/* ============================================================ CurrencyDesk OS — base layer Palette, icons, seed data, helpers, and the rate bridge that connects the back office to the live rate engine (yorkfx-converter.js). Everything is hung off window.CDOS so the other babel files can read it. ============================================================ */ (function () { const { useState } = React; /* black/white "Rate Board" palette + semantic compliance colors. Every CD value is a CSS custom property so the whole OS can re-skin (light / dark) by flipping ONE attribute on — no component needs to know which theme is active. The literal values live in CD_THEMES; injectThemeVars() writes them as --cd-* tokens. */ const CD_THEMES = { light: { ink: '#0a0a0a', inkSoft: '#171717', inkStrong: '#000000', onInk: '#ffffff', onInkSoft: 'rgba(255,255,255,0.65)', onInkFaint: 'rgba(255,255,255,0.22)', desk: '#e6e4de', paper: '#f4f3f0', paperSoft: '#faf9f6', panel: '#ffffff', chip: '#f1f0ec', chipDeep: '#e3e0d8', line: 'rgba(10,10,10,0.14)', lineSoft: 'rgba(10,10,10,0.07)', text: '#0a0a0a', mute: 'rgba(10,10,10,0.55)', faint: 'rgba(10,10,10,0.4)', hoverSoft: 'rgba(10,10,10,0.04)', hover: 'rgba(10,10,10,0.06)', hoverStrong: 'rgba(10,10,10,0.10)', shade: 'rgba(10,10,10,0.22)', scrim: 'rgba(10,10,10,0.5)', disabled: '#bdbcb3', brass: '#9a7406', brassSoft: '#f3e7c8', brassText: '#6b5119', /* amber accent (sparingly) */ flag: '#c0392b', flagSoft: '#f7e1dd', green: '#1f8a4c', greenSoft: '#dcefe4', amber: '#9a6b1f', amberSoft: '#f5e8cf' }, /* warm charcoal night surface — ink flips to warm white, the colour accents brighten a step so they hold contrast on dark panels, and "soft" tints become translucent washes of their accent. */ dark: { ink: '#eceae3', inkSoft: '#dedbd2', inkStrong: '#ffffff', onInk: '#131210', onInkSoft: 'rgba(19,18,16,0.66)', onInkFaint: 'rgba(19,18,16,0.26)', desk: '#131210', paper: '#161513', paperSoft: '#1a1917', panel: '#1e1d1a', chip: '#262521', chipDeep: '#2f2d28', line: 'rgba(255,255,255,0.16)', lineSoft: 'rgba(255,255,255,0.08)', text: '#eceae3', mute: 'rgba(236,234,227,0.58)', faint: 'rgba(236,234,227,0.4)', hoverSoft: 'rgba(255,255,255,0.05)', hover: 'rgba(255,255,255,0.07)', hoverStrong: 'rgba(255,255,255,0.12)', shade: 'rgba(255,255,255,0.24)', scrim: 'rgba(0,0,0,0.62)', disabled: '#514f47', brass: '#d9a92c', brassSoft: 'rgba(217,169,44,0.16)', brassText: '#e5c56a', flag: '#e0604f', flagSoft: 'rgba(224,96,79,0.15)', green: '#36ad6d', greenSoft: 'rgba(54,173,109,0.15)', amber: '#d99c3f', amberSoft: 'rgba(217,156,63,0.15)' } }; const cdVar = (k) => 'var(--cd-' + k.replace(/[A-Z]/g, c => '-' + c.toLowerCase()) + ')'; const CD = {}; Object.keys(CD_THEMES.light).forEach(k => { CD[k] = cdVar(k); }); /* ---- theme controller: persisted per device, applied on ---- */ const THEME_KEY = 'cdos_theme'; const themePref = () => { try { return localStorage.getItem(THEME_KEY) || 'light'; } catch (e) { return 'light'; } }; const resolveTheme = (p) => p === 'auto' ? (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light') : (p === 'dark' ? 'dark' : 'light'); const applyTheme = (p) => { const t = resolveTheme(p || themePref()); document.documentElement.setAttribute('data-cdtheme', t); document.documentElement.style.colorScheme = t; /* native controls, scrollbars */ }; const setThemePref = (p) => { try { localStorage.setItem(THEME_KEY, p); } catch (e) {} applyTheme(p); try { window.dispatchEvent(new CustomEvent('cdos-theme', { detail: { pref: p, resolved: resolveTheme(p) } })); } catch (e) {} }; if (window.matchMedia) { try { window.matchMedia('(prefers-color-scheme: dark)').addEventListener('change', () => { if (themePref() === 'auto') applyTheme('auto'); }); } catch (e) {} } /* write the token sets once. `.cd-paper-island` re-pins the light values on a subtree — used for surfaces that simulate PRINT (receipts, sealed report paper) so they stay paper-white even in dark mode. */ (function injectThemeVars() { const decl = (t) => Object.keys(t).map(k => ' --cd-' + k.replace(/[A-Z]/g, c => '-' + c.toLowerCase()) + ': ' + t[k] + ';').join('\n'); const el = document.createElement('style'); el.id = 'cdos-theme-vars'; el.textContent = ':root {\n' + decl(CD_THEMES.light) + '\n}\n' + 'html[data-cdtheme="dark"] {\n' + decl(CD_THEMES.dark) + '\n}\n' + 'html[data-cdtheme="dark"] .cd-paper-island {\n' + decl(CD_THEMES.light) + '\n color-scheme: light;\n}\n' + /* Tailwind's .text-white sits on CD.ink / accent buttons all over the modules; in dark mode those backgrounds turn light, so the label flips to the on-ink token. Paper islands keep true white. */ 'html[data-cdtheme="dark"] .text-white { color: var(--cd-on-ink); }\n' + 'html[data-cdtheme="dark"] .cd-paper-island .text-white { color: #ffffff; }\n'; document.head.appendChild(el); applyTheme(); })(); const ICONS = { lock:'', smartphone:'', search:'', plus:'', trash:'', download:'', building:'', logout:'', chev:'', calc:'', users:'', x:'', alert:'', shield:'', receipt:'', dash:'', coins:'', scroll:'', ledgerbook:'', gear:'', id:'', printer:'', upload:'', del:'', globe:'', clock:'', bars:'', rateboard:'', telegraphbubble:'', minus:'', grip:'', grid4:'', calendar:'', mail:'', phone:'', cake:'', mappin:'', briefcase:'', camera:'', pencil:'', pie:'', arrowleft:'', sparkle:'', percent:'', bag:'', send:'', transferarrows:'', cheque:'', clientskyc:'', complianceshield:'', reportsdoc:'', pricingpercent:'', dashboardgrid:'', aispark:'', tilldrawer:'', vaultsafe:'', branchnet:'', audittrail:'', calcdevice:'', calcmono:'', loancentre:'', taggedbookmark:'', gearsettings:'', storefront:'', power:'', check:'', checkcircle:'', filetext:'', userplus:'', ban:'', arrowdown:'', arrowup:'', trendup:'', trenddown:'', wallet:'', card:'', star:'', activity:'', target:'', arrowright:'', swap:'', info:'', note:'', bookmark:'', tag:'' }; function Ic({ n, s = 16, c = 'currentColor' }) { return React.createElement('svg', { width: s, height: s, viewBox: '0 0 24 24', fill: 'none', stroke: c, strokeWidth: 2, strokeLinecap: 'round', strokeLinejoin: 'round', style: { flexShrink: 0 }, dangerouslySetInnerHTML: { __html: ICONS[n] || '' } }); } /* ---- domain constants ---- */ const TYPES = ['Currency Exchange', 'Remittance — Send', 'Remittance — Receive', 'Cheque Cashing', 'Money Order', 'Bill Payment']; const CCY = ['CAD', 'USD', 'EUR', 'GBP', 'INR', 'PHP', 'CNY', 'MXN', 'AED']; /* ============================================================ WHAT ACTUALLY CROSSED THE COUNTER, IN CASH A row's `inAmt`/`inCcy` is what the deal was FOR. It is not necessarily cash, and on one line it is not even money that moved in this shop: a remittance RECEIVE carries the foreign sum a sender abroad dispatched — 16,000 pesos — while the only thing that crossed this counter is the smaller home-currency payout, going the other way. The large-cash report is a report about CASH RECEIVED. Built on `inAmt` it reads that payout as 16,000 pesos taken in and files a cash report against a customer who handed the desk nothing; a cheque cashing files one against a customer who handed over a cheque. Both are false filings, and the second is the kind a desk is asked to explain. The server settles this. `cash_in_home` and `cash_out_home` on `ledger_transactions` (migration 018) are the RECORDED figures and they are the authority — this table exists only because the browser's compliance engine still reasons over its own row store, and it must say the same thing the book does. It is written as a table rather than a rule so the two can be checked against each other by eye. An unknown type is treated as cash in. That is deliberate: the failure this table prevents is over-reporting, and the failure it could introduce is under-reporting. Only one of those gets a desk fined, so anything not named here keeps the old behaviour and shows up in a report somebody reads. ============================================================ */ const COUNTER_CASH = { /* cash over the counter both ways */ 'Currency Exchange': { in: true, out: true }, /* cash in; what leaves is a wire to a corridor partner */ 'Remittance — Send': { in: true, out: false }, /* nothing in; the desk counts out the payout */ 'Remittance — Receive': { in: false, out: true }, /* a cheque is not cash. The desk pays cash out against it */ 'Cheque Cashing': { in: false, out: true }, /* cash in; what leaves is the instrument itself */ 'Money Order': { in: true, out: false }, /* cash in; what leaves is a credit to somebody's account */ 'Bill Payment': { in: true, out: false }, }; /** The cash a row took in, as `{ amount, ccy }`, or null if none did. */ function counterCashIn(row) { if (!row) return null; const rule = COUNTER_CASH[row.type]; if (rule && !rule.in) return null; return { amount: Number(row.inAmt) || 0, ccy: row.inCcy }; } /** The cash a row paid out, as `{ amount, ccy }`, or null if none did. */ function counterCashOut(row) { if (!row) return null; const rule = COUNTER_CASH[row.type]; if (rule && !rule.out) return null; return { amount: Number(row.outAmt) || 0, ccy: row.outCcy }; } /* ============================================================ THE HOME-CURRENCY SIZE OF A DEAL One rule, and it is the server's: a deal's size in the desk's own money is whichever of its two legs IS that currency. The note above `volume_home` in server/src/ledger/reporting.ts states it, and this is here so the browser can say the same thing rather than a similar thing. What it replaced converted the IN leg at today's board mid whatever currency that leg was in, and that is wrong twice over. A foreign-to-foreign cross has no home leg at all, and a mid between two foreign currencies multiplied out is a number in neither of them. And a remittance receive's in-leg is the foreign sum a sender abroad dispatched: 16,000 pesos re-priced at today's mid came to $388.82 while the book carried $382.97, the amount the desk actually counted out. The Ledger's Pay-in volume and the ledger's own summary differed by exactly that — two books for one headline, which is what docs/CASH_OWNERSHIP_INVARIANTS.md exists to forbid. Null means this book cannot value that deal. Not zero, and not a price nobody quoted — docs/ABSENT_FIGURES.md. ============================================================ */ function dealHome(row, home) { if (!row || !home) return null; if (row.inCcy === home) return Number(row.inAmt) || 0; if (row.outCcy === home) return Number(row.outAmt) || 0; return null; } /** Volume over a set of rows, and how many of them it could not value. */ function sumDealHome(rows, home) { let total = 0, valued = 0, unvalued = 0; (rows || []).forEach(row => { const v = dealHome(row, home); if (v == null) { unvalued += 1; return; } total += v; valued += 1; }); return { total: valued ? total : null, valued, unvalued }; } /* ============================================================ TWO KINDS OF "TODAY", AND THEY ARE NOT THE SAME THING This line used to read `const TODAY = '2026-06-18'`. Every New Transaction ticket was headed with that date while the server posted the deal under the real one; cash-rail movements were minted with references like MV-260618-01; and the drawer's history table labelled the 2026-06-18 row TODAY under a session banner showing the real date. A teller read a seven-week-old date back to a customer, and an audit trail carried it. There are two distinct questions behind the word, and a call site wants exactly one of them: wallClock() what time is it, on this machine, right now. For "posted at 14:32", for greeting somebody good morning, for the clock in a receipt footer. businessDate() which TRADING DAY the desk is working in. The till session carries it (`business_date`), the server decides it, and it is what belongs on a movement reference, a day's close-out and anything that has to line up with the book afterwards. A branch that opened its session before midnight is still on yesterday's business date at 00:05, and that is the correct answer, not a bug. They coincide most of the time, which is precisely why getting them confused is cheap to do and expensive to find. `TODAY` remains exported as the wall-clock date so that files this change does not own keep working — but it is a SNAPSHOT taken when the page loaded. Anything that must survive a desk left open overnight should call wallClock() or businessDate() instead. */ const wallClock = () => new Date().toLocaleDateString('en-CA'); // YYYY-MM-DD, local /* What the server says this till's trading day is. Null until a session has been read — and null means "not known yet", so businessDate() falls back to the wall clock rather than to a made-up date. */ let _businessDate = null; const businessDate = () => _businessDate || wallClock(); const setBusinessDate = (date) => { const next = date ? String(date).slice(0, 10) : null; if (next === _businessDate) return _businessDate; _businessDate = next; try { window.dispatchEvent(new CustomEvent('cdos-business-date', { detail: { date: _businessDate } })); } catch (e) {} return _businessDate; }; /* Ask the ledger which trading day this till is in. Cheap, idempotent, and safe before sign-in — an unauthenticated answer simply leaves the business date unknown and the wall clock standing in for it. */ async function refreshBusinessDate() { try { const B = window.CDOS && window.CDOS.Backend; if (!B) return businessDate(); const answer = await B.loadTillSession(); if (answer && answer.session && answer.session.businessDate) setBusinessDate(answer.session.businessDate); } catch (e) { /* no session, no server, or not signed in: the clock stands in */ } return businessDate(); } /* The window a "today" figure covers, as two instants, from the desk's own midnight. The server deliberately refuses to guess this — see the note on LedgerReportingService.summary — because a business day belongs to a branch's clock and this browser is standing in the branch. `days` looks back that many days from the business date. */ function businessDayWindow(days) { const end = new Date(businessDate() + 'T00:00:00'); end.setDate(end.getDate() + 1); const start = new Date(end); start.setDate(start.getDate() - Math.max(1, days || 1)); return { from: start.toISOString(), to: end.toISOString() }; } const TODAY = wallClock(); /* ============================================================ THE REPORTING LINE — one number, in the desk's own money `const THRESHOLD = 10000` sat here, hardcoded, in Canadian dollars. The Ledger flagged reportable rows against it, warned the teller against it and printed it in the report footer; Reports used it in four more places. Meanwhile Compliance, LCTR, KYC and the Dashboard all honoured `settings.threshold` through getRegime(). The same desk flagged at two different numbers on two different screens, and a UAE desk operating on 55,000 AED got a Canadian figure with a dollar sign in front of it. reportingLimit() is the one answer. In precedence order: 1. what the DESK has set the server's per-entity override 2. what the jurisdiction pack says the server's pack, per entity 3. what the owner set in Settings settings.threshold 4. what the regime engine says getRegime(), the browser's packs and the currency comes from the pack first, because home currency is the pack's to state — it is the whole point of shipping a Canada pack and a UK pack rather than hardcoding one country. Note where the owner's setting now sits. It used to be first, and it was browser state: whatever this browser profile last saved. That is the wrong authority for a compliance line — the second till at the same desk held its own copy, a cleared browser held none, and the server enforcing the ID gate could not see any of it. The desk's number now lives on the ledger and comes back at (1); (3) survives only for the standalone build, which has no server to ask. `amount` is null when nothing can answer. A screen showing a threshold it cannot state must say so; flagging every deal against a number nobody chose is how this went wrong the first time. */ let _pack = null; const deskPack = () => _pack; /* The forms this jurisdiction files, alongside the pack that defines them — the filing portal, the aggregation window, the trigger amount. They arrive in the same answer as the pack and were being dropped on the floor, so the LCTR worksheet issued its own duplicate request per session to get them back. Kept together because they are one fact. */ let _reports = []; const deskReports = () => _reports; /* ============================================================ WHICH CURRENCIES THIS DESK DEALS IN The browser used to answer this itself, from a literal: const LEDGER_CCYS = ['CAD', 'USD', 'EUR', 'GBP']; // cdos-os.jsx — and it checked that list BEFORE calling the server, so a shop holding pesos was refused by its own screen with the words "PHP is not carried by the server ledger yet". The ledger had no such opinion; a matching four-way enum on the route did, and the two agreed only because somebody kept them in step by hand. It arrives with the jurisdiction now, from the one place that can answer it. `stated` is the owner's own set or NULL, and NULL is not an empty set — it means nobody restricted anything. `suggested` is what a dropdown should offer. `minorUnits` carries only the exceptions to two places, so a screen never quotes ¥1,234.56. ============================================================ */ let _currencies = null; const deskCurrencies = () => _currencies; /** How many decimal places this currency is actually paid in. */ const currencyPlaces = (code) => { const known = _currencies && _currencies.minorUnits; const stated = known && known[String(code || '').toUpperCase()]; return typeof stated === 'number' ? stated : 2; }; /** Does this desk deal in it? True where nobody has restricted anything. */ const deskTrades = (code) => { const want = String(code || '').toUpperCase(); if (!_currencies) return true; if (!_currencies.stated) return true; return _currencies.stated.indexOf(want) >= 0; }; /** What a currency picker should offer, home first. */ const deskCurrencyList = () => { const set = _currencies && (_currencies.stated || _currencies.suggested); return Array.isArray(set) && set.length ? set.slice() : CCY.slice(); }; const setDeskPack = (pack, reports, currencies) => { _pack = pack || null; if (reports !== undefined) _reports = Array.isArray(reports) ? reports : []; if (currencies !== undefined) _currencies = currencies || null; try { window.dispatchEvent(new CustomEvent('cdos-jurisdiction', { detail: { pack: _pack, reports: _reports, currencies: _currencies } })); } catch (e) {} return _pack; }; async function refreshJurisdiction() { try { const B = window.CDOS && window.CDOS.Backend; if (!B) return _pack; const answer = await B.loadJurisdiction(); if (answer && answer.pack) setDeskPack(answer.pack, answer.reports, answer.currencies); } catch (e) { /* not signed in, or a desk with no pack yet */ } return _pack; } /* The desk's own lines, as the ledger resolved them: each of reportThreshold / idThreshold / aggregationHours / retentionYears as { effective, deskChoice, packValue, posture }. Cached in module state beside the pack and refreshed by the same hook, because every screen that shows a threshold wants the same answer and none of them should be asking for itself. */ let _thresholds = null; const deskThresholds = () => _thresholds; const setDeskThresholds = (answer) => { _thresholds = answer || null; try { window.dispatchEvent(new CustomEvent('cdos-thresholds', { detail: { thresholds: _thresholds } })); } catch (e) {} return _thresholds; }; async function refreshDeskThresholds() { try { const B = window.CDOS && window.CDOS.Backend; if (!B) return _thresholds; const answer = await B.loadDeskThresholds(); if (answer && answer.idThreshold) setDeskThresholds(answer); } catch (e) { /* not signed in, or the standalone build with no server */ } return _thresholds; } const _positive = (v) => v != null && v !== '' && !isNaN(v) && +v > 0; /* One resolved line off the server's answer, or null. `effective` is already the desk's choice where it made one and the pack's where it did not — the precedence was decided on the server, once, so that the number the screen prints and the number the gate enforces cannot drift apart. */ const _serverLine = (key) => { const line = _thresholds && _thresholds[key]; return line && _positive(line.effective) ? +line.effective : null; }; function reportingLimit(settings) { const regime = (window.CDOS && window.CDOS.getRegime) ? window.CDOS.getRegime(settings) : null; const amount = _serverLine('reportThreshold') != null ? _serverLine('reportThreshold') : (_pack && _positive(_pack.reportThreshold)) ? +_pack.reportThreshold : _positive(settings && settings.threshold) ? +settings.threshold : (regime && _positive(regime.threshold)) ? +regime.threshold : null; const currency = (_pack && _pack.homeCurrency) || (settings && settings.baseCurrency) || (regime && regime.currency) || null; return { amount, currency, /* What the regulator calls the report this line triggers — "LCTR" in Canada, "CTR" in the United States. Screens print it; none of them should be spelling it out for themselves. */ /* THE PACK FIRST. getRegime() falls back to FINTRAC whenever settings.regime is unset, so reading it first handed a London desk the code "LCTR" — a Canadian form, named confidently, on a report the desk does not file. The pack is the thing that actually knows which form this jurisdiction uses. */ code: (_pack && _pack.reportName) || (regime && regime.largeCode) || 'report', label: amount == null || !currency ? '—' : fmt(amount, currency), }; } /* Is this deal over the line? Null-safe on purpose: with no threshold to compare against, the honest answer is "cannot say", and a screen that turns that into `false` has quietly cleared a deal nobody checked. */ const overReportingLimit = (homeAmount, settings) => { const limit = reportingLimit(settings); return limit.amount == null ? null : (+homeAmount || 0) >= limit.amount; }; /* The line at which this desk asks for identification — the other half of the pair, and the one the LEDGER refuses a deal at. Same precedence, same currency, same null. A screen quoting a different number from the one the server will enforce is how a teller ends up arguing with a refusal they were told would not come. */ function identificationLimit(settings) { const regime = (window.CDOS && window.CDOS.getRegime) ? window.CDOS.getRegime(settings) : null; const amount = _serverLine('idThreshold') != null ? _serverLine('idThreshold') : (_pack && _positive(_pack.idThreshold)) ? +_pack.idThreshold : _positive(settings && settings.idRequiredOver) ? +settings.idRequiredOver : (regime && _positive(regime.idAt)) ? +regime.idAt : null; const currency = (_thresholds && _thresholds.currency) || (_pack && _pack.homeCurrency) || (settings && settings.baseCurrency) || (regime && regime.currency) || null; return { amount, currency, label: amount == null || !currency ? '—' : fmt(amount, currency) }; } /* Staff directory seed. Per the Branch & Access Model spec: a role carries capabilities (ROLE_CAPS) AND a scope (ROLE_SCOPE); assignments say WHERE the role applies — branches: '*' (owner) or an array of branch ids, with one home branch. S. Iqbal is deliberately unassigned to demo the R1 stop screen. The live, editable copy lives in settings.employees. */ /* EVERY ONE OF THESE IS MARKED `demo`, AND THAT MATTERS. These five are the rehearsal desk's staff. On a browser that has never signed in to a real desk they are the whole directory — which is fine for the demo and was quietly wrong on the sign-in screen, where they were offered to real returning customers as EXAMPLES of what to type. Somebody who runs their own shop was being shown two strangers' staff IDs and told to pick one. The flag is what lets that screen tell "this desk's people" from "nobody's people". Anything adopted from the server is unmarked. */ const STAFF = [ { name: 'J. Masri', role: 'Owner', staffId: 'j.masri', branches: '*', home: null, demo: true }, { name: 'R. Haddad', role: 'Manager', staffId: 'r.haddad', branches: ['b02'], home: 'b02', demo: true }, { name: 'A. Singh', role: 'Senior teller', staffId: 'a.singh', branches: ['b01'], home: 'b01', demo: true }, { name: 'M. Costa', role: 'Cashier', staffId: 'm.costa', branches: ['b01', 'b02'], home: 'b01', demo: true }, { name: 'S. Iqbal', role: 'Trainee', staffId: 's.iqbal', branches: [], home: null, demo: true }, ]; /* scope axis: how much of the network a role can see/act on. network = everything · branch = their assigned branch(es), all tills till = their assigned till only (no self-serve till switching) */ const ROLE_SCOPE = { 'Owner': 'network', 'Manager': 'branch', 'Senior teller': 'branch', 'Cashier': 'till', 'Trainee': 'till' }; /* capability preset per role. Owner is implicitly all-access. These mirror the one-click presets in Settings → Permissions; switching account applies the matching preset to the shared Teller config so each role can be previewed live. Anyone who isn't the Owner is a "teller" for scoping purposes. */ const ROLE_CAPS = { 'Owner': { canDelete: true, canExport: true, canViewReports: true, canEditKYC: true, canSettings: true, canCloseDay: true }, 'Manager': { canDelete: true, canExport: true, canViewReports: true, canEditKYC: true, canSettings: true, canCloseDay: true }, 'Senior teller': { canDelete: true, canExport: true, canViewReports: true, canEditKYC: true, canSettings: false, canCloseDay: true }, 'Cashier': { canDelete: false, canExport: false, canViewReports: false, canEditKYC: true, canSettings: false, canCloseDay: false }, 'Trainee': { canDelete: false, canExport: false, canViewReports: false, canEditKYC: false, canSettings: false, canCloseDay: false }, }; /* ---- rate bridge: prefer the live engine, fall back to a local table ---- */ const PER_CAD = { CAD: 1, USD: 0.731, EUR: 0.676, GBP: 0.581, INR: 62.4, PHP: 41.2, CNY: 5.28, MXN: 13.1, AED: 2.68 }; function crossRate(inC, outC) { if (typeof convRate === 'function' && typeof BY !== 'undefined' && BY[inC] && BY[outC]) { return +convRate(inC, outC).toFixed(4); } return +(PER_CAD[outC] / PER_CAD[inC]).toFixed(4); } function perCadLive(code) { if (typeof BY !== 'undefined' && BY[code]) return +BY[code].perCad.toFixed(code === 'CAD' ? 0 : 4); return PER_CAD[code]; } /* ---- rate book bridge (Rate Board ↔ Ledger) ---- A "book" is a { CODE: perCad } map where perCad = units of that currency per 1 CAD (matching the engine's BY[code].perCad). publishedBook() reads the staff-published board from localStorage; applyBook() pushes a book into the live engine so crossRate()/perCadLive() immediately reflect it; bookSig() gives a cheap change-key. */ function publishedBook() { const book = {}; const list = (typeof CUR !== 'undefined' ? CUR : []); list.forEach(c => { book[c.code] = c.perCadDefault != null ? c.perCadDefault : c.perCad; }); if (!list.length) Object.keys(PER_CAD).forEach(k => { book[k] = PER_CAD[k]; }); try { const cfg = JSON.parse(localStorage.getItem('yorkfx_rates_v1') || 'null'); if (cfg && cfg.rows) Object.keys(cfg.rows).forEach(code => { const r = cfg.rows[code]; if (r && typeof r.mid === 'number' && r.mid > 0 && book[code] != null) book[code] = 1 / r.mid; }); } catch (e) {} return book; } function applyBook(book) { if (!book) return; Object.keys(book).forEach(code => { if (typeof BY !== 'undefined' && BY[code]) BY[code].perCad = book[code]; if (PER_CAD[code] != null) PER_CAD[code] = book[code]; }); } function bookSig(book) { if (!book) return ''; return Object.keys(book).sort().map(k => k + ':' + (+book[k]).toFixed(6)).join('|'); } const fmt = (n, c) => isNaN(n) || n === '' ? '' : new Intl.NumberFormat('en-CA', { style: 'currency', currency: c || 'CAD', maximumFractionDigits: 2 }).format(Number(n)); const num = (n) => new Intl.NumberFormat('en-CA', { maximumFractionDigits: 2 }).format(Number(n) || 0); const dDiff = (a, b) => (new Date(b) - new Date(a)) / 86400000; /* ============================================================ THE SECOND BOOK — THIS IS ITS HEADSTONE What stood here was `position(c, rows, baseline, receipts)`: a pure function that DERIVED the desk's cash from an opening baseline plus every posted record. It was a good function and it was the wrong idea. The server ledger STORES cash — a row in ledger_till_balances and ledger_vault_balances that movements update — and neither model was ever declared authoritative over the other. Every cash defect this project has had lived exactly where the two met, and none of them crashed. Two books do not crash; they disagree quietly, and the daily close overwrites the evidence. See docs/CASH_OWNERSHIP_INVARIANTS.md. The baseline it started from was a demo seed — 238,500 CAD and eight other currencies nobody had counted — which is how the Vault came to announce $594,124.00 on hand for a safe that was empty, and how the Dashboard reported the desk SHORT the euros it was long. There is nothing here now. Cash comes from GET /api/ledger/position and GET /api/ledger/till-balances, and a figure the ledger has no row for is shown as absent rather than derived. See docs/ABSENT_FIGURES.md. `defaultBaseline` and `defaultReceipts` survive as EMPTY only because two call sites in files this change does not own invoke them unconditionally at start-up, and deleting them would black-screen the desk rather than fix it: os-src/cdos-os.jsx:769-770 — the `baseline` / `receipts` state os-src/cdos-os.jsx:1799-1800, 1869 — the same on tenant switch/reset Those states, and every prop threading them down to the Till, the Vault, Reports and Compliance, are the remaining work. They now carry nothing, so nothing reads a cash figure out of them. */ function defaultBaseline() { return { anchor: null, units: {}, cost: {} }; } function defaultReceipts() { return []; } /* Deriving stock from transactions is the second book, so there is no derivation left to call. It answers null — "the ledger has no figure here" — rather than a number, because null is the one answer a screen cannot mistake for money. One caller in a file this change does not own still reaches for it: os-src/cdos-till.jsx:485 — the drawer's `expectedOf` in the standalone (no-server) mode. It should read const expectedOf = (c) => serverBalances && Object.prototype.hasOwnProperty.call(serverBalances, c) ? Number(serverBalances[c]) : null; and render null as "—". A desk that cannot reach the ledger has no expected float; docs/CASH_OWNERSHIP_INVARIANTS.md is explicit that there is no offline mode, and an invented expected figure is what a teller reconciles a real drawer against. */ const holdings = () => null; /* ============================================================ TWO-SIDED PRICING — the defining act of the desk, one pure function A real desk publishes a BUY rate and a SELL rate per currency; the gap between them (the spread) is the margin. priceDeal() is the single source of truth both the Ledger (quoting) and Reports (earnings) call, so the spread shown at the counter is the exact spread booked — never a back-estimate. The desk RECEIVES the pay-in currency (buys it, under mid) and GIVES the pay-out currency (sells it, over mid); a foreign→ foreign cross pays spread on both legs. unit CAD (mid) = crossRate(code,'CAD') // CAD per 1 unit we BUY 1 unit = mid · (1 − spread) // what we pay out we SELL 1 unit = mid · (1 + spread) // what we charge rate(out/in) = inUnitCad(buy) ÷ outUnitCad(sell) margin (CAD) = mid value in − mid value out // = spread captured Spread is per-currency (settings.spreads[code], %) falling back to the global default; rounding of the customer pay-out is configurable. */ const DEFAULT_SPREAD = 0.015; function spreadOf(code, settings) { if (code === 'CAD') return 0; const sp = settings && settings.spreads; if (sp && sp[code] != null && sp[code] !== '' && !isNaN(sp[code])) return Math.max(0, +sp[code]) / 100; if (settings && settings.defaultSpread != null && !isNaN(settings.defaultSpread)) return Math.max(0, +settings.defaultSpread) / 100; return DEFAULT_SPREAD; } const unitCadMid = (code) => code === 'CAD' ? 1 : (crossRate(code, 'CAD') || 0); const buyUnitCad = (code, s) => code === 'CAD' ? 1 : unitCadMid(code) * (1 - spreadOf(code, s)); // we pay this to acquire 1 unit const sellUnitCad = (code, s) => code === 'CAD' ? 1 : unitCadMid(code) * (1 + spreadOf(code, s)); // we charge this to release 1 unit // round a customer pay-out per the configured rule. mode: nearest|down|up // ('down' favours the desk, 'up' favours the customer); inc is the increment. function roundPayout(amt, settings) { const a = +amt || 0; const inc = settings && settings.payoutRoundTo != null ? +settings.payoutRoundTo : 0.01; const mode = (settings && settings.payoutRoundMode) || 'nearest'; if (!inc || inc <= 0) return +a.toFixed(2); const q = a / inc; const r = mode === 'down' ? Math.floor(q) : mode === 'up' ? Math.ceil(q) : Math.round(q); return +(r * inc).toFixed(2); } /* the one pricing call. side is informational: 'sell' (we give foreign for CAD), 'buy' (we take foreign for CAD), or 'cross' (foreign↔foreign). lockedRate, when passed, overrides the live two-sided rate (a rate lock); margin is still measured against the *current* mid so a held quote that moves with the market still books its true captured spread. */ function priceDeal({ inCcy, outCcy, inAmt, settings, lockedRate, overrideRate }) { const amt = +inAmt || 0; const inEach = buyUnitCad(inCcy, settings); // CAD value to us of each in-unit const outEach = sellUnitCad(outCcy, settings); // CAD we charge per out-unit const deskRate = outEach ? inEach / outEach : 0; // outCcy per 1 inCcy const midRate = crossRate(inCcy, outCcy) || 0; const rate = (overrideRate != null && overrideRate !== '' && !isNaN(overrideRate)) ? +overrideRate : (lockedRate != null ? +lockedRate : deskRate); const outAmtRaw = amt * rate; const outAmt = roundPayout(outAmtRaw, settings); // margin in CAD = mid value of what we took in − mid value of what we gave out const midCadIn = amt * unitCadMid(inCcy); const midCadOut = outAmt * unitCadMid(outCcy); const marginCad = +(midCadIn - midCadOut).toFixed(2); const side = inCcy === 'CAD' ? 'sell' : outCcy === 'CAD' ? 'buy' : 'cross'; const spreadPct = midCadIn ? (marginCad / midCadIn) * 100 : 0; return { rate: +(+rate).toFixed(6), deskRate: +deskRate.toFixed(6), midRate: +midRate.toFixed(6), outAmt, outAmtRaw, marginCad, spreadPct, side, midCadIn }; } // exact booked margin for a posted row: prefer the stored figure, else the // legacy live-mid estimate (so historical rows still show a spread) function dealMargin(r) { if (r && r.spreadCad != null && !isNaN(r.spreadCad)) return Math.max(0, +r.spreadCad); const mid = (+r.inAmt || 0) * crossRate(r.inCcy, r.outCcy); const d = mid - (+r.outAmt || 0); return d > 0 ? d / (perCadLive(r.outCcy) || 1) : 0; } /* human-readable, sortable reference: LT-YYMMDD-NNN */ const mkRef = (date, seq) => 'LT-' + String(date).slice(2).replace(/-/g, '') + '-' + String(seq).padStart(3, '0'); const nowTime = () => new Date().toLocaleTimeString('en-CA', { hour: '2-digit', minute: '2-digit', hour12: false }); /* factory for a fresh, fully-formed transaction record */ function newTx(over = {}) { return Object.assign({ id: Date.now() + Math.floor(Math.random() * 1000), /* the TRADING day, not the wall clock — a record's date is what it has to line up with in the book afterwards */ ref: '', date: businessDate(), time: nowTime(), customer: '', beneficiary: '', type: 'Currency Exchange', inCcy: 'CAD', inAmt: '', rate: crossRate('CAD', 'USD'), outCcy: 'USD', outAmt: '', fee: '', midRate: null, spreadCad: null, side: null, /* two-sided pricing: booked margin vs mid */ quoteRef: null, lockedUntil: null, /* rate-lock provenance, if quoted */ teller: '', notes: '', status: 'posted', /* posted | void — never deleted */ thread: [], /* append-only note log [{ts,user,text}] */ filed: false, filedInfo: null, /* LCTR report filing */ ackStr: false, ackStrInfo: null, /* structuring acknowledgement */ marginPct: null, profitCad: null, marginOverride: null, /* margin-floor guardrail */ capture: null, /* point-of-sale FINTRAC capture (purpose/source/3rd-party) */ tagged: false, tagInfo: null, /* teller/owner follow-up tag */ voidReason: '', voidBy: '', voidAt: '', createdBy: '', createdAt: '' }, over); } /* ---- one-time roster rename (v2): devices that persisted stores under the old demo client names get them rewritten in place, so cheques / transfers / beneficiaries match the new seed roster without wiping any user work. Every search string contains a space, dot or @ so base64 blobs can't match. ---- */ try { if (!localStorage.getItem('cdos_roster_v2')) { const REN = [["d.okafor@email.com","jakob.miller@email.com"],["lucia.ferraro@email.com","rachel.carter@email.com"],["m.reyes@email.com","tyler.bennett@email.com"],["elena.cruz@email.com","megan.foster@email.com"],["sofia.lim@email.com","ashley.turner@email.com"],["hassan.ali@email.com","kevin.doyle@email.com"],["mei.chen@email.com","emily.park@email.com"],["o.adeyemi@email.com","brandon.cole@email.com"],["yuki.tanaka@email.com","lauren.bishop@email.com"],["c.mendez@email.com","chris.delaney@email.com"],["fatima.khan@email.com","nicole.hayes@email.com"],["ravi.patel@email.com","jordan.blake@email.com"],["grace.owusu@email.com","sarah.whitman@email.com"],["tomas.novak@email.com","marcus.reed@email.com"],["Daniel Okafor","Jakob Miller"],["Lucia Ferraro","Rachel Carter"],["Aran Voss","Brooke Lawson"],["Marco Reyes","Tyler Bennett"],["Elena Cruz","Megan Foster"],["Sofia Lim","Ashley Turner"],["Hassan Ali","Kevin Doyle"],["Mei Chen","Emily Park"],["Olawale Adeyemi","Brandon Cole"],["Yuki Tanaka","Lauren Bishop"],["Carlos Mendez","Chris Delaney"],["Fatima Khan","Nicole Hayes"],["Ravi Patel","Jordan Blake"],["Grace Owusu","Sarah Whitman"],["Tomas Novak","Marcus Reed"],["Maria Ferraro","Maria Carter"],["M. Ferraro","M. Carter"],["Rohan Okafor","Rohan Miller"],["A. Ali · Dubai","A. Doyle · Dubai"],["L. Chen · Shanghai","L. Park · Shanghai"],["S. Patel · Mumbai","S. Blake · Mumbai"],["R. Mendez · Guadalajara","R. Delaney · Guadalajara"],["A. Khan · Dubai","A. Hayes · Dubai"],["Okafor","Miller"],["Ferraro","Carter"],["Adeyemi","Cole"],["Tanaka","Bishop"],["Owusu","Whitman"],["Novak","Reed"]]; Object.keys(localStorage).forEach((k) => { if (k.indexOf('cdos_') !== 0 && k.indexOf('yorkfx_') !== 0) return; const v = localStorage.getItem(k); if (!v) return; let nv = v; REN.forEach((p) => { nv = nv.split(p[0]).join(p[1]); }); if (nv !== v) localStorage.setItem(k, nv); }); localStorage.setItem('cdos_roster_v2', '1'); } } catch (e) {} /* ============================================================ THE DEMO BOOK — ALSO GONE `seedRows()` returned thirty-eight invented transactions dated 2026-06-18, and `seedClients()` the eighteen people who supposedly made them. They were the browser's whole book before the server had one, and they are the reason a desk that had posted a single $1,000 trade opened on a Ledger header reading "38 records · $130,566.36 pay-in · $1,051.86 fees" and a Dashboard claiming $1,150 earned. A brand-new desk must not come up showing York FX's trading. The book is GET /api/ledger/transactions and nothing else; a desk with nothing posted shows nothing posted, which is both true and the thing an owner needs to see on their first morning. Both survive as empty because cdos-os.jsx:714-715 calls them to initialise its `rows` and `clients` state before any server round trip. Empty is the correct starting value for that state. */ const seedRows = () => []; const seedClients = () => ({}); /* ---- brand UI effects: a chime + click-pop + double-click guard for any permanent action (everything that writes to the audit trail). One global listener remembers the last button pressed; log() calls auditFx.fire(). ---- */ const auditFx = { lastBtn: null, lastAt: 0, _ctx: null, ping() { try { const AC = window.AudioContext || window.webkitAudioContext; if (!AC) return; const ctx = auditFx._ctx || (auditFx._ctx = new AC()); if (ctx.state === 'suspended') ctx.resume(); const now = ctx.currentTime; [[660, 0], [988, 0.075]].forEach(([f, t]) => { const o = ctx.createOscillator(), g = ctx.createGain(); o.type = 'sine'; o.frequency.value = f; o.connect(g); g.connect(ctx.destination); g.gain.setValueAtTime(0.0001, now + t); g.gain.exponentialRampToValueAtTime(0.05, now + t + 0.012); g.gain.exponentialRampToValueAtTime(0.0001, now + t + 0.15); o.start(now + t); o.stop(now + t + 0.17); }); } catch (e) {} }, fire() { auditFx.ping(); const el = auditFx.lastBtn; if (el && (Date.now() - auditFx.lastAt) < 900 && document.contains(el)) { el.classList.add('fx-pop'); setTimeout(() => { try { el.classList.remove('fx-pop'); } catch (e) {} }, 380); const prev = el.style.pointerEvents; el.style.pointerEvents = 'none'; setTimeout(() => { try { el.style.pointerEvents = prev; } catch (e) {} }, 650); } } }; if (typeof document !== 'undefined' && !window.__cdosFxBound) { window.__cdosFxBound = true; document.addEventListener('pointerdown', (e) => { const b = e.target && e.target.closest && e.target.closest('button'); auditFx.lastBtn = b || null; auditFx.lastAt = Date.now(); }, true); } /* ---- per-app accent colours: a sparse, muted identity tint so each app reads differently at a glance (dock glyph + open-window dot). Semantic where it can be — compliance is the flag red, the till is cash green. ---- */ const APP_ACCENT = { rates: '#274B8E', ledger: '#1D6B45', transfers: '#1F7269', cheques: '#8F6410', clients: '#3C3B78', compliance: '#6B2E54', dashboard: '#17140F', assistant: '#17140F', till: '#17140F', vault: '#17140F', branches: '#17140F', audit: '#17140F', calc: '#17140F', loan: '#17140F', tagged: '#17140F', settings: '#17140F', store: '#17140F', reports: '#46506B', pricing: '#274B8E', telegraph: '#8A4B2F' }; /* ---- shared commit button: press → flash green + lock → fire a beat later. One re-entrant lock means a double-click can never double-post. Mirrors the vault/till pattern so every consequential action confirms the same way. ---- */ function CommitBtn({ onCommit, disabled, tone, bg, icon, doneIcon, label, doneLabel, armLabel, stage, delay, className, style, title }) { const { useState: uS, useRef: uR } = React; const [phase, setPhase] = uS('idle'); // idle → (arm) → done const lock = uR(false); const idleBg = bg || (tone === 'danger' ? CD.flag : CD.ink); const d = delay || 460; const done = phase === 'done'; const armed = phase === 'arm'; const fire = () => { if (disabled || lock.current || phase !== 'idle') return; lock.current = true; if (stage) { // two-stage weighty commit: flash red (arming) → green (committed) → fire setPhase('arm'); setTimeout(() => setPhase('done'), Math.round(d * 0.5)); setTimeout(() => { try { onCommit && onCommit(); } catch (e) {} }, d + Math.round(d * 0.5)); } else { setPhase('done'); setTimeout(() => { try { onCommit && onCommit(); } catch (e) {} }, d); } }; const bgNow = disabled ? '#bdbcb3' : armed ? CD.flag : done ? CD.green : idleBg; const shownIcon = armed ? 'alert' : done ? (doneIcon || 'check') : icon; const shownLabel = armed ? (armLabel || label) : done ? (doneLabel || label) : label; return ( ); } /* ---- the two facts every screen needs before it can render honestly ---- Which trading day this till is in, and which rules the desk trades under. Both live on the server, both are cheap, and both are cached in module state — so this hook asks for them once per mounted screen and returns a version number that changes when either arrives. Put it in a memo's dependencies and the figures re-derive when the answer lands instead of a moment too late. Deliberately NOT a hard dependency: a screen renders immediately with the wall-clock date and no threshold, and reportingLimit() reports "—" until the pack is known. A dash for half a second beats a Canadian 10,000 on a UAE desk forever. */ function useDeskFacts() { const [version, setVersion] = React.useState(0); React.useEffect(() => { let live = true; const bump = () => { if (live) setVersion(v => v + 1); }; window.addEventListener('cdos-jurisdiction', bump); window.addEventListener('cdos-thresholds', bump); window.addEventListener('cdos-business-date', bump); Promise.all([ refreshJurisdiction(), /* The desk's own lines, alongside the pack that proposes them. A screen that had the pack but not the override would print the regulator's 10,000 at a desk that had deliberately moved to 7,500 — the exact class of disagreement this hook exists to stop, so the two arrive together or the version does not move. */ refreshDeskThresholds(), refreshBusinessDate(), ]).then(bump, bump); return () => { live = false; window.removeEventListener('cdos-jurisdiction', bump); window.removeEventListener('cdos-thresholds', bump); window.removeEventListener('cdos-business-date', bump); }; }, []); return version; } /* ---- a figure the ledger has no answer for ---------------------------- One dash, one reason, everywhere. The rule is written down in docs/ABSENT_FIGURES.md and it is short: a figure with no server row is shown as absent, visibly — never as zero, never as a demo number, never as a confident-looking total. "—" with a line saying why beats a bold $594,124.00 that is fiction. The `why` is not optional and not decoration. "—" on its own reads as a rendering fault; "— nothing posted yet today" reads as an answer, and it is one. Keep it short and factual: what is missing, and what would fill it in. */ /* ---- taking a photograph of somebody's identity document ---------------- Every scan the desk captures used to go straight into storage as a base64 data URL at whatever resolution the camera or the phone produced, with no ceiling anywhere. One photograph of a passport is three to five megabytes raw and about a third larger again once base64'd, against a four-megabyte limit on the whole desk's saved state — so a single ID scan could take the tenant past it, and the bridge treats that refusal as terminal: "Nothing is being saved." Every client, every filing and every setting after it was then browser-only until somebody intervened. A teller doing exactly their job could stop the shop saving anything. So there is one way in, and it downscales. Sixteen hundred pixels on the long edge is comfortably enough to read a document number off a passport — the thing the image is FOR — and re-encoding at 0.6 takes a four-megabyte photograph to something in the low hundreds of kilobytes. Anything that is still too big afterwards is refused, out loud, rather than accepted and silently lost. This is a ceiling, not a cure. Scans belong in object storage with a row pointing at them, not in the desk's state document at all — see docs/BROWSER_STORES.md. Until they move, this keeps one photograph from stopping a shop. */ /* 1200 on the long edge is about 150 DPI across a passport, which reads a document number comfortably and is what the image is FOR. It was 1600 first; measured against a worst-case scan that came out at 240 KB apiece, which is only sixteen clients before a desk is at its saving limit. This is the honest trade — a scan you can read, small enough that a shop gets through a working week — and it is still a stopgap. Scans belong in object storage; see docs/BROWSER_STORES.md. */ const ID_IMAGE_MAX_EDGE = 1200; const ID_IMAGE_QUALITY = 0.55; /* Refused above this AFTER downscaling. A scan that will not come under it is not a scan, it is a scanner set to something strange. */ const ID_IMAGE_MAX_BYTES = 700 * 1024; /* A PDF or a Word file cannot be downscaled, so a supporting document gets a flat limit and an honest refusal. */ const ATTACHMENT_MAX_BYTES = 900 * 1024; const dataUrlBytes = (url) => Math.ceil((String(url || '').length - (String(url || '').indexOf(',') + 1)) * 3 / 4); const readableSize = (bytes) => bytes >= 1024 * 1024 ? (bytes / 1024 / 1024).toFixed(1) + ' MB' : Math.round(bytes / 1024) + ' KB'; function readAsDataUrl(file) { return new Promise((resolve, reject) => { const r = new FileReader(); r.onload = () => resolve(r.result); r.onerror = () => reject(new Error('That file could not be read.')); r.readAsDataURL(file); }); } /* Downscale and re-encode. Resolves { ok, dataUrl } or { ok: false, why } — never throws at a call site that is holding somebody's passport. */ async function intakeIdImage(file) { if (!file) return { ok: false, why: 'No file was chosen.' }; if (!/^image\//.test(file.type || '')) { return { ok: false, why: 'That is not an image. Use Documents for a PDF or a scan from a machine.' }; } let source; try { source = await readAsDataUrl(file); } catch (e) { return { ok: false, why: e.message }; } const shrunk = await shrinkDataUrl(source); const bytes = dataUrlBytes(shrunk); if (bytes > ID_IMAGE_MAX_BYTES) { return { ok: false, why: `That image is still ${readableSize(bytes)} after resizing, which is too large to store. Try a photograph rather than a full-resolution scan.` }; } return { ok: true, dataUrl: shrunk, bytes }; } /* The same treatment for an image the desk produced itself — a camera frame is already a data URL and still wants the ceiling. */ async function shrinkDataUrl(dataUrl) { try { const img = await new Promise((resolve, reject) => { const i = new Image(); i.onload = () => resolve(i); i.onerror = () => reject(new Error('unreadable')); i.src = dataUrl; }); const longest = Math.max(img.width, img.height) || 1; const scale = Math.min(1, ID_IMAGE_MAX_EDGE / longest); const cv = document.createElement('canvas'); cv.width = Math.max(1, Math.round(img.width * scale)); cv.height = Math.max(1, Math.round(img.height * scale)); cv.getContext('2d').drawImage(img, 0, 0, cv.width, cv.height); return cv.toDataURL('image/jpeg', ID_IMAGE_QUALITY); } catch (e) { /* Better the original than nothing — the size check still stands after this, so an unreadable image is refused rather than stored. */ return dataUrl; } } async function intakeAttachment(file) { if (!file) return { ok: false, why: 'No file was chosen.' }; if (/^image\//.test(file.type || '')) return intakeIdImage(file); if (file.size > ATTACHMENT_MAX_BYTES) { return { ok: false, why: `${file.name || 'That file'} is ${readableSize(file.size)}. Documents are limited to ${readableSize(ATTACHMENT_MAX_BYTES)} — attach a smaller copy.` }; } try { return { ok: true, dataUrl: await readAsDataUrl(file), bytes: file.size }; } catch (e) { return { ok: false, why: e.message }; } } function Absent({ why, size, align }) { return ( — {why && {why}} ); } /* Render a server money field, or say it is absent. `value` is whatever the ledger sent: a decimal string, or null. There is deliberately no "default to 0" branch — that default is the bug this exists to stop. */ const money = (value, currency, why, opts) => value == null ? : fmt(value, currency || 'CAD'); // ---- client risk rating (staff-set compliance tier; light V1) ---------------- // Every contact carries one tier. Staff set it in the profile's Edit mode; it feeds // the recommendation engine (High -> enhanced due diligence) and the auto-tag rules. // FUTURE (mapped, not built): tiers sync across the branch network so a High flag // raised at one store surfaces on a customer's file at every store during a check. // Kept on-device for now — see the roadmap in docs/. const RISK_TIERS = ['Normal', 'Low', 'Medium', 'High']; const normalizeRisk = (v) => { const s = String(v == null ? '' : v).trim().toLowerCase(); if (s === 'low') return 'Low'; if (s === 'medium' || s === 'enhanced') return 'Medium'; if (s === 'high') return 'High'; return 'Normal'; }; const RISK_TONE = { Normal: { level: 'Normal', c: CD.mute, bg: CD.lineSoft }, Low: { level: 'Low', c: CD.green, bg: CD.greenSoft }, Medium: { level: 'Medium', c: CD.amber, bg: CD.amberSoft }, High: { level: 'High', c: CD.flag, bg: CD.flagSoft }, }; const riskTone = (v) => RISK_TONE[normalizeRisk(v)]; /* ---- shared 4-digit PIN gate: reused at account switch, till switch, void. A proper mandatory-PIN screen — dot indicators + on-screen keypad, and the physical keyboard works too. ---- */ function PinPrompt({ title, sub, name, staffId, expected, onOk, onCancel }) { const [pin, setPin] = React.useState(''); const [err, setErr] = React.useState(''); const [shake, setShake] = React.useState(false); const exp = String(expected == null ? '0000' : expected); const ini = (nm) => (nm || '?').split(/[ .]+/).filter(Boolean).map(x => x[0]).join('').slice(0, 2).toUpperCase(); React.useEffect(() => { if (!document.getElementById('cdos-pin-kf')) { const s = document.createElement('style'); s.id = 'cdos-pin-kf'; s.textContent = '@keyframes cdosPinShake{0%,100%{transform:translateX(0)}20%{transform:translateX(-8px)}40%{transform:translateX(8px)}60%{transform:translateX(-5px)}80%{transform:translateX(5px)}}'; document.head.appendChild(s); } }, []); const fail = (msg) => { setErr(msg || 'Incorrect PIN'); setShake(true); setTimeout(() => setShake(false), 420); setTimeout(() => { setPin(''); }, 260); }; /* The server decides. Holding the expected PIN in the browser and comparing it here made this gate decorative — it could be read out of devtools, or stepped over entirely. A desk whose PINs have not been set on the server yet answers 409, and only then do we fall back to the old local check so nothing breaks mid-migration. */ const submit = async (val) => { try { const res = await fetch('/api/staff/pin/verify', { method: 'POST', headers: { 'content-type': 'application/json' }, credentials: 'same-origin', body: JSON.stringify(staffId ? { staffId: staffId, pin: val } : { pin: val }), }); if (res.ok) { onOk && onOk(); return; } if (res.status === 429) { fail('Too many tries — wait a few minutes'); return; } if (res.status === 401) { fail(); return; } if (res.status !== 409) { fail('Could not check that PIN'); return; } } catch (e) { /* offline: the local check is all there is */ } if (val === exp) { onOk && onOk(); } else { fail(); } }; const press = (dgt) => { setErr(''); setPin(p => { if (p.length >= 4) return p; const n = p + dgt; if (n.length === 4) setTimeout(() => submit(n), 90); return n; }); }; const back = () => { setErr(''); setPin(p => p.slice(0, -1)); }; React.useEffect(() => { const h = (e) => { if (e.key === 'Escape') { onCancel && onCancel(); return; } if (e.key === 'Backspace') { e.preventDefault(); back(); return; } if (/^[0-9]$/.test(e.key)) { e.preventDefault(); press(e.key); } }; document.addEventListener('keydown', h); return () => document.removeEventListener('keydown', h); }, []); const keyBtn = (label, onClick, kind) => ( ); return ReactDOM.createPortal(

onCancel && onCancel()}>

e.stopPropagation()} style={{ width: '100%', maxWidth: 320, background: CD.paper, border: `1px solid ${CD.ink}`, borderRadius: 18, boxShadow: '0 30px 70px var(--cd-scrim)', padding: '24px 22px 18px', textAlign: 'center', animation: shake ? 'cdosPinShake .42s' : 'none' }}>

PIN required

{ini(name)}

{title || 'Enter your PIN'}

{sub || name || ''}

{[0, 1, 2, 3].map(i => { const filled = i < pin.length; return ; })}

{err}

{['1', '2', '3', '4', '5', '6', '7', '8', '9'].map(k => keyBtn(k, () => press(k)))} {keyBtn('Cancel', () => onCancel && onCancel(), 'ghost')} {keyBtn('0', () => press('0'))} {keyBtn(, back, 'ghost')}

, document.body); } window.CDOS = Object.assign(window.CDOS || {}, { CD, ICONS, Ic, TYPES, CCY, TODAY, STAFF, ROLE_CAPS, ROLE_SCOPE, auditFx, RISK_TIERS, normalizeRisk, riskTone, COUNTER_CASH, counterCashIn, counterCashOut, dealHome, sumDealHome, CD_THEMES, theme: { get: themePref, set: setThemePref, resolve: resolveTheme, apply: applyTheme }, CommitBtn, APP_ACCENT, PinPrompt, Absent, money, intakeIdImage, intakeAttachment, shrinkDataUrl, dataUrlBytes, readableSize, crossRate, perCadLive, fmt, num, dDiff, mkRef, nowTime, newTx, seedRows, seedClients, publishedBook, applyBook, bookSig, defaultBaseline, defaultReceipts, holdings, /* the two "todays", kept apart on purpose — see the note above */ wallClock, businessDate, setBusinessDate, refreshBusinessDate, businessDayWindow, /* the one reporting line, and the pack it comes from */ reportingLimit, overReportingLimit, identificationLimit, deskPack, deskReports, setDeskPack, refreshJurisdiction, useDeskFacts, deskCurrencies, deskCurrencyList, deskTrades, currencyPlaces, /* the desk's own lines, as the ledger resolved them against the pack */ deskThresholds, setDeskThresholds, refreshDeskThresholds, spreadOf, unitCadMid, buyUnitCad, sellUnitCad, roundPayout, priceDeal, dealMargin }); })();