V2 Function Source Audit

Complete source-of-truth verification for V1 blueprint and V2 engine functions

CRITICAL: V1 Blueprint Protection & Audit Rules

V1 functions are the working blueprint and must not be changed. V2 functions must preserve the same private partner endpoints, secrets, proxy routes, headers, and token flow unless a change is explicitly approved.

If V2 differs from V1 on SmartCredit endpoint, secret name, proxy route, header, or token handling, that difference must be highlighted before any fix is made.

Registry Sync Requirement: Every backend function change must update both the deployed function AND this registry file (/src/admin/v2FunctionSourceRegistry.js).

Total Functions

V1 Blueprint

V2 Engine

With Source Code

SECTION A — V1 Working Debugger Blueprint

14 functions — Do Not Modify

Original working 14-step debugger functions that powered the Credit Report Flow Debugger. These serve as the blueprint for V2.

0001-authGateV1 Step 1 1119 chars

Authentication gate - verifies C2C user login and scEmail

0002-verifySmartCreditAccessV1 Step 2 2257 chars

Verifies SmartCredit access record exists or creates PENDING stub

0003-completeSmartCreditLinkV1 Step 3 6583 chars

Links SmartCredit account by finding customer via PAPI and multiple PIDs

0004-generateOtcV1 Step 4 5465 chars

Generates One-Time Code (OTC) via PAPI for SmartCredit login

0005-exchangeOtcForScSessionV1 Step 5 4358 chars

Exchanges OTC for SmartCredit session token via proxy — uses /smartcredit/v1/login?code= GET + x-cd-proxy-secret header

0006-pull3BCurrentV1 Step 6 4224 chars

Pulls /smartcredit/v1/credit/3bs/current via proxy with x-cd-proxy-secret + Bearer session token

storeWidgetCustomerTokenAndKickoffV1 Step 7 9332 chars

Captures customerToken from ConsumerDirect widget, stores it, orders fresh 3B via PWS, then runs the 14-step pipeline

handleSmartCreditWidgetSuccessV1 Step 8 4557 chars

Called after SmartCredit widget ConfirmationStep — auth optional, captures lead, runs kickoff pipeline if logged in

completePostSmartCreditSignupV1 Step 9 4659 chars

Creates full C2C user account after SmartCredit widget completion. Auth NOT required — user is created here.

buildCreditReportV1 Step 10 3837 chars

18-step credit report builder — PATH A: runs steps 1-6 fresh via getSmartCreditBundle, PATH B: uses existing bundleId

orchestrateCreditReportPullV1 Step 11 5260 chars

14-step orchestrator — sequentially invokes 0001-0006, 01-3b-getBundle through 06-sc-readReportSnapshotForUI

kickoffCreditReportByEmailV1 Step 12 4516 chars

Runs all 14 steps sequentially using FLOW_STEP_FNS array, updates user profile with snapshotId on completion

fetchCreditReportByEmailV1 Step 13 3837 chars

Complete credit report flow — inlines steps 1-6 directly, then calls processSmartCreditBundle for steps 7-13

0003-mintPapiBearerTokenV1 Step 14 2468 chars

Mints PAPI bearer token via CD_PAPI_CLIENT_ID/SECRET + CD_PAPI_OAUTH_URL + CD_TARGET_ENTITY_SCOPE

SECTION B — V2 New Engine

24 functions — Must match V1 blueprint

New 24-function engine. Each function must preserve the same private partner endpoints, secrets, proxy routes, headers, and token flow as V1 unless explicitly approved.

sc100AuthGateStep 100 1799 chars

V2 Auth gate — validates scEmail and creates runId. admin_debug bypasses user auth.

sc101ResolveConnectionStep 101 2979 chars

V2 Resolve connection — finds customerToken from SmartCreditAccess, SmartCreditCustomerTokens, or SmartCreditEnrollment

sc102CompleteLinkStep 102 2790 chars

V2 Complete link — stores customerToken in SmartCreditAccess or SmartCreditCustomerTokens

sc103GenerateOtcStep 103 5795 chars

V2 Generate OTC — FIXED: uses V1-compatible endpoint /cd/v1/customers/{token}/otcs/login-as, x-shared-secret header, {agentId} body. Mints PAPI token directly (same as V1 0004).

sc104ExchangeOtcForSessionStep 104 5696 chars

V2 Exchange OTC for session — accepts customerToken, stores it on SmartCreditSessions, returns customerToken and sessionId. Matches V1 0005-exchangeOtcForScSession.

sc105Pull3BCurrentRawStep 105 8267 chars

V2 Pull 3B — FIXED 2026-06-17-exact-pws-copy: Uses EXACT fetchPwsAccessToken + orderFresh3B from storeWidgetCustomerTokenAndKickoff. Logs BOTH /pws/login and /oauth/token attempts with status+preview. Returns PWS_LOGIN_FAILED with full diagnostics if both fail. Orders fresh 3B via POST /pws/customer/credit/3bs. Returns THREEB_ORDERED_NOT_READY with shouldRetry:true if report not ready.

sc106IndexRawComponentsStep 106 4242 chars

V2 Index raw components — reads threeBCurrent first, parses SmartCredit BundleComponents.BundleComponent[] structure

sc107ExtractScoresStep 107 5194 chars

V2 Extract scores — reads threeBCurrent, extracts from BundleComponents *VantageScoreV6 components. factorToText() normalizes scoreFactors: handles string, array-of-objects, nested FactorText arrays. Prevents [object Object] display.

sc108ExtractBorrowerStep 108 5752 chars

V2 Extract borrower — FIXED: uses exact same address paths as old 18-step flow (BorrowerAddress/PreviousAddress with CreditAddress nested structure), bureau-specific address mapping

sc109ExtractTradelinesRawStep 109 4242 chars

V2 Extract raw tradelines - preserves SmartCredit native grouping IDs + resolves bureau from Source/ItemId (fixes UNKNOWN bureau bug).

sc110NormalizeTradelinesStep 110 4405 chars

V2 Normalize tradelines - bureau resolver + safe payStatus normalization (fixes charged_off misclassification).

sc111MergeAccountGroupsStep 111 7760 chars

V2 Merge - v9 preserves resolved bureaus from sc110 (fixes UNKNOWN bureau in group.bureaus).

sc112ExtractCollectionsStep 112 3330 chars

V2 Extract collections/inquiries/public records — tries 97-inspectCollectionsInRaw3B + 92-debugInquiriesBureauFromRaw3B, falls back to regex

sc113BuildReportSnapshotStep 113 4559 chars

V2 Build report snapshot - v2 uses isNegative flag from groups (fixes negative count after bureau/paystatus fixes).

sc114CompareSnapshotToRawStep 114 4470 chars

V2 Compare snapshot to raw — shows raw vs normalized vs displayed counts, skipped tradelines

sc115RunFullProductionEngineStep 115 7440 chars

V2 Full orchestrator — runs steps 100-114 in sequence, propagates context between steps, returns full step log. sanitizeStepResult() applied before every step response reaches frontend: (1) generic LARGE_RAW_FIELDS omission >10KB; (2) step 105: threeBCurrent omitted, threeBCurrentPreview stub added; (3) step 107: scoreFactors normalized to readable strings (string/array-of-objects/object); (4) step 109: tradelines replaced with tradelinesPreview[5]+tradelinesOmittedFromUi+tradelinesTotal+viewFullInTradelinesTab; (5) step 110: tradelines replaced with preview if JSON >10KB; (6) step 111: groups replaced with groupsPreview if JSON >10KB. DiagnosticPanel sanitizeForDisplay() also guards any array >20 items or >10KB, stripping rawTradeline/rawPartition/threeBCurrent from preview items.

sc116RefreshExistingClientReportStep 116 1513 chars

V2 Refresh — calls sc115RunFullProductionEngine with mode=production_refresh

sc117GetLatestReportSnapshotStep 117 2713 chars

V2 Get snapshot — by snapshotId or scEmail/userEmail, checks SmartCreditSnapshot then CreditReportSnapshot

sc118AdminGetRawPullStep 118 2084 chars

V2 Admin raw pull viewer — returns SmartCreditBundle record metadata and optionally full raw JSON

sc119AdminGetFunctionRegistryStep 119 6639 chars

V2 Admin function registry — returns metadata + source code for all 24 V2 engine functions

sc120-v2-createReportJobStep 120 3407 chars

V2 Queue job — creates CreditReportJobV2 record after SmartCredit widget ConfirmationStep, returns jobId immediately

sc121-v2-processNextReportJobsStep 121 5295 chars

V2 Worker — admin-only, processes batch of queued CreditReportJobV2 jobs with lock, retry, backoff

sc122-v2-getReportJobStatusStep 122 2480 chars

V2 Poll job status — looks up CreditReportJobV2 by jobId or scEmail, returns snapshotId if completed

sc123-v2-adminQueueDashboardStep 123 3126 chars

V2 Admin queue dashboard — admin-only summary of CreditReportJobV2 counts, avg processing time, stale locks, recent errors

SECTION C — V1 to V2 Comparison Map

V1 Function	→	V2 Function	Notes
0001-authGate	→	sc100AuthGate	Direct mapping — auth gate. V2 adds admin_debug bypass mode.
0002-verifySmartCreditAccess	→	sc101ResolveConnection	V2 NOW INCLUDES OLD 0002 + 0003: (1) Creates PENDING SmartCreditAccess stub if missing (old 0002 behavior), (2) Uses CD_TARGET_ENTITY_SCOPE for PAPI lookup (not papi:customers:login-as), (3) Searches primary PIDs (49392, 81464, 49391, 49393, 81465) first, (4) Persists to SmartCreditAccess + SmartCreditCustomerTokens on success.
0003-completeSmartCreditLink	→	sc102CompleteLink	V2 assumes link already exists, just stores the token.
0003-mintPapiBearerToken	→	sc103GenerateOtc (internal)	V2 sc103 now mints PAPI token directly inline (same as V1), no longer delegates to 15-mintPapiToken.
0004-generateOtc	→	sc103GenerateOtc	V2 now matches V1 private partner route/header. Both mint PAPI token via CD_PAPI_CLIENT_ID/SECRET directly. Both call /cd/v1/customers/{token}/otcs/login-as with x-shared-secret + Bearer accessToken + { agentId } body.
0005-exchangeOtcForScSession	→	sc104ExchangeOtcForSession	V2 now matches V1 private partner route/header. Both use /smartcredit/v1/login?code= GET with x-cd-proxy-secret. Both store full JWT in SmartCreditSessions.sessionTokenLong. Both return entity ID as sessionId.
0006-pull3BCurrent	→	sc105Pull3BCurrentRaw	V2 now matches V1 private partner route/header. Both load SmartCreditSessions by sessionId, read sessionTokenLong, call CD_PROXY_URL/smartcredit/v1/credit/3bs/current with Bearer token + x-cd-proxy-secret. Both include V1 404 retry + metadata fallback.
storeWidgetCustomerTokenAndKickoff	→	sc120-v2-createReportJob	V2 queues a job instead of running the pipeline synchronously.
handleSmartCreditWidgetSuccess	→	sc120-v2-createReportJob	V2 creates job, front-end polls sc122 instead of waiting for pipeline.
kickoffCreditReportByEmail	→	sc115RunFullProductionEngine	V2 runs steps 100-114. V1 runs steps 1-14 via FLOW_STEP_FNS array.
orchestrateCreditReportPull	→	sc115RunFullProductionEngine	Direct orchestration equivalent.
buildCreditReport	→	sc115RunFullProductionEngine	18-step V1 vs 15-step V2 pipeline.
fetchCreditReportByEmail	→	sc116RefreshExistingClientReport	V2 refresh equivalent.
completePostSmartCreditSignup	→	sc120-v2-createReportJob + sc121	V2 splits into job creation + async worker processing.