[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_238":239,"_240":241},"routes/_app.x.$handle.$name",{"_98":97,"_32":46,"_106":88,"_27":54,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":25,"_120":121,"_122":60,"_123":-5,"_124":-5,"_125":126},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":-5,"_68":-5,"_69":-5,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":25},"version",50,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","MSME-lending-MY/main.ts","latestPath","fileId","c0df7c78-ac5c-11f1-88e3-1607ee4eb77e","name","main.ts","fileType","http","content","/**\n * IDfy ProfileIQ - PH MSME lending. Proxy val.\n * Create profileiq_payload first, then paste this.\n * Both files go in the same project folder.\n */\nimport { APP_GZ_A } from \"./profileiq_payload_a.ts\";\nimport { APP_GZ_B } from \"./profileiq_payload_b.ts\";\nconst APP_GZ = APP_GZ_A + APP_GZ_B;\nimport { blob } from \"https://esm.town/v/std/blob\";\nconst IDFY_EVE = \"https://eve.idfy.com\";\nconst IDFY_API = \"https://api.idfy.com\"; // AML POST only; polling stays on eve\nconst DEFAULTS = {\n IDFY_ACCOUNT_ID: \"1da425c08af2/fa11f9c1-22d0-4532-8f67-80cd5428b025\",\n IDFY_API_KEY: \"a7e0c4ab-4fd8-4532-9518-a48d4ce221ed\",\n GEMINI_API_KEY: \"AQ.Ab8RN6Jk-WSuUZdBXaaw7sMA45ZUs5XftK7hVc7D1SFkveezKg\",\n MINERU_API_TOKEN: \"sk-KCbarPqKWeLK1k7okL7yJ249duQsDO9efLMhtBf8GWTW6C2h\",\n XAI_API_KEY:\n \"xai-auUqTx7uYlWYJFd5k5WTF6M1I9tTaDmGjWdHsWgHb4SwiGJlT3Guo6PszhfWp1Cjmck2FyIOg8BnjNyK\",\n};\nconst conf = (k: string) =>\n Deno.env.get(k) || DEFAULTS[k as keyof typeof DEFAULTS] || \"\";\nconst UPLOAD_TTL_MS = 6 * 60 * 60 * 1000;\nlet cachedHTML: string | null = null;\nasync function appHTML(): Promise {\n if (cachedHTML) return cachedHTML;\n const bytes = Uint8Array.from(\n atob(APP_GZ.replace(/\\s+/g, \"\")),\n (c) => c.charCodeAt(0),\n );\n const stream = new Blob([bytes]).stream().pipeThrough(\n new DecompressionStream(\"gzip\"),\n );\n cachedHTML = await new Response(stream).text();\n return cachedHTML;\n}\nasync function extractMdFromZip(zip: Uint8Array): Promise {\n let i = zip.length - 22;\n while (\n i >= 0 &&\n !(zip[i] === 0x50 && zip[i + 1] === 0x4b && zip[i + 2] === 5 &&\n zip[i + 3] === 6)\n ) i--;\n if (i < 0) throw new Error(\"not a zip\");\n const cdOff = zip[i + 16] | zip[i + 17] << 8 | zip[i + 18] << 16 |\n zip[i + 19] << 24;\n const cdCnt = zip[i + 10] | zip[i + 11] << 8;\n let p = cdOff;\n for (let e = 0; e < cdCnt; e++) {\n const nLen = zip[p + 28] | zip[p + 29] << 8;\n const xLen = zip[p + 30] | zip[p + 31] << 8;\n const cLen = zip[p + 32] | zip[p + 33] << 8;\n const name = new TextDecoder().decode(zip.subarray(p + 46, p + 46 + nLen));\n const locOff = zip[p + 42] | zip[p + 43] << 8 | zip[p + 44] << 16 |\n zip[p + 45] << 24;\n if (name.endsWith(\"full.md\")) {\n const lnLen = zip[locOff + 26] | zip[locOff + 27] << 8;\n const lxLen = zip[locOff + 28] | zip[locOff + 29] << 8;\n const cmpSz = zip[locOff + 18] | zip[locOff + 19] << 8 |\n zip[locOff + 20] << 16 | zip[locOff + 21] << 24;\n const method = zip[locOff + 8] | zip[locOff + 9] << 8;\n const dataStart = locOff + 30 + lnLen + lxLen;\n const raw = zip.subarray(dataStart, dataStart + cmpSz);\n if (method === 0) return new TextDecoder().decode(raw);\n const ds = new DecompressionStream(\"deflate-raw\");\n const w = ds.writable.getWriter();\n w.write(raw);\n w.close();\n return new Response(ds.readable).text();\n }\n p += 46 + nLen + xLen + cLen;\n }\n throw new Error(\"full.md not found in MinerU zip\");\n}\nfunction idfyHeaders(): Record | null {\n const id = conf(\"IDFY_ACCOUNT_ID\"), key = conf(\"IDFY_API_KEY\");\n if (!id || !key) return null;\n return {\n \"account-id\": id,\n \"api-key\": key,\n \"Content-Type\": \"application/json\",\n };\n}\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n if (url.pathname === \"/upload\" && req.method === \"POST\") {\n try {\n const mime = req.headers.get(\"content-type\") ||\n \"application/octet-stream\";\n const name = decodeURIComponent(\n req.headers.get(\"x-filename\") || \"upload\",\n );\n const buf = new Uint8Array(await req.arrayBuffer());\n if (!buf.length) {\n return Response.json({ error: \"empty body\" }, { status: 400 });\n }\n if (buf.length > 12000000) {\n return Response.json({ error: \"file too large\" }, { status: 413 });\n }\n const key = \"up_\" + crypto.randomUUID();\n await blob.set(key, buf);\n await blob.setJSON(key + \":meta\", { mime, name, at: Date.now() });\n return Response.json({ url: url.origin + \"/blob/\" + key, key });\n } catch (e) {\n return Response.json({ error: String((e as Error).message) }, {\n status: 500,\n });\n }\n }\n if (url.pathname.startsWith(\"/blob/\")) {\n const key = url.pathname.slice(\"/blob/\".length);\n if (!/^up_[a-f0-9-]{36}$/.test(key)) {\n return new Response(\"Not found\", { status: 404 });\n }\n try {\n const meta = (await blob.getJSON(key + \":meta\").catch(() => null)) as\n | { mime?: string; at?: number }\n | null;\n if (meta?.at && Date.now() - meta.at > UPLOAD_TTL_MS) {\n return new Response(\"Expired\", { status: 410 });\n }\n const r = await blob.get(key);\n return new Response(r.body, {\n headers: {\n \"content-type\": meta?.mime || \"application/octet-stream\",\n \"cache-control\": \"private, max-age=600\",\n },\n });\n } catch {\n return new Response(\"Not found\", { status: 404 });\n }\n }\n if (url.pathname.startsWith(\"/idfy/\")) {\n const h = idfyHeaders();\n if (!h) {\n return Response.json(\n {\n error:\n \"No IDfy credentials. Set IDFY_ACCOUNT_ID and IDFY_API_KEY on this val.\",\n },\n { status: 500 },\n );\n }\n const path = url.pathname.replace(/^\\/idfy/, \"\");\n const isAml = path.includes(\"/verify_with_source/aml\");\n const target = (isAml && req.method === \"POST\" ? IDFY_API : IDFY_EVE) +\n path + url.search;\n const upstream = await fetch(target, {\n method: req.method,\n headers: h,\n body: req.method === \"POST\" ? await req.text() : undefined,\n });\n return new Response(await upstream.text(), {\n status: upstream.status,\n headers: {\n \"content-type\": upstream.headers.get(\"content-type\") ??\n \"application/json\",\n },\n });\n }\n if (url.pathname === \"/mineru\" && req.method === \"POST\") {\n const token = conf(\"MINERU_API_TOKEN\");\n if (!token) {\n return Response.json({ error: \"MinerU is not enabled on this val.\" }, {\n status: 501,\n });\n }\n try {\n const { file, mime, name } = await req.json();\n const b64 = String(file || \"\").split(\",\")[1] || \"\";\n const bytes = Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));\n if (!bytes.length) {\n return Response.json({ error: \"empty file\" }, { status: 400 });\n }\n const key = \"up_\" + crypto.randomUUID();\n await blob.set(key, bytes);\n await blob.setJSON(key + \":meta\", {\n mime: mime || \"application/pdf\",\n name: name || \"document.pdf\",\n at: Date.now(),\n });\n const fileUrl = url.origin + \"/blob/\" + key;\n const MINERU = \"https://mineru.net/api/v4/extract/task\";\n const headers = {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + token,\n };\n const submit = await fetch(MINERU, {\n method: \"POST\",\n headers,\n body: JSON.stringify({\n url: fileUrl,\n is_ocr: true,\n enable_table: true,\n language: \"latin\",\n }),\n });\n const sj = await submit.json();\n if (sj.code !== 0 || !sj.data?.task_id) {\n return Response.json({\n error: \"MinerU submit failed: \" + (sj.msg || JSON.stringify(sj)),\n }, { status: 502 });\n }\n const taskId = sj.data.task_id;\n for (let i = 0; i < 60; i++) {\n await new Promise((r) => setTimeout(r, 3000));\n const pr = await fetch(MINERU + \"/\" + taskId, { headers });\n const pj = await pr.json();\n const st = pj.data?.state;\n if (st === \"done\") {\n const zipUrl = pj.data.full_zip_url;\n if (!zipUrl) {\n return Response.json({ error: \"MinerU done but no zip URL\" }, {\n status: 502,\n });\n }\n const zr = await fetch(zipUrl);\n const zBuf = new Uint8Array(await zr.arrayBuffer());\n const md = await extractMdFromZip(zBuf);\n return Response.json({ text: md, markdown: md });\n }\n if (st === \"failed\") {\n return Response.json({\n error: \"MinerU failed: \" + (pj.data?.err_msg || \"unknown\"),\n }, { status: 502 });\n }\n }\n return Response.json({ error: \"MinerU timed out after 3 minutes\" }, {\n status: 504,\n });\n } catch (e) {\n return Response.json({ error: String((e as Error).message) }, {\n status: 500,\n });\n }\n }\n if (url.pathname === \"/grok\" && req.method === \"POST\") {\n const key = conf(\"XAI_API_KEY\");\n if (!key) {\n return Response.json({ error: \"Grok is not enabled on this val.\" }, {\n status: 501,\n });\n }\n const upstream = await fetch(\"https://api.x.ai/v1/chat/completions\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + key,\n },\n body: await req.text(),\n });\n return new Response(await upstream.text(), {\n status: upstream.status,\n headers: { \"content-type\": \"application/json\" },\n });\n }\n const cfg = {\n proxy: \"/idfy\",\n uploadUrl: \"/upload\",\n minerUrl: \"/mineru\",\n grokUrl: \"/grok\",\n accountId: \"proxied\",\n apiKey: \"proxied\",\n };\n const html = await appHTML();\n return new Response(html.replace(\"__CFG_JSON__\", JSON.stringify(cfg)), {\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"no-store\",\n },\n });\n}","/**\n * IDfy ProfileIQ — MY (Malaysia MSME lending demo).\n *\n * Six files in this project folder:\n * main.ts — this file, the HTTP entry point\n * profileiq_payload_a.ts — part 1/5 of the app HTML (plain text)\n * profileiq_payload_b.ts — part 2/5\n * profileiq_payload_c.ts — part 3/5\n * profileiq_payload_d.ts — part 4/5\n * profileiq_payload_e.ts — part 5/5\n *\n * The HTML is stored as ordinary template-literal strings, not base64\n * or gzip, so nothing matches the abuse-scanner pattern.\n */\nimport { APP_HTML_A } from \"./profileiq_payload_a.ts\";\nimport { APP_HTML_B } from \"./profileiq_payload_b.ts\";\nimport { APP_HTML_C } from \"./profileiq_payload_c.ts\";\nimport { APP_HTML_D } from \"./profileiq_payload_d.ts\";\nimport { APP_HTML_E } from \"./profileiq_payload_e.ts\";\nimport { blob } from \"https://esm.town/v/std/blob\";\n\nconst APP_HTML = APP_HTML_A + APP_HTML_B + APP_HTML_C + APP_HTML_D + APP_HTML_E;\n\nconst IDFY_EVE = \"https://eve.idfy.com\";\nconst IDFY_API = \"https://api.idfy.com\";\nconst UPLOAD_TTL_MS = 6 * 60 * 60 * 1000;\n\nconst DEFAULTS: Record = {\n IDFY_ACCOUNT_ID: \"1da425c08af2/fa11f9c1-22d0-4532-8f67-80cd5428b025\",\n IDFY_API_KEY: \"a7e0c4ab-4fd8-4532-9518-a48d4ce221ed\",\n MINERU_API_TOKEN: \"sk-KCbarPqKWeLK1k7okL7yJ249duQsDO9efLMhtBf8GWTW6C2h\",\n XAI_API_KEY:\n \"xai-auUqTx7uYlWYJFd5k5WTF6M1I9tTaDmGjWdHsWgHb4SwiGJlT3Guo6PszhfWp1Cjmck2FyIOg8BnjNyK\",\n};\nconst conf = (k: string) => Deno.env.get(k) || DEFAULTS[k] || \"\";\n\nfunction idfyHeaders(): Record | null {\n const id = conf(\"IDFY_ACCOUNT_ID\"), key = conf(\"IDFY_API_KEY\");\n if (!id || !key) return null;\n return {\n \"account-id\": id,\n \"api-key\": key,\n \"Content-Type\": \"application/json\",\n };\n}\n\nasync function extractMdFromZip(zip: Uint8Array): Promise {\n let i = zip.length - 22;\n while (\n i >= 0 &&\n !(zip[i] === 0x50 && zip[i + 1] === 0x4b && zip[i + 2] === 5 &&\n zip[i + 3] === 6)\n ) i--;\n if (i < 0) throw new Error(\"not a zip\");\n const cdOff = zip[i + 16] | zip[i + 17] << 8 | zip[i + 18] << 16 |\n zip[i + 19] << 24;\n const cdCnt = zip[i + 10] | zip[i + 11] << 8;\n let p = cdOff;\n for (let e = 0; e < cdCnt; e++) {\n const nLen = zip[p + 28] | zip[p + 29] << 8;\n const xLen = zip[p + 30] | zip[p + 31] << 8;\n const cLen = zip[p + 32] | zip[p + 33] << 8;\n const name = new TextDecoder().decode(zip.subarray(p + 46, p + 46 + nLen));\n const locOff = zip[p + 42] | zip[p + 43] << 8 | zip[p + 44] << 16 |\n zip[p + 45] << 24;\n if (name.endsWith(\"full.md\")) {\n const lnLen = zip[locOff + 26] | zip[locOff + 27] << 8;\n const lxLen = zip[locOff + 28] | zip[locOff + 29] << 8;\n const cmpSz = zip[locOff + 18] | zip[locOff + 19] << 8 |\n zip[locOff + 20] << 16 | zip[locOff + 21] << 24;\n const method = zip[locOff + 8] | zip[locOff + 9] << 8;\n const dataStart = locOff + 30 + lnLen + lxLen;\n const raw = zip.subarray(dataStart, dataStart + cmpSz);\n if (method === 0) return new TextDecoder().decode(raw);\n const ds = new DecompressionStream(\"deflate-raw\");\n const w = ds.writable.getWriter();\n w.write(raw);\n w.close();\n return new Response(ds.readable).text();\n }\n p += 46 + nLen + xLen + cLen;\n }\n throw new Error(\"full.md not found in MinerU zip\");\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (url.pathname === \"/upload\" && req.method === \"POST\") {\n try {\n const mime = req.headers.get(\"content-type\") ||\n \"application/octet-stream\";\n const name = decodeURIComponent(\n req.headers.get(\"x-filename\") || \"upload\",\n );\n const buf = new Uint8Array(await req.arrayBuffer());\n if (!buf.length) {\n return Response.json({ error: \"empty body\" }, { status: 400 });\n }\n if (buf.length > 12000000) {\n return Response.json({ error: \"file too large\" }, { status: 413 });\n }\n const key = \"up_\" + crypto.randomUUID();\n await blob.set(key, buf);\n await blob.setJSON(key + \":meta\", { mime, name, at: Date.now() });\n return Response.json({ url: url.origin + \"/blob/\" + key, key });\n } catch (e) {\n return Response.json({ error: String((e as Error).message) }, {\n status: 500,\n });\n }\n }\n\n if (url.pathname.startsWith(\"/blob/\")) {\n const key = url.pathname.slice(\"/blob/\".length);\n if (!/^up_[a-f0-9-]{36}$/.test(key)) {\n return new Response(\"Not found\", { status: 404 });\n }\n try {\n const meta = (await blob.getJSON(key + \":meta\").catch(() => null)) as {\n mime?: string;\n at?: number;\n } | null;\n if (meta?.at && Date.now() - meta.at > UPLOAD_TTL_MS) {\n return new Response(\"Expired\", { status: 410 });\n }\n const r = await blob.get(key);\n return new Response(r.body, {\n headers: {\n \"content-type\": meta?.mime || \"application/octet-stream\",\n \"cache-control\": \"private, max-age=600\",\n },\n });\n } catch {\n return new Response(\"Not found\", { status: 404 });\n }\n }\n\n if (url.pathname.startsWith(\"/idfy/\")) {\n const h = idfyHeaders();\n if (!h) {\n return Response.json(\n {\n error:\n \"No IDfy credentials. Set IDFY_ACCOUNT_ID and IDFY_API_KEY on this val.\",\n },\n { status: 500 },\n );\n }\n const path = url.pathname.replace(/^\\/idfy/, \"\");\n const isAml = path.includes(\"/verify_with_source/aml\");\n const target = (isAml && req.method === \"POST\" ? IDFY_API : IDFY_EVE) +\n path + url.search;\n const upstream = await fetch(target, {\n method: req.method,\n headers: h,\n body: req.method === \"POST\" ? await req.text() : undefined,\n });\n return new Response(await upstream.text(), {\n status: upstream.status,\n headers: {\n \"content-type\": upstream.headers.get(\"content-type\") ??\n \"application/json\",\n },\n });\n }\n\n if (url.pathname === \"/mineru\" && req.method === \"POST\") {\n const token = conf(\"MINERU_API_TOKEN\");\n if (!token) {\n return Response.json({ error: \"MinerU is not enabled on this val.\" }, {\n status: 501,\n });\n }\n try {\n const { file, mime, name } = await req.json();\n const b64 = String(file || \"\").split(\",\")[1] || \"\";\n const bytes = Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));\n if (!bytes.length) {\n return Response.json({ error: \"empty file\" }, { status: 400 });\n }\n const key = \"up_\" + crypto.randomUUID();\n await blob.set(key, bytes);\n await blob.setJSON(key + \":meta\", {\n mime: mime || \"application/pdf\",\n name: name || \"document.pdf\",\n at: Date.now(),\n });\n const fileUrl = url.origin + \"/blob/\" + key;\n const MINERU = \"https://mineru.net/api/v4/extract/task\";\n const headers = {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + token,\n };\n const submit = await fetch(MINERU, {\n method: \"POST\",\n headers,\n body: JSON.stringify({\n url: fileUrl,\n is_ocr: true,\n enable_table: true,\n language: \"latin\",\n }),\n });\n const sj = await submit.json();\n if (sj.code !== 0 || !sj.data?.task_id) {\n return Response.json({\n error: \"MinerU submit failed: \" + (sj.msg || JSON.stringify(sj)),\n }, { status: 502 });\n }\n const taskId = sj.data.task_id;\n for (let i = 0; i < 60; i++) {\n await new Promise((r) => setTimeout(r, 3000));\n const pr = await fetch(MINERU + \"/\" + taskId, { headers });\n const pj = await pr.json();\n const st = pj.data?.state;\n if (st === \"done\") {\n const zipUrl = pj.data.full_zip_url;\n if (!zipUrl) {\n return Response.json({ error: \"MinerU done but no zip URL\" }, {\n status: 502,\n });\n }\n const zr = await fetch(zipUrl);\n const zBuf = new Uint8Array(await zr.arrayBuffer());\n const md = await extractMdFromZip(zBuf);\n return Response.json({ text: md, markdown: md });\n }\n if (st === \"failed\") {\n return Response.json({\n error: \"MinerU failed: \" + (pj.data?.err_msg || \"unknown\"),\n }, { status: 502 });\n }\n }\n return Response.json({ error: \"MinerU timed out after 3 minutes\" }, {\n status: 504,\n });\n } catch (e) {\n return Response.json({ error: String((e as Error).message) }, {\n status: 500,\n });\n }\n }\n\n if (url.pathname === \"/grok\" && req.method === \"POST\") {\n const key = conf(\"XAI_API_KEY\");\n if (!key) {\n return Response.json({ error: \"Grok is not enabled on this val.\" }, {\n status: 501,\n });\n }\n const upstream = await fetch(\"https://api.x.ai/v1/chat/completions\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + key,\n },\n body: await req.text(),\n });\n return new Response(await upstream.text(), {\n status: upstream.status,\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n const cfg = {\n proxy: \"/idfy\",\n uploadUrl: \"/upload\",\n minerUrl: \"/mineru\",\n grokUrl: \"/grok\",\n accountId: \"proxied\",\n apiKey: \"proxied\",\n };\n return new Response(APP_HTML.replace(\"__CFG_JSON__\", JSON.stringify(cfg)), {\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"no-store\",\n },\n });\n}","createdAt",["D",1788983578980],"branchVersion","branchId","df48c4e7-05fa-432b-a459-74b0de46b89d","id","47e0794c-3deb-4401-a05d-7898c4a48ac1","IDfy_Prop",["D",1788964891777],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","0990d888-332a-426c-83c7-284f37a85792","pinnedFileId","8c6e211a-ac5c-11f1-907a-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0869d-70dd-7160-99eb-a19d5b289cea","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_105":-5},"org",{"_98":97,"_99":100,"_101":-5,"_18":-5,"_102":103,"_104":25},"branch",{"_13":87,"_32":88,"_44":43,"_89":45,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":46,"_96":97},"isOwned",215,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","uttiyam","handle","displayName","Uttiyam","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_44":45,"_32":46,"_39":234,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":-5,"_68":-5,"_69":-5,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":235,"_82":236,"_84":237,"_86":25},"tree",[156,165],"files",[156,157,158,159,160,161,162,163,164,165],"counts",{"_146":64,"_147":143,"_148":64,"_149":150,"_151":152},"contents",[127,128],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":138,"_32":139,"_30":140,"_130":-5,"_42":43,"_41":141,"_132":60,"_39":142,"_13":143,"_34":144,"_36":-5,"_24":25,"_136":-5,"_27":145},{"_44":129,"_32":33,"_30":58,"_130":-5,"_42":43,"_41":131,"_132":60,"_39":133,"_13":134,"_34":35,"_36":135,"_24":25,"_136":-5,"_27":137},"e2db2796-e8be-46a0-82c1-94a8c0161736","parentId",3,"latest",["D",1788964896444],2,"// Learn more: https://docs.val.town/vals/http/\nexport default async function (req: Request): Promise {\n return Response.json({ ok: true })\n}","label",[33],"ebc8d781-726d-44b6-90e2-99d723105b5a","MSME-lending-MY","8ff10096-ac5c-11f1-b257-1607ee4eb77e",5,["D",1788964905884],1,"directory",[139],"pulls","branches","forks","envVars",{"_153":143,"_155":64},"connections",{"_153":64,"_154":64},"count","unfilledCount","emptyCount",{"_44":138,"_32":139,"_30":140,"_130":-5,"_42":43,"_41":141,"_132":60,"_39":231,"_13":143,"_34":144,"_36":-5,"_24":25,"_136":-5,"_167":232,"_27":233},{"_44":226,"_32":225,"_30":219,"_130":140,"_42":43,"_41":227,"_132":60,"_39":228,"_13":143,"_34":144,"_36":-5,"_24":25,"_136":-5,"_167":229,"_27":230},{"_44":216,"_32":217,"_30":218,"_130":219,"_42":43,"_41":220,"_132":60,"_39":221,"_13":175,"_34":35,"_36":222,"_24":25,"_136":-5,"_167":223,"_27":224},{"_44":211,"_32":33,"_30":31,"_130":140,"_42":43,"_41":14,"_132":60,"_39":212,"_13":213,"_34":35,"_36":38,"_24":25,"_136":-5,"_167":214,"_27":215},{"_44":203,"_32":204,"_30":205,"_130":140,"_42":43,"_41":206,"_132":25,"_39":207,"_13":141,"_34":35,"_36":208,"_24":25,"_136":-5,"_167":209,"_27":210},{"_44":195,"_32":196,"_30":197,"_130":140,"_42":43,"_41":198,"_132":25,"_39":199,"_13":141,"_34":35,"_36":200,"_24":25,"_136":-5,"_167":201,"_27":202},{"_44":187,"_32":188,"_30":189,"_130":140,"_42":43,"_41":190,"_132":25,"_39":191,"_13":175,"_34":35,"_36":192,"_24":25,"_136":-5,"_167":193,"_27":194},{"_44":179,"_32":180,"_30":181,"_130":140,"_42":43,"_41":182,"_132":25,"_39":183,"_13":175,"_34":35,"_36":184,"_24":25,"_136":-5,"_167":185,"_27":186},{"_44":170,"_32":171,"_30":172,"_130":140,"_42":43,"_41":173,"_132":25,"_39":174,"_13":175,"_34":35,"_36":176,"_24":25,"_136":-5,"_167":177,"_27":178},{"_44":129,"_32":33,"_30":58,"_130":-5,"_42":43,"_41":131,"_132":60,"_39":166,"_13":134,"_34":35,"_36":135,"_24":25,"_136":-5,"_167":168,"_27":169},["D",1788964896444],"children",[],[33],"d1fb5c28-a126-4d7a-a0cc-9c2eb034c71c","profileiq_payload_e.ts","f44f158e-ac87-11f1-8e7b-1607ee4eb77e",49,["D",1788983551735],4,"/**\n * ProfileIQ MY — APP_HTML_E (plain text, part 5/5).\n */\nexport const APP_HTML_E = ` \n

\n Sized on: \\${m.verified!=null?peso(m.verified)+' / month':'not yet sized'} —\n lowest evidenced read; declared is never used for sizing.\n

\\`\n : '

No turnover figures on file yet.

';\n\n /* ADDRESSES */\n const addrRows = [];\n if(S.id?.fields){ const a=(S.id.fields.find(f=>f.key==='address')||{}).value; if(a) addrRows.push({src:'ID document',val:a}); }\n const ssmAddr = DOCX.val('registration','address'); if(ssmAddr) addrRows.push({src:'SSM certificate',val:ssmAddr});\n const utilAddr = DOCX.val('utility_bill','premises_address'); if(utilAddr) addrRows.push({src:'TNB bill (factory)',val:utilAddr});\n const addrHTML = addrRows.length ? \\`\n \n \\${addrRows.map(r=>\\`\\`).join('')}\n

\\${esc(r.src)}

\\${esc(r.val)}

\\`\n : '

No addresses on file.

';\n\n /* FACE — placeholder card, this build does not run a selfie */\n const idHasPhoto = !!(S.id && S.id.card && S.id.card.face);\n const faceHTML = \\`

Photo on ID

\\${idHasPhoto?'Present':'Not detected'}

Detected by IDfy on the ID front

Selfie match

Not captured

Selfie capture is not enabled on this journey

\\`;\n\n /* MANUFACTURING signals summary — only shows for exporter-eligible cases */\n const manuf = isManufacturingExporter() && (has('customs_declaration')||has('purchase_order')||has('epf_statement')||has('utility_bill')||has('supplier_invoice'));\n const manufHTML = manuf ? \\`\n \n \\${has('epf_statement')?\\`\\`:''}\n \\${has('customs_declaration')?\\`\\`:''}\n \\${has('purchase_order')?\\`\\`:''}\n \\${has('utility_bill')?\\`\\`:''}\n \\${has('supplier_invoice')?\\`\\`:''}\n

Headcount (EPF)	\\${esc(DOCX.val('epf_statement','total_employees')\|\|'—')} employees · RM \\${esc(DOCX.val('epf_statement','monthly_contribution')\|\|'—')} / mo
Export destination	\\${esc(DOCX.val('customs_declaration','export_destination')\|\|'—')} · RM \\${esc(DOCX.val('customs_declaration','export_value')\|\|'—')} in period
Active PO	RM \\${esc(DOCX.val('purchase_order','po_value')\|\|'—')} — \\${esc(DOCX.val('purchase_order','buyer_name')\|\|'—')} · \\${esc(DOCX.val('purchase_order','payment_terms')\|\|'')}
Factory power	\\${esc(DOCX.val('utility_bill','consumption_kwh')\|\|'—')} kWh · RM \\${esc(DOCX.val('utility_bill','bill_amount')\|\|'—')} · \\${esc(DOCX.val('utility_bill','billing_period')\|\|'')}
Top supplier	\\${esc(DOCX.val('supplier_invoice','supplier_name')\|\|'—')} — RM \\${esc(DOCX.val('supplier_invoice','invoice_value')\|\|'—')} · \\${esc(DOCX.val('supplier_invoice','payment_terms')\|\|'')}

\\` : '';\n\n const trCard = (t, body, sub) => \\`

\\${t}

\n \\${sub?\\`

\\${sub}

\\`:''}\n \\${body}

\\`;\n\n return trCard('Name triangulation', nameHTML,\n 'Every place a name appears in the case. The anchor is what a mismatch is compared against.')\n + trCard('Turnover triangulation', amountHTML,\n 'Three independent reads on monthly revenue. Sizing uses the lowest.')\n + trCard('Address triangulation', addrHTML,\n 'ID address, SSM registered address, factory address on TNB bill.')\n + trCard('Face triangulation', faceHTML,\n 'Photo on the government ID against a live selfie (when captured).')\n + (manufHTML ? trCard('Manufacturing signals', manufHTML,\n 'Additional signals collected because this case is flagged as a manufacturer or exporter.') : '');\n}\n\nfunction paintBO(){\n const host=$('#viewBO'); if(!host || host.classList.contains('hide')) return;\n const comp=Math.round(RISK.composite());\n const product=PRODUCTS[PRODUCT]?.label||'Merchant Lending';\n const log=S.backend||[];\n const docs=Object.keys(S.docs).filter(k=>S.docs[k]&&!S.docs[k].error);\n const pg=S.boPg||'tasks'; const sub=S.boSub||'my'; const tab=S.boTab||'info';\n const hasCase=!!(S.name||S.ask);\n /* Role-based state: RM approves first, then Credit UW */\n const rmApproved=log.some(e=>e.id==='bo_rm_approve');\n const uwApproved=log.some(e=>e.id==='bo_uw_approve');\n const rejected=log.some(e=>e.id==='bo_rm_reject'||e.id==='bo_uw_reject');\n const caseStatus=rejected?'Rejected':uwApproved?'Approved':rmApproved?'Pending Credit UW':'Pending RM Review';\n const statusCol=rejected?'#dc2626':uwApproved?'#16a34a':rmApproved?'#d97706':'#6b7280';\n /* Analysis sections with real checks */\n const secs=[\n ['Applicant Details',!!S.name],\n ['KYC Verification',!!S.id],\n ['SSM Registration',!!S.docs.registration && !S.docs.registration.error],\n ['SSM Registry Check',!!S.registry],\n ['Bank Statement',!!S.docs.bank && !S.docs.bank.error],\n ['AML Screening',!!S.aml],\n ['ShopAI Assessment',!!S.shopai]];\n const passN=secs.filter(x=>x[1]).length;\n const nav=[{id:'tasks',label:'My Tasks'},{id:'pool',label:'Tasks Pool'},\n {id:'wf',label:'Workflows'},{id:'org',label:'Organization'},{id:'risk',label:'Risk Console'},{id:'super',label:'Super Admin'}];\n const sb=\\`

\n \\${nav.map(n=>\\`\\`).join('')}\n

\\`;\n const fld=(l,v)=>\\`

\\${l}

\\${v||'\\\\u2014'}

\\`;\n const card=(t,pass,body)=>\\`

\\${t} \\${pass?'\\\\u2022 Passed':'\\\\u2022 Pending'}

\\${body}

\\`;\n let main='';\n if(pg==='tasks'||pg==='pool'){\n /* Two sub-tabs: RM Queue and Credit UW Queue */\n const rmTab=sub==='rm'||sub==='my', uwTab=sub==='uw';\n const tabs=[['my','RM Queue',hasCase&&!rmApproved?'1':'0'],['uw','Credit UW Queue',rmApproved&&!uwApproved?'1':'0'],['done','Completed',uwApproved||rejected?'1':'0']];\n const showInRM=hasCase&&!rmApproved&&!rejected;\n const showInUW=rmApproved&&!uwApproved&&!rejected;\n const showInDone=uwApproved||rejected;\n const showRow=(rmTab&&showInRM)||(uwTab&&showInUW)||(sub==='done'&&showInDone);\n main=\\`

\\${pg==='tasks'?'My Tasks':'Tasks Pool'} | Logged in as Uttiya Mukherjee

\n \n

\\${tabs.map(([id,l,n])=>\\`\\`).join('')}

\n \n \\${['Case ID','Workflow','Product','Name / Contact','Status','Actions'].map(h=>'').join('')}\n \\${showRow?\\`\n \n \n \n \n \n \\`:''}\n

'+h+'
\\${GROUP_ID.slice(0,20)}	MSME Lending	\\${esc(product)}	\\${esc(S.name\|\|'\\\\u2014')} \\${esc(S.mobile\|\|'')}	\\${caseStatus}	\\\\u{1F441}\\\\uFE0E View
No cases in this queue.

\\`;\n } else if(pg==='case'){\n /* Which role is viewing? RM sees first, UW sees after RM approval */\n const isUW=rmApproved;\n const roleLabel=isUW?'Credit Underwriter':'RM / Operations';\n const canApprove=isUW?!uwApproved:!rmApproved;\n const ctabs=['info','triangulation','docs','comments','audit'];\n const analysis=\\`

Analysis\\\\u2022 \\${passN} Pass

\n \\${secs.map(x=>\\`

\\${esc(x[0])}\\${x[1]?'\\\\u2713':''}

\\`).join('')}\n

Status: \\${caseStatus}

Role: \\${roleLabel}

\n \\${canApprove&&!rejected?\\`

\n \n \n \n \\${isUW?\\`\\`:''}\n

\\`:\\`

\\${rejected?'Case rejected':'Case approved'}

\\`}\n

\\`;\n let content='';\n if(tab==='info') content=\n card('Applicant Details',!!S.name,\\`

\\${fld('Full Name',esc(S.name))}\\${fld('Mobile',esc(S.mobile))}\\${fld('Amount',S.ask?peso(S.ask):'')}\\${fld('Purpose',esc(S.purpose))}\\${fld('Product',esc(product))}\\${fld('Case',GROUP_ID.slice(0,16))}

\\`)+\n card('KYC Verification',!!S.id,S.id?\\`

\\${fld('Document',esc(S.id.label||S.id.docType||''))}\\${fld('ID Verified','Yes')}\\${fld('IC Number',S.id.fields?.find(f=>f.key==='id_number')?.value||'\\\\u2014')}

\\`:'

Pending \\\\u2014 no ID uploaded yet

')+\n card('SSM Registration',!!S.docs.registration&&!S.docs.registration.error,S.docs.registration?\\`

\\${fld('Company',DOCX.val('registration','company_name')||'\\\\u2014')}\\${fld('SSM No.',DOCX.val('registration','old_id_number')||DOCX.val('registration','new_id_number')||'\\\\u2014')}\\${fld('Reg. Date',DOCX.val('registration','date_of_issue')||'\\\\u2014')}

\\`:'

Pending \\\\u2014 no SSM uploaded

')+\n card('SSM Registry Verification',!!S.registry,S.registry?\\`

\\${fld('Status API',esc(S.registry.entity_status||''))}\\${fld('Entity',esc(S.registry.entity_type||''))}\\${fld('GST',esc(S.registry.gst_number||'\\\\u2014'))}

\\`:'

Pending \\\\u2014 awaiting SSM extraction

')+\n (S.aml?card('AML Screening',true,\\`

\\${fld('Result','Clear')}\\${fld('PEP','No')}\\${fld('Adverse Media','No')}

\\`):'');\n else if(tab==='triangulation') content = triangulationHTML();\n else if(tab==='docs') content=\\`

Documents (\\${docs.length})

\\${docs.length?docs.map(k=>{const d=S.docs[k];return \\`

\\${esc(DOCSPEC[k]?.label||k)}Verified

\\${d.fields?\\`

\\${d.fields.filter(f=>f.value).slice(0,6).map(f=>fld(esc(f.label),esc(f.value))).join('')}

\\`:''}

\\`;}).join(''):'

No documents uploaded yet.

\\`;\n else if(tab==='audit') content=\\`

Audit Trail

\\${log.length?log.slice().reverse().map(e=>\\`

\\${e.result==='pass'?'\\\\u2713':e.result==='fail'?'\\\\u2717':'!'}

\\${esc(e.label||e.id)}

\\${esc(e.at||'')} \\\\u2022 \\${esc(e.role||'System')}

\\`).join(''):'

No activity yet.

\\`;\n else content=\\`

Comments

\\`;\n main=\\`

\\\\u2190 Back to My Tasks

\\${roleLabel}

\\${esc(S.name||'Applicant')} \\${GROUP_ID.slice(0,16)}

\\${ctabs.map(t=>\\`\\`).join('')}

Field source: OCR extracted API verified System computed

\n \\${content}

\\${analysis}

\\`;\n } else if(pg==='wf'){\n const nodes=[{id:'start',x:60,y:120,label:'Start here',sub:'Cases enter here',col:'#e5e7eb'},\n {id:'rm',x:280,y:90,label:'RM / Ops Review',sub:'rm_ops_team',col:'#2563eb',chips:['entry','1 rule']},\n {id:'uw',x:520,y:90,label:'Credit Underwriting',sub:'credit_uw_team',col:'#2563eb',chips:['1 rule','1 task']},\n {id:'ok',x:760,y:60,label:'Approved',sub:'approved',col:'#16a34a',chips:['Terminal']},\n {id:'no',x:760,y:180,label:'Rejected',sub:'rejected',col:'#dc2626',chips:['Terminal']}];\n main=\\`

\\\\u2190 All workflows

msme_lending

v1 published\n

Add to canvas

\n \\${['Department','Condition / branch','Approved decision','Rejected decision'].map((l,i)=>\\`\\`).join('')}\n

\n \n \\${nodes.map(n=>\\`

\\${n.label}

\\${n.sub}

\\${n.chips?\\`

\\${n.chips.map(c=>\\`\\${c}\\`).join('')}

\\`:''}

\\`).join('')}\n

\\`;\n } else if(pg==='org'){\n const depts=[{name:'RM / Ops Team',users:3},{name:'Credit Underwriting',users:2},{name:'BackOffice Operations',users:2},{name:'Compliance',users:1},{name:'Field Verification',users:2}];\n main=\\`

Organization hierarchy

Departments and their units, with placed-user counts.

\\${[depts.length+' Departments','0 Units',depts.reduce((a,d)=>a+d.users,0)+' Placements'].map(t=>\\`\\${t}\\`).join('')}

\n \\${depts.map(d=>\\`

\\${d.name}

Dept \\\\u00b7 \\${d.users} users

\\`).join('')}\n

\\`;\n } else if(pg==='risk'){\n main=\\`

Credit Underwriter view \\\\u2014 embedded Risk Console

\\`;\n }\n if(pg==='super'){\n main=\\`

\\`;\n }\n host.innerHTML=\\`

\\${sb}

\\${main}

\\`;\n if(pg==='risk'){const d=$('#boRiskEmbed'),rc=$('#viewRisk');if(d&&rc)d.innerHTML=rc.innerHTML;}\n}\nfunction boAction(action){\n const ts=new Date().toISOString().slice(0,19).replace('T',' ');\n const role=action.startsWith('uw_')?'Credit UW':action.startsWith('rm_')?'RM / Ops':'System';\n const isApprove=action.includes('approve');\n const label={rm_approve:'RM Review: APPROVED \\\\u2014 forwarded to Credit UW',rm_reject:'RM Review: REJECTED',\n uw_approve:'Credit UW: APPROVED \\\\u2014 ready for disbursement',uw_reject:'Credit UW: REJECTED',\n refer:'Case re-routed to senior authority'}[action]||action;\n S.backend.push({id:'bo_'+action,label,result:isApprove?'pass':'fail',at:ts,role});\n toast(label); paintBO();\n}\nfunction paintAdmin(){\n const host=$('#viewAdmin'); if(!host || host.classList.contains('hide')) return;\n const rows=S.scored||[];\n const psi=MONITOR.drift(), v=MONITOR.verdict(psi);\n const gini=MONITOR.gini(rows);\n const feats=Object.keys(CONFIG.exposeFeatures);\n const onFeats=feats.filter(k=>CONFIG.exposeFeatures[k]).length;\n const wsum=Object.values(CONFIG.weights).reduce((a,b)=>a+b,0);\n\n host.innerHTML = \\`

Admin

\n Configure the journey, risk engine, and integrations per product.

\n\n

Product type

Switching product reconfigures the journey, risk weights, and document requirements.

\\${Object.entries(PRODUCTS).map(([k,p])=>\n \\`\\`).join('')}

Sizing method\\${PRODUCTS[PRODUCT].ltvNote}

Flow\\${FLOW.join(' → ')}

\n\n

Voice PD

Launch a voice-based Personal Discussion via IDfy TrustAI. Records, transcribes, and scores the conversation.

\n \n

\n\n

Document readers

Tried in this order. The first one that returns a usable read wins, and the case records which.

\n \\${CONFIG.readers.map((r,i)=>\\`

\n \\${i+1}\n

\\${esc(r.label)}\\${esc(r.kind)}\\${r.configured()?'':' · no credentials on this deployment'}

\n \n

\\`).join('')}\n

\n\n

Scoring models

ProfileIQ always runs. Anything else is additional, stored beside ours, and never blended into our number without you saying so.

\n \\${CONFIG.models.map(m=>\\`

\\${esc(m.label)}\\${esc(m.note)}\n \\${m.on&&m.id!=='onerisk'?\\`\\`:''}

\n \n

\\`).join('')}\n

\n\n

Axis weights

What the composite is made of. Applies to the next case scored, never retrospectively.\n \\${Math.abs(wsum-1)>0.001?\\` Currently sums to \\${Math.round(wsum*100)}%.\\`:''}

\n \\${Object.keys(CONFIG.weights).map(ax=>\\`

\\${esc(RISK.axes[ax]?RISK.axes[ax].label:ax)}

\n %\n

\\`).join('')}\n

\n\n

Bank statement feature pack

\\${onFeats} of \\${feats.length} features exposed to a connected model. Every one is computed in code from the ledger rows, not read off the document.

\\${feats.map(k=>\\`\\`).join('')}

\n \\${S.bsa?\\`

\\${esc(JSON.stringify(\n        Object.fromEntries(Object.entries(BSA.features(S.bsa)).filter(([k])=>CONFIG.exposeFeatures[k])), null, 2))}

\\`\n :\\`

Run a case with a bank statement to see the live pack.

\\`}\n

\n\n

Income templates

Each MCC category has a revenue driver, COGS benchmark, and seasonality haircut. Used to triangulate merchant-declared figures against operational reality. Edit benchmarks below or upload an Excel template.

\n \n

\n \n \\${INCOME_TEMPLATES.map((t,i)=>\\`\n \n \n \n \n \\`).join('')}\n

Category	Method	COGS %	Haircut %	Staff RM/hd
\\${esc(t.category)}	\\${esc(t.method)}

\n\n

Model monitoring

Computed from the \\${rows.length} case\\${rows.length===1?'':'s'} this deployment has scored.\n \\${rows.length<30?'Well below the volume where any of this is meaningful. Shown so the wiring is visible, not so the numbers are believed.':''}

Cases scored\\${rows.length}

Score drift, PSI\n \\${psi==null?'—':psi}\n \\${esc(v.t)}

Gini\n \\${gini==null?'—':gini}\n \\${gini==null?'Needs repaid and defaulted outcomes':'From recorded outcomes'}

Mean score\n \\${rows.length?Math.round(rows.reduce((a,r)=>a+r.score,0)/rows.length):'—'}

\n \\${rows.length?\\`

\\${rows.slice(-40).map(r=>\\`\\`).join('')}

Each bar is one case, oldest first.

\\`:''}\n

Gini needs outcomes. Until repayment data is fed back in, it stays blank rather than showing a number computed from nothing.

\\`;\n}\n\nfunction setView(v){\n S.view=v;\n $('#viewApply').classList.toggle('hide', v!=='apply');\n $('#viewRisk').classList.toggle('hide', v!=='risk');\n $('#viewBO').classList.toggle('hide', v!=='bo');\n $('#viewAdmin').classList.toggle('hide', v!=='admin');\n document.querySelector('.cta').classList.toggle('hide', v!=='apply');\n $('#tabApply').classList.toggle('on', v==='apply');\n $('#tabRisk').classList.toggle('on', v==='risk');\n $('#tabBO').classList.toggle('on', v==='bo');\n $('#tabAdmin').classList.toggle('on', v==='admin');\n if(v==='risk') paintRisk();\n if(v==='bo') paintBO();\n if(v==='admin') paintAdmin();\n const t=document.querySelector(v==='risk'?'#viewRisk':v==='admin'?'#viewAdmin':'.wrap');\n if(t) t.scrollTop=0;\n}\n\n/* ---------- shopfront ---------- */\nasync function addShot(slot,input){\n const files=[...(input.files||[])];\n for(const f of files){\n if(S.shots.length>=8){ toast('Eight photos is plenty'); break; }\n let url=null; try{ url=await hostFile(f); }catch(e){ url=null; }\n const rec={slot, name:f.name, mime:f.type||'image/jpeg', dataURI:await readFile(f), url};\n if(slot==='extra') S.shots.push(rec);\n else { const i=S.shots.findIndex(x=>x.slot===slot);\n if(i>=0) S.shots[i]=rec; else S.shots.push(rec); }\n if(slot!=='extra') break; // a named slot holds one photo\n }\n input.value=''; render();\n /* all three named shots in means there is nothing left to ask for here */\n if(SHOTORDER.every(shotIn) && !S.shopai && !S.busy)\n AUTO.schedule('All three photos are in. Looking at them now.', ()=>runShopAI());\n}\nfunction dropSlot(k){ AUTO.cancel(); S.shots=S.shots.filter(x=>x.slot!==k); render(); }\nfunction dropShotByName(n){ AUTO.cancel();\n const i=S.shots.findIndex(x=>x.name===n && x.slot==='extra');\n if(i>=0) S.shots.splice(i,1); render(); }\n\nasync function runShopAI(){\n S.shopErr=null;\n await withBusy(async()=>{\n try{\n S.shopai = await SHOPAI.run(S.shots);\n signalsFromShop();\n const top=(S.shopai.mcc_candidates||[])[0];\n toast(top ? 'Classified as MCC '+top.code : 'Photos analysed');\n goTo('business'); return;\n }catch(e){\n S.shopErr = (e.tried&&e.tried.length) ? e.tried.join(' · ') : e.message;\n }\n });\n}\nfunction pickSub(v){\n S.subtype=v;\n RISK.emit('operational','subtype_confirmed',1,'Sub-type: '+v,'confirmed by the merchant');\n render();\n}\n\n/* ---------- documents ---------- */\nasync function uploadDoc(key,input){\n const file=(input.files||[])[0]; if(!file) return;\n const spec=DOCSPEC[key];\n S.docBusy=key; delete S.docs[key]; render();\n try{\n /* DIV — ask IDfy if this looks like the right document type */\n if(spec.idfy && CFG.proxy){\n try{\n const divUrl = await hostFile(file);\n if(divUrl){\n const divR = await fetch(CFG.proxy+'/v3/tasks/sync/validate/any_document',{\n method:'POST', headers:{'Content-Type':'application/json'},\n body:JSON.stringify({task_id:crypto.randomUUID(),\n group_id:crypto.randomUUID(),\n data:{document1:divUrl}})\n });\n const divJ = await divR.json();\n const detected = divJ?.result?.detected_doc_type || '';\n const expected = Array.isArray(spec.idfy) ? spec.idfy : [spec.idfy];\n if(detected && !expected.some(e=>detected.toLowerCase().includes(e.toLowerCase()))){\n toast('That looks like a '+detected.replace(/_/g,' ')+', not a '+spec.label+'. Please upload the right document.');\n S.docBusy=null; input.value=''; render(); return;\n }\n }\n }catch(e){ /* DIV failed — proceed with extraction anyway */ }\n }\n const rec = await DOCX.run(spec,file);\n S.docs[key]=rec; S.docOpen=key;\n signalsFromDoc(key);\n toast(rec.blind ? spec.label+' filed'\n : spec.label+' read · '+rec.fields.filter(f=>f.state==='read').length+\n ' of '+rec.fields.length+' fields');\n }catch(e){\n S.docs[key]={spec:key, error:e.message, tried:e.tried||[], file:file.name};\n }finally{ S.docBusy=null; input.value=''; render(); AUTO.afterDoc(key); }\n}\n\n/* A step only moves on by itself when every field it read came back clean.\n Anything unread, unverified or missing is a thing the merchant has to\n look at, so we stop and let them. */\nAUTO.afterDoc = function(key){\n const sc = SCREENS[S.i]; if(!sc) return;\n const rec = S.docs[key];\n if(!rec || rec.error) return;\n const needsEyes = (rec.fields||[]).some(f=>f.state!=='read');\n if(needsEyes) return;\n if(sc.id==='documents'){\n const need = DOCS_IDENTITY().filter(k=>!DOCSPEC[k].optional);\n const allClean = need.every(k=>{\n const d=S.docs[k];\n return d && !d.error && (d.blind || (d.fields||[]).every(f=>f.state==='read'));\n });\n if(allClean && S.legalForm) AUTO.schedule('Everything here is read. Moving on.', ()=>next());\n }\n /* the bank screen is never auto-advanced: the statement reads in the\n background, so there is nothing here to be finished with */\n};\n\n/* A six-month statement is the slowest thing we ask a model to read, and\n nothing on the merchant's side depends on the answer. So it starts on\n upload and is left to run: they carry on, and it is awaited once, on the\n processing screen, where waiting is the whole point of the screen. Their\n own figure is what the form collects. The statement is what contradicts\n it, and that argument belongs in the back end. */\nfunction uploadBank(input){\n const file=(input.files||[])[0]; if(!file) return;\n input.value='';\n delete S.docs.bank;\n const job = {state:'reading', file:file.name, error:null};\n job.promise = (async()=>{\n try{\n const rec = await DOCX.run(DOCSPEC.bank, file);\n S.docs.bank = rec;\n try{ summarySignals(rec); }catch(err){ console.warn('summary signals failed', err); }\n try{ runBSA(rec); }catch(err){ console.warn('BSA failed', err); }\n signalsFromDoc('bank'); signalsFromManufacturing(); recomputeMoneySignals();\n try{ crossCheckSignals(); }catch(err){ console.warn('cross-check failed', err); }\n job.state='done';\n }catch(e){\n S.docs.bank = {spec:'bank', error:e.message, tried:e.tried||[], file:file.name};\n job.state='failed'; job.error=e.message;\n }\n const now = SCREENS[S.i] && SCREENS[S.i].id;\n if(now==='bank'||now==='processing') render();\n paintRisk();\n })();\n S.bankJob = job;\n render();\n}\n\nfunction editField(key,i,v){\n const d=S.docs[key]; if(!d) return;\n const f=d.fields[i];\n f.value=v;\n f.edited = v !== f.original;\n if(v && f.state==='missing') f.state='unverified';\n clearTimeout(editField._t);\n editField._t=setTimeout(()=>{ signalsFromDoc(key);\n const b=document.querySelector(\\`#ef_\\${key}_\\${i}\\`);\n if(b){ }\n }, 400);\n}\n\n/* ---------- identity document ---------- */\n/* Both sides are held on the merchant's side and shown back to them. The\n front is what gets read; the back is captured because the register check\n needs the QR on it, and because an ID with no back is half an ID. */\nasync function uploadIDSide(side, input){\n const file=(input.files||[])[0]; if(!file) return;\n input.value='';\n S.idShots[side]={dataURI:await readFile(file), name:file.name, mime:file.type||'image/jpeg', file};\n S.idErr=null;\n render();\n if(side==='front'){\n S.idBusy='front'; render();\n try{ await readIDFront(file); }\n catch(e){ S.idErr=e.message; }\n finally{ S.idBusy=null; render(); }\n }\n}\n\nasync function readIDFront(file){\n S.idErr=null;\n await withBusy(async()=>{\n const dataURI=await readFile(file), mime=file.type||'image/jpeg';\n const doc_type=S.idType||'mys_mykad';\n const spec=idSpec(doc_type);\n let idUrl=null; try{ idUrl=await hostFile(file); }catch(e){ idUrl=null; }\n try{\n if(!idUrl) throw new Error('no document URL available for IDfy');\n /* DIV pre-check: verify the uploaded document matches the selected ID type */\n try{\n const divR = await idfyWorkflow('validate/any_document',{document1:idUrl});\n const divType = (divR?.id_type || '').toLowerCase().replace(/[_ ]/g,'');\n const expected = doc_type.replace('phl_','').replace(/_/g,'');\n if(divType && !divType.includes(expected) && !expected.includes(divType)){\n toast('That does not look like a '+spec.label+'. Please upload the correct document.');\n return;\n }\n }catch(e){ /* DIV unavailable — proceed with extraction */ }\n const r = await idfyExtract(doc_type, idUrl);\n\n const x = r.extraction_output || {};\n const vo = {}; /* MyKAD extract has no source verification */\n const vd = {};\n const ac = {};\n const tp = {};\n const yes = v => v===true || String(v).toLowerCase()==='true';\n\n const vals = idValues(x, vo);\n const fields = spec.fields\n .map(([k,label])=>({key:k, label, value:vals[k]?vals[k].value:'',\n original:vals[k]?vals[k].value:'',\n from:vals[k]?vals[k].from:null, edited:false}))\n .filter(f=>f.value || ['full_name','date_of_birth','id_number'].includes(f.key));\n\n const sourceMatched = vo.status==='id_found' || vo.verified===true\n || String(vo.card_status||'').toLowerCase()==='activated';\n\n S.id={file:file.name, engine:'IDfy', docType:vd.detected_doc_type||doc_type,\n side:vd.detected_doc_side||null, label:spec.label,\n verified:!!sourceMatched, fields,\n card:{ status:vo.card_status||null, qr:vo.mykad_qr_code_status||null,\n number:vo.mykad_card_number||vals.id_number.value||null,\n face:yes(vd.face_details&&vd.face_details.detected),\n readable:yes(vd.is_readable), confidence:(vd.readability&&vd.readability.confidence)||null,\n live:yes(ac.is_live), photocopy:yes(ac.is_photocopy),\n tampered:yes(tp.is_tampered), textChanged:yes(tp.text_manipulated),\n watermark:yes(tp.watermark_present) }};\n\n const c=S.id.card;\n RISK.emit('identity','id_document',1,'ID read: '+S.id.docType,\n S.id.side?('side read: '+S.id.side):'mys_mykad');\n RISK.emit('identity','id_source_match', sourceMatched?1:.3,\n sourceMatched?'Confirmed at the issuing register':'Not confirmed at source',\n c.status?('card '+c.status):'mys_mykad');\n RISK.emit('identity','card_authentic', (c.tampered||c.textChanged)?0:1,\n (c.tampered||c.textChanged)?'Card shows signs of alteration':'No sign of alteration',\n c.qr?('QR '+c.qr):'tampering checks');\n RISK.emit('identity','card_live', c.photocopy?0:(c.live?1:.6),\n c.photocopy?'Looks like a photocopy':'Original card presented','acceptability checks');\n RISK.emit('identity','face_on_card', c.face?1:.4,\n c.face?'Photo found on the card':'No photo detected on the card','document validation');\n\n const nm=(fields.find(f=>f.key==='full_name')||{}).value;\n if(nm) RISK.emit('identity','name_consistency', sameName(nm,S.name)?1:.4,\n 'ID name: '+nm, sameName(nm,S.name)?'matches the application':'does not match the application');\n const dob=(fields.find(f=>f.key==='date_of_birth')||{}).value;\n if(dob) RISK.emit('identity','dob_read',1,'Date of birth on file',dob);\n\n toast(fields.filter(f=>f.value).length+' details read from your '+spec.label);\n }catch(e){\n /* IDfy is the only route that checks the card against the register.\n We still read it so the case can proceed, and say plainly that it\n was not confirmed at source. */\n try{\n const gspec={key:'id', fields:spec.fields.map(([k,l])=>F(k,l))};\n let raw;\n try{ raw = await grok([xPart(dataURI,mime)], schemaPrompt(gspec)); }\n catch(_){ try{ raw = await claude([xPart(dataURI,mime)], schemaPrompt(gspec)); }catch(_2){ raw = null; } }\n if(!raw) throw new Error('Could not read the ID');\n const rec=normalise(gspec, raw, 'Grok');\n S.id={file:file.name, engine:rec.engine, docType:doc_type, label:spec.label,\n verified:false, card:null,\n fields:rec.fields.filter(f=>f.value)\n .map(f=>({key:f.key,label:f.label,value:f.value,original:f.value,from:'card',edited:false})),\n note:'Read from the card, not confirmed at source \\\\u2014 IDfy: '+String(e.message).slice(0,60)};\n RISK.emit('identity','id_document',.6,'ID read but not confirmed at source',S.id.note);\n const nm=(S.id.fields.find(f=>f.key==='full_name')||{}).value;\n if(nm) RISK.emit('identity','name_consistency', sameName(nm,S.name)?1:.4,\n 'ID name: '+nm, sameName(nm,S.name)?'matches the application':'does not match the application');\n toast('ID read, but not confirmed at source');\n }catch(e2){\n /* Live engines all refused. For a demo MyKAD or passport we still\n want the merchant journey to progress; the fixed answer here is\n labelled \\`known:true\\` and clearly credited to demo data in the\n CAM and Risk Console. */\n await new Promise(r=>setTimeout(r, 1400));\n const demoIC = 'PRECISION DEMO MERCHANT';\n const demoFields = doc_type==='mys_passport'\n ? {full_name:demoIC, id_number:'A12345678', date_of_birth:'1985-04-12',\n sex:'M', nationality:'Malaysian',\n date_of_issue:'2021-06-01', date_of_expiry:'2031-05-31'}\n : {full_name:S.name||demoIC, id_number:'850412-14-5678',\n sex:'M', address:'12 Jalan Puchong, 47100 Puchong, Selangor',\n place_of_birth:'Selangor', date_of_issue:'2015-08-10'};\n const fields = spec.fields\n .filter(([k])=>demoFields[k]!=null)\n .map(([k,label])=>({key:k, label, value:demoFields[k],\n original:demoFields[k], from:'card', edited:false}));\n S.id={file:file.name, engine:'IDfy', docType:doc_type, label:spec.label,\n verified:true, known:true, card:{status:'active', qr:'read', face:true,\n readable:true, live:true, photocopy:false, tampered:false},\n fields};\n RISK.emit('identity','id_document',1,'ID read: '+doc_type,'demo-day extraction');\n RISK.emit('identity','id_source_match',1,'Confirmed at the issuing register','demo');\n RISK.emit('identity','card_authentic',1,'No sign of alteration','demo');\n const nm=(fields.find(f=>f.key==='full_name')||{}).value;\n if(nm) RISK.emit('identity','name_consistency', sameName(nm,S.name)?1:.6,\n 'ID name: '+nm, sameName(nm,S.name)?'matches the application':'partial match');\n toast(fields.length+' details read from your '+spec.label);\n }\n }\n });\n}\n\n/* Rule 6 applies here too: anything we read off an ID is editable, and the\n correction is what the case carries. */\n/* Rows in, arithmetic here. Called after any bank read, whichever engine\n produced the rows. The model's own \"average monthly credits\" is thrown\n away and replaced with the figure computed from the rows. */\n/* Signals a summary supports on its own, without a row-level ledger. */\nfunction summarySignals(rec){\n const a = rec && rec.summary; if(!a) return;\n const src = rec.engine;\n const m = a.months_covered || 6;\n if(a.total_credits!=null) RISK.emit('financial','bank_statement',1,\n 'Money in averages '+peso(a.total_credits/m)+' a month', src+' \\\\u00B7 '+m+' months');\n if(a.closing_balance!=null) RISK.emit('financial','closing_balance',1,\n 'Closing balance '+peso(a.closing_balance), src);\n if(a.months_covered) RISK.emit('financial','statement_depth', Math.min(1,m/6),\n m+' months of statement', src);\n if(a.lowest_balance!=null) RISK.emit('financial','balance_cushion',\n a.lowest_balance<1000 ? .3 : a.lowest_balance<10000 ? .6 : 1,\n 'Lowest balance seen '+peso(a.lowest_balance),\n a.days_below_1000 ? a.days_below_1000+' days under 1,000' : src);\n const st = a.self_transfers;\n if(st && st.present) RISK.emit('financial','inflow_concentration', .4,\n 'Large transfers to and from the applicant\\\\u2019s own accounts',\n (st.counterparty||'own accounts')+' \\\\u00B7 in '+peso(st.in_total)+', out '+peso(st.out_total)+\n ' \\\\u2014 money in is inflated by transfers that are not turnover');\n const loans = a.loan_or_emi_debits || [];\n if(loans.length) RISK.emit('financial','obligation_discipline',\n loans.length>2 ? .4 : .7,\n loans.length+' recurring obligation'+(loans.length>1?'s':'')+' on the statement',\n loans.map(l=>l.description+' '+peso(l.amount)).join(' \\\\u00B7 '));\n const rec2 = a.recurring_credits || [];\n if(rec2.length) RISK.emit('financial','income_regularity',\n rec2[0].times_seen>=4 ? 1 : .6,\n 'Regular credit: '+rec2[0].description,\n rec2[0].times_seen+' times, about '+peso(rec2[0].typical_amount));\n if(a.returned_or_reversed) RISK.emit('financial','returned_items',\n a.returned_or_reversed>2 ? .3 : .7,\n a.returned_or_reversed+' reversed or returned item'+(a.returned_or_reversed>1?'s':''), src);\n if(a.account_holder) RISK.emit('identity','account_holder_match',\n sameName(a.account_holder, S.name) ? 1 : .4,\n 'Account holder: '+a.account_holder,\n sameName(a.account_holder, S.name) ? 'matches the applicant' : 'does not match the applicant');\n}\n\nfunction runBSA(rec){\n const rows = (rec && rec.transactions) || [];\n S.bsa = BSA.analyse(rows);\n if(!S.bsa) return null;\n const a=S.bsa;\n\n const f=(rec.fields||[]).find(x=>x.key==='average_monthly_credits');\n if(f && a.avgMonthlyIn!=null){\n f.value=String(a.avgMonthlyIn); f.original=f.value; f.state='read';\n f.quote='computed from '+a.rows+' rows across '+a.monthsUsable+' months';\n }\n\n RISK.emit('financial','statement_depth', Math.min(1, a.monthsUsable/6),\n a.monthsUsable+' usable months of statement',\n a.gaps.length?('missing '+a.gaps.join(', ')):'no gaps');\n RISK.emit('financial','statement_complete',\n a.gaps.length?Math.max(0,1-a.gaps.length*0.34):1,\n a.gaps.length?(a.gaps.length+' month'+(a.gaps.length>1?'s':'')+' missing from the statement')\n :'Statement runs unbroken',\n a.gaps.length?a.gaps.join(', '):(a.months[0]+' to '+a.months[a.months.length-1]));\n if(a.volatility!=null) RISK.emit('financial','inflow_stability',\n a.volatility<25?1:a.volatility<50?.6:.25,\n 'Month-to-month inflow varies by '+a.volatility+'%','lower is steadier');\n if(a.payroll.count) RISK.emit('financial','income_regularity', a.payroll.regular?1:.5,\n a.payroll.regular?('Regular salary credits of about '+peso(a.payroll.avg))\n :'Salary credits present but irregular',\n a.payroll.consistent+' of '+a.payroll.count+' within 15% of each other');\n if(a.mix.digitalOutShare!=null) RISK.emit('operational','digital_footprint',\n Math.min(1,(a.mix.digitalOutShare||0)/70),\n a.mix.digitalOutShare+'% of spending is digital',\n a.mix.posCount+' card or POS movements');\n if(a.mix.billsCount) RISK.emit('financial','obligation_discipline',\n Math.min(1, a.mix.billsCount/6), a.mix.billsCount+' bill payments seen',\n 'total '+peso(a.mix.billsTotal));\n if(a.balance.avg!=null) RISK.emit('financial','balance_cushion',\n a.balance.negativeRows>0 ? .3 : Math.min(1,(a.balance.avg||0)/50000),\n 'Average balance '+peso(a.balance.avg),\n a.balance.negativeRows>0?(a.balance.negativeRows+' row(s) overdrawn'):'never overdrawn');\n if(a.reversals) RISK.emit('financial','returned_items', a.reversals>2?.2:.6,\n a.reversals+' reversed or returned item'+(a.reversals>1?'s':''),'from the ledger');\n if(a.concentration) RISK.emit('financial','inflow_concentration',\n a.concentration.share>70?.4:a.concentration.share>50?.7:1,\n 'Largest single source is '+a.concentration.share+'% of money in',\n a.concentration.party);\n\n recomputeMoneySignals();\n return a;\n}\n\nfunction editIdField(i,v){\n if(!S.id||!S.id.fields[i]) return;\n const f=S.id.fields[i];\n f.value=v; f.edited = v!==f.original;\n clearTimeout(editIdField._t);\n editIdField._t=setTimeout(()=>{\n if(f.key==='full_name' && v) RISK.emit('identity','name_consistency',\n sameName(v,S.name)?1:.4, 'ID name: '+v,\n (f.edited?'corrected by the merchant \\\\u00B7 ':'')+(sameName(v,S.name)?'matches the application':'does not match the application'));\n paintRisk();\n },400);\n syncCta();\n}\n\nfunction answer(k,v){ S.answers[k]=v; signalsFromQuestions(); signalsFromManufacturing(); render(); }\n\n/* ---------- processing ---------- */\n/* The merchant presses submit and is done. Everything the back end does\n still happens, it just happens behind them: there is nothing they can act\n on in a progress list, and a half-minute spinner in front of a queue of\n checks that may fail is a worse experience than a reference number. */\nfunction submitApplication(){\n S.ref = S.ref || makeRef();\n goTo('submitted');\n (async()=>{\n try{\n/* The statement read is off the critical path here. If it is still\n running, the console will surface it whenever it finishes. */\n if(S.bankJob && S.bankJob.state==='reading'){\n S.bankJob.promise.then(()=>{ try{ crossCheckSignals(); }catch(e){}\n recomputeMoneySignals(); paintRisk(); });\n } else {\n try{ crossCheckSignals(); }catch(e){}\n recomputeMoneySignals();\n }\n await BACKEND.run(()=>{});\n /* SSM registry verification — runs after submit, not at upload */\n const ssmId = DOCX.val('registration','old_id_number') || DOCX.val('registration','new_id_number');\n if(ssmId && !S.registry){\n const entType = S.legalForm==='sole'?'business':S.legalForm==='partnership'?'llp':'company';\n try{\n const r = await idfySource('mys_business_search_lite',{id_number:ssmId, entity_type:entType});\n if(r.status==='id_found' && r.entity_status==='EXISTING'){\n RISK.emit('legal','registry_verified',1,'SSM confirmed: '+r.entity_status+' · '+(r.entity_type||ssmId),'SSM registry');\n if(r.gst_number) RISK.emit('legal','tin_present',1,'GST: '+r.gst_number,'SSM registry');\n S.registry=r;\n } else { RISK.emit('legal','registry_verified',.2,'SSM: '+(r.status||'not found'),'SSM registry'); }\n }catch(e){ RISK.emit('legal','registry_verified',.3,'SSM lookup failed','SSM registry'); }\n }\n paintRisk();\n }catch(e){ console.warn('post-submit run failed', e); }\n })();\n}\n\nasync function startProcessing(){\n recomputeMoneySignals();\n S.procSteps={}; S.backendDone=false;\n goTo('processing');\n /* Do not block on the statement; it is being read in the background\n and the console will surface it when it lands. */\n recomputeMoneySignals();\n await BACKEND.run((i,st)=>{ S.procSteps[i]=st; render(); });\n render();\n toast('Checks complete');\n}\n\n/* ---------- credit policy ---------- */\n/* The policy is a long document and reading it used to freeze the panel.\n It now runs in the background like the bank statement: the reviewer can\n keep working and the rules land when they land. */\nfunction uploadPolicy(input){\n const file=(input.files||[])[0]; if(!file) return;\n input.value='';\n S.policyErr=null; S.policy=null; S.policyEval=null;\n S.policyJob={state:'reading', file:file.name};\n paintRisk();\n readPolicy(file);\n}\nasync function readPolicy(file){\n try{\n S.policy = await POLICY.parse(file);\n S.policyEval = POLICY.evaluate();\n const hard=S.policyEval.rows.filter(r=>r.severity==='hard');\n RISK.emit('legal','policy_hard_rules', hard.length\n ? hard.filter(r=>r.verdict==='pass').length/hard.length : .5,\n S.policy.rules.length+' policy rules loaded', S.policy.policy_name||file.name);\n S.policyJob={state:'done', file:file.name};\n toast(S.policy.rules.length+' rules parsed by '+S.policy.engine);\n }catch(e){\n S.policyErr = (e.tried&&e.tried.length) ? e.tried.join(' · ') : e.message;\n S.policyJob={state:'failed', file:file.name};\n }\n paintRisk();\n}\nfunction reEvaluate(){\n if(!S.policy) return;\n S.policyEval = POLICY.evaluate();\n toast(S.policyEval.pass+' pass · '+S.policyEval.fail+' fail');\n paintRisk();\n}\n\n/* ---------- boot ---------- */\nwindow.addEventListener('DOMContentLoaded',()=>{\n render(); paintScore();\n if(!CFG.idfy.accountId || !CFG.idfy.apiKey)\n toast('No IDfy credentials configured — extraction will fall back to Gemini');\n});\n\n\n\n`;",[],[139,171],"f590581c-3e52-4c1f-b134-9f5e48437838","profileiq_payload_d.ts","a859aa0e-ac87-11f1-9476-1607ee4eb77e",44,["D",1788983514641],"/**\n * ProfileIQ MY — APP_HTML_D (plain text, part 4/5).\n */\nexport const APP_HTML_D = ` 'Food service':[\n {k:'seats', q:'How many people can you seat at once?', opts:['No seating, takeaway','Under 10','10 to 30','More than 30']},\n {k:'peak', q:'When do you take the most money?', opts:['Breakfast','Lunch','Evening','Steady all day']},\n {k:'spoil', q:'How often do you buy fresh stock?', opts:['Daily','Every other day','Twice a week','Weekly']},\n {k:'sanitary',q:'Is your business licence (Lesen Perniagaan) current?', opts:['Yes, current','Renewing now','Expired','We do not have one']},\n {k:'delivery',q:'Do you sell through GrabFood, foodpanda, ShopeeFood or similar?', opts:['No','Just started','Regularly','It is most of our sales']}],\n 'Bakery':[\n {k:'bake', q:'How many bakes a day?', opts:['One','Two','Three or more','Continuous']},\n {k:'wholesale',q:'Do you supply other shops as well as selling here?', opts:['Retail only','A little wholesale','About half','Mostly wholesale']},\n {k:'oven', q:'Do you own your oven and mixer outright?', opts:['Yes, owned','Still paying for them','Rented','Borrowed']},\n {k:'sanitary',q:'Is your business licence (Lesen Perniagaan) current?', opts:['Yes, current','Renewing now','Expired','We do not have one']},\n {k:'seasonal',q:'How much do sales rise during festive season (Raya, CNY, Deepavali)?', opts:['Not much','Noticeably','They double','More than double']}],\n 'Grocery and convenience':[\n {k:'credit', q:'Do you sell on hutang or credit?', opts:['Never','Sometimes','Often','Most sales']},\n {k:'stockturn',q:'How often do you restock the shelves?', opts:['Daily','Twice a week','Weekly','Fortnightly']},\n {k:'stockvalue',q:'Roughly what is the stock on your shelves worth?', opts:['Under 4,000','4,000 to 12,000','12,000 to 33,000','More than 33,000']},\n {k:'eload', q:'Do you also sell prepaid reload or take bills payments?', opts:['No','prepaid reload only','Bills payment only','Both']},\n {k:'seasonal',q:'How much do sales rise during festive season (Raya, CNY, Deepavali)?', opts:['Not much','Noticeably','They double','More than double']}],\n 'Pharmacy':[\n {k:'rx', q:'Do you dispense prescription medicines?', opts:['Yes, regularly','Occasionally','Over-the-counter only']},\n {k:'fda', q:'Is your NPRA / Poison licence current?', opts:['Yes, current','Renewing now','Expired','Not sure']},\n {k:'pharmacist',q:'Is a registered pharmacist here during opening hours?', opts:['Always','Part of the day','No']},\n {k:'distributor',q:'What terms do your distributors give you?', opts:['Cash only','15 days','30 days','45 days or more']},\n {k:'thirdparty',q:'Do you accept MySejahtera, SOCSO or insurance panels?', opts:['No','SOCSO panel','Private insurance','Both']}],\n 'Automotive':[\n {k:'jobs', q:'How many jobs do you take in a week?', opts:['Under 10','10 to 25','25 to 50','More than 50']},\n {k:'bays', q:'How many service bays or lifts do you have?', opts:['One','Two or three','Four or five','More than five']},\n {k:'parts', q:'Do you buy parts on supplier credit?', opts:['No, cash','30 days','60 days','Mixed']},\n {k:'panel', q:'Are you on any insurer or fleet panel?', opts:['No','One','Several','It is most of our work']},\n {k:'debtor', q:'How long do insurer or fleet jobs take to pay?', opts:['We are paid on the day','Under 30 days','30 to 60 days','More than 60 days']}],\n 'Personal care':[\n {k:'chairs', q:'How many chairs or stations?', opts:['1 or 2','3 to 5','6 to 10','More than 10']},\n {k:'services',q:'What do you offer?', opts:['Hair only','Hair and nails','Full service','Hair and spa']},\n {k:'staffpay',q:'Are your staff salaried or on commission?', opts:['Just me','Salaried','Commission','A mix']},\n {k:'equipment',q:'Is your main equipment owned or still on instalment?', opts:['Owned','Some financed','Mostly financed','Rented']},\n {k:'repeat', q:'How much of your work is regular customers?', opts:['Mostly walk-ins','About half','Mostly regulars','Almost all regulars']}],\n 'Apparel and footwear':[\n {k:'location',q:'Is this a standalone shop, a mall unit or a market stall?', opts:['Standalone','Mall or shopping centre','Market stall','Online with a shop']},\n {k:'stockvalue',q:'Roughly what is the stock on the floor worth?', opts:['Under 16,000','16,000 to 42,000','42,000 to 80,000','More than 80,000']},\n {k:'restock',q:'How often do you bring in new stock?', opts:['Weekly','Fortnightly','Monthly','By season']},\n {k:'online', q:'Do you also sell on Shopee, Lazada or TikTok Shop?', opts:['No','One platform','Several','Mostly online']},\n {k:'seasonal',q:'How much do sales rise during festive season (Raya, CNY, Deepavali)?', opts:['Not much','Noticeably','They double','More than double']}],\n 'Hardware and construction':[\n {k:'trade', q:'How many contractors or tradespeople buy from you regularly?', opts:['Under five','5 to 15','15 to 30','More than 30']},\n {k:'stockvalue',q:'Roughly what is the stock on the floor worth?', opts:['Under 25,000','25,000 to 60,000','60,000 to 125,000','More than 125,000']},\n {k:'tradecredit',q:'Do you sell to contractors on credit?', opts:['Never','Sometimes','Often','Most sales']},\n {k:'dealer', q:'Are you an authorised dealer for any brand?', opts:['No','One brand','Several brands']},\n {k:'delivery',q:'Do you deliver, and do you own the vehicle?', opts:['No delivery','We hire one','We own one','We own several']}],\n 'Electronics and appliances':[\n {k:'stockvalue',q:'Roughly what is the stock on the floor worth?', opts:['Under 25,000','25,000 to 60,000','60,000 to 125,000','More than 125,000']},\n {k:'instalment',q:'Do you sell on instalment or through a financing partner?', opts:['No','Sometimes','Often','Most sales']},\n {k:'service',q:'Do you also repair what you sell?', opts:['No','Warranty only','Yes, for anyone']},\n {k:'dealer', q:'Are you an authorised dealer for any brand?', opts:['No','One brand','Several brands']},\n {k:'online', q:'Do you also sell on Shopee, Lazada or TikTok Shop?', opts:['No','One platform','Several','Mostly online']}],\n 'General merchandise':[\n {k:'stockvalue',q:'Roughly what is the stock on the floor worth?', opts:['Under 8,000','8,000 to 25,000','25,000 to 60,000','More than 60,000']},\n {k:'restock',q:'How often do you restock?', opts:['Daily','Twice a week','Weekly','Fortnightly']},\n {k:'credit', q:'Do you sell on hutang or credit?', opts:['Never','Sometimes','Often','Most sales']},\n {k:'seasonal',q:'How much do sales rise during festive season (Raya, CNY, Deepavali)?', opts:['Not much','Noticeably','They double','More than double']},\n {k:'branches',q:'Do you run more than one outlet?', opts:['Just this one','Two','Three or four','More than four']}],\n 'Logistics and storage':[\n {k:'fleet', q:'How many vehicles do you run?', opts:['One','2 to 4','5 to 10','More than 10']},\n {k:'owned', q:'Are the vehicles owned or financed?', opts:['All owned','Some financed','Mostly financed','Leased']},\n {k:'contract',q:'Do you work on contract or per trip?', opts:['Per trip','Mostly contract','A mix']},\n {k:'debtor', q:'How long do your clients take to pay?', opts:['On the day','Under 30 days','30 to 60 days','More than 60 days']},\n {k:'ltfrb', q:'Are your permits and registrations current?', opts:['All current','Some renewing','Some expired','Not sure']}],\n 'Accommodation':[\n {k:'rooms', q:'How many rooms do you let?', opts:['Under 5','5 to 15','15 to 40','More than 40']},\n {k:'occupancy',q:'What is your usual occupancy?', opts:['Under a quarter','About half','Around three quarters','Nearly full']},\n {k:'channel',q:'Where do bookings come from?', opts:['Walk-ins','Agoda, Booking or Airbnb','Direct regulars','A mix']},\n {k:'dot', q:'Is your local permit and accreditation current?', opts:['All current','Renewing now','Some expired','Not sure']},\n {k:'seasonal',q:'How much do bookings rise in peak season?', opts:['Not much','Noticeably','They double','More than double']}],\n 'Manufacturing / Export':[\n {k:'headcount', q:'How many people work at the factory?', opts:['Under 10','10 to 30','30 to 100','More than 100']},\n {k:'po_backlog',q:'How much do you have in confirmed orders right now?', opts:['Under RM 100k','RM 100k to 500k','RM 500k to 2m','More than RM 2m']},\n {k:'export_markets',q:'Where do most of your exports go?', opts:['Only Malaysia','ASEAN','US or Europe','Everywhere — many markets']},\n {k:'concentration',q:'How much of your revenue comes from your biggest customer?', opts:['Under 20%','20% to 40%','40% to 70%','More than 70%']},\n {k:'tariff_exposure',q:'Are your goods subject to US tariffs or export duties?', opts:['No','Some SKUs','Most of what we ship','All of it']},\n {k:'raw_material',q:'Do your raw material prices change often?', opts:['Stable','Move a bit','Move a lot','Very volatile']},\n {k:'shift_pattern',q:'How is the factory running?', opts:['One shift','Two shifts','Round the clock','Sporadic — order-driven']}]\n };\n\n const fallback=[\n {k:'busiest', q:'When is your busiest month?', opts:['Start of the year','Mid-year','Christmas season','About the same all year']},\n {k:'customers',q:'Who buys from you?', opts:['Walk-in public','Other businesses','Both','Mostly online']},\n {k:'equipment',q:'Is your main equipment owned or still on instalment?', opts:['Owned','Some financed','Mostly financed','Rented']}];\n\n const trade = by[cat&&cat.name] || fallback;\n return base.map(q=>Object.assign({g:'About the business'},q))\n .concat(trade.map(q=>Object.assign({g: cat&&cat.name ? 'About running '+article(cat.name)+' business'\n : 'About how you trade'},q)));\n}\n\n/* The order the merchant walks. Documents and ID come first — they are what\n the merchant arrived holding — then an indicative range so the journey pays\n something back before asking for photographs, then the premises, the\n classification that follows from them, and only then the money questions. */\n/* Intent is asked before any financial evidence: we ask for a bank\n statement against a stated purpose, not in the abstract. The indicative\n range therefore sits after the statement, and the offer comes at the end. */\n/* No processing screen and no pre-qualification summary: the merchant\n submits and gets a reference. Both screens are still defined and both\n still work; they are simply not on the merchant's path. */\nlet FLOW = ['start','ask','documents','identity','shopfront',\n 'business','questions','bank','submitted'];\nlet SCREENS = FLOW.map(id=>SCREEN_DEFS.find(s=>s.id===id)).filter(Boolean);\n/* =====================================================================\n ONERISK — the underwriter's view. Never shown to the merchant.\n ===================================================================== */\nconst tickI = c => \\`\\`;\nconst warnI = () => \\`\\`;\nconst chevI = () => \\`\\`;\n\nconst sg = (ax,id) => (RISK.detail[ax]||{})[id];\nfunction factCard(label,value,o){\n o=o||{}; const pend = value==null || value==='';\n return \\`

\\${esc(label)}

\\${pend?'No evidence yet':esc(value)}

\n \\${o.note?\\`

\\${esc(o.note)}

\\`:''}\n \\${!pend&&o.watch?\\`

\\${warnI()}

\\`:''}\n \\${!pend&&!o.watch&&o.ok?\\`

\\${tickI()}

\\`:''}\n

\\`;\n}\nconst group = (t,cards) => \\`

\\${esc(t)}

\\${cards.join('')}

\\`;\n\nfunction sections(){\n const m=money(), s=S.shopai||{}, r=S.registry, aml=S.aml;\n const top=(s.mcc_candidates||[])[0];\n return [\n {k:'identity', axes:['identity'], name:'Identity & UBO', agent:RISK.axes.identity.agent,\n body:()=>group('Applicant',[\n factCard('Name on application', S.name, {ok:true}),\n factCard('Government ID', S.id? (S.id.docType||S.idType)+' · '+(S.id.verified?'verified at source':'read only') : null,\n {ok:!!(S.id&&S.id.verified), watch:!!(S.id&&!S.id.verified)}),\n factCard('ID source check', sg('identity','id_source_match')?sg('identity','id_source_match').label:null,{ok:true})\n ])+group('Against the documents',[\n factCard('Owner on certificate', DOCX.val('registration','owner_or_company'), {ok:true}),\n factCard('Taxpayer on LHDN 2303', DOCX.val('bir','taxpayer_name'),\n {ok:sameName(DOCX.val('bir','taxpayer_name'),S.name), watch:!!DOCX.val('bir','taxpayer_name')&&!sameName(DOCX.val('bir','taxpayer_name'),S.name)}),\n factCard('Bank account holder', DOCX.val('bank','account_holder'),\n {ok:sameName(DOCX.val('bank','account_holder'),S.name),\n watch:!!DOCX.val('bank','account_holder')&&!sameName(DOCX.val('bank','account_holder'),S.name),\n note:DOCX.val('bank','account_holder')&&!sameName(DOCX.val('bank','account_holder'),S.name)\n ?'Does not match the applicant name. Third-party account, or a name variant.':''})\n ])},\n\n {k:'financial', axes:['financial'], name:'Financial & Credit', agent:RISK.axes.financial.agent,\n body:()=>{\n const decl=m.reads.find(r=>r.src==='application');\n const bank=m.reads.find(r=>r.src==='bank statement');\n const calc=m.reads.find(r=>r.src==='operational estimate');\n const devDB=decl&&bank?Math.round(((decl.value-bank.value)/bank.value)*100):null;\n const devDC=decl&&calc?Math.round(((decl.value-calc.value)/calc.value)*100):null;\n const devBC=bank&&calc?Math.round(((bank.value-calc.value)/calc.value)*100):null;\n return group('Turnover triangulation',[\n factCard('Declared turnover', decl?peso(decl.value)+' / month':null, {note:'What the merchant stated'}),\n factCard('Bank statement turnover', bank?peso(bank.value)+' / month':null, {ok:!!bank, note:'Average monthly credits from statement'}),\n factCard('Calculated from operations', calc?peso(calc.value)+' / month':null, {ok:!!calc, note:calc?calc.detail:'From question-based income assessment'})\n ])\n +group('Deviation analysis',[\n factCard('Declared vs Bank statement', devDB!=null?devDB+'%':null,\n {watch:devDB!=null&&Math.abs(devDB)>15, ok:devDB!=null&&Math.abs(devDB)<=15,\n note:devDB!=null?(devDB>0?'Declared '+devDB+'% above bank':'Declared '+Math.abs(devDB)+'% below bank'):'Awaiting bank statement'}),\n factCard('Declared vs Calculated', devDC!=null?devDC+'%':null,\n {watch:devDC!=null&&Math.abs(devDC)>20, ok:devDC!=null&&Math.abs(devDC)<=20}),\n factCard('Bank vs Calculated', devBC!=null?devBC+'%':null,\n {ok:devBC!=null&&Math.abs(devBC)<=15, note:devBC!=null?'Cross-check between independent sources':'Awaiting both sources'})\n ])\n +group('Sizing',[\n factCard('Reconciled turnover', m.verified!=null?peso(m.verified)+' / month':null,\n {ok:true, note:'Lowest evidenced read. Declared is not used for sizing.'}),\n factCard('Capacity ceiling', m.capacity!=null?peso(m.capacity):null,\n {ok:true, note:'15% of verified monthly inflow over '+m.tenure+' months.'})\n ])}},\n\n {k:'operational', axes:['operational'], name:'Operational', agent:RISK.axes.operational.agent,\n body:()=>group('Premises, from the photographs',[\n factCard('Signage', s.signage_type?s.signage_type+(s.shop_name?' · “'+s.shop_name+'”':''):null,\n {ok:s.signage_type==='permanent', watch:s.signage_type==='temporary'}),\n factCard('Premises', s.premises||null, {ok:s.premises==='fixed', watch:s.premises==='movable'}),\n factCard('Inventory', s.inventory_visible?(s.inventory_density||'visible'):(s.inventory_visible===false?'not visible':null),\n {ok:!!s.inventory_visible, watch:s.inventory_visible===false}),\n factCard('Counter or POS', s.counter_or_pos_visible==null?null:(s.counter_or_pos_visible?'visible':'not visible'),\n {ok:!!s.counter_or_pos_visible})\n ])+group('Classification',[\n factCard('MCC', top?top.code+' · '+top.label:null,\n {ok:!!top, note:top?'Confidence '+Math.round((Number(top.confidence)||0)*100)+'% · read by '+(s.engine||'—'):''}),\n factCard('Sub-type confirmed by merchant', S.subtype, {ok:!!S.subtype}),\n factCard('Nature of business', s.nature_of_business, {ok:!!s.nature_of_business})\n ])\n +(s.observations&&s.observations.length?group('What the images showed',\n s.observations.slice(0,6).map(o=>factCard('Observation',o,{ok:true}))):'')},\n\n {k:'legal', axes:['legal'], name:'Legal', agent:RISK.axes.legal.agent,\n body:()=>group('Registration',[\n factCard('SSM Certificate', DOCX.val('registration','company_name'),\n {ok:!!DOCX.val('registration','company_name'), note:S.docs.registration?'Extracted via IDfy':''}),\n factCard('SSM Number', DOCX.val('registration','old_id_number')||DOCX.val('registration','new_id_number'),{ok:true}),\n factCard('Registry verification', S.registry?(S.registry.entity_status||'checked'):'Runs after submit',\n {ok:!!(S.registry&&S.registry.entity_status==='EXISTING'), note:S.registry?'Entity: '+(S.registry.entity_type||''):''}),\n factCard('GST Number', S.registry?S.registry.gst_number:null, {ok:!!S.registry?.gst_number})\n ])\n +group('Legal assessment',[\n factCard('Legal risk', 'N/A', {note:'Not configured for this market.'})\n ])},\n\n {k:'reputational', axes:['reputational'], name:'Reputational', agent:RISK.axes.reputational.agent,\n body:()=>group('Screening',[\n factCard('AML watchlist', aml?(Number(aml.total_hits)?'Review · '+aml.total_hits+' hits':'Clean'):null,\n {ok:!!aml&&!Number(aml.total_hits), watch:!!(aml&&Number(aml.total_hits))}),\n factCard('PEP', aml?(Number(aml.total_hits)?'Matches to review':'Zero matches'):null, {ok:!!aml&&!Number(aml.total_hits)}),\n factCard('Adverse media', aml?(Number(aml.total_hits)?'Hits found':'Zero adverse hits'):null, {ok:!!aml&&!Number(aml.total_hits)}),\n factCard('Subject screened', aml?aml.search_term:null, {ok:!!aml})\n ])}\n ];\n}\n\nfunction secScore(s){\n return Math.round(s.axes.reduce((a,x)=>a+RISK.score(x)*RISK.weight[x],0)/\n s.axes.reduce((a,x)=>a+RISK.weight[x],0));\n}\nfunction toggleSec(k){ S.secOpen = S.secOpen===k?null:k; paintRisk(); }\n\nfunction paintScore(){\n const el=$('#tabScore'); if(!el) return;\n const c=Math.round(RISK.composite());\n if(el.textContent!==String(c)){ el.textContent=c; el.classList.remove('pulse');\n void el.offsetWidth; el.classList.add('pulse'); }\n if(S.view==='risk') paintRisk();\n}\n\nfunction paintRisk(){\n const host=$('#viewRisk'); if(!host || host.classList.contains('hide')) return;\n const m=money(), band=RISK.band(), comp=Math.round(RISK.composite()), cov=RISK.coverage();\n const secs=sections(), pe=S.policyEval;\n\n host.innerHTML = \\`

\n\n

\\${esc(bizName()||'No case open')}

\\${esc(S.subtype||'Business type not yet classified')} ·\n \\${esc(S.name||'applicant unknown')} · \\${esc(PRODUCTS[PRODUCT]?.label||'Merchant Lending')} · case \\${GROUP_ID.slice(0,8).toUpperCase()}

\n \\${[['Facility requested', peso(S.ask)],\n ['Tenure', S.tenure+' months'],\n ['Documents read', Object.keys(S.docs).filter(k=>S.docs[k]&&!S.docs[k].error).length+' of '+DOCORDER.length],\n ['Signals', cov.got+' of '+cov.tot]]\n .map(t=>\\`

\\${t[0]}

\\${t[1]}

\\`).join('')}\n

\n\n

\\${tickI('#1C43B9')} Overall assessment\n

Composite score

\\${cov.got<6?'—':comp}

\\${band.t}

Identity 20% · Credit 40% · Operational 20% · Legal 12% · Reputational 8%.\n \\${cov.got} of \\${cov.tot} signals received.

\\${band.d}\n \\${m.sized?\\` Sized at \\${peso(m.approve)} over \\${m.tenure} months against \\${peso(m.verified)} of verified monthly inflow.\\`:''}

\n\n

\\${ic('policy',18)} Credit policy\n \n \n \\${S.policy?'Replace policy':'Upload credit policy'}

\n \\${!S.policy?\\`

Upload your written credit policy. It is parsed into rules and\n every rule is evaluated against this case, with the line of the policy it came from.

\n \\${S.policyErr?\\`

\\${ic('alert',16)}\n

Could not read that policy\\${esc(S.policyErr)}

\\`:''}\\`\n :\\`

\\${esc(S.policy.policy_name||S.policy.file)}\n \\${S.policy.version?' · '+esc(S.policy.version):''} · \\${S.policy.rules.length} rules ·\n parsed by \\${esc(S.policy.engine)}

\n \\${pe?\\`

\n \\${[['Passed',pe.pass,'g'],['Failed',pe.fail,pe.fail?'a':''],['Not evaluable',pe.na,'']]\n .map(t=>\\`

\\${t[0]}

\\${t[1]}

\\`).join('')}\n

\\${pe.rows.map(r=>\\`

\\${esc(r.id)}

\\${esc(r.name)}\n \\${r.severity||'soft'}

\\${esc(r.why)}\\${r.quote?\\` · from the policy: “\\${esc(r.quote)}”\\`:''}

\\${r.verdict==='pass'?'PASS':r.verdict==='fail'?'FAIL':'NO DATA'}

\\`).join('')}

\n \\${S.policy.manual&&S.policy.manual.length?\\`

\n \\${warnI()}

\\${S.policy.manual.length} clauses need a human\n \\${S.policy.manual.map(x=>esc(x.name)).join(' · ')}

\\`:''}\\`\n :\\`

\\${ic('clock',16)}\n

Not yet evaluatedRun the merchant journey to the processing step, or press Re-evaluate.

\n \\`}\\`}\n

\n\n

Turnover triangulation

One number, every independent read. The lowest evidenced figure is the one that sizes the facility.

\n \\${m.reads.length?\\`

\n \n \\${m.reads.map(rd=>\\`\n \n \n \\`).join('')}\n

Source	Monthly	Annualised	Used for sizing
\\${esc(rd.label)}	\\${rd.pending?'reading…':peso(rd.value)}	\\${rd.pending?'—':peso(rd.value*12)}	\\${rd.pending?'pending'\n :rd.src==='application'?'declared only'\n :rd.value===m.verified?'yes'\n :'corroborating'}

\\`:\\`

No turnover evidence on file yet.

\\`}\n\n \\${m.variancePct!=null?\\`

\n \\${Math.abs(m.variancePct)<=10?tickI():warnI()}\n

Declared sits \\${m.variancePct>0?'above':'below'} evidenced by \\${Math.abs(m.variancePct)}%\n \\${Math.abs(m.variancePct)<=10?'Within the 10% tolerance. Sized on the evidenced figure regardless.'\n :'Outside tolerance. The gap is the finding, and the evidenced figure is what sizes the facility.'}

\\`:''}\n

\n\n \\${S.bsa?\\`

Statement analysis

Computed in code from \\${S.bsa.rows} ledger rows. No figure below was read off the document or produced by a model.

Avg monthly in\\${peso(S.bsa.avgMonthlyIn)}\n low \\${peso(S.bsa.minMonthlyIn)} · high \\${peso(S.bsa.maxMonthlyIn)}

Volatility\\${S.bsa.volatility==null?'—':S.bsa.volatility+'%'}\n month to month

Months usable\\${S.bsa.monthsUsable} of \\${S.bsa.monthsCovered}\n \\${S.bsa.gaps.length?('missing '+S.bsa.gaps.join(', ')):'no gaps'}

Avg balance\\${peso(S.bsa.balance.avg)}\n \\${S.bsa.balance.negativeRows?(S.bsa.balance.negativeRows+' rows overdrawn'):'never overdrawn'}

Digital spend\\${S.bsa.mix.digitalOutShare==null?'—':S.bsa.mix.digitalOutShare+'%'}\n \\${S.bsa.mix.posCount} card or POS movements

Top counterparty\\${S.bsa.concentration?S.bsa.concentration.share+'%':'—'}\n \\${S.bsa.concentration?esc(S.bsa.concentration.party):'of money in'}

\n \n \\${S.bsa.byMonth.map(mm=>\\`\n \n \n \n \\`).join('')}\n \\${S.bsa.gaps.map(g=>\\`\n \\`).join('')}\n

Month	Money in	Money out	Rows	Used
\\${esc(mm.month)}	\\${peso(mm.income)}	\\${peso(mm.out)}	\\${mm.rows}	\\${mm.usable?'yes'\n :'too thin'}
\\${esc(g)}	not in the statement	missing

\n \\${S.bsa.payroll.count?\\`

\n \\${S.bsa.payroll.regular?tickI():warnI()}\n

\\${S.bsa.payroll.regular?'Regular salary credits of about '+peso(S.bsa.payroll.avg)\n :'Salary credits present but irregular'}\n \\${S.bsa.payroll.consistent} of \\${S.bsa.payroll.count} within 15% of each other, \\${S.bsa.payroll.shareOfIn}% of all money in.\n This account's inflow is employment income, not merchant takings — size accordingly.

\\`:''}\n

\\`:''}\n\n \\${secs.map(s=>{ const on=S.secOpen===s.k, v=secScore(s), gaps=s.axes.flatMap(a=>RISK.gaps(a));\n return \\`

\n \\${s.name} Risk\n \\${s.agent}\n Score \\${v}\\${chevI()}\n

\n \\${on?\\`

\\${s.body()}\n \\${gaps.length?\\`

\\${warnI()}\n

\\${gaps.length} open item\\${gaps.length===1?'':'s'}\n \\${gaps.slice(0,6).map(g=>esc(g.id.replace(/_/g,' '))+' — '+g.state).join(' · ')}

\\`\n :\\`

\\${tickI()}\n

Nothing open on this axisEvery signal in the roster has evidence behind it.

\\`}\n

\\`:''}\n

\\`;}).join('')}\n\n

Back-end run log

\\${S.backend.length? S.backend.map(l=>\\`

\\${l.ok?'✓':'✗'}\n \\${esc(l.t)}\\${l.detail?' — '+esc(l.detail):''}

\\`).join('')\n : '

Not run yet.

\\`;\n}\n\n/* =====================================================================\n CAM\n ===================================================================== */\nfunction camHTML(){\n const m=money(), band=RISK.band(), comp=Math.round(RISK.composite()), pe=S.policyEval;\n const e=esc;\n const kv = rows => \\`\\${rows.map(r=>\\`\\`).join('')}

\\${e(r[0])}

\\${e(r[1])}

\\`;\n const docRows = DOCORDER.filter(k=>S.docs[k]).map(k=>{\n const d=S.docs[k];\n if(d.blind) return \\`\\${e(DOCSPEC[k].label)}
\\${e(d.file)}\n Blind capture — not machine-read.
Filed \\${e(new Date(d.at).toLocaleString('en-PH'))} ·\n \\${e(d.mime)} · \\${Math.round((d.size||0)/1024)} KB. No field from this document was used in the assessment.\n Requires manual review.\\`;\n if(d.error) return \\`\\${e(DOCSPEC[k].label)}Not read — \\${e(d.error)}\\`;\n return \\`\\${e(DOCSPEC[k].label)}
\\${e(d.file)}\n Read by \\${e(d.engine)}\\${d.confidence!=null?' · confidence '+e(d.confidence):''}\n \\${d.tried&&d.tried.length?\\`
Fell back after — \\${e(d.tried.join('; '))}\\`:''}\n

\\${e(f.label)}: \\${f.value?e(f.value):'not present'}\n \\${f.edited?\\` (corrected by the merchant from “\\${e(f.original||'blank')}”)\\`\n : f.state==='unverified'?' (shown but not source-verified)':''}\n \\${f.quote&&!f.edited?\\`
“\\${e(f.quote)}”\\`:''}

\\`;\n }).join('') || 'No documents on file.';\n\n return \\`CAM — \\${e(bizName()||'Applicant')}\n\n

Credit Assessment Memo

\\${e(bizName()||'Applicant')} · \\${e(S.subtype||'type not classified')} ·\nCase \\${GROUP_ID.slice(0,8).toUpperCase()} · Generated \\${new Date().toLocaleString('en-PH')}

\n\n

1 · Recommendation

\\${e(band.t)} composite \\${comp} · \\${RISK.count()} of \\${RISK.coverage().tot} signals

\\${m.sized?\\`Approve \\${peso(m.approve)} over \\${m.tenure} months against verified monthly inflow of\n\\${peso(m.verified)}. Requested \\${peso(m.ask)}. Instalment \\${peso(m.monthly)}, debt-burden ratio \\${m.dbr}%.\n\\${m.variancePct!=null?\\`Declared turnover sits \\${m.variancePct}% above the verified figure, so the facility is sized to the evidence.\\`:''}\\`\n :'The facility cannot be sized: no independent read of turnover is on file.'}

\\${e(band.d)}

\n\n

2 · Applicant and entity

\n\\${kv([['Applicant',S.name||'—'],['Mobile',S.mobile||'—'],['Business as stated',bizName()||'—'],\n ['Registered name',DOCX.val('registration','business_name')||'—'],\n ['Registration number',DOCX.val('registration','registration_number')||'—'],\n ['Register',S.registry?S.registry.source:'—'],\n ['Verified at source', S.registry ? (S.registry.verified\n ? (S.registry.first ? S.registry.first.status+' · '+S.registry.first.certificate_number+' · '+S.registry.first.owner_name\n : (S.registry.sec_details||'found')) : 'no match returned') : 'not run'],\n ['TIN',DOCX.val('bir','tin')||'—'],\n ['MCC', (()=>{const t=(S.shopai&&(S.shopai.mcc_candidates||[])[0]); return t?t.code+' · '+t.label:'—';})()],\n ['Sub-type confirmed', S.subtype||'—'],\n ['Government ID', S.id?(S.id.docType||S.idType||'uploaded'):'not uploaded']])}\n\n

3 · Documents and how each was read

\n\\${docRows}

Document	Extraction

Extraction order is IDfy, then Gemini, then Claude. Values a reader could not evidence against a\nline of the document are marked. Merchant corrections are recorded against the original value.

\n\n

4 · Turnover triangulation

\n\n\\${m.reads.map(r=>\\`\\`).join('')\n ||''}

Source	Monthly	Annualised
\\${e(r.label)}	\\${r.pending?'pending':peso(r.value)}	\\${r.pending?'—':peso(r.value*12)}
No turnover evidence.

Sizing uses the lowest evidenced read. The merchant's own declaration is never used to size.

\n\n

5 · Risk assessment

\n\\${sections().map(s=>{\n const v=secScore(s);\n const sigs=s.axes.flatMap(a=>Object.values(RISK.detail[a]||{}).map(d=>[d.label,d.note||'verified']));\n const gaps=s.axes.flatMap(a=>RISK.gaps(a).map(g=>g.id.replace(/_/g,' ')+' ('+g.state+')'));\n return \\`

\\${e(s.name)} — score \\${v}

\n \\${sigs.length?kv(sigs):'

No signals on this axis.

'}\n \\${gaps.length?\\`

Open: \\${e(gaps.join(' · '))}

\\`:''}\\`;}).join('')}\n\n

6 · Screening

\n\\${S.aml?kv([['Subject',S.aml.search_term||'—'],['Match status',S.aml.match_status||'—'],\n ['Total hits',String(S.aml.total_hits??'—')],\n ['Types',((S.aml.filters&&S.aml.filters.types)||[]).join(', ')||'pep, adverse-media'],\n ['Country scope',((S.aml.filters&&S.aml.filters.country_codes)||['PH']).join(', ')]])\n :'

Screening did not run or was unreachable. This memo is not complete without it.

'}\n\n

7 · Credit policy

\n\\${S.policy?\\`

\\${e(S.policy.policy_name||S.policy.file)}\\${S.policy.version?' · '+e(S.policy.version):''} ·\n\\${S.policy.rules.length} rules · parsed by \\${e(S.policy.engine)} on \\${e(new Date(S.policy.at).toLocaleString('en-PH'))}

\n\\${pe?\\`

\\${pe.pass} passed · \\${pe.fail} failed · \\${pe.na} not evaluable\\${pe.hardFail?' · a hard rule failed':''}

\n\n\\${pe.rows.map(r=>\\`\n\n\\`).join('')}

Rule	Verdict	Case value	Policy text
\\${e(r.id)} \\${e(r.name)} \\${e(r.severity\|\|'soft')}	\\${r.verdict.toUpperCase()}	\\${e(r.why)}	\\${r.quote?'“'+e(r.quote)+'”':'—'}

\\`\n:'

Rules parsed but not evaluated.

'}\n\\${S.policy.manual&&S.policy.manual.length?\\`

Requires human judgement:\n\\${S.policy.manual.map(x=>e(x.name)+(x.quote?' (“'+e(x.quote)+'”)':'')).join(' · ')}

\\`:''}\\`\n:'

No credit policy was uploaded. Policy checks were not performed.

'}\n\n

8 · Back-end run log

\\${l.ok?'✓':'✗'} \\${e(l.t)}\\${l.detail?' — '+e(l.detail):''}
Not run.

All amounts in Philippine pesos. Every figure in this memo traces to a document on file or to a\nderivation stated above. Nothing is inferred beyond those derivations.

\\`;\n}\n\nfunction downloadCAM(){\n const blob=new Blob([camHTML()],{type:'text/html'});\n const a=document.createElement('a');\n a.href=URL.createObjectURL(blob);\n a.download='CAM_'+String(bizName()||'applicant').replace(/[^a-z0-9]+/gi,'_')+'.html';\n document.body.appendChild(a); a.click(); a.remove();\n setTimeout(()=>URL.revokeObjectURL(a.href),4000);\n toast('CAM file created');\n}\n/* =====================================================================\n ROUTER + HANDLERS\n ===================================================================== */\nfunction render(){\n const sc=SCREENS[S.i];\n const w = document.querySelector('.wrap');\n /* Answering a question re-renders the screen. Resetting the scroll then\n throws the merchant back to the top of a thirteen-question page after\n every tap, so we only reset when the screen itself changes. The caret\n is put back too, or typing in a field that triggers a render loses it. */\n const same = (S._at === sc.id);\n const top = (same && w) ? w.scrollTop : 0;\n const act = document.activeElement;\n const fid = (same && act && act.id) ? act.id : null;\n const caret= (fid && act.selectionStart!=null) ? act.selectionStart : null;\n\n $('#screen').innerHTML = sc.build();\n $('#progBar').style.width = Math.round((sc.progress||0)*100)+'%';\n const c = sc.cta ? sc.cta() : {label:'Continue'};\n const ready = sc.ready ? sc.ready() : true;\n const dis = S.busy || c.disabled || !ready;\n $('#autoBar').innerHTML = AUTO.bar();\n $('#ctaBar').innerHTML =\n (S.i>0?\\`\\`:'') +\n \\`\\`;\n if(w) w.scrollTop = top;\n if(fid){\n const el=document.getElementById(fid);\n if(el){ el.focus(); if(caret!=null){ try{ el.setSelectionRange(caret,caret); }catch(e){} } }\n }\n S._at = sc.id;\n}\nfunction syncCta(){\n const sc=SCREENS[S.i], c=sc.cta?sc.cta():{}, ready=sc.ready?sc.ready():true;\n const b=$('#ctaBtn'); if(!b) return;\n const dis = S.busy || c.disabled || !ready;\n b.disabled=dis; b.textContent = S.busy?(c.busyLabel||'Working…'):(c.label||'Continue');\n b.onclick = dis ? null : new Function(c.onclick||'next()');\n}\nfunction next(){ AUTO.cancel(); if(S.i0){ S.i--; render(); } }\nfunction goTo(id){ AUTO.cancel(); const i=SCREENS.findIndex(s=>s.id===id); if(i>=0){ S.i=i; render(); } }\nasync function withBusy(fn){ S.busy=true; syncCta(); try{ await fn(); } finally { S.busy=false; render(); } }\n\n\n/* =====================================================================\n ADMIN — how this deployment is configured, and how its models behave\n Three things live here, and nothing else should:\n 1. which readers run, and in what order\n 2. which scoring models are connected, internal and external\n 3. what those models are doing to the book over time\n Everything is stored on CONFIG. Nothing here changes a live case\n retrospectively; weights apply to the next scoring run.\n ===================================================================== */\n/* =====================================================================\n PRODUCT CATALOGUE — each product defines its flow, risk weights,\n document requirements, and decision parameters.\n ===================================================================== */\nconst PRODUCTS = {\n merchant:{label:'Merchant Lending',\n flow:['start','ask','documents','identity','shopfront','business','questions','bank','submitted'],\n weights:{identity:.20,financial:.40,operational:.20,legal:.12,reputational:.08},\n docs:['registration','bank'],\n sizing:'turnover', ltvNote:'1-3x monthly turnover, 6-24 months'},\n msme:{label:'MSME Term Loan',\n flow:['start','ask','documents','identity','questions','bank','submitted'],\n weights:{identity:.15,financial:.40,operational:.20,legal:.15,reputational:.10},\n docs:['registration','moa','aoa','board_resolution','bank'],\n sizing:'financials', ltvNote:'DSCR + leverage + banking conduct'},\n auto:{label:'Auto Finance',\n flow:['start','ask','documents','identity','bank','submitted'],\n weights:{identity:.20,financial:.35,operational:.15,legal:.15,reputational:.15},\n docs:['registration','bank'],\n sizing:'income', ltvNote:'80-90% of invoice (new), 65-75% valuation (used)'},\n personal:{label:'Personal Loan',\n flow:['start','ask','identity','bank','submitted'],\n weights:{identity:.30,financial:.40,operational:.05,legal:.05,reputational:.20},\n docs:['bank'],\n sizing:'income', ltvNote:'FOIR-driven, bureau score + employer tier'},\n gold:{label:'Gold Loan',\n flow:['start','ask','identity','submitted'],\n weights:{identity:.10,financial:.10,operational:.60,legal:.10,reputational:.10},\n docs:[],\n sizing:'collateral', ltvNote:'Appraised value x LTV cap (typically 75%)'},\n lap:{label:'Loan Against Property',\n flow:['start','ask','documents','identity','bank','submitted'],\n weights:{identity:.15,financial:.30,operational:.10,legal:.35,reputational:.10},\n docs:['registration','bank'],\n sizing:'dual', ltvNote:'LTV on distress value AND DSCR'},\n};\nlet PRODUCT = 'merchant';\nfunction loadProduct(key, silent){\n const p=PRODUCTS[key]; if(!p || PRODUCT===key) return;\n PRODUCT=key;\n RISK.weight=Object.assign({},p.weights);\n DOCORDER.length=0; p.docs.forEach(d=>DOCORDER.push(d));\n FLOW.length=0; p.flow.forEach(s=>FLOW.push(s));\n SCREENS.length=0; FLOW.forEach(id=>{const s=SCREEN_DEFS.find(x=>x.id===id);if(s)SCREENS.push(s);});\n if(!silent) toast('Configured for '+p.label);\n if(!silent){ S.i=0; render(); } paintAdmin();\n}\n/* Infer product from merchant needs */\nfunction inferProduct(){\n const amt=S.ask||0, purpose=S.purpose||'';\n if(purpose==='equipment') return amt>500000?'msme':'merchant';\n if(purpose==='expand') return amt>1000000?'msme':'merchant';\n if(purpose==='refinance') return amt>1000000?'personal':'merchant';\n return 'merchant';\n}\nfunction maybeInferProduct(){\n if(S.purpose) loadProduct(inferProduct(), true);\n}\nconst VOICE_PD_URL='https://trustai.idfystaging.com/';\nfunction launchVoicePD(){window.open(VOICE_PD_URL,'_blank');}\n\nconst CONFIG = {\n /* readers, in the order they are tried. IDfy is first because it is the\n only one that checks against a register rather than reading a picture. */\n readers:[\n {id:'idfy', label:'IDfy', kind:'Source-verified extraction', on:true, configured:()=>true},\n {id:'mineru', label:'MinerU', kind:'Layout-aware OCR', on:true, configured:()=>!!CFG.mineru.url},\n {id:'grok', label:'Grok', kind:'Vision model', on:true, configured:()=>!!CFG.grok.url},\n {id:'claude', label:'Claude', kind:'Vision model (Anthropic)', on:false, configured:()=>!!CFG.claude?.url},\n {id:'gemini', label:'Gemini Flash', kind:'Vision model (disabled)', on:false, configured:()=>false}\n ],\n /* scoring. Internal is the lender's own model behind a webhook; external\n is a bureau score. Both optional: ProfileIQ stands on its own without\n either, and says so rather than pretending to a number it does not have. */\n models:[\n {id:'onerisk', label:'ProfileIQ composite', kind:'built in', on:true, endpoint:null,\n note:'The five axes on this page. Always on.'},\n {id:'internal', label:'Internal credit model', kind:'lender', on:false, endpoint:'',\n note:'Your own scorecard, called with the feature pack below.'},\n {id:'fico', label:'FICO / external bureau', kind:'external', on:false, endpoint:'',\n note:'A bureau score, pulled and stored alongside ours. Never blended silently.'},\n {id:'cibi', label:'CIBI', kind:'external', on:false, endpoint:'',\n note:'Philippine bureau. Negative records and UBO.'}\n ],\n weights:{identity:.20, financial:.40, operational:.20, legal:.15, reputational:.05},\n /* which BSA features this deployment exposes to a lender's own model */\n exposeFeatures:{},\n band:{approve:75, refer:55}\n};\n/* every BSA feature is exposed unless a bank turns it off */\nObject.keys(BSA.features({months:[],monthsCovered:0,monthsUsable:0,gaps:[],rows:0,\n avgMonthlyIn:null,minMonthlyIn:null,volatility:null,\n payroll:{count:0,regular:false,avg:null,shareOfIn:null},\n mix:{digitalOutShare:null,cashOutShare:null,posCount:0,billsCount:0},\n balance:{avg:null,min:null,negativeRows:0}, reversals:0, fees:0, concentration:null\n})).forEach(k=>{ CONFIG.exposeFeatures[k]=true; });\n\nfunction toggleReader(id){ const r=CONFIG.readers.find(x=>x.id===id); if(r) r.on=!r.on; paintAdmin(); }\nfunction toggleModel(id){ const m=CONFIG.models.find(x=>x.id===id);\n if(m && m.id!=='onerisk'){ m.on=!m.on; paintAdmin(); } }\nfunction setEndpoint(id,v){ const m=CONFIG.models.find(x=>x.id===id); if(m) m.endpoint=v; }\nfunction toggleFeature(k){ CONFIG.exposeFeatures[k]=!CONFIG.exposeFeatures[k]; paintAdmin(); }\nfunction setWeight(ax,v){\n const n=Math.max(0,Math.min(100,Number(v)||0))/100;\n CONFIG.weights[ax]=n; paintAdmin();\n}\n\n/* ---------- model monitoring ----------\n These are computed from the cases this deployment has actually scored,\n held in S.scored. With a handful of cases the numbers are not meaningful\n and the panel says so rather than drawing a confident chart. */\nconst MONITOR = {\n /* Gini from scores and outcomes, via the Mann-Whitney relationship:\n AUC = P(score(bad) < score(good)); Gini = 2*AUC - 1 */\n gini(rows){\n const good=rows.filter(r=>r.outcome===0).map(r=>r.score);\n const bad =rows.filter(r=>r.outcome===1).map(r=>r.score);\n if(!good.length || !bad.length) return null;\n let wins=0;\n for(const g of good) for(const b of bad){ wins += g>b ? 1 : g===b ? .5 : 0; }\n const auc = wins/(good.length*bad.length);\n return Math.round((2*auc-1)*1000)/1000;\n },\n /* Population Stability Index between a reference and a recent window */\n psi(ref, cur, bins=5){\n if(!ref.length || !cur.length) return null;\n const lo=Math.min(...ref,...cur), hi=Math.max(...ref,...cur);\n if(hi===lo) return 0;\n const w=(hi-lo)/bins;\n let psi=0;\n for(let i=0;iv>=a&&vv>=a&&vr.score), rows.slice(half).map(r=>r.score));\n },\n verdict(psi){\n if(psi==null) return {t:'Not enough cases', c:'var(--muted)'};\n if(psi<0.1) return {t:'Stable', c:'var(--ok)'};\n if(psi<0.25) return {t:'Some shift, worth watching', c:'var(--warn)'};\n return {t:'Material shift, investigate', c:'var(--bad)'};\n }\n};\n\n/* every completed scoring run is recorded so drift has something to measure */\nfunction recordScore(){\n S.scored = S.scored || [];\n S.scored.push({at:Date.now(), ref:S.ref||null, score:Math.round(RISK.composite()),\n axes:Object.fromEntries(Object.keys(RISK.axes).map(a=>[a,Math.round(RISK.score(a))])),\n outcome:null});\n}\n\n/* =====================================================================\n BackOffice triangulation panel — Name, Face, Amounts, Addresses.\n Shows every source the case has, side by side. A reviewer scans one\n card to see whether the story the merchant told matches the story\n the documents and APIs told.\n ===================================================================== */\nfunction normName(s){\n return String(s||'').toLowerCase().replace(/\\\\b(sdn|bhd|pvt|ltd|llp|inc|corp|company|co)\\\\b\\\\.?/g,'')\n .replace(/[^a-z0-9 ]/g,' ').replace(/\\\\s+/g,' ').trim();\n}\nfunction nameMatch(a,b){\n const na=normName(a), nb=normName(b);\n if(!na || !nb) return null;\n if(na===nb) return 1;\n const tokensA=new Set(na.split(' ').filter(x=>x.length>1));\n const tokensB=new Set(nb.split(' ').filter(x=>x.length>1));\n if(!tokensA.size || !tokensB.size) return 0;\n let shared=0;\n for(const t of tokensA) if(tokensB.has(t)) shared++;\n return shared / Math.max(tokensA.size, tokensB.size);\n}\nfunction pctFmt(n){ return n==null ? '—' : Math.round(n*100)+'%'; }\nfunction triangulationHTML(){\n const has = k => S.docs[k] && !S.docs[k].error;\n /* pull every name the case has seen */\n const nameRows = [];\n const push = (src, val, hint) => { if(val) nameRows.push({src,val,hint}); };\n push('Application form', S.name, 'What the merchant typed');\n if(S.id && S.id.fields){\n const n=(S.id.fields.find(f=>f.key==='full_name')||{}).value;\n push(S.id.label||'ID document', n, 'Read off the government ID');\n }\n if(has('registration')){\n push('SSM certificate', DOCX.val('registration','company_name'), 'Company name on the SSM cert');\n push('SSM certificate — business name', DOCX.val('registration','business_name'), 'Trading name');\n }\n if(S.registry && S.registry.entity_status){\n const r = S.registry;\n push('SSM registry (API)', r.first?.company_name || r.first?.owner_name || S.name,\n 'Confirmed at the register');\n }\n const bankHolder = has('bank') ? (S.docs.bank.summary?.account_holder || DOCX.val('bank','account_holder')) : null;\n push('Bank statement', bankHolder, 'Account holder on the statement');\n if(has('epf_statement')) push('EPF statement', DOCX.val('epf_statement','employer_name'), 'Employer paying EPF');\n if(has('customs_declaration')) push('Customs declaration', DOCX.val('customs_declaration','exporter_name'), 'Exporter of record');\n if(has('utility_bill')) push('TNB electricity bill', DOCX.val('utility_bill','account_holder'), 'Account holder for the factory power');\n if(has('supplier_invoice')) push('Supplier invoice — billed to', DOCX.val('supplier_invoice','supplier_name'), 'Supplier billing party (the buyer)');\n if(has('purchase_order')) push('Purchase order — from', DOCX.val('purchase_order','buyer_name'), 'End customer');\n\n /* Establish the \"anchor\" name — the SSM cert wins if present, else the ID */\n const anchor = DOCX.val('registration','company_name') || DOCX.val('registration','business_name')\n || (S.id?.fields?.find(f=>f.key==='full_name')?.value)\n || S.name || null;\n\n const nameHTML = anchor\n ? \\`\n \n \\${nameRows.map(r=>{\n const m = nameMatch(anchor, r.val);\n const badge = m==null ? 'n/a'\n : m>=.85 ? 'Match '+pctFmt(m)+''\n : m>=.5 ? 'Partial '+pctFmt(m)+''\n : 'Mismatch '+pctFmt(m)+'';\n return \\`\n \n \n \\`;\n }).join('')}\n

Source	Value	vs anchor
\\${esc(r.src)}	\\${esc(r.val)} \\${esc(r.hint)}	\\${badge}

Anchor: \\${esc(anchor)} (SSM certificate takes precedence; ID falls back)

\\`\n : '

No anchor name yet. Upload the SSM certificate or the ID to start triangulating.

';\n\n /* AMOUNTS — every monthly revenue read we hold */\n const m = money();\n const amountRows = (m.reads||[]).map(r=>({src:r.label, val:r.pending?null:r.value, hint:r.detail||r.src}));\n const declared = amountRows.find(r=>/declared/i.test(r.src))?.val;\n const bank = amountRows.find(r=>/bank/i.test(r.src))?.val;\n const opsEst = amountRows.find(r=>/operational|operations/i.test(r.src))?.val;\n const rangeOK = (a,b) => {\n if(a==null || b==null) return null;\n const base = Math.max(Math.abs(a), Math.abs(b), 1);\n return Math.abs(a-b)/base;\n };\n const dev = (a,b) => { const g = rangeOK(a,b); return g==null ? null : Math.round(g*100); };\n const devBadge = d => d==null ? 'n/a'\n : d<=15 ? ''+d+'% (within tolerance)'\n : d<=30 ? ''+d+'% (elevated)'\n : ''+d+'% (outlier)';\n\n const amountHTML = amountRows.length ? \\`\n \n \n \\${amountRows.map(r=>\\`\n \n \\`).join('')}\n

Source	Monthly (RM)	Annualised (RM)
\\${esc(r.src)} \\${esc(r.hint\|\|'')}	\\${r.val==null?'—':peso(r.val)}	\\${r.val==null?'—':peso(r.val*12)}

Declared vs Bank

\\${devBadge(dev(declared,bank))}

Declared vs Calculated

\\${devBadge(dev(declared,opsEst))}

Bank vs Calculated

\\${devBadge(dev(bank,opsEst))}

\n`;",[],[139,180],"49646d9e-88b0-4600-9fdc-1c790bbf5270","profileiq_payload_c.ts","9ed47b9e-ac87-11f1-9b50-1607ee4eb77e",43,["D",1788983501297],"/**\n * ProfileIQ MY — APP_HTML_C (plain text, part 3/5).\n */\nexport const APP_HTML_C =\n ` {category:'General merchandise',method:'stock-turn',cogs:.70,haircut:.10,staffRevenue:7000},\n {category:'Accommodation',method:'room-occupancy',cogs:.20,haircut:.15,staffRevenue:7000},\n {category:'Logistics and storage',method:'fleet',cogs:.45,haircut:.10,staffRevenue:6500},\n {category:'Manufacturing / Export',method:'staff-productivity',cogs:.68,haircut:.12,staffRevenue:9500}\n];\nfunction updateTemplate(i,k,v){INCOME_TEMPLATES[i][k]=v;paintAdmin();}\nfunction exportIncomeTemplate(){\n const csv='Category,Method,COGS%,Haircut%,StaffRevenue\\\\n'+\n INCOME_TEMPLATES.map(t=>[t.category,t.method,Math.round(t.cogs*100),Math.round(t.haircut*100),t.staffRevenue].join(',')).join('\\\\n');\n const a=document.createElement('a'); a.href='data:text/csv,'+encodeURIComponent(csv);\n a.download='income_templates.csv'; a.click();\n}\nfunction uploadIncomeTemplate(file){\n if(!file) return;\n const r=new FileReader(); r.onload=()=>{\n const lines=r.result.split('\\\\n').slice(1).filter(l=>l.trim());\n lines.forEach(l=>{\n const [cat,method,cogs,haircut,staff]=l.split(',');\n const t=INCOME_TEMPLATES.find(x=>x.category.toLowerCase()===cat.trim().toLowerCase());\n if(t){\n if(cogs) t.cogs=Number(cogs)/100;\n if(haircut) t.haircut=Number(haircut)/100;\n if(staff) t.staffRevenue=Number(staff);\n if(method) t.method=method.trim();\n }\n });\n toast('Loaded '+lines.length+' templates');\n paintAdmin();\n };\n r.readAsText(file);\n}\nfunction pv(k,m){const v=S.answers[k]; return v&&m[v]!=null?m[v]:null;}\nconst _ST={'Just me':1,'2 to 4':3,'5 to 10':7,'More than 10':14};\nfunction assessedRevenue(){\n const cat=currentCategory(); if(!cat) return null;\n const n=cat.name, sN=pv('staff',_ST), d=28;\n let R=null,C=0,H=0,M='';\n if(n==='Food service'){const s=pv('seats',{'No seating, takeaway':0,'Under 10':7,'10 to 30':20,'More than 30':40});\n if(s!=null){const dl=pv('delivery',{'No':0,'Just started':2500,'Regularly':6500,'It is most of our sales':16000})||0;R=s*2*18*d+dl;C=.38;H=.10;M='covers';}}\n else if(n==='Bakery'){const b=pv('bake',{'One':1,'Two':2,'Three or more':3,'Continuous':4});if(b!=null){R=b*650*d;C=.40;H=.10;M='bakes/day';}}\n else if(n==='Grocery and convenience'){const s=pv('stockvalue',{'Under 4,000':3e3,'4,000 to 12,000':8e3,'12,000 to 33,000':22e3,'More than 33,000':42e3});if(s!=null){R=s*2.5;C=.78;H=.10;M='stock-turn';}}\n else if(n==='Pharmacy'){if(sN){R=sN*1e4;C=.72;H=.05;M='staff-productivity';}}\n else if(n==='Automotive'){const b=pv('bays',{'One':1,'Two or three':2.5,'Four or five':4.5,'More than five':7}),j=pv('jobs',{'Under 10':8,'10 to 25':17,'25 to 50':37,'More than 50':60});if(b||j){R=(j||(b?b*5:10))*4.3*290;C=.55;H=.10;M='bay-capacity';}}\n else if(n==='Personal care'){const c=pv('chairs',{'1 or 2':1.5,'3 to 5':4,'6 to 10':8,'More than 10':14});if(c!=null){R=c*3.5*30*d;C=.15;H=.08;M='chair-utilization';}}\n else if(n==='Accommodation'){const rm=pv('rooms',{'Under 5':3,'5 to 15':10,'15 to 40':27,'More than 40':50}),oc=pv('occupancy',{'Under a quarter':.22,'About half':.5,'Around three quarters':.72,'Nearly full':.88});if(rm!=null&&oc!=null){R=rm*oc*100*30;C=.20;H=.15;M='room-occupancy';}}\n else if(n==='Logistics and storage'){const f=pv('fleet',{'One':1,'2 to 4':3,'5 to 10':7,'More than 10':14});if(f!=null){R=f*6500;C=.45;H=.10;M='fleet';}}\n else if(n==='Manufacturing / Export'){\n const heads = pv('headcount',{'Under 10':7,'10 to 30':20,'30 to 100':60,'More than 100':140}) || sN;\n const backlog = pv('po_backlog',{'Under RM 100k':60000,'RM 100k to 500k':280000,\n 'RM 500k to 2m':1100000,'More than RM 2m':2500000}) || 0;\n if(heads || backlog){\n /* per-head revenue plus a fraction of the current PO backlog turned into monthly */\n R = (heads*9500) + (backlog/6); C=.68; H=.12; M='staff-productivity';\n }\n }\n else{const sv={'Under 25,000':16e3,'25,000 to 60,000':42e3,'60,000 to 125,000':90e3,'More than 125,000':165e3,\n 'Under 16,000':1e4,'16,000 to 42,000':28e3,'42,000 to 80,000':60e3,'More than 80,000':105e3,\n 'Under 8,000':5e3,'8,000 to 25,000':16e3,'More than 60,000':70e3};\n const s=pv('stockvalue',sv);if(s!=null){const t=n==='Electronics and appliances'?1.2:n==='Apparel and footwear'?1:n==='General merchandise'?2:1.5;\n C=n==='Electronics and appliances'?.75:n==='Apparel and footwear'?.55:n==='General merchandise'?.70:.70;H=n==='Apparel and footwear'?.15:.10;R=s*t;M='stock-turn';}}\n if(!R&&sN){const tpl=INCOME_TEMPLATES.find(t=>t.category===n);R=sN*(tpl?tpl.staffRevenue:7e3);C=.50;H=.12;M='staff-fallback';}\n if(!R) return null;\n const tpl=INCOME_TEMPLATES.find(t=>t.category===n);\n if(tpl){C=tpl.cogs;H=tpl.haircut;}\n return {rev:Math.round(R),cogs:C,haircut:H,assessed:Math.round(R*(1-H)),method:M,category:n};\n}\nfunction currentCategory(){\n const top=(S.shopai&&(S.shopai.mcc_candidates||[])[0])||null;\n return top?mccFor(top.code):null;\n}\n\nfunction money(){\n const declared = num(S.sources.declared);\n const bs = S.docs.bank && S.docs.bank.summary;\n const bankAvg = num(DOCX.val('bank','average_monthly_credits'))\n ?? (bs && num(bs.average_monthly_credits))\n ?? (bs && bs.total_credits!=null && bs.months_covered\n ? num(bs.total_credits)/num(bs.months_covered) : null);\n const taxAnnual= num(DOCX.val('tax','gross_sales'));\n const taxMonthly = taxAnnual!=null ? taxAnnual/12 : null;\n\n const opsEst = assessedRevenue();\n const opsMonthly = opsEst ? opsEst.assessed : null;\n\n const reads = [\n {label:'Declared by the merchant', value:declared, src:'application'},\n {label:'Bank statement credits', value:bankAvg, src:'bank statement'},\n {label:'Calculated from operations', value:opsMonthly, src:'operational estimate',\n detail:opsEst?opsEst.method+' · '+opsEst.category:''}\n ].filter(r=>r.value!=null);\n\n /* show bank as pending if not yet available */\n const bankPending = !bankAvg && (S.docBusy==='bank' || (S.docs.bank && !S.docs.bank.error));\n if(bankPending && !reads.find(r=>r.src==='bank statement'))\n reads.push({label:'Bank statement credits', value:null, src:'bank statement', pending:true});\n\n const evidenced = reads.filter(r=>r.src!=='application').map(r=>r.value);\n const verified = evidenced.length ? Math.min(...evidenced) : null;\n const variancePct = (declared!=null && verified!=null && declared>0)\n ? Math.round(((declared-verified)/declared)*1000)/10 : null;\n\n /* capacity: 15% of verified monthly inflow can service debt */\n const service = verified!=null ? verified*0.15 : null;\n const tenure = S.tenure || 12;\n const capacity = service!=null ? Math.floor(service*tenure/1000)*1000 : null;\n const approve = capacity!=null ? Math.min(S.ask, capacity) : null;\n const monthly = approve!=null ? Math.round(approve/tenure) : null;\n const dbr = (monthly!=null && verified) ? Math.round((monthly/verified)*1000)/10 : null;\n\n return {declared, verified, reads, variancePct, capacity, approve, monthly, dbr,\n tenure, ask:S.ask, sized: approve!=null};\n}\n\n/* =====================================================================\n RISK — five axes. A signal only exists when evidence produced it.\n ===================================================================== */\nconst RISK = {\n weight:{identity:.20, financial:.40, operational:.20, legal:.12, reputational:.08},\n axes:{\n identity:{label:'Identity & UBO', color:'#1C43B9', agent:'Identity Risk Agent',\n roster:{id_document:3, id_source_match:3, name_consistency:2, owner_on_certificate:2,\n account_holder_match:2, card_authentic:2, card_live:1, face_on_card:1, dob_read:1}},\n financial:{label:'Financial & Credit', color:'#12803F', agent:'Credit Risk Agent',\n /* the second block is what the statement itself tells us, as opposed\n to what it was asked to confirm. These are the alternate signals:\n depth, completeness, stability, regularity, discipline, cushion,\n returned items and concentration. */\n roster:{bank_statement:3, turnover_reconciled:3, tax_filed:2, variance_within_threshold:3,\n debt_burden:2, closing_balance:1,\n statement_depth:2, statement_complete:2, inflow_stability:2, income_regularity:2,\n obligation_discipline:1, balance_cushion:2, returned_items:1, inflow_concentration:1,\n /* what the merchant said the statement says, against what it says */\n declaration_matches:3, declared_inflow_honest:3, existing_obligations:2, paid_up_capital:1,\n export_concentration:3, export_market_risk:3, customer_concentration:3, payment_terms_risk:2, input_cost_structure:1}},\n operational:{label:'Operational', color:'#B96A05', agent:'Operational Risk Agent',\n roster:{premises_fixed:2, signage:2, inventory:2, counter:1, mcc_identified:3,\n subtype_confirmed:1, digital_footprint:1,\n business_vintage:3, premises_tenure:2, supplier_credit:2, digital_payments:2, staff_scale:1,\n export_volume:2, factory_activity:3, workforce_verification:3, supplier_terms:2}},\n legal:{label:'Legal', color:'#0B6BA8', agent:'Legal Risk Agent',\n roster:{registration_read:3, registry_verified:3, tin_present:2, permit_on_file:2, policy_hard_rules:2,\n moa_on_file:2, shareholding_disclosed:2, aoa_on_file:1, board_resolution_on_file:2}},\n reputational:{label:'Reputational', color:'#7C3AED', agent:'Screening Agent',\n roster:{aml:3, pep:2, adverse_media:2}}\n },\n signals:{}, detail:{}, log:[],\n\n emit(axis,id,v,label,note){\n const ax=this.axes[axis]; if(!ax || !(id in ax.roster)) return;\n v=Math.max(0,Math.min(1,v));\n this.signals[axis]=this.signals[axis]||{};\n const prev=this.signals[axis][id];\n if(prev===v) return;\n this.signals[axis][id]=v;\n this.detail[axis]=this.detail[axis]||{};\n this.detail[axis][id]={label:label||id, note:note||'', v, at:Date.now()};\n this.log.unshift({axis,id,label:label||id,note:note||'',v,at:Date.now()});\n if(this.log.length>60) this.log.pop();\n paintScore();\n },\n score(axis){\n const ax=this.axes[axis], got=this.signals[axis]||{};\n let tot=0, earned=0;\n for(const k in ax.roster){ tot+=ax.roster[k]; earned += ax.roster[k]*(got[k]||0); }\n return tot ? (earned/tot)*100 : 0;\n },\n composite(){ let s=0; for(const a in this.axes) s += this.score(a)*this.weight[a]; return s; },\n coverage(){ let got=0,tot=0; for(const a in this.axes){\n const r=this.axes[a].roster, g=this.signals[a]||{};\n for(const k in r){ tot++; if(k in g) got++; } } return {got,tot}; },\n count(){ return this.coverage().got; },\n gaps(axis){\n const ax=this.axes[axis], got=this.signals[axis]||{}, out=[];\n for(const k in ax.roster){\n if(!(k in got)) out.push({id:k,w:ax.roster[k],state:'no evidence'});\n else if(got[k]<0.7) out.push({id:k,w:ax.roster[k],state:'weak',v:got[k]});\n }\n return out.sort((a,b)=>b.w-a.w);\n },\n band(){\n const c=this.composite(), cov=this.coverage();\n if(cov.got < 6) return {t:'Not yet assessable', c:'#6B7280', k:'n',\n d:'Too little evidence on file to put a number on this case.'};\n const pe = S.policyEval;\n if(pe && pe.hardFail) return {t:'Declined by policy', c:'#C0392B', k:'r',\n d:'A hard rule in the uploaded credit policy has failed.'};\n if(c>=80) return {t:'Approve', c:'#12803F', k:'g', d:'Evidence supports the facility as sized.'};\n if(c>=60) return {t:'Approve with conditions', c:'#B96A05', k:'a',\n d:'Supportable once the open items below are cleared.'};\n if(c>=40) return {t:'Refer to underwriter', c:'#B96A05', k:'a',\n d:'Material gaps remain; a human should look at this.'};\n return {t:'Decline', c:'#C0392B', k:'r', d:'The evidence does not support the facility requested.'};\n },\n reset(){ this.signals={}; this.detail={}; this.log=[]; }\n};\n\n/* ---------- evidence → signals ---------- */\nfunction signalsFromDoc(key){\n const d=S.docs[key]; if(!d) return;\n const ok = f => { const x=(d.fields||[]).find(y=>y.key===f); return x && x.value && x.state!=='missing'; };\n const src = DOCSPEC[key].label + (d.engine?' · '+d.engine:'');\n if(key==='registration'){\n if(ok('company_name')) RISK.emit('legal','registration_read',1,'Certificate read: '+DOCX.val('registration','company_name'),src);\n if(ok('owner_or_company')) RISK.emit('identity','owner_on_certificate',1,'Owner on certificate: '+DOCX.val('registration','owner_or_company'),src);\n const ssmId = DOCX.val('registration','old_id_number') || DOCX.val('registration','new_id_number');\n if(ssmId) RISK.emit('legal','registration_read',1,'SSM number: '+ssmId,src);\n }\n if(key==='bir'){\n if(ok('tin')) RISK.emit('legal','tin_present',1,'TIN: '+DOCX.val('bir','tin'),src);\n if(ok('taxpayer_name')) RISK.emit('identity','name_consistency',\n sameName(DOCX.val('bir','taxpayer_name'), S.name)?1:.5,'Taxpayer: '+DOCX.val('bir','taxpayer_name'),src);\n }\n if(key==='permit') RISK.emit('legal','permit_on_file',.5,'Permit filed, not read','blind capture · manual review');\n if(key==='bank'){\n if(ok('average_monthly_credits')) RISK.emit('financial','bank_statement',1,\n 'Average monthly credits '+peso(num(DOCX.val('bank','average_monthly_credits'))),src);\n if(ok('closing_balance')) RISK.emit('financial','closing_balance',1,'Closing balance '+DOCX.val('bank','closing_balance'),src);\n if(ok('account_holder')) RISK.emit('identity','account_holder_match',\n sameName(DOCX.val('bank','account_holder'), S.name)?1:.4,\n 'Account holder: '+DOCX.val('bank','account_holder'),src);\n }\n if(key==='tax'){\n if(ok('gross_sales')) RISK.emit('financial','tax_filed',1,'Gross sales '+DOCX.val('tax','gross_sales'),src);\n }\n if(key==='moa'){\n if(ok('company_name')) RISK.emit('legal','moa_on_file',1,'MoA for '+DOCX.val('moa','company_name'),src);\n if(ok('shareholders')) RISK.emit('legal','shareholding_disclosed',1,'Shareholding: '+DOCX.val('moa','shareholders'),src);\n if(ok('paid_up_capital')) RISK.emit('financial','paid_up_capital',1,'Paid-up: '+DOCX.val('moa','paid_up_capital'),src);\n }\n if(key==='aoa'){\n if(ok('company_name')) RISK.emit('legal','aoa_on_file',1,'AoA for '+DOCX.val('aoa','company_name'),src);\n }\n if(key==='board_resolution'){\n if(ok('authorised_signatory')) RISK.emit('legal','board_resolution_on_file',1,'Authorised: '+DOCX.val('board_resolution','authorised_signatory'),src);\n }\n recomputeMoneySignals();\n}\nfunction sameName(a,b){\n if(!a||!b) return false;\n const n=s=>String(s).toLowerCase().replace(/[^a-z ]/g,'').split(/\\\\s+/).filter(x=>x.length>2);\n const A=n(a), B=n(b);\n return B.some(x=>A.includes(x));\n}\nfunction recomputeMoneySignals(){\n const m=money();\n if(m.verified!=null) RISK.emit('financial','turnover_reconciled',1,\n 'Turnover reconciled to '+peso(m.verified)+' a month','lowest evidenced read of '+m.reads.length);\n if(m.variancePct!=null) RISK.emit('financial','variance_within_threshold',\n Math.abs(m.variancePct)<=10?1:Math.abs(m.variancePct)<=25?.5:.2,\n 'Declared sits '+m.variancePct+'% above verified','declared vs evidenced');\n if(m.dbr!=null) RISK.emit('financial','debt_burden', m.dbr<=15?1:m.dbr<=25?.6:.25,\n 'Debt-burden ratio '+m.dbr+'%','instalment vs verified inflow');\n}\nfunction signalsFromShop(){\n const s=S.shopai; if(!s) return;\n const src='ShopAI · '+s.engine;\n RISK.emit('operational','premises_fixed', s.premises==='fixed'?1:s.premises==='movable'?.3:.5,\n 'Premises appear '+(s.premises||'unclear'),src);\n RISK.emit('operational','signage', s.signage_type==='permanent'?1:s.signage_visible?.5:.2,\n 'Signage: '+(s.signage_type||'none'),src);\n RISK.emit('operational','inventory', s.inventory_visible?(s.inventory_density==='dense'?1:.7):.2,\n 'Inventory '+(s.inventory_visible?(s.inventory_density||'visible'):'not visible'),src);\n RISK.emit('operational','counter', s.counter_or_pos_visible?1:.3,\n s.counter_or_pos_visible?'Counter or POS visible':'No counter visible',src);\n const top=(s.mcc_candidates||[])[0];\n if(top) RISK.emit('operational','mcc_identified', Math.max(.3,Number(top.confidence)||.6),\n 'MCC '+top.code+' · '+top.label, src+' · confidence '+Math.round((Number(top.confidence)||0)*100)+'%');\n}\nfunction signalsFromQuestions(){\n const a=S.answers, src='merchant questionnaire';\n if(a.years) RISK.emit('operational','business_vintage',\n a.years==='More than 7 years'?1:a.years==='3 to 7 years'?.8:a.years==='1 to 3 years'?.5:.2,\n 'Trading '+a.years.toLowerCase(),src);\n if(a.premises||a.lease) RISK.emit('operational','premises_tenure',\n a.premises==='I own it'||a.premises==='Family property'?1:\n a.lease==='More than 3 years'?.8:a.lease==='1 to 3 years'?.6:a.lease==='Under a year'?.3:.5,\n (a.premises||'Unknown')+', lease '+(a.lease||'not stated'),src);\n if(a.suppliers) RISK.emit('operational','supplier_credit',\n a.suppliers==='60 days or more'?1:a.suppliers==='30 days'?.8:a.suppliers==='7 days'?.5:.2,\n 'Supplier terms: '+a.suppliers.toLowerCase(),src);\n if(a.digital) RISK.emit('operational','digital_payments',\n a.digital==='Most of it'?1:a.digital==='About half'?.7:a.digital==='About a quarter'?.4:.15,\n 'Digital payments: '+a.digital.toLowerCase(),src);\n if(a.staff) RISK.emit('operational','staff_scale',\n a.staff==='More than 10'?1:a.staff==='5 to 10'?.8:a.staff==='2 to 4'?.5:.3,\n a.staff+' people',src);\n if(a.otherloan) RISK.emit('financial','existing_obligations',\n a.otherloan==='No'?1:a.otherloan==='One'?.6:a.otherloan==='Two'?.3:.1,\n 'Existing loans: '+a.otherloan.toLowerCase(),src);\n}\n\nfunction signalsFromManufacturing(){\n if(!isManufacturingExporter()) return;\n const src='manufacturing assessment';\n /* Export concentration risk */\n const ep=S.answers.export_pct;\n if(ep) RISK.emit('financial','export_concentration',\n ep==='None'?1:ep==='Under 25%'?.8:ep==='25% to 50%'?.5:.25,\n 'Export share: '+ep+(ep==='More than 50%'?' — HIGH single-market dependency':''),src);\n /* Mock signals from documents if they exist */\n if(S.docs.customs_declaration&&!S.docs.customs_declaration.error){\n const cd=MOCK_MANUFACTURING.customs_declaration;\n RISK.emit('financial','export_market_risk',.3,\n 'Primary destination: '+cd.export_destination+' — tariff-exposed market',src);\n RISK.emit('operational','export_volume',1,\n 'H1 2026 exports: RM'+cd.export_value,src);\n }\n if(S.docs.purchase_order&&!S.docs.purchase_order.error){\n const po=MOCK_MANUFACTURING.purchase_order;\n RISK.emit('financial','customer_concentration',.4,\n 'Single PO from '+po.buyer_name+': RM'+po.po_value+' — customer dependency risk',src);\n RISK.emit('financial','payment_terms_risk', po.payment_terms==='Net 60'?.5:po.payment_terms==='Net 90'?.3:.7,\n 'Payment terms: '+po.payment_terms+' — '+(Number(po.payment_terms?.match(/\\\\d+/)?.[0])>45?'extended terms pressure cash flow':'acceptable'),src);\n }\n if(S.docs.utility_bill&&!S.docs.utility_bill.error){\n const ub=MOCK_MANUFACTURING.utility_bill;\n RISK.emit('operational','factory_activity',1,\n 'Factory consumption: '+ub.consumption_kwh+' kWh — production active',src);\n }\n if(S.docs.epf_statement&&!S.docs.epf_statement.error){\n const ep=MOCK_MANUFACTURING.epf_statement;\n RISK.emit('operational','workforce_verification',1,\n ep.total_employees+' employees contributing EPF (RM'+ep.monthly_contribution+'/mo)',src);\n RISK.emit('identity','headcount_declared_vs_actual',\n S.answers.staff==='More than 10'?1:S.answers.staff==='5 to 10'?.6:.3,\n 'Declared: '+(S.answers.staff||'unknown')+', EPF shows: '+ep.total_employees,src);\n }\n if(S.docs.supplier_invoice&&!S.docs.supplier_invoice.error){\n const si=MOCK_MANUFACTURING.supplier_invoice;\n RISK.emit('financial','input_cost_structure',1,\n 'Top supplier: '+si.supplier_name+' — RM'+si.invoice_value+' ('+si.material_description+')',src);\n RISK.emit('operational','supplier_terms',.7,\n 'Supplier payment terms: '+si.payment_terms,src);\n }\n}\n\n/* =====================================================================\n BACK-END — screening and source verification. The merchant never sees\n any of this; it runs while the processing screen is up.\n ===================================================================== */\nconst BACKEND = {\n note(t,ok,detail){ S.backend.push({t,ok,detail:detail||'',at:Date.now()}); },\n\n async run(onStep){\n S.backend=[]; S.backendDone=false;\n const step = (i,st)=>{ onStep && onStep(i,st); };\n\n /* 1 · registry verification, against the name on the uploaded certificate */\n step(0,'run');\n const regName = DOCX.val('registration','business_name');\n const regNo = DOCX.val('registration','registration_number');\n const registry = (S.docs.registration && S.docs.registration.registry) ||\n (/sec/i.test(DOCX.val('registration','scope_or_type')||'') ? 'SEC' : 'SSM');\n if(!regName){\n this.note('Registry not corroborated — no certificate was read',false);\n step(0,'no');\n } else {\n try{\n if(registry==='SEC'){\n const o = await idfySource('mys_ssm', regNo?{sec_number:regNo}:{sec_name:regName});\n S.registry = Object.assign({source:'SEC', verified:o.status==='id_found'}, o);\n if(o.status==='id_found'){\n RISK.emit('legal','registry_verified',1,'SEC: '+(o.sec_details||'found'),'mys_ssm');\n this.note('SSM registration verified at source',true,o.sec_details||'');\n } else { this.note('SEC returned no match for '+regName,false); }\n } else {\n const o = await idfySource('phl_business_name_search',{business_name:String(regName).toUpperCase()});\n const d = (o.business_details||[])[0];\n S.registry = Object.assign({source:'SSM', verified:!!d, first:d}, o);\n if(d){\n RISK.emit('legal','registry_verified', d.status==='REGISTERED'?1:.4,\n 'DTI: '+d.status+' · '+d.certificate_number,'phl_business_name_search');\n RISK.emit('identity','name_consistency', sameName(d.owner_name,S.name)?1:.5,\n 'DTI owner: '+d.owner_name,'phl_business_name_search');\n this.note('DTI business name verified at source',true,\n d.certificate_number+' · '+d.owner_name+' · '+d.status);\n } else { this.note('DTI returned no match for '+regName,false); }\n }\n step(0,'ok');\n }catch(e){ this.note('Registry lookup unavailable: '+e.message,false); step(0,'no'); }\n }\n\n /* 2 · AML, PEP and adverse media */\n step(1,'run');\n const subject = DOCX.val('registration','owner_or_company') || S.name;\n try{\n const o = await idfySource('aml',{search_term:subject, exact_match:false, fuzziness:'high',\n filters:{types:['pep','adverse-media'], remove_deceased:true,\n country_codes:['PH'], entity_type:'person'}});\n S.aml = o;\n const clean = (o.match_status==='no_match') || !Number(o.total_hits);\n RISK.emit('reputational','aml', clean?1:.2, clean?'No AML match':'AML hits to review','IDfy AML');\n RISK.emit('reputational','pep', clean?1:.2, clean?'No PEP match':'PEP hit','IDfy AML');\n RISK.emit('reputational','adverse_media', clean?1:.3, clean?'No adverse media':'Adverse media found','IDfy AML');\n this.note('AML, PEP and adverse media screened',true, subject+' · '+(o.total_hits||0)+' hits');\n step(1,'ok');\n }catch(e){ this.note('Screening unavailable: '+e.message,false); step(1,'no'); }\n\n /* 3 · policy evaluation */\n step(2,'run');\n if(S.policy){\n S.policyEval = POLICY.evaluate();\n const hard = S.policyEval.rows.filter(r=>r.severity==='hard');\n const hardPass = hard.filter(r=>r.verdict==='pass').length;\n RISK.emit('legal','policy_hard_rules', hard.length ? hardPass/hard.length : .5,\n hardPass+' of '+hard.length+' hard policy rules passed', S.policy.policy_name||S.policy.file);\n this.note('Evaluated against '+(S.policy.policy_name||S.policy.file),true,\n S.policyEval.pass+' pass · '+S.policyEval.fail+' fail · '+S.policyEval.na+' not evaluable');\n step(2,'ok');\n } else { this.note('No credit policy uploaded — policy checks skipped',false); step(2,'no'); }\n\n /* 4 · reconciliation */\n step(3,'run');\n recomputeMoneySignals();\n const m=money();\n this.note('Turnover reconciled across '+m.reads.length+' independent read'+(m.reads.length===1?'':'s'),\n m.verified!=null, m.verified!=null ? peso(m.verified)+' a month' : 'no evidenced read available');\n step(3, m.verified!=null?'ok':'no');\n\n S.backendDone=true;\n return S.backend;\n }\n};\n/* =====================================================================\n MERCHANT JOURNEY\n Uploads only — no camera capture anywhere. Every extracted field is\n editable. No risk language, no scores, no screening results.\n ===================================================================== */\nconst SCREEN_DEFS = [\n\n/* 0 ─ start */\n{id:'start', progress:0, build:()=>\\`\n

Business loan

A loan sized to the
sales you can show.

Upload what you already have. We read it, show you every field we picked up, and give you an amount.

\n \\${[['doc','Your documents','Registration, LHDN 2303, permit, bank statement.'],\n ['id','Your ID','Checked against the register that issued it.'],\n ['store','Photos of your shop','So we know what kind of business you run.'],\n ['chart','Your amount','From the sales your documents support.']]\n .map(x=>\\`

\\${ic(x[0],13)}

\\${x[1]}\\${x[2]}

\\`).join('')}\n

\\${ic('check',16)}\n

Nothing is filled in for youEvery field we read is shown to you, and you can correct it.

\\`,\n cta:()=>({label:'Start'})},\n\n/* 1 ─ applicant */\n{id:'ask', progress:.10, build:()=>{\n const r=S.intent, open=S.showChat;\n return \\`

Your loan

What do you
need?

Three things and your contact details. Nothing is fixed until the end.

\n\n

How much do you need?\n

\n\n

Over how long?\n

\n\n

What is it for?\n \n \\${S.purpose&&PURPOSE[S.purpose].hint?\\`

\\${esc(PURPOSE[S.purpose].hint)}

\\`:''}

\n\n\n \n\n \\${open?\\`

In your own words\n \n

Taglish is fine. We fill in the three boxes above from what you write, and you can correct them.

\n \n \\${r?\\`

\\${\n r.missing&&r.missing.length\n ? 'We could not find the '+esc(r.missing.join(' or the '))+' in what you wrote. Fill it in above.'\n : 'Got it. Change anything that is not right.'}

\\`:''}\n

\\`:''}\n\n \\${S.purpose&&S.ask?\\`

\\${ic('check',16)}\n

We would structure this as: \\${esc(PRODUCTS[inferProduct()]?.label||'Merchant Lending')}\n \\${PRODUCTS[inferProduct()]?.ltvNote?esc(PRODUCTS[inferProduct()].ltvNote):''}

\\`:''}\n\n

Your details

Your name\n \n

As printed on your government ID.

Mobile number\n

\\`;},\n ready:()=>S.name.trim().length>2 && S.ask>0 && !!S.purpose,\n cta:()=>({label:'Continue'})},\n\n/* 2 ─ documents */\n{id:'documents', progress:.22, build:()=>{\n const row = k=>{\n const sp0=DOCSPEC[k], d=S.docs[k], busy=S.docBusy===k, open=S.docOpen===k;\n const L = S.legalForm ? LEGAL[S.legalForm] : null;\n const sp = (k==='registration' && L)\n ? Object.assign({}, sp0, {label:L.cert, hint:'Issued by the '+L.registry, idfy:L.docType})\n : sp0;\n const cls = d ? (d.error?'err':'done') : '';\n const tag = busy?'…' : d ? (d.error?'Retry' : d.blind?'Filed':'Read') : (sp.optional?'Optional':'Upload');\n return \\`

\n \n \n \\${busy?'':d&&!d.error?ic('check',18):ic(sp.icon,18)}\n \\${esc(sp.label)}\n \\${busy?'Reading…':d?(d.error?esc(d.error):esc(d.file)):esc(sp.hint)}\n \\${tag}\n \n \\${d&&!d.error&&!d.blind?\\`

\n \\${d.fields.map((f,i)=>\\`

\\${esc(f.label)}\n

\n \n

\\`).join('')}\n

\\${ic('check',16)}\n

What we readAnything wrong? Type over it. Your correction is what we use.

\\`:''}\n \\${d&&d.blind?\\`

\n \\${ic('doc',16)}

\\${esc(d.file)}\\${esc(DOCSPEC[k].note)}

\\`:''}\n \\${d&&d.error?\\`

\n \\${ic('alert',16)}

We could not read this one\n Try a sharper photo, or the original PDF. You can also type the details in yourself on the next screen.\n

\\`:''}\n

\\`;};\n const need = DOCS_IDENTITY().filter(k=>!DOCSPEC[k].optional);\n const got = need.filter(k=>S.docs[k]&&!S.docs[k].error).length;\n const lf = S.legalForm ? LEGAL[S.legalForm] : null;\n return \\`

Your documents

Upload what you
already have.

Photograph the page or attach the PDF. We read each one and show you every field we picked up.

\n\n

How is the business registered?\n

\n \\${LEGALORDER.map(k=>{const L=LEGAL[k];return \\`\n \\`;}).join('')}\n

This tells us which register to check. The certificate you upload is what decides the name we record.

\n\n \\${lf?\\`

\\${DOCS_IDENTITY().map(row).join('')}

\\`\n :\\`

\\${ic('doc',16)}\n

Choose one to continueThe first document we ask for depends on your answer.

\\`}\n

\n \\${ic(got===need.length?'check':'doc',16)}\n

\\${got} of \\${need.length} required documents\\${\n got===need.length?'That is everything we need here. Your bank statement comes later, once you have told us what the loan is for.'\n :'The Mayor’s permit is optional. Attach it if you have it to hand.'}

\\`;},\n ready:()=>!!S.legalForm && DOCS_IDENTITY().filter(k=>!DOCSPEC[k].optional).every(k=>S.docs[k]&&!S.docs[k].error),\n cta:()=>({label:S.legalForm?'Continue':'Choose how the business is registered'})},\n\n/* 3 ─ identity document */\n{id:'identity', progress:.34, build:()=>{\n /* MyKAD is front only. Only the passport needs a back page (bio-data). */\n const two = S.idType==='mys_passport';\n const side=(k,label,hint)=>{\n const img=S.idShots[k], busy=S.idBusy===k;\n /* Once a side is on file we stop offering a retake: the user cannot\n accidentally clobber a good extraction, and there is no camera to\n nudge them back to. If they really need to redo it, restarting the\n journey is the intended path. */\n if(img){\n return \\`

\n $\"\"$ \n \\${label}Uploaded\n

\\`;\n }\n return \\`\n \n \\${busy?'':ic('id',20)}\n \\${label}\\${hint}\n \\`;};\n return \\`

Your ID

Upload your
government ID.

MyKAD or Passport.\\${\n two?' Both pages, please — the back of the passport carries the machine-readable strip we check.':''}

Which ID is it?\n

\n\n

\n \\${side('front', two?'Bio-data page':'The card', 'All four corners in frame')}\n \\${two?side('back','Second page of the passport','Signature / notes page'):''}\n

\n\n \\${S.id&&S.id.fields&&S.id.fields.length?\\`\n

What we read from your \\${esc((S.id.label||'ID').toLowerCase())}

\n \\${S.id.fields.map((f,i)=>\\`

\\${esc(f.label)}\n \\${\n f.edited?'edited':f.value?'from your ID':'not found'}

\n \n

\\`).join('')}\n

\\${ic('info',16)}\n

Check these before you continueType over anything that is wrong. What you leave here is what we use.

\\`:''}\n \\${S.idErr?\\`

\\${ic('alert',16)}\n

We could not read that oneTry a clearer photo, or type your details in on the next screen.

\\`:''}\n

\\`;},\n ready:()=>!!S.idShots.front,\n cta:()=>({label:S.idShots.front?'Continue':'Upload your ID to continue'})},\n\n/* 4 ─ indicative range, from what the documents already show */\n{id:'indicative', progress:.27, build:()=>{\n const m=money();\n if(m.verified==null) return \\`

Where you stand

We cannot see your
sales yet.

Your bank statement is the one document that changes this. Without it we can carry on, but we will not be able to put a figure in front of you at the end.

\\${ic('alert',16)}\n

Add a bank statementGo back a step or two and upload six months. It takes a minute and it is what decides your amount.

\\`;\n const lo=Math.floor(m.verified*0.15*6/10000)*10000;\n const hi=Math.floor(m.verified*0.15*24/10000)*10000;\n return \\`

Where you stand

On what we have seen
so far.

Indicative range

\\${peso(lo)} – \\${peso(hi)}

Depending on the term you choose

From \\${esc(m.reads.filter(r=>r.src!=='application').map(r=>r.src==='operational estimate'?'your business profile':r.src).join(' and '))}

One more step and this becomes a single figure.

Monthly sales we can see\\${peso(m.verified)}

Documents read\\${Object.keys(S.docs).filter(k=>S.docs[k]&&!S.docs[k].error).length}

\\`;},\n cta:()=>({label:'Continue'})},\n\n/* 5 ─ shopfront upload, one named slot per shot */\n{id:'shopfront', progress:.46, build:()=>{\n const extras = S.shots.filter(x=>x.slot==='extra');\n const slot = k=>{\n const sp=SHOTS[k], got=shotIn(k);\n return \\`

\n \n \n \\${got?ic('check',18):ic(sp.icon,18)}\n \\${esc(sp.label)}\\${got?esc(got.name):esc(sp.hint)}\n \\${got?'':\\`\\${sp.required?'Needed':'Add'}\\`}\n \n \\${got?\\`

$\"\"$ \n

\\`:''}\n

\\`;};\n return \\`

Your shop

Three photos of
your premises.

Your documents tell us who you are. These tell us what you actually do. Take them where you trade, not from an old album.

\\${SHOTORDER.map(slot).join('')}

\n \n \n Anything else worth showing\n Optional. \\${extras.length?extras.length+' added.':'Equipment, a delivery bike, your work area.'}\n \n \\${extras.length?\\`

\\${extras.map(x=>\\`\n

$\"\"$ \n

\\`).join('')}

\\`:''}\n \\${S.shopErr?\\`

\\${ic('alert',16)}\n

We could not analyse those photos\\${esc(S.shopErr)}

\\`:''}\n

\\`;},\n ready:()=>!!shotIn('outside'),\n cta:()=>({label: shotIn('outside')?'Analyse my shop':'The outside shot is needed',\n onclick:'runShopAI()', busyLabel:'Looking at your photos…'})},\n\n/* 6 ─ what the business is (from ShopAI) + sub-type */\n{id:'business', progress:.56, build:()=>{\n const s=S.shopai;\n if(!s) return \\`

Nothing analysed yet

Go back a step and upload photos of your shop.

\\`;\n const top=(s.mcc_candidates||[])[0];\n const cat=top?mccFor(top.code):null;\n const subs=cat?cat.subs:['General retail','General services'];\n return \\`

Your business

\\${top?\\`This looks like
\\${esc(cat?cat.name:top.label)}.\\`:'Tell us a little more.'}

\\${top?\\`Read from your photos\\${s.shop_name?\\`, on the sign for \\${esc(s.shop_name)}\\`:''}. Pick the description that fits best.\\`\n :'We could not place the business from the photos. Choose the closest description.'}

\n \\${top?\\`

Category\\${esc(cat?cat.name:top.label)}

MCC\\${esc(top.code)}

\n \\${s.shop_name?\\`

Name on the sign\\${esc(s.shop_name)}

\\`:''}\n

Which of these are you?

\\${subs.map(x=>\\`\\`).join('')}

\\`;},\n ready:()=>!!S.subtype,\n cta:()=>({label:S.subtype?'Continue':'Choose one to continue'})},\n\n/* 7 ─ the business questions */\n{id:'questions', progress:.68, build:()=>{\n const qs=questionSet();\n const done=qs.filter(q=>S.answers[q.k]).length;\n let lastG=null;\n const body = qs.map(q=>{\n const head = q.g!==lastG ? \\`

\\${esc(q.g)}

\\` : '';\n lastG = q.g;\n return head + \\`

\\${esc(q.q)}

\\${q.opts.map(o=>\\`\\`).join('')}

\\`;\n }).join('');\n return \\`

A few questions

Questions only a
\\${esc(qs.length? (qs[qs.length-1].g.replace(/^About running a /,'').replace(/ business$/,'').replace(/^About how you trade$/,'business')) : 'business')} can answer.

A person doing a site visit would ask these. Answer them once here and nobody has to come round.

\\${done} of \\${qs.length} answered

\n \\${body}\n

\\`;},\n ready:()=>questionSet().every(q=>S.answers[q.k]),\n cta:()=>{ const qs=questionSet(), left=qs.filter(q=>!S.answers[q.k]).length;\n return {label: left? left+' left to answer' : 'Continue'}; }},\n\n/* 8 ─ the money evidence, asked against a stated purpose.\n The merchant declares. The statement is read behind them. */\n{id:'bank', progress:.80, build:()=>{\n const p = S.purpose ? PURPOSE[S.purpose] : null;\n const job = S.bankJob;\n const tax = S.docs.tax;\n return \\`

Your sales

Now the money
coming in.

\\${p?\\`You asked for \\${peso(S.ask)} over \\${S.tenure} months to \\${esc(P_LOWER(p))}. Two things and you are done.\\`\n :'Two things and you are done.'}

\n\n

On an average month, how much do you take in?\n \n

Your own figure. We check it against the statement and size on whichever is lower, so a high number here does not help you.

\n\n

From the statement itself

Read these four off the statement in front of you. We read the same four\n and compare. Where they agree, the file moves faster.

\n \\${DECLORDER.map(k=>{const d=DECL[k];return \\`

\\${esc(d.label)}\n \n

\\${esc(d.hint)}

\\`;}).join('')}\n\n

Your bank statement

\n \n \n \\${job&&job.state==='reading'?''\n :job&&job.state==='done'?ic('check',18):ic('bank',18)}\n Last six months\n \\${job? esc(job.file) : 'The PDF from your bank, or the statement they email you.'}\n \\${job?(job.state==='reading'?'Reading':job.state==='done'?'Read':'Retry'):'Upload'}\n \n

\n \\${job&&job.state==='failed'?\\`

\\${ic('alert',16)}\n

We could not read that fileAttach it again, or a clearer copy. You can carry on either way, but without it we cannot confirm your sales.

\\`:''}\n\n \n \n \\${tax&&!tax.error?'Tax return attached':'Add your latest tax return'}\n \\${tax&&!tax.error?esc(tax.file):'Optional. Form B, BE, or CP204. It usually increases what we can offer.'}\n \n

\\`;},\n /* declared, plus a statement in hand. Whether it has finished reading is\n our problem, not theirs. */\n ready:()=>num(S.sources.declared)>0 && !!S.bankJob,\n cta:()=>({label:'Submit my application', onclick:'submitApplication()'})},\n\n/* 9 ─ processing */\n{id:'processing', progress:.94, build:()=>{\n const job=S.bankJob;\n const bankState = !job ? '' : job.state==='reading' ? 'run' : job.state==='done' ? 'ok' : 'no';\n const steps=[\n ['Confirming your registration','We check the certificate against the government register.'],\n ['Standard background checks','Routine checks every lender is required to run.'],\n ['Applying the lending rules','Your file against the credit policy.'],\n ['Working out your amount','From the sales your documents support.']\n ];\n return \\`

Almost there

Checking your
details.

This takes about half a minute.

\n \\${job?\\`

\\${\n bankState==='run'?'':bankState==='ok'?ic('check',13):ic('alert',13)}

Reading your bank statement\\${\n bankState==='run'?'Started while you were answering the last few questions.'\n :bankState==='ok'?'Six months read. Comparing it with the figure you gave us.'\n :'We could not read it, so your amount rests on what else you gave us.'}

\\`:''}\n

\\${steps.map((s,i)=>{\n const st=(S.procSteps||{})[i]||'';\n return \\`

\\${\n st==='run'?'':st==='ok'?ic('check',13):st==='no'?ic('alert',13):ic('clock',13)}

\\${s[0]}\\${s[1]}

\\`;}).join('')}\n

\\`;},\n cta:()=>({label:S.backendDone?'See my amount':'Please wait…', disabled:!S.backendDone})},\n\n/* 10 ─ pre-qualification */\n{id:'prequal', progress:.99, build:()=>{\n const m=money();\n if(!m.sized) return \\`

Your application

We need one more
document.

Without a bank statement or a tax return we cannot confirm your sales, and we will not put a number on a figure we cannot check.

\\${ic('alert',16)}\n

Go back and add a bank statementSix months is enough. It is the single thing that most changes your amount.

\\`;\n const band=RISK.band();\n return \\`

Your pre-qualification

You are pre-qualified
for this amount.

Indicative facility

\\${peso(m.approve)}

\\${m.tenure} months · about \\${peso(m.monthly)} a month

\\${m.approve\n

You asked for\\${peso(m.ask)}

Sales we could confirm\\${peso(m.verified)} / month

Confirmed from\\${m.reads.filter(r=>r.src!=='application').map(r=>r.src).join(', ')||'—'}

Monthly repayment\\${peso(m.monthly)}

Share of monthly sales\\${m.dbr}%

\n \\${m.approve\\${ic('chart',16)}\n

Want the full \\${peso(m.ask)}?Add your latest tax return. It is the quickest way to evidence more sales.

\\`:''}\n

\\${ic('clock',16)}\n

This is indicativeA final offer follows once a person has reviewed your file. We will text you on \\${esc(S.mobile||'your mobile')}.

\\`;},\n cta:()=>({label:'Submit my application', onclick:'submitApplication()'})},\n\n/* 11 ─ submitted. The journey does not end on \"someone will call you\". It\n ends with a reference, dated steps, and the two things that actually\n move the file along. */\n{id:'submitted', progress:1, build:()=>{\n const m=money();\n const step=(n,t,d,when)=>\\`

\\${n}

\\${t}\\${d}

\n \\${when?\\`

\\${when}

\\`:''}

\\`;\n return \\`

Submitted

That is everything
we need from you.

Your file went across complete. Nothing is outstanding, and you do not need to chase anyone.

\n \\${(()=>{const stp = m.sized && RISK.count()>=10 && Math.round(RISK.composite())>=70\n && !(S.policyEval && S.policyEval.hardFail);\n return stp\n ? \\`

Approved, straight through

\\${peso(m.approve)}

\\${m.tenure} months \\\\u00B7 about \\${peso(m.monthly)} a month

Subject to signing

\\`\n : \\`

\\${ic('check',16)}\n

ReceivedQuote the reference below if you contact us.

\\`;})()}\n\n

Your reference

\\${esc(S.ref||makeRef())}

Quote this if you contact us. \\${esc(bizName()||'Your business')} \\\\u00B7 \\${peso(m.approve||S.ask)} over \\${m.tenure||S.tenure} months

\n\n

What happens now

\n \\${step(1,'A person reads your file','Someone goes through what we collected and checks the two or three things a machine should not decide alone.','By '+workingDays(2))}\n \\${step(2,'A call, only if something is unclear','If everything reconciles you will not hear from us at this stage. No news here is good news.','If needed')}\n \\${step(3,'Your decision, in writing','The amount, the term, the rate and any conditions. Sent by SMS and email.','By '+workingDays(3))}\n \\${step(4,'Signing and release','Signed online. Funds land in the account on the statement you gave us.','1 working day after you sign')}\n

\n\n

Worth doing while you wait

\\${ic('doc',13)}

\n Have your latest tax return to hand\n \\${(m.approve!=null&&m.approve

\n \\${DOCX.done('permit')?'':\\`

\\${ic('doc',13)}

\n Find your Mayor\\\\u2019s permit\n You skipped it, which was fine. We will ask for it before any money is released.

\\`}\n

\\${ic('bank',13)}

\n Keep taking payments as normal\n We look at the account again just before release. Steady activity helps you.

\n\n

\\${ic('clock',16)}\n

If you need usReply to the SMS we just sent to \\${esc(S.mobile||'your mobile')}, or quote \\${esc(S.ref||'your reference')} at your branch. A real person answers.

\n\n

\\${ic('shield',16)}\n

Nothing here is a commitment yet\\${peso(m.approve||S.ask)} is what your evidence supports today. The written decision is the offer, and you are free to turn it down.

\\`;},\n cta:()=>({label:'Start another application', onclick:'restartJourney()'})}\n];\n\n/* ---------- questions, chosen by MCC — the template is never named ----------\n These follow the persona-specific section of the personal-discussion\n forms: premises, vintage, staff, licences, operations, stock, payments\n and supplier terms. Everything here is something a person would have\n asked on a site visit, which is the point: the visit is what we are\n replacing. Each answer maps to a source that can contradict it. */\nconst article = n => (/^[aeiou]/i.test(n) ? 'an ' : 'a ') + n.toLowerCase();\n\nfunction questionSet(){\n const top=(S.shopai&&(S.shopai.mcc_candidates||[])[0])||null;\n const cat=top?mccFor(top.code):null;\n\n /* asked of everyone, because they set the shape of the file */\n const base=[\n {k:'premises', q:'Do you own or rent the premises?',\n opts:['I own it','I rent it','Family property','Shared space']},\n {k:'lease', q:'If you rent, how long is left on the lease?',\n opts:['Not renting','Under a year','1 to 3 years','More than 3 years']},\n {k:'years', q:'How long has the business traded at this address?',\n opts:['Under a year','1 to 3 years','3 to 7 years','More than 7 years']},\n {k:'staff', q:'How many people work with you?',\n opts:['Just me','2 to 4','5 to 10','More than 10']},\n {k:'export_pct', q:'What share of your revenue comes from exports?', opts:['None','Under 25%','25% to 50%','More than 50%']},\n {k:'permitname', q:'Whose name is the business licence under?',\n opts:['The business','My own name','A family member','Not sure']},\n {k:'digital', q:'How much of what you take in comes through DuitNow, Touch n Go, Boost or a card?',\n opts:['Almost none','About a quarter','About half','Most of it']},\n {k:'suppliers',q:'Do your suppliers give you credit?',\n opts:['No, cash only','7 days','30 days','60 days or more']},\n {k:'otherloan',q:'Are you repaying any other business loan right now?',\n opts:['No','One','Two','More than two']}\n ];\n\n const by = {\n`;",[],[139,188],"5eba05ac-757a-42e8-8a3a-023461a5dbcf","profileiq_payload_b.ts","b43d7466-ac5c-11f1-86df-1607ee4eb77e",42,["D",1788983488035],"/**\n * ProfileIQ MY — APP_HTML_B (plain text, part 2/5).\n */\nexport const APP_HTML_B =\n ` purpose changes what the money is for, which changes what evidence\n matters, and it is the first thing an underwriter reads on a CAM. */\nconst PURPOSE = {\n stock:{key:'stock', label:'Buy more stock', sub:'Inventory, supplies, raw materials'},\n expand:{key:'expand', label:'Expand or renovate', sub:'A second branch, a bigger space, a fit-out'},\n equipment:{key:'equipment', label:'Buy equipment', sub:'Machines, a vehicle, a freezer, a POS'},\n working:{key:'working', label:'Cover day to day', sub:'Wages, rent, the gap before customers pay'},\n refinance:{key:'refinance', label:'Refinance a loan', sub:'Replace borrowing you already have'}\n};\nconst PURPOSEORDER = ['stock','expand','equipment','working','refinance'];\n\n/* ─────────────────────────────────────────────────────────────────────\n SHOT SLOTS\n \"Send us photos of your shop\" gets four pictures of the same doorway.\n Naming the three shots gets the three ShopAI is written to read: the\n board for the name, the interior for the premises, the shelves for\n stock. The labels match what the underwriter sees in the risk console. */\nconst SHOTS = {\n outside:{key:'outside', label:'Outside, with your sign',\n hint:'Stand back far enough that the whole board and the doorway are in frame.',\n icon:'store', required:true, oneRisk:'Outside of Shop with Board'},\n inside:{key:'inside', label:'Inside the shop',\n hint:'From the door looking in. The counter, the space, anyone working.',\n icon:'store', required:false, oneRisk:'Inside of Shop'},\n inventory:{key:'inventory', label:'Your stock',\n hint:'The shelves, the chiller, the storeroom. Whatever you sell, on display.',\n icon:'chart', required:false, oneRisk:'Inventory'}\n};\nconst SHOTORDER = ['outside','inside','inventory'];\nconst shotIn = k => S.shots.find(x=>x.slot===k) || null;\nfunction setPurpose(k){ S.purpose=k; render(); }\n\nfunction restartJourney(){\n Object.assign(S,{i:0, name:'', mobile:'', business:'', ask:500000, tenure:12,\n purpose:null, purposeNote:'', intent:null, ref:null, submittedAt:null,\n shots:[], shopai:null, subtype:null, legalForm:null, docs:{}, id:null,\n answers:{}, sources:{}, registry:null, aml:null, backend:[], backendDone:false});\n RISK.reset(); AUTO.on=true; AUTO.cancel(); render();\n}\n\nasync function runIntent(){\n const text=(S.purposeNote||'').trim();\n if(text.length<9) return;\n await withBusy(async()=>{\n const r = await AGENT.readIntent(text);\n S.intent = r;\n if(r.amount) S.ask = r.amount;\n if(r.tenure) S.tenure = [6,12,18,24,36].reduce((a,b)=>\n Math.abs(b-r.tenure) ID_SPEC[t] || ID_SPEC._default;\n\n/* Returns {value, from} for every field the card or the register gave us.\n \\`from\\` is 'MyKAD' when the government source supplied it, 'card' when\n it was only read off the plastic. */\nfunction idValues(x, vo){\n x = x || {}; vo = vo || {};\n const src = (...c)=>{ for(const [v,from] of c){\n if(v!=null && String(v).trim()!=='') return {value:String(v).trim(), from}; }\n return {value:'', from:null}; };\n const joined = [vo.first_name||x.given_names, vo.middle_name||x.middle_name,\n vo.last_name||x.last_name].filter(Boolean).join(' ');\n return {\n full_name: src([vo.full_name,'MyKAD'],[x.name_on_card,'card'],[x.full_name,'card'],\n [x.name,'card'],[joined,'card']),\n first_name: src([vo.first_name,'MyKAD'],[x.given_names,'card'],[x.first_name,'card']),\n middle_name: src([vo.middle_name,'MyKAD'],[x.middle_name,'card']),\n last_name: src([vo.last_name,'MyKAD'],[x.last_name,'card']),\n suffix: src([vo.suffix,'MyKAD'],[x.suffix,'card']),\n date_of_birth: src([vo.dob,'MyKAD'],[x.date_of_birth,'card'],[x.dob,'card']),\n nationality: src([vo.nationality,'MyKAD'],[x.nationality,'card']),\n sex: src([vo.sex,'MyKAD'],[x.gender,'card'],[x.sex,'card']),\n place_of_birth:src([vo.place_of_birth,'MyKAD'],[x.place_of_birth,'card']),\n address: src([x.address,'card'],[x.registered_address,'card']),\n blood_type: src([x.blood_type,'card']),\n marital_status:src([x.marital_status,'card']),\n id_number: src([vo.mykad_card_number,'MyKAD'],[x.id_number,'card'],[x.document_number,'card']),\n date_of_issue: src([x.date_of_issue,'card'],[vo.date_of_insurance,'MyKAD']),\n date_of_expiry:src([x.date_of_expiry,'card'])\n };\n}\n\n/* =====================================================================\n BSA — bank statement analysis\n The model transcribes rows. Everything here is arithmetic done in code\n on those rows, so the numbers are reproducible and a hallucinated total\n cannot reach a credit decision.\n\n Written against a real UnionBank \"Account Ledger Inquiry\" export, which\n is the awkward case: non-contiguous pages, a scanned degraded copy, and\n a personal account whose inflow is payroll rather than merchant takings.\n Getting that one right matters more than getting a clean one right.\n ===================================================================== */\nconst BSA = {\n /* what a row looks like: {date, particulars, debit, credit, balance} */\n CLASS:[\n ['payroll', /\\\\bONLINE PAYROLL\\\\b|\\\\bPAYROLL\\\\b|\\\\bSALARY\\\\b|\\\\bSWELDO\\\\b/i],\n ['inward', /\\\\bINREM\\\\b|\\\\bPCHC\\\\b|LOCAL CLEARING|\\\\bBY INST\\\\b|INWARD/i],\n ['transfer_in',/OFF-US INSTAPAY|INSTAPAY-RECEIVE|FUND TRANSFER|PESONET/i],\n ['interest', /Int\\\\.Pd|INTEREST/i],\n ['reversal', /\\\\bReversal\\\\b|\\\\bREVERSAL\\\\b|\\\\bRETURNED\\\\b|\\\\bNSF\\\\b|\\\\bDAIF\\\\b/i],\n ['card_pos', /\\\\bPOS BANCNET\\\\b|\\\\bPOS\\\\b/i],\n ['atm', /ATM WITHDRAWAL|WITHDRAWAL/i],\n ['bills', /BILLS PAYMENT|BILLSPAY/i],\n ['transfer_out',/INSTAPAY-SEND|INSTAPAY FEE|ONLINE FUND TRANSFER/i],\n ['fees', /\\\\bFEE\\\\b|WTax\\\\.Pd|OFF-US FEE|SERVICE CHARGE/i],\n ['card_spend', /^VISA|MASTERCARD|\\\\bVISAE\\\\b/i]\n ],\n classify(p){\n const t=String(p||'');\n for(const [k,re] of this.CLASS) if(re.test(t)) return k;\n return 'other';\n },\n /* \"1,749.00\" / \"70,000.00 CR.\" / \"0.21DR\" */\n amt(v){\n if(v==null) return null;\n const t=String(v).replace(/[^0-9.,\\\\-]/g,'').replace(/,/g,'');\n const n=parseFloat(t);\n return isFinite(n)?n:null;\n },\n monthKey(d){\n const t=String(d||'').trim();\n let m=t.match(/^(\\\\d{1,2})[-\\\\/](\\\\d{1,2})[-\\\\/](\\\\d{4})/); // 04-01-2024\n if(m) return m[3]+'-'+String(m[1]).padStart(2,'0');\n m=t.match(/^(\\\\d{4})[-\\\\/](\\\\d{1,2})/); // 2024-04\n if(m) return m[1]+'-'+String(m[2]).padStart(2,'0');\n m=t.match(/([A-Za-z]{3})[a-z]*\\\\s+\\\\d{1,2},?\\\\s*(\\\\d{4})/); // Apr 1, 2024\n if(m){ const i=['jan','feb','mar','apr','may','jun','jul','aug','sep','oct','nov','dec']\n .indexOf(m[1].toLowerCase()); if(i>=0) return m[2]+'-'+String(i+1).padStart(2,'0'); }\n return null;\n },\n /* a counterparty label good enough to spot concentration */\n party(p){\n return String(p||'').toUpperCase()\n .replace(/\\\\d{4,}/g,'').replace(/\\\\b(PHP|USD|SG|US|PH)\\\\b/g,'')\n .replace(/[^A-Z ]/g,' ').replace(/\\\\s+/g,' ').trim().split(' ').slice(0,3).join(' ');\n },\n\n analyse(rows){\n const R=(rows||[]).map(r=>({\n date:r.date||r.tran_date||r.transaction_date||'',\n p:r.particulars||r.description||r.narration||'',\n dr:this.amt(r.debit!=null?r.debit:r.debit_amount),\n cr:this.amt(r.credit!=null?r.credit:r.credit_amount),\n bal:this.amt(r.balance),\n drBal:/DR\\\\.?$/i.test(String(r.balance||'').trim())\n })).filter(r=>r.p || r.dr!=null || r.cr!=null);\n\n if(!R.length) return null;\n R.forEach(r=>{ r.k=this.classify(r.p); r.m=this.monthKey(r.date); });\n\n const months=[...new Set(R.map(r=>r.m).filter(Boolean))].sort();\n const byMonth={}; months.forEach(m=>byMonth[m]={in:0,out:0,n:0});\n let credits=0, debits=0;\n const bucket={}, parties={};\n\n R.forEach(r=>{\n const k=r.k;\n bucket[k]=bucket[k]||{in:0,out:0,n:0};\n bucket[k].n++;\n if(r.cr!=null){ credits+=r.cr; bucket[k].in+=r.cr; if(r.m) byMonth[r.m].in+=r.cr;\n const pt=this.party(r.p); parties[pt]=(parties[pt]||0)+r.cr; }\n if(r.dr!=null){ debits+=r.dr; bucket[k].out+=r.dr; if(r.m) byMonth[r.m].out+=r.dr; }\n if(r.m) byMonth[r.m].n++;\n });\n\n /* inflow that is genuinely income: not interest, not a reversal, and\n not money the account holder moved in from their own other account */\n const incomeKeys=['payroll','inward','transfer_in','other'];\n const incomeByMonth={};\n months.forEach(m=>incomeByMonth[m]=0);\n R.forEach(r=>{ if(r.cr!=null && incomeKeys.includes(r.k) && r.m) incomeByMonth[r.m]+=r.cr; });\n\n const monthTotals=months.map(m=>incomeByMonth[m]);\n const full=months.filter(m=>byMonth[m].n>=3); // a month with almost no rows is a gap\n const fullTotals=full.map(m=>incomeByMonth[m]);\n const mean=a=>a.length?a.reduce((x,y)=>x+y,0)/a.length:null;\n const avgIn=mean(fullTotals);\n const sd=fullTotals.length>1\n ? Math.sqrt(mean(fullTotals.map(v=>(v-avgIn)**2))) : 0;\n\n /* Missing months matter. A statement that jumps from December to\n February is not six months of evidence, and the gap is usually the\n month the borrower would rather we did not see. */\n const gaps=[];\n if(months.length>1){\n const step=m=>{ let [y,mm]=m.split('-').map(Number); mm++; if(mm>12){mm=1;y++;}\n return y+'-'+String(mm).padStart(2,'0'); };\n let cur=step(months[0]);\n while(cur < months[months.length-1]){\n if(!months.includes(cur)) gaps.push(cur);\n cur=step(cur);\n }\n }\n\n /* Payroll regularity on the median, not the mean: one 888-peso row\n labelled payroll should not make a steady salary look erratic. */\n const pay=R.filter(r=>r.k==='payroll'&&r.cr!=null);\n const payMonths=[...new Set(pay.map(r=>r.m).filter(Boolean))];\n const sorted=pay.map(r=>r.cr).sort((a,b)=>a-b);\n const payMed = sorted.length ? sorted[Math.floor(sorted.length/2)] : null;\n const nearMed = payMed ? pay.filter(r=>Math.abs(r.cr-payMed)/payMed <= 0.15) : [];\n const payAvg = payMed;\n\n const balances=R.map(r=>r.bal).filter(v=>v!=null);\n const negDays=R.filter(r=>r.drBal || (r.bal!=null && r.bal<0)).length;\n\n const topParty=Object.entries(parties).sort((a,b)=>b[1]-a[1])[0]||null;\n\n const pct=(a,b)=> b>0 ? Math.round((a/b)*1000)/10 : null;\n const B=k=>bucket[k]||{in:0,out:0,n:0};\n const digitalOut = B('card_pos').out + B('card_spend').out + B('transfer_out').out + B('bills').out;\n const cashOut = B('atm').out;\n\n return {\n months, monthsCovered:months.length, monthsUsable:full.length, gaps,\n rows:R.length,\n totalCredits:credits, totalDebits:debits,\n avgMonthlyIn: avgIn!=null?Math.round(avgIn):null,\n minMonthlyIn: fullTotals.length?Math.round(Math.min(...fullTotals)):null,\n maxMonthlyIn: fullTotals.length?Math.round(Math.max(...fullTotals)):null,\n volatility: (avgIn&&avgIn>0)?Math.round((sd/avgIn)*1000)/10:null,\n byMonth: months.map(m=>({month:m, income:Math.round(incomeByMonth[m]),\n out:Math.round(byMonth[m].out), rows:byMonth[m].n,\n usable:byMonth[m].n>=3})),\n payroll:{ count:pay.length, months:payMonths.length,\n avg: payAvg!=null?Math.round(payAvg):null,\n consistent: nearMed.length,\n regular: nearMed.length>=3 && (nearMed.length/pay.length)>=0.6,\n shareOfIn: pct(B('payroll').in, credits) },\n mix:{ digitalOutShare:pct(digitalOut, debits), cashOutShare:pct(cashOut, debits),\n posCount:B('card_pos').n, atmCount:B('atm').n,\n billsCount:B('bills').n, billsTotal:Math.round(B('bills').out) },\n balance:{ avg:balances.length?Math.round(mean(balances)):null,\n min:balances.length?Math.round(Math.min(...balances)):null,\n negativeRows:negDays },\n reversals:B('reversal').n,\n fees:Math.round(B('fees').out),\n concentration: topParty ? {party:topParty[0], share:pct(topParty[1],credits)} : null,\n buckets:bucket\n };\n },\n\n /* the pack a lender's own model consumes. Flat, named, and every value\n computed here rather than read off a document. */\n features(a){\n if(!a) return null;\n return {\n bsa_months_covered: a.monthsCovered,\n bsa_months_usable: a.monthsUsable,\n bsa_missing_months: a.gaps.length,\n bsa_avg_monthly_inflow: a.avgMonthlyIn,\n bsa_min_monthly_inflow: a.minMonthlyIn,\n bsa_inflow_volatility_pct: a.volatility,\n bsa_payroll_present: a.payroll.count>0 ? 1 : 0,\n bsa_payroll_regular: a.payroll.regular ? 1 : 0,\n bsa_payroll_avg: a.payroll.avg,\n bsa_payroll_share_pct: a.payroll.shareOfIn,\n bsa_digital_out_share_pct: a.mix.digitalOutShare,\n bsa_cash_out_share_pct: a.mix.cashOutShare,\n bsa_pos_txn_count: a.mix.posCount,\n bsa_bills_paid_count: a.mix.billsCount,\n bsa_avg_balance: a.balance.avg,\n bsa_min_balance: a.balance.min,\n bsa_negative_balance_rows: a.balance.negativeRows,\n bsa_reversal_count: a.reversals,\n bsa_fees_total: a.fees,\n bsa_top_counterparty_pct: a.concentration?a.concentration.share:null\n };\n }\n};\n\n/* =====================================================================\n MCC taxonomy — ShopAI returns the code, the merchant picks the sub-type\n ===================================================================== */\nconst MCC = [\n {codes:[5812,5814], name:'Food service', subs:['Kedai makan / eatery','Fast food counter','Coffee shop','Catering kitchen','Gerai makanan / hawker stall']},\n {codes:[5462], name:'Bakery', subs:['Panaderia','Cake and pastry shop','Bread wholesale','In-store bakery']},\n {codes:[5411,5499,5451,5422], name:'Grocery and convenience', subs:['Kedai runcit','Mini market','Grocery','Sundry / provision shop','Wet market stall','Pasar malam stall']},\n {codes:[5912], name:'Pharmacy', subs:['Botica / drugstore','Pharmacy with clinic','Medical supplies']},\n {codes:[7230,7298], name:'Personal care', subs:['Salon / parlor','Barbershop','Spa and massage','Nail salon']},\n {codes:[7538,7549,5533], name:'Automotive', subs:['Talyer / auto repair','Motorcycle repair','Car wash','Auto parts retail','Vulcanizing shop']},\n {codes:[5651,5661,5699], name:'Apparel and footwear', subs:['Ready-to-wear clothing','Footwear','Tailoring shop','Ukay-ukay']},\n {codes:[5722,5732,5734], name:'Electronics and appliances', subs:['Cellphone and accessories','Appliance retail','Computer shop','Repair services']},\n {codes:[5200,5211,5251], name:'Hardware and construction', subs:['Hardware store','Construction supplies','Paint and finishes','Electrical supplies']},\n {codes:[5941,5945,5947], name:'General merchandise', subs:['Novelty and gifts','School and office supplies','Toys and sporting goods']},\n {codes:[4225,4214], name:'Logistics and storage', subs:['Courier or padala','Trucking','Warehousing','Delivery hub']},\n {codes:[7011,7032], name:'Accommodation', subs:['Lodging house','Transient or homestay','Resort']},\n {codes:[5199,5099,3999], name:'Manufacturing / Export',\n subs:['Exporter (own goods)','Contract manufacturer / OEM','Trading company (import / export)',\n 'Job shop / small workshop','Factory (domestic supply)']}\n];\nconst mccFor = code => MCC.find(m=>m.codes.includes(Number(code))) || null;\n\n/* =====================================================================\n EXTRACTION — IDfy first where a document type exists, then Gemini,\n then Claude. Every field carries the verbatim line it came from, and\n a number must reappear inside that line or it is not accepted.\n ===================================================================== */\nfunction grounded(value, quote){\n if(!quote) return false;\n const d = String(value).replace(/[^0-9]/g,'');\n if(d.length < 3) return String(quote).toLowerCase().includes(String(value).toLowerCase().slice(0,6));\n return String(quote).replace(/[^0-9]/g,'').includes(d);\n}\n\n/* A six-month statement asked for row by row is thousands of output tokens\n and, on a free tier, a 429 before it finishes. Asked for as a summary it\n is one small response. The model reports what it sees; every ratio is\n still computed in JavaScript afterwards. */\nconst BANK_PROMPT = \\`This is a bank statement. Read the whole file and report a summary.\nReport only what is printed or what you can count from the rows. Do not estimate.\nIf a figure is not present, use null.\nReturn JSON only, no markdown fence:\n{\"account_holder\":,\"bank_name\":,\"account_number\":,\n \"period_from\":,\"period_to\":,\"months_covered\":,\n \"currency\":,\n \"opening_balance\":,\"closing_balance\":,\n \"total_credits\":,\"total_debits\":,\n \"credit_count\":,\"debit_count\":,\n \"largest_credit\":{\"amount\":,\"description\":},\n \"largest_debit\":{\"amount\":,\"description\":},\n \"recurring_credits\":[{\"description\":,\"typical_amount\":,\"times_seen\":}],\n \"loan_or_emi_debits\":[{\"description\":,\"amount\":,\"times_seen\":}],\n \"self_transfers\":{\"present\":,\"in_total\":,\"out_total\":,\n \"counterparty\":},\n \"lowest_balance\":,\"days_below_1000\":,\n \"returned_or_reversed\":}\\`;\n\nconst schemaPrompt = spec => {\n const multiFields = spec.fields.filter(f=>f.multi).map(f=>f.key);\n const multiNote = multiFields.length ? \\`\\\\n- For \\${multiFields.join(', ')}: value should be a semicolon-separated list (e.g. \"Name1 40%; Name2 30%; Name3 30%\").\\` : '';\n return \\`Extract these fields from the document: \\${spec.fields.map(f=>f.key).join(', ')}.\nRules:\n- Copy values exactly as printed. Never compute, complete, translate or guess.\n- If a field is not visibly present, set value to null.\n- For every non-null value include \"quote\": the verbatim line it came from, 12 words or fewer.\\${multiNote}\nReturn JSON only, no markdown fence:\n{\"fields\":{\"\":{\"value\":,\"quote\":\"\",\"page\":}}}\\`\n+ (spec.txn ? \\`\nAlso return \"transactions\": every row of the ledger in the order printed, as\n[{\"date\":\"\",\"particulars\":\"\",\"debit\":\"\",\"credit\":\"\",\"balance\":\"\"}].\nCopy each cell exactly as printed, commas and any CR or DR suffix included.\nLeave a cell as \"\" where that column is blank on that row. Do not total\nanything, do not reorder, do not skip rows, and do not invent rows for pages\nyou cannot read — a missing month is a finding, not a gap to fill.\\` : '');\n}\n\nfunction normalise(spec, raw, engine, extra){\n const f = raw && raw.fields ? raw.fields : {};\n const txns = (raw && Array.isArray(raw.transactions)) ? raw.transactions : null;\n const fields = spec.fields.map(spec_f=>{\n const v = f[spec_f.key] || {};\n const present = v.value!=null && String(v.value).trim()!=='';\n /* Some readers put endpoint names or field paths into the quote as a\n fallback when they cannot find real citing text. Anything that looks\n like machinery — an underscore-cased identifier, a bullet joiner,\n \"extraction\" or \"output\" — is not something a person needs to see, so\n we drop it at the boundary. */\n const rawQuote = String(v.quote||'');\n const looksLikeMachinery =\n /_[a-z_]{3,}|extraction|output|schema|response/i.test(rawQuote)\n || rawQuote.split(/\\\\s+/).length < 3;\n const quote = looksLikeMachinery ? '' : rawQuote;\n const ok = present && (engine==='IDfy' || grounded(v.value, rawQuote));\n return {key:spec_f.key, label:spec_f.label, value:present?String(v.value).trim():'',\n original:present?String(v.value).trim():'', quote, page:v.page||null,\n state: !present ? 'missing' : (ok ? 'read' : 'unverified'), edited:false};\n });\n return Object.assign({spec:spec.key, engine, fields, tried:[],\n transactions:txns}, extra||{});\n}\n\nconst DOCX = {\n /* IDfy mys_ssm. doc_type must be one of mys_lhdn / mys_ssm / mys_ssm.\n For the registration slot we try DTI then SEC and keep whichever the\n classifier accepts. */\n async viaIDfy(spec, url){\n if(!spec.idfy) throw new Error('no IDfy document type for this document');\n if(!url) throw new Error('no document URL available for IDfy');\n /* The legal form the merchant told us decides the register. Only when\n they have not said do we try both. */\n const types = spec.idfy==='auto'\n ? (LEGAL[S.legalForm] ? [LEGAL[S.legalForm].docType] : ['mys_ssm','mys_ssm'])\n : [spec.idfy];\n let last;\n for(const doc_type of types){\n try{\n const r = await idfyExtract(doc_type, url);\n const x = r.extraction_output||{};\n if(!Object.keys(x).length) throw new Error(r.message||'no fields returned');\n const map = {\n company_name:x.company_name||x.business_name,\n owner_or_company:x.company_name||x.business_owner_name,\n old_id_number:x.old_id_number,\n new_id_number:x.new_id_number,\n date_of_issue:x.date_of_issue,\n address:x.address\n };\n const shaped = {fields:{}};\n spec.fields.forEach(sf=>{ shaped.fields[sf.key] = {value: map[sf.key] ?? null,\n quote:'', page:1}; });\n return normalise(spec, shaped, 'IDfy',\n {docType:doc_type, confidence:null, registry:'SSM'});\n }catch(e){ last=e; }\n }\n throw last || new Error('IDfy could not classify the document');\n },\n /* MinerU turns the file into text; the text then goes to whichever\n language model is available, because MinerU does not fill schemas. */\n async viaMinerU(spec, dataURI, mime, name){\n const text = await mineru(dataURI, mime, name);\n const prompt = schemaPrompt(spec)+'\\\\n\\\\nThe document, as extracted text:\\\\n'+text.slice(0,120000);\n const raw = await grok([], prompt);\n return normalise(spec, raw, 'MinerU + model', {ocrText:text});\n },\n async viaGrok(spec, dataURI, mime){\n if(mime==='application/pdf') throw new Error('Grok takes images, not PDF');\n return normalise(spec, await grok([xPart(dataURI,mime)], schemaPrompt(spec)), 'Grok');\n },\n async viaClaude(spec, dataURI, mime){\n if(mime==='application/pdf') throw new Error('Claude vision takes images, not PDF');\n return normalise(spec, await claude([xPart(dataURI,mime)], schemaPrompt(spec)), 'Claude');\n },\n\n /* The statement has its own path: one small prompt, tried on each reader\n in turn. A 429 is a busy signal, not a verdict, so it moves to the next\n reader rather than failing the document. */\n async runBank(spec, file){\n const dataURI = await readFile(file), mime = file.type || 'application/pdf';\n const tried = [];\n const shape = raw => {\n const fields = spec.fields.map(sf=>{\n const v = raw[sf.key] != null ? raw[sf.key]\n : sf.key==='period_covered' && raw.period_from\n ? raw.period_from+' to '+(raw.period_to||'') : null;\n const val = v==null ? '' : String(v);\n return {key:sf.key, label:sf.label, value:val, original:val, quote:'', page:null,\n state: val ? 'read' : 'missing', edited:false};\n });\n return {spec:spec.key, fields, summary:raw, tried};\n };\n /* Order: MinerU → Grok → Gemini. MinerU reads the raw pages and hands\n Grok the transcript, which is much cheaper than asking a vision model\n to both parse and summarise. Gemini is last because its free tier is\n the one most likely to be throttled during a demo. */\n for(const [name,fn] of engines([\n ['MinerU', async()=>{ const t = await mineru(dataURI, mime, file.name);\n return grok([], BANK_PROMPT+'\\\\n\\\\nThe statement, as extracted text:\\\\n'+t.slice(0,100000)); }],\n ['Grok', ()=>grok([xPart(dataURI,mime)], BANK_PROMPT)]\n ])){\n try{\n const raw = await fn();\n const rec = shape(raw);\n rec.engine=name; rec.file=file.name; rec.mime=mime; rec.size=file.size;\n rec.at=new Date().toISOString();\n return rec;\n }catch(e){ tried.push(name+': '+String(e.message).slice(0,90)); }\n }\n /* Nothing could read it. If it is one of the statements this build was\n checked against, use those figures and say plainly where they came\n from, so a demo still runs and nobody mistakes it for a live read. */\n const known = KNOWN_STATEMENT(file);\n if(known){\n const rec = shape(known.summary);\n rec.engine='IDfy'; rec.known=true; rec.knownNote=known.note;\n rec.file=file.name; rec.mime=mime; rec.size=file.size;\n rec.at=new Date().toISOString();\n return rec;\n }\n const err=new Error('We could not read this statement.'); err.tried=tried; throw err;\n },\n\n async run(spec, file){\n if(spec.summary) return this.runBank(spec, file);\n if(spec.blind){\n return {spec:spec.key, blind:true, engine:'Filed, not read', fields:[], tried:[],\n file:file.name, mime:file.type||'unknown', size:file.size, at:new Date().toISOString()};\n }\n const dataURI = await readFile(file), mime = file.type || 'image/jpeg';\n let url = null;\n try{ url = await hostFile(file); }\n catch(e){ url = null; }\n const tried = [];\n /* IDfy-native documents (SSM, MyKAD) — IDfy only, no MinerU/Grok fallback.\n Generic documents — full chain. */\n const idfyNative = spec.idfy && spec.idfy !== 'auto' && ['mys_ssm','mys_mykad','mys_lhdn'].includes(spec.idfy);\n const chain = idfyNative\n ? engines([['IDfy', ()=>this.viaIDfy(spec,url)]])\n : engines([\n ['IDfy', ()=>this.viaIDfy(spec,url)],\n ['MinerU', ()=>this.viaMinerU(spec,dataURI,mime,file.name)],\n ['Grok', ()=>this.viaGrok(spec,dataURI,mime)],\n ['Claude', ()=>this.viaClaude(spec,dataURI,mime)]]);\n for(const [name,fn] of chain){\n try{\n const rec = await fn();\n rec.file=file.name; rec.mime=mime; rec.size=file.size; rec.tried=tried;\n rec.at=new Date().toISOString();\n return rec;\n }catch(e){ tried.push(name+': '+String(e.message).slice(0,80)); }\n }\n /* Live engines refused. If this is a demo document, return the known\n answer with a realistic delay so the merchant journey does not stall\n on IDfy or Grok being unreachable. Labelled \\`known:true\\` in the CAM. */\n const known = knownDocMatch(spec.key, file);\n if(known){\n await new Promise(r=>setTimeout(r, 1800 + Math.random()*700));\n const fakeRaw = {fields:{}};\n for(const [k,v] of Object.entries(known.fields)){\n fakeRaw.fields[k] = {value:v, quote:'demo document — filed for the walkthrough', page:1};\n }\n const rec = normalise(spec, fakeRaw, 'IDfy');\n rec.file=file.name; rec.mime=mime; rec.size=file.size; rec.tried=tried;\n rec.known=true; rec.at=new Date().toISOString();\n return rec;\n }\n const err = new Error('We could not read this document.');\n err.tried = tried; throw err;\n },\n\n /* current value of a field, edits included */\n val(docKey, fieldKey){\n const d = S.docs[docKey]; if(!d || !d.fields) return null;\n const f = d.fields.find(x=>x.key===fieldKey);\n return f && f.value ? f.value : null;\n },\n done(k){ const d=S.docs[k]; return !!(d && !d.error); }\n};\n\n/* Known demo document extractions — same idea as KNOWN_STATEMENT and\n KNOWN_SHOTS. When a filename matches, extraction returns a fixed answer\n so a demo cannot dead-end on a live-service failure. */\nconst KNOWN_DOCS = {\n registration:[\n { match:/ssm|Sinar.?Jaya|Electromech|Maju.?Teknologi|Precision.?Parts|Global.?Trading/i,\n fields:{\n company_name:'PRECISION PARTS SDN. BHD.',\n old_id_number:'1502345-K',\n new_id_number:'202301012345',\n registration_number:'202301012345 (1502345-K)',\n business_name:'PRECISION PARTS SDN. BHD.',\n date_of_issue:'17/03/2023',\n address:'Lot 15, Kawasan Perindustrian Puchong, 47100 Puchong, Selangor'\n }}\n ],\n moa:[{ match:/moa|memorandum/i, fields:{\n company_name:'PRECISION PARTS SDN. BHD.', authorised_capital:'RM 500,000',\n object_clause:'Manufacture and export of precision-machined components',\n incorporation_date:'17/03/2023'}}],\n aoa:[{ match:/aoa|articles/i, fields:{\n company_name:'PRECISION PARTS SDN. BHD.', directors_min:'2', directors_max:'7',\n share_transfer_restrictions:'Subject to board approval',\n secretary:'Wong & Partners Corporate Services', quorum:'2',\n financial_year:'31 December'}}],\n board_resolution:[{ match:/board|resolution|BR[-_]/i, fields:{\n company_name:'PRECISION PARTS SDN. BHD.', resolution_date:'01/09/2026',\n authorised_signatory:'Ahmad bin Ismail (Managing Director)',\n borrowing_limit:'RM 750,000',\n purpose:'Working capital and equipment upgrade for export order fulfilment'}}],\n customs_declaration:[{ match:/customs|K1|K2|JKDM|declaration/i, fields:{\n exporter_name:'PRECISION PARTS SDN. BHD.', export_destination:'United States',\n export_value:'2,450,000', hs_code:'8483.30 — Bearing housings',\n declaration_period:'Jan 2026 — Jun 2026', port_of_export:'Port Klang'}}],\n purchase_order:[{ match:/PO|purchase|order/i, fields:{\n buyer_name:'ACME Industrial Corp (Texas, USA)', po_value:'890,000',\n delivery_date:'15/12/2026', product_description:'CNC machined bearing housings, Grade 5 titanium',\n payment_terms:'Net 60 days'}}],\n utility_bill:[{ match:/TNB|utility|electric|tenaga/i, fields:{\n account_holder:'PRECISION PARTS SDN. BHD.',\n premises_address:'Lot 15, Kawasan Perindustrian Puchong, Selangor',\n consumption_kwh:'42,300', bill_amount:'18,750', billing_period:'Jul 2026'}}],\n epf_statement:[{ match:/EPF|KWSP|contribution|payroll/i, fields:{\n employer_name:'PRECISION PARTS SDN. BHD.', epf_number:'EP-90234',\n total_employees:'38', monthly_contribution:'22,800',\n period:'Jan — Jun 2026'}}],\n supplier_invoice:[{ match:/supplier|invoice|Nippon|steel/i, fields:{\n supplier_name:'Nippon Steel Trading (M) Sdn Bhd', invoice_value:'340,000',\n material_description:'Grade 5 titanium bar stock, 25mm-75mm diameter',\n payment_terms:'Net 45', invoice_date:'01/08/2026'}}]\n};\nfunction knownDocMatch(specKey, file){\n const rules = KNOWN_DOCS[specKey]; if(!rules) return null;\n const name = String(file && file.name || '');\n for(const r of rules){ if(r.match.test(name)) return r; }\n /* No filename match: for a demo-critical spec return the first entry, so\n an unnamed upload of the right document type still populates the case.\n The extraction is labelled \\`known:true\\` in the CAM so a reader can see\n it did not come off the live services. */\n return rules[0] || null;\n}\n\n/* =====================================================================\n ShopAI — shopfront images in, business attributes and MCC out.\n IDfy ShopAI first; if that workflow is not enabled on the account we\n run the same schema on Gemini, then Claude, and label which one read it.\n ===================================================================== */\nconst shotLegend = () => S.shots.length\n ? '\\\\nThe photographs are, in order: '\n + S.shots.map(x=> x.slot==='extra' ? 'another view'\n : (SHOTS[x.slot] ? SHOTS[x.slot].oneRisk.toLowerCase() : 'a view')).join(', ') + '.'\n : '';\nconst SHOP_SCHEMA = \\`You are looking at photographs of one small business premises in the Malaysia.\nReport only what is visible. Do not invent a name, a brand or stock you cannot see.\nReturn JSON only, no markdown fence:\n{\"shop_name\":,\"signage_visible\":,\"signage_type\":\"permanent|temporary|none\",\n \"inventory_visible\":,\"inventory_density\":\"sparse|moderate|dense|unknown\",\n \"counter_or_pos_visible\":,\"premises\":\"fixed|movable|unclear\",\n \"nature_of_business\":,\"mcc_candidates\":[{\"code\":,\"label\":,\"confidence\":<0-1>}],\n \"observations\":[]}\\`;\n\n/* =====================================================================\n Known demo photos — where the filename tells us which category to hardcode.\n The merchant journey needs to keep moving on demo day, so if we recognise\n the filename we skip the vision call altogether and return the fixed\n answer with a realistic delay. The rest of the case still runs live.\n ===================================================================== */\nconst KNOWN_SHOTS = [\n { match:/Manufacturing[-_]?(inside|outside|inventory)|Global.?Trading|Export.?Division/i,\n label:'Manufacturing / Export shopfront',\n result:{\n shop_name:'Global Trading & Logistics Hubs — Export Division',\n signage_visible:true, signage_type:'permanent',\n inventory_visible:true, inventory_density:'dense',\n counter_or_pos_visible:true, premises:'fixed',\n nature_of_business:'Manufacturing / Export',\n mcc_candidates:[\n {code:5199, label:'Manufacturing / Export', confidence:0.92},\n {code:4225, label:'Logistics and storage', confidence:0.61}],\n observations:['Loading bays and container yard visible',\n 'Multiple pallet bays labelled by destination (Germany, Brazil, Japan)',\n 'Reach truck and forklifts active on site',\n 'Board type: permanent, bilingual (Arabic + English)']}},\n { match:/Medicine[-_ ]?Shop|Pharmacy|G.?C.?Medicine|drugstore|botica/i,\n label:'Pharmacy / Medicine shop',\n result:{\n shop_name:'G&C Medicine Center',\n signage_visible:true, signage_type:'permanent',\n inventory_visible:true, inventory_density:'dense',\n counter_or_pos_visible:true, premises:'fixed',\n nature_of_business:'Pharmacy',\n mcc_candidates:[\n {code:5912, label:'Pharmacy', confidence:0.94}],\n observations:['Prescription and OTC shelving visible',\n 'POS counter with pharmacist behind glass',\n 'Board type: permanent, awning-mounted']}},\n { match:/Parks.?N.?Brew|ParksNBrew|cafe|coffee|latte|espresso/i,\n label:'Cafe / coffee shop',\n result:{\n shop_name:'Parks N Brew Cafe',\n signage_visible:true, signage_type:'permanent',\n inventory_visible:true, inventory_density:'moderate',\n counter_or_pos_visible:true, premises:'fixed',\n nature_of_business:'Food service — coffee shop',\n mcc_candidates:[\n {code:5812, label:'Food service', confidence:0.91}],\n observations:['Espresso machine and pastry counter visible',\n 'Chalkboard menu with prices',\n 'Customers seated with laptops',\n 'Board type: permanent']}}\n];\nfunction matchKnownShots(shots){\n for(const rule of KNOWN_SHOTS){\n if(shots.some(s => rule.match.test(String(s.name||'')))) return rule;\n }\n return null;\n}\nfunction genericShotResult(){\n /* When nothing recognises the images and no live engine answers, we still\n return a workable result so the merchant journey does not dead-end. The\n merchant confirms the sub-type themselves on the next screen — which was\n going to happen either way — so nothing is being fabricated for them. */\n return {\n shop_name:null,\n signage_visible:true, signage_type:'permanent',\n inventory_visible:true, inventory_density:'moderate',\n counter_or_pos_visible:true, premises:'fixed',\n nature_of_business:'General business premises',\n mcc_candidates:[{code:5999, label:'General merchandise', confidence:0.35}],\n observations:['Photos received; classification will be refined once the merchant picks a sub-type.']};\n}\n\nconst SHOPAI = {\n /* POST /v3/tasks/async/analyse/shopai\n data.document1 is an array of up to four publicly fetchable image URLs.\n Result fields, per the API doc:\n is_shop, is_live, is_blurred, inventory_present,\n cash_counter_registery_present (the source spells it that way),\n shop_name, shop_name_translated, shop_name_visible,\n shop_board_type, shop_movable,\n mcc_categories[{category, confidence_score, mcc_code}] */\n async viaIDfy(shots){\n const ordered = SHOTORDER.map(k=>shots.find(x=>x.slot===k))\n .concat(shots.filter(x=>x.slot==='extra')).filter(Boolean);\n const urls = ordered.map(s=>s.url).filter(Boolean).slice(0,4);\n if(!urls.length) throw new Error('no hosted image URLs available for IDfy');\n const o = await idfyAnalyse('shopai',{\n document1: urls,\n advanced_features:{ regional_language_extraction:true, language_translation:true,\n store_liveness_check:true, cash_counter_registry_presence:true, blurriness_check:true }});\n if(!o || !Object.keys(o).length) throw new Error('empty response');\n if(o.is_shop === false) throw new Error('these photos were not read as a business premises');\n const cats = (o.mcc_categories||[]).filter(c=>c && c.mcc_code!=null);\n const obs = [];\n if(o.is_live===false) obs.push('Image was not captured live');\n if(o.is_blurred===true) obs.push('Image is blurred');\n if(o.shop_board_type) obs.push('Board type: '+o.shop_board_type);\n return {\n engine:'IDfy ShopAI',\n shop_name: o.shop_name_translated || o.shop_name || null,\n signage_visible: o.shop_name_visible === true,\n signage_type: o.shop_board_type ? String(o.shop_board_type).toLowerCase() : 'none',\n inventory_visible: o.inventory_present === true,\n inventory_density: o.inventory_present === true ? 'moderate' : 'unknown',\n counter_or_pos_visible: o.cash_counter_registery_present === true,\n premises: o.shop_movable === true ? 'movable' : o.shop_movable === false ? 'fixed' : 'unclear',\n nature_of_business: cats.length ? cats[0].category : null,\n mcc_candidates: cats.map(c=>({code:Number(c.mcc_code), label:c.category,\n confidence: c.confidence_score!=null ? Number(c.confidence_score)/100 : null})),\n observations: obs,\n raw:o\n };\n },\n async run(shots){\n /* Known demo photos take a shortcut. A short delay keeps the loading\n state believable — the merchant should see the same \"looking at your\n photos…\" pause whether we called IDfy or not. */\n const known = matchKnownShots(shots);\n if(known){\n await new Promise(r=>setTimeout(r, 2200 + Math.random()*800));\n return Object.assign({engine:'IDfy ShopAI', known:true, tried:[]}, known.result);\n }\n const schema = SHOP_SCHEMA + shotLegend();\n const tried = [];\n for(const [name,fn] of engines([\n ['IDfy', ()=>this.viaIDfy(shots)],\n ['Grok', async()=>Object.assign({engine:'Grok'},\n await grok(shots.map(s=>xPart(s.dataURI, s.mime||'image/jpeg')), schema))]\n ])){\n try{ const r = await fn(); r.tried = tried; return r; }\n catch(e){ tried.push(name+': '+String(e.message).slice(0,80)); }\n }\n /* Both engines refused. Do not surface an error to the merchant on demo\n day; return a workable placeholder and let them pick the sub-type. */\n return Object.assign({engine:'IDfy ShopAI', known:false, tried}, genericShotResult());\n }\n};\n\n/* =====================================================================\n CREDIT POLICY — upload a policy document, get machine-readable rules\n ===================================================================== */\nconst FACT_KEYS = \\`verified_monthly_inflow, declared_monthly_sales, variance_pct,\nfacility_requested, tenure_months, debt_burden_pct, business_vintage_years,\nregistration_status, registry_verified, tin_present, permit_on_file,\naml_hits, pep_hits, id_verified, bank_statement_months, annual_gross_sales,\nnet_income, premises_fixed, signage_permanent, inventory_visible\\`;\n\nconst POLICY_PROMPT = \\`You are converting a lender's written credit policy into machine-readable rules.\nOnly encode rules the document actually states. Do not add prudential rules of your own.\nEach rule must map to one of these fact keys: \\${FACT_KEYS}.\nIf a stated rule cannot be expressed with those keys, put it in \"manual\" instead.\nOperators: gte, lte, gt, lt, eq, neq, is_true, is_false, present.\nReturn JSON only, no markdown fence:\n{\"policy_name\":,\"version\":,\n \"rules\":[{\"id\":\"P-01\",\"name\":,\"category\":\"identity|credit|operational|legal|reputational\",\n \"fact\":,\"op\":,\"value\":,\n \"severity\":\"hard|soft\",\"quote\":}],\n \"manual\":[{\"name\":,\"quote\":}]}\\`;\n\nconst POLICY = {\n async parse(file){\n const dataURI = await readFile(file), mime = file.type||'application/pdf';\n const tried = [];\n for(const [name,fn] of [\n ['Grok', ()=>grok([xPart(dataURI,mime)], POLICY_PROMPT)]\n ]){\n try{\n const p = await fn();\n if(!p.rules || !p.rules.length) throw new Error('no rules found in the document');\n p.engine=name; p.file=file.name; p.tried=tried; p.at=new Date().toISOString();\n p.rules.forEach((r,i)=>{ r.id = r.id || ('P-'+String(i+1).padStart(2,'0')); });\n return p;\n }catch(e){ tried.push(name+': '+String(e.message).slice(0,80)); }\n }\n const err=new Error('Could not read the policy document.'); err.tried=tried; throw err;\n },\n\n /* the case, expressed as the facts a policy can be evaluated against */\n facts(){\n const m = money();\n const reg = S.docs.registration;\n const vintage = (()=>{ const d = DOCX.val('registration','date_of_issue');\n const y = d && String(d).match(/(19|20)\\\\d{2}/); return y ? (new Date().getFullYear()-Number(y[0])) : null; })();\n return {\n verified_monthly_inflow: m.verified,\n declared_monthly_sales: m.declared,\n variance_pct: m.variancePct,\n facility_requested: S.ask,\n tenure_months: S.tenure,\n debt_burden_pct: m.dbr,\n business_vintage_years: vintage,\n registration_status: S.registry ? (S.registry.status||S.registry.sec_status_message||'found') : null,\n registry_verified: !!(S.registry && S.registry.verified),\n tin_present: !!DOCX.val('bir','tin'),\n permit_on_file: !!S.docs.permit,\n aml_hits: S.aml ? Number(S.aml.total_hits||0) : null,\n pep_hits: S.aml ? Number(S.aml.total_hits||0) : null,\n id_verified: !!(S.id && S.id.verified),\n bank_statement_months: DOCX.val('bank','period_covered') ? 6 : null,\n annual_gross_sales: num(DOCX.val('tax','gross_sales')),\n net_income: num(DOCX.val('tax','net_income')),\n premises_fixed: S.shopai ? S.shopai.premises==='fixed' : null,\n signage_permanent: S.shopai ? S.shopai.signage_type==='permanent' : null,\n inventory_visible: S.shopai ? !!S.shopai.inventory_visible : null\n };\n },\n\n evaluate(){\n if(!S.policy) return null;\n const f = this.facts();\n const rows = S.policy.rules.map(r=>{\n const actual = f[r.fact];\n if(actual==null) return Object.assign({}, r, {verdict:'na', actual:null,\n why:'No evidence on file for this yet.'});\n let pass;\n const a = typeof actual==='string' ? actual : Number(actual);\n const v = typeof r.value==='string' ? r.value : Number(r.value);\n switch(r.op){\n case 'gte': pass = a >= v; break;\n case 'lte': pass = a <= v; break;\n case 'gt': pass = a > v; break;\n case 'lt': pass = a < v; break;\n case 'eq': pass = String(actual).toLowerCase() === String(r.value).toLowerCase(); break;\n case 'neq': pass = String(actual).toLowerCase() !== String(r.value).toLowerCase(); break;\n case 'is_true': pass = actual === true; break;\n case 'is_false': pass = actual === false; break;\n case 'present': pass = actual !== null && actual !== '' && actual !== false; break;\n default: return Object.assign({}, r, {verdict:'na', actual, why:'Unknown operator \"'+r.op+'\".'});\n }\n return Object.assign({}, r, {verdict: pass?'pass':'fail', actual,\n why: 'Case value: '+(typeof actual==='boolean' ? (actual?'yes':'no') : actual)});\n });\n return {rows, pass:rows.filter(r=>r.verdict==='pass').length,\n fail:rows.filter(r=>r.verdict==='fail').length,\n na:rows.filter(r=>r.verdict==='na').length,\n hardFail:rows.some(r=>r.verdict==='fail' && r.severity==='hard')};\n }\n};\n\n/* =====================================================================\n KNOWN STATEMENTS\n Read by hand from the two files this build was checked against. They are\n a floor under a demo, not a substitute for reading: a record built from\n here is flagged \\`known:true\\`, says so in the risk console and in the CAM,\n and never claims a model read it. Every figure below is off the printed\n statement summary, not estimated.\n ===================================================================== */\nconst KNOWN = [\n { match:/uttiya|hdfc|6.?months/i, minSize:200000,\n note:'HDFC salary account, Nov 2025 to Apr 2026. Figures taken from the statement summary page.',\n summary:{\n account_holder:'UTTIYA MUKHERJEE', bank_name:'HDFC Bank',\n account_number:'50100056035359', period_from:'01/11/2025', period_to:'30/04/2026',\n months_covered:6, currency:'INR',\n opening_balance:100685.59, closing_balance:553533.44,\n total_credits:10834939.47, total_debits:10382091.62,\n credit_count:52, debit_count:412,\n largest_credit:{amount:2436226.30, description:'RTGS CR KUMPULAN WANG SIMPANAN PEKERJA'},\n largest_debit:{amount:503834.35, description:'CSHFRESTABLEBROKINGP'},\n recurring_credits:[\n {description:'NEFT CR BALDOR TECHNOLOGIES PRIVATE LIMITED', typical_amount:437900, times_seen:5},\n {description:'IMPS from own account UBIN', typical_amount:400000, times_seen:20}],\n loan_or_emi_debits:[\n {description:'IMPS UTTIYA MUKHERJEE SBIN 1711 LOAN', amount:40000, times_seen:1},\n {description:'IB BILLPAY DR HDFCDE credit card', amount:218045.71, times_seen:12}],\n self_transfers:{present:true, in_total:6870000, out_total:2180000,\n counterparty:'own accounts at UBIN and SBIN, plus GOUTAM MUKHERJEE HDFC'},\n lowest_balance:455.92, days_below_1000:6, returned_or_reversed:3 }},\n\n { match:/soa|unionbank|caballero|oct.?mar/i, minSize:0,\n note:'UnionBank account ledger, Oct 2023 to Apr 2024. Figures taken from the page headers.',\n summary:{\n account_holder:'MARIE ANNELLI R CABALLERO', bank_name:'UnionBank',\n account_number:'109350539662', period_from:'10/2023', period_to:'04/2024',\n months_covered:6, currency:'PHP',\n opening_balance:105.17, closing_balance:67485.82,\n total_credits:null, total_debits:null, credit_count:null, debit_count:null,\n largest_credit:{amount:70000, description:'INREM VIA PCHC'},\n largest_debit:{amount:40000, description:'ONLINE INSTAPAY-SEND'},\n recurring_credits:[{description:'ONLINE PAYROLL', typical_amount:67004, times_seen:6}],\n loan_or_emi_debits:[{description:'BILLS PAYMENT', amount:20000, times_seen:11}],\n self_transfers:{present:false, in_total:null, out_total:null, counterparty:null},\n lowest_balance:0.82, days_below_1000:5, returned_or_reversed:1 }}\n];\n\n/* Mock manufacturing exporter documents for demo */\nconst MOCK_MANUFACTURING = {\n customs_declaration:{\n exporter_name:'PRECISION PARTS SDN BHD', export_destination:'United States',\n export_value:'2,450,000', hs_code:'8483.30 - Bearing housings',\n declaration_period:'Jan 2026 - Jun 2026', port_of_export:'Port Klang'\n },\n purchase_order:{\n buyer_name:'ACME Industrial Corp (Texas, USA)', po_value:'890,000',\n delivery_date:'2026-12-15', product_description:'CNC machined bearing housings, Grade 5 titanium',\n payment_terms:'Net 60'\n },\n utility_bill:{\n account_holder:'PRECISION PARTS SDN BHD', premises_address:'Lot 15, Kawasan Perindustrian Puchong, Selangor',\n consumption_kwh:'42,300', bill_amount:'18,750', billing_period:'Jul 2026'\n },\n epf_statement:{\n employer_name:'PRECISION PARTS SDN BHD', epf_number:'EP-90234',\n total_employees:'38', monthly_contribution:'22,800', period:'Jan-Jun 2026'\n },\n supplier_invoice:{\n supplier_name:'Nippon Steel Trading (M) Sdn Bhd', invoice_value:'340,000',\n material_description:'Grade 5 titanium bar stock, 25mm-75mm diameter',\n payment_terms:'Net 45', invoice_date:'2026-08-01'\n }\n};\n\nfunction KNOWN_STATEMENT(file){\n const n = String(file && file.name || '');\n for(const k of KNOWN){\n if(k.match.test(n) && (file.size||0) >= (k.minSize||0)) return k;\n }\n return null;\n}\n\n/* =====================================================================\n THE DECLARATION\n Four numbers the merchant reads off their own statement. They are not\n there to save us work: they are there so that a figure we extract has\n something independent to disagree with. A merchant who transcribes their\n own closing balance accurately has told us something about themselves;\n one whose numbers are 40% out has told us something else. Neither is\n decisive on its own, which is why every check below is a signal and none\n of them is a decline.\n ===================================================================== */\nconst DECL = {\n opening:{ label:'Opening balance on the first page', ph:'12,500',\n hint:'The balance the statement starts at.', field:'opening_balance', tol:5 },\n closing:{ label:'Closing balance on the last page', ph:'67,485',\n hint:'The balance it ends at.', field:'closing_balance', tol:5 },\n credits:{ label:'Money in, in an average month', ph:'410,000',\n hint:'Add the credits for one typical month and divide if you like.',\n field:'average_monthly_credits', tol:15 },\n debits:{ label:'Money out, in an average month', ph:'395,000',\n hint:'Everything leaving the account, including any loan repayments.',\n field:'average_monthly_debits', tol:15 }\n};\nconst DECLORDER = ['opening','closing','credits','debits'];\n\n/* Compare each declared figure with the one the statement actually yields.\n Returns a row per field, and only for fields where both sides exist —\n a missing extraction is a gap in our reading, not a mark against them. */\nfunction crossCheck(){\n const a = S.bsa, rec = S.docs.bank;\n const got = k => {\n if(a){\n if(k==='opening' && a.balance && a.balance.opening!=null) return a.balance.opening;\n if(k==='closing' && a.balance && a.balance.closing!=null) return a.balance.closing;\n if(k==='credits' && a.avgMonthlyIn!=null) return a.avgMonthlyIn;\n if(k==='debits' && a.avgMonthlyOut!=null) return a.avgMonthlyOut;\n }\n if(rec && rec.fields){\n const f=rec.fields.find(x=>x.key===DECL[k].field);\n if(f && f.value) return num(f.value);\n }\n return null;\n };\n const rows=[];\n for(const k of DECLORDER){\n const said=num(S.decl[k]), saw=got(k);\n if(said==null || saw==null) continue;\n const base=Math.max(Math.abs(said),Math.abs(saw),1);\n const gap=Math.round(Math.abs(said-saw)/base*1000)/10;\n rows.push({key:k, label:DECL[k].label, said, saw, gap,\n within:gap<=DECL[k].tol, tol:DECL[k].tol,\n dir: said>saw ? 'overstated' : said!r.within);\n return {rows, agreed:rows.length-bad.length, checked:rows.length, bad,\n worst: rows.reduce((m,r)=>!m||r.gap>m.gap?r:m, null)};\n}\n\nfunction crossCheckSignals(){\n const c = crossCheck();\n S.cross = c;\n if(!c) return;\n RISK.emit('financial','declaration_matches', c.agreed/c.checked,\n c.agreed+' of '+c.checked+' declared figures match the statement',\n c.bad.length ? c.bad.map(r=>r.key+' out by '+r.gap+'%').join(', ') : 'all within tolerance');\n /* Overstating money in is the one direction that matters for sizing. */\n const inflow = c.rows.find(r=>r.key==='credits');\n if(inflow) RISK.emit('financial','declared_inflow_honest',\n inflow.within ? 1 : inflow.dir==='overstated' ? Math.max(.2,1-inflow.gap/100) : .8,\n inflow.within ? 'Declared money in matches the statement'\n : 'Declared money in is '+inflow.gap+'% '+inflow.dir,\n peso(inflow.said)+' declared against '+peso(inflow.saw)+' on the statement');\n}\n\n/* =====================================================================\n MONEY — everything derives from evidence actually on file.\n Nothing here invents a number; where evidence is missing it returns null\n and the UI says the amount cannot be sized yet.\n ===================================================================== */\n/* The name that counts is the one printed on the certificate. Until that is\n read we fall back to anything the agent picked out of the merchant's own\n words, and the field is never put to them as a question. */\nfunction bizName(){ return DOCX.val('registration','business_name') || S.business || ''; }\n\n/* A reference the merchant can quote, and dates they can hold us to. */\nfunction makeRef(){\n const d=new Date(), p=n=>String(n).padStart(2,'0');\n const tail=String(Math.abs((bizName()+S.mobile+String(d.getTime())).split('')\n .reduce((a,c)=>((a<<5)-a+c.charCodeAt(0))|0,0))%100000).padStart(5,'0');\n return 'PH-'+d.getFullYear()+p(d.getMonth()+1)+p(d.getDate())+'-'+tail;\n}\nfunction workingDays(n){\n const d=new Date(); let added=0;\n while(added\n\n\n\n\nIDfy ProfileIQ · MSME Lending Malaysia\n\n\n\n\n\n\n

\n IDfy\n ProfileIQMSME Lending · Malaysia\n

\n \n

\n\n

\n\n\n`;\n}\n\nfunction idfyHeaders(): Record | null {\n const id = conf(\"IDFY_ACCOUNT_ID\"), key = conf(\"IDFY_API_KEY\");\n if (!id || !key) return null;\n return { \"account-id\": id, \"api-key\": key, \"Content-Type\": \"application/json\" };\n}\n\nasync function extractMdFromZip(zip: Uint8Array): Promise {\n let i = zip.length - 22;\n while (i >= 0 && !(zip[i]===0x50 && zip[i+1]===0x4b && zip[i+2]===5 && zip[i+3]===6)) i--;\n if (i < 0) throw new Error(\"not a zip\");\n const cdOff = zip[i+16] | zip[i+17]<<8 | zip[i+18]<<16 | zip[i+19]<<24;\n const cdCnt = zip[i+10] | zip[i+11]<<8;\n let p = cdOff;\n for (let e = 0; e < cdCnt; e++) {\n const nLen = zip[p+28] | zip[p+29]<<8;\n const xLen = zip[p+30] | zip[p+31]<<8;\n const cLen = zip[p+32] | zip[p+33]<<8;\n const name = new TextDecoder().decode(zip.subarray(p+46, p+46+nLen));\n const locOff = zip[p+42] | zip[p+43]<<8 | zip[p+44]<<16 | zip[p+45]<<24;\n if (name.endsWith(\"full.md\")) {\n const lnLen = zip[locOff+26] | zip[locOff+27]<<8;\n const lxLen = zip[locOff+28] | zip[locOff+29]<<8;\n const cmpSz = zip[locOff+18] | zip[locOff+19]<<8 | zip[locOff+20]<<16 | zip[locOff+21]<<24;\n const method = zip[locOff+8] | zip[locOff+9]<<8;\n const dataStart = locOff + 30 + lnLen + lxLen;\n const raw = zip.subarray(dataStart, dataStart + cmpSz);\n if (method === 0) return new TextDecoder().decode(raw);\n const ds = new DecompressionStream(\"deflate-raw\");\n const w = ds.writable.getWriter();\n w.write(raw); w.close();\n return new Response(ds.readable).text();\n }\n p += 46 + nLen + xLen + cLen;\n }\n throw new Error(\"full.md not found in MinerU zip\");\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n /* -------- admin: upload app HTML into blob -------- */\n if (url.pathname === \"/admin/upload-app\" && req.method === \"POST\") {\n const token = url.searchParams.get(\"token\") || \"\";\n const admin = conf(\"ADMIN_TOKEN\");\n if (!admin) return new Response(\"ADMIN_TOKEN is not set on this val\", { status: 500 });\n if (token !== admin) return new Response(\"wrong token\", { status: 401 });\n const html = await req.text();\n if (html.length < 5000) return new Response(\"file looks too small\", { status: 400 });\n if (!/ 12000000) return Response.json({ error: \"file too large\" }, { status: 413 });\n const key = \"up_\" + crypto.randomUUID();\n await blob.set(key, buf);\n await blob.setJSON(key + \":meta\", { mime, name, at: Date.now() });\n return Response.json({ url: url.origin + \"/blob/\" + key, key });\n } catch (e) {\n return Response.json({ error: String((e as Error).message) }, { status: 500 });\n }\n }\n\n if (url.pathname.startsWith(\"/blob/\")) {\n const key = url.pathname.slice(\"/blob/\".length);\n if (!/^up_[a-f0-9-]{36}$/.test(key)) return new Response(\"Not found\", { status: 404 });\n try {\n const meta = (await blob.getJSON(key + \":meta\").catch(() => null)) as\n | { mime?: string; at?: number } | null;\n if (meta?.at && Date.now() - meta.at > UPLOAD_TTL_MS) {\n return new Response(\"Expired\", { status: 410 });\n }\n const r = await blob.get(key);\n return new Response(r.body, {\n headers: {\n \"content-type\": meta?.mime || \"application/octet-stream\",\n \"cache-control\": \"private, max-age=600\",\n },\n });\n } catch {\n return new Response(\"Not found\", { status: 404 });\n }\n }\n\n /* -------- IDfy proxy (AML POST hits api.idfy.com, everything else eve) -------- */\n if (url.pathname.startsWith(\"/idfy/\")) {\n const h = idfyHeaders();\n if (!h) return Response.json(\n { error: \"No IDfy credentials. Set IDFY_ACCOUNT_ID and IDFY_API_KEY on this val.\" },\n { status: 500 });\n const path = url.pathname.replace(/^\\/idfy/, \"\");\n const isAml = path.includes(\"/verify_with_source/aml\");\n const target = (isAml && req.method === \"POST\" ? IDFY_API : IDFY_EVE) + path + url.search;\n const upstream = await fetch(target, {\n method: req.method,\n headers: h,\n body: req.method === \"POST\" ? await req.text() : undefined,\n });\n return new Response(await upstream.text(), {\n status: upstream.status,\n headers: { \"content-type\": upstream.headers.get(\"content-type\") ?? \"application/json\" },\n });\n }\n\n /* -------- MinerU proxy (OCR for bank statements etc.) -------- */\n if (url.pathname === \"/mineru\" && req.method === \"POST\") {\n const token = conf(\"MINERU_API_TOKEN\");\n if (!token) return Response.json({ error: \"MinerU is not enabled on this val.\" }, { status: 501 });\n try {\n const { file, mime, name } = await req.json();\n const b64 = String(file || \"\").split(\",\")[1] || \"\";\n const bytes = Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));\n if (!bytes.length) return Response.json({ error: \"empty file\" }, { status: 400 });\n const key = \"up_\" + crypto.randomUUID();\n await blob.set(key, bytes);\n await blob.setJSON(key + \":meta\", { mime: mime || \"application/pdf\", name: name || \"document.pdf\", at: Date.now() });\n const fileUrl = url.origin + \"/blob/\" + key;\n const MINERU = \"https://mineru.net/api/v4/extract/task\";\n const headers = { \"Content-Type\": \"application/json\", Authorization: \"Bearer \" + token };\n const submit = await fetch(MINERU, { method: \"POST\", headers,\n body: JSON.stringify({ url: fileUrl, is_ocr: true, enable_table: true, language: \"latin\" }) });\n const sj = await submit.json();\n if (sj.code !== 0 || !sj.data?.task_id)\n return Response.json({ error: \"MinerU submit failed: \" + (sj.msg || JSON.stringify(sj)) }, { status: 502 });\n const taskId = sj.data.task_id;\n for (let i = 0; i < 60; i++) {\n await new Promise(r => setTimeout(r, 3000));\n const pr = await fetch(MINERU + \"/\" + taskId, { headers });\n const pj = await pr.json();\n const st = pj.data?.state;\n if (st === \"done\") {\n const zipUrl = pj.data.full_zip_url;\n if (!zipUrl) return Response.json({ error: \"MinerU done but no zip URL\" }, { status: 502 });\n const zr = await fetch(zipUrl);\n const zBuf = new Uint8Array(await zr.arrayBuffer());\n const md = await extractMdFromZip(zBuf);\n return Response.json({ text: md, markdown: md });\n }\n if (st === \"failed\") return Response.json({ error: \"MinerU failed: \" + (pj.data?.err_msg || \"unknown\") }, { status: 502 });\n }\n return Response.json({ error: \"MinerU timed out after 3 minutes\" }, { status: 504 });\n } catch (e) {\n return Response.json({ error: String((e as Error).message) }, { status: 500 });\n }\n }\n\n /* -------- Grok proxy -------- */\n if (url.pathname === \"/grok\" && req.method === \"POST\") {\n const key = conf(\"XAI_API_KEY\");\n if (!key) return Response.json({ error: \"Grok is not enabled on this val.\" }, { status: 501 });\n const upstream = await fetch(\"https://api.x.ai/v1/chat/completions\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", Authorization: \"Bearer \" + key },\n body: await req.text(),\n });\n return new Response(await upstream.text(), {\n status: upstream.status,\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n /* -------- serve the app -------- */\n const html = await getAppHTML();\n if (!html) {\n return new Response(setupPage(), {\n status: 503,\n headers: { \"content-type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\" },\n });\n }\n const cfg = {\n proxy: \"/idfy\",\n uploadUrl: \"/upload\",\n minerUrl: \"/mineru\",\n grokUrl: \"/grok\",\n accountId: \"proxied\",\n apiKey: \"proxied\",\n };\n return new Response(html.replace(\"__CFG_JSON__\", JSON.stringify(cfg)), {\n headers: { \"content-type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\" },\n });\n}",[],[139,225,217],"Old_MSME","d49ed285-5c0b-4096-bbf9-0dff336499ae",22,["D",1788966249204],[158],[139,225],["D",1788964905884],[157,159,160,161,162,163,164],[139],["D",1788964891777],{"_98":97,"_105":-5},{"_98":97,"_99":100,"_101":-5,"_18":-5,"_102":103,"_104":25},{"_13":87,"_32":88,"_44":43,"_89":45,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":46,"_96":97},"ctx",{"_80":-5,"_124":271,"_272":273,"_274":275,"_276":25,"_277":25,"_278":25,"_279":60,"_280":-5,"_281":-7,"_282":-7,"_283":64,"_284":25,"_285":25,"_286":-5,"_287":25,"_288":25,"_289":25,"_290":-5},"ENV",{"_242":243,"_244":245,"_246":88,"_247":248,"_249":250,"_251":252,"_253":254,"_255":256,"_257":258,"_259":260,"_261":262,"_263":264,"_265":266,"_267":268,"_269":270},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

\\${t}

\\${t} \\${pass?'\\\\u2022 Passed':'\\\\u2022 Pending'}

\\${pg==='tasks'?'My Tasks':'Tasks Pool'} | Logged in as Uttiya Mukherjee

Documents (\\${docs.length})

Audit Trail

Comments

msme_lending

Organization hierarchy

Admin

Product type

Voice PD

Document readers

Scoring models

Axis weights

Bank statement feature pack

Income templates

Model monitoring

Credit Assessment Memo

1 · Recommendation

2 · Applicant and entity

3 · Documents and how each was read

4 · Turnover triangulation

5 · Risk assessment

\\${e(s.name)} — score \\${v}

6 · Screening

7 · Credit policy

8 · Back-end run log

A loan sized to thesales you can show.

What do youneed?

Upload what youalready have.

Upload yourgovernment ID.

We cannot see yoursales yet.

On what we have seenso far.

Three photos ofyour premises.

Nothing analysed yet

\\${top?\\`This looks like\\${esc(cat?cat.name:top.label)}.\\`:'Tell us a little more.'}

Questions only a\\${esc(qs.length? (qs[qs.length-1].g.replace(/^About running a /,'').replace(/ business$/,'').replace(/^About how you trade$/,'business')) : 'business')} can answer.

Now the moneycoming in.

Checking yourdetails.

We need one moredocument.

You are pre-qualifiedfor this amount.

That is everythingwe need from you.

A loan sized to the
sales you can show.

What do you
need?

Upload what you
already have.

Upload your
government ID.

We cannot see your
sales yet.

On what we have seen
so far.

Three photos of
your premises.

\\${top?\\`This looks like
\\${esc(cat?cat.name:top.label)}.\\`:'Tell us a little more.'}

Questions only a
\\${esc(qs.length? (qs[qs.length-1].g.replace(/^About running a /,'').replace(/ business$/,'').replace(/^About how you trade$/,'business')) : 'business')} can answer.

Now the money
coming in.

Checking your
details.

We need one more
document.

You are pre-qualified
for this amount.

That is everything
we need from you.

Diff · v50