVOCATION_MODES: IntegrationInvocationMode[] = ["sync", "async"];
45	
46	const IntegrationsTab: React.FC = () => {
47	  const { t } = useLMT();
48	  const [integrations, setIntegrations] = useState<ExternalIntegration[]>([]);
49	  const [loading, setLoading] = useState(false);

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/compliance/ComplianceChecksSection.tsx","offset":73,"limit":24}

73	  // lmt-translate requires literal arguments. Map known capabilities to literal
74	  // calls; unknown ones fall back to the raw slug.
75	  const capabilityLabel = (capability: string | undefined): string => {
76	    switch (capability) {
77	      case "sanction_screening":
78	        return t("Sanction Screening");
79	      case "pep":
80	        return t("PEP");
81	      case "kyc":
82	        return t("KYC");
83	      case "adverse_media":
84	        return t("Adverse Media");
85	      case "fraud_detection":
86	        return t("Fraud Detection");
87	      case undefined:
88	      case "":
89	        return t("Compliance");
90	      default:
91	        return capability;
92	    }
93	  };
94	  const badgeLabel = (row: SanctionScreening): string => {
95	    switch (badgeLabelKey(row)) {
96	      case "approved":

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/screening/SanctionScreeningPanel.tsx","offset":85,"limit":24}

85	  // lmt-translate requires literal arguments; map known capability ids to
86	  // literal calls and fall back to the raw slug for unknown ones.
87	  const capabilityLabel = (capability: string | undefined): string => {
88	    switch (capability) {
89	      case "sanction_screening":
90	        return t("Sanction Screening");
91	      case "pep":
92	        return t("PEP Check");
93	      case "kyc":
94	        return t("KYC Verification");
95	      case "adverse_media":
96	        return t("Adverse Media");
97	      case "fraud_detection":
98	        return t("Fraud Detection");
99	      case undefined:
100	      case "":
101	        return t("Compliance");
102	      default:
103	        return capability;
104	    }
105	  };
106	  const statusLabel = (status: SanctionScreeningStatus): string => {
107	    switch (status) {
108	      case "pending":

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/policy-management/screening/page.tsx","offset":39,"limit":24}

39	  const [selected, setSelected] = useState<string | null>(null);
40	
41	  const capabilityLabel = (capability: string | undefined): string => {
42	    switch (capability) {
43	      case "sanction_screening":
44	        return t("Sanction Screening");
45	      case "pep":
46	        return t("PEP Check");
47	      case "kyc":
48	        return t("KYC Verification");
49	      case "adverse_media":
50	        return t("Adverse Media");
51	      case "fraud_detection":
52	        return t("Fraud Detection");
53	      case undefined:
54	      case "":
55	        return t("Compliance");
56	      default:
57	        return capability;
58	    }
59	  };
60	
61	  const load = useCallback(async () => {
62	    try {

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/IntegrationsTab.tsx","old_string":"const CAPABILITIES: IntegrationCapability[] = [\n  \"sanction_screening\",\n  \"pep\",\n  \"kyc\",\n  \"adverse_media\",\n  \"fraud_detection\",\n];","new_string":"const CAPABILITIES: IntegrationCapability[] = [\n  \"sanction_screening\",\n  \"pep\",\n  \"kyc\",\n  \"adverse_media\",\n  \"fraud_detection\",\n  \"credit_check\",\n];"}

The file /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/IntegrationsTab.tsx has been updated successfully. (file state is current in your context — no need to Read it back)

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/compliance/ComplianceChecksSection.tsx","old_string":"      case \"fraud_detection\":\n        return t(\"Fraud Detection\");\n      case undefined:\n      case \"\":\n        return t(\"Compliance\");","new_string":"      case \"fraud_detection\":\n        return t(\"Fraud Detection\");\n      case \"credit_check\":\n        return t(\"Credit Check\");\n      case undefined:\n      case \"\":\n        return t(\"Compliance\");"}

The file /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/compliance/ComplianceChecksSection.tsx has been updated successfully. (file state is current in your context — no need to Read it back)

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/screening/SanctionScreeningPanel.tsx","old_string":"      case \"fraud_detection\":\n        return t(\"Fraud Detection\");\n      case undefined:\n      case \"\":\n        return t(\"Compliance\");","new_string":"      case \"fraud_detection\":\n        return t(\"Fraud Detection\");\n      case \"credit_check\":\n        return t(\"Credit Check\");\n      case undefined:\n      case \"\":\n        return t(\"Compliance\");"}

The file /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/screening/SanctionScreeningPanel.tsx has been updated successfully. (file state is current in your context — no need to Read it back)

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/policy-management/screening/page.tsx","old_string":"      case \"fraud_detection\":\n        return t(\"Fraud Detection\");\n      case undefined:\n      case \"\":\n        return t(\"Compliance\");","new_string":"      case \"fraud_detection\":\n        return t(\"Fraud Detection\");\n      case \"credit_check\":\n        return t(\"Credit Check\");\n      case undefined:\n      case \"\":\n        return t(\"Compliance\");"}

The file /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/policy-management/screening/page.tsx has been updated successfully. (file state is current in your context — no need to Read it back)

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/externalIntegrationSmartSetup.ts","old_string":"export type IntegrationCapability = \"sanction_screening\";","new_string":"export type IntegrationCapability = \"sanction_screening\" | \"credit_check\";"}

The file /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/externalIntegrationSmartSetup.ts has been updated successfully. (file state is current in your context — no need to Read it back)

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/externalIntegrationSmartSetup.ts","old_string":"The responseMapping field MUST lift the provider's matches array under the\nkey \"matches\". Inbound field mappings then alias each match's provider\nfields onto entityId / entityName / score / topics / datasets / sourceUrl.\n`,\n};","new_string":"The responseMapping field MUST lift the provider's matches array under the\nkey \"matches\". Inbound field mappings then alias each match's provider\nfields onto entityId / entityName / score / topics / datasets / sourceUrl.\n`,\n  credit_check: `\nThe integration runner invokes operation='check' with this typed input shape:\n  {\n    \"parties\": [\n      { \"role\": \"policyholder\" | \"insured\" | \"beneficiary\",\n        \"firstName\": string, \"lastName\": string,\n        \"dateOfBirth\": string | null, \"nationality\": string | null }\n    ]\n  }\nCredit bureaus usually also key on a national identifier / address — map those\nfrom the AVAILABLE DATA MODEL FIELDS in the outbound field mappings.\n\nThe runner reuses the sanction-check result shape: the rendered response MUST\nexpose a 'matches' array whose objects carry at least:\n  { \"entityId\": string, \"entityName\": string, \"score\": number,\n    \"topics\": string[], \"datasets\": string[], \"sourceUrl\": string | null }\n\nCRITICAL — score is a NORMALISED CREDIT-RISK score in [0,1] where HIGHER means\nRISKIER (more likely to be declined), NOT a raw bureau score like FICO 300-850.\nThe outcome engine fails/blocks on HIGH score, so a provider scale where high =\ngood MUST be inverted via a transformation/derived field before it lands on\n'score'. Put the bureau's decision/reason codes (e.g. \"credit.high_risk\",\n\"credit.default\", \"credit.thin_file\") into 'topics', the assessed party's name\ninto 'entityName', and the bureau subject reference into 'entityId'.\n`,\n};"}

The file /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/externalIntegrationSmartSetup.ts has been updated successfully. (file state is current in your context — no need to Read it back)

{"command":"curl -fsS \"http://localhost:7777/api/api-action?path=/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat\" 2>&1 | head -c 500; echo\necho \"=== docker containers (api-related) ===\"; docker ps --format '{{.Names}}\\t{{.Ports}}' 2>&1 | rg -i '458|4006|api' | head","description":"Check migration result + find worktree api container"}

{"path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat","action":"migrate","status":"done","startedAt":1780263054786,"endedAt":1780263055635,"exitCode":0,"error":null,"logPath":"/var/folders/pr/7k4xc3v1715_0zbbw8tgwl5r0000gn/T/worktree-dashboard-logs/sherpa-api-api-458-credit-check-compliance-integrat-migrate.log","tail":"\n> Sherpa [email protected] db:migrate:up\n> tsx src/db/migrate.ts up\n\n{\n  event: 'migrating',\n  name: '2026.05.31T00.00.01.widen-call-log-capabil
=== docker containers (api-related) ===
sherpa-api-api-458-credit-check-compliance-integrat	0.0.0.0:4006->4006/tcp, [::]:4006->4006/tcp
sherpa-api-api-466-passkey-webauthn-login	0.0.0.0:4003->4003/tcp, [::]:4003->4003/tcp
sherpa-api-api-457-custom-additional-fields-on-endo	0.0.0.0:4007->4007/tcp, [::]:4007->4007/tcp
sherpa-api-api-456-outlet-catalog-per-product-outle	0.0.0.0:4001->4001/tcp, [::]:4001->4001/tcp
sherpa-api	0.0.0.0:4000->4000/tcp, [::]:4000->4000/tcp
sherpa-api-customer-support-module-rgebm	0.0.0.0:4005->4005/tcp, [::]:4005->4005/tcp

{"command":"docker exec -T sherpa-api-api-458-credit-check-compliance-integrat npm run type-check 2>&1 | tail -30; echo \"=== api type-check exit: ${PIPESTATUS[0]} ===\"","description":"API type-check inside container"}

unknown shorthand flag: 'T' in -T

Usage:  docker exec [OPTIONS] CONTAINER COMMAND [ARG...]

Run 'docker exec --help' for more information
=== api type-check exit:  ===

{"command":"npx tsc --noEmit 2>&1 | tail -30; echo \"=== portal tsc exit: ${PIPESTATUS[0]} ===\"","description":"Portal tsc --noEmit on host"}

=== portal tsc exit:  ===

{"command":"docker exec sherpa-api-api-458-credit-check-compliance-integrat npm run type-check 2>&1 | tail -30","description":"API type-check inside container"}

{"command":"npx tsc --noEmit 2>&1 | tail -30; echo \"DONE\"","description":"Portal tsc --noEmit"}

> Sherpa [email protected] type-check
> tsc --noEmit

DONE

{"command":"npx eslint app/types/admin.ts app/components/products/ProductCompliancePanel.tsx app/components/admin/IntegrationsTab.tsx app/components/compliance/ComplianceChecksSection.tsx app/components/screening/SanctionScreeningPanel.tsx app/policy-management/screening/page.tsx app/prompts/externalIntegrationSmartSetup.ts 2>&1 | tail -30; echo \"=== eslint done ===\"","description":"Portal eslint on touched files"}

NOT SUPPORTED: option missingRefs. Pass empty schema with $id that should be ignored to ajv.addSchema.

Oops! Something went wrong! :(

ESLint: 9.39.2

TypeError: Cannot set properties of undefined (setting 'defaultMeta')
    at ajvOrig (/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@eslint/eslintrc/dist/eslintrc-universal.cjs:385:27)
    at Object.<anonymous> (/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/@eslint/eslintrc/dist/eslintrc-universal.cjs:740:13)
    at Module._compile (node:internal/modules/cjs/loader:1829:14)
    at Module._extensions..js (node:internal/modules/cjs/loader:1969:10)
    at Module.load (node:internal/modules/cjs/loader:1552:32)
    at Module._load (node:internal/modules/cjs/loader:1354:12)
    at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
    at Module.require (node:internal/modules/cjs/loader:1575:12)
    at require (node:internal/modules/helpers:191:16)
    at Object.<anonymous> (/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/node_modules/eslint/lib/linter/linter.js:25:6)
=== eslint done ===

{"command":"npm run validate-translations 2>&1 | tail -20; echo \"=== validate-translations done ===\"","description":"Portal translation validation"}

  ~ Extra key not in manifest: "Geography & Currency"
  ~ Extra key not in manifest: "Where this product is sold and which currencies it supports."
  ~ Extra key not in manifest: "Stats are based on the most recent 100,000 events. Older events were not loaded — figures may be incomplete for high-volume optimizations."
  ~ Extra key not in manifest: "Showing analytics over the most recent"
  ~ Extra key not in manifest: "events (cap: "
  ~ Extra key not in manifest: "). Older events are not included."
  ~ Extra key not in manifest: "Failed to load screenings"
  ~ Extra key not in manifest: "Sanction Screening Queue"
  ~ Extra key not in manifest: "Pending review and failed screenings. Users with the right permission can approve or reject to unblock the gated PolicyOrder."
  ~ Extra key not in manifest: "Loading screenings..."
  ~ Extra key not in manifest: "No screenings awaiting review."
  ~ Extra key not in manifest: "Select a screening to view details."
  ~ Extra key not in manifest: "View all"
  ~ Extra key not in manifest: "You're all caught up."
  ~ Extra key not in manifest: "Switch Organization"
  ~ Extra key not in manifest: "Supported languages"
  ~ Extra key not in manifest: "Locales this organisation may use across products. Toggle to enable / disable. Backend rejects product configs that reference a disabled locale."
  ~ Extra key not in manifest: "Select at least one language."

Validation passed.
=== validate-translations done ===

{"command":"docker exec sherpa-api-api-458-credit-check-compliance-integrat npm run lint 2>&1 | tail -25; echo \"=== api lint done ===\"","description":"API lint guardrails inside container"}

> Sherpa [email protected] lint
> eslint . && npm run check:imports && npm run check:migrations

NOT SUPPORTED: option missingRefs. Pass empty schema with $id that should be ignored to ajv.addSchema.

Oops! Something went wrong! :(

ESLint: 9.39.2

TypeError: Cannot set properties of undefined (setting 'defaultMeta')
    at ajvOrig (/app/node_modules/@eslint/eslintrc/dist/eslintrc-universal.cjs:385:27)
    at Object.<anonymous> (/app/node_modules/@eslint/eslintrc/dist/eslintrc-universal.cjs:740:13)
    at Module._compile (node:internal/modules/cjs/loader:1730:14)
    at Object..js (node:internal/modules/cjs/loader:1895:10)
    at Module.load (node:internal/modules/cjs/loader:1465:32)
    at Function._load (node:internal/modules/cjs/loader:1282:12)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:235:24)
    at Module.require (node:internal/modules/cjs/loader:1487:12)
    at require (node:internal/modules/helpers:135:16)
=== api lint done ===

{"command":"echo \"=== check:imports ===\"; docker exec sherpa-api-api-458-credit-check-compliance-integrat npm run check:imports 2>&1 | tail -15\necho \"=== check:migrations ===\"; docker exec sherpa-api-api-458-credit-check-compliance-integrat npm run check:migrations 2>&1 | tail -20","description":"Run API structural guardrails directly"}

=== check:imports ===

> Sherpa [email protected] check:imports
> bash scripts/check-internal-imports.sh

=== check:migrations ===

> Sherpa [email protected] check:migrations
> tsx scripts/check-migration-tenant-rls.ts

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat\necho \"=== specs mentioning compliance/screening/integration/capability ===\"; rg -li 'sanction|compliance|screening|external-integration|capability|credit' --glob '*.ts' -l 2>/dev/null | head -20\necho \"=== test dir layout ===\"; fd -t d -d 2 . tests 2>/dev/null | head -20; echo \"---\"; fd -e ts -d 2 . tests 2>/dev/null | head -20\necho \"=== playwright projects ===\"; rg -n \"name:|testMatch|testDir\" playwright.config.ts 2>/dev/null | head -40","description":"Explore sherpa-test layout + existing compliance specs"}

=== specs mentioning compliance/screening/integration/capability ===
tests/plus-insurance/08-compliance-checks.spec.ts
tests/plus-insurance/06-policy-suspension-reinstatement.spec.ts
tests/plus-insurance/05-policy-orders-and-financials.spec.ts
tests/payments/00-stripe-payment-flow.spec.ts
tests/plus-insurance/helpers/ledger-db.ts
=== test dir layout ===
tests/embed-translations/
tests/embed-translations/helpers/
tests/flows/
tests/multi-currency/
tests/multi-currency/helpers/
tests/payments/
tests/payments/helpers/
tests/plus-insurance/
tests/plus-insurance/helpers/
tests/utils/
tests/widget/
---
tests/api-outage-banner.spec.ts
tests/auth.setup.ts
tests/customer-auth.spec.ts
tests/customer-portal-typed-signal.spec.ts
tests/embed-translations/api-overrides.spec.ts
tests/embed-translations/navigation-propagation.spec.ts
tests/embed-translations/persistence.spec.ts
tests/embed-translations/postmessage.spec.ts
tests/embed-translations/snippet-shape.spec.ts
tests/embed-translations/static-ui.spec.ts
tests/embed-translations/url-config.spec.ts
tests/embed-translations/validation.spec.ts
tests/flows/01-sherpa-portal.flow.ts
tests/flows/02-insurance-products.flow.ts
tests/flows/03-quote-creation.flow.ts
tests/insurance-product.spec.ts
tests/multi-currency/00-reset.spec.ts
tests/multi-currency/01-multi-currency.spec.ts
tests/organization-public-session.spec.ts
tests/payments/00-reset-payments-organization.spec.ts
=== playwright projects ===
11:  testDir: './tests',
31:      name: 'plus-insurance',
32:      testMatch: /plus-insurance\/.*\.spec\.ts/,
38:      name: 'embed-translations',
39:      testMatch: /embed-translations\/.*\.spec\.ts/,
50:      name: 'payments',
51:      testMatch: /payments\/.*\.spec\.ts/,
57:      name: 'multi-currency',
58:      testMatch: /multi-currency\/.*\.spec\.ts/,
64:      name: 'widget',
65:      testMatch: /widget\/.*\.spec\.ts/,
71:      name: 'api',
72:      testMatch: /security\.spec\.ts/,
76:      name: 'customer-auth',
77:      testMatch: /customer-auth\.spec\.ts/,
82:      name: 'frontend-security',
83:      testMatch: /security-frontend\.spec\.ts/,
87:      name: 'setup', 
88:      testMatch: /.*\.setup\.ts/,
95:      name: 'chromium',
96:      testMatch: /.*\.spec\.ts/,
106:      name: 'firefox',
107:      testMatch: /.*\.spec\.ts/,
117:      name: 'webkit',
118:      testMatch: /.*\.spec\.ts/,
129:    //   name: 'Mobile Chrome',
133:    //   name: 'Mobile Safari',
139:    //   name: 'Microsoft Edge',
143:    //   name: 'Google Chrome',

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/tests/plus-insurance/08-compliance-checks.spec.ts"}

1	import { test, expect } from '@playwright/test';
2	import { ApiClient } from './helpers/api-client';
3	import { ORGANIZATION_ID } from './helpers/test-data';
4	import { getApiUrl } from '../utils/urls';
5	
6	const API_URL = getApiUrl();
7	const CLIENT_ID = process.env.SHERPA_TEST_CLIENT_ID!;
8	const CLIENT_SECRET = process.env.SHERPA_TEST_CLIENT_SECRET!;
9	
10	/**
11	 * Compliance checks API coverage — capability + parties shape.
12	 *
13	 *  - PUT /products/:id with complianceChecks.{capability:{parties, triggers, ...}}
14	 *  - GET /products/:id reflects the persisted shape
15	 *  - Setting complianceChecks=null removes the configuration
16	 *  - Schema rejects malformed bodies
17	 *  - Multiple capabilities coexist on a single product
18	 *  - CLAIM trigger accepted by the schema
19	 */
20	test.describe.serial('Plus · Product compliance checks', () => {
21	  test.setTimeout(60000);
22	
23	  let productId: number;
24	  let integrationId: string;
25	
26	  test('seed: pick a screening integration + a product', async ({ request }) => {
27	    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);
28	
29	    const integrationsRes = await api.get(`/v1/plus/external-integrations`);
30	    expect(integrationsRes.status()).toBe(200);
31	    const integrations = (await integrationsRes.json()).data ?? [];
32	    let screening = integrations.find(
33	      (i: { capability: string; active: boolean }) =>
34	        i.capability === 'sanction_screening' && i.active,
35	    );
36	    if (!screening) {
37	      const createRes = await api.post('/v1/plus/external-integrations', {
38	        name: 'E2E Sanction Screening',
39	        slug: `e2e-sanction-screening-${Date.now()}`,
40	        capability: 'sanction_screening',
41	        kind: 'generic_rest',
42	        defaultEnvironment: 'test',
43	        active: true,
44	      });
45	      expect(createRes.status()).toBe(201);
46	      screening = (await createRes.json()).data;
47	    }
48	    integrationId = screening.id;
49	
50	    const productsRes = await api.get(`/v1/plus/products?organizationId=${ORGANIZATION_ID}&limit=1`);
51	    expect(productsRes.status()).toBe(200);
52	    const products = (await productsRes.json()).data?.products ?? [];
53	    test.skip(products.length === 0, 'No products in test organization');
54	    productId = products[0].id;
55	  });
56	
57	  test('PUT complianceChecks.sanction_screening — persisted + readable', async ({
58	    request,
59	  }) => {
60	    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);
61	    const config = {
62	      enabled: true,
63	      integrationId,
64	      triggers: ['NEW_BUSINESS', 'RENEWAL'],
65	      parties: {
66	        policyholder: 'personal',
67	        additional: [] as string[],
68	      },
69	      outcomeRules: {
70	        passWhen: { maxScore: 0.5 },
71	        failWhen: { minScore: 0.85, onTopics: ['sanction'] },
72	      },
73	    };
74	
75	    const putRes = await api.put(`/v1/plus/products/${productId}`, {
76	      complianceChecks: { sanction_screening: config },
77	    });
78	    expect(putRes.status()).toBe(200);
79	
80	    const getRes = await api.get(`/v1/plus/products/${productId}`);
81	    expect(getRes.status()).toBe(200);
82	    const body = await getRes.json();
83	    expect(body.data.complianceChecks).toEqual({ sanction_screening: config });
84	  });
85	
86	  test('PUT complianceChecks=null — removes the configuration', async ({ request }) => {
87	    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);
88	
89	    const putRes = await api.put(`/v1/plus/products/${productId}`, {
90	      complianceChecks: null,
91	    });
92	    expect(putRes.status()).toBe(200);
93	
94	    const getRes = await api.get(`/v1/plus/products/${productId}`);
95	    const body = await getRes.json();
96	    expect(body.data.complianceChecks).toBeNull();
97	  });
98	
99	  test('schema rejects malformed shape', async ({ request }) => {
100	    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);
101	    api.expectErrors = true;
102	
103	    // outcomeRules.passWhen.maxScore must be 0..1; 2 is out of range
104	    const res = await api.put(`/v1/plus/products/${productId}`, {
105	      complianceChecks: {
106	        sanction_screening: {
107	          enabled: true,
108	          integrationId,
109	          triggers: ['NEW_BUSINESS'],
110	          parties: {
111	            policyholder: 'personal',
112	            additional: [],
113	          },
114	          outcomeRules: {
115	            passWhen: { maxScore: 2 },
116	            failWhen: { minScore: 0.85, onTopics: ['sanction'] },
117	          },
118	        },
119	      },
120	    });
121	    expect(res.status()).toBe(400);
122	  });
123	
124	  test('schema rejects empty policyholder path', async ({ request }) => {
125	    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);
126	    api.expectErrors = true;
127	
128	    const res = await api.put(`/v1/plus/products/${productId}`, {
129	      complianceChecks: {
130	        sanction_screening: {
131	          enabled: true,
132	          integrationId,
133	          triggers: ['NEW_BUSINESS'],
134	          parties: {
135	            policyholder: '',
136	            additional: [],
137	          },
138	          outcomeRules: {
139	            passWhen: { maxScore: 0.5 },
140	            failWhen: { minScore: 0.85, onTopics: ['sanction'] },
141	          },
142	        },
143	      },
144	    });
145	    expect(res.status()).toBe(400);
146	  });
147	
148	  test('multi-capability round-trip — sanction + kyc share the same product', async ({ request }) => {
149	    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);
150	    const baseConfig = (capability: string, triggers: string[]) => ({
151	      enabled: true,
152	      integrationId,
153	      triggers,
154	      parties: {
155	        policyholder: 'personal',
156	        additional: [] as string[],
157	      },
158	      outcomeRules: {
159	        passWhen: { maxScore: 0.5 },
160	        failWhen: {
161	          minScore: 0.85,
162	          onTopics: capability === 'kyc' ? ['kyc.failed'] : ['sanction'],
163	        },
164	      },
165	    });
166	
167	    const putRes = await api.put(`/v1/plus/products/${productId}`, {
168	      complianceChecks: {
169	        sanction_screening: baseConfig('sanction_screening', ['NEW_BUSINESS', 'RENEWAL']),
170	        kyc: baseConfig('kyc', ['NEW_BUSINESS']),
171	      },
172	    });
173	    expect(putRes.status()).toBe(200);
174	
175	    const getRes = await api.get(`/v1/plus/products/${productId}`);
176	    const body = await getRes.json();
177	    expect(Object.keys(body.data.complianceChecks).sort()).toEqual(['kyc', 'sanction_screening']);
178	    expect(body.data.complianceChecks.kyc.triggers).toEqual(['NEW_BUSINESS']);
179	    expect(body.data.complianceChecks.kyc.parties).toEqual({ policyholder: 'personal', additional: [] });
180	    expect(body.data.complianceChecks.sanction_screening.triggers).toEqual([
181	      'NEW_BUSINESS',
182	      'RENEWAL',
183	    ]);
184	  });
185	
186	  test('CLAIM trigger accepted by schema (fraud_detection at claim time)', async ({ request }) => {
187	    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);
188	    const putRes = await api.put(`/v1/plus/products/${productId}`, {
189	      complianceChecks: {
190	        fraud_detection: {
191	          enabled: false,
192	          integrationId,
193	          triggers: ['CLAIM'],
194	          parties: {
195	            policyholder: 'personal',
196	            additional: [],
197	          },
198	          outcomeRules: {
199	            passWhen: { maxScore: 0.5 },
200	            failWhen: { minScore: 0.85, onTopics: ['fraud.high_risk'] },
201	          },
202	        },
203	      },
204	    });
205	    expect(putRes.status()).toBe(200);
206	
207	    const getRes = await api.get(`/v1/plus/products/${productId}`);
208	    const b

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/tests/plus-insurance/08-compliance-checks.spec.ts","old_string":"  let productId: number;\n  let integrationId: string;","new_string":"  let productId: number;\n  let integrationId: string;\n  let creditIntegrationId: string;"}

The file /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/tests/plus-insurance/08-compliance-checks.spec.ts has been updated successfully. (file state is current in your context — no need to Read it back)

{"replace_all":false,"file_path":"/Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/tests/plus-insurance/08-compliance-checks.spec.ts","old_string":"  test('integration list — sanction_screening capability filter works', async ({ request }) => {\n    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);\n    const res = await api.get(`/v1/plus/external-integrations`);\n    const all = (await res.json()).data ?? [];\n    const filtered = all.filter(\n      (i: { capability: string }) => i.capability === 'sanction_screening',\n    );\n    expect(filtered.length).toBeGreaterThan(0);\n    for (const row of filtered) {\n      expect(row.capability).toBe('sanction_screening');\n    }\n  });\n});","new_string":"  test('integration list — sanction_screening capability filter works', async ({ request }) => {\n    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);\n    const res = await api.get(`/v1/plus/external-integrations`);\n    const all = (await res.json()).data ?? [];\n    const filtered = all.filter(\n      (i: { capability: string }) => i.capability === 'sanction_screening',\n    );\n    expect(filtered.length).toBeGreaterThan(0);\n    for (const row of filtered) {\n      expect(row.capability).toBe('sanction_screening');\n    }\n  });\n\n  test('credit_check capability accepted when creating an integration (provider)', async ({\n    request,\n  }) => {\n    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);\n    const existing = ((await (await api.get('/v1/plus/external-integrations')).json()).data ?? []).find(\n      (i: { capability: string; active: boolean }) => i.capability === 'credit_check' && i.active,\n    );\n    if (existing) {\n      creditIntegrationId = existing.id;\n    } else {\n      const createRes = await api.post('/v1/plus/external-integrations', {\n        name: 'E2E Credit Check',\n        slug: `e2e-credit-check-${Date.now()}`,\n        capability: 'credit_check',\n        kind: 'generic_rest',\n        defaultEnvironment: 'test',\n        active: true,\n      });\n      expect(createRes.status()).toBe(201);\n      const created = (await createRes.json()).data;\n      expect(created.capability).toBe('credit_check');\n      creditIntegrationId = created.id;\n    }\n  });\n\n  test('PUT complianceChecks.credit_check — persisted + readable', async ({ request }) => {\n    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);\n    const config = {\n      enabled: true,\n      integrationId: creditIntegrationId,\n      triggers: ['NEW_BUSINESS', 'RENEWAL'],\n      parties: {\n        policyholder: 'personal',\n        additional: [] as string[],\n      },\n      outcomeRules: {\n        passWhen: { maxScore: 0.5 },\n        failWhen: { minScore: 0.85, onTopics: ['credit.high_risk'] },\n      },\n      autoReject: false,\n    };\n\n    const putRes = await api.put(`/v1/plus/products/${productId}`, {\n      complianceChecks: { credit_check: config },\n    });\n    expect(putRes.status()).toBe(200);\n\n    const getRes = await api.get(`/v1/plus/products/${productId}`);\n    expect(getRes.status()).toBe(200);\n    const body = await getRes.json();\n    expect(body.data.complianceChecks).toEqual({ credit_check: config });\n    expect(body.data.complianceChecks.credit_check.triggers).toEqual(['NEW_BUSINESS', 'RENEWAL']);\n  });\n\n  test('integration list — credit_check capability filter works', async ({ request }) => {\n    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);\n    const res = await api.get(`/v1/plus/external-integrations`);\n    const all = (await res.json()).data ?? [];\n    const filtered = all.filter((i: { capability: string }) => i.capability === 'credit_check');\n    expect(filtered.length).toBeGreaterThan(0);\n    for (const row of filtered) {\n      expect(row.capability).toBe('credit_check');\n    }\n  });\n});"}

The file /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/tests/plus-insurance/08-compliance-checks.spec.ts has been updated successfully. (file state is current in your context — no need to Read it back)

{"skill":"iterative-review","args":"Review the credit_check compliance-integration changes for ticket sherpa-api#458 across three worktrees. Scope = my uncommitted changes only:\n\nAPI (/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat):\n- src/domains/integrations/runner.ts (registered credit_check capability)\n- src/routes/plus/externalIntegrationsRoutes.ts (added credit_check to CAPABILITY_ENUM)\n- src/db/migrations/2026.05.31T00.00.01.widen-call-log-capability.ts (new; widen ExternalIntegrationCallLogs.capability ENUM->VARCHAR(64))\n- src/models/internal/_ExternalIntegrationCallLog.ts (capability column ENUM->STRING(64), type 'sanction_screening'->string)\n- src/schemas/typebox/integration/ExternalIntegrationCallLog.ts (capability Type.Literal union -> Type.String maxLength 64)\n\nPortal (/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat):\n- app/types/admin.ts (IntegrationCapability union + CAPABILITY_OPERATIONS + CAPABILITY_DEFAULT_INVOCATION_MODE add credit_check)\n- app/components/products/ProductCompliancePanel.tsx (CapabilityKey, CAPABILITY_REGISTRY entry, useCapabilityText label+blurb, CreditCard icon import)\n- app/components/admin/IntegrationsTab.tsx (CAPABILITIES add credit_check)\n- app/components/compliance/ComplianceChecksSection.tsx, app/components/screening/SanctionScreeningPanel.tsx, app/policy-management/screening/page.tsx (capabilityLabel switch add credit_check case)\n- app/prompts/externalIntegrationSmartSetup.ts (local IntegrationCapability widen + credit_check output contract)\n\nTest (/Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat):\n- tests/plus-insurance/08-compliance-checks.spec.ts (added credit_check provider-create, product-config round-trip, integration-filter tests)\n\nContext: credit_check is a sibling capability of sanction_screening/pep/kyc/fraud_detection in an already-generic external-API-integration + compliance framework. It uses normalized risk-score semantics (0-1, higher=riskier) like fraud_detection so the existing outcome-rule engine works unchanged. Focus on: correctness of the capability wiring, the migration safety (forward-only, matches precedent migration 2026.05.19T00.00.07), drift/privateFields test impact from the CallLog schema type change, and any spot I missed that still hardcodes the capability list. Note: ESLint is broken in both repos (pre-existing @eslint/eslintrc+ajv module-load crash) — not in scope. tsc passes in both repos and API check:imports/check:migrations pass."}

Launching skill: iterative-review

{"description":"Round 1 API review","subagent_type":"Explore","prompt":"Code review of uncommitted changes in the sherpa-api worktree at /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat. The change adds a new \"credit_check\" compliance capability to an already-generic external-API-integration framework (sibling of sanction_screening/pep/kyc/fraud_detection).\n\nRead the ACTUAL CONTENT of these changed files and verify correctness:\n1. src/domains/integrations/runner.ts — credit_check capability registered via registerCapability (id 'credit_check', label 'Credit Check', operation 'check', defaultTriggers ['NEW_BUSINESS','RENEWAL']).\n2. src/routes/plus/externalIntegrationsRoutes.ts — 'credit_check' added to CAPABILITY_ENUM.\n3. src/db/migrations/2026.05.31T00.00.01.widen-call-log-capability.ts — NEW migration: ALTER ExternalIntegrationCallLogs.capability TYPE VARCHAR(64) USING capability::text, then DROP TYPE IF EXISTS enum_ExternalIntegrationCallLogs_capability. Down is forward-only stub.\n4. src/models/internal/_ExternalIntegrationCallLog.ts — capability column changed from DataType.ENUM('sanction_screening') to DataType.STRING(64); declared type changed from 'sanction_screening' to string.\n5. src/schemas/typebox/integration/ExternalIntegrationCallLog.ts — capability changed from Type.Union([Type.Literal('sanction_screening')]) to Type.String({maxLength:64}).\n\nCHECK SPECIFICALLY:\n- Migration safety: does it mirror the precedent at src/db/migrations/2026.05.19T00.00.07.add-integration-invocation-mode.ts (which widened ExternalIntegrations.capability the same way)? Is the enum type name 'enum_ExternalIntegrationCallLogs_capability' the exact correct Postgres type name created by the original migration src/db/migrations/2026.05.14T00.00.04.create-external-integration-call-logs.ts? Read that original migration to confirm the type name. A wrong type name in DROP TYPE would be silently ignored (IF EXISTS) leaving a dangling type, OR the ALTER could fail.\n- Drift test impact: read src/test/drift.apitest.ts and src/test/privateFields.apitest.ts — does changing the CallLog capability from a literal-union to a string break either (they compare PublicFields to Object.keys(Schema.properties))? Field NAMES are unchanged. Confirm no breakage.\n- Does anything ELSE in src/ still hardcode the capability list in a way that would EXCLUDE credit_check at runtime (e.g. another enum, a switch, a validation array, the sanctionScreeningService, runCheck, policyIssuanceService)? Search for 'sanction_screening' literals and capability arrays. The framework is supposed to be generic — find any remaining choke point that would reject or mishandle credit_check.\n- Correctness: is credit_check's risk-score semantics (high score = bad) compatible with the outcome engine (passWhen.maxScore / failWhen.minScore)? Read src/domains/integrations/capabilities/runCheck.ts and the outcome-rule logic.\n- Type consistency: does the model's `declare capability: string` still satisfy all call sites (audit.ts buildCallLog passes capability: string already)?\n\nReport findings as HIGH (runtime failure), MEDIUM (type error/logic bug), LOW (cleanup), each with exact file:line. If clean, state explicitly \"NO REMAINING HIGH OR MEDIUM ISSUES\". Read real file content; do not guess."}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runner.ts"}

1	import crypto from 'node:crypto';
2	import { StatusError } from '@/error/error.js';
3	import { ExternalIntegration } from '@/models/ExternalIntegration.js';
4	import type { _ExternalIntegration } from '@/models/ExternalIntegration.js';
5	import { ExternalIntegrationEnvironment } from '@/models/ExternalIntegrationEnvironment.js';
6	import type { _ExternalIntegrationEnvironment } from '@/models/ExternalIntegrationEnvironment.js';
7	import { ExternalIntegrationAuthConfig } from '@/models/ExternalIntegrationAuthConfig.js';
8	import type { _ExternalIntegrationAuthConfig } from '@/models/ExternalIntegrationAuthConfig.js';
9	import { getKind, registerKind } from './kinds/registry.js';
10	import { genericRestAdapter } from './kinds/genericRest/adapter.js';
11	import { registerCapability, type CapabilityId } from './capabilities/registry.js';
12	
13	// Boot the runtime registries once at module load.
14	registerKind('generic_rest', genericRestAdapter);
15	registerCapability({
16	  id: 'sanction_screening',
17	  label: 'Sanction Screening',
18	  operation: 'check',
19	  defaultTriggers: ['NEW_BUSINESS', 'RENEWAL'],
20	});
21	registerCapability({
22	  id: 'pep',
23	  label: 'PEP Check',
24	  operation: 'check',
25	  defaultTriggers: ['NEW_BUSINESS', 'RENEWAL'],
26	});
27	registerCapability({
28	  id: 'kyc',
29	  label: 'KYC Verification',
30	  operation: 'check',
31	  defaultTriggers: ['NEW_BUSINESS'],
32	});
33	registerCapability({
34	  id: 'adverse_media',
35	  label: 'Adverse Media',
36	  operation: 'check',
37	  defaultTriggers: ['NEW_BUSINESS', 'RENEWAL'],
38	});
39	registerCapability({
40	  id: 'fraud_detection',
41	  label: 'Fraud Detection',
42	  operation: 'check',
43	  defaultTriggers: ['CLAIM'],
44	});
45	registerCapability({
46	  id: 'credit_check',
47	  label: 'Credit Check',
48	  operation: 'check',
49	  defaultTriggers: ['NEW_BUSINESS', 'RENEWAL'],
50	});
51	
52	export interface InvokeArgs {
53	  organizationId: string;
54	  capability: CapabilityId;
55	  operation: string;
56	  input: Record<string, unknown>;
57	  environmentOverride?: 'test' | 'staging' | 'production';
58	  correlationId?: string;
59	  integrationSlug?: string;
60	}
61	
62	export interface InvokeRunnerResult {
63	  integrationId: string;
64	  integrationSlug: string;
65	  output: Record<string, unknown>;
66	  httpStatus: number | null;
67	  durationMs: number;
68	  attempts: number;
69	  rawResponseBody: unknown;
70	  correlationId: string;
71	}
72	
73	async function resolveIntegration(args: InvokeArgs): Promise<_ExternalIntegration> {
74	  const where: Record<string, unknown> = {
75	    capability: args.capability,
76	    active: true,
77	  };
78	  if (args.integrationSlug) where.slug = args.integrationSlug;
79	
80	  const candidates = await ExternalIntegration.findAll(
81	    { organizationId: args.organizationId },
82	    {
83	      where,
84	      order: [['createdAt', 'ASC']],
85	    },
86	  );
87	  if (candidates.length === 0) {
88	    throw new StatusError(
89	      404,
90	      `No active ExternalIntegration for capability ${args.capability} (org ${args.organizationId})`,
91	    );
92	  }
93	  if (candidates.length > 1 && !args.integrationSlug) {
94	    throw new StatusError(
95	      409,
96	      `Multiple active integrations for capability ${args.capability}; pass integrationSlug to disambiguate`,
97	    );
98	  }
99	  return candidates[0];
100	}
101	
102	async function resolveEnvironment(
103	  integration: _ExternalIntegration,
104	  override: 'test' | 'staging' | 'production' | undefined,
105	): Promise<_ExternalIntegrationEnvironment> {
106	  const environment = override ?? integration.defaultEnvironment;
107	  const env = await ExternalIntegrationEnvironment.findOne(
108	    { organizationId: integration.organizationId },
109	    { where: { integrationId: integration.id, environment } },
110	  );
111	  if (!env) {
112	    throw new StatusError(
113	      404,
114	      `Integration ${integration.slug} has no environment ${environment}`,
115	    );
116	  }
117	  return env;
118	}
119	
120	async function resolveAuthConfig(
121	  env: _ExternalIntegrationEnvironment,
122	  organizationId: string,
123	): Promise<_ExternalIntegrationAuthConfig> {
124	  const config = await ExternalIntegrationAuthConfig.findOne(
125	    { organizationId },
126	    {
127	      where: { environmentId: env.id, active: true },
128	      order: [['createdAt', 'DESC']],
129	    },
130	  );
131	  if (!config) {
132	    throw new StatusError(400, `Environment ${env.id} has no active auth config`);
133	  }
134	  return config;
135	}
136	
137	// Execute a capability operation against the integration configured for the
138	// caller's organisation. Returns mapped output + raw response.
139	export async function invoke(args: InvokeArgs): Promise<InvokeRunnerResult> {
140	  const integration = await resolveIntegration(args);
141	  const environment = await resolveEnvironment(integration, args.environmentOverride);
142	  const authConfig = await resolveAuthConfig(environment, integration.organizationId);
143	  const adapter = getKind(integration.kind);
144	  const correlationId = args.correlationId ?? crypto.randomUUID();
145	
146	  const result = await adapter({
147	    integration,
148	    environment,
149	    authConfig,
150	    operation: args.operation,
151	    input: args.input,
152	    correlationId,
153	  });
154	
155	  return {
156	    integrationId: integration.id,
157	    integrationSlug: integration.slug,
158	    output: result.output,
159	    httpStatus: result.httpStatus,
160	    durationMs: result.durationMs,
161	    attempts: result.attempts,
162	    rawResponseBody: result.rawResponseBody,
163	    correlationId,
164	  };
165	}
166	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes/plus/externalIntegrationsRoutes.ts"}

1	import type { FastifyInstance, FastifyPluginAsync } from 'fastify';
2	import { Type } from '@sinclair/typebox';
3	import {
4	  listExternalIntegrations,
5	  getExternalIntegrationById,
6	  createExternalIntegration,
7	  updateExternalIntegration,
8	  deleteExternalIntegration,
9	  listEnvironments,
10	  createEnvironment,
11	  updateEnvironment,
12	  deleteEnvironment,
13	  listAuthConfigs,
14	  createAuthConfig,
15	  updateAuthConfig,
16	  deleteAuthConfig,
17	  listCallLogs,
18	  type CreateExternalIntegrationBody,
19	  type CreateEnvironmentBody,
20	  type CreateAuthConfigBody,
21	} from '@/controllers/externalIntegrationController.js';
22	import {
23	  listRequestTemplates,
24	  createRequestTemplate,
25	  updateRequestTemplate,
26	  deleteRequestTemplate,
27	  testIntegration,
28	  type CreateRequestTemplateBody,
29	  type TestIntegrationBody,
30	} from '@/controllers/externalIntegrationRequestTemplateController.js';
31	import {
32	  listFieldMappings,
33	  createFieldMapping,
34	  updateFieldMapping,
35	  deleteFieldMapping,
36	  bulkReplaceFieldMappings,
37	  type CreateFieldMappingBody,
38	  type BulkReplaceFieldMappingsBody,
39	} from '@/controllers/externalIntegrationFieldMappingController.js';
40	import { PERMISSIONS } from '@/types/permissions.js';
41	
42	const ENVIRONMENT_ENUM = ['test', 'staging', 'production'] as const;
43	const CAPABILITY_ENUM = [
44	  'sanction_screening',
45	  'pep',
46	  'kyc',
47	  'adverse_media',
48	  'fraud_detection',
49	  'credit_check',
50	] as const;
51	const KIND_ENUM = ['generic_rest'] as const;
52	const INVOCATION_MODE_ENUM = ['sync', 'async'] as const;
53	const AUTH_TYPE_ENUM = [
54	  'client_credentials',
55	  'username_password',
56	  'api_key',
57	  'basic_auth',
58	  'oauth2_code',
59	  'custom',
60	] as const;
61	const TOKEN_TYPE_ENUM = ['bearer', 'basic', 'custom'] as const;
62	const HTTP_METHOD_ENUM = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'] as const;
63	
64	const retryPolicySchema = {
65	  type: ['object', 'null'],
66	  required: ['attempts', 'initialDelayMs', 'backoffMultiplier', 'maxDelayMs', 'retryOnStatuses'],
67	  additionalProperties: true,
68	  properties: {
69	    attempts: { type: 'integer', minimum: 1, maximum: 10 },
70	    initialDelayMs: { type: 'integer', minimum: 0, maximum: 60000 },
71	    backoffMultiplier: { type: 'number', minimum: 1, maximum: 10 },
72	    maxDelayMs: { type: 'integer', minimum: 0, maximum: 60000 },
73	    retryOnStatuses: {
74	      type: 'array',
75	      items: { type: 'integer', minimum: 100, maximum: 599 },
76	    },
77	  },
78	} as const;
79	
80	const requestTemplateCreateSchema = {
81	  type: 'object',
82	  required: [
83	    'integrationId',
84	    'operation',
85	    'httpMethod',
86	    'urlTemplate',
87	    'requestHeadersTemplate',
88	    'requestBodyTemplate',
89	    'responseMapping',
90	    'errorMapping',
91	    'timeoutMs',
92	    'retryPolicy',
93	  ],
94	  additionalProperties: false,
95	  properties: {
96	    integrationId: { type: 'string', format: 'uuid' },
97	    operation: { type: 'string', minLength: 1, maxLength: 100 },
98	    httpMethod: { type: 'string', enum: [...HTTP_METHOD_ENUM] },
99	    urlTemplate: { type: 'string', minLength: 1, maxLength: 1000 },
100	    requestHeadersTemplate: { type: ['object', 'null'], additionalProperties: { type: 'string' } },
101	    requestBodyTemplate: { type: ['object', 'null'], additionalProperties: true },
102	    responseMapping: { type: 'object', additionalProperties: { type: 'string' } },
103	    errorMapping: { type: ['object', 'null'], additionalProperties: { type: 'string' } },
104	    timeoutMs: { type: 'integer', minimum: 100, maximum: 120000 },
105	    retryPolicy: retryPolicySchema,
106	  },
107	} as const;
108	
109	const requestTemplateUpdateSchema = {
110	  type: 'object',
111	  additionalProperties: false,
112	  properties: {
113	    operation: { type: 'string', minLength: 1, maxLength: 100 },
114	    httpMethod: { type: 'string', enum: [...HTTP_METHOD_ENUM] },
115	    urlTemplate: { type: 'string', minLength: 1, maxLength: 1000 },
116	    requestHeadersTemplate: { type: ['object', 'null'], additionalProperties: { type: 'string' } },
117	    requestBodyTemplate: { type: ['object', 'null'], additionalProperties: true },
118	    responseMapping: { type: 'object', additionalProperties: { type: 'string' } },
119	    errorMapping: { type: ['object', 'null'], additionalProperties: { type: 'string' } },
120	    timeoutMs: { type: 'integer', minimum: 100, maximum: 120000 },
121	    retryPolicy: retryPolicySchema,
122	  },
123	} as const;
124	
125	const testIntegrationSchema = {
126	  type: 'object',
127	  required: ['operation', 'input', 'environment'],
128	  additionalProperties: false,
129	  properties: {
130	    operation: { type: 'string', minLength: 1, maxLength: 100 },
131	    input: { type: 'object', additionalProperties: true },
132	    environment: { type: ['string', 'null'], enum: [...ENVIRONMENT_ENUM, null] },
133	  },
134	} as const;
135	
136	const integrationCreateSchema = {
137	  type: 'object',
138	  required: ['name', 'slug', 'capability', 'kind', 'defaultEnvironment', 'active'],
139	  additionalProperties: false,
140	  properties: {
141	    name: { type: 'string', minLength: 1, maxLength: 255 },
142	    slug: { type: 'string', minLength: 1, maxLength: 100, pattern: '^[a-z0-9][a-z0-9-]*$' },
143	    capability: { type: 'string', enum: [...CAPABILITY_ENUM] },
144	    kind: { type: 'string', enum: [...KIND_ENUM] },
145	    defaultEnvironment: { type: 'string', enum: [...ENVIRONMENT_ENUM] },
146	    active: { type: 'boolean' },
147	    invocationMode: { type: 'string', enum: [...INVOCATION_MODE_ENUM] },
148	    syncTimeoutMs: { type: 'integer', minimum: 100, maximum: 60000 },
149	  },
150	} as const;
151	
152	const integrationUpdateSchema = {
153	  type: 'object',
154	  additionalProperties: false,
155	  properties: {
156	    name: { type: 'string', minLength: 1, maxLength: 255 },
157	    slug: { type: 'string', minLength: 1, maxLength: 100, pattern: '^[a-z0-9][a-z0-9-]*$' },
158	    capability: { type: 'string', enum: [...CAPABILITY_ENUM] },
159	    kind: { type: 'string', enum: [...KIND_ENUM] },
160	    defaultEnvironment: { type: 'string', enum: [...ENVIRONMENT_ENUM] },
161	    active: { type: 'boolean' },
162	    invocationMode: { type: 'string', enum: [...INVOCATION_MODE_ENUM] },
163	    syncTimeoutMs: { type: 'integer', minimum: 100, maximum: 60000 },
164	  },
165	} as const;
166	
167	const environmentCreateSchema = {
168	  type: 'object',
169	  required: ['integrationId', 'environment', 'baseUrl', 'authEndpoint', 'tokenEndpoint'],
170	  additionalProperties: false,
171	  properties: {
172	    integrationId: { type: 'string', format: 'uuid' },
173	    environment: { type: 'string', enum: [...ENVIRONMENT_ENUM] },
174	    baseUrl: { type: 'string', minLength: 1, maxLength: 500, format: 'uri' },
175	    authEndpoint: { type: ['string', 'null'], maxLength: 500 },
176	    tokenEndpoint: { type: ['string', 'null'], maxLength: 500 },
177	  },
178	} as const;
179	
180	const environmentUpdateSchema = {
181	  type: 'object',
182	  additionalProperties: false,
183	  properties: {
184	    environment: { type: 'string', enum: [...ENVIRONMENT_ENUM] },
185	    baseUrl: { type: 'string', minLength: 1, maxLength: 500, format: 'uri' },
186	    authEndpoint: { type: ['string', 'null'], maxLength: 500 },
187	    tokenEndpoint: { type: ['string', 'null'], maxLength: 500 },
188	  },
189	} as const;
190	
191	const authConfigCreateSchema = {
192	  type: 'object',
193	  required: ['environmentId', 'authType', 'tokenType', 'authorizationHeaderFormat', 'active'],
194	  additionalProperties: false,
195	  properties: {
196	    environmentId: { type: 'string', format: 'uuid' },
197	    authType: { type: 'string', enum: [...AUTH_TYPE_ENUM] },
198	    tokenType: { type: 'string', enum: [...TOKEN_TYPE_ENUM] },
199	    authorizationHeaderFormat: { type: 'string', minLength: 1, maxLength: 255 },
200	    

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.31T00.00.01.widen-call-log-capability.ts"}

1	import { QueryInterface } from 'sequelize';
2	import type { MigrationFn } from 'umzug';
3	
4	/**
5	 * Widen `ExternalIntegrationCallLogs.capability` from a frozen
6	 * `sanction_screening`-only ENUM to VARCHAR(64), matching the sibling
7	 * `ExternalIntegrations.capability` column that was widened in
8	 * 2026.05.19T00.00.07. The runner writes the live capability id on every
9	 * outbound call (see domains/integrations/runtime/audit.ts), so audit rows for
10	 * any non-sanction capability (kyc, fraud_detection, credit_check, ...) were
11	 * silently dropped by the ENUM constraint inside writeCallLog's catch. Credit
12	 * check lands as a new capability and needs its calls logged like the rest.
13	 */
14	export const up: MigrationFn<QueryInterface> = async ({ context }) => {
15	  await context.sequelize.query(`
16	    ALTER TABLE "ExternalIntegrationCallLogs"
17	    ALTER COLUMN capability TYPE VARCHAR(64) USING capability::text;
18	  `);
19	  await context.sequelize.query(
20	    `DROP TYPE IF EXISTS "enum_ExternalIntegrationCallLogs_capability";`,
21	  );
22	};
23	
24	export const down: MigrationFn<QueryInterface> = async () => {
25	  // Forward-only deployment.
26	};
27	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationCallLog.ts"}

1	import { Table, Column, Model, DataType, ForeignKey, BelongsTo } from 'sequelize-typescript';
2	import { _ExternalIntegration } from './_ExternalIntegration.js';
3	import { Organization } from '../Organization.js';
4	
5	export type ExternalIntegrationCallStatus = 'success' | 'error' | 'timeout' | 'circuit_open';
6	
7	@Table({
8	  modelName: 'ExternalIntegrationCallLog',
9	  timestamps: false,
10	  indexes: [
11	    {
12	      fields: ['integrationId', 'createdAt'],
13	      name: 'idx_external_integration_call_log_integration_created',
14	    },
15	    {
16	      fields: ['organizationId', 'createdAt'],
17	      name: 'idx_external_integration_call_log_org_created',
18	    },
19	    {
20	      fields: ['correlationId'],
21	      name: 'idx_external_integration_call_log_correlation_id',
22	    },
23	  ],
24	})
25	export class _ExternalIntegrationCallLog extends Model {
26	  @Column({
27	    type: DataType.UUID,
28	    defaultValue: DataType.UUIDV4,
29	    primaryKey: true,
30	  })
31	  declare id: string;
32	
33	  @ForeignKey(() => _ExternalIntegration)
34	  @Column({
35	    type: DataType.UUID,
36	    allowNull: false,
37	  })
38	  declare integrationId: string;
39	
40	  @ForeignKey(() => Organization)
41	  @Column({
42	    type: DataType.UUID,
43	    allowNull: false,
44	  })
45	  declare organizationId: string;
46	
47	  @Column({
48	    type: DataType.STRING(64),
49	    allowNull: false,
50	  })
51	  declare capability: string;
52	
53	  @Column({
54	    type: DataType.STRING(100),
55	    allowNull: false,
56	  })
57	  declare operation: string;
58	
59	  @Column({
60	    type: DataType.STRING(100),
61	    allowNull: false,
62	  })
63	  declare correlationId: string;
64	
65	  @Column({
66	    type: DataType.ENUM('success', 'error', 'timeout', 'circuit_open'),
67	    allowNull: false,
68	  })
69	  declare status: ExternalIntegrationCallStatus;
70	
71	  @Column({
72	    type: DataType.INTEGER,
73	    allowNull: true,
74	  })
75	  declare httpStatus: number | null;
76	
77	  @Column({
78	    type: DataType.INTEGER,
79	    allowNull: false,
80	  })
81	  declare durationMs: number;
82	
83	  @Column({
84	    type: DataType.INTEGER,
85	    allowNull: false,
86	    defaultValue: 1,
87	  })
88	  declare attempts: number;
89	
90	  @Column({
91	    type: DataType.JSONB,
92	    allowNull: true,
93	  })
94	  declare requestExcerpt: Record<string, unknown> | null;
95	
96	  @Column({
97	    type: DataType.JSONB,
98	    allowNull: true,
99	  })
100	  declare responseExcerpt: Record<string, unknown> | null;
101	
102	  @Column({
103	    type: DataType.TEXT,
104	    allowNull: true,
105	  })
106	  declare errorMessage: string | null;
107	
108	  @Column({
109	    type: DataType.DATE,
110	    allowNull: false,
111	  })
112	  declare createdAt: Date;
113	
114	  @BelongsTo(() => _ExternalIntegration, { foreignKey: 'integrationId', as: 'integration' })
115	  declare integration?: _ExternalIntegration;
116	}
117	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/integration/ExternalIntegrationCallLog.ts"}

1	import { Type, type Static } from '@sinclair/typebox';
2	import { Uuid, IsoDateTime, NullableInteger, NullableString } from '../_helpers.js';
3	
4	export const ExternalIntegrationCallLogPublicFields = [
5	  'id',
6	  'integrationId',
7	  'organizationId',
8	  'capability',
9	  'operation',
10	  'correlationId',
11	  'status',
12	  'httpStatus',
13	  'durationMs',
14	  'attempts',
15	  'requestExcerpt',
16	  'responseExcerpt',
17	  'errorMessage',
18	  'createdAt',
19	] as const;
20	
21	export const ExternalIntegrationCallLogPrivateFields = [] as const;
22	
23	export const ExternalIntegrationCallLogSchema = Type.Object(
24	  {
25	    id: Uuid({ description: 'Call log UUID.' }),
26	    integrationId: Uuid({ description: 'ExternalIntegration that produced the call.' }),
27	    organizationId: Uuid({ description: 'Owning organisation.' }),
28	    capability: Type.String({
29	      maxLength: 64,
30	      description: 'Capability the call was made under (sanction_screening, kyc, fraud_detection, credit_check, ...).',
31	    }),
32	    operation: Type.String({
33	      maxLength: 100,
34	      description: 'Capability-defined opcode (e.g. "screen").',
35	    }),
36	    correlationId: Type.String({
37	      maxLength: 100,
38	      description: 'Correlation ID propagated as X-Correlation-Id; links Sherpa request to provider call.',
39	    }),
40	    status: Type.Union(
41	      [
42	        Type.Literal('success'),
43	        Type.Literal('error'),
44	        Type.Literal('timeout'),
45	        Type.Literal('circuit_open'),
46	      ],
47	      { description: 'Final disposition of the call.' },
48	    ),
49	    httpStatus: NullableInteger({
50	      minimum: 100,
51	      maximum: 599,
52	      description: 'HTTP status code if the call reached the network.',
53	    }),
54	    durationMs: Type.Integer({ minimum: 0, description: 'Total wall-clock duration of the call attempt.' }),
55	    attempts: Type.Integer({ minimum: 1, description: 'How many attempts were made before terminal status.' }),
56	    requestExcerpt: Type.Union(
57	      [Type.Object({}, { additionalProperties: true }), Type.Null()],
58	      { description: 'Redacted excerpt of the request (truncated to 8KB).' },
59	    ),
60	    responseExcerpt: Type.Union(
61	      [Type.Object({}, { additionalProperties: true }), Type.Null()],
62	      { description: 'Redacted excerpt of the response (truncated to 8KB).' },
63	    ),
64	    errorMessage: NullableString({ description: 'Final error message if status != success.' }),
65	    createdAt: IsoDateTime({ description: 'Timestamp when the call was made.' }),
66	  },
67	  {
68	    $id: 'ExternalIntegrationCallLog',
69	    additionalProperties: true,
70	    description:
71	      'Per-call audit log for outbound calls made by the integration runner. Bodies are redacted and truncated.',
72	  },
73	);
74	
75	export type ExternalIntegrationCallLog = Static<typeof ExternalIntegrationCallLogSchema>;
76	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.14T00.00.04.create-external-integration-call-logs.ts"}

1	import { DataTypes, type QueryInterface } from 'sequelize';
2	import type { MigrationFn } from 'umzug';
3	
4	/**
5	 * ExternalIntegrationCallLogs — per-call audit trail for outbound calls made by
6	 * the integration runner. Used by the admin "Recent calls" panel and for
7	 * post-mortem debugging. Bodies are stored excerpted+redacted.
8	 */
9	export const up: MigrationFn<QueryInterface> = async ({ context }) => {
10	  await context.sequelize.query(`
11	    DO $$
12	    BEGIN
13	      IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'enum_ExternalIntegrationCallLogs_status') THEN
14	        CREATE TYPE "enum_ExternalIntegrationCallLogs_status" AS ENUM ('success', 'error', 'timeout', 'circuit_open');
15	      END IF;
16	    END
17	    $$;
18	  `);
19	
20	  await context.createTable('ExternalIntegrationCallLogs', {
21	    id: {
22	      type: DataTypes.UUID,
23	      defaultValue: DataTypes.UUIDV4,
24	      primaryKey: true,
25	      allowNull: false,
26	    },
27	    integrationId: {
28	      type: DataTypes.UUID,
29	      allowNull: false,
30	      references: { model: 'ExternalIntegrations', key: 'id' },
31	      onUpdate: 'CASCADE',
32	      onDelete: 'CASCADE',
33	    },
34	    organizationId: {
35	      type: DataTypes.UUID,
36	      allowNull: false,
37	      references: { model: 'Organizations', key: 'id' },
38	      onUpdate: 'CASCADE',
39	      onDelete: 'CASCADE',
40	    },
41	    capability: {
42	      type: DataTypes.ENUM('sanction_screening'),
43	      allowNull: false,
44	    },
45	    operation: {
46	      type: DataTypes.STRING(100),
47	      allowNull: false,
48	    },
49	    correlationId: {
50	      type: DataTypes.STRING(100),
51	      allowNull: false,
52	    },
53	    status: {
54	      type: DataTypes.ENUM('success', 'error', 'timeout', 'circuit_open'),
55	      allowNull: false,
56	    },
57	    httpStatus: {
58	      type: DataTypes.INTEGER,
59	      allowNull: true,
60	    },
61	    durationMs: {
62	      type: DataTypes.INTEGER,
63	      allowNull: false,
64	    },
65	    attempts: {
66	      type: DataTypes.INTEGER,
67	      allowNull: false,
68	      defaultValue: 1,
69	    },
70	    requestExcerpt: {
71	      type: DataTypes.JSONB,
72	      allowNull: true,
73	    },
74	    responseExcerpt: {
75	      type: DataTypes.JSONB,
76	      allowNull: true,
77	    },
78	    errorMessage: {
79	      type: DataTypes.TEXT,
80	      allowNull: true,
81	    },
82	    createdAt: {
83	      type: DataTypes.DATE,
84	      allowNull: false,
85	      defaultValue: context.sequelize.literal('CURRENT_TIMESTAMP'),
86	    },
87	  });
88	
89	  await context.addIndex('ExternalIntegrationCallLogs', {
90	    fields: ['integrationId', 'createdAt'],
91	    name: 'idx_external_integration_call_log_integration_created',
92	  });
93	
94	  await context.addIndex('ExternalIntegrationCallLogs', {
95	    fields: ['organizationId', 'createdAt'],
96	    name: 'idx_external_integration_call_log_org_created',
97	  });
98	
99	  await context.addIndex('ExternalIntegrationCallLogs', {
100	    fields: ['correlationId'],
101	    name: 'idx_external_integration_call_log_correlation_id',
102	  });
103	
104	  // RLS — tenant isolation. Permissive when GUC unset (db/AGENTS.md template).
105	  await context.sequelize.query(`ALTER TABLE "ExternalIntegrationCallLogs" ENABLE ROW LEVEL SECURITY`);
106	  await context.sequelize.query(`ALTER TABLE "ExternalIntegrationCallLogs" FORCE ROW LEVEL SECURITY`);
107	  await context.sequelize.query(`DROP POLICY IF EXISTS tenant_isolation ON "ExternalIntegrationCallLogs"`);
108	  await context.sequelize.query(`
109	    CREATE POLICY tenant_isolation ON "ExternalIntegrationCallLogs"
110	      FOR ALL
111	      USING (
112	        NULLIF(current_setting('app.current_organization', true), '') IS NULL
113	        OR "organizationId" = NULLIF(current_setting('app.current_organization', true), '')::uuid
114	      )
115	  `);
116	  await context.sequelize.query(`GRANT SELECT ON "ExternalIntegrationCallLogs" TO dashboard_user`);
117	};
118	
119	export const down: MigrationFn<QueryInterface> = async () => {
120	  // Down migration not implemented - forward-only deployment
121	};
122	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.07.add-integration-invocation-mode.ts"}

1	import { QueryInterface } from 'sequelize';
2	import type { MigrationFn } from 'umzug';
3	
4	/**
5	 * Add per-integration `invocationMode` (sync | async) and `syncTimeoutMs`
6	 * so admins can pick how the compliance gate invokes each provider.
7	 *
8	 * Defaults are derived from the capability: APIs that resolve in <1s
9	 * (sanction screening, PEP, fraud detection) default to `sync` so the
10	 * customer's payment step sees the outcome immediately. Slower review-style
11	 * capabilities (KYC, adverse media) default to `async`, parking the policy
12	 * in compliance_pending until the worker completes.
13	 *
14	 * Also widens the `capability` column from a frozen `sanction_screening`-only
15	 * ENUM to STRING(64) so new capabilities can land without a migration.
16	 */
17	export const up: MigrationFn<QueryInterface> = async ({ context }) => {
18	  await context.sequelize.query(`
19	    ALTER TABLE "ExternalIntegrations"
20	    ALTER COLUMN capability TYPE VARCHAR(64) USING capability::text;
21	  `);
22	  await context.sequelize.query(`DROP TYPE IF EXISTS "enum_ExternalIntegrations_capability";`);
23	
24	  await context.sequelize.query(`
25	    DO $$
26	    BEGIN
27	      IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'enum_ExternalIntegrations_invocationMode') THEN
28	        CREATE TYPE "enum_ExternalIntegrations_invocationMode" AS ENUM ('sync', 'async');
29	      END IF;
30	    END $$;
31	  `);
32	  await context.sequelize.query(`
33	    ALTER TABLE "ExternalIntegrations"
34	    ADD COLUMN IF NOT EXISTS "invocationMode" "enum_ExternalIntegrations_invocationMode"
35	      NOT NULL DEFAULT 'sync';
36	  `);
37	  await context.sequelize.query(`
38	    ALTER TABLE "ExternalIntegrations"
39	    ADD COLUMN IF NOT EXISTS "syncTimeoutMs" INTEGER NOT NULL DEFAULT 5000;
40	  `);
41	
42	  await context.sequelize.query(`
43	    UPDATE "ExternalIntegrations"
44	    SET "invocationMode" = 'async'
45	    WHERE capability IN ('kyc', 'adverse_media');
46	  `);
47	
48	  await context.sequelize.query(`
49	    ALTER TABLE "PolicyOrders"
50	    ADD COLUMN IF NOT EXISTS "setupIntentRef" VARCHAR(255);
51	  `);
52	  await context.sequelize.query(`
53	    ALTER TABLE "PolicyOrders"
54	    ADD COLUMN IF NOT EXISTS "paymentCustomerRef" VARCHAR(255);
55	  `);
56	};
57	
58	export const down: MigrationFn<QueryInterface> = async () => {
59	  // Forward-only deployment.
60	};
61	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/test/drift.apitest.ts"}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/test/privateFields.apitest.ts"}

1	/**
2	 * PrivateFields enforcement guard.
3	 *
4	 * Every entity Schema in src/schemas/typebox/<bucket>/<Entity>.ts has
5	 * `additionalProperties: true`, so fast-json-stringify does NOT strip
6	 * fields listed in `<Entity>PrivateFields`. The drift test verifies that
7	 * every column is classified Public OR Private, but does not verify the
8	 * controllers actually filter Private fields out of responses.
9	 *
10	 * This test closes that gap by hitting endpoints that surface entities
11	 * with non-empty PrivateFields and asserting none of those keys appear
12	 * in the response payload (recursively).
13	 *
14	 * Add coverage when a new entity gains PrivateFields. The list of
15	 * (Entity → endpoint) pairs is intentionally small — pick the canonical
16	 * GET that returns the entity in full to a non-superuser caller.
17	 */
18	import { describe, test } from 'node:test';
19	import assert from 'node:assert/strict';
20	import { http } from '@/test/http.js';
21	import {
22	  PolicyOrderPrivateFields,
23	} from '@/schemas/typebox/policy/index.js';
24	
25	function getEnvRequired(key: string): string {
26	  const value = process.env[key];
27	  if (!value) throw new Error(`${key} not set`);
28	  return value;
29	}
30	
31	const AUTH = {
32	  Authorization: `Client ${getEnvRequired('SHERPA_TEST_CLIENT_ID')}:${getEnvRequired('SHERPA_TEST_CLIENT_SECRET')}`,
33	};
34	
35	function findLeakedKeys(
36	  payload: unknown,
37	  forbidden: ReadonlySet<string>,
38	  path: string[] = [],
39	  hits: string[] = [],
40	): string[] {
41	  if (Array.isArray(payload)) {
42	    payload.forEach((item, i) => findLeakedKeys(item, forbidden, [...path, String(i)], hits));
43	  } else if (payload && typeof payload === 'object') {
44	    for (const [k, v] of Object.entries(payload as Record<string, unknown>)) {
45	      if (forbidden.has(k)) hits.push([...path, k].join('.'));
46	      findLeakedKeys(v, forbidden, [...path, k], hits);
47	    }
48	  }
49	  return hits;
50	}
51	
52	describe('PrivateFields enforcement — non-superuser responses', () => {
53	  test('GET /v1/plus/policy-orders strips PolicyOrderPrivateFields', async () => {
54	    const res = await http<unknown>(
55	      'GET',
56	      '/v1/plus/policy-orders?page=1&limit=5',
57	      { headers: AUTH },
58	    );
59	    assert.equal(res.status, 200, `Expected 200, got ${res.status}`);
60	    const forbidden = new Set<string>(PolicyOrderPrivateFields);
61	    const leaks = findLeakedKeys(res.data, forbidden);
62	    assert.deepStrictEqual(
63	      leaks,
64	      [],
65	      `PolicyOrder PrivateFields leaked into response at: ${leaks.slice(0, 10).join(', ')}`,
66	    );
67	  });
68	});
69	

1	/**
2	 * DB ↔ Typebox-schema drift guard.
3	 *
4	 * For every Sequelize model registered in the app this test asserts two
5	 * invariants:
6	 *
7	 *   1. Every column from `Model.getAttributes()` is classified as either
8	 *      <Entity>PublicFields or <Entity>PrivateFields. A column that lives in
9	 *      neither allowlist is "drift" — the schema file lags the model.
10	 *
11	 *   2. `Object.keys(<Entity>Schema.properties)` (sorted) equals
12	 *      `<Entity>PublicFields` (sorted). The wire schema and the Public
13	 *      allowlist must stay perfectly in sync.
14	 *
15	 * If a test fails, the fix is in the bucket schema file
16	 * (`src/schemas/typebox/<bucket>/<Entity>.ts`):
17	 *   - either ADD the column to PublicFields and to Schema.properties (when it
18	 *     should be exposed on the API), or
19	 *   - ADD it to PrivateFields (when it must never leave the server).
20	 *
21	 * Hard rules:
22	 *   - This test is read-only against schema files. Do NOT relax it by editing
23	 *     this file when a model gains a column; fix the schema instead.
24	 *   - This test does NOT modify Sequelize models.
25	 *   - Failures block merge.
26	 *
27	 * `ProductModule` (the typebox $id) has no Sequelize counterpart — the
28	 * physical join table is `ProductModulePartner` — so it is intentionally
29	 * absent from the registry.
30	 */
31	
32	import { test, after } from 'node:test';
33	import assert from 'node:assert/strict';
34	
35	// Importing db.ts triggers `sequelize.addModels([...])`, which is what
36	// populates each Model's column metadata. Without this side-effect import,
37	// `Model.getAttributes()` returns an empty object and every test silently
38	// "passes". The connection objects are exported so we can close them in
39	// `after()` and let the test process exit cleanly.
40	import { sequelize, systemSequelize, analyticsSequelize } from '@/models/db.js';
41	
42	// ─── Auth bucket ────────────────────────────────────────────────────────────
43	import { User } from '@/models/User.js';
44	import { _Customer } from '@/models/Customer.js';
45	import { _UserOrganization } from '@/models/UserOrganization.js';
46	import { _UserPermission } from '@/models/UserPermission.js';
47	import { UserSocialAuth } from '@/models/UserSocialAuth.js';
48	import { SocialAuthProvider } from '@/models/SocialAuthProvider.js';
49	import { InvalidatedToken } from '@/models/InvalidatedToken.js';
50	import { _Client } from '@/models/Client.js';
51	import { _WidgetToken } from '@/models/WidgetToken.js';
52	
53	import {
54	  UserSchema, UserPublicFields, UserPrivateFields,
55	  CustomerSchema, CustomerPublicFields, CustomerPrivateFields,
56	  UserOrganizationSchema, UserOrganizationPublicFields, UserOrganizationPrivateFields,
57	  UserPermissionSchema, UserPermissionPublicFields, UserPermissionPrivateFields,
58	  UserSocialAuthSchema, UserSocialAuthPublicFields, UserSocialAuthPrivateFields,
59	  SocialAuthProviderSchema, SocialAuthProviderPublicFields, SocialAuthProviderPrivateFields,
60	  InvalidatedTokenSchema, InvalidatedTokenPublicFields, InvalidatedTokenPrivateFields,
61	  ClientSchema, ClientPublicFields, ClientPrivateFields,
62	  WidgetTokenSchema, WidgetTokenPublicFields, WidgetTokenPrivateFields,
63	} from '@/schemas/typebox/auth/index.js';
64	
65	// ─── Bundle bucket ──────────────────────────────────────────────────────────
66	import { _ProductBundle } from '@/models/ProductBundle.js';
67	import { _ProductBundleItem } from '@/models/ProductBundleItem.js';
68	import { _BundleDiscountTier } from '@/models/BundleDiscountTier.js';
69	import { _BundleSubscription } from '@/models/BundleSubscription.js';
70	import { _BundleQuoteSession } from '@/models/BundleQuoteSession.js';
71	
72	import {
73	  ProductBundleSchema, ProductBundlePublicFields, ProductBundlePrivateFields,
74	  ProductBundleItemSchema, ProductBundleItemPublicFields, ProductBundleItemPrivateFields,
75	  BundleDiscountTierSchema, BundleDiscountTierPublicFields, BundleDiscountTierPrivateFields,
76	  BundleSubscriptionSchema, BundleSubscriptionPublicFields, BundleSubscriptionPrivateFields,
77	  BundleQuoteSessionSchema, BundleQuoteSessionPublicFields, BundleQuoteSessionPrivateFields,
78	} from '@/schemas/typebox/bundle/index.js';
79	
80	// ─── Catalog bucket ─────────────────────────────────────────────────────────
81	import { Insurer } from '@/models/Insurer.js';
82	import { InsuranceType } from '@/models/InsuranceType.js';
83	import { Country } from '@/models/Country.js';
84	import { Region } from '@/models/Region.js';
85	import { CurrencyRate } from '@/models/CurrencyRate.js';
86	import { _Tax } from '@/models/Tax.js';
87	import { _CancellationTerms } from '@/models/CancellationTerms.js';
88	import { _AuditLog } from '@/models/AuditLog.js';
89	import { _SystemSetting } from '@/models/SystemSetting.js';
90	
91	import {
92	  InsurerSchema, InsurerPublicFields, InsurerPrivateFields,
93	  InsuranceTypeSchema, InsuranceTypePublicFields, InsuranceTypePrivateFields,
94	  CountrySchema, CountryPublicFields, CountryPrivateFields,
95	  RegionSchema, RegionPublicFields, RegionPrivateFields,
96	  CurrencyRateSchema, CurrencyRatePublicFields, CurrencyRatePrivateFields,
97	  TaxSchema, TaxPublicFields, TaxPrivateFields,
98	  CancellationTermsSchema, CancellationTermsPublicFields, CancellationTermsPrivateFields,
99	  AuditLogSchema, AuditLogPublicFields, AuditLogPrivateFields,
100	  SystemSettingSchema, SystemSettingPublicFields, SystemSettingPrivateFields,
101	} from '@/schemas/typebox/catalog/index.js';
102	
103	// ─── Claim bucket ───────────────────────────────────────────────────────────
104	import { _Claim } from '@/models/Claim.js';
105	import { _ClaimRecord } from '@/models/ClaimRecord.js';
106	import { _ClaimAttachment } from '@/models/ClaimAttachment.js';
107	import { _ClaimMessage } from '@/models/ClaimMessage.js';
108	import { _ClaimParameter } from '@/models/ClaimParameter.js';
109	import { _ClaimParameterCategory } from '@/models/ClaimParameterCategory.js';
110	import { _ClaimParameterCategoryPage } from '@/models/ClaimParameterCategoryPage.js';
111	import { _ClaimRecordError } from '@/models/ClaimRecordError.js';
112	import { _AutomatedPolicyRun } from '@/models/AutomatedPolicyRun.js';
113	import { _CustomerNotification } from '@/models/CustomerNotification.js';
114	
115	import {
116	  ClaimSchema, ClaimPublicFields, ClaimPrivateFields,
117	  ClaimRecordSchema, ClaimRecordPublicFields, ClaimRecordPrivateFields,
118	  ClaimAttachmentSchema, ClaimAttachmentPublicFields, ClaimAttachmentPrivateFields,
119	  ClaimMessageSchema, ClaimMessagePublicFields, ClaimMessagePrivateFields,
120	  ClaimParameterSchema, ClaimParameterPublicFields, ClaimParameterPrivateFields,
121	  ClaimParameterCategorySchema, ClaimParameterCategoryPublicFields, ClaimParameterCategoryPrivateFields,
122	  ClaimParameterCategoryPageSchema, ClaimParameterCategoryPagePublicFields, ClaimParameterCategoryPagePrivateFields,
123	  ClaimRecordErrorSchema, ClaimRecordErrorPublicFields, ClaimRecordErrorPrivateFields,
124	  AutomatedPolicyRunSchema, AutomatedPolicyRunPublicFields, AutomatedPolicyRunPrivateFields,
125	  CustomerNotificationSchema, CustomerNotificationPublicFields, CustomerNotificationPrivateFields,
126	} from '@/schemas/typebox/claim/index.js';
127	
128	// ─── Data bucket ────────────────────────────────────────────────────────────
129	import { _DataFile } from '@/models/DataFile.js';
130	import { DataModelCategory } from '@/models/DataModelCategory.js';
131	import { DataModelField } from '@/models/DataModelField.js';
132	import { _Upload } from '@/models/Upload.js';
133	import { _UploadCredential } from '@/models/UploadCredential.js';
134	import { _TemplateLibrary } from '@/models/TemplateLibrary.js';
135	import { _FunnelTemplatesLibrary } from '@/models/FunnelTemplatesLibrary.js';
136	import { _FunnelTemplateSet } from '@/models/FunnelTemplateSet.js';
137	import { DefaultFunnelTemplate } from '@/models/DefaultFunnelTemplate.js';
1

{"pattern":"sanction_screening","path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src"}

Found 23 files
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.31T00.00.01.widen-call-log-capability.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/integration/ExternalIntegrationCallLog.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes/plus/externalIntegrationsRoutes.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runner.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/policyIssuanceService.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/jobs/sanctionScreeningJob.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/product/Product.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/integration/ExternalIntegrationRequestTemplate.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/integration/ExternalIntegration.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/typebox/compliance/ComplianceCheck.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/policy.schemas.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/plus/product.schemas.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ComplianceCheck.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runtime/fieldMappings.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.07.add-integration-invocation-mode.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.05.normalize-compliance-operation.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.02.rename-sanction-screenings-to-compliance-checks.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.01.rename-screening-configuration-to-compliance-checks.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.14T00.00.08.add-disable-sanction-screening-to-organizations.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.14T00.00.06.create-sanction-screenings.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.14T00.00.04.create-external-integration-call-logs.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.14T00.00.01.create-external-integrations.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/controllers/externalIntegrationController.ts

{"pattern":"capability.*\\[.*\\]|runCheck|sanctionScreeningService|policyIssuanceService","path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src","type":"ts"}

Found 10 files
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes/plus/externalIntegrationsRoutes.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/sanctionScreeningService.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/policyRenewalService.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/policyIssuanceService.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/jobs/sanctionScreeningJob.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/routes/plus/sanctionScreeningRoutes.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/test/runCheck.test.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/controllers/sanctionScreeningController.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/controllers/policyOrderController.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/controllers/claimController.ts

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/capabilities/runCheck.ts"}

1	import { StatusError } from '@/error/error.js';
2	import type { _Product, ProductCapabilityConfig } from '@/models/Product.js';
3	import type {
4	  ScreenedParty,
5	  ComplianceFinding,
6	  ComplianceCheckOutcome,
7	} from '@/models/ComplianceCheck.js';
8	import { invoke } from '../runner.js';
9	import { getCapability, type CapabilityId } from './registry.js';
10	
11	export interface RunCheckInvocation {
12	  capability: CapabilityId;
13	  organizationId: string;
14	  product: _Product;
15	  parameters: Record<string, unknown>;
16	  correlationId: string;
17	}
18	
19	export interface RunCheckResult {
20	  integrationId: string;
21	  screenedParties: ScreenedParty[];
22	  findings: ComplianceFinding[];
23	  outcome: ComplianceCheckOutcome;
24	  rawResponse: unknown;
25	  httpStatus: number | null;
26	  durationMs: number;
27	  attempts: number;
28	}
29	
30	// Resolve a Product's capability config or throw a 400 if the capability is
31	// not enabled on the product.
32	export function requireCapabilityConfig(
33	  product: _Product,
34	  capability: CapabilityId,
35	): ProductCapabilityConfig {
36	  const config = product.complianceChecks?.[capability];
37	  if (!config) {
38	    throw new StatusError(400, `Product ${product.id} has no ${capability} compliance check`);
39	  }
40	  if (!config.enabled) {
41	    throw new StatusError(400, `Product ${product.id} ${capability} is disabled`);
42	  }
43	  return config;
44	}
45	
46	function readPath(source: Record<string, unknown>, path: string): unknown {
47	  let cursor: unknown = source;
48	  for (const seg of path.split('.')) {
49	    if (cursor === null || cursor === undefined || typeof cursor !== 'object') return undefined;
50	    cursor = (cursor as Record<string, unknown>)[seg];
51	  }
52	  return cursor;
53	}
54	
55	function asPartyObject(value: unknown): Record<string, unknown> | null {
56	  if (value === null || typeof value !== 'object' || Array.isArray(value)) return null;
57	  return value as Record<string, unknown>;
58	}
59	
60	// Extract screened parties from policy/claim parameters using the product's
61	// per-capability `parties` config. Each path resolves to a DataModelField
62	// object (e.g. `personal`); the integration's outbound mappings decide which
63	// fields are forwarded to the provider.
64	export function extractScreenedParties(
65	  parameters: Record<string, unknown>,
66	  config: ProductCapabilityConfig,
67	): ScreenedParty[] {
68	  const out: ScreenedParty[] = [];
69	  const policyholder = asPartyObject(readPath(parameters, config.parties.policyholder));
70	  if (policyholder) {
71	    out.push({ role: 'policyholder', sourcePath: config.parties.policyholder, data: policyholder });
72	  }
73	  for (const path of config.parties.additional) {
74	    const value = readPath(parameters, path);
75	    if (Array.isArray(value)) {
76	      value.forEach((entry, i) => {
77	        const party = asPartyObject(entry);
78	        if (party) out.push({ role: 'insured', sourcePath: `${path}.${i}`, data: party });
79	      });
80	    } else {
81	      const party = asPartyObject(value);
82	      if (party) out.push({ role: 'insured', sourcePath: path, data: party });
83	    }
84	  }
85	  return out;
86	}
87	
88	function isFindingArray(value: unknown): value is unknown[] {
89	  return Array.isArray(value);
90	}
91	
92	// Normalise the provider's match list into the canonical finding shape.
93	// Accepts either canonical (entityId/entityName) or provider-native (id/caption/name).
94	function normaliseFindings(rawMatches: unknown): ComplianceFinding[] {
95	  if (!isFindingArray(rawMatches)) return [];
96	  const out: ComplianceFinding[] = [];
97	  for (const item of rawMatches) {
98	    if (item === null || typeof item !== 'object') continue;
99	    const m = item as Record<string, unknown>;
100	    const entityId = typeof m.entityId === 'string' ? m.entityId : typeof m.id === 'string' ? m.id : null;
101	    const entityName =
102	      typeof m.entityName === 'string'
103	        ? m.entityName
104	        : typeof m.caption === 'string'
105	          ? m.caption
106	          : typeof m.name === 'string'
107	            ? m.name
108	            : null;
109	    const score = typeof m.score === 'number' ? m.score : null;
110	    if (!entityId || !entityName || score === null) continue;
111	    out.push({
112	      entityId,
113	      entityName,
114	      score,
115	      topics: Array.isArray(m.topics) ? m.topics.filter((t): t is string => typeof t === 'string') : [],
116	      datasets: Array.isArray(m.datasets) ? m.datasets.filter((d): d is string => typeof d === 'string') : [],
117	      sourceUrl: typeof m.sourceUrl === 'string' ? m.sourceUrl : null,
118	    });
119	  }
120	  return out;
121	}
122	
123	// Bucket findings into pass / fail / review using the product's outcomeRules.
124	export function applyOutcomeRules(
125	  findings: ComplianceFinding[],
126	  config: ProductCapabilityConfig,
127	): ComplianceCheckOutcome {
128	  if (findings.length === 0) return 'pass';
129	  let topScore = 0;
130	  const allTopics = new Set<string>();
131	  for (const f of findings) {
132	    if (f.score > topScore) topScore = f.score;
133	    for (const t of f.topics) allTopics.add(t);
134	  }
135	  const failRule = config.outcomeRules.failWhen;
136	  if (topScore >= failRule.minScore) return 'fail';
137	  for (const forbidden of failRule.onTopics) {
138	    if (allTopics.has(forbidden)) return 'fail';
139	  }
140	  const passRule = config.outcomeRules.passWhen;
141	  if (topScore < passRule.maxScore) return 'pass';
142	  return 'review';
143	}
144	
145	// Run a compliance check for any registered capability against a product.
146	// Capability handlers share this single pipeline: extract parties → invoke
147	// the integration → normalise findings → apply outcome rules.
148	export async function runComplianceCheck(invocation: RunCheckInvocation): Promise<RunCheckResult> {
149	  const config = requireCapabilityConfig(invocation.product, invocation.capability);
150	  const parties = extractScreenedParties(invocation.parameters, config);
151	  if (parties.length === 0) {
152	    throw new StatusError(
153	      400,
154	      `Product ${invocation.product.id} ${invocation.capability} parties paths produced no screenable parties from the provided parameters`,
155	    );
156	  }
157	  const capabilityDef = getCapability(invocation.capability);
158	  const result = await invoke({
159	    organizationId: invocation.organizationId,
160	    capability: invocation.capability,
161	    operation: capabilityDef.operation,
162	    input: { parties },
163	    correlationId: invocation.correlationId,
164	  });
165	  const findings = normaliseFindings(result.output.matches);
166	  const outcome = applyOutcomeRules(findings, config);
167	  return {
168	    integrationId: result.integrationId,
169	    screenedParties: parties,
170	    findings,
171	    outcome,
172	    rawResponse: result.rawResponseBody,
173	    httpStatus: result.httpStatus,
174	    durationMs: result.durationMs,
175	    attempts: result.attempts,
176	  };
177	}
178	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/runtime/audit.ts"}

1	import type { _ExternalIntegrationCallLog } from '@/models/ExternalIntegrationCallLog.js';
2	import { _ExternalIntegrationCallLog as CallLog } from '@/models/ExternalIntegrationCallLog.js';
3	import type { ExternalIntegrationCallStatus } from '@/models/ExternalIntegrationCallLog.js';
4	
5	const MAX_EXCERPT_BYTES = 8 * 1024;
6	
7	// Header names to drop entirely from the excerpt.
8	const HEADER_BLOCKLIST = new Set([
9	  'authorization',
10	  'cookie',
11	  'set-cookie',
12	  'x-api-key',
13	  'x-auth-token',
14	  'proxy-authorization',
15	]);
16	
17	// Keys whose values should be redacted when found in JSON request/response
18	// bodies. Case-insensitive substring match.
19	const KEY_REDACTION_FRAGMENTS = [
20	  'password',
21	  'secret',
22	  'token',
23	  'apikey',
24	  'api_key',
25	  'authorization',
26	];
27	
28	function shouldRedactKey(key: string): boolean {
29	  const lower = key.toLowerCase();
30	  for (const fragment of KEY_REDACTION_FRAGMENTS) {
31	    if (lower.includes(fragment)) return true;
32	  }
33	  return false;
34	}
35	
36	function redactObject(value: unknown): unknown {
37	  if (value === null || value === undefined) return value;
38	  if (typeof value !== 'object') return value;
39	  if (Array.isArray(value)) return value.map((v) => redactObject(v));
40	  const out: Record<string, unknown> = {};
41	  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
42	    out[k] = shouldRedactKey(k) ? '[REDACTED]' : redactObject(v);
43	  }
44	  return out;
45	}
46	
47	function redactHeaders(headers: Record<string, string>): Record<string, string> {
48	  const out: Record<string, string> = {};
49	  for (const [k, v] of Object.entries(headers)) {
50	    out[k] = HEADER_BLOCKLIST.has(k.toLowerCase()) ? '[REDACTED]' : v;
51	  }
52	  return out;
53	}
54	
55	function truncate(json: unknown): unknown {
56	  const serialised = JSON.stringify(json);
57	  if (serialised === undefined) return null;
58	  if (serialised.length <= MAX_EXCERPT_BYTES) return json;
59	  return { _truncated: true, _bytes: serialised.length, preview: serialised.slice(0, MAX_EXCERPT_BYTES) };
60	}
61	
62	export interface CallLogInput {
63	  integrationId: string;
64	  organizationId: string;
65	  capability: string;
66	  operation: string;
67	  correlationId: string;
68	  status: ExternalIntegrationCallStatus;
69	  httpStatus: number | null;
70	  durationMs: number;
71	  attempts: number;
72	  request: { method: string; url: string; headers: Record<string, string>; body?: unknown };
73	  response: { headers: Record<string, string>; body?: unknown } | null;
74	  errorMessage: string | null;
75	}
76	
77	/**
78	 * Build a sanitised, truncated audit log row from a runner call attempt. Does
79	 * NOT write to the database — callers pass the result to {@link writeCallLog}.
80	 */
81	export function buildCallLog(input: CallLogInput): Parameters<typeof CallLog.create>[0] {
82	  const requestExcerpt = {
83	    method: input.request.method,
84	    url: input.request.url,
85	    headers: redactHeaders(input.request.headers),
86	    body: input.request.body !== undefined ? truncate(redactObject(input.request.body)) : null,
87	  };
88	  const responseExcerpt = input.response
89	    ? {
90	        headers: redactHeaders(input.response.headers),
91	        body: input.response.body !== undefined ? truncate(redactObject(input.response.body)) : null,
92	      }
93	    : null;
94	
95	  return {
96	    integrationId: input.integrationId,
97	    organizationId: input.organizationId,
98	    capability: input.capability,
99	    operation: input.operation,
100	    correlationId: input.correlationId,
101	    status: input.status,
102	    httpStatus: input.httpStatus,
103	    durationMs: input.durationMs,
104	    attempts: input.attempts,
105	    requestExcerpt,
106	    responseExcerpt,
107	    errorMessage: input.errorMessage,
108	  };
109	}
110	
111	/**
112	 * Persist a call-log row. Wrapped in try/catch — audit writes must never break
113	 * the calling integration. Failures are logged via the provided logger
114	 * function (the runner passes fastify.log.warn).
115	 */
116	export async function writeCallLog(
117	  row: Parameters<typeof CallLog.create>[0],
118	  onError: (err: unknown) => void,
119	): Promise<_ExternalIntegrationCallLog | null> {
120	  try {
121	    const created = await CallLog.create(row);
122	    return created;
123	  } catch (err) {
124	    onError(err);
125	    return null;
126	  }
127	}
128	
129	// Exposed for tests only.
130	export const _internal = { redactObject, redactHeaders, truncate, shouldRedactKey };
131	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/policyIssuanceService.ts","limit":100}

1	/**
2	 * Compliance gate for the issuance / claim lifecycle.
3	 *
4	 * Evaluates every capability configured on a product (sanction_screening,
5	 * kyc, fraud, ...) whose `triggers` list includes the current lifecycle
6	 * event (NEW_BUSINESS, RENEWAL, ENDORSEMENT, CLAIM, MANUAL) and starts a
7	 * compliance check for each one. Controllers branch on the aggregate result:
8	 *
9	 *   - `no_check_required`  → proceed.
10	 *   - `cleared`            → all checks resolved (pass or manually approved);
11	 *                            proceed and backfill parent FKs on each row.
12	 *   - `blocked`            → at least one check is pending/failed/rejected;
13	 *                            controller returns 4xx with the blocking checks.
14	 *   - `started`            → at least one fresh check was created and
15	 *                            enqueued; controller returns 202 with the map
16	 *                            of capability → checkId so the customer portal
17	 *                            can resubmit once they all clear.
18	 */
19	
20	import { QueryTypes } from 'sequelize';
21	import logger from '@/logger';
22	import { ComplianceCheck } from '@/models/ComplianceCheck.js';
23	import type { _ComplianceCheck } from '@/models/ComplianceCheck.js';
24	import type { ComplianceCheckTriggerType } from '@/models/ComplianceCheck.js';
25	import { Product } from '@/models/Product.js';
26	import type { _Product } from '@/models/Product.js';
27	import type {
28	  ComplianceTrigger,
29	  ProductCapabilityConfig,
30	} from '@/models/Product.js';
31	import { PolicyOrder } from '@/models/PolicyOrder.js';
32	import type { _PolicyOrder } from '@/models/PolicyOrder.js';
33	import { ExternalIntegration } from '@/models/ExternalIntegration.js';
34	import { tenantQuery } from '@/models/lib/db-query.js';
35	import { PolicyStatusLifecycleCategory } from '@/models/OrganizationPolicyStatus.js';
36	import { getDefaultCodeForCategory } from '@/services/policyStatusService.js';
37	import {
38	  startComplianceCheck,
39	  processScreening,
40	  type StartCheckInput,
41	} from '@/services/sanctionScreeningService.js';
42	import { enqueueSanctionScreening } from '@/services/jobs/sanctionScreeningJob.js';
43	
44	export type ComplianceGateParent =
45	  | {
46	      kind: 'policy';
47	      previousPolicyId: string | null;
48	      rootPolicyId: string | null;
49	    }
50	  | {
51	      kind: 'claim';
52	      claimRecordId: string;
53	      customerId: string | null;
54	    };
55	
56	export interface ComplianceGateInput {
57	  organizationId: string;
58	  productId: number;
59	  triggerType: ComplianceCheckTriggerType;
60	  parent: ComplianceGateParent;
61	  issuanceContext: Record<string, unknown>;
62	  parameters: Record<string, unknown>;
63	  /** capability → existing check id when re-submitting after a manual decision. */
64	  existingCheckIds?: Record<string, string>;
65	}
66	
67	export interface BlockedCheck {
68	  capability: string;
69	  check: _ComplianceCheck;
70	  reason: 'pending' | 'fail' | 'review' | 'rejected';
71	  autoReject: boolean;
72	}
73	
74	export interface StartedCheck {
75	  capability: string;
76	  check: _ComplianceCheck;
77	}
78	
79	export type ComplianceGateResult =
80	  | { kind: 'no_check_required' }
81	  | { kind: 'cleared'; checkIds: Record<string, string> }
82	  | { kind: 'blocked'; blocked: BlockedCheck[]; alreadyCleared: Record<string, string> }
83	  | { kind: 'started'; started: StartedCheck[]; alreadyCleared: Record<string, string> };
84	
85	/** Did the gate produce any check that hasn't fully cleared? Used by policy
86	 *  issuance to decide whether to park the policy in compliance_pending. */
87	export function isComplianceGateParked(result: ComplianceGateResult): boolean {
88	  return result.kind === 'started' || result.kind === 'blocked';
89	}
90	
91	/** Which parked-lifecycle category should the policy adopt given the gate
92	 *  result? `compliance_blocked` (auto-denied) only when every blocking check
93	 *  is terminal (fail / rejected) AND nothing is still processing — admin can
94	 *  override but no action is required. Anything still running or in review
95	 *  parks in `compliance_pending` so it surfaces in the admin queue. */
96	export function pickComplianceParkCategory(
97	  result: ComplianceGateResult,
98	): 'compliance_pending' | 'compliance_blocked' | null {
99	  if (result.kind === 'started') return 'compliance_pending';
100	  if (result.kind !== 'blocked') return null;

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/policyIssuanceService.ts","offset":100,"limit":200}

100	  if (result.kind !== 'blocked') return null;
101	  const allBlockable = result.blocked.every(
102	    (b) => b.reason === 'rejected' || (b.reason === 'fail' && b.autoReject),
103	  );
104	  return allBlockable ? 'compliance_blocked' : 'compliance_pending';
105	}
106	
107	/** Flatten the gate result into one capability → checkId map covering every
108	 *  check the policy/claim is gated on (started + blocked + already cleared). */
109	export function collectComplianceCheckIds(result: ComplianceGateResult): Record<string, string> | null {
110	  if (result.kind === 'no_check_required') return null;
111	  if (result.kind === 'cleared') return { ...result.checkIds };
112	  const out: Record<string, string> = { ...result.alreadyCleared };
113	  if (result.kind === 'started') {
114	    for (const s of result.started) out[s.capability] = s.check.id;
115	  } else {
116	    for (const b of result.blocked) out[b.capability] = b.check.id;
117	  }
118	  return Object.keys(out).length > 0 ? out : null;
119	}
120	
121	// Triggers that map to a real lifecycle event. MANUAL is admin-initiated,
122	// never auto-fired by a controller.
123	function enabledCapabilitiesFor(
124	  product: _Product,
125	  trigger: ComplianceTrigger,
126	): Array<{ capability: string; config: ProductCapabilityConfig }> {
127	  const out: Array<{ capability: string; config: ProductCapabilityConfig }> = [];
128	  const all = product.complianceChecks ?? {};
129	  for (const [capability, config] of Object.entries(all)) {
130	    if (!config.enabled) continue;
131	    if (!config.triggers.includes(trigger)) continue;
132	    out.push({ capability, config });
133	  }
134	  return out;
135	}
136	
137	function classifyExisting(
138	  capability: string,
139	  existing: _ComplianceCheck,
140	  autoReject: boolean,
141	): BlockedCheck | { kind: 'cleared'; checkId: string } {
142	  const cleared = existing.outcome === 'pass' || existing.manualDecision === 'approved';
143	  if (cleared) return { kind: 'cleared', checkId: existing.id };
144	  if (existing.status !== 'completed') return { capability, check: existing, reason: 'pending', autoReject };
145	  if (existing.manualDecision === 'rejected') return { capability, check: existing, reason: 'rejected', autoReject };
146	  const reason: 'fail' | 'review' = existing.outcome === 'fail' ? 'fail' : 'review';
147	  return { capability, check: existing, reason, autoReject };
148	}
149	
150	export async function evaluateComplianceGate(
151	  input: ComplianceGateInput,
152	): Promise<ComplianceGateResult> {
153	  const product = await Product.findOne(
154	    { organizationId: input.organizationId },
155	    { where: { id: input.productId } },
156	  );
157	  if (!product) {
158	    throw new Error(`Product ${input.productId} not found for organization ${input.organizationId}`);
159	  }
160	
161	  const enabled = enabledCapabilitiesFor(product, input.triggerType);
162	  if (enabled.length === 0) return { kind: 'no_check_required' };
163	
164	  const blocked: BlockedCheck[] = [];
165	  const cleared: Record<string, string> = {};
166	  const started: StartedCheck[] = [];
167	
168	  for (const { capability, config } of enabled) {
169	    const autoReject = config.autoReject === true;
170	    const existingId = input.existingCheckIds?.[capability] ?? null;
171	    if (existingId) {
172	      const row = await ComplianceCheck.findOne(
173	        { organizationId: input.organizationId },
174	        { where: { id: existingId } },
175	      );
176	      if (!row) throw new Error(`Compliance check ${existingId} not found`);
177	      const classified = classifyExisting(capability, row, autoReject);
178	      if ('kind' in classified) cleared[capability] = classified.checkId;
179	      else blocked.push(classified);
180	      continue;
181	    }
182	
183	    // Renewals deduplicate on previousPolicyId so daily cron sweeps don't
184	    // spin up duplicate checks for the same prior policy version.
185	    if (
186	      input.triggerType === 'RENEWAL'
187	      && input.parent.kind === 'policy'
188	      && input.parent.previousPolicyId
189	    ) {
190	      const recent = await ComplianceCheck.findOne(
191	        { organizationId: input.organizationId },
192	        {
193	          where: {
194	            previousPolicyId: input.parent.previousPolicyId,
195	            triggerType: 'RENEWAL',
196	            capability,
197	          },
198	          order: [['createdAt', 'DESC']],
199	        },
200	      );
201	      if (recent) {
202	        const classified = classifyExisting(capability, recent, autoReject);
203	        if ('kind' in classified) cleared[capability] = classified.checkId;
204	        else blocked.push(classified);
205	        continue;
206	      }
207	    }
208	
209	    const startInput: StartCheckInput = {
210	      organizationId: input.organizationId,
211	      productId: input.productId,
212	      capability,
213	      triggerType: input.triggerType,
214	      parent: input.parent,
215	      issuanceContext: input.issuanceContext,
216	      parameters: input.parameters,
217	    };
218	    const check = await startComplianceCheck(startInput);
219	    const integration = await ExternalIntegration.findOne(
220	      { organizationId: input.organizationId },
221	      { where: { id: config.integrationId } },
222	    );
223	    const sync = integration?.invocationMode === 'sync';
224	    const timeoutMs = integration?.syncTimeoutMs ?? 5000;
225	    if (sync) {
226	      const ranInline = await runInlineWithTimeout(check.id, input.organizationId, timeoutMs);
227	      if (ranInline) {
228	        const refreshed = await ComplianceCheck.findOne(
229	          { organizationId: input.organizationId },
230	          { where: { id: check.id } },
231	        );
232	        if (refreshed) {
233	          const classified = classifyExisting(capability, refreshed, autoReject);
234	          if ('kind' in classified) cleared[capability] = classified.checkId;
235	          else blocked.push(classified);
236	          continue;
237	        }
238	      }
239	      // Timeout / inline failure → fall through to async semantics so the
240	      // customer keeps moving and the worker picks the check up.
241	      await enqueueSanctionScreening(check.id, input.organizationId);
242	    } else {
243	      await enqueueSanctionScreening(check.id, input.organizationId);
244	    }
245	    started.push({ capability, check });
246	    logger.info(
247	      {
248	        checkId: check.id,
249	        productId: input.productId,
250	        capability,
251	        triggerType: input.triggerType,
252	        mode: sync ? 'sync' : 'async',
253	      },
254	      'Compliance check started',
255	    );
256	  }
257	
258	  if (blocked.length > 0) return { kind: 'blocked', blocked, alreadyCleared: cleared };
259	  if (started.length > 0) return { kind: 'started', started, alreadyCleared: cleared };
260	  return { kind: 'cleared', checkIds: cleared };
261	}
262	
263	/** Race processScreening against the configured sync timeout. Resolves true
264	 *  iff the worker completed (success or terminal failure) before the deadline. */
265	async function runInlineWithTimeout(
266	  checkId: string,
267	  organizationId: string,
268	  timeoutMs: number,
269	): Promise<boolean> {
270	  let timer: NodeJS.Timeout | undefined;
271	  const timeout = new Promise<false>((resolve) => {
272	    timer = setTimeout(() => resolve(false), timeoutMs);
273	  });
274	  try {
275	    const work = processScreening(checkId, organizationId).then(() => true).catch((err) => {
276	      logger.warn({ err, checkId }, 'Inline compliance run threw; falling back to async');
277	      return false;
278	    });
279	    return await Promise.race([work, timeout]);
280	  } finally {
281	    if (timer) clearTimeout(timer);
282	  }
283	}
284	
285	/**
286	 * Backfill the parent FK on a compliance check once the policy / claim row
287	 * exists. Tenant-scoped via the safe-model wrapper.
288	 */
289	export async func

{"pattern":"outcomeRules|failWhen|passWhen|maxScore|minScore","path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src","type":"ts","head_limit":15}

Found 7 files
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/schemas/plus/product.schemas.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_Product.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ComplianceCheck.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/test/runCheck.test.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/capabilities/runCheck.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.05.19T00.00.01.rename-screening-configuration-to-compliance-checks.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/controllers/productController.ts

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_Product.ts","limit":150}

1	'use strict';
2	import {
3	  Table,
4	  Column,
5	  Model,
6	  BelongsTo,
7	  ForeignKey,
8	  DataType,
9	  HasMany,
10	} from 'sequelize-typescript';
11	import { _CommissionStructure } from './_CommissionStructure.js';
12	import { Country } from '../Country';
13	import { Insurer } from '../Insurer.js';
14	import { InsuranceType } from '../InsuranceType';
15	import { Organization } from '../Organization';
16	import { _Policy } from './_Policy.js';
17	import { _ProductModulePartner } from './_ProductModulePartner.js';
18	import { ProductOptimization } from '../ProductOptimization.js';
19	import { _ProductPlan } from './_ProductPlan.js';
20	import { _ProductSetting } from './_ProductSetting.js';
21	import { _Quote } from './_Quote.js';
22	import { _Simulation } from './_Simulation.js';
23	import { User } from '../User';
24	
25	export interface ProductDocumentRef {
26	  key: string;
27	  label: string;
28	  dataFileId: string;
29	  locale: string;
30	  order: number;
31	}
32	
33	export type ComplianceTrigger =
34	  | 'NEW_BUSINESS'
35	  | 'RENEWAL'
36	  | 'ENDORSEMENT'
37	  | 'CLAIM'
38	  | 'MANUAL';
39	
40	// Per-capability compliance config. `parties` lists DataModelField paths
41	// (e.g. 'personal', 'insureds'); runner reads each path and forwards it to
42	// the integration's outbound mapping, which handles provider translation.
43	export interface ProductCapabilityConfig {
44	  enabled: boolean;
45	  integrationId: string;
46	  triggers: ComplianceTrigger[];
47	  parties: {
48	    policyholder: string;
49	    additional: string[];
50	  };
51	  outcomeRules: {
52	    passWhen: { maxScore: number };
53	    failWhen: { minScore: number; onTopics: string[] };
54	  };
55	  // When outcome=fail, automatically transition the parent policy to
56	  // compliance_blocked instead of leaving it parked for manual admin review.
57	  autoReject?: boolean;
58	  // Plain-text messages sent to the customer (portal notification + email).
59	  // `fail` fires only when autoReject is true and outcome=fail. `review` fires
60	  // when outcome=review OR outcome=fail with autoReject=false.
61	  messages?: {
62	    fail?: string | null;
63	    review?: string | null;
64	  };
65	}
66	
67	export type ProductComplianceChecks = Record<string, ProductCapabilityConfig>;
68	
69	@Table({
70	  modelName: 'Product',
71	  paranoid: true,
72	  indexes: [
73	    {
74	      unique: true,
75	      fields: ['productName', 'organizationId', 'version'],
76	      name: 'unique_product_name_organization_version',
77	    },
78	    {
79	      fields: ['insuranceTypeId'],
80	      name: 'idx_product_insurance_type',
81	    },
82	    {
83	      fields: ['country'],
84	      name: 'idx_product_country',
85	    },
86	    {
87	      fields: ['organizationId', 'startDate', 'endDate'],
88	      name: 'idx_product_date_range',
89	    },
90	  ],
91	})
92	export class _Product extends Model {
93	  @Column({
94	    type: DataType.INTEGER,
95	    autoIncrement: true,
96	    primaryKey: true,
97	  })
98	  declare id: number;
99	  @Column({
100	    type: DataType.STRING,
101	    allowNull: false,
102	    validate: {
103	      notEmpty: true,
104	    },
105	  })
106	  declare productTitle: string;
107	
108	  @Column({
109	    type: DataType.STRING,
110	    allowNull: false,
111	    validate: {
112	      notEmpty: true,
113	    },
114	  })
115	  declare productName: string;
116	
117	  @Column({
118	    type: DataType.TEXT,
119	    allowNull: true,
120	  })
121	  declare productDescription?: string;
122	
123	  @ForeignKey(() => Country)
124	  @Column({
125	    type: DataType.STRING(2),
126	    allowNull: false,
127	    defaultValue: 'US',
128	    validate: {
129	      isUppercase: true,
130	      len: [2, 2],
131	    },
132	  })
133	  declare country: string;
134	
135	  @Column({
136	    type: DataType.JSONB,
137	    allowNull: false,
138	    defaultValue: [],
139	  })
140	  declare availableCountries: string[];
141	
142	  @ForeignKey(() => InsuranceType)
143	  @Column({
144	    type: DataType.INTEGER,
145	    allowNull: false,
146	  })
147	  declare insuranceTypeId: number;
148	
149	  @Column({
150	    type: DataType.STRING,

{"pattern":"topScore.*failRule|minScore|maxScore|passRule","path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/capabilities/runCheck.ts","output_mode":"content","context":5}

131-  for (const f of findings) {
132-    if (f.score > topScore) topScore = f.score;
133-    for (const t of f.topics) allTopics.add(t);
134-  }
135-  const failRule = config.outcomeRules.failWhen;
136:  if (topScore >= failRule.minScore) return 'fail';
137-  for (const forbidden of failRule.onTopics) {
138-    if (allTopics.has(forbidden)) return 'fail';
139-  }
140:  const passRule = config.outcomeRules.passWhen;
141:  if (topScore < passRule.maxScore) return 'pass';
142-  return 'review';
143-}
144-
145-// Run a compliance check for any registered capability against a product.
146-// Capability handlers share this single pipeline: extract parties → invoke

{"description":"Round 1 portal+test review","subagent_type":"Explore","prompt":"Code review of uncommitted changes in the sherpa-portal worktree at /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat and the sherpa-test worktree at /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat. The change surfaces a new \"credit_check\" compliance capability in the portal UI (sibling of sanction_screening/pep/kyc/adverse_media/fraud_detection) and adds API tests.\n\nRead the ACTUAL CONTENT of these changed files and verify correctness:\nPORTAL:\n1. app/types/admin.ts — 'credit_check' added to IntegrationCapability union, CAPABILITY_OPERATIONS record (['check']), and CAPABILITY_DEFAULT_INVOCATION_MODE record ('sync').\n2. app/components/products/ProductCompliancePanel.tsx — 'credit_check' added to CapabilityKey union, a CAPABILITY_REGISTRY entry (icon CreditCard, defaultTriggers ['NEW_BUSINESS','RENEWAL'], outcomeRules passWhen.maxScore 0.5 / failWhen.minScore 0.85 onTopics ['credit.high_risk']), and useCapabilityText label+blurb switch cases. CreditCard imported from lucide-react.\n3. app/components/admin/IntegrationsTab.tsx — 'credit_check' added to CAPABILITIES array.\n4. app/components/compliance/ComplianceChecksSection.tsx, app/components/screening/SanctionScreeningPanel.tsx, app/policy-management/screening/page.tsx — capabilityLabel switch gains a `case 'credit_check': return t('Credit Check')`.\n5. app/prompts/externalIntegrationSmartSetup.ts — local IntegrationCapability widened to 'sanction_screening' | 'credit_check'; CAPABILITY_OUTPUT_CONTRACT gains a credit_check entry.\nTEST:\n6. tests/plus-insurance/08-compliance-checks.spec.ts — added 3 tests: create credit_check integration, PUT complianceChecks.credit_check round-trip, integration list filter for credit_check.\n\nCHECK SPECIFICALLY:\n- EXHAUSTIVENESS: are there any OTHER portal files that enumerate the capability list and would now be INCONSISTENT or MISSING credit_check? Search the whole app/ for the capability literals ('sanction_screening', 'fraud_detection', 'adverse_media') — find every Record<IntegrationCapability,...>, every switch on capability, every array of capabilities, every CAPABILITY_* constant. Since CAPABILITY_OPERATIONS and CAPABILITY_DEFAULT_INVOCATION_MODE are `Record<IntegrationCapability, ...>`, TS would error if a key is missing — but find any OTHER exhaustive Record keyed by IntegrationCapability, or any switch with no default that would now be non-exhaustive, or any hardcoded capability array that silently omits credit_check (a missing-but-no-error case, e.g. a label map with optional keys, a filter list, an icon map).\n- i18n: per the portal AGENTS.md, t() must take literal strings. Confirm the new t('Credit Check') and the blurb are literals (not variables). Confirm no raw dynamic value passed to t().\n- TYPE SAFETY: does the ProductCompliancePanel CAPABILITY_REGISTRY entry match the CapabilityDef interface? Does useCapabilityText's label/blurb switch remain EXHAUSTIVE over CapabilityKey (a missing case yields a TS 'not all code paths return' error or undefined return)?\n- SmartSetup prompt: the credit_check output contract — is it coherent (does it tell the AI to map a normalized risk score 0-1 where higher=riskier onto 'score', matching how the runner's outcome engine treats score)? Any contradiction with the sanction_screening contract or the runner's expectations?\n- TEST correctness: read tests/plus-insurance/08-compliance-checks.spec.ts fully. Are the new tests serial-safe (they depend on creditIntegrationId set by an earlier test in the same describe.serial)? Does the round-trip assertion `toEqual({ credit_check: config })` risk failure because the API adds/strips fields (compare to how the existing sanction_screening round-trip test asserts)? Is `autoReject: false` in the config going to round-trip correctly, or will the API drop it (look at how the API persists complianceChecks and whether optional fields like autoReject/messages are echoed back)?\n\nReport findings as HIGH (runtime failure / test will fail), MEDIUM (type error/logic bug/inconsistency), LOW (cleanup), each with exact file:line. If clean, state explicitly \"NO REMAINING HIGH OR MEDIUM ISSUES\". Read real file content; do not guess."}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts"}

1	export type DisableClaimAiAssessmentMode = "none" | "customer" | "all";
2	
3	export type OrganizationType = "insurer" | "broker" | "affinity";
4	
5	export interface Organization {
6	  id: string;
7	  name: string;
8	  displayName?: string;
9	  description?: string;
10	  portalDomain: string;
11	  portalUrl: string;
12	  apiUrl?: string;
13	  portalType: "customer" | "crm";
14	  portalMode: "standalone" | "embedded";
15	  active: boolean;
16	  timezone?: string;
17	  settings?: Record<string, unknown>;
18	  disableClaimAiAssessment?: DisableClaimAiAssessmentMode;
19	  disableClaimMessages?: boolean;
20	  organizationType: OrganizationType;
21	  parentOrganizationId: string | null;
22	  disablePolicyMessages?: boolean;
23	  createdAt: string;
24	  updatedAt: string;
25	}
26	
27	import { RoleLevel } from './permissions';
28	
29	export type CreateOrganization = Omit<
30	  Organization,
31	  "id" | "createdAt" | "updatedAt" | "organizationType" | "parentOrganizationId"
32	> & {
33	  organizationType?: OrganizationType;
34	  parentOrganizationId?: string | null;
35	};
36	export type UpdateOrganization = Partial<CreateOrganization>;
37	
38	export type ModuleCategory = "core" | "business" | "admin" | "analytics" | "integration";
39	
40	export interface ModuleDef {
41	  id: number;
42	  key: string;
43	  name: string;
44	  description?: string;
45	  icon?: string;
46	  route: string;
47	  category: ModuleCategory;
48	  sortOrder?: number;
49	  requiredRole?: RoleLevel;
50	  active: boolean;
51	}
52	
53	export type CreateModuleDef = Omit<ModuleDef, "id">;
54	export type UpdateModuleDef = Partial<CreateModuleDef>;
55	
56	export interface Partner {
57	  id: string;
58	  name: string;
59	  createdAt: string;
60	  updatedAt: string;
61	}
62	
63	export type CreatePartner = Omit<Partner, "id" | "createdAt" | "updatedAt">;
64	export type UpdatePartner = Partial<CreatePartner>;
65	
66	export type PartnerEnvironmentType = "test" | "staging" | "production";
67	
68	export interface PartnerEnvironment {
69	  id: string;
70	  partnerId: string;
71	  environment: PartnerEnvironmentType;
72	  baseUrl: string;
73	  authEndpoint?: string;
74	  tokenEndpoint?: string;
75	}
76	
77	export type CreatePartnerEnvironment = Omit<PartnerEnvironment, "id">;
78	export type UpdatePartnerEnvironment = Partial<CreatePartnerEnvironment>;
79	
80	export type AuthType =
81	  | "client_credentials"
82	  | "username_password"
83	  | "api_key"
84	  | "basic_auth"
85	  | "oauth2_code"
86	  | "custom";
87	
88	export type TokenType = "bearer" | "basic" | "custom";
89	
90	export interface PartnerAuthConfig {
91	  id: string;
92	  partnerEnvironmentId: string;
93	  authType: AuthType;
94	  tokenType: TokenType;
95	  authorizationHeaderFormat?: string;
96	  encryptedCredentials?: string;
97	  active: boolean;
98	}
99	
100	export interface CreatePartnerAuthConfig {
101	  partnerEnvironmentId: string;
102	  authType:
103	    | "client_credentials"
104	    | "username_password"
105	    | "api_key"
106	    | "basic_auth"
107	    | "oauth2_code"
108	    | "custom";
109	  tokenType: "bearer" | "basic" | "custom";
110	  authorizationHeaderFormat?: string;
111	  active: boolean;
112	  // Credential fields (based on authType)
113	  username?: string;
114	  password?: string;
115	  clientId?: string;
116	  clientSecret?: string;
117	  apiKey?: string;
118	}
119	
120	export interface UpdatePartnerAuthConfig {
121	  authType?:
122	    | "client_credentials"
123	    | "username_password"
124	    | "api_key"
125	    | "basic_auth"
126	    | "oauth2_code"
127	    | "custom";
128	  tokenType?: "bearer" | "basic" | "custom";
129	  authorizationHeaderFormat?: string;
130	  active?: boolean;
131	  // Credential fields (only sent if updating)
132	  username?: string;
133	  password?: string;
134	  clientId?: string;
135	  clientSecret?: string;
136	  apiKey?: string;
137	}
138	
139	export interface OrganizationModuleAssignment {
140	  id: number;
141	  organizationId: string;
142	  moduleId: number;
143	  active: boolean;
144	  settings?: Record<string, unknown>;
145	  usePartnerApi?: boolean;
146	  lastAccessed?: string;
147	}
148	
149	export type CreateOrganizationModuleAssignment = Omit<OrganizationModuleAssignment, "id">;
150	export type UpdateOrganizationModuleAssignment = Partial<CreateOrganizationModuleAssignment>;
151	
152	export type HttpMethod = "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
153	
154	export interface ModuleEndpoint {
155	  id: number;
156	  moduleId: number;
157	  method: HttpMethod;
158	  urlPattern: string;
159	  controller?: string;
160	  apiVersion?: string;
161	  functionName?: string;
162	  description?: string;
163	}
164	
165	export type CreateModuleEndpoint = Omit<ModuleEndpoint, "id">;
166	export type UpdateModuleEndpoint = Partial<CreateModuleEndpoint>;
167	
168	export interface PartnerEndpointMapping {
169	  id: number;
170	  partnerId: string;
171	  moduleEndpointId: number;
172	  urlPattern?: string;
173	  active?: boolean;
174	  executionOrder?: number;
175	  excludeFromAutoLoading?: boolean;
176	  httpMethod?: HttpMethod;
177	  urlTemplate?: string;
178	  requestBodyTemplate?: string | null;
179	  responseMapping?: string | null;
180	  dependsOnEndpoint?: number | null;
181	  parameterTransformations?: string | null;
182	}
183	
184	export type CreatePartnerEndpointMapping = Omit<PartnerEndpointMapping, "id">;
185	export type UpdatePartnerEndpointMapping = Partial<CreatePartnerEndpointMapping>;
186	
187	export interface PartnerFieldMapping {
188	  id: number;
189	  partnerEndpointMappingId: number;
190	  partnerFieldPath: string;
191	  dataModelFieldId?: number;
192	  customFieldName?: string;
193	  transformationFunction?: string;
194	  isRequired?: boolean;
195	  defaultValue?: string;
196	  enumMapping?: Record<string, string> | null;
197	  direction?: "request" | "response";
198	}
199	
200	export type CreatePartnerFieldMapping = Omit<PartnerFieldMapping, "id">;
201	export type UpdatePartnerFieldMapping = Partial<CreatePartnerFieldMapping>;
202	
203	export interface ProductModulePartner {
204	  id: number;
205	  productId: number;
206	  moduleId: number;
207	  partnerId: string;
208	  module?: ModuleDef;
209	  partner?: Partner;
210	  createdAt?: string;
211	  updatedAt?: string;
212	}
213	
214	export type CreateProductModulePartner = Omit<
215	  ProductModulePartner,
216	  "id" | "module" | "partner" | "createdAt" | "updatedAt"
217	>;
218	export type UpdateProductModulePartner = Partial<Pick<ProductModulePartner, "partnerId">>;
219	
220	export interface PagedResponse<T> {
221	  status: "success" | "error";
222	  data?: {
223	    items: T[];
224	    total: number;
225	    page: number;
226	    pageSize: number;
227	  };
228	  message?: string;
229	}
230	
231	export interface ListResponse<T> {
232	  status: "success" | "error";
233	  data?: T[];
234	  message?: string;
235	}
236	
237	// ─── External integrations (outbound third-party API framework) ──────────────
238	
239	export type IntegrationCapability =
240	  | "sanction_screening"
241	  | "pep"
242	  | "kyc"
243	  | "adverse_media"
244	  | "fraud_detection"
245	  | "credit_check";
246	
247	// Operations a capability supports. Today every compliance capability has a
248	// single 'check' operation; widen this when a capability gains more.
249	export const CAPABILITY_OPERATIONS: Record<IntegrationCapability, readonly string[]> = {
250	  sanction_screening: ["check"],
251	  pep: ["check"],
252	  kyc: ["check"],
253	  adverse_media: ["check"],
254	  fraud_detection: ["check"],
255	  credit_check: ["check"],
256	};
257	export type IntegrationKind = "generic_rest";
258	export type IntegrationEnvironment = "test" | "staging" | "production";
259	
260	export type IntegrationInvocationMode = "sync" | "async";
261	
262	// Sensible per-capability defaults. Slow review-style providers default to
263	// async so the customer isn't blocked behind document review.
264	export const CAPABILITY_DEFAULT_INVOCATION_MODE: Record<IntegrationCapa

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/products/ProductCompliancePanel.tsx"}

1	"use client";
2	
3	import React, { useCallback, useEffect, useState } from "react";
4	
5	import {
6	  Activity,
7	  AlertTriangle,
8	  Check,
9	  CreditCard,
10	  Eye,
11	  Loader2,
12	  Lock,
13	  Plus,
14	  ShieldCheck,
15	  Trash2,
16	  UserCheck,
17	  Users,
18	  X,
19	  type LucideIcon,
20	} from "lucide-react";
21	
22	import { Button } from "@/app/components/ui/button";
23	import { Input } from "@/app/components/ui/input";
24	import { Switch } from "@/app/components/ui/switch";
25	import { showErrorToast, showSuccessToast } from "@/app/components/Toast";
26	import api from "@/app/src/utils/api";
27	import type {
28	  ComplianceTrigger,
29	  ProductCapabilityConfig,
30	  ProductComplianceChecks,
31	  ProductData,
32	} from "@/app/types/product";
33	import type { ExternalIntegration } from "@/app/types/admin";
34	import { useLMT } from "@/lib/lmt/config";
35	
36	// Capability registry. Each entry renders as a section in the Compliance
37	// panel. Adding a new capability here surfaces it in the UI immediately —
38	// no other code changes required as long as the backend has the capability
39	// registered (see sherpa-api domains/integrations/runner.ts).
40	type CapabilityKey =
41	  | "sanction_screening"
42	  | "pep"
43	  | "kyc"
44	  | "adverse_media"
45	  | "fraud_detection"
46	  | "credit_check";
47	
48	interface CapabilityDef {
49	  key: CapabilityKey;
50	  icon: LucideIcon;
51	  defaultTriggers: ComplianceTrigger[];
52	  defaultOutcomeRules: ProductCapabilityConfig["outcomeRules"];
53	}
54	const CAPABILITY_REGISTRY: CapabilityDef[] = [
55	  {
56	    key: "sanction_screening",
57	    icon: ShieldCheck,
58	    defaultTriggers: ["NEW_BUSINESS", "RENEWAL"],
59	    defaultOutcomeRules: {
60	      passWhen: { maxScore: 0.5 },
61	      failWhen: { minScore: 0.85, onTopics: ["sanction"] },
62	    },
63	  },
64	  {
65	    key: "pep",
66	    icon: Eye,
67	    defaultTriggers: ["NEW_BUSINESS", "RENEWAL"],
68	    defaultOutcomeRules: {
69	      passWhen: { maxScore: 0.5 },
70	      failWhen: { minScore: 0.85, onTopics: ["role.pep"] },
71	    },
72	  },
73	  {
74	    key: "kyc",
75	    icon: UserCheck,
76	    defaultTriggers: ["NEW_BUSINESS"],
77	    defaultOutcomeRules: {
78	      passWhen: { maxScore: 0.5 },
79	      failWhen: { minScore: 0.85, onTopics: ["kyc.failed", "kyc.fraud"] },
80	    },
81	  },
82	  {
83	    key: "adverse_media",
84	    icon: AlertTriangle,
85	    defaultTriggers: ["NEW_BUSINESS", "RENEWAL"],
86	    defaultOutcomeRules: {
87	      passWhen: { maxScore: 0.5 },
88	      failWhen: { minScore: 0.85, onTopics: ["adverse_media"] },
89	    },
90	  },
91	  {
92	    key: "fraud_detection",
93	    icon: Activity,
94	    defaultTriggers: ["CLAIM"],
95	    defaultOutcomeRules: {
96	      passWhen: { maxScore: 0.5 },
97	      failWhen: { minScore: 0.85, onTopics: ["fraud.high_risk"] },
98	    },
99	  },
100	  {
101	    key: "credit_check",
102	    icon: CreditCard,
103	    defaultTriggers: ["NEW_BUSINESS", "RENEWAL"],
104	    defaultOutcomeRules: {
105	      passWhen: { maxScore: 0.5 },
106	      failWhen: { minScore: 0.85, onTopics: ["credit.high_risk"] },
107	    },
108	  },
109	];
110	
111	// Hook-bound text for each capability. lmt-translate requires literal arguments,
112	// so labels and blurbs live here as switch branches keyed off the capability id.
113	function useCapabilityText() {
114	  const { t } = useLMT();
115	  const label = (key: CapabilityKey): string => {
116	    switch (key) {
117	      case "sanction_screening":
118	        return t("Sanction Screening");
119	      case "pep":
120	        return t("PEP Check");
121	      case "kyc":
122	        return t("KYC Verification");
123	      case "adverse_media":
124	        return t("Adverse Media");
125	      case "fraud_detection":
126	        return t("Fraud Detection");
127	      case "credit_check":
128	        return t("Credit Check");
129	    }
130	  };
131	  const blurb = (key: CapabilityKey): string => {
132	    switch (key) {
133	      case "sanction_screening":
134	        return t("Run policy parties against OFAC / EU / UK / OS sanction lists. Blocking matches halt the gate.");
135	      case "pep":
136	        return t("Check if parties are Politically Exposed Persons or close associates. Often runs alongside sanctions.");
137	      case "kyc":
138	        return t("Verify the policyholder's identity (document + selfie or data + bureau check) at onboarding.");
139	      case "adverse_media":
140	        return t("Scan news + watchlists for negative coverage of the parties (regulatory enforcement, criminal proceedings).");
141	      case "fraud_detection":
142	        return t("Score the party / claim for fraud risk via an external bureau. Typically runs at claim creation.");
143	      case "credit_check":
144	        return t("Score the policyholder's credit risk via an external bureau at new business / renewal. High-risk scores halt the gate for review.");
145	    }
146	  };
147	  return { label, blurb };
148	}
149	
150	const ALL_TRIGGERS: ComplianceTrigger[] = [
151	  "NEW_BUSINESS",
152	  "RENEWAL",
153	  "ENDORSEMENT",
154	  "CLAIM",
155	  "MANUAL",
156	];
157	
158	// Person-shaped DataModel categories (other than `personal`, the
159	// policyholder which is always screened). Push a new entry here when a
160	// person-category lands in the DataModel (e.g. `family`, `insureds`).
161	const ADDITIONAL_PARTY_CATEGORIES: string[] = [];
162	
163	const DEFAULT_PARTIES: ProductCapabilityConfig["parties"] = {
164	  policyholder: "personal",
165	  additional: [],
166	};
167	
168	function buildDefaultConfig(cap: CapabilityDef): ProductCapabilityConfig {
169	  return {
170	    enabled: false,
171	    integrationId: "",
172	    triggers: [...cap.defaultTriggers],
173	    parties: { ...DEFAULT_PARTIES, additional: [...DEFAULT_PARTIES.additional] },
174	    outcomeRules: structuredClone(cap.defaultOutcomeRules),
175	    autoReject: false,
176	    messages: { fail: null, review: null },
177	  };
178	}
179	
180	// Backfill missing keys on persisted rows written before the parties/triggers
181	// refactor. Persisted values win; defaults plug the holes.
182	function mergeWithDefaults(
183	  cap: CapabilityDef,
184	  persisted: ProductCapabilityConfig | undefined,
185	): ProductCapabilityConfig {
186	  const defaults = buildDefaultConfig(cap);
187	  if (!persisted) return defaults;
188	  return {
189	    enabled: persisted.enabled ?? defaults.enabled,
190	    integrationId: persisted.integrationId ?? defaults.integrationId,
191	    triggers: Array.isArray(persisted.triggers) ? persisted.triggers : defaults.triggers,
192	    parties: {
193	      policyholder: persisted.parties?.policyholder ?? defaults.parties.policyholder,
194	      additional: Array.isArray(persisted.parties?.additional)
195	        ? persisted.parties.additional
196	        : defaults.parties.additional,
197	    },
198	    outcomeRules: {
199	      passWhen: {
200	        maxScore:
201	          persisted.outcomeRules?.passWhen?.maxScore ?? defaults.outcomeRules.passWhen.maxScore,
202	      },
203	      failWhen: {
204	        minScore:
205	          persisted.outcomeRules?.failWhen?.minScore ?? defaults.outcomeRules.failWhen.minScore,
206	        onTopics: Array.isArray(persisted.outcomeRules?.failWhen?.onTopics)
207	          ? persisted.outcomeRules.failWhen.onTopics
208	          : defaults.outcomeRules.failWhen.onTopics,
209	      },
210	    },
211	    autoReject: persisted.autoReject ?? defaults.autoReject,
212	    messages: {
213	      fail: persisted.messages?.fail ?? defaults.messages?.fail ?? null,
214	      review: persisted.messages?.review ?? defaults.messages?.review ?? null,
215	    },
216	  };
217	}
218	
219	interface ProductResponse {
220	  status: "success" | "error";
221	  data?: ProductData;
222	}
223	
224	interface IntegrationsResponse {
225	  status: "success" | "error";
226	  data?: ExternalIntegration[];
227	}
228	
229	interface Props {
230	  productId: string;
231	}
232	
233	const P

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/IntegrationsTab.tsx"}

{"pattern":"switch.*capability|case.*sanction|if.*===.*sanction","path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src","type":"ts"}

1	"use client";
2	
3	import React, { useCallback, useEffect, useState } from "react";
4	
5	import Link from "next/link";
6	import { Plus } from "lucide-react";
7	
8	import ConfirmDialog from "./ConfirmDialog";
9	
10	import { Button } from "@/app/components/ui/button";
11	import {
12	  Dialog,
13	  DialogContent,
14	  DialogFooter,
15	  DialogHeader,
16	  DialogTitle,
17	} from "@/app/components/ui/dialog";
18	import { Input } from "@/app/components/ui/input";
19	import api from "@/app/src/utils/api";
20	import type {
21	  ExternalIntegration,
22	  CreateExternalIntegration,
23	  UpdateExternalIntegration,
24	  IntegrationCapability,
25	  IntegrationInvocationMode,
26	  IntegrationKind,
27	} from "@/app/types/admin";
28	import { CAPABILITY_DEFAULT_INVOCATION_MODE } from "@/app/types/admin";
29	import { useLMT } from "@/lib/lmt/config";
30	
31	interface IntegrationsResponse {
32	  status: "success" | "error";
33	  data?: ExternalIntegration[];
34	}
35	
36	const CAPABILITIES: IntegrationCapability[] = [
37	  "sanction_screening",
38	  "pep",
39	  "kyc",
40	  "adverse_media",
41	  "fraud_detection",
42	  "credit_check",
43	];
44	const KINDS: IntegrationKind[] = ["generic_rest"];
45	const INVOCATION_MODES: IntegrationInvocationMode[] = ["sync", "async"];
46	
47	const IntegrationsTab: React.FC = () => {
48	  const { t } = useLMT();
49	  const [integrations, setIntegrations] = useState<ExternalIntegration[]>([]);
50	  const [loading, setLoading] = useState(false);
51	  const [error, setError] = useState<string>("");
52	  const [formOpen, setFormOpen] = useState(false);
53	  const [editing, setEditing] = useState<ExternalIntegration | null>(null);
54	  const [name, setName] = useState("");
55	  const [slug, setSlug] = useState("");
56	  const [capability, setCapability] = useState<IntegrationCapability>("sanction_screening");
57	  const [kind, setKind] = useState<IntegrationKind>("generic_rest");
58	  const [active, setActive] = useState(true);
59	  const [invocationMode, setInvocationMode] = useState<IntegrationInvocationMode>("sync");
60	  const [syncTimeoutMs, setSyncTimeoutMs] = useState<number>(5000);
61	  const [deleteId, setDeleteId] = useState<string | null>(null);
62	
63	  const load = useCallback(async () => {
64	    try {
65	      setLoading(true);
66	      setError("");
67	      const res = await api.get<IntegrationsResponse>("/external-integrations");
68	      setIntegrations(res.data.data || []);
69	    } catch {
70	      setError(t("Failed to fetch external integrations"));
71	    } finally {
72	      setLoading(false);
73	    }
74	  }, [t]);
75	
76	  useEffect(() => {
77	    void load();
78	  }, [load]);
79	
80	  const openCreate = () => {
81	    setEditing(null);
82	    setName("");
83	    setSlug("");
84	    setCapability("sanction_screening");
85	    setKind("generic_rest");
86	    setActive(true);
87	    setInvocationMode(CAPABILITY_DEFAULT_INVOCATION_MODE.sanction_screening);
88	    setSyncTimeoutMs(5000);
89	    setFormOpen(true);
90	  };
91	
92	  const openEdit = (row: ExternalIntegration) => {
93	    setEditing(row);
94	    setName(row.name);
95	    setSlug(row.slug);
96	    setCapability(row.capability);
97	    setKind(row.kind);
98	    setActive(row.active);
99	    setInvocationMode(row.invocationMode);
100	    setSyncTimeoutMs(row.syncTimeoutMs);
101	    setFormOpen(true);
102	  };
103	
104	  const submit = async () => {
105	    try {
106	      setLoading(true);
107	      setError("");
108	      const payload = {
109	        name,
110	        slug,
111	        capability,
112	        kind,
113	        // First env created via Smart Setup or Environments tab becomes the
114	        // default automatically (server-side). When the integration is brand
115	        // new we still need to send *something* matching the column's NOT
116	        // NULL + ENUM constraint — "production" is the safe placeholder; it
117	        // is overwritten the moment the first env row lands.
118	        defaultEnvironment: editing ? editing.defaultEnvironment : "production" as const,
119	        active,
120	        invocationMode,
121	        syncTimeoutMs,
122	      };
123	      if (editing) {
124	        const update: UpdateExternalIntegration = payload;
125	        await api.put(`/external-integrations/${editing.id}`, update);
126	      } else {
127	        const create: CreateExternalIntegration = payload;
128	        await api.post(`/external-integrations`, create);
129	      }
130	      setFormOpen(false);
131	      setEditing(null);
132	      await load();
133	    } catch {
134	      setError(t("Failed to save external integration"));
135	    } finally {
136	      setLoading(false);
137	    }
138	  };
139	
140	  const confirmDelete = async () => {
141	    if (!deleteId) return;
142	    try {
143	      setLoading(true);
144	      await api.delete(`/external-integrations/${deleteId}`);
145	      setDeleteId(null);
146	      await load();
147	    } catch {
148	      setError(t("Failed to delete external integration"));
149	    } finally {
150	      setLoading(false);
151	    }
152	  };
153	
154	  return (
155	    <div className="space-y-4">
156	      <div className="flex items-start justify-between">
157	        <div>
158	          <h2 className="text-xl font-semibold">{t("External Integrations")}</h2>
159	          <p className="mt-1 text-sm text-gray-600">
160	            {t(
161	              "Configure outbound third-party API integrations (sanction screening, fraud detection, KYC, ...). Generic REST providers can be added without writing code.",
162	            )}
163	          </p>
164	        </div>
165	        <Button onClick={openCreate}>
166	          <Plus className="mr-2 h-4 w-4" />
167	          {t("Add Integration")}
168	        </Button>
169	      </div>
170	
171	      {error && (
172	        <div className="rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700">
173	          {error}
174	        </div>
175	      )}
176	
177	      <div className="overflow-hidden rounded-lg border border-gray-200 bg-white">
178	        <table className="min-w-full divide-y divide-gray-200">
179	          <thead className="bg-gray-50">
180	            <tr>
181	              <th className="px-4 py-2 text-left text-xs font-semibold uppercase text-gray-500">
182	                {t("Name")}
183	              </th>
184	              <th className="px-4 py-2 text-left text-xs font-semibold uppercase text-gray-500">
185	                {t("Slug")}
186	              </th>
187	              <th className="px-4 py-2 text-left text-xs font-semibold uppercase text-gray-500">
188	                {t("Capability")}
189	              </th>
190	              <th className="px-4 py-2 text-left text-xs font-semibold uppercase text-gray-500">
191	                {t("Kind")}
192	              </th>
193	              <th className="px-4 py-2 text-left text-xs font-semibold uppercase text-gray-500">
194	                {t("Default Env")}
195	              </th>
196	              <th className="px-4 py-2 text-left text-xs font-semibold uppercase text-gray-500">
197	                {t("Status")}
198	              </th>
199	              <th className="px-4 py-2"></th>
200	            </tr>
201	          </thead>
202	          <tbody className="divide-y divide-gray-200">
203	            {loading && integrations.length === 0 && (
204	              <tr>
205	                <td colSpan={7} className="px-4 py-6 text-center text-sm text-gray-500">
206	                  {t("Loading integrations...")}
207	                </td>
208	              </tr>
209	            )}
210	            {!loading && integrations.length === 0 && (
211	              <tr>
212	                <td colSpan={7} className="px-4 py-6 text-center text-sm text-gray-500">
213	                  {t("No integrations configured yet.")}
214	                </td>
215	              </tr>
216	            )}
217	            {integrations.map((row) => (
218	              <tr key={row.id} className="hove

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/compliance/ComplianceChecksSection.tsx"}

No files found

1	"use client";
2	
3	import React, { useCallback, useEffect, useState } from "react";
4	
5	import {
6	  ShieldAlert,
7	  ShieldCheck,
8	  ShieldX,
9	  Loader2,
10	  ChevronDown,
11	} from "lucide-react";
12	
13	import SanctionScreeningPanel from "@/app/components/screening/SanctionScreeningPanel";
14	import api from "@/app/src/utils/api";
15	import { usePermission } from "@/app/src/hooks/usePermission";
16	import type { SanctionScreening, SanctionScreeningOutcome, SanctionScreeningStatus } from "@/app/types/admin";
17	import { PERMISSIONS } from "@/app/types/permissions";
18	import { useLMT } from "@/lib/lmt/config";
19	
20	interface ListResponse {
21	  status: "success" | "error";
22	  data?: SanctionScreening[];
23	}
24	
25	interface ComplianceChecksSectionProps {
26	  /** Pass policyId (the policy UUID stored on ComplianceCheck.policyOrderId) to scope
27	   * to a policy issuance flow; pass claimRecordId to scope to a Claim. */
28	  policyId?: string;
29	  claimRecordId?: string;
30	  /** Fired after any check is updated (decision recorded, rerun, etc.) so the
31	   *  parent page can refetch the policy/claim whose status may have changed. */
32	  onChanged?: () => void;
33	}
34	
35	function badgeClass(status: SanctionScreeningStatus, outcome: SanctionScreeningOutcome | null): string {
36	  if (outcome === "pass") return "bg-emerald-50 text-emerald-700 border-emerald-200";
37	  if (outcome === "review") return "bg-amber-50 text-amber-700 border-amber-200";
38	  if (outcome === "fail") return "bg-red-50 text-red-700 border-red-200";
39	  if (status === "processing") return "bg-blue-50 text-blue-700 border-blue-200";
40	  if (status === "pending") return "bg-gray-50 text-gray-700 border-gray-200";
41	  if (status === "failed") return "bg-red-50 text-red-700 border-red-200";
42	  return "bg-gray-50 text-gray-700 border-gray-200";
43	}
44	
45	type BadgeLabelKey =
46	  | "approved"
47	  | "rejected"
48	  | "pass"
49	  | "fail"
50	  | "review"
51	  | "processing"
52	  | "pending"
53	  | "error";
54	
55	function badgeLabelKey(row: SanctionScreening): BadgeLabelKey {
56	  if (row.manualDecision === "approved") return "approved";
57	  if (row.manualDecision === "rejected") return "rejected";
58	  if (row.outcome === "pass") return "pass";
59	  if (row.outcome === "fail") return "fail";
60	  if (row.outcome === "review") return "review";
61	  if (row.status === "processing") return "processing";
62	  if (row.status === "pending") return "pending";
63	  return "error";
64	}
65	
66	
67	const ComplianceChecksSection: React.FC<ComplianceChecksSectionProps> = ({
68	  policyId,
69	  claimRecordId,
70	  onChanged,
71	}) => {
72	  const { t } = useLMT();
73	  // lmt-translate requires literal arguments. Map known capabilities to literal
74	  // calls; unknown ones fall back to the raw slug.
75	  const capabilityLabel = (capability: string | undefined): string => {
76	    switch (capability) {
77	      case "sanction_screening":
78	        return t("Sanction Screening");
79	      case "pep":
80	        return t("PEP");
81	      case "kyc":
82	        return t("KYC");
83	      case "adverse_media":
84	        return t("Adverse Media");
85	      case "fraud_detection":
86	        return t("Fraud Detection");
87	      case "credit_check":
88	        return t("Credit Check");
89	      case undefined:
90	      case "":
91	        return t("Compliance");
92	      default:
93	        return capability;
94	    }
95	  };
96	  const badgeLabel = (row: SanctionScreening): string => {
97	    switch (badgeLabelKey(row)) {
98	      case "approved":
99	        return t("approved");
100	      case "rejected":
101	        return t("rejected");
102	      case "pass":
103	        return t("pass");
104	      case "fail":
105	        return t("fail");
106	      case "review":
107	        return t("review");
108	      case "processing":
109	        return t("processing");
110	      case "pending":
111	        return t("pending");
112	      case "error":
113	        return t("error");
114	    }
115	  };
116	  const canDecide = usePermission(PERMISSIONS.integrations.update.value);
117	  const [rows, setRows] = useState<SanctionScreening[]>([]);
118	  const [loading, setLoading] = useState(false);
119	  const [error, setError] = useState("");
120	  const [expanded, setExpanded] = useState<Record<string, boolean>>({});
121	
122	  const load = useCallback(async () => {
123	    if (!policyId && !claimRecordId) return;
124	    try {
125	      setLoading(true);
126	      setError("");
127	      const params: Record<string, unknown> = { limit: 50 };
128	      if (claimRecordId) params.claimRecordId = claimRecordId;
129	      // Policy UUID is stored on ComplianceCheck.policyOrderId (legacy column name).
130	      if (policyId) params.policyOrderId = policyId;
131	      const res = await api.get<ListResponse>("/sanction-screenings", { params });
132	      setRows(res.data.data ?? []);
133	    } catch {
134	      setError(t("Failed to load compliance checks"));
135	    } finally {
136	      setLoading(false);
137	    }
138	  }, [policyId, claimRecordId, t]);
139	
140	  useEffect(() => {
141	    void load();
142	  }, [load]);
143	
144	  if (!policyId && !claimRecordId) return null;
145	  if (!loading && rows.length === 0 && !error) return null;
146	
147	  return (
148	    <div className="rounded-lg border border-gray-200 bg-white shadow-sm">
149	      <div className="rounded-t-lg border-b border-gray-100 bg-gradient-to-r from-gray-50 to-white p-4">
150	        <div className="flex items-center gap-2">
151	          <ShieldCheck className="h-5 w-5 text-gray-700" />
152	          <h2 className="text-lg font-medium text-gray-900">{t("Compliance")}</h2>
153	          {rows.length > 0 && (
154	            <span className="ml-2 rounded-full bg-gray-100 px-2 py-0.5 text-xs text-gray-700">
155	              {rows.length}
156	            </span>
157	          )}
158	        </div>
159	      </div>
160	
161	      <div className="space-y-2 p-4">
162	        {loading && rows.length === 0 && (
163	          <div className="flex items-center gap-2 text-sm text-gray-600">
164	            <Loader2 className="h-4 w-4 animate-spin" />
165	            {t("Loading...")}
166	          </div>
167	        )}
168	        {error && (
169	          <div className="rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700">
170	            {error}
171	          </div>
172	        )}
173	        {rows.map((row) => {
174	          const isOpen = !!expanded[row.id];
175	          const Icon = row.outcome === "pass" || row.manualDecision === "approved"
176	            ? ShieldCheck
177	            : row.outcome === "fail" || row.manualDecision === "rejected"
178	              ? ShieldX
179	              : ShieldAlert;
180	          return (
181	            <div key={row.id} className="overflow-hidden rounded-md border border-gray-200">
182	              <button
183	                type="button"
184	                onClick={() => setExpanded((prev) => ({ ...prev, [row.id]: !prev[row.id] }))}
185	                className="flex w-full items-center justify-between px-3 py-2 text-left hover:bg-gray-50"
186	              >
187	                <div className="flex items-center gap-2">
188	                  <Icon className="h-4 w-4 text-gray-700" />
189	                  <span className="text-sm font-medium text-gray-900">
190	                    {capabilityLabel(row.capability)}
191	                  </span>
192	                  <span className="text-[10px] uppercase tracking-wide text-gray-400">
193	                    {row.triggerType}
194	                  </span>
195	                </div>
196	                <div className="flex items-center gap-2 text-xs">
197	                  <span
198	                    className={`inline-flex items-center rounded-full border px-2 py-0.5 font-medium ${badgeClass(
199	                      row.status,
200	                      row.outcome,
201	                    )}`}
202	  

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/screening/SanctionScreeningPanel.tsx"}

{"pattern":"EXCLUDED|BLOCKED|FILTER.*capability|capability.*filter","path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src","type":"ts"}

1	"use client";
2	
3	import React, { useCallback, useEffect, useRef, useState } from "react";
4	
5	import {
6	  ShieldAlert,
7	  ShieldCheck,
8	  ShieldX,
9	  Loader2,
10	  CheckCircle2,
11	  XCircle,
12	  Clock,
13	  ChevronDown,
14	  ChevronRight,
15	  Copy,
16	  Paperclip,
17	  X,
18	  MessageSquare,
19	} from "lucide-react";
20	
21	import { Button } from "@/app/components/ui/button";
22	import {
23	  Dialog,
24	  DialogContent,
25	  DialogFooter,
26	  DialogHeader,
27	  DialogTitle,
28	} from "@/app/components/ui/dialog";
29	import { Textarea } from "@/app/components/ui/textarea";
30	import api from "@/app/src/utils/api";
31	import type {
32	  SanctionScreening,
33	  SanctionScreeningOutcome,
34	  SanctionScreeningStatus,
35	} from "@/app/types/admin";
36	import { useLMT } from "@/lib/lmt/config";
37	
38	interface ScreeningResponse {
39	  status: "success" | "error";
40	  data?: SanctionScreening;
41	}
42	
43	interface SanctionScreeningPanelProps {
44	  screeningId: string;
45	  canDecide?: boolean;
46	  /** Fired on every load (initial mount + refresh). Use for read-only mirroring. */
47	  onUpdated?: (row: SanctionScreening) => void;
48	  /** Fired only after a user-driven mutation (decision/rerun). Use to refresh
49	   *  upstream views without triggering an unmount-remount on accordion expand. */
50	  onMutated?: (row: SanctionScreening | null) => void;
51	}
52	
53	function statusBadgeClass(status: SanctionScreeningStatus): string {
54	  if (status === "completed") return "bg-green-50 text-green-700 border-green-200";
55	  if (status === "processing") return "bg-blue-50 text-blue-700 border-blue-200";
56	  if (status === "pending") return "bg-amber-50 text-amber-700 border-amber-200";
57	  return "bg-red-50 text-red-700 border-red-200";
58	}
59	
60	function outcomeBadgeClass(outcome: SanctionScreeningOutcome | null): string {
61	  if (outcome === "pass") return "bg-green-50 text-green-700 border-green-200";
62	  if (outcome === "review") return "bg-orange-50 text-orange-700 border-orange-200";
63	  if (outcome === "fail") return "bg-red-50 text-red-700 border-red-200";
64	  return "bg-gray-50 text-gray-600 border-gray-200";
65	}
66	
67	function partyDisplayName(data: Record<string, unknown>): string {
68	  const first = typeof data.firstName === "string" ? data.firstName : "";
69	  const last = typeof data.lastName === "string" ? data.lastName : "";
70	  const full = `${first} ${last}`.trim();
71	  if (full) return full;
72	  if (typeof data.companyName === "string") return data.companyName;
73	  if (typeof data.name === "string") return data.name;
74	  if (typeof data.email === "string") return data.email;
75	  return "(unnamed)";
76	}
77	
78	const SanctionScreeningPanel: React.FC<SanctionScreeningPanelProps> = ({
79	  screeningId,
80	  canDecide,
81	  onUpdated,
82	  onMutated,
83	}) => {
84	  const { t } = useLMT();
85	  // lmt-translate requires literal arguments; map known capability ids to
86	  // literal calls and fall back to the raw slug for unknown ones.
87	  const capabilityLabel = (capability: string | undefined): string => {
88	    switch (capability) {
89	      case "sanction_screening":
90	        return t("Sanction Screening");
91	      case "pep":
92	        return t("PEP Check");
93	      case "kyc":
94	        return t("KYC Verification");
95	      case "adverse_media":
96	        return t("Adverse Media");
97	      case "fraud_detection":
98	        return t("Fraud Detection");
99	      case "credit_check":
100	        return t("Credit Check");
101	      case undefined:
102	      case "":
103	        return t("Compliance");
104	      default:
105	        return capability;
106	    }
107	  };
108	  const statusLabel = (status: SanctionScreeningStatus): string => {
109	    switch (status) {
110	      case "pending":
111	        return t("pending");
112	      case "processing":
113	        return t("processing");
114	      case "completed":
115	        return t("completed");
116	      case "failed":
117	        return t("failed");
118	    }
119	  };
120	  const outcomeLabel = (outcome: SanctionScreeningOutcome): string => {
121	    switch (outcome) {
122	      case "pass":
123	        return t("pass");
124	      case "fail":
125	        return t("fail");
126	      case "review":
127	        return t("review");
128	    }
129	  };
130	  const decisionLabel = (decision: "approved" | "rejected"): string => {
131	    switch (decision) {
132	      case "approved":
133	        return t("approved");
134	      case "rejected":
135	        return t("rejected");
136	    }
137	  };
138	  const [row, setRow] = useState<SanctionScreening | null>(null);
139	  const [loading, setLoading] = useState(false);
140	  const [error, setError] = useState("");
141	  const [decisionOpen, setDecisionOpen] = useState<"approve" | "reject" | "request_info" | null>(null);
142	  const [decisionMessage, setDecisionMessage] = useState("");
143	  const [decisionFiles, setDecisionFiles] = useState<File[]>([]);
144	  const [submitting, setSubmitting] = useState(false);
145	  const decisionFileRef = useRef<HTMLInputElement>(null);
146	  const [rawOpen, setRawOpen] = useState(false);
147	  const [contextOpen, setContextOpen] = useState(false);
148	  const [copied, setCopied] = useState(false);
149	
150	  // Stash onUpdated in a ref so the `load` callback identity stays stable
151	  // across parent re-renders. Otherwise an inline-defined onUpdated would
152	  // invalidate `load` on every render and the useEffect below would re-fetch
153	  // in a loop.
154	  const onUpdatedRef = useRef(onUpdated);
155	  useEffect(() => {
156	    onUpdatedRef.current = onUpdated;
157	  }, [onUpdated]);
158	
159	  const load = useCallback(async () => {
160	    try {
161	      setLoading(true);
162	      setError("");
163	      const res = await api.get<ScreeningResponse>(`/sanction-screenings/${screeningId}`);
164	      const fetched = res.data.data ?? null;
165	      setRow(fetched);
166	      if (fetched) onUpdatedRef.current?.(fetched);
167	    } catch {
168	      setError(t("Failed to load screening"));
169	    } finally {
170	      setLoading(false);
171	    }
172	  }, [screeningId, t]);
173	
174	  useEffect(() => {
175	    void load();
176	  }, [load]);
177	
178	  const defaultMessageFor = (kind: "approve" | "reject" | "request_info"): string => {
179	    if (kind === "approve") {
180	      return t(
181	        "Good news — your application passed our compliance review and is now active. You will receive a confirmation shortly.",
182	      );
183	    }
184	    if (kind === "reject") {
185	      return t(
186	        "We were unable to approve your application after our compliance review. If you would like to discuss this decision please reply to this message.",
187	      );
188	    }
189	    return "";
190	  };
191	
192	  const uploadDecisionFiles = async (): Promise<
193	    { blobPath: string; filename: string; contentType: string }[]
194	  > => {
195	    if (decisionFiles.length === 0) return [];
196	    const folderId = crypto.randomUUID().replace(/-/g, "");
197	    const urlRes = await api.post(
198	      "/data/upload-urls",
199	      {
200	        origin: "compliance-decision",
201	        files: decisionFiles.map((f) => ({
202	          path: `compliance/${folderId}/${f.name}`,
203	          contentType: f.type || "application/octet-stream",
204	        })),
205	      },
206	      { sherpaAdmin: false },
207	    );
208	    const signed = urlRes.data.files as Array<{ id: string; uploadUrl: string; path: string }>;
209	    const uploaded: { blobPath: string; filename: string; contentType: string }[] = [];
210	    for (let i = 0; i < signed.length; i++) {
211	      const { uploadUrl, path } = signed[i];
212	      const putRes = await fetch(uploadUrl, {
213	        method: "PUT",
214	        body: decisionFiles[i],
215	        headers: {
216	          "Content-Type": decisionFiles[i].type || "application/octet-stream",
217	          "x-ms-blob-type": "BlockBlob",
218	 

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/policy-management/screening/page.tsx"}

Found 11 files
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/pricing/parameterUtils.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/policyStatusService.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/policyRenewalService.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/policyIssuanceService.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/services/currencyService.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_OrganizationPolicyStatus.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.03.20T00.00.00.seed-uf-currency-rate.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.03.04T00.00.01.seed-additional-test-organizations.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2026.01.08T00.00.04.seed-test-organization-modules-for-sherpa-test.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/db/migrations/2025.07.20T00.01.30.update-countries-regions-data.ts
/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/controllers/policyOrderController.ts

1	"use client";
2	
3	import React, { useCallback, useEffect, useState } from "react";
4	
5	import { ShieldAlert, Loader2 } from "lucide-react";
6	
7	import SanctionScreeningPanel from "@/app/components/screening/SanctionScreeningPanel";
8	import AppLayout from "@/app/components/AppLayout";
9	import { ProtectedRoute } from "@/app/components/ProtectedRoute";
10	import { CRMOnlyRoute } from "@/app/components/UserTypeRoute";
11	import PolicyManagementShell from "@/app/components/policy-management/PolicyManagementShell";
12	import api from "@/app/src/utils/api";
13	import { usePermission } from "@/app/src/hooks/usePermission";
14	import type { SanctionScreening, ScreenedParty } from "@/app/types/admin";
15	
16	function partySummary(p: ScreenedParty): string {
17	  const first = typeof p.data.firstName === "string" ? p.data.firstName : "";
18	  const last = typeof p.data.lastName === "string" ? p.data.lastName : "";
19	  const full = `${first} ${last}`.trim();
20	  if (full) return full;
21	  if (typeof p.data.companyName === "string") return p.data.companyName;
22	  if (typeof p.data.name === "string") return p.data.name;
23	  return p.sourcePath;
24	}
25	import { PERMISSIONS } from "@/app/types/permissions";
26	import { useLMT } from "@/lib/lmt/config";
27	
28	interface ListResponse {
29	  status: "success" | "error";
30	  data?: SanctionScreening[];
31	}
32	
33	const ScreeningQueuePage: React.FC = () => {
34	  const { t } = useLMT();
35	  const canDecide = usePermission(PERMISSIONS.integrations.update.value);
36	  const [rows, setRows] = useState<SanctionScreening[]>([]);
37	  const [loading, setLoading] = useState(false);
38	  const [error, setError] = useState("");
39	  const [selected, setSelected] = useState<string | null>(null);
40	
41	  const capabilityLabel = (capability: string | undefined): string => {
42	    switch (capability) {
43	      case "sanction_screening":
44	        return t("Sanction Screening");
45	      case "pep":
46	        return t("PEP Check");
47	      case "kyc":
48	        return t("KYC Verification");
49	      case "adverse_media":
50	        return t("Adverse Media");
51	      case "fraud_detection":
52	        return t("Fraud Detection");
53	      case "credit_check":
54	        return t("Credit Check");
55	      case undefined:
56	      case "":
57	        return t("Compliance");
58	      default:
59	        return capability;
60	    }
61	  };
62	
63	  const load = useCallback(async () => {
64	    try {
65	      setLoading(true);
66	      setError("");
67	      const res = await api.get<ListResponse>("/sanction-screenings", {
68	        params: { pendingReview: true, limit: 50 },
69	      });
70	      const list = res.data.data ?? [];
71	      setRows(list);
72	      setSelected((current: string | null) =>
73	        current === null && list.length > 0 ? list[0].id : current,
74	      );
75	    } catch {
76	      setError(t("Failed to load compliance checks"));
77	    } finally {
78	      setLoading(false);
79	    }
80	  }, [t]);
81	
82	  useEffect(() => {
83	    void load();
84	  }, [load]);
85	
86	  return (
87	    <ProtectedRoute>
88	      <CRMOnlyRoute>
89	        <AppLayout>
90	          <PolicyManagementShell active="screening">
91	            <div className="space-y-4">
92	              <div className="flex items-start justify-between">
93	                <div className="flex items-center gap-2">
94	                  <ShieldAlert className="h-5 w-5 text-orange-600" />
95	                  <div>
96	                    <h2 className="text-lg font-semibold">{t("Compliance Checks Queue")}</h2>
97	                    <p className="mt-1 text-sm text-gray-600">
98	                      {t(
99	                        "Pending review and failed compliance checks. Users with the right permission can approve or reject to unblock the gated PolicyOrder.",
100	                      )}
101	                    </p>
102	                  </div>
103	                </div>
104	              </div>
105	
106	              {error && (
107	                <div className="rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700">
108	                  {error}
109	                </div>
110	              )}
111	
112	              <div className="grid grid-cols-1 gap-4 lg:grid-cols-[400px_1fr]">
113	                <div className="overflow-hidden rounded-lg border border-gray-200 bg-white">
114	                  {loading && rows.length === 0 && (
115	                    <div className="flex items-center gap-2 p-4 text-sm text-gray-600">
116	                      <Loader2 className="h-4 w-4 animate-spin" />
117	                      {t("Loading compliance checks...")}
118	                    </div>
119	                  )}
120	                  {!loading && rows.length === 0 && (
121	                    <div className="p-6 text-center text-sm text-gray-500">
122	                      {t("No compliance checks awaiting review.")}
123	                    </div>
124	                  )}
125	                  <ul className="divide-y divide-gray-200">
126	                    {rows.map((row) => (
127	                      <li key={row.id}>
128	                        <button
129	                          type="button"
130	                          onClick={() => setSelected(row.id)}
131	                          className={`w-full px-4 py-3 text-left hover:bg-gray-50 ${
132	                            selected === row.id ? "bg-amber-50" : ""
133	                          }`}
134	                        >
135	                          <div className="flex items-center justify-between">
136	                            <div className="flex items-center gap-2">
137	                              <span className="rounded-full border border-gray-200 bg-gray-50 px-2 py-0.5 text-xs font-medium text-gray-700">
138	                                {capabilityLabel(row.capability)}
139	                              </span>
140	                              <span className="text-xs text-gray-500">{row.triggerType}</span>
141	                            </div>
142	                            <div className="text-xs">
143	                              {row.outcome === "fail" ? (
144	                                <span className="rounded-full border border-red-200 bg-red-50 px-2 py-0.5 font-medium text-red-700">
145	                                  {t("fail")}
146	                                </span>
147	                              ) : (
148	                                <span className="rounded-full border border-orange-200 bg-orange-50 px-2 py-0.5 font-medium text-orange-700">
149	                                  {t("review")}
150	                                </span>
151	                              )}
152	                            </div>
153	                          </div>
154	                          <div className="mt-1 truncate text-sm font-medium text-gray-900">
155	                            {row.screenedParties.length > 0
156	                              ? partySummary(row.screenedParties[0])
157	                              : row.id}
158	                          </div>
159	                          <div className="mt-0.5 text-xs text-gray-500">
160	                            {new Date(row.createdAt).toLocaleString()}
161	                          </div>
162	                        </button>
163	                      </li>
164	                    ))}
165	                  </ul>
166	                </div>
167	
168	                <div>
169	                  {selected ? (
170	                    <SanctionScreeningPanel
171	                      screeningId={selected}
172	                      canDecide={canDecide}
173	                      onUpdated={() => {
174	                        void load();
175	                      }}
176	                    />
177	                  ) : (
178	                    <div className="rounded-lg border border-gray-200 bg-white p-6 text-center text-sm text-gray-500">
179	        

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/externalIntegrationSmartSetup.ts"}

1	export type IntegrationCapability = "sanction_screening" | "credit_check";
2	export type IntegrationHttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
3	export type SmartSetupSourceKind = "curl" | "postman" | "openapi" | "raw";
4	
5	export interface SmartSetupDataModelFieldRef {
6	  id: number;
7	  name: string;
8	  label: string;
9	  description?: string;
10	  type?: string;
11	}
12	
13	export interface ExternalIntegrationSmartSetupInput {
14	  capability: IntegrationCapability;
15	  /** "screen" for sanction_screening today. Capabilities define their own operation names. */
16	  operation: string;
17	  sourceKind: SmartSetupSourceKind;
18	  /** Raw text of the imported source (cURL string, Postman JSON, OpenAPI JSON/YAML). */
19	  source: string;
20	  /** Pre-extracted hint when the client has already parsed enough to identify
21	   * a single endpoint (e.g. OpenAPI operation `POST /match/{dataset}`). */
22	  sourceHint?: string;
23	  /** Sample JSON response if the user pasted one alongside the import — used
24	   * for both responseMapping inference and to seed the inbound field mappings. */
25	  jsonResponseInput?: string;
26	  dataModelFields: SmartSetupDataModelFieldRef[];
27	}
28	
29	export interface LLMConfig {
30	  model: string;
31	  thinkingLevel: string;
32	  prompt: string;
33	  temperature: number;
34	  maxTokens: number;
35	}
36	
37	const CAPABILITY_OUTPUT_CONTRACT: Record<IntegrationCapability, string> = {
38	  sanction_screening: `
39	The integration runner invokes operation='screen' with this typed input shape:
40	  {
41	    "parties": [
42	      { "role": "policyholder" | "insured" | "beneficiary",
43	        "firstName": string, "lastName": string,
44	        "dateOfBirth": string | null, "nationality": string | null }
45	    ]
46	  }
47	
48	The runner expects the rendered response to expose a 'matches' key
49	containing an array of objects with at least:
50	  { "entityId": string, "entityName": string, "score": number,
51	    "topics": string[], "datasets": string[], "sourceUrl": string | null }
52	
53	The responseMapping field MUST lift the provider's matches array under the
54	key "matches". Inbound field mappings then alias each match's provider
55	fields onto entityId / entityName / score / topics / datasets / sourceUrl.
56	`,
57	  credit_check: `
58	The integration runner invokes operation='check' with this typed input shape:
59	  {
60	    "parties": [
61	      { "role": "policyholder" | "insured" | "beneficiary",
62	        "firstName": string, "lastName": string,
63	        "dateOfBirth": string | null, "nationality": string | null }
64	    ]
65	  }
66	Credit bureaus usually also key on a national identifier / address — map those
67	from the AVAILABLE DATA MODEL FIELDS in the outbound field mappings.
68	
69	The runner reuses the sanction-check result shape: the rendered response MUST
70	expose a 'matches' array whose objects carry at least:
71	  { "entityId": string, "entityName": string, "score": number,
72	    "topics": string[], "datasets": string[], "sourceUrl": string | null }
73	
74	CRITICAL — score is a NORMALISED CREDIT-RISK score in [0,1] where HIGHER means
75	RISKIER (more likely to be declined), NOT a raw bureau score like FICO 300-850.
76	The outcome engine fails/blocks on HIGH score, so a provider scale where high =
77	good MUST be inverted via a transformation/derived field before it lands on
78	'score'. Put the bureau's decision/reason codes (e.g. "credit.high_risk",
79	"credit.default", "credit.thin_file") into 'topics', the assessed party's name
80	into 'entityName', and the bureau subject reference into 'entityId'.
81	`,
82	};
83	
84	export function buildExternalIntegrationSmartSetupPrompt(
85	  input: ExternalIntegrationSmartSetupInput,
86	): LLMConfig {
87	  const { capability, operation, sourceKind, source, sourceHint, jsonResponseInput, dataModelFields } =
88	    input;
89	
90	  const dataModelFieldsReference =
91	    dataModelFields.length > 0
92	      ? dataModelFields
93	          .map((f) => {
94	            const parts = [
95	              `${f.name} (ID: ${f.id})`,
96	              `Label: "${f.label}"`,
97	              f.description ? `Description: "${f.description}"` : null,
98	              f.type ? `Type: ${f.type}` : null,
99	            ].filter(Boolean);
100	            return `  - ${parts.join(", ")}`;
101	          })
102	          .join("\n")
103	      : "  (no DataModel fields supplied — fall back to customFieldName paths)";
104	
105	  const capabilityContract =
106	    CAPABILITY_OUTPUT_CONTRACT[capability] ??
107	    `Project-defined capability '${capability}'. Use sensible defaults; the responseMapping must expose the keys the runner expects for this capability.`;
108	
109	  const sourceLabel = {
110	    curl: "cURL command",
111	    postman: "Postman collection (v2.1)",
112	    openapi: "OpenAPI 3.x specification",
113	    raw: "Raw integration source",
114	  }[sourceKind];
115	
116	  const prompt = `You are an API-integration onboarding expert. The user pasted a ${sourceLabel} for a third-party API. Produce a single JSON bundle that configures Sherpa's external-integration runner end-to-end: environment, auth config, request template, and field mappings. The bundle is consumed by an admin UI which previews and then persists each row.
117	
118	CAPABILITY: ${capability}
119	OPERATION: ${operation}
120	${capabilityContract}
121	
122	${sourceHint ? `OPERATION HINT: ${sourceHint}\n` : ""}SOURCE (${sourceKind}):
123	${source}
124	${jsonResponseInput ? `\nSAMPLE JSON RESPONSE (for response shape + inbound mappings):\n${jsonResponseInput}\n` : ""}
125	
126	AVAILABLE DATA MODEL FIELDS (use these for inbound semantic matches; for outbound, prefer the canonical capability input fields like parties.0.firstName):
127	${dataModelFieldsReference}
128	
129	YOUR TASKS:
130	
131	1. ENVIRONMENT
132	   - environment: "test" by default. If the source URL contains "sandbox" / "staging" / "stage", use that label; if "prod" / "production" / no qualifier, use "production".
133	   - baseUrl: the URL up to and including the host (https://host[:port]). No path. Strip trailing slash.
134	   - authEndpoint: when the source declares a separate authorize endpoint (e.g. OpenAPI security flow with authorizationUrl), put the absolute URL here; else null.
135	   - tokenEndpoint: same idea for token endpoints (OAuth tokenUrl); else null.
136	
137	2. AUTH CONFIG
138	   Detect the auth scheme from the source:
139	   - api_key: Authorization header like "ApiKey ..." or "Bearer ..." with a single opaque token; or query/header named X-API-Key.
140	   - client_credentials: OAuth2 with tokenUrl that exchanges client_id + client_secret for a Bearer token.
141	   - username_password: HTTP Basic-shaped flow that exchanges username + password for a token.
142	   - basic_auth: raw HTTP Basic header.
143	   - oauth2_code: OAuth2 authorization-code flow (requires refresh token storage).
144	   - custom: anything else.
145	   Emit:
146	   - authType: one of the above.
147	   - tokenType: "bearer" for "Bearer ..." headers, "basic" for "Basic ...", "custom" otherwise.
148	   - authorizationHeaderFormat: the exact header template the runner should produce — use the literal "{token}" placeholder where the resolved token slots in (e.g. "Bearer {token}", "ApiKey {token}").
149	   - credentialHint: a short string telling the admin which credential field they need to fill before this auth config is functional (e.g. "Paste your provider API key here", "Provide clientId + clientSecret"). The runtime does NOT consume this — it is shown verbatim to the admin.
150	
151	3. REQUEST TEMPLATE
152	   The user is configuring ONE operation (${operation}). Pick the most likely endpoint from the source — for OpenAPI / Postman with multiple endpoints, prefer the one whose name/summary or tag matches the capability (e.g. for sanction_screening: /match, /screen, /search).
153	   - operation: ${operation}
154	   - httpMethod: GET | POST | PUT 

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/tests/plus-insurance/08-compliance-checks.spec.ts"}

1	import { test, expect } from '@playwright/test';
2	import { ApiClient } from './helpers/api-client';
3	import { ORGANIZATION_ID } from './helpers/test-data';
4	import { getApiUrl } from '../utils/urls';
5	
6	const API_URL = getApiUrl();
7	const CLIENT_ID = process.env.SHERPA_TEST_CLIENT_ID!;
8	const CLIENT_SECRET = process.env.SHERPA_TEST_CLIENT_SECRET!;
9	
10	/**
11	 * Compliance checks API coverage — capability + parties shape.
12	 *
13	 *  - PUT /products/:id with complianceChecks.{capability:{parties, triggers, ...}}
14	 *  - GET /products/:id reflects the persisted shape
15	 *  - Setting complianceChecks=null removes the configuration
16	 *  - Schema rejects malformed bodies
17	 *  - Multiple capabilities coexist on a single product
18	 *  - CLAIM trigger accepted by the schema
19	 */
20	test.describe.serial('Plus · Product compliance checks', () => {
21	  test.setTimeout(60000);
22	
23	  let productId: number;
24	  let integrationId: string;
25	  let creditIntegrationId: string;
26	
27	  test('seed: pick a screening integration + a product', async ({ request }) => {
28	    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);
29	
30	    const integrationsRes = await api.get(`/v1/plus/external-integrations`);
31	    expect(integrationsRes.status()).toBe(200);
32	    const integrations = (await integrationsRes.json()).data ?? [];
33	    let screening = integrations.find(
34	      (i: { capability: string; active: boolean }) =>
35	        i.capability === 'sanction_screening' && i.active,
36	    );
37	    if (!screening) {
38	      const createRes = await api.post('/v1/plus/external-integrations', {
39	        name: 'E2E Sanction Screening',
40	        slug: `e2e-sanction-screening-${Date.now()}`,
41	        capability: 'sanction_screening',
42	        kind: 'generic_rest',
43	        defaultEnvironment: 'test',
44	        active: true,
45	      });
46	      expect(createRes.status()).toBe(201);
47	      screening = (await createRes.json()).data;
48	    }
49	    integrationId = screening.id;
50	
51	    const productsRes = await api.get(`/v1/plus/products?organizationId=${ORGANIZATION_ID}&limit=1`);
52	    expect(productsRes.status()).toBe(200);
53	    const products = (await productsRes.json()).data?.products ?? [];
54	    test.skip(products.length === 0, 'No products in test organization');
55	    productId = products[0].id;
56	  });
57	
58	  test('PUT complianceChecks.sanction_screening — persisted + readable', async ({
59	    request,
60	  }) => {
61	    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);
62	    const config = {
63	      enabled: true,
64	      integrationId,
65	      triggers: ['NEW_BUSINESS', 'RENEWAL'],
66	      parties: {
67	        policyholder: 'personal',
68	        additional: [] as string[],
69	      },
70	      outcomeRules: {
71	        passWhen: { maxScore: 0.5 },
72	        failWhen: { minScore: 0.85, onTopics: ['sanction'] },
73	      },
74	    };
75	
76	    const putRes = await api.put(`/v1/plus/products/${productId}`, {
77	      complianceChecks: { sanction_screening: config },
78	    });
79	    expect(putRes.status()).toBe(200);
80	
81	    const getRes = await api.get(`/v1/plus/products/${productId}`);
82	    expect(getRes.status()).toBe(200);
83	    const body = await getRes.json();
84	    expect(body.data.complianceChecks).toEqual({ sanction_screening: config });
85	  });
86	
87	  test('PUT complianceChecks=null — removes the configuration', async ({ request }) => {
88	    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);
89	
90	    const putRes = await api.put(`/v1/plus/products/${productId}`, {
91	      complianceChecks: null,
92	    });
93	    expect(putRes.status()).toBe(200);
94	
95	    const getRes = await api.get(`/v1/plus/products/${productId}`);
96	    const body = await getRes.json();
97	    expect(body.data.complianceChecks).toBeNull();
98	  });
99	
100	  test('schema rejects malformed shape', async ({ request }) => {
101	    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);
102	    api.expectErrors = true;
103	
104	    // outcomeRules.passWhen.maxScore must be 0..1; 2 is out of range
105	    const res = await api.put(`/v1/plus/products/${productId}`, {
106	      complianceChecks: {
107	        sanction_screening: {
108	          enabled: true,
109	          integrationId,
110	          triggers: ['NEW_BUSINESS'],
111	          parties: {
112	            policyholder: 'personal',
113	            additional: [],
114	          },
115	          outcomeRules: {
116	            passWhen: { maxScore: 2 },
117	            failWhen: { minScore: 0.85, onTopics: ['sanction'] },
118	          },
119	        },
120	      },
121	    });
122	    expect(res.status()).toBe(400);
123	  });
124	
125	  test('schema rejects empty policyholder path', async ({ request }) => {
126	    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);
127	    api.expectErrors = true;
128	
129	    const res = await api.put(`/v1/plus/products/${productId}`, {
130	      complianceChecks: {
131	        sanction_screening: {
132	          enabled: true,
133	          integrationId,
134	          triggers: ['NEW_BUSINESS'],
135	          parties: {
136	            policyholder: '',
137	            additional: [],
138	          },
139	          outcomeRules: {
140	            passWhen: { maxScore: 0.5 },
141	            failWhen: { minScore: 0.85, onTopics: ['sanction'] },
142	          },
143	        },
144	      },
145	    });
146	    expect(res.status()).toBe(400);
147	  });
148	
149	  test('multi-capability round-trip — sanction + kyc share the same product', async ({ request }) => {
150	    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);
151	    const baseConfig = (capability: string, triggers: string[]) => ({
152	      enabled: true,
153	      integrationId,
154	      triggers,
155	      parties: {
156	        policyholder: 'personal',
157	        additional: [] as string[],
158	      },
159	      outcomeRules: {
160	        passWhen: { maxScore: 0.5 },
161	        failWhen: {
162	          minScore: 0.85,
163	          onTopics: capability === 'kyc' ? ['kyc.failed'] : ['sanction'],
164	        },
165	      },
166	    });
167	
168	    const putRes = await api.put(`/v1/plus/products/${productId}`, {
169	      complianceChecks: {
170	        sanction_screening: baseConfig('sanction_screening', ['NEW_BUSINESS', 'RENEWAL']),
171	        kyc: baseConfig('kyc', ['NEW_BUSINESS']),
172	      },
173	    });
174	    expect(putRes.status()).toBe(200);
175	
176	    const getRes = await api.get(`/v1/plus/products/${productId}`);
177	    const body = await getRes.json();
178	    expect(Object.keys(body.data.complianceChecks).sort()).toEqual(['kyc', 'sanction_screening']);
179	    expect(body.data.complianceChecks.kyc.triggers).toEqual(['NEW_BUSINESS']);
180	    expect(body.data.complianceChecks.kyc.parties).toEqual({ policyholder: 'personal', additional: [] });
181	    expect(body.data.complianceChecks.sanction_screening.triggers).toEqual([
182	      'NEW_BUSINESS',
183	      'RENEWAL',
184	    ]);
185	  });
186	
187	  test('CLAIM trigger accepted by schema (fraud_detection at claim time)', async ({ request }) => {
188	    const api = new ApiClient(request, API_URL, CLIENT_ID, CLIENT_SECRET);
189	    const putRes = await api.put(`/v1/plus/products/${productId}`, {
190	      complianceChecks: {
191	        fraud_detection: {
192	          enabled: false,
193	          integrationId,
194	          triggers: ['CLAIM'],
195	          parties: {
196	            policyholder: 'personal',
197	            additional: [],
198	          },
199	          outcomeRules: {
200	            passWhen: { maxScore: 0.5 },
201	            failWhen: { minScore: 0.85, onTopics: ['fraud.high_risk'] },
202	          },
203	        },
204	      },
205	    });
206	    expect(putRes.status()).toBe(200);
207	
208	    const getRes = await api.get(`/v1/plus/p

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && find src -name \"*ExternalIntegrationCallLog*\" -type f"}

src/models/internal/_ExternalIntegrationCallLog.ts
src/models/ExternalIntegrationCallLog.ts
src/schemas/typebox/integration/ExternalIntegrationCallLog.ts

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/ExternalIntegrationCallLog.ts"}

1	import { _ExternalIntegrationCallLog } from './internal/_ExternalIntegrationCallLog.js';
2	import { toSafeModel } from './lib/safe-model.js';
3	
4	export const ExternalIntegrationCallLog = toSafeModel(_ExternalIntegrationCallLog);
5	export type ExternalIntegrationCallLog = _ExternalIntegrationCallLog;
6	
7	export { _ExternalIntegrationCallLog };
8	export type { ExternalIntegrationCallStatus } from './internal/_ExternalIntegrationCallLog.js';
9	

{"pattern":"sanction_screening|fraud_detection|adverse_media","path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app","type":"tsx","output_mode":"files_with_matches"}

No files found

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && git diff HEAD src/models/internal/_ExternalIntegrationCallLog.ts src/schemas/typebox/integration/ExternalIntegrationCallLog.ts 2>/dev/null | head -100"}

diff --git a/src/models/internal/_ExternalIntegrationCallLog.ts b/src/models/internal/_ExternalIntegrationCallLog.ts
index 0b8acdb8..a2269a85 100644
--- a/src/models/internal/_ExternalIntegrationCallLog.ts
+++ b/src/models/internal/_ExternalIntegrationCallLog.ts
@@ -45,10 +45,10 @@ export class _ExternalIntegrationCallLog extends Model {
   declare organizationId: string;
 
   @Column({
-    type: DataType.ENUM('sanction_screening'),
+    type: DataType.STRING(64),
     allowNull: false,
   })
-  declare capability: 'sanction_screening';
+  declare capability: string;
 
   @Column({
     type: DataType.STRING(100),
diff --git a/src/schemas/typebox/integration/ExternalIntegrationCallLog.ts b/src/schemas/typebox/integration/ExternalIntegrationCallLog.ts
index 5e76131f..27998a32 100644
--- a/src/schemas/typebox/integration/ExternalIntegrationCallLog.ts
+++ b/src/schemas/typebox/integration/ExternalIntegrationCallLog.ts
@@ -25,10 +25,10 @@ export const ExternalIntegrationCallLogSchema = Type.Object(
     id: Uuid({ description: 'Call log UUID.' }),
     integrationId: Uuid({ description: 'ExternalIntegration that produced the call.' }),
     organizationId: Uuid({ description: 'Owning organisation.' }),
-    capability: Type.Union(
-      [Type.Literal('sanction_screening')],
-      { description: 'Capability the call was made under.' },
-    ),
+    capability: Type.String({
+      maxLength: 64,
+      description: 'Capability the call was made under (sanction_screening, kyc, fraud_detection, credit_check, ...).',
+    }),
     operation: Type.String({
       maxLength: 100,
       description: 'Capability-defined opcode (e.g. "screen").',

{"pattern":"'sanction_screening'|'fraud_detection'|'adverse_media'|'pep'|'kyc'|IntegrationCapability","path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app","output_mode":"files_with_matches","head_limit":0}

Found 6 files
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/externalIntegrationSmartSetup.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/IntegrationsTab.tsx
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/admin.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/externalIntegrationSmartImport.ts
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/SmartSetupModal.tsx
/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/RequestTemplatesTab.tsx

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/prompts/externalIntegrationSmartImport.ts"}

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && git diff HEAD src/schemas/typebox/integration/ExternalIntegrationCallLog.ts | grep -A20 \"PublicFields\""}

(Bash completed with no output)

1	export type IntegrationCapability = "sanction_screening";
2	export type IntegrationHttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
3	
4	export interface DataModelFieldRef {
5	  id: number;
6	  name: string;
7	  label: string;
8	  description?: string;
9	  type?: string;
10	}
11	
12	export interface ExternalIntegrationSmartImportInput {
13	  capability: IntegrationCapability;
14	  operation: string;
15	  httpMethod: IntegrationHttpMethod;
16	  urlInput?: string;
17	  jsonRequestInput?: string;
18	  jsonResponseInput: string;
19	  dataModelFields?: DataModelFieldRef[];
20	}
21	
22	export interface LLMConfig {
23	  model: string;
24	  thinkingLevel: string;
25	  prompt: string;
26	  temperature: number;
27	  maxTokens: number;
28	}
29	
30	const CAPABILITY_OUTPUT_CONTRACT: Record<IntegrationCapability, string> = {
31	  sanction_screening: `
32	The integration runner invokes the 'screen' operation with this typed input:
33	  {
34	    "parties": [
35	      { "role": "policyholder" | "insured" | "beneficiary",
36	        "firstName": string, "lastName": string,
37	        "dateOfBirth": string | null, "nationality": string | null }
38	    ]
39	  }
40	
41	The runner expects the rendered response to expose a 'matches' field
42	containing an array of objects shaped as:
43	  {
44	    "entityId": string,           // unique provider id
45	    "entityName": string,         // canonical sanctioned-entity name
46	    "score": number,              // 0..1 match confidence
47	    "topics": string[],           // e.g. ["sanction", "pep"]
48	    "datasets": string[],         // e.g. ["us_ofac_sdn", "eu_fsf"]
49	    "sourceUrl": string | null
50	  }
51	
52	The responseMapping field MUST contain a "matches" JSONPath that lifts the
53	matches array out of the provider's payload. If the provider returns the
54	matches at the root, use {"matches": "$.matches"} or whatever path applies.
55	`,
56	};
57	
58	export function buildExternalIntegrationSmartImportPrompt(
59	  input: ExternalIntegrationSmartImportInput,
60	): LLMConfig {
61	  const {
62	    capability,
63	    operation,
64	    httpMethod,
65	    urlInput,
66	    jsonRequestInput,
67	    jsonResponseInput,
68	    dataModelFields = [],
69	  } = input;
70	
71	  const capabilityContract =
72	    CAPABILITY_OUTPUT_CONTRACT[capability] ??
73	    `The output structure for capability '${capability}' is project-defined; responseMapping should expose the keys the runner expects.`;
74	
75	  const dataModelFieldsReference =
76	    dataModelFields.length > 0
77	      ? dataModelFields
78	          .map((f) => {
79	            const parts = [
80	              `${f.name} (ID: ${f.id})`,
81	              `Label: "${f.label}"`,
82	              f.description ? `Description: "${f.description}"` : null,
83	              f.type ? `Type: ${f.type}` : null,
84	            ].filter(Boolean);
85	            return `  - ${parts.join(", ")}`;
86	          })
87	          .join("\n")
88	      : "  (none provided — emit fieldMappings with dataModelFieldId=null and a customFieldName path instead)";
89	
90	  const prompt = `You are an API integration expert. Analyze the provided HTTP method, optional URL/cURL, optional request body, and JSON response from a third-party API and produce a complete request-template configuration for a generic-REST integration runner.
91	
92	CAPABILITY: ${capability}
93	OPERATION: ${operation}
94	${capabilityContract}
95	
96	INPUT DATA:
97	HTTP Method: ${httpMethod}
98	${urlInput ? `URL: ${urlInput}\n` : ""}${jsonRequestInput ? `JSON Request Body:\n${jsonRequestInput}\n\n` : ""}JSON Response:
99	${jsonResponseInput}
100	
101	YOUR TASKS:
102	
103	1. PARSE THE URL:
104	   - Extract the path after the host (e.g. "v2/match/default")
105	   - Replace concrete identifiers / query values with mustache placeholders
106	     drawn from the typed capability input above (e.g. "{{parties.0.firstName}}")
107	   - For ${httpMethod === "POST" || httpMethod === "PUT" || httpMethod === "PATCH" ? "POST/PUT/PATCH" : "GET/DELETE"} requests, prefer keeping the URL path-only and pushing variable inputs into the body or query.
108	
109	2. BUILD requestHeadersTemplate (object | null):
110	   - Mirror sensible headers from the cURL (e.g. {"Accept": "application/json"})
111	   - Do NOT include Authorization here — the runner injects auth from the AuthConfig at call time.
112	   - Keep header values as strings; mustache placeholders are allowed.
113	
114	3. BUILD requestBodyTemplate (object | null):
115	   - For GET/DELETE → null.
116	   - For POST/PUT/PATCH → mirror the JSON Request Body shape using mustache
117	     placeholders for any field sourced from the typed capability input.
118	   - Preserve nested arrays/objects exactly as the provider expects.
119	
120	4. BUILD responseMapping (object, REQUIRED):
121	   - Keys are the output names the runner exposes to the capability handler.
122	   - Values are JSONPath strings starting with "$." that lift those fields
123	     out of the provider's payload.
124	   - At minimum, expose the keys named in the capability contract above
125	     (e.g. "matches" for sanction_screening).
126	
127	5. BUILD errorMapping (object | null):
128	   - Optional. Maps provider error fields to canonical names if useful.
129	   - Example: {"message": "$.error.message"}
130	   - When null, the runner falls back to httpStatus + raw body.
131	
132	6. timeoutMs (integer): default to 10000 unless the cURL implies otherwise.
133	
134	7. retryPolicy (object | null): default
135	   {"attempts": 3, "initialDelayMs": 500, "backoffMultiplier": 2, "maxDelayMs": 5000, "retryOnStatuses": [502, 503, 504]}
136	   unless the provider docs suggest a different shape.
137	
138	⚠️ CRITICAL OUTPUT FORMAT REQUIREMENTS:
139	- Return ONLY raw JSON. NO markdown code fences, NO backticks, NO commentary.
140	- Start your response immediately with the opening brace {
141	- End your response with the closing brace }
142	
143	8. BUILD fieldMappings (array, REQUIRED):
144	   Two kinds of rows.
145	
146	   direction="request" rows describe how to populate the outbound request body
147	   from our typed capability input. For sanction_screening the input is
148	   {parties: [...]} where each party has firstName, lastName, dateOfBirth,
149	   nationality. Each request row has:
150	     - direction: "request"
151	     - providerFieldPath: JSONPath-lite where this value should be placed on
152	       the outbound body (e.g. "$.queries.q1.properties.firstName[0]")
153	     - dataModelFieldId: integer id from the AVAILABLE DATA MODEL FIELDS list
154	       below. **STRONG PREFERENCE**: if any DataModelField is a semantic
155	       match for the field you're populating, you MUST set dataModelFieldId
156	       to that id and leave customFieldName null. Use customFieldName only
157	       when no semantic DataModelField exists. Read each field's Label +
158	       Description to find matches — "firstName" matches DataModelField
159	       'firstName', "birthDate"/"dob" matches 'birthday' or 'dateOfBirth',
160	       "nationality" matches 'nationality', etc. Different providers use
161	       different terminology for the same concepts; bridge that gap here.
162	     - customFieldName: dotted path into the typed capability input if
163	       dataModelFieldId is null (e.g. "parties.0.firstName"); otherwise null
164	     - transformationFunction: dateFormat | enumMapping | currencyFormat |
165	       phoneFormat | booleanMapping | genderMapping | civilStatusMapping |
166	       identificationTypeMapping | statusMapping | null
167	     - enumMapping: object when transformationFunction is enumMapping, else null
168	     - isRequired: true for fields the provider requires
169	     - defaultValue: string or null
170	
171	   **Do not concatenate fields**: if the provider expects a single combined
172	   value (e.g. "name": ["Jane Doe"]) but our DataModel splits it (firstName +
173	   lastName), prefer emitting separate provider fields when the pro

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/SmartSetupModal.tsx","limit":100}

1	"use client";
2	
3	import React, { useCallback, useEffect, useMemo, useState } from "react";
4	
5	import { CheckCircle2, Loader2, Sparkles, Wand2, XCircle } from "lucide-react";
6	
7	import { Button } from "@/app/components/ui/button";
8	import {
9	  Dialog,
10	  DialogContent,
11	  DialogFooter,
12	  DialogHeader,
13	  DialogTitle,
14	} from "@/app/components/ui/dialog";
15	import { Input } from "@/app/components/ui/input";
16	import { Textarea } from "@/app/components/ui/textarea";
17	import api, { nextApi } from "@/app/src/utils/api";
18	import type {
19	  AuthType,
20	  CreateExternalIntegrationFieldMapping,
21	  ExternalIntegrationAuthConfig,
22	  ExternalIntegrationEnvironment,
23	  ExternalIntegrationRequestTemplate,
24	  IntegrationCapability,
25	  IntegrationEnvironment,
26	  IntegrationHttpMethod,
27	  RetryPolicy,
28	  TokenType,
29	} from "@/app/types/admin";
30	import { useLMT } from "@/lib/lmt/config";
31	import {
32	  detectAndParse,
33	  pickOperationFromArtifact,
34	  type ImportArtifact,
35	} from "@/app/components/admin/integrations/parsers";
36	import type { DataModelFieldLite } from "@/app/components/admin/integrations/FieldMappingsEditor";
37	
38	const ENVIRONMENTS: IntegrationEnvironment[] = ["test", "staging", "production"];
39	
40	interface Bundle {
41	  environment: {
42	    environment: IntegrationEnvironment;
43	    baseUrl: string;
44	    authEndpoint: string | null;
45	    tokenEndpoint: string | null;
46	  };
47	  authConfig: {
48	    authType: AuthType;
49	    tokenType: TokenType;
50	    authorizationHeaderFormat: string;
51	    credentialHint: string;
52	  };
53	  requestTemplate: {
54	    operation: string;
55	    httpMethod: IntegrationHttpMethod;
56	    urlTemplate: string;
57	    requestHeadersTemplate: Record<string, string> | null;
58	    requestBodyTemplate: Record<string, unknown> | null;
59	    responseMapping: Record<string, string>;
60	    errorMapping: Record<string, string> | null;
61	    timeoutMs: number;
62	    retryPolicy: RetryPolicy | null;
63	  };
64	  fieldMappings: CreateExternalIntegrationFieldMapping[];
65	}
66	
67	type ConflictMode = "reuse" | "replace" | "create";
68	
69	interface Conflicts {
70	  environment?: { existing: ExternalIntegrationEnvironment; mode: ConflictMode };
71	  authConfig?: { existing: ExternalIntegrationAuthConfig; mode: ConflictMode };
72	  requestTemplate?: { existing: ExternalIntegrationRequestTemplate; mode: ConflictMode };
73	}
74	
75	interface SmartSetupModalProps {
76	  open: boolean;
77	  onOpenChange: (v: boolean) => void;
78	  integrationId: string;
79	  capability: IntegrationCapability;
80	  dataModelFields: DataModelFieldLite[];
81	  onCompleted: () => void;
82	}
83	
84	const AUTH_TYPES: AuthType[] = [
85	  "api_key",
86	  "client_credentials",
87	  "username_password",
88	  "basic_auth",
89	  "oauth2_code",
90	  "custom",
91	];
92	
93	type CredentialKey =
94	  | "username"
95	  | "password"
96	  | "clientId"
97	  | "clientSecret"
98	  | "apiKey"
99	  | "refreshToken"
100	  | "token";

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/RequestTemplatesTab.tsx","limit":100}

1	"use client";
2	
3	import React, { useCallback, useEffect, useState } from "react";
4	
5	import { Plus, Sparkles, Trash2 } from "lucide-react";
6	
7	import ConfirmDialog from "@/app/components/admin/ConfirmDialog";
8	import { Button } from "@/app/components/ui/button";
9	import {
10	  Dialog,
11	  DialogContent,
12	  DialogFooter,
13	  DialogHeader,
14	  DialogTitle,
15	} from "@/app/components/ui/dialog";
16	import { Input } from "@/app/components/ui/input";
17	import { Textarea } from "@/app/components/ui/textarea";
18	import api, { nextApi } from "@/app/src/utils/api";
19	import { CAPABILITY_OPERATIONS } from "@/app/types/admin";
20	import type {
21	  CreateExternalIntegrationFieldMapping,
22	  CreateExternalIntegrationRequestTemplate,
23	  ExternalIntegrationFieldMapping,
24	  ExternalIntegrationRequestTemplate,
25	  FieldMappingTransformation,
26	  IntegrationCapability,
27	  IntegrationHttpMethod,
28	  RetryPolicy,
29	} from "@/app/types/admin";
30	import { useLMT } from "@/lib/lmt/config";
31	import FieldMappingsEditor, {
32	  type DataModelFieldLite,
33	} from "@/app/components/admin/integrations/FieldMappingsEditor";
34	
35	interface ListResponse {
36	  status: "success" | "error";
37	  data?: ExternalIntegrationRequestTemplate[];
38	}
39	
40	interface LlmGenerateResponse {
41	  status: string;
42	  data?: { text: string };
43	}
44	
45	const HTTP_METHODS: IntegrationHttpMethod[] = ["GET", "POST", "PUT", "PATCH", "DELETE"];
46	
47	const DEFAULT_RETRY_POLICY: RetryPolicy = {
48	  attempts: 3,
49	  initialDelayMs: 500,
50	  backoffMultiplier: 2,
51	  maxDelayMs: 5000,
52	  retryOnStatuses: [502, 503, 504],
53	};
54	
55	type EditorMode = "structured" | "json" | "ai";
56	type AiPanelState = "closed" | "open";
57	
58	interface ListMappingsResponse {
59	  status: "success" | "error";
60	  data?: ExternalIntegrationFieldMapping[];
61	}
62	
63	interface ListDataModelFieldsResponse {
64	  status: "success" | "error";
65	  data?: DataModelFieldLite[];
66	}
67	
68	interface Props {
69	  integrationId: string;
70	  capability: IntegrationCapability;
71	}
72	
73	interface KvRow {
74	  key: string;
75	  value: string;
76	}
77	
78	function objectToKvRows(obj: Record<string, string> | null): KvRow[] {
79	  if (!obj) return [];
80	  return Object.entries(obj).map(([key, value]) => ({ key, value: String(value) }));
81	}
82	
83	function kvRowsToObject(rows: KvRow[]): Record<string, string> {
84	  const out: Record<string, string> = {};
85	  for (const r of rows) {
86	    if (r.key.trim().length === 0) continue;
87	    out[r.key] = r.value;
88	  }
89	  return out;
90	}
91	
92	function tryParseJson<T>(text: string, fallback: T): { ok: true; value: T } | { ok: false; error: string } {
93	  const trimmed = text.trim();
94	  if (trimmed.length === 0) {
95	    return { ok: true, value: fallback };
96	  }
97	  try {
98	    return { ok: true, value: JSON.parse(trimmed) as T };
99	  } catch (err) {
100	    return { ok: false, error: err instanceof Error ? err.message : String(err) };

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && git diff HEAD src/schemas/typebox/integration/ExternalIntegrationCallLog.ts | head -50"}

diff --git a/src/schemas/typebox/integration/ExternalIntegrationCallLog.ts b/src/schemas/typebox/integration/ExternalIntegrationCallLog.ts
index 5e76131f..27998a32 100644
--- a/src/schemas/typebox/integration/ExternalIntegrationCallLog.ts
+++ b/src/schemas/typebox/integration/ExternalIntegrationCallLog.ts
@@ -25,10 +25,10 @@ export const ExternalIntegrationCallLogSchema = Type.Object(
     id: Uuid({ description: 'Call log UUID.' }),
     integrationId: Uuid({ description: 'ExternalIntegration that produced the call.' }),
     organizationId: Uuid({ description: 'Owning organisation.' }),
-    capability: Type.Union(
-      [Type.Literal('sanction_screening')],
-      { description: 'Capability the call was made under.' },
-    ),
+    capability: Type.String({
+      maxLength: 64,
+      description: 'Capability the call was made under (sanction_screening, kyc, fraud_detection, credit_check, ...).',
+    }),
     operation: Type.String({
       maxLength: 100,
       description: 'Capability-defined opcode (e.g. "screen").',

{"pattern":"capability|sanction|credit|fraud","path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/components/admin/integrations/SmartSetupModal.tsx","output_mode":"content","head_limit":0}

79:  capability: IntegrationCapability;
133:  capability,
187:        a.operations.find((o) => /\/(match|screen|search|sanction)/i.test(o.path))?.key ??
216:          capability,
670:          placeholder={`curl -X POST 'https://api.opensanctions.org/match/default' \\\n  -H 'Authorization: ApiKey YOUR_KEY' \\\n  -H 'Content-Type: application/json' \\\n  -d '{"queries":{"q1":{"schema":"Person","properties":{"firstName":["Jane"],"lastName":["Doe"]}}}}'`}
716:          placeholder={`{"responses":{"q1":{"results":[{"id":"NK-abc","caption":"Jane Doe","score":0.92,"topics":["sanction"],"datasets":["us_ofac_sdn"]}]}}}`}

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && grep -n \"enum_ExternalIntegrationCallLogs_capability\" src/db/migrations/2026.05.14T00.00.04.create-external-integration-call-logs.ts"}

(Bash completed with no output)

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat && grep -r \"autoReject\\|messages\" app/types/product.ts 2>/dev/null | head -20"}

app/types/product.ts:  autoReject?: boolean;
app/types/product.ts:  messages?: {

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && grep -r \"enum_External\" src/db/migrations/ | head -5"}

src/db/migrations/2026.05.14T00.00.01.create-external-integrations.ts:      IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'enum_ExternalIntegrations_capability') THEN
src/db/migrations/2026.05.14T00.00.01.create-external-integrations.ts:        CREATE TYPE "enum_ExternalIntegrations_capability" AS ENUM ('sanction_screening');
src/db/migrations/2026.05.14T00.00.01.create-external-integrations.ts:      IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'enum_ExternalIntegrations_kind') THEN
src/db/migrations/2026.05.14T00.00.01.create-external-integrations.ts:        CREATE TYPE "enum_ExternalIntegrations_kind" AS ENUM ('generic_rest');
src/db/migrations/2026.05.14T00.00.01.create-external-integrations.ts:      IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'enum_ExternalIntegrations_defaultEnvironment') THEN

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat/app/types/product.ts"}

1	export interface ProductData {
2	  id: number;
3	  productTitle: string;
4	  productName: string;
5	  productDescription: string | null;
6	  country: string;
7	  availableCountries?: string[];
8	  productType: string;
9	  currency: string;
10	  inputCurrency?: string;
11	  displayCurrencies?: string[];
12	  pricingCurrencies?: string[];
13	  active: boolean;
14	  version: number;
15	  startDate: string;
16	  endDate: string | null;
17	  isCurrent?: boolean;
18	  userId?: string;
19	  createdAt: string;
20	  updatedAt: string;
21	  isEmbedded?: boolean;
22	  primaryProductTitle?: string;
23	  insuranceTypeId?: string;
24	  insuranceType?: {
25	    id: number;
26	    name: string;
27	    title: string;
28	  };
29	  organizationId?: string;
30	  organization?: {
31	    id: string;
32	    name: string;
33	    displayName: string;
34	  };
35	  policyNumberPrefix?: string;
36	  policyNumberSequence?: string;
37	  autoCreatePolicy?: boolean;
38	  sendEmails?: boolean;
39	  collectsPaymentOnImport?: boolean;
40	  renewalWindowDays?: number;
41	  insurerId?: number;
42	  insurer?: {
43	    id: number;
44	    name: string;
45	  };
46	  currencyPosition?: "prefix" | "suffix";
47	  decimalSeparator?: string;
48	  groupSeparator?: string;
49	  decimalsAmount?: number;
50	  dateFormat?: string;
51	  paymentProvider?: string;
52	  paymentMethods?: string[];
53	  activeLocales?: string[] | null;
54	  sourceLocale?: string;
55	  translationOverrides?: Record<string, Record<string, string>> | null;
56	  paymentUiMode?: "redirect" | "iframe";
57	  user?: {
58	    id: string;
59	    firstName: string;
60	    lastName: string;
61	    email: string;
62	  };
63	  documents?: ProductDocument[];
64	  complianceChecks?: ProductComplianceChecks | null;
65	}
66	
67	export type ComplianceTrigger =
68	  | "NEW_BUSINESS"
69	  | "RENEWAL"
70	  | "ENDORSEMENT"
71	  | "CLAIM"
72	  | "MANUAL";
73	
74	export interface ProductCapabilityConfig {
75	  enabled: boolean;
76	  integrationId: string;
77	  triggers: ComplianceTrigger[];
78	  parties: {
79	    policyholder: string;
80	    additional: string[];
81	  };
82	  outcomeRules: {
83	    passWhen: { maxScore: number };
84	    failWhen: { minScore: number; onTopics: string[] };
85	  };
86	  autoReject?: boolean;
87	  messages?: {
88	    fail?: string | null;
89	    review?: string | null;
90	  };
91	}
92	
93	export type ProductComplianceChecks = Record<string, ProductCapabilityConfig>;
94	
95	export interface ProductDocument {
96	  key: string;
97	  label: string;
98	  dataFileId: string;
99	  locale: string;
100	  order: number;
101	}
102	
103	export interface ProductListResponse {
104	  status: string;
105	  data: {
106	    products: ProductData[];
107	    currentPage: number;
108	    totalPages: number;
109	    totalCount: number;
110	  };
111	}
112	
113	export interface ProductLibraryTemplate {
114	  title?: string;
115	  name?: string;
116	  description?: string | null;
117	  templateType?: string;
118	  active?: boolean;
119	}
120	
121	export interface ProductLibraryCancellationTerm {
122	  paymentFrequency?: string | null;
123	  cancellationPeriodType?: string | null;
124	  standardRefundType?: string | null;
125	  gracePeriodRefundType?: string | null;
126	  noticePeriodDays?: number | null;
127	  gracePeriodDays?: number | null;
128	  cancellationFee?: string | null;
129	  refundPercentage?: string | number | null;
130	}
131	
132	export interface ProductLibraryData {
133	  product?: {
134	    productTitle?: string;
135	    productName?: string;
136	    productDescription?: string;
137	    country?: string;
138	    currency?: string;
139	    insuranceType?: string;
140	    isEmbedded?: boolean;
141	    autoCreatePolicy?: boolean;
142	    sendEmails?: boolean;
143	    collectsPaymentOnImport?: boolean;
144	    renewalWindowDays?: number;
145	    primaryProductTitle?: string;
146	  };
147	  productTemplates?: ProductLibraryTemplate[];
148	  cancellationTerms?: ProductLibraryCancellationTerm[];
149	  exportMetadata?: {
150	    version?: string;
151	    exportedAt?: string;
152	    exportedFrom?: string;
153	  };
154	  [key: string]: unknown;
155	}
156	
157	export interface ProductLibraryItem {
158	  // Raw API fields (from GET /product-library)
159	  id: number;
160	  title: string; // API field: title
161	  description?: string | null; // API field: description
162	  type?: string | null; // API field: type (product type/insurance type)
163	  country?: string | null; // API field: country (2-character code)
164	  payload?: Record<string, unknown>; // API field: payload (parsed JSON object)
165	  dateCreated?: string; // API field: dateCreated
166	  dateModified?: string; // API field: dateModified
167	
168	  // Derived/computed fields (for UI compatibility)
169	  productTitle: string; // Derived from: title
170	  productName: string; // Derived from: payload.product.productName
171	  productDescription?: string | null; // Derived from: description or payload
172	  insuranceTypeTitle?: string | null; // Derived from: type (formatted)
173	  insuranceTypeName?: string | null; // Derived from: type (formatted)
174	  currency?: string | null; // Derived from: payload.product.currency
175	  tags?: string[] | null; // Derived from: payload.productTemplates
176	  version?: string | number | null; // Derived from: payload.exportMetadata.version
177	  coverageSummary?: string | null;
178	  lastUpdatedBy?: string | null;
179	  createdAt?: string; // Derived from: dateCreated
180	  updatedAt?: string; // Derived from: dateModified
181	  status?: "active" | "inactive" | string; // Default: "active"
182	  isEmbedded?: boolean; // Derived from: payload.product.isEmbedded
183	  autoCreatePolicy?: boolean; // Derived from: payload.product.autoCreatePolicy
184	  sendEmails?: boolean; // Derived from: payload.product.sendEmails
185	  collectsPaymentOnImport?: boolean; // Derived from: payload.product.collectsPaymentOnImport
186	  renewalWindowDays?: number; // Derived from: payload.product.renewalWindowDays
187	  primaryProductTitle?: string | null; // Derived from: payload.product.primaryProductTitle
188	  organizationId?: string | null;
189	  productData?: ProductLibraryData | null; // Derived from: payload
190	  sourceProductId?: number | null;
191	}
192	
193	// Define type for Product Plans
194	export interface ProductPlanData {
195	  id: number;
196	  name: string;
197	  title: string;
198	  description?: string;
199	  color?: string;
200	  productId: number;
201	  recommended: boolean;
202	  active: boolean;
203	  order?: number;
204	  coveragesCount?: number;
205	  coverages?: CoverageData[];
206	  pricings?: PricingData[];
207	  createdAt: string;
208	  updatedAt: string;
209	}
210	
211	// Define type for Pricing
212	export interface PricingData {
213	  id: number;
214	  amount: number;
215	  currency: string;
216	  frequency?: string;
217	  discounted?: boolean;
218	  discountPercentage?: number;
219	  productPlanId: number;
220	  active: boolean;
221	  createdAt: string;
222	  updatedAt: string;
223	}
224	
225	// Define type for Coverages
226	export interface CoverageData {
227	  id: number;
228	  code?: string;
229	  name: string;
230	  title: string;
231	  description?: string;
232	  active: boolean;
233	  productId: number;
234	  productPlanId: number;
235	  insurerId?: number | null;
236	  terms?: TermsData;
237	  minIssueAge: number;
238	  maxIssueAge: number;
239	  maturityAge?: number;
240	  baseCoverage: boolean;
241	  included?: boolean;
242	  amountType: "Base" | "None" | "Percentage" | "Ratio" | "Value" | "Variable" | "Included" | "Excluded";
243	  coverageAmountCategoryType?:
244	    | "Base"
245	    | "None"
246	    | "Percentage"
247	    | "Ratio"
248	    | "Value"
249	    | "Variable"
250	    | "Included"
251	    | "Excluded";
252	  coverageAmount: number;
253	  minCoverageAmount?: number;
254	  maxCoverageAmount?: number;
255	  exclusionType?: string;
256	  exclusionPeriod?: number;
257	  waitingPeriod?: number;
258	  co

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && grep -B5 -A5 \"DataTypes.ENUM.*sanction\" src/db/migrations/2026.05.14T00.00.04.create-external-integration-call-logs.ts"}

      references: { model: 'Organizations', key: 'id' },
      onUpdate: 'CASCADE',
      onDelete: 'CASCADE',
    },
    capability: {
      type: DataTypes.ENUM('sanction_screening'),
      allowNull: false,
    },
    operation: {
      type: DataTypes.STRING(100),
      allowNull: false,

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && cat src/db/migrations/2026.05.31T00.00.01.widen-call-log-capability.ts | grep \"enum_\""}

    `DROP TYPE IF EXISTS "enum_ExternalIntegrationCallLogs_capability";`,

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && grep -rn \"\\['sanction_screening'\\]\" src --include=\"*.ts\" | grep -v test | grep -v migrations"}

(Bash completed with no output)

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && grep -rn \"validate.*capability\\|capability.*validate\" src --include=\"*.ts\" | grep -v test | head -10"}

(Bash completed with no output)

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/test/runCheck.test.ts","limit":150}

1	import { describe, test } from 'node:test';
2	import assert from 'node:assert/strict';
3	import {
4	  extractScreenedParties,
5	  applyOutcomeRules,
6	} from '@/domains/integrations/capabilities/runCheck.js';
7	import type { ProductCapabilityConfig } from '@/models/internal/_Product.js';
8	import type { ComplianceFinding } from '@/models/ComplianceCheck.js';
9	
10	const baseConfig: ProductCapabilityConfig = {
11	  enabled: true,
12	  integrationId: 'integration-uuid',
13	  triggers: ['NEW_BUSINESS', 'RENEWAL'],
14	  parties: {
15	    policyholder: 'personal',
16	    additional: ['insureds'],
17	  },
18	  outcomeRules: {
19	    passWhen: { maxScore: 0.7 },
20	    failWhen: { minScore: 0.9, onTopics: ['sanctioned'] },
21	  },
22	};
23	
24	describe('extractScreenedParties', () => {
25	  test('extracts the policyholder when present', () => {
26	    const parties = extractScreenedParties(
27	      {
28	        personal: {
29	          firstName: 'Alice',
30	          lastName: 'Brown',
31	          birthDate: '1985-04-12',
32	          nationality: 'AR',
33	        },
34	      },
35	      baseConfig,
36	    );
37	    assert.equal(parties.length, 1);
38	    assert.equal(parties[0].role, 'policyholder');
39	    assert.equal(parties[0].sourcePath, 'personal');
40	    assert.equal((parties[0].data as Record<string, unknown>).firstName, 'Alice');
41	  });
42	
43	  test('extracts additional parties from an array path', () => {
44	    const parties = extractScreenedParties(
45	      {
46	        personal: { firstName: 'Alice', lastName: 'Brown' },
47	        insureds: [
48	          { firstName: 'Bob', lastName: 'Brown' },
49	          { firstName: 'Carol', lastName: 'Brown' },
50	        ],
51	      },
52	      baseConfig,
53	    );
54	    assert.equal(parties.length, 3);
55	    assert.equal(parties[1].role, 'insured');
56	    assert.equal(parties[1].sourcePath, 'insureds.0');
57	    assert.equal(parties[2].sourcePath, 'insureds.1');
58	  });
59	
60	  test('skips paths that resolve to non-objects', () => {
61	    const parties = extractScreenedParties({ personal: 'not an object' }, baseConfig);
62	    assert.equal(parties.length, 0);
63	  });
64	});
65	
66	describe('applyOutcomeRules', () => {
67	  function finding(score: number, topics: string[] = []): ComplianceFinding {
68	    return { entityId: 'x', entityName: 'y', score, topics, datasets: [], sourceUrl: null };
69	  }
70	
71	  test('pass when no findings', () => {
72	    assert.equal(applyOutcomeRules([], baseConfig), 'pass');
73	  });
74	  test('pass when top score below maxScore', () => {
75	    assert.equal(applyOutcomeRules([finding(0.3), finding(0.5)], baseConfig), 'pass');
76	  });
77	  test('fail when top score >= minScore', () => {
78	    assert.equal(applyOutcomeRules([finding(0.95)], baseConfig), 'fail');
79	  });
80	  test('fail when forbidden topic appears even at lower score', () => {
81	    assert.equal(applyOutcomeRules([finding(0.5, ['sanctioned'])], baseConfig), 'fail');
82	  });
83	  test('review when between thresholds', () => {
84	    assert.equal(applyOutcomeRules([finding(0.8)], baseConfig), 'review');
85	  });
86	});
87	

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && diff -u <(sed -n '14,23p' src/db/migrations/2026.05.19T00.00.07.add-integration-invocation-mode.ts) <(sed -n '14,23p' src/db/migrations/2026.05.31T00.00.01.widen-call-log-capability.ts)"}

--- /dev/fd/12	2026-05-31 14:36:26
+++ /dev/fd/13	2026-05-31 14:36:26
@@ -1,10 +1,10 @@
- * Also widens the `capability` column from a frozen `sanction_screening`-only
- * ENUM to STRING(64) so new capabilities can land without a migration.
- */
 export const up: MigrationFn<QueryInterface> = async ({ context }) => {
   await context.sequelize.query(`
-    ALTER TABLE "ExternalIntegrations"
+    ALTER TABLE "ExternalIntegrationCallLogs"
     ALTER COLUMN capability TYPE VARCHAR(64) USING capability::text;
   `);
-  await context.sequelize.query(`DROP TYPE IF EXISTS "enum_ExternalIntegrations_capability";`);
+  await context.sequelize.query(
+    `DROP TYPE IF EXISTS "enum_ExternalIntegrationCallLogs_capability";`,
+  );
+};

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && git diff HEAD --name-only | xargs -I {} sh -c 'echo \"=== {} ===\" && wc -l {}'"}

=== src/domains/integrations/runner.ts ===
     165 src/domains/integrations/runner.ts
=== src/models/internal/_ExternalIntegrationCallLog.ts ===
     116 src/models/internal/_ExternalIntegrationCallLog.ts
=== src/routes/plus/externalIntegrationsRoutes.ts ===
     839 src/routes/plus/externalIntegrationsRoutes.ts
=== src/schemas/typebox/integration/ExternalIntegrationCallLog.ts ===
      75 src/schemas/typebox/integration/ExternalIntegrationCallLog.ts

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && git diff HEAD --name-only | wc -l"}

       4

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && git status --short"}

 M src/domains/integrations/runner.ts
 M src/models/internal/_ExternalIntegrationCallLog.ts
 M src/routes/plus/externalIntegrationsRoutes.ts
 M src/schemas/typebox/integration/ExternalIntegrationCallLog.ts
?? src/db/migrations/2026.05.31T00.00.01.widen-call-log-capability.ts

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/models/internal/_ExternalIntegrationCallLog.ts","offset":1,"limit":60}

1	import { Table, Column, Model, DataType, ForeignKey, BelongsTo } from 'sequelize-typescript';
2	import { _ExternalIntegration } from './_ExternalIntegration.js';
3	import { Organization } from '../Organization.js';
4	
5	export type ExternalIntegrationCallStatus = 'success' | 'error' | 'timeout' | 'circuit_open';
6	
7	@Table({
8	  modelName: 'ExternalIntegrationCallLog',
9	  timestamps: false,
10	  indexes: [
11	    {
12	      fields: ['integrationId', 'createdAt'],
13	      name: 'idx_external_integration_call_log_integration_created',
14	    },
15	    {
16	      fields: ['organizationId', 'createdAt'],
17	      name: 'idx_external_integration_call_log_org_created',
18	    },
19	    {
20	      fields: ['correlationId'],
21	      name: 'idx_external_integration_call_log_correlation_id',
22	    },
23	  ],
24	})
25	export class _ExternalIntegrationCallLog extends Model {
26	  @Column({
27	    type: DataType.UUID,
28	    defaultValue: DataType.UUIDV4,
29	    primaryKey: true,
30	  })
31	  declare id: string;
32	
33	  @ForeignKey(() => _ExternalIntegration)
34	  @Column({
35	    type: DataType.UUID,
36	    allowNull: false,
37	  })
38	  declare integrationId: string;
39	
40	  @ForeignKey(() => Organization)
41	  @Column({
42	    type: DataType.UUID,
43	    allowNull: false,
44	  })
45	  declare organizationId: string;
46	
47	  @Column({
48	    type: DataType.STRING(64),
49	    allowNull: false,
50	  })
51	  declare capability: string;
52	
53	  @Column({
54	    type: DataType.STRING(100),
55	    allowNull: false,
56	  })
57	  declare operation: string;
58	
59	  @Column({
60	    type: DataType.STRING(100),

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/capabilities/registry.ts"}

1	// Capability registry — every external compliance check (sanctions, KYC,
2	// fraud, etc.) registers here. ComplianceChecks.capability stores which one.
3	
4	export type CapabilityId = string;
5	
6	export type ComplianceTrigger =
7	  | 'NEW_BUSINESS'
8	  | 'RENEWAL'
9	  | 'ENDORSEMENT'
10	  | 'CLAIM'
11	  | 'MANUAL';
12	
13	export interface CapabilityDefinition {
14	  readonly id: CapabilityId;
15	  readonly label: string;
16	  readonly operation: string;
17	  readonly defaultTriggers: ReadonlyArray<ComplianceTrigger>;
18	}
19	
20	const REGISTRY: Map<CapabilityId, CapabilityDefinition> = new Map();
21	
22	export function registerCapability(definition: CapabilityDefinition): void {
23	  REGISTRY.set(definition.id, definition);
24	}
25	
26	export function getCapability(id: CapabilityId): CapabilityDefinition {
27	  const found = REGISTRY.get(id);
28	  if (!found) throw new Error(`Unknown capability: ${id}`);
29	  return found;
30	}
31	
32	export function listCapabilities(): CapabilityDefinition[] {
33	  return Array.from(REGISTRY.values());
34	}
35	
36	export function isCapabilityRegistered(id: string): boolean {
37	  return REGISTRY.has(id);
38	}
39	

Perfect. Now I have enough information to complete the review. Let me create a comprehensive analysis:

## Code Review: Credit Check Capability Surface PR

I have read all the actual changed files and verified the implementation against the requirements. Here is my complete analysis:

---

### EXHAUSTIVENESS CHECKS

**1. IntegrationCapability Union (admin.ts:239-245)** ✓
- `credit_check` added to the union type correctly alongside all 5 existing capabilities
- Type-safe — TS will error on any Record<IntegrationCapability> missing this key

**2. CAPABILITY_OPERATIONS Record (admin.ts:249-256)** ✓
- `credit_check: ["check"]` present
- Matches all other capabilities (all single-operation for now)

**3. CAPABILITY_DEFAULT_INVOCATION_MODE Record (admin.ts:264-271)** ✓
- `credit_check: "sync"` present
- Coherent with sanction_screening (both sync, both quick API calls)

**4. ProductCompliancePanel CapabilityKey Union (ProductCompliancePanel.tsx:40-46)** ✓
- `credit_check` added to local union type

**5. CAPABILITY_REGISTRY (ProductCompliancePanel.tsx:54-109)** ✓
- Entry present with:
  - `key: "credit_check"`
  - `icon: CreditCard` (imported from lucide-react at line 9) ✓
  - `defaultTriggers: ["NEW_BUSINESS", "RENEWAL"]` — sensible defaults for underwriting gate
  - `defaultOutcomeRules: { passWhen: { maxScore: 0.5 }, failWhen: { minScore: 0.85, onTopics: ["credit.high_risk"] } }` — correctly tuned
- Matches `CapabilityDef` interface (lines 48-53) perfectly

**6. useCapabilityText() label/blurb switch (ProductCompliancePanel.tsx:113-147)** ✓
- Case `"credit_check"` present in both `label` and `blurb` functions
- `t("Credit Check")` (line 128) — literal string ✓
- Blurb at lines 143-144 is a literal string ✓
- Both switches are now **exhaustive** — no missing cases that would cause TS error

**7. IntegrationsTab CAPABILITIES array (IntegrationsTab.tsx:36-43)** ✓
- `"credit_check"` present at line 42
- Array of all 6 capabilities in correct order

**8. ComplianceChecksSection capabilityLabel switch (ComplianceChecksSection.tsx:75-95)** ✓
- Case `"credit_check"` at line 87-88 with `t("Credit Check")`
- Switch is now **exhaustive** (returns default for undefined/empty case, else falls back to raw slug)

**9. SanctionScreeningPanel capabilityLabel switch (SanctionScreeningPanel.tsx:87-107)** ✓
- Case `"credit_check"` at lines 99-100 with `t("Credit Check")`
- Switch is now **exhaustive**

**10. Screening page capabilityLabel switch (page.tsx:41-61)** ✓
- Case `"credit_check"` at lines 53-54 with `t("Credit Check")`
- Switch is now **exhaustive**

---

### i18n CHECKS

**Literal String Usage:**
- All `t()` calls use literal string arguments ✓
- `t("Credit Check")` appears consistently (4 times across portal files)
- No dynamic values passed to `t()` ✓

---

### TYPE SAFETY

**ProductCompliancePanel CAPABILITY_REGISTRY entry vs CapabilityDef:**
- Entry at lines 101-108 has all required fields:
  - `key: "credit_check"` — matches CapabilityKey union ✓
  - `icon: CreditCard` — LucideIcon type ✓
  - `defaultTriggers: ["NEW_BUSINESS", "RENEWAL"]` — ComplianceTrigger[] ✓
  - `defaultOutcomeRules: {...}` — matches ProductCapabilityConfig["outcomeRules"] ✓
- **Entry is type-safe** ✓

**useCapabilityText label/blurb exhaustiveness:**
- Both functions have explicit cases for all 6 capabilities (sanction_screening, pep, kyc, adverse_media, fraud_detection, credit_check)
- Both return `string` and TS will error if any case is missing
- **Switches are exhaustive** ✓

---

### SmartSetup Prompt Contract

**File: externalIntegrationSmartSetup.ts (lines 57-81)**

The `credit_check` contract is **well-defined and coherent:**
- Input shape correctly documented: parties array with role, firstName, lastName, etc.
- **CRITICAL:** Lines 74-75 specify that score is "NORMALISED CREDIT-RISK score in [0,1] where HIGHER means RISKIER"
- This **correctly matches the runner's outcome engine** expectations (fail/block on HIGH score) ✓
- Response shape reuses sanction_screening match format (entityId, entityName, score, topics, datasets, sourceUrl) — logical reuse ✓
- Transformation guidance is explicit: "a provider scale where high = good MUST be inverted via a transformation/derived field" (lines 76-77)
- Topics guidance: "credit.high_risk", "credit.default", "credit.thin_file" (lines 79-80) — aligns with defaultOutcomeRules failWhen onTopics ✓

**Comparison to sanction_screening contract:**
- Parallel structure: both define input (parties), both define output (matches array with canonical fields)
- sanction_screening contract (lines 38-56) has identical match shape
- No contradictions detected ✓

**LOCAL TYPE NARROWING (line 1):**
- `export type IntegrationCapability = "sanction_screening" | "credit_check";`
- This is **INTENTIONALLY NARROWED** for this prompt file (only these 2 are tested in the current SmartSetup feature)
- Does NOT affect the portal's admin.ts union type (which remains complete with all 6) ✓
- This is correct — the prompt can be capability-aware without affecting production types

---

### TEST CORRECTNESS

**File: 08-compliance-checks.spec.ts**

**Test 1: Create credit_check integration (lines 276-299)** ✓
- Sets `creditIntegrationId` which is used in subsequent tests
- Follows same pattern as sanction_screening integration setup (lines 27-56)
- Test is serial-safe: depends on prior sanction_screening setup, feeds subsequent credit_check config test

**Test 2: PUT complianceChecks.credit_check round-trip (lines 301-328)** ✓
- Config structure matches ProductCapabilityConfig interface:
  - `enabled: true` ✓
  - `integrationId: creditIntegrationId` (set by prior test) ✓
  - `triggers: ['NEW_BUSINESS', 'RENEWAL']` ✓
  - `parties: { policyholder: 'personal', additional: [] }` ✓
  - `outcomeRules: { passWhen: { maxScore: 0.5 }, failWhen: { minScore: 0.85, onTopics: ['credit.high_risk'] } }` ✓
  - `autoReject: false` (line 315) ✓ — optional field, correctly included
- **Line 326 assertion**: `expect(body.data.complianceChecks).toEqual({ credit_check: config })`
  - This assertion **will round-trip correctly** because:
    - The config passed to PUT (lines 303-316) includes all fields expected on GET
    - API persists optional fields (autoReject, messages) — verified by existing sanction_screening round-trip test (lines 58-85) which also uses `.toEqual()` and passes
    - No evidence that API strips optional fields (see product.ts lines 86-90 where both are optional but persisted)
- **Verified**: existing sanction_screening test at line 84 uses same `.toEqual()` pattern without `autoReject` (since sanction doesn't have it), so the pattern is proven ✓

**Test 3: List filter for credit_check (lines 330-339)** ✓
- Tests `GET /v1/plus/external-integrations` with implicit filtering by capability (not a query param, but response items are filtered client-side)
- Verifies integrations returned have `capability: 'credit_check'`
- Matches existing sanction_screening filter test (lines 263-274) in structure
- **Assertion at line 336**: loops through results and verifies each has `capability === 'credit_check'` ✓

**Serial Safety:**
- Line 20: `test.describe.serial(...)` ensures tests run in order
- Test 1 (seed) sets `creditIntegrationId` at line 297
- Test 2 reads `creditIntegrationId` at line 305 (set by prior test, serial guarantee)
- Test 3 reads `creditIntegrationId` implicitly via prior setup
- **All dependencies honored** ✓

**Field Persistence Risk:**
- Test 2 includes `autoReject: false` in config
- Admin UI code at ProductCompliancePanel.tsx:175 sets `autoReject: false` in buildDefaultConfig
- Type definition at product.ts:86 marks `autoReject?` as optional
- **No risk**: optional fields are persisted and returned by the API (proven by existing sanction test using `.toEqual()`) ✓

---

### FINAL SUMMARY

**NO REMAINING HIGH OR MEDIUM ISSUES.**

All checks pass:
- ✓ Exhaustive coverage: credit_check added to all IntegrationCapability records and unions
- ✓ No silent omissi

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && grep -A5 \"buildCallLog\\|writeCallLog\" src/domains/integrations/runtime/audit.ts | head -20"}

 * NOT write to the database — callers pass the result to {@link writeCallLog}.
 */
export function buildCallLog(input: CallLogInput): Parameters<typeof CallLog.create>[0] {
  const requestExcerpt = {
    method: input.request.method,
    url: input.request.url,
    headers: redactHeaders(input.request.headers),
    body: input.request.body !== undefined ? truncate(redactObject(input.request.body)) : null,
--
export async function writeCallLog(
  row: Parameters<typeof CallLog.create>[0],
  onError: (err: unknown) => void,
): Promise<_ExternalIntegrationCallLog | null> {
  try {
    const created = await CallLog.create(row);

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat && grep -rn \"buildCallLog\" src --include=\"*.ts\" | grep -v test | grep -v audit.ts"}

src/domains/integrations/kinds/genericRest/adapter.ts:19:import { buildCallLog, writeCallLog } from '../../runtime/audit.js';
src/domains/integrations/kinds/genericRest/adapter.ts:110:  const logRow = buildCallLog({

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/src/domains/integrations/kinds/genericRest/adapter.ts","offset":100,"limit":50}

100	    { timeoutMs: template.timeoutMs, retryPolicy: template.retryPolicy },
101	  );
102	
103	  const isSuccess = outcome.kind === 'success';
104	  const status: 'success' | 'error' | 'timeout' =
105	    outcome.kind === 'timeout' ? 'timeout' : outcome.kind === 'error' ? 'error' : 'success';
106	  const httpStatus =
107	    outcome.kind === 'timeout' ? null : outcome.response?.status ?? null;
108	  const responseBody = outcome.kind === 'timeout' ? null : outcome.response?.body;
109	
110	  const logRow = buildCallLog({
111	    integrationId: ctx.integration.id,
112	    organizationId: ctx.integration.organizationId,
113	    capability: ctx.integration.capability,
114	    operation: ctx.operation,
115	    correlationId: ctx.correlationId,
116	    status,
117	    httpStatus,
118	    durationMs: outcome.durationMs,
119	    attempts: outcome.attempts,
120	    request: { method: template.httpMethod, url, headers, body: renderedBody ?? undefined },
121	    response:
122	      outcome.kind === 'timeout'
123	        ? null
124	        : {
125	            headers: outcome.response?.headers ?? {},
126	            body: responseBody,
127	          },
128	    errorMessage: outcome.kind === 'success' ? null : outcome.message,
129	  });
130	  await writeCallLog(logRow, () => {
131	    // Audit failures are swallowed; caller-level logging will surface them.
132	  });
133	
134	  if (!isSuccess || outcome.kind !== 'success') {
135	    const baseMessage =
136	      outcome.kind === 'timeout' ? outcome.message : (outcome as { message: string }).message;
137	    // Surface up to ~2KB of the provider response body in the thrown error so
138	    // admins debugging "HTTP 4xx from provider" see what the provider actually
139	    // said (validation detail, missing field, schema complaint) without
140	    // hunting through call logs. Bodies bigger than the cap get truncated;
141	    // structured bodies are JSON-stringified compactly.
142	    const detail = (() => {
143	      if (outcome.kind === 'timeout' || !outcome.response || outcome.response.body === undefined) {
144	        return null;
145	      }
146	      const body = outcome.response.body;
147	      const text = typeof body === 'string' ? body : JSON.stringify(body);
148	      if (!text) return null;
149	      const MAX = 2048;

Perfect! Line 113 passes `ctx.integration.capability` which is a string. Everything is properly typed and compatible.

Now let me create a comprehensive summary of my findings:

## Code Review Summary: Credit Check Compliance Capability Addition

### Files Changed
1. `src/domains/integrations/runner.ts` - Capability registration
2. `src/routes/plus/externalIntegrationsRoutes.ts` - API route enum
3. `src/db/migrations/2026.05.31T00.00.01.widen-call-log-capability.ts` - Database migration (untracked)
4. `src/models/internal/_ExternalIntegrationCallLog.ts` - Model type change
5. `src/schemas/typebox/integration/ExternalIntegrationCallLog.ts` - Schema type change

### Verification Results

#### Migration Safety: HIGH CONFIDENCE PASS
- **Enum type name**: `enum_ExternalIntegrationCallLogs_capability` is correctly derived from the original `2026.05.14T00.00.04.create-external-integration-call-logs.ts` which uses `DataTypes.ENUM('sanction_screening')` without explicit naming, causing Sequelize to auto-generate this standard pattern.
- **Syntax precedent**: Matches exactly the pattern in `2026.05.19T00.00.07.add-integration-invocation-mode.ts` which widened `ExternalIntegrations.capability`.
- **Forward-only deployment**: Down migration is a stub as intended.
- **IF EXISTS safety**: DROP TYPE IF EXISTS ensures no failure if type already dropped or never existed.

#### Drift Test Impact: PASS
- Field names in PublicFields array are unchanged: `'capability'` still appears in the list
- Field NAMES in Schema.properties unchanged
- Only TYPE changed from `Type.Union([Type.Literal('sanction_screening')])` to `Type.String({maxLength:64})`
- Drift test at line 469-479 of drift.apitest.ts compares key names, not types: `Object.keys(Schema.properties)` vs `PublicFields` — no breakage
- PrivateFields test unaffected (no private fields on CallLog)

#### No Runtime Hardcoding Found
- **No capability switches/cases**: No code branches on specific capability values
- **No filtering arrays**: No `['sanction_screening']` or similar exclusion lists in runtime code
- **No validation arrays**: capability field has no enum validator at call sites
- **Generic framework**: runner.ts uses `getCapability()` lookup, runCheck.ts uses generic pipeline with `product.complianceChecks[capability]`
- **policyIssuanceService.ts**: Iterates over `product.complianceChecks` keys (lines 128-134), capability-agnostic
- **audit.ts**: Passes `ctx.integration.capability: string` to buildCallLog, handler writes it as-is to DB

#### Outcome Rules Semantics: CORRECT
- `applyOutcomeRules()` at runCheck.ts:124-143:
  - Higher score → fail (lines 135-136: `if (topScore >= failRule.minScore) return 'fail'`)
  - Lower score → pass (line 141: `if (topScore < passRule.maxScore) return 'pass'`)
  - Between thresholds → review
- **Semantic correctness for credit_check**: A higher credit risk score SHOULD fail, lower score should pass. Logic is sound.
- **Tests confirm**: runCheck.test.ts at line 77-78 validates `finding(0.95)` with `minScore: 0.9` returns `'fail'` ✓

#### Type Consistency: CLEAN
- Model `capability: string` (was `'sanction_screening'` literal)
- Schema `Type.String({maxLength:64})` (was `Type.Union([Type.Literal('sanction_screening')])`)
- Call site passes `string` value (adapter.ts line 113)
- Registry accepts `CapabilityId = string` (registry.ts line 4)

---

## Final Assessment

**NO REMAINING HIGH OR MEDIUM ISSUES**

The change is production-ready:
- Database migration is safe with correct enum type name and IF EXISTS guard
- Schema changes are semantically correct and drift-test compatible
- No runtime hardcoding excludes credit_check
- Generic framework properly handles new capability without code duplication
- Outcome rules logic is correct for credit risk scoring (high=bad)
- All type signatures are consistent from database through API

{"command":"echo \"=== stack re-verify (post-edit) ===\"\ncurl -fsS -o /dev/null -w \"api/:    %{http_code}\\n\" http://localhost:4006/ 2>&1 || echo \"api DOWN\"\ncurl -fsS -o /dev/null -w \"portal:  %{http_code}\\n\" http://localhost:3006/ 2>&1 || echo \"portal DOWN\"\ncurl -fsS -o /dev/null -w \"embed:   %{http_code}\\n\" http://localhost:3106/ 2>&1 || echo \"embed DOWN\"\necho \"=== api log tail (check clean reload) ===\"\ndocker logs --tail=8 sherpa-api-api-458-credit-check-compliance-integrat 2>&1 | tail -8","description":"Re-verify all services healthy after edits"}

=== stack re-verify (post-edit) ===
api/:    200
portal:  200
embed:   200
=== api log tail (check clean reload) ===
   Mailcatcher:     http://localhost:1080

{"time":"2026-05-31T21:31:03.729Z","msg":"Starting inline workers..."}
{"time":"2026-05-31T21:31:03.729Z","msg":"Journey stream processor starting"}
{"time":"2026-05-31T21:37:32.745Z","reqId":"req-1","method":"GET","url":"/","msg":"request"}
{"time":"2026-05-31T21:37:32.750Z","reqId":"req-1","method":"GET","url":"/","status":200,"msg":"response"}
{"time":"2026-05-31T21:37:32.770Z","reqId":"req-2","method":"GET","url":"/v1/organization?by=origin","msg":"request"}
{"time":"2026-05-31T21:37:32.773Z","reqId":"req-2","method":"GET","url":"/v1/organization?by=origin","status":200,"msg":"response"}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/tests/auth.setup.ts"}

1	import { test as setup } from '@playwright/test';
2	import { getPortalUrl } from './utils/urls';
3	import * as fs from 'fs';
4	
5	const authFile = 'playwright/.auth/user.json';
6	
7	setup('authenticate', async ({ page, context }) => {
8	  const portalUrl = getPortalUrl();
9	  const testEmail = process.env.TEST_USER_EMAIL || '';
10	  const testPassword = process.env.TEST_USER_PASSWORD || '';
11	
12	  // Load existing storage state if it exists (to reuse Microsoft persistent cookies)
13	  if (fs.existsSync(authFile)) {
14	    const storageState = JSON.parse(fs.readFileSync(authFile, 'utf-8'));
15	    await context.addCookies(storageState.cookies || []);
16	  }
17	
18	  await page.goto(portalUrl);
19	
20	  // Always click login to trigger OAuth flow and get fresh app tokens
21	  // Microsoft cookies will allow us to skip MFA, but we need the OAuth redirect for app tokens
22	  await page.getByRole('button', { name: /log in with microsoft entra id/i }).click();
23	  await page.waitForURL(/login\.microsoftonline\.com/);
24	
25	  // Check if "Pick an account" page is shown (user already signed in via cookies)
26	  const accountTile = page.getByText(testEmail).first();
27	  const emailInput = page.getByPlaceholder(/email, phone, or skype/i);
28	
29	  // Wait for either account picker or email input
30	  await Promise.race([
31	    accountTile.waitFor({ timeout: 5000 }).catch(() => {}),
32	    emailInput.waitFor({ timeout: 5000 }).catch(() => {})
33	  ]);
34	
35	  if (await accountTile.isVisible().catch(() => false)) {
36	    // Click the existing account tile to continue
37	    console.log('Account picker detected, clicking existing account');
38	    await accountTile.click();
39	  } else {
40	    // Fresh login flow
41	    await emailInput.fill(testEmail);
42	    await page.getByRole('button', { name: /next/i }).click();
43	
44	    await page.getByPlaceholder(/password/i).waitFor({ timeout: 10000 });
45	    await page.getByPlaceholder(/password/i).fill(testPassword);
46	    await page.getByRole('button', { name: /sign in/i }).click();
47	  }
48	  
49	  const maxAttempts = 100;
50	  let attempt = 0;
51	  
52	  while (attempt < maxAttempts) {
53	    await page.waitForTimeout(500);
54	    attempt++;
55	
56	    // Check for successful login FIRST - before looking for Microsoft flow buttons
57	    // This prevents clicking pagination "Next" buttons on the portal
58	    const currentUrl = page.url();
59	    if (currentUrl.includes(portalUrl) && !currentUrl.includes('/login')) {
60	      // Wait for the app to fully load user data before saving state
61	      // The email being visible indicates the user object is populated
62	      const userEmail = page.getByText(testEmail);
63	      if (await userEmail.isVisible({ timeout: 1000 }).catch(() => false)) {
64	        console.log('Login successful, saving storage state');
65	        await page.context().storageState({ path: authFile });
66	        return;
67	      }
68	    }
69	
70	    // Only look for Microsoft login flow buttons if we're still on Microsoft's domain
71	    if (!currentUrl.includes('microsoftonline.com')) {
72	      continue;
73	    }
74	
75	    const passwordInput = page.getByPlaceholder(/password/i);
76	    if (await passwordInput.isVisible().catch(() => false)) {
77	      console.log('Password prompt detected, entering password');
78	      await passwordInput.fill(testPassword);
79	      await page.getByRole('button', { name: /sign in/i }).click();
80	      continue;
81	    }
82	
83	    const nextButton = page.getByRole('button', { name: /next/i });
84	    const yesButton = page.getByRole('button', { name: /yes/i });
85	    const doneButton = page.getByRole('button', { name: /done/i });
86	
87	    if (await nextButton.isVisible().catch(() => false)) {
88	      await nextButton.click();
89	      continue;
90	    }
91	
92	    if (await yesButton.isVisible().catch(() => false)) {
93	      const staySignedInCheckbox = page.getByRole('checkbox', { name: /don't show this again/i });
94	      if (await staySignedInCheckbox.isVisible().catch(() => false)) {
95	        await staySignedInCheckbox.check();
96	      }
97	      await yesButton.click();
98	      continue;
99	    }
100	
101	    if (await doneButton.isVisible().catch(() => false)) {
102	      await doneButton.click();
103	      continue;
104	    }
105	  }
106	  
107	  throw new Error('Login did not complete within 50 seconds');
108	});
109	
110	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/tests/utils/urls.ts"}

1	export function getPortalUrl(): string {
2	  const env = process.env.ENV || 'local';
3	  
4	  if (env === 'local') {
5	    return process.env.SHERPA_PORTAL_HTTP || 'http://localhost:3000';
6	  }
7	  
8	  if (env === 'dev') {
9	    return process.env.SHERPA_PORTAL_DEV_HTTPS || '';
10	  }
11	  
12	  if (env === 'staging') {
13	    return process.env.SHERPA_PORTAL_STAGING_HTTPS || '';
14	  }
15	  
16	  if (env === 'production') {
17	    return process.env.SHERPA_PORTAL_PROD_HTTPS || '';
18	  }
19	  
20	  return process.env.SHERPA_PORTAL_HTTPS || '';
21	}
22	
23	export function getApiUrl(): string {
24	  const env = process.env.ENV || 'local';
25	  
26	  if (env === 'local') {
27	    return process.env.SHERPA_API_HTTP || 'http://localhost:4000';
28	  }
29	  
30	  if (env === 'dev') {
31	    return process.env.SHERPA_API_DEV_HTTPS || '';
32	  }
33	  
34	  if (env === 'staging') {
35	    return process.env.SHERPA_API_STAGING_HTTPS || '';
36	  }
37	  
38	  if (env === 'production') {
39	    return process.env.SHERPA_API_PROD_HTTPS || '';
40	  }
41	  
42	  return process.env.SHERPA_API_HTTPS || '';
43	}
44	
45	export function getEmbedUrl(): string {
46	  const env = process.env.ENV || 'local';
47	
48	  if (env === 'local') {
49	    return process.env.SHERPA_EMBED_HTTP || 'http://localhost:3101';
50	  }
51	
52	  if (env === 'dev') {
53	    return process.env.SHERPA_EMBED_DEV_HTTPS || '';
54	  }
55	
56	  if (env === 'staging') {
57	    return process.env.SHERPA_EMBED_STAGING_HTTPS || '';
58	  }
59	
60	  if (env === 'production') {
61	    return process.env.SHERPA_EMBED_PROD_HTTPS || '';
62	  }
63	
64	  return process.env.SHERPA_EMBED_HTTPS || '';
65	}
66	
67	export function getWayniPortalUrl(): string {
68	  const env = process.env.ENV || 'local';
69	  
70	  if (env === 'local') {
71	    return process.env.WAYNI_PORTAL_URL || 'https://portal.wayni.chris.dev.gangkhar.dev';
72	  }
73	  
74	  if (env === 'dev') {
75	    return process.env.WAYNI_PORTAL_DEV_URL || 'https://portal.wayni.dev.gangkhar.dev';
76	  }
77	  
78	  if (env === 'staging') {
79	    return process.env.WAYNI_PORTAL_STAGING_URL || 'https://portal.wayni.staging.gangkhar.dev';
80	  }
81	  
82	  return process.env.WAYNI_PORTAL_URL || 'https://portal.wayni.chris.dev.gangkhar.dev';
83	}
84	
85	

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat\necho \"=== .env present? keys only (no values) ===\"; test -f .env && rg -o '^[A-Z_]+(?==)' .env | sort -u || echo \".env MISSING\"\necho \"=== dotenv load in playwright.config ===\"; rg -n 'dotenv|\\.env|ENV|storageState|use:' playwright.config.ts | head -20\necho \"=== seeded auth state age/size ===\"; ls -la playwright/.auth/user.json 2>&1; echo \"cookie count:\"; node -e \"const s=require('./playwright/.auth/user.json'); console.log('cookies:', (s.cookies||[]).length, 'origins:', (s.origins||[]).length)\" 2>&1","description":"Check test .env keys + config env loading + auth state"}

=== .env present? keys only (no values) ===
rg: regex parse error:
    (?:^[A-Z_]+(?==))
               ^^^
error: look-around, including look-ahead and look-behind, is not supported

Consider enabling PCRE2 with the --pcre2 flag, which can handle backreferences
and look-around.
=== dotenv load in playwright.config ===
2:import dotenv from 'dotenv';
5:dotenv.config({ path: path.resolve(__dirname, '.env') });
13:  forbidOnly: !!process.env.CI,
14:  retries: process.env.CI ? 2 : 0,
19:  use: {
33:      use: {},
41:      use: {
43:        storageState: 'playwright/.auth/user.json',
52:      use: {},
59:      use: {},
66:      use: {},
73:      use: {},
78:      use: {},
84:      use: {},
90:      use: {
98:      use: { 
100:        storageState: 'playwright/.auth/user.json',
109:      use: { 
111:        storageState: 'playwright/.auth/user.json',
120:      use: { 
=== seeded auth state age/size ===
-rw-r--r--@ 1 bakker  staff  13813 May 31 14:28 playwright/.auth/user.json
cookie count:
cookies: 17 origins: 1

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat\necho \"=== .env keys (names only) ===\"; rg -o '^[A-Z_0-9]+=' .env | tr -d '=' | sort -u\necho \"=== origin in seeded auth ===\"; node -e \"const s=require('./playwright/.auth/user.json'); console.log('origin:', (s.origins||[]).map(o=>o.origin).join(',')); console.log('cookie domains:', [...new Set((s.cookies||[]).map(c=>c.domain))].join(', '))\" 2>&1","description":"List .env key names + seeded auth origin/domains"}

=== .env keys (names only) ===
DEVELOPER_NAME
ENV
SHERPA_API_DEV_HTTPS
SHERPA_API_HTTP
SHERPA_API_HTTPS
SHERPA_API_PROD_HTTPS
SHERPA_API_STAGING_HTTPS
SHERPA_PORTAL_DEV_HTTPS
SHERPA_PORTAL_HTTP
SHERPA_PORTAL_HTTPS
SHERPA_PORTAL_PROD_HTTPS
SHERPA_PORTAL_STAGING_HTTPS
SHERPA_TEST_CLIENT_ID
SHERPA_TEST_CLIENT_SECRET
TEST_USER_EMAIL
TEST_USER_PASSWORD
WAYNI_PORTAL_DEV_URL
WAYNI_PORTAL_STAGING_URL
WAYNI_PORTAL_URL
=== origin in seeded auth ===
origin: http://localhost:3000
cookie domains: login.microsoftonline.com, .login.microsoftonline.com, .microsoftonline.com, .gangkhar.dev, .login.live.com

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat\nenv SHERPA_PORTAL_HTTP=http://localhost:3006 SHERPA_API_HTTP=http://localhost:4006 ENV=local npx playwright test --project=setup --reporter=line 2>&1 | tail -25; echo \"=== setup exit done ===\"","description":"Run Playwright auth setup against portal 3006","timeout":180000}

Running 1 test using 1 worker

[1/1] [setup] › tests/auth.setup.ts:7:6 › authenticate
[setup] › tests/auth.setup.ts:7:6 › authenticate
Account picker detected, clicking existing account

Login successful, saving storage state

  1 passed (10.1s)
=== setup exit done ===

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat\necho \"=== where IntegrationsTab is mounted (route) ===\"; rg -rn 'IntegrationsTab' app --glob '*.tsx' | rg -v 'IntegrationsTab.tsx:'\necho \"=== where ProductCompliancePanel is mounted ===\"; rg -rn 'ProductCompliancePanel' app --glob '*.tsx' | rg -v 'ProductCompliancePanel.tsx:'\necho \"=== admin integrations route files ===\"; fd -e tsx . app/admin 2>/dev/null | head; fd . app -t d -d 1 2>/dev/null | head -40","description":"Find route mount points for the credit_check UI"}

=== where IntegrationsTab is mounted (route) ===
app/admin/page.tsx:import n from "@/app/components/admin/n";
app/admin/page.tsx:        {activeTab === "integrations" && <n />}
=== where ProductCompliancePanel is mounted ===
app/products/[id]/compliance/page.tsx:import n from "@/app/components/products/n";
app/products/[id]/compliance/page.tsx:          <n productId={productId} />
=== admin integrations route files ===
app/admin/integrations/[id]/page.tsx
app/admin/page.tsx
app/admin/
app/api/
app/auth/
app/bundles/
app/chat/
app/components/
app/constants/
app/create-account/
app/customer-portal/
app/customers/
app/dashboard/
app/dashboard-legacy/
app/data/
app/dev/
app/docs/
app/domain-blocked/
app/embed-customer-portal/
app/financials/
app/fonts/
app/forgot-password/
app/hooks/
app/lens/
app/lib/
app/login/
app/mcp/
app/partners/
app/policy-management/
app/products/
app/profile/
app/prompts/
app/register/
app/repairs/
app/reset-password/
app/services/
app/settings/
app/src/
app/team/
app/two-factor-setup/
app/two-factor-verify/
app/types/

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat\necho \"=== admin tab mechanism ===\"; rg -n 'activeTab|useSearchParams|searchParams|setActiveTab|tab ===|integrations' app/admin/page.tsx | head -25","description":"Inspect admin page tab switching"}

=== admin tab mechanism ===
5:import { useSearchParams } from "next/navigation";
25:  | "integrations"
31:  const searchParams = useSearchParams();
32:  const activeTab = (searchParams.get("tab") as AdminTab | null) || "organizations";
37:        {activeTab === "organizations" && <OrganizationsTab />}
38:        {activeTab === "users" && <UsersTab />}
39:        {activeTab === "modules" && <ModulesTab />}
40:        {activeTab === "partners" && <PartnersTab />}
41:        {activeTab === "integrations" && <IntegrationsTab />}
42:        {activeTab === "insurance-types" && <InsuranceTypesTab />}
43:        {activeTab === "data-model" && <DataModelTab />}
44:        {activeTab === "audit-logs" && <AuditLogsTab />}

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat\necho \"=== ORGANIZATION_ID from test-data ===\"; rg -n 'ORGANIZATION_ID' tests/plus-insurance/helpers/test-data.ts | head\necho \"=== fetch a product id + existing integrations via API (client creds) ===\"\nset -l CID (rg -o 'SHERPA_TEST_CLIENT_ID=.*' .env | string replace 'SHERPA_TEST_CLIENT_ID=' '')\nset -l CSEC (rg -o 'SHERPA_TEST_CLIENT_SECRET=.*' .env | string replace 'SHERPA_TEST_CLIENT_SECRET=' '')\nset -l ORG (rg -o 'ORGANIZATION_ID = .(.*).;' tests/plus-insurance/helpers/test-data.ts | rg -o '[0-9a-f-]{36}')\necho \"org=$ORG\"\nset -l TOKEN (curl -fsS -X POST http://localhost:4006/v1/auth/client-token -H 'Content-Type: application/json' -d \"{\\\"clientId\\\":\\\"$CID\\\",\\\"clientSecret\\\":\\\"$CSEC\\\"}\" 2>/dev/null | node -e \"let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{const j=JSON.parse(d);console.log(j.data?.token||j.token||j.access_token||'')}catch(e){console.log('')}})\")\necho \"token len:\" (string length -- $TOKEN)","description":"Get ORGANIZATION_ID and a client token"}

Exit code 1
(eval):8: parse error near `)'

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/tests/plus-insurance/helpers/api-client.ts"}

1	import { APIRequestContext, APIResponse } from '@playwright/test';
2	
3	function toCurl(method: string, url: string, headers: Record<string, string>, data?: any): string {
4	  const parts = [`curl -X ${method.toUpperCase()} '${url}'`];
5	  for (const [key, value] of Object.entries(headers)) {
6	    parts.push(`  -H '${key}: ${value}'`);
7	  }
8	  if (data !== undefined) {
9	    parts.push(`  -d '${JSON.stringify(data)}'`);
10	  }
11	  return parts.join(' \\\n');
12	}
13	
14	async function logIfFailed(response: APIResponse, method: string, url: string, headers: Record<string, string>, data?: any, silent = false): Promise<APIResponse> {
15	  if (response.status() >= 400 && !silent) {
16	    let body: any;
17	    try { body = await response.json(); } catch { body = await response.text(); }
18	    console.error(`\n❌ API ${method.toUpperCase()} ${url} → ${response.status()}`);
19	    console.error(`Response body: ${JSON.stringify(body, null, 2)}`);
20	    console.error(`cURL:\n${toCurl(method, url, headers, data)}\n`);
21	  }
22	  return response;
23	}
24	
25	export class ApiClient {
26	  /** Set to true to suppress error logging (for unhappy-path tests that expect 4xx/5xx) */
27	  expectErrors = false;
28	
29	  constructor(
30	    private request: APIRequestContext,
31	    private baseURL: string,
32	    private clientId: string,
33	    private clientSecret: string
34	  ) {}
35	
36	  private getHeaders() {
37	    return {
38	      'Authorization': `Client ${this.clientId}:${this.clientSecret}`,
39	      'Content-Type': 'application/json',
40	    };
41	  }
42	
43	  async post(endpoint: string, data: any) {
44	    const url = `${this.baseURL}${endpoint}`;
45	    const headers = this.getHeaders();
46	    const response = await this.request.post(url, { headers, data });
47	    return logIfFailed(response, 'POST', url, headers, data, this.expectErrors);
48	  }
49	
50	  async patch(endpoint: string, data: any) {
51	    const url = `${this.baseURL}${endpoint}`;
52	    const headers = this.getHeaders();
53	    const response = await this.request.patch(url, { headers, data });
54	    return logIfFailed(response, 'PATCH', url, headers, data, this.expectErrors);
55	  }
56	
57	  async put(endpoint: string, data: any) {
58	    const url = `${this.baseURL}${endpoint}`;
59	    const headers = this.getHeaders();
60	    const response = await this.request.put(url, { headers, data });
61	    return logIfFailed(response, 'PUT', url, headers, data, this.expectErrors);
62	  }
63	
64	  async get(endpoint: string) {
65	    const url = `${this.baseURL}${endpoint}`;
66	    const headers = this.getHeaders();
67	    const response = await this.request.get(url, { headers });
68	    return logIfFailed(response, 'GET', url, headers, undefined, this.expectErrors);
69	  }
70	
71	  async delete(endpoint: string) {
72	    const url = `${this.baseURL}${endpoint}`;
73	    const headers = this.getHeaders();
74	    const response = await this.request.delete(url, { headers });
75	    return logIfFailed(response, 'DELETE', url, headers, undefined, this.expectErrors);
76	  }
77	}
78	
79	export class WidgetApiClient {
80	  /** Set to true to suppress error logging (for unhappy-path tests that expect 4xx/5xx) */
81	  expectErrors = false;
82	
83	  constructor(
84	    private request: APIRequestContext,
85	    private baseURL: string,
86	    private widgetToken: string,
87	    private parentDomain: string = 'localhost'
88	  ) {}
89	
90	  private getHeaders() {
91	    return {
92	      'X-Widget-Token': this.widgetToken,
93	      'X-Parent-Domain': this.parentDomain,
94	      'Content-Type': 'application/json',
95	    };
96	  }
97	
98	  async post(endpoint: string, data: any) {
99	    const url = `${this.baseURL}${endpoint}`;
100	    const headers = this.getHeaders();
101	    const response = await this.request.post(url, { headers, data });
102	    return logIfFailed(response, 'POST', url, headers, data, this.expectErrors);
103	  }
104	
105	  async get(endpoint: string) {
106	    const url = `${this.baseURL}${endpoint}`;
107	    const headers = this.getHeaders();
108	    const response = await this.request.get(url, { headers });
109	    return logIfFailed(response, 'GET', url, headers, undefined, this.expectErrors);
110	  }
111	
112	  async getAllowPdf(endpoint: string) {
113	    const url = `${this.baseURL}${endpoint}`;
114	    const headers = { ...this.getHeaders(), Accept: 'application/pdf,*/*' };
115	    const response = await this.request.get(url, { headers });
116	    return logIfFailed(response, 'GET', url, headers, undefined, this.expectErrors);
117	  }
118	}
119	

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/credit-check-proof.mjs","content":"// Browser proof for sherpa-api#458 — credit_check compliance integration.\n// Seeds a credit_check provider via the API, then drives the real portal UI:\n//   1. Admin → Integrations: provider selector offers \"Credit Check\"\n//   2. Product → Compliance tab: \"Credit Check\" is a selectable check type, fully configurable\n// Screenshots land in the api worktree's .auto-proof/ dir.\nimport { chromium } from '@playwright/test';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nconst PORTAL = 'http://localhost:3006';\nconst API = 'http://localhost:4006';\nconst PROOF_DIR = '/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.auto-proof';\nconst AUTH = 'playwright/.auth/user.json';\n\nconst env = Object.fromEntries(\n  fs.readFileSync('.env', 'utf-8')\n    .split('\\n')\n    .filter((l) => l.includes('=') && !l.trimStart().startsWith('#'))\n    .map((l) => {\n      const i = l.indexOf('=');\n      return [l.slice(0, i).trim(), l.slice(i + 1).trim()];\n    }),\n);\nconst clientAuth = `Client ${env.SHERPA_TEST_CLIENT_ID}:${env.SHERPA_TEST_CLIENT_SECRET}`;\nconst apiHeaders = { Authorization: clientAuth, 'Content-Type': 'application/json' };\n\nfs.mkdirSync(PROOF_DIR, { recursive: true });\nconst shot = async (page, name) => {\n  await page.screenshot({ path: path.join(PROOF_DIR, name), fullPage: true });\n  console.log(`  📸 ${name}`);\n};\n\nasync function api(method, endpoint, body) {\n  const res = await fetch(`${API}${endpoint}`, {\n    method,\n    headers: apiHeaders,\n    body: body ? JSON.stringify(body) : undefined,\n  });\n  const json = await res.json().catch(() => ({}));\n  return { status: res.status, json };\n}\n\n// ── 1. Seed a credit_check provider + locate a product ───────────────────────\nconsole.log('Seeding via API...');\nconst list = await api('GET', '/v1/plus/external-integrations');\nlet integrations = list.json.data ?? [];\nlet credit = integrations.find((i) => i.capability === 'credit_check' && i.active);\nif (!credit) {\n  const created = await api('POST', '/v1/plus/external-integrations', {\n    name: 'Demo Credit Bureau',\n    slug: `demo-credit-bureau-${Date.now()}`,\n    capability: 'credit_check',\n    kind: 'generic_rest',\n    defaultEnvironment: 'test',\n    active: true,\n  });\n  console.log(`  create credit_check integration → ${created.status}`);\n  if (created.status !== 201) throw new Error(`integration create failed: ${JSON.stringify(created.json)}`);\n  credit = created.json.data;\n}\nconsole.log(`  credit_check integration id: ${credit.id} (capability=${credit.capability})`);\n\nconst products = await api('GET', '/v1/plus/products?limit=25');\nconst productList = products.json.data?.products ?? products.json.data ?? [];\nif (!productList.length) throw new Error('no products available to configure');\nconst product = productList[0];\nconsole.log(`  product: ${product.id} \"${product.name ?? product.title ?? ''}\"`);\n\n// Pre-configure the product so the compliance tab renders a populated credit_check.\nconst cfg = {\n  enabled: true,\n  integrationId: credit.id,\n  triggers: ['NEW_BUSINESS', 'RENEWAL'],\n  parties: { policyholder: 'personal', additional: [] },\n  outcomeRules: { passWhen: { maxScore: 0.5 }, failWhen: { minScore: 0.85, onTopics: ['credit.high_risk'] } },\n  autoReject: true,\n};\nconst put = await api('PUT', `/v1/plus/products/${product.id}`, { complianceChecks: { credit_check: cfg } });\nconsole.log(`  PUT product complianceChecks.credit_check → ${put.status}`);\n\n// ── 2. Drive the portal UI ───────────────────────────────────────────────────\nconst consoleErrors = [];\nconst failedRequests = [];\nconst browser = await chromium.launch({ headless: true });\nconst context = await browser.newContext({ storageState: AUTH, viewport: { width: 1440, height: 1000 } });\nconst page = await context.newPage();\npage.on('console', (m) => { if (m.type() === 'error') consoleErrors.push(m.text()); });\npage.on('requestfailed', (r) => failedRequests.push(`${r.method()} ${r.url()} — ${r.failure()?.errorText}`));\npage.on('response', (r) => { if (r.url().includes('/v1/') && r.status() >= 400) failedRequests.push(`${r.status()} ${r.url()}`); });\n\ntry {\n  // 2a. Admin → Integrations list (provider selector lives here)\n  console.log('Admin → Integrations...');\n  await page.goto(`${PORTAL}/admin?tab=integrations`, { waitUntil: 'networkidle' });\n  await page.waitForTimeout(1500);\n  await shot(page, '01-admin-integrations-list.png');\n  // Confirm our credit_check provider row is present\n  const creditRow = page.getByText('Demo Credit Bureau', { exact: false }).first();\n  const creditRowVisible = await creditRow.isVisible().catch(() => false);\n  console.log(`  \"Demo Credit Bureau\" row visible: ${creditRowVisible}`);\n\n  // Open the create dialog to show the capability/provider selector includes Credit Check\n  const addBtn = page.getByRole('button', { name: /add|new|create/i }).first();\n  if (await addBtn.isVisible().catch(() => false)) {\n    await addBtn.click();\n    await page.waitForTimeout(800);\n    await shot(page, '02-integration-create-dialog.png');\n    // Reveal the capability dropdown options\n    const capSelect = page.locator('select').first();\n    if (await capSelect.isVisible().catch(() => false)) {\n      const opts = await capSelect.locator('option').allTextContents();\n      console.log(`  capability <select> options: ${JSON.stringify(opts)}`);\n    } else {\n      // custom dropdown — click anything labelled capability\n      const capTrigger = page.getByRole('button', { name: /capabilit|credit|sanction/i }).first();\n      if (await capTrigger.isVisible().catch(() => false)) {\n        await capTrigger.click();\n        await page.waitForTimeout(500);\n      }\n    }\n    await shot(page, '03-capability-options.png');\n    // Close dialog (Escape) be

File created successfully at: /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/credit-check-proof.mjs (file state is current in your context — no need to Read it back)

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat && node credit-check-proof.mjs 2>&1 | tail -45","description":"Run browser proof script","timeout":120000}

Seeding via API...
  create credit_check integration → 201
  credit_check integration id: 2fba92ff-1447-471b-8994-ccf364c5e35c (capability=credit_check)
  product: 196 ""
  PUT product complianceChecks.credit_check → 200
Admin → Integrations...
  📸 01-admin-integrations-list.png
  "Demo Credit Bureau" row visible: true
  📸 02-integration-create-dialog.png
  capability <select> options: ["sanction_screening","pep","kyc","adverse_media","fraud_detection","credit_check"]
  📸 03-capability-options.png
Product → Compliance...
  📸 04-product-compliance-tab.png
  "Credit Check" present on compliance tab: true
  📸 05-credit-check-config.png
  DOM check: {"hasCreditCheck":true,"hasSanction":false,"hasTriggers":false,"hasOutcome":true}

=== console errors ===
  (none)
=== failed/4xx requests ===
POST http://localhost:3006/monitoring?o=4510269804576768&p=4510269805887488&r=us — net::ERR_ABORTED

DONE

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.auto-proof/04-product-compliance-tab.png"}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.auto-proof/05-credit-check-config.png"}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.auto-proof/01-admin-integrations-list.png"}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.auto-proof/02-integration-create-dialog.png"}

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/credit-check-proof-dialog.mjs","content":"// Focused capture: the provider-creation dialog with capability = credit_check selected.\nimport { chromium } from '@playwright/test';\nimport path from 'node:path';\n\nconst PORTAL = 'http://localhost:3006';\nconst PROOF_DIR = '/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.auto-proof';\n\nconst browser = await chromium.launch({ headless: true });\nconst context = await browser.newContext({ storageState: 'playwright/.auth/user.json', viewport: { width: 1440, height: 1000 } });\nconst page = await context.newPage();\nawait page.goto(`${PORTAL}/admin?tab=integrations`, { waitUntil: 'networkidle' });\nawait page.waitForTimeout(1200);\nawait page.getByRole('button', { name: /add integration/i }).first().click();\nawait page.waitForTimeout(700);\nawait page.getByPlaceholder('OpenSanctions').fill('Demo Credit Bureau').catch(() => {});\nconst capSelect = page.locator('select').first();\nawait capSelect.selectOption('credit_check');\nawait page.waitForTimeout(400);\nconst selected = await capSelect.inputValue();\nconsole.log('capability select value:', selected);\nawait page.screenshot({ path: path.join(PROOF_DIR, '03-provider-selector-credit-check.png'), fullPage: true });\nconsole.log('📸 03-provider-selector-credit-check.png');\nawait browser.close();\nconsole.log('DONE');\n"}

File created successfully at: /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/credit-check-proof-dialog.mjs (file state is current in your context — no need to Read it back)

{"command":"node credit-check-proof-dialog.mjs 2>&1 | tail -10","description":"Capture provider dialog with credit_check selected","timeout":60000}

capability select value: credit_check
📸 03-provider-selector-credit-check.png
DONE

{"file_path":"/Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.auto-proof/03-provider-selector-credit-check.png"}

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat\nenv SHERPA_API_HTTP=http://localhost:4006 SHERPA_PORTAL_HTTP=http://localhost:3006 ENV=local npx playwright test tests/plus-insurance/08-compliance-checks.spec.ts --project=plus-insurance --reporter=line 2>&1 | tail -30; echo \"=== spec run done ===\"","description":"Run targeted credit_check compliance spec","timeout":180000}

Running 14 tests using 1 worker

[1/14] [plus-insurance] › tests/plus-insurance/08-compliance-checks.spec.ts:27:7 › Plus · Product compliance checks › seed: pick a screening integration + a product
[2/14] [plus-insurance] › tests/plus-insurance/08-compliance-checks.spec.ts:58:7 › Plus · Product compliance checks › PUT complianceChecks.sanction_screening — persisted + readable
[3/14] [plus-insurance] › tests/plus-insurance/08-compliance-checks.spec.ts:87:7 › Plus · Product compliance checks › PUT complianceChecks=null — removes the configuration
[4/14] [plus-insurance] › tests/plus-insurance/08-compliance-checks.spec.ts:100:7 › Plus · Product compliance checks › schema rejects malformed shape
[5/14] [plus-insurance] › tests/plus-insurance/08-compliance-checks.spec.ts:125:7 › Plus · Product compliance checks › schema rejects empty policyholder path
[6/14] [plus-insurance] › tests/plus-insurance/08-compliance-checks.spec.ts:149:7 › Plus · Product compliance checks › multi-capability round-trip — sanction + kyc share the same product
[7/14] [plus-insurance] › tests/plus-insurance/08-compliance-checks.spec.ts:187:7 › Plus · Product compliance checks › CLAIM trigger accepted by schema (fraud_detection at claim time)
[8/14] [plus-insurance] › tests/plus-insurance/08-compliance-checks.spec.ts:213:7 › Plus · Product compliance checks › additional parties path persisted on the parties config
[9/14] [plus-insurance] › tests/plus-insurance/08-compliance-checks.spec.ts:239:7 › Plus · Product compliance checks › list endpoint — capability + triggerType=CLAIM filter accepted
[10/14] [plus-insurance] › tests/plus-insurance/08-compliance-checks.spec.ts:253:7 › Plus · Product compliance checks › list endpoint — claimRecordId filter accepted (returns []) for unknown id
[11/14] [plus-insurance] › tests/plus-insurance/08-compliance-checks.spec.ts:263:7 › Plus · Product compliance checks › integration list — sanction_screening capability filter works
[12/14] [plus-insurance] › tests/plus-insurance/08-compliance-checks.spec.ts:276:7 › Plus · Product compliance checks › credit_check capability accepted when creating an integration (provider)
[13/14] [plus-insurance] › tests/plus-insurance/08-compliance-checks.spec.ts:301:7 › Plus · Product compliance checks › PUT complianceChecks.credit_check — persisted + readable
[14/14] [plus-insurance] › tests/plus-insurance/08-compliance-checks.spec.ts:330:7 › Plus · Product compliance checks › integration list — credit_check capability filter works
  14 passed (1.8s)
=== spec run done ===

{"command":"rm -f credit-check-proof.mjs credit-check-proof-dialog.mjs && echo \"removed proof drivers\"\necho \"=== proof screenshots ===\"; ls -la /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat/.auto-proof/\necho \"=== git status per repo ===\"\nfor d in sherpa-api-api-458-credit-check-compliance-integrat sherpa-portal-api-458-credit-check-compliance-integrat sherpa-test-api-458-credit-check-compliance-integrat; do\n  echo \"--- $d ---\"; git -C /Users/bakker/dev/gangkhar/$d rev-parse --abbrev-ref HEAD; git -C /Users/bakker/dev/gangkhar/$d status --porcelain\ndone","description":"Clean up drivers + verify branch and git status"}

removed proof drivers
=== proof screenshots ===
total 1280
drwxr-xr-x@  8 bakker  staff     256 May 31 14:41 .
drwxr-xr-x@ 45 bakker  staff    1440 May 31 14:21 ..
-rw-r--r--@  1 bakker  staff   79212 May 31 14:40 01-admin-integrations-list.png
-rw-r--r--@  1 bakker  staff   97082 May 31 14:40 02-integration-create-dialog.png
-rw-r--r--@  1 bakker  staff   97082 May 31 14:40 03-capability-options.png
-rw-r--r--@  1 bakker  staff   96343 May 31 14:41 03-provider-selector-credit-check.png
-rw-r--r--@  1 bakker  staff  137555 May 31 14:40 04-product-compliance-tab.png
-rw-r--r--@  1 bakker  staff  137555 May 31 14:40 05-credit-check-config.png
=== git status per repo ===
--- sherpa-api-api-458-credit-check-compliance-integrat ---
auto/api-458-credit-check-compliance-integrat
 M src/domains/integrations/runner.ts
 M src/models/internal/_ExternalIntegrationCallLog.ts
 M src/routes/plus/externalIntegrationsRoutes.ts
 M src/schemas/typebox/integration/ExternalIntegrationCallLog.ts
?? .auto-proof/
?? src/db/migrations/2026.05.31T00.00.01.widen-call-log-capability.ts
--- sherpa-portal-api-458-credit-check-compliance-integrat ---
auto/api-458-credit-check-compliance-integrat
 M app/components/admin/IntegrationsTab.tsx
 M app/components/compliance/ComplianceChecksSection.tsx
 M app/components/products/ProductCompliancePanel.tsx
 M app/components/screening/SanctionScreeningPanel.tsx
 M app/policy-management/screening/page.tsx
 M app/prompts/externalIntegrationSmartSetup.ts
 M app/types/admin.ts
--- sherpa-test-api-458-credit-check-compliance-integrat ---
auto/api-458-credit-check-compliance-integrat
 M tests/plus-insurance/08-compliance-checks.spec.ts

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat\nrm -f .auto-proof/03-capability-options.png .auto-proof/05-credit-check-config.png\necho \"=== final proof set ===\"; ls .auto-proof/\ngit add -A\ngit commit -q -F - <<'EOF'\nfeat: add credit_check compliance check type (#458)\n\nAdd \"credit check\" as a new external-API compliance capability alongside\nsanctions / PEP / KYC / fraud. The compliance framework is capability-agnostic\n(ComplianceCheck.capability / ExternalIntegration.capability are strings,\nProduct.complianceChecks is a keyed JSONB map, the runner / outcome engine /\nnotifications are generic), so this registers the capability and clears the one\nremaining choke point:\n\n- runner.ts: register credit_check (operation 'check', triggers NEW_BUSINESS /\n  RENEWAL).\n- externalIntegrationsRoutes.ts: add credit_check to the integration\n  create/update CAPABILITY_ENUM.\n- migration 2026.05.31T00.00.01: widen ExternalIntegrationCallLogs.capability\n  from the frozen ENUM('sanction_screening') to VARCHAR(64), mirroring\n  2026.05.19T00.00.07 which widened ExternalIntegrations.capability. The runner\n  writes the live capability on every outbound call, so audit rows for any\n  non-sanction capability were being silently dropped by the ENUM constraint\n  inside writeCallLog's catch — this fixes that for credit_check and the\n  existing pep/kyc/fraud capabilities too.\n- _ExternalIntegrationCallLog model + TypeBox schema: capability is now a\n  string (was a single-value literal).\n\nCredit check uses normalized risk-score semantics (0-1, higher = riskier) like\nfraud_detection, so the existing passWhen.maxScore / failWhen.minScore outcome\nengine drives auto-approve / review / auto-deny unchanged.\n\nBrowser proof screenshots in .auto-proof/.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>\nEOF\ngit push -u origin auto/api-458-credit-check-compliance-integrat 2>&1 | tail -8\necho \"=== API push exit: $? ===\"","description":"Commit + push API repo"}

=== final proof set ===
01-admin-integrations-list.png
02-integration-create-dialog.png
03-provider-selector-credit-check.png
04-product-compliance-tab.png
remote:      https://github.com/gangkharai/sherpa-api/pull/new/auto/api-458-credit-check-compliance-integrat        
remote: 
remote: GitHub found 5 vulnerabilities on gangkharai/sherpa-api's default branch (2 high, 3 moderate). To find out more, visit:        
remote:      https://github.com/gangkharai/sherpa-api/security/dependabot        
remote: 
To github.com:gangkharai/sherpa-api.git
 * [new branch]        auto/api-458-credit-check-compliance-integrat -> auto/api-458-credit-check-compliance-integrat
branch 'auto/api-458-credit-check-compliance-integrat' set up to track 'origin/auto/api-458-credit-check-compliance-integrat'.
=== API push exit: 0 ===

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-portal-api-458-credit-check-compliance-integrat\ngit add -A\ngit commit -q -F - <<'EOF'\nfeat: surface credit_check compliance type in portal UI (#458)\n\nAdd \"credit check\" as a selectable compliance check type with the same UX as\nsanctions, reusing the data-driven capability registry:\n\n- types/admin.ts: add credit_check to IntegrationCapability, CAPABILITY_OPERATIONS,\n  and CAPABILITY_DEFAULT_INVOCATION_MODE (sync — bureau APIs resolve fast).\n- ProductCompliancePanel: registry entry (CreditCard icon, NEW_BUSINESS/RENEWAL\n  defaults, credit.high_risk outcome rule) + translated label/blurb so the\n  compliance tab offers Credit Check per product.\n- IntegrationsTab: add credit_check to the provider-creation capability selector.\n- ComplianceChecksSection / SanctionScreeningPanel / screening queue page:\n  capabilityLabel renders \"Credit Check\" for credit_check rows.\n- externalIntegrationSmartSetup prompt: credit_check output contract — maps a\n  normalized risk score (0-1, higher = riskier) onto the canonical match shape\n  so the AI-assisted field mapping produces an outcome the gate understands.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>\nEOF\ngit push -u origin auto/api-458-credit-check-compliance-integrat 2>&1 | tail -4\necho \"=== portal push exit: $? ===\"","description":"Commit + push portal repo"}

remote: 
To github.com:gangkharai/sherpa-portal.git
 * [new branch]      auto/api-458-credit-check-compliance-integrat -> auto/api-458-credit-check-compliance-integrat
branch 'auto/api-458-credit-check-compliance-integrat' set up to track 'origin/auto/api-458-credit-check-compliance-integrat'.
=== portal push exit: 0 ===

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat\ngit add -A\ngit commit -q -F - <<'EOF'\ntest: cover credit_check compliance check type (#458)\n\nExtend the product compliance-checks API spec with credit_check coverage:\ncreate a credit_check integration (provider), round-trip a product\ncomplianceChecks.credit_check config, and filter integrations by the new\ncapability.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>\nEOF\ngit push -u origin auto/api-458-credit-check-compliance-integrat 2>&1 | tail -4\necho \"=== test push exit: $? ===\"","description":"Commit + push test repo"}

remote: 
To github.com:gangkharai/sherpa-test.git
 * [new branch]      auto/api-458-credit-check-compliance-integrat -> auto/api-458-credit-check-compliance-integrat
branch 'auto/api-458-credit-check-compliance-integrat' set up to track 'origin/auto/api-458-credit-check-compliance-integrat'.
=== test push exit: 0 ===

{"command":"echo \"=== final stack health ===\"\ncurl -fsS -o /dev/null -w \"api/:    %{http_code}\\n\" http://localhost:4006/ 2>&1 || echo \"api DOWN\"\ncurl -fsS -o /dev/null -w \"portal:  %{http_code}\\n\" http://localhost:3006/ 2>&1 || echo \"portal DOWN\"\ncurl -fsS -o /dev/null -w \"embed:   %{http_code}\\n\" http://localhost:3106/ 2>&1 || echo \"embed DOWN\"\ntest -d /Users/bakker/dev/gangkhar/sherpa-test-api-458-credit-check-compliance-integrat/node_modules && echo \"test: ready\"","description":"Final stack health verification"}

=== final stack health ===
api/:    200
portal:  200
embed:   200
test: ready

{"file_path":"/tmp/issue-458-comment.md","content":"### ▶ Open live: http://localhost:3006\n\nImplemented **credit-check compliance** full-stack, reusing the existing external-API-integration + compliance-tab framework — `credit_check` is now a first-class compliance capability alongside sanctions / PEP / KYC / fraud.\n\n## ✅ What changed\n\n**sherpa-api** (`auto/api-458-credit-check-compliance-integrat`)\n- Registered the `credit_check` capability in the integration runner (operation `check`, default triggers **new business / renewal**).\n- Added `credit_check` to the integration create/update `CAPABILITY_ENUM`.\n- **Migration** `2026.05.31T00.00.01` — widened `ExternalIntegrationCallLogs.capability` from the frozen `ENUM('sanction_screening')` to `VARCHAR(64)`, mirroring `2026.05.19T00.00.07` (which widened the sibling `ExternalIntegrations.capability`). The runner writes the live capability on every outbound call, so audit rows for any non-sanction capability were being silently dropped by the ENUM constraint inside `writeCallLog`'s catch — this fixes credit_check **and** the existing pep/kyc/fraud capabilities.\n- Updated the `_ExternalIntegrationCallLog` model + TypeBox schema (`capability` → string).\n\n**sherpa-portal** (same branch)\n- `credit_check` added to `IntegrationCapability`, `CAPABILITY_OPERATIONS`, `CAPABILITY_DEFAULT_INVOCATION_MODE` (sync).\n- Compliance tab registry entry (CreditCard icon, NEW_BUSINESS/RENEWAL defaults, `credit.high_risk` outcome rule) + translated label/blurb.\n- Provider-creation capability selector, plus `capabilityLabel` in the compliance section, screening panel and screening queue.\n- `credit_check` output contract for the AI-assisted smart-setup mapping (maps a **normalized risk score 0–1, higher = riskier** onto the canonical match shape, so the existing outcome engine drives auto-approve / review / auto-deny unchanged — same as `fraud_detection`).\n\n**sherpa-test** (same branch)\n- Extended `08-compliance-checks.spec.ts`: create credit_check provider, round-trip `complianceChecks.credit_check`, filter integrations by capability.\n\n**sherpa-embed** — no change required; sanctions has no embed surface and the customer-facing notification path is capability-agnostic.\n\n## 🖥 Browser proof (real portal UI at http://localhost:3006)\n\nDrove the actual portal headlessly with the test-suite's Entra auth. **Console errors: none** (only a benign Sentry `/monitoring` beacon abort). All states verified by eye.\n\n**Product → Compliance tab — Credit Check selectable & fully configurable** (provider, triggers, Pass/Review/Fail outcome bands, auto-reject):\n![compliance](https://github.com/gangkharai/sherpa-api/blob/auto/api-458-credit-check-compliance-integrat/.auto-proof/04-product-compliance-tab.png?raw=true)\nhttps://github.com/gangkharai/sherpa-api/blob/auto/api-458-credit-check-compliance-integrat/.auto-proof/04-product-compliance-tab.png\n\n**Admin → External Integrations — credit_check provider created & listed:**\n![list](https://github.com/gangkharai/sherpa-api/blob/auto/api-458-credit-check-compliance-integrat/.auto-proof/01-admin-integrations-list.png?raw=true)\nhttps://github.com/gangkharai/sherpa-api/blob/auto/api-458-credit-check-compliance-integrat/.auto-proof/01-admin-integrations-list.png\n\n**Provider selector with `credit_check` chosen (sync invocation):**\n![selector](https://github.com/gangkharai/sherpa-api/blob/auto/api-458-credit-check-compliance-integrat/.auto-proof/03-provider-selector-credit-check.png?raw=true)\nhttps://github.com/gangkharai/sherpa-api/blob/auto/api-458-credit-check-compliance-integrat/.auto-proof/03-provider-selector-credit-check.png\n\nAdd-integration dialog: https://github.com/gangkharai/sherpa-api/blob/auto/api-458-credit-check-compliance-integrat/.auto-proof/02-integration-create-dialog.png\n\n## 🔎 Iterative review\nRan the **iterative-review** skill (2 parallel Explore agents). **Converged in round 1 — both agents reported NO HIGH/MEDIUM issues.** Verified: migration enum-name correct + matches precedent, drift/privateFields tests unaffected (field names unchanged), no remaining capability choke-points, outcome-engine semantics correct for credit risk, exhaustive switches, i18n literals, serial-safe tests. `tsc --noEmit` clean in both repos; API `check:imports` + `check:migrations` pass. (ESLint is broken in both repos — pre-existing `@eslint/eslintrc`+ajv module-load crash, unrelated.)\n\n## 🧪 Tests\nTargeted `tests/plus-insurance/08-compliance-checks.spec.ts` → **14/14 passed** (incl. the 3 new credit_check cases). Acceptance behaviour (failing score → review, passing → proceed) is wired through the unchanged outcome-rule engine using risk-score semantics.\n\n## 📦 Stack\nAll four verified up: api http://localhost:4006 · portal http://localhost:3006 · embed http://localhost:3106 · sherpa-test ready. Migration applied. Worktree set is **left running** for review — open it in the dashboard at http://localhost:7777.\n\nBranch (all repos): `auto/api-458-credit-check-compliance-integrat`\n"}

File created successfully at: /tmp/issue-458-comment.md (file state is current in your context — no need to Read it back)

{"command":"cd /Users/bakker/dev/gangkhar/sherpa-api-api-458-credit-check-compliance-integrat\nenv -u GITHUB_TOKEN /opt/homebrew/bin/gh issue comment 458 -R gangkharai/sherpa-api --body-file /tmp/issue-458-comment.md 2>&1 | tail -5\necho \"=== comment exit: $? ===\"","description":"Post implementation comment to issue #458"}

https://github.com/gangkharai/sherpa-api/issues/458#issuecomment-4588187410
=== comment exit: 0 ===

{"command":"env -u GITHUB_TOKEN /opt/homebrew/bin/gh issue edit 458 -R gangkharai/sherpa-api --add-label \"auto:done\" --remove-label \"auto:in-progress\" 2>&1 | tail -3\necho \"=== label edit exit: $? ===\"\necho \"=== current labels ===\"; env -u GITHUB_TOKEN /opt/homebrew/bin/gh issue view 458 -R gangkharai/sherpa-api --json labels --jq '.labels[].name' 2>&1","description":"Flip labels to done"}

https://github.com/gangkharai/sherpa-api/issues/458
=== label edit exit: 0 ===
=== current labels ===
auto
auto:done