SKYVENE — Claude Code Build Pack

**Project:** SKYVENE Cross-Border Deal Infrastructure
**Founder:** Q. Bilal Niazi
**Build by:** Spotlight (Khurram Badar)
**Target:** skyvenedemo.dubaiaihouse.com
**Stack:** Next.js 15 + Supabase + Anthropic Claude + Vercel
**Locales:** English + Arabic (RTL)

---

How to use this pack

This is a sequenced set of prompts you paste into Claude Code, **one at a time, in order**. After each prompt:

1. Let Claude Code complete the work
2. Run the verification step listed at the end of the prompt
3. Only proceed to the next prompt when verification passes

**Where to run from:** `~/projects/skyvene` (create this directory first)

**Before Prompt 0** — set up these accounts and have credentials ready:
- GitHub repo `khurrambadar3125/skyvene` (create empty)
- Vercel project linked to that repo
- Supabase project in EU region (eu-west-1 ideal for UK proximity)
- Anthropic API key
- Resend account for email (free tier fine for now)
- DNS access for dubaiaihouse.com

Save your secrets in a file you'll reference but never commit:

```
ANTHROPIC_API_KEY=<redacted>
NEXT_PUBLIC_SUPABASE_URL=https://xxx.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJ...
SUPABASE_SERVICE_ROLE_KEY=eyJ...
RESEND_API_KEY=re_...
```

---

PROMPT 0 — Project initialization

**Paste this into Claude Code first.**

```
You are building SKYVENE, a cross-border M&A deal infrastructure platform connecting UK SME deal flow with GCC capital. The founder is Q. Bilal Niazi (UAE-based, 20+ years GCC banking). Project is being built by Spotlight as a client engagement.

Initialize a fresh Next.js 15 project in the current directory with:

Next.js 15 App Router
TypeScript with strict mode
Tailwind CSS v4
ESLint + Prettier
src/ directory structure
App Router (not Pages Router)
No Turbopack (use webpack for stability)

After scaffolding, install these additional dependencies:
- @supabase/supabase-js, @supabase/ssr
- @anthropic-ai/sdk
- next-intl (for EN/AR routing with RTL)
- zod (schema validation)
- lucide-react (icons)
- class-variance-authority, clsx, tailwind-merge (component variants)
- @radix-ui/react-dialog, @radix-ui/react-dropdown-menu, @radix-ui/react-tabs, @radix-ui/react-toast (UI primitives)
- resend (transactional email)
- date-fns (date formatting)

Create this directory structure:

src/
├── app/
│ ├── [locale]/
│ │ ├── (marketing)/ # public pages
│ │ ├── (app)/ # authenticated pages
│ │ ├── layout.tsx
│ │ └── page.tsx
│ ├── api/
│ ├── globals.css
│ └── layout.tsx # root layout
├── components/
│ ├── ui/ # base components (button, card, input)
│ ├── marketing/ # landing/marketing components
│ ├── app/ # authenticated app components
│ └── ai/ # AI agent UI components
├── lib/
│ ├── supabase/
│ │ ├── client.ts # browser client
│ │ ├── server.ts # server client
│ │ └── middleware.ts # auth middleware
│ ├── anthropic/
│ │ ├── client.ts
│ │ └── agents/ # one file per AI agent
│ ├── i18n/
│ │ ├── config.ts
│ │ └── messages/ # en.json, ar.json
│ ├── compliance/ # FCA perimeter classification
│ ├── audit/ # audit logging
│ └── utils.ts
├── messages/
│ ├── en.json
│ └── ar.json
└── middleware.ts # i18n + auth routing

Set up .env.local with placeholders for:
- NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY
- ANTHROPIC_API_KEY
- RESEND_API_KEY
- NEXT_PUBLIC_APP_URL=http://localhost:3000

Configure tailwind.config.ts with the SKYVENE brand tokens:
- primary: #0A2540 (navy)
- accent: #0066CC (brand blue)
- highlight: #00B4D8 (cyan)
- surface: #F4F7FB
- text: #1A1A1A
- muted: #6B7280
- warn: #D97706
- error: #DC2626

Add font configuration: Inter for English, IBM Plex Sans Arabic for Arabic. Use next/font/google for both.

Configure next.config.js to allow images from supabase.co domains.

Write a README.md at project root summarizing what SKYVENE is, the stack, and how to run locally.

Initialize git, create initial commit "feat: project scaffold".

VERIFICATION:
1. `npm run dev` starts cleanly on port 3000
2. http://localhost:3000 shows a Next.js placeholder
3. No TypeScript errors when running `npm run build`
```

**STOP HERE. Run `npm run dev`. If it works, proceed to Prompt 1.**

---

PROMPT 1 — Supabase schema and migrations

```
Set up the SKYVENE database schema in Supabase. This platform handles cross-border M&A deals so the schema must support: multi-tenant organizations (partners, investors, internal), deals with sensitive document storage, AI-generated listings, investor mandates with vector matching, NDAs and bidding, and comprehensive audit logging.

Create a migrations file at supabase/migrations/0001_initial_schema.sql with:

ENABLE EXTENSIONS:
- pgcrypto (for UUIDs)
- vector (for embeddings — pgvector)

TABLES:

profiles (extends auth.users):
- id (uuid, PK, references auth.users)
- email, full_name, locale ('en' | 'ar'), role (user_role), mfa_enabled (bool), phone
- created_at, updated_at

organizations:
- id (uuid, PK), name, type (org_type), country, registration_number, website
- primary_contact_user_id (uuid, FK profiles)
- verified (bool), verified_at, verified_by
- created_at, updated_at

organization_members:
- org_id (uuid, FK), user_id (uuid, FK), role_in_org (text), invited_by, joined_at
- PRIMARY KEY (org_id, user_id)

deals:
- id (uuid, PK), partner_org_id (FK organizations)
- status (deal_status), sector, country, region
- ev_estimate_low (numeric), ev_estimate_high (numeric), ev_currency (default 'GBP')
- ebitda (numeric), revenue (numeric), employees (int)
- reason_for_sale (text)
- created_by (FK profiles), created_at, updated_at, approved_at, approved_by

deal_listings:
- id (uuid, PK), deal_id (FK), locale ('en' | 'ar')
- headline, anonymized_description (text), full_description (text)
- ai_generated (bool), ai_generated_at, human_reviewed (bool), human_reviewed_at, human_reviewed_by
- published (bool), published_at
- UNIQUE (deal_id, locale)

deal_documents:
- id (uuid, PK), deal_id (FK), doc_type (text), file_path (text), file_size (bigint)
- sensitivity (doc_sensitivity), sha256 (text)
- uploaded_by (FK profiles), uploaded_at

deal_status_history:
- id, deal_id, from_status, to_status, changed_by, changed_at, reason

investor_profiles:
- id (uuid, PK), org_id (FK organizations), primary_contact_user_id (FK profiles)
- mandate_summary (text), kyc_status ('pending' | 'in_review' | 'approved' | 'rejected'), kyc_completed_at
- accreditation_evidence_path (text)
- created_at, updated_at

investor_mandates:
- id (uuid, PK), investor_id (FK investor_profiles)
- ticket_size_min (numeric), ticket_size_max (numeric), currency (default 'GBP')
- sectors (text[]), geographies (text[]), control_pref ('minority' | 'majority' | 'either')
- sharia_required (bool), hold_period_pref (text), free_text_mandate (text)
- embedding vector(1024) -- using Voyage AI embedding dim, but we'll use Anthropic-compatible
- active (bool, default true), created_at, updated_at

deal_embeddings:
- deal_id (FK, PK), embedding vector(1024), model (text), generated_at

matches:
- id (uuid, PK), deal_id (FK), investor_id (FK)
- score (numeric), explanation (jsonb)
- generated_at, status ('proposed' | 'reviewed' | 'surfaced' | 'engaged' | 'passed')
- reviewed_by (FK profiles), reviewed_at
- surfaced_to_investor_at, investor_response (text), investor_response_at

ndas:
- id (uuid, PK), deal_id (FK), investor_id (FK), signed_user_id (FK profiles)
- signed_at, ip_address, signature_hash, document_version
- expires_at

data_room_access:
- id, nda_id (FK), granted_at, granted_by, expires_at, revoked_at, revoked_by

bids:
- id (uuid, PK), deal_id (FK), investor_id (FK), round (bid_round)
- amount (numeric), currency, structure (jsonb), conditions (text)
- submitted_at, submitted_by (FK profiles)

audit_log:
- id (uuid, PK), actor_user_id (FK profiles), actor_org_id (FK organizations)
- action (text), target_type, target_id (uuid)
- perimeter_class (perimeter_class), payload_hash (text)
- ip_address, user_agent, ts (timestamp default now())
- INDEX on (actor_user_id, ts), (target_type, target_id, ts)

communications:
- id (uuid, PK), from_user_id, to_user_id, channel ('email' | 'sms' | 'in_app')
- subject, content_redacted (text), perimeter_class
- dispatched_at, delivered_at, opened_at

ROW LEVEL SECURITY (RLS):
Enable RLS on every table. Add policies:

profiles: users can read/update only their own row; admins can read all.

organizations: members can read their orgs; admins read all; insert restricted.

deals:
- partner org members can read/write deals belonging to their org
- investors can read deals where status='live' AND a match or NDA exists
- admins read all

deal_documents:
- sensitivity='public' → anyone authenticated can read
- sensitivity='partner_shared' → org members + matched investors
- sensitivity='nda_gated' → investors with active NDA
- sensitivity='data_room' → investors with active data_room_access

investor_mandates: investor org members read/write own; admins read all.

audit_log: insert-only for application; admins read; nobody updates or deletes.

Create supabase/seed.sql with:
- An internal organization called "SKYVENE Internal"
- Admin user placeholder (to be linked when first admin signs up)

Create lib/supabase/types.ts with TypeScript types matching the schema (export Database type for Supabase client).

Create lib/supabase/client.ts (browser client) and lib/supabase/server.ts (server client with cookies handler).

Create scripts/db-push.sh that runs the migration via Supabase CLI.

Update README with database setup instructions.

VERIFICATION:
1. Run migration in Supabase SQL editor (or via CLI if installed)
2. All tables visible in Supabase Table Editor
3. RLS enabled on all tables (shown in Supabase UI)
4. Generate types: `npx supabase gen types typescript --project-id YOUR_ID > src/lib/supabase/types.ts`
5. TypeScript compiles cleanly
```

**STOP. Run the migration in Supabase. Verify tables exist with RLS enabled. Then proceed.**

---

PROMPT 2 — Internationalization & RTL foundation

```
Set up next-intl for EN + AR routing with full RTL support. This is foundational — every page from now on must work in both locales.

Configure middleware.ts at project root to:
- Detect locale from URL prefix (/en/, /ar/)
- Default to /en if no locale specified
- Combine with future Supabase auth middleware (leave hook for later)

Create src/lib/i18n/config.ts:
- locales: ['en', 'ar']
- defaultLocale: 'en'
- direction map: { en: 'ltr', ar: 'rtl' }

Create src/messages/en.json and src/messages/ar.json with these initial namespaces (provide professional, idiomatic translations — Gulf Arabic business register, NOT literal MSA):

{
"common": {
"skyvene": "SKYVENE",
"tagline": "Cross-Border Deal Infrastructure",
"signin": "Sign In",
"signup": "Get Access",
"language": "Language",
"english": "English",
"arabic": "العربية"
},
"nav": {
"home": "Home",
"partners": "For Partners",
"investors": "For Investors",
"sectors": "Sectors",
"about": "About",
"contact": "Contact"
},
"hero": {
"headline": "Where UK Deal Flow Meets GCC Capital",
"subheadline": "Cross-border M&A infrastructure for mid-market businesses, qualified investors, and the professionals who advise them.",
"cta_partner": "Partner With Us",
"cta_investor": "Apply as Investor"
},
"marketing": {
"value_partners_title": "For UK Partners",
"value_partners_body": "Insolvency practitioners, accountants, and corporate lawyers — bring your deal flow to a qualified GCC investor pool you cannot reach alone. Transparent revenue share on every closed transaction.",
"value_investors_title": "For GCC Investors",
"value_investors_body": "UK mid-market opportunities curated to your mandate, with structured information access, professional due diligence support, and Arabic-first service.",
"value_sellers_title": "For UK Business Owners",
"value_sellers_body": "Access international capital through your trusted advisor, with confidentiality, structure, and competitive bidding."
},
"compliance": {
"ai_generated": "AI-generated content — for information only, not investment advice",
"indicative_only": "Indicative only — independent professional advice required before relying on this information",
"regulated_notice": "SKYVENE facilitates introductions and provides information. It does not provide regulated investment advice."
}
}

Arabic translations must use proper Gulf business register. Examples of correct register:
- "Sign In" → "تسجيل الدخول"
- "Get Access" → "طلب الانضمام"
- "Partner With Us" → "كن شريكاً معنا"
- "Apply as Investor" → "التقديم كمستثمر"
- "Cross-Border Deal Infrastructure" → "البنية التحتية للصفقات عبر الحدود"

Configure src/app/[locale]/layout.tsx:
- Set <html lang={locale} dir={direction}>
- Apply font: Inter for en, IBM Plex Sans Arabic for ar (use next/font/google)
- Wrap children in NextIntlClientProvider

Create src/components/ui/locale-switcher.tsx — a dropdown that swaps between /en and /ar preserving the current path.

Update tailwind.config.ts to use logical properties helpers and ensure RTL flipping works.

Create src/app/[locale]/(marketing)/page.tsx with a minimal hero section using the i18n strings, just to verify EN/AR rendering works correctly with RTL.

Add a /demo/rtl-check route that renders:
- A card with text, an icon, an arrow, and a button
- The same card mirrored correctly in Arabic
- Side-by-side comparison so you can verify RTL is working

VERIFICATION:
1. Visit http://localhost:3000 → redirects to /en
2. Visit http://localhost:3000/ar → loads Arabic, RTL direction set on <html>, font is IBM Plex Sans Arabic
3. Visit /en/demo/rtl-check and /ar/demo/rtl-check → arrows flip correctly, text alignment correct
4. Locale switcher in header swaps locales preserving path
```

**STOP. Verify both locales work and Arabic actually looks right (not just translated — the layout and typography should feel native). If anything looks off, iterate before moving on.**

---

PROMPT 3 — Component library & design system

```
Build SKYVENE's component library. These components will be used everywhere — they must be polished, brand-consistent, and bilingually correct.

Read the design system from project context: navy primary (#0A2540), brand blue (#0066CC), cyan highlight (#00B4D8), surface (#F4F7FB), text (#1A1A1A), muted (#6B7280), warn (#D97706), error (#DC2626). Inter for English, IBM Plex Sans Arabic for Arabic.

Build these components in src/components/ui/:

1. Button — variants: primary, secondary, ghost, destructive, outline. Sizes: sm, md, lg. Loading state with spinner. Icon-left and icon-right slots. RTL-aware (icon position flips with direction).

2. Input — text, email, number, tel. Label, helper text, error state. RTL-aware text alignment.

3. Textarea — multi-line. Character counter optional.

4. Select — using @radix-ui/react-select. Custom styled. Bilingual.

5. Card — Card, CardHeader, CardTitle, CardDescription, CardContent, CardFooter. Subtle border with hover lift.

6. Badge — variants: default, success, warning, error, info. For deal status, sector tags, etc.

7. Dialog — using @radix-ui/react-dialog. RTL-aware close button position.

8. Tabs — using @radix-ui/react-tabs.

9. Toast — using @radix-ui/react-toast. Success, error, info variants.

10. Skeleton — loading placeholder.

11. ComplianceBadge — special component that wraps AI-generated content with a clearly visible "AI-generated — informational only" label. Two variants: inline (small badge above content) and overlay (banner at top of section). Styled with warn color. Bilingual labels.

12. LocaleSwitcher — already created in Prompt 2, refine if needed.

13. AppHeader — sticky top header with SKYVENE wordmark, primary nav, locale switcher, sign in / dashboard button. Different content authenticated vs unauthenticated.

14. AppFooter — multi-column footer with company info, partner/investor links, compliance/legal, social. Confidentiality and regulatory disclaimer at bottom.

Build these higher-order layout components in src/components/marketing/:

15. SectionHero — large hero with headline, subheadline, dual CTAs, background gradient using brand colors.

16. SectionFeature — alternating image/content blocks with icon, title, body.

17. SectionStats — numerical highlights (e.g., "20+ years GCC experience", "£500B+ UK SME market").

18. SectionTestimonial — quote with attribution (placeholder for now, real ones once available).

19. SectionCTA — call-to-action band with single dominant CTA.

For the app surface in src/components/app/:

20. AppShell — sidebar + main content layout. Sidebar collapsible. RTL-aware (sidebar flips to right side in Arabic).

21. PageHeader — title, optional description, actions slot.

22. EmptyState — illustration, title, description, optional CTA. For empty dashboards.

23. DataTable — sortable, paginated table using react-table or simple custom. RTL-aware.

24. StatusPill — colored pill for deal status with icon.

Create a /components-demo route (locale-aware) that renders every component in both light and dark contexts, in both EN and AR. This is your visual regression check.

Use shadcn/ui patterns and class-variance-authority for variants. All components fully typed in TypeScript. All accept className for override.

VERIFICATION:
1. Visit /en/components-demo and /ar/components-demo
2. Every component renders correctly in both locales
3. RTL components actually flip (sidebar position, icons, text alignment)
4. ComplianceBadge clearly distinguishes AI-generated content
5. No TypeScript errors
```

**STOP. Spend 15 minutes on /components-demo. If any component looks generic or AI-defaulty, prompt Claude Code to refine — "this card looks generic, give it more SKYVENE character — subtle border accent in brand blue, deeper shadow on hover, more spacious padding". Polish matters.**

---

PROMPT 4 — Public marketing surface

```
Build the SKYVENE public marketing site. This is what insolvency practitioners, GCC family offices, and the UK Home Office endorsing body see first. It must be tier-1 quality.

Create these pages under src/app/[locale]/(marketing)/:

1. page.tsx (homepage)
- SectionHero with main headline from i18n
- SectionFeature alternating: "Cross-Border by Design", "AI-Augmented, Human-Led", "Compliance-First Architecture"
- SectionStats: years of GCC experience, UK SME market size, GCC AUM stat
- Three audience tiles: For Partners | For Investors | For Sellers — each linking to their dedicated page
- SectionCTA at bottom

2. partners/page.tsx
- Hero: "Bring your deal flow to GCC capital"
- Value props: revenue share, AI-augmented listing, qualified investor pool, white-label option
- "Who this is for" section: insolvency practitioners, accountants, corporate lawyers, restructuring specialists
- How it works (4-step visual flow): Submit → AI profile → Match → Close
- Commercial model: clear sliding-scale revenue share table
- CTA: "Apply to become a partner"

3. investors/page.tsx
- Hero: "UK opportunities, qualified for your mandate" (Arabic version culturally adjusted)
- Value props: curated mandate matching, Arabic-first service, qualified DD support, Sharia-compliant options
- Investor tier table: Member (free) | Premium (£3,500/yr) | Institutional (£12,500/yr) | Strategic (bespoke)
- "How we serve GCC investors" section
- Founder credibility block (Bilal's GCC track record)
- CTA: "Apply as investor"

4. sellers/page.tsx
- Hero: "International capital through your trusted advisor"
- "How it works for business owners" — note SKYVENE works with sellers via their professional advisors
- Confidentiality section
- Sectors served grid

5. sectors/page.tsx + dynamic [sector] sub-pages
- Sectors: manufacturing, healthcare, hospitality, professional-services, technology, real-estate, education
- Each sector page: market context, typical deal sizes, GCC investor appetite, recent (anonymized) examples placeholder

6. about/page.tsx
- Founder bio (Bilal — write strong, factual, references 20+ years GCC banking and current Dubai advisory firm)
- Spotlight technology partner mention
- Advisory panel placeholder (to be filled)
- Mission and values

7. compliance/page.tsx
- Regulatory positioning statement (conservative — SKYVENE facilitates introductions and provides information)
- AML/CTF policy summary
- GDPR / UK data protection summary
- Important: "Subject to validation by qualified UK legal counsel" footer note
- Links to: privacy policy, terms, AML/CTF policy, cookies

8. privacy/page.tsx, terms/page.tsx — full legal copy in EN and AR (use placeholder appropriate-but-conservative content noting these are subject to legal review)

9. contact/page.tsx
- Form: name, email, organization, role (partner/investor/seller/other), message
- Submission goes to Resend (placeholder API route)
- Office address placeholder for London + Dubai
- WhatsApp Business number placeholder

DESIGN REQUIREMENTS:
- Premium institutional aesthetic — think Goldman Sachs meets Stripe, NOT generic SaaS
- Lots of whitespace, restrained color use, navy + blue + occasional cyan accent
- High-quality stock imagery placeholders or solid color/gradient blocks (do NOT use emoji or generic icons)
- Subtle motion — fade-ins on scroll, hover lifts on cards
- Mobile-first responsive
- Page Speed target 90+ on mobile

CONTENT TONE:
- Confident but never boastful
- Specific numbers where possible (years of experience, market sizes)
- No "leverage", "synergize", "innovative platform" language — write like a serious institution
- Arabic content uses Gulf business register, not literal translation

For each page, all i18n strings go in messages/en.json and messages/ar.json under appropriately namespaced keys.

VERIFICATION:
1. All pages load in both /en and /ar
2. Lighthouse mobile score 85+ on homepage
3. All CTAs link to correct destinations (auth flow placeholders fine)
4. Contact form submits and shows success toast
5. Arabic version genuinely feels native, not translated
```

**STOP. View on actual mobile device or DevTools mobile mode. The marketing site is your demo to Bilal — it should look serious enough that a Riyadh family office would take a meeting.**

---

PROMPT 5 — Authentication & user flows

```
Build SKYVENE's authentication system using Supabase Auth.

Auth flows needed:
1. Sign up (with role selection: partner | investor | seller)
2. Sign in (magic link primary, password optional)
3. MFA enrollment (mandatory for partner and investor roles)
4. Password reset
5. Email verification
6. Sign out

Build these routes under src/app/[locale]/(auth)/:

1. signin/page.tsx — magic link form (email input, "Send magic link" button)
2. signup/page.tsx — full signup with role selection, organization name, primary contact name
3. verify/page.tsx — landing for magic link callback
4. mfa-setup/page.tsx — TOTP setup with QR code
5. forgot-password/page.tsx — reset request
6. reset-password/page.tsx — reset confirmation

Build src/lib/supabase/middleware.ts to handle auth in middleware (combine with existing i18n middleware):
- Refresh expired sessions
- Redirect unauthenticated users from (app) routes to /signin
- Redirect authenticated users from /signin to their dashboard

On signup, create:
1. Row in profiles with selected role and locale
2. Row in organizations (if partner or investor)
3. Row in organization_members linking them
4. Audit log entry

Create src/lib/auth/actions.ts with server actions:
- signUpAction(formData)
- signInAction(formData)
- signOutAction()
- enrollMfaAction()
- verifyMfaAction(code)

Create src/lib/auth/helpers.ts:
- getUser() — server-side current user
- requireUser() — throws if no user
- requireRole(role) — throws if user lacks role
- getUserOrg() — fetches user's organization

Update AppHeader to show:
- Unauthenticated: Sign in, Get Access buttons
- Authenticated: User dropdown with name, role, dashboard link, sign out

After signup, redirect to role-specific dashboard:
- partner → /[locale]/partner
- investor → /[locale]/investor
- seller → /[locale]/seller (placeholder for now)
- admin/staff → /[locale]/admin

Each dashboard for now is just a placeholder page with "Welcome [name], you are a [role]".

Email templates for magic link and verification — use Resend, EN and AR templates based on user locale stored in profiles.

CRITICAL: Every auth action writes to audit_log with appropriate perimeter_class='information'. Failed attempts also logged.

VERIFICATION:
1. Sign up as partner → receive magic link email → click → land on /en/partner
2. Sign up as investor → MFA enrollment prompt → enroll → land on /en/investor
3. Sign out → redirect to home
4. Try to access /en/partner without auth → redirect to /signin
5. Locale persists through auth flow (sign up in /ar stays in /ar)
6. audit_log has rows for every auth action
```

**STOP. Create test accounts for partner, investor, admin. Verify the role-based routing works. Verify audit_log is capturing events.**

---

PROMPT 6 — Anthropic Claude integration & Compliance Perimeter Agent

```
Set up the Anthropic Claude integration foundation and build the FIRST AI agent — the Compliance Perimeter Agent. This must come before any other agent because every other agent's outputs will pass through it.

Create src/lib/anthropic/client.ts:
- Initialize Anthropic SDK with API key from env
- Use claude-opus-4-7 as the default model (latest Claude Opus)
- Helper function for structured output via tool use
- Token counting utility

Create src/lib/anthropic/agents/compliance-perimeter.ts:

This agent classifies any piece of content into one of four FCA perimeter categories:
- 'information' — pure facts, no interpretation, no comparison, no recommendation
- 'introduction' — connecting parties for independent evaluation
- 'arrangement' — actively facilitating a transaction
- 'advice' — recommending one investment over another, or recommending action

System prompt (use this exactly):

"You are the Compliance Perimeter Agent for SKYVENE, a UK-based cross-border M&A infrastructure platform. Your role is to classify content under UK Financial Services and Markets Act 2000 (FSMA) perimeter rules — distinguishing what is permissible information-sharing from what would constitute regulated activity requiring FCA authorization.

You operate on conservative defaults: when in doubt, classify content into the higher-restriction category. Your classifications determine whether content is published, requires disclaimers, requires human review, or is blocked.

Classify each piece of content into exactly one of four categories:

1. INFORMATION — Pure factual content. Describes a business, presents financial data, lists historical transactions, explains how a process works. No interpretation, no comparison between investments, no recommendation. SAFE DEFAULT.

2. INTRODUCTION — Connecting two parties so they can independently evaluate a potential transaction. Saying 'this deal matches your declared mandate' is an introduction; saying 'this is a good investment for you' is not. PERMITTED with appropriate framing.

3. ARRANGEMENT — Actively structuring or facilitating a transaction. Coordinating bid timing, advising on deal structure, negotiating terms on behalf of a party. REQUIRES careful structuring; may need authorized firm involvement.

4. ADVICE — Recommending one investment over another, recommending action, expressing opinion that an investment is suitable for a specific person. OUT OF SCOPE for SKYVENE absent FCA authorization. BLOCK.

Output JSON via tool use with: { class, confidence (0-1), reasoning, suggested_disclaimer (if any), block (bool) }.

Conservative defaults: classify ambiguous content one tier more restrictive. Confidence below 0.7 → escalate to human review."

Implement the agent function:

async function classifyPerimeter(content: string, context?: { audience: 'partner' | 'investor' | 'public', content_type: 'listing' | 'message' | 'analysis' | 'recommendation' }): Promise<PerimeterClassification>

Returns: { class: PerimeterClass, confidence: number, reasoning: string, disclaimer?: string, block: boolean, requires_human_review: boolean }

Create src/lib/compliance/disclaimers.ts with standard disclaimers (EN + AR) for each class:
- information_disclaimer: "This information is provided for general informational purposes. SKYVENE does not provide investment advice. Independent professional advice should be sought before any investment decision."
- introduction_disclaimer: "SKYVENE facilitates introductions between parties. SKYVENE does not assess suitability of investments for specific persons. All decisions remain with the parties."
- arrangement_disclaimer: "Where SKYVENE facilitates transaction arrangements, this does not constitute investment advice. Parties should engage qualified professional advisors."

Arabic versions properly translated to Gulf business register.

Create src/lib/compliance/wrap.ts:
- wrapContent(content, classification): adds disclaimers, formats with ComplianceBadge
- Used by ANY agent that produces user-facing output

Create an audit hook:
- Every classification call logs to audit_log with perimeter_class, content_hash, model used, decision

Create test page at /en/admin/compliance-test (admin only):
- Textarea for content input
- "Classify" button
- Display: classification, confidence, reasoning, suggested action
- Test cases pre-loaded:
1. "Acme Manufacturing reported £4.2M EBITDA in 2024" → expect INFORMATION
2. "This deal matches your mandate for UK manufacturing 5-15M EV" → expect INTRODUCTION
3. "We recommend you proceed with this acquisition based on your portfolio" → expect ADVICE (blocked)
4. "I will negotiate the price down to £18M on your behalf" → expect ARRANGEMENT
5. "أوصي بهذه الصفقة لمحفظتك" (I recommend this deal for your portfolio in Arabic) → expect ADVICE (blocked)

VERIFICATION:
1. /en/admin/compliance-test classifies all 5 test cases correctly
2. Arabic input handled correctly
3. ADVICE-class content blocked from any user-facing rendering
4. audit_log captures every classification
5. wrapContent() correctly attaches disclaimers to non-blocked content
```

**STOP. Test with edge cases. Try to break it. The Compliance Perimeter Agent is the safety layer — every other agent depends on it.**

---

PROMPT 7 — Deal Intelligence Engine (Agent 1)

```
Build the Deal Intelligence Engine — the AI agent that takes a UK business submission from a partner and generates a structured deal profile, valuation range, and bilingual listing.

Create src/lib/anthropic/agents/deal-intelligence.ts.

INPUT:
- Uploaded financial documents (PDF) — the agent reads them via Claude's PDF support
- Partner-supplied narrative text
- Sector classification, geography, reason for sale

PROCESSING (multi-step prompt chain):

Step 1 — Financial extraction:
"Extract financial data from the provided documents. Output structured JSON: { revenue: { years: [{year, amount, currency}] }, ebitda: { years: [...] }, gross_margin, net_margin, working_capital_trend, customer_concentration_indicators, related_party_flags, going_concern_indicators }."

Step 2 — Risk analysis:
"Given the extracted financials and partner narrative, identify risk factors. Output: [{risk, severity (low|medium|high), evidence, requires_human_review (bool)}]. Be conservative — flag for human review when uncertain."

Step 3 — Valuation indication:
"Given the financials, sector, and geography, estimate an indicative EV range. Use sector-appropriate EBITDA multiples. Output: { ev_low, ev_high, currency, methodology, assumptions: [], comparable_transactions (if any noted in input). Make explicit that this is indicative only, based on limited information, not a formal valuation."

Step 4 — Listing draft (English):
"Draft a deal listing. Output two versions: anonymized_teaser (3-4 paragraphs, no identifying information, sector + size + opportunity description) and full_description (comprehensive, post-NDA version with full business profile). Tone: institutional, factual, never promotional."

Step 5 — Listing draft (Arabic):
"Translate the listings to Gulf Arabic business register. NOT literal MSA translation. Idiomatic, professional Arabic as used in UAE/KSA institutional finance."

Step 6 — Buyer mandate description:
"Describe the ideal buyer for this deal. Output: { buyer_type, ticket_size_range, sector_familiarity, control_preference, value_add_required, geographic_fit, structural_preferences }. This output feeds the matching engine."

Each step's output passes through the Compliance Perimeter Agent before storage.

OUTPUT (saved to deal_listings, deals.ev_estimate_*, etc.):
- structured_profile: jsonb
- listing_en: { headline, anonymized_teaser, full_description }
- listing_ar: { headline, anonymized_teaser, full_description }
- valuation: { ev_low, ev_high, currency, methodology, assumptions[] }
- risks: [{risk, severity, evidence}]
- buyer_mandate_description: structured object
- ai_generated_at, ai_model_version

CRITICAL FLAGS:
- All outputs labeled 'ai_generated: true, human_reviewed: false'
- Listings NOT published until admin approves
- ComplianceBadge wraps every AI output in UI

Build the Partner Deal Submission Flow under src/app/[locale]/(app)/partner/deals/new/:

Multi-step form:
1. Basic info: business name (will be anonymized), sector, country, region, employee count
2. Financial documents upload (PDF, multiple files, sensitivity tagged 'partner_shared' initially)
3. Narrative: reason for sale, business overview (free text), partner notes
4. Review & submit

On submit:
1. Create deal row (status='draft')
2. Upload documents to Supabase Storage (encrypted)
3. Trigger Deal Intelligence Engine (background job — use Vercel Edge Function or simple async)
4. Update status to 'in_review' once AI generation complete
5. Notify admin (email via Resend)

Build admin review interface at /en/admin/deals/[id]/review:
- Show all AI-generated outputs side-by-side with original documents
- Edit capability on listing text
- Approve / request revisions / reject buttons
- On approve → status='approved', listing.published=true, listing.human_reviewed=true
- Audit log every action

Partner dashboard at /en/partner:
- List of submitted deals with status pills
- Click to /partner/deals/[id] showing AI-generated profile (read-only) + status + admin feedback
- "Submit new deal" CTA

VERIFICATION:
1. Partner submits a deal with sample financial PDF
2. AI generates profile within 90 seconds
3. Admin reviews at /admin/deals/[id]/review — sees structured output with disclaimers
4. Admin approves → deal status updates → partner sees approved status on dashboard
5. ComplianceBadge visible on every AI output
6. audit_log captures: submission, AI generation, perimeter classification, review, approval

TEST DATA: Create a sample financial PDF for testing. Or use a realistic mock document.
```

**STOP. Test the full flow with a realistic mock PDF. The output quality here determines whether Bilal can demo this to a UK insolvency practitioner. If the AI output is generic or weak, refine the prompts.**

---

PROMPT 8 — Investor onboarding & mandate capture

```
Build the investor side of the platform: onboarding, KYC capture, mandate definition.

Build investor onboarding flow at /[locale]/investor/onboarding/:

Step 1 — Welcome & intro
- Brief intro to SKYVENE
- What to expect: KYC, mandate definition, deal feed

Step 2 — Personal information
- Full legal name, nationality, country of residence
- Phone (WhatsApp), preferred language (en/ar)
- Investor type: individual HNW, family office representative, institutional, fund manager

Step 3 — KYC documents
- Government ID upload (passport, Emirates ID, etc.)
- Proof of address (utility bill, bank statement)
- Source of wealth declaration
- Sanctions screening consent
- Save to deal_documents with sensitivity='private', linked to investor_profiles

Step 4 — Accreditation
- Net worth band, investment experience, prior transactions
- Self-declaration with attestation

Step 5 — Investment mandate
- Ticket size range (slider: £100k to £100M)
- Sectors (multi-select with Arabic translations: manufacturing, healthcare, hospitality, professional services, technology, real estate, education, other)
- Geographies (UK regions: London, South East, South West, Midlands, North, Scotland, Wales, NI)
- Control preference: minority | majority | either
- Sharia compliance required: yes | no
- Hold period preference
- Free-text mandate description (encouraged: "what makes a deal interesting to me")

Step 6 — Subscription tier
- Show tier comparison: Member (free) | Premium | Institutional | Strategic
- Allow defer to "decide later" → defaults to Member

Step 7 — Review & submit
- Show all entered information
- Terms & conditions checkbox
- Privacy policy checkbox
- Submit → investor_profiles row created with kyc_status='pending'

After submission:
1. KYC review queue notification to admin
2. Investor lands on /en/investor/dashboard with "Your account is in KYC review" status
3. Once admin approves → kyc_status='approved' → unlocks deal feed

Build admin KYC review at /en/admin/investors/[id]/kyc:
- All submitted documents
- Sanctions screening results (use a placeholder service or manual flag)
- PEP screening (manual flag)
- Approve / request more info / reject
- Audit log everything

Build investor dashboard at /en/investor:
- Welcome state if KYC pending: "Account in review, typical 2-3 business days"
- Once approved:
- "Your mandate" summary card with edit link
- "Curated deals" empty state if no matches yet
- Subscription tier indicator
- Recent activity

Build mandate edit page at /en/investor/mandate:
- Same form as onboarding step 5
- Save updates trigger re-embedding (next prompt builds matching engine)

CRITICAL — Bilingual UX:
- Arabic-locale investors see Arabic-first throughout
- Hijri date display optional (toggle in profile)
- WhatsApp Business as primary communication channel for AR investors
- Currency display: amounts in GBP with AED/SAR conversion shown alongside

VERIFICATION:
1. Sign up as investor → land in onboarding
2. Complete all 7 steps → submit
3. Land on dashboard with "in review" status
4. As admin, navigate to KYC review → see uploaded docs → approve
5. Investor refreshes dashboard → KYC approved, mandate visible
6. Edit mandate → changes save
7. Full flow works in Arabic locale with proper RTL
```

**STOP. Test the investor flow end-to-end in both locales. If the Arabic version feels translated rather than native, fix it.**

---

PROMPT 9 — Buyer Matching Engine (Agent 2)

```
Build the Buyer Matching Engine — generates ranked matches between deals and investor mandates using vector embeddings + structured filters.

Create src/lib/anthropic/agents/matching.ts.

EMBEDDINGS:
Use Voyage AI's voyage-3 model (or similar 1024-dim embedding model). If using Anthropic-only, use Claude to generate semantic representation that you then embed via a separate service. For simplicity, use OpenAI's text-embedding-3-small as embedding service (dim=1536) — adjust schema if needed.

Actually, for self-contained: use Voyage AI which Anthropic recommends. Set VOYAGE_API_KEY in env.

Generate embeddings for:
1. Deal: combination of buyer_mandate_description + sector + structured_profile summary
2. Mandate: combination of free_text_mandate + structured fields rendered as text

Save embeddings to deal_embeddings and investor_mandates.embedding columns.

MATCHING ALGORITHM:
async function generateMatches(dealId: string): Promise<Match[]>

1. Fetch deal embedding + structured criteria (EV range, sector, geography, structure)
2. Query investor_mandates where:
- active = true
- kyc_status = 'approved'
- ticket_size_min <= deal.ev_high AND ticket_size_max >= deal.ev_low
- sectors array contains deal.sector OR sectors is empty (open mandate)
- sharia_required = false OR deal supports Sharia structure
3. For each candidate, compute:
- vector_similarity = cosine similarity between embeddings
- hard_filter_score = 1.0 if all hard filters pass
- historical_signal = +0.1 if investor has engaged similar past deals, +0.2 if closed similar
- composite_score = 0.5 * vector_similarity + 0.3 * hard_filter_score + 0.2 * historical_signal
4. Rank by composite_score, return top N (default 10)

EXPLANATION GENERATION:
For top matches, use Claude to generate explanation:
"Given this deal and this mandate, explain in 2-3 sentences why they match. Be factual and specific. Reference declared mandate criteria and observable deal attributes. NEVER frame as 'good investment' — only as 'fits declared mandate'. Output in investor's locale."

Result: { score, vector_similarity, hard_filter_pass, historical_signal, explanation_en, explanation_ar }

Pass explanations through Compliance Perimeter Agent — must be classified INTRODUCTION, never ADVICE.

Save to matches table.

INTERNAL REVIEW WORKFLOW:
During first 6 months (configurable via feature flag), all matches require admin review before surfacing to investor:
- Match generated → status='proposed'
- Admin sees in /en/admin/matches → reviews → approves or skips
- On approve → status='surfaced' → investor sees in their feed
- audit_log every decision

Investor-facing surfacing:
- Investor dashboard: "X new opportunities matched to your mandate"
- /en/investor/deals — list of surfaced matches with explanation
- Click → deal teaser (anonymized) → "Request more information" button → triggers NDA flow (next prompt)

REVERSE MATCHING:
When new investor mandate is created/updated, also run matching against all live deals.
When new deal is approved, also run matching against all active investor mandates.

Trigger generation:
- On deal approval (post Prompt 7 admin approval)
- On mandate save (post onboarding or edit)
- Manual trigger from admin: "Re-run matching for [deal/investor]"

Build admin matches dashboard at /en/admin/matches:
- Tabs: Proposed (awaiting review) | Surfaced (live) | Engaged (NDA signed) | Passed
- Each row: deal name, investor org, score, AI explanation, review actions
- Bulk approve option

Build investor deals feed at /en/investor/deals:
- Cards for each surfaced match
- Each card: anonymized teaser, score visualization, AI explanation, "Request access" CTA
- Sort by score, filter by sector
- Empty state with link to "review your mandate"

VERIFICATION:
1. Approve a deal → matching runs automatically → matches generated for relevant investors
2. Admin sees matches in /admin/matches → reviews and approves
3. Investor sees match in /investor/deals with proper explanation
4. Explanation is INFORMATION or INTRODUCTION class only (never ADVICE)
5. Vector similarity actually correlates with intuitive fit
6. Reverse matching works: new investor → matches against existing live deals
7. Both languages display correctly
```

**STOP. Create test deals (3 different sectors, different EV ranges) and test investors (3 different mandates) and verify matching produces sensible results. Tune scoring weights if needed.**

---

PROMPT 10 — NDA flow & Data Room

```
Build the NDA execution flow and data room access for matched investors.

NDA FLOW at /[locale]/investor/deals/[id]/nda:

When investor clicks "Request access" on a matched deal:
1. Show deal teaser (already visible) + "To proceed, sign our standard NDA"
2. Display NDA full text (EN or AR based on investor locale)
3. NDA includes:
- Definition of confidential information
- Permitted use (evaluation only)
- Standstill provision (no direct contact with target)
- Survival period (typically 2 years)
- Governing law (England & Wales)
- Electronic signature acceptance
4. Checkbox: "I have read and agree to the NDA"
5. Click "Sign electronically" → captures: signed_at, IP, user_agent, content hash, electronic signature
6. Insert ndas row, insert data_room_access row (granted_at=now, expires_at=now+90days)
7. Email confirmation (EN/AR) with NDA PDF copy attached
8. Redirect to deal data room

DATA ROOM at /[locale]/investor/deals/[id]/dataroom:

Layout: file tree on left (or top in mobile), document viewer on right.

Document categories:
- Financial: P&L, balance sheet, cash flow, management accounts, tax returns
- Legal: corporate structure, key contracts, IP, litigation history
- Commercial: customer list (anonymized), supplier list, market analysis
- Operational: org chart, key personnel, HR summary
- Information memorandum (full description)

Access controls:
- Every document fetch via signed URL with 15-min expiry
- Audit log every view: investor_id, doc_id, ts, ip
- Document watermarking (visible "Confidential — [Investor Name] — [timestamp]" overlay if PDF)
- No download for sensitive docs (view-only in browser via PDF viewer)
- Download permitted for IM and standard docs with watermark

Add session monitoring: max 3 concurrent sessions per investor, idle timeout 15min.

DD CO-PILOT trigger on data room:
- "Ask a question about these documents" button
- Click → opens DD Co-Pilot chat panel (Agent 3 - next prompt)

ADMIN side:
- /en/admin/deals/[id]/dataroom — manage documents in data room
- Upload, categorize, set sensitivity
- View access log (who viewed what when)
- Revoke specific NDAs or access

PARTNER side:
- /en/partner/deals/[id]/access — see who has signed NDA, who is actively viewing
- Activity stats (heat map of which docs are getting viewed)

EMAILS via Resend:
- NDA signed confirmation (EN/AR templates)
- New investor signed NDA (to admin + partner)
- Data room expiring in 7 days

VERIFICATION:
1. Investor clicks "Request access" on matched deal → NDA modal
2. Investor signs → ndas row created with hash, IP captured
3. Email sent to investor with PDF NDA copy
4. Data room loads with document list
5. Click document → loads via signed URL → audit log entry
6. Watermark visible on rendered PDFs
7. Admin sees full access log
8. NDA expires correctly after 90 days (test by manipulating expires_at)
```

**STOP. Test the NDA flow rigorously — this is legally significant. Verify hash integrity, audit logging, and access controls.**

---

PROMPT 11 — DD Co-Pilot (Agent 3)

```
Build the Due Diligence Co-Pilot — an AI assistant that helps qualified professionals analyze data room contents.

CRITICAL FRAMING: This is a CO-PILOT, not a replacement for professional DD. Every output is explicitly framed as draft requiring qualified review. Never generates an investment recommendation.

Create src/lib/anthropic/agents/dd-copilot.ts.

CAPABILITIES:

1. Document Q&A
- Investor asks question about data room documents
- Agent reads relevant documents (using Claude's PDF support and long context)
- Returns answer with citations: "Per Document A page 3, [fact]" — every assertion tied to source
- If question requires opinion or recommendation → refuses, redirects to "consult your professional advisor"

2. Anomaly Detection
- On-demand or auto-run when data room first loaded
- Scans financial documents for: revenue concentration (single customer >20%), margin volatility, working capital deterioration, related-party transactions, going concern indicators, off-balance-sheet items
- Output: structured list with severity, evidence (doc + page), suggested professional review

3. Contract Clause Extraction
- User uploads or selects contract → agent extracts: parties, key terms, change of control, exclusivity, termination, key person dependencies, IP assignment, indemnities
- Risk classification per clause

4. Red Flag Report
- Comprehensive AI-generated draft red flag report
- Sections: Financial flags, Commercial flags, Legal flags (visible from documents), Operational flags
- PROMINENTLY labeled "DRAFT — REQUIRES QUALIFIED PROFESSIONAL REVIEW"
- Cannot be exported as final without admin watermark "Reviewed by [name], qualified [role]"

System prompt for DD Co-Pilot:
"You are the Due Diligence Co-Pilot for SKYVENE. You assist qualified professionals — investors, their advisors, and SKYVENE staff — in analyzing data room contents for cross-border M&A transactions.

Critical operating rules:
1. EVERY assertion must cite a specific document and page. Never state a fact without source.
2. You are AI-assisted analysis, NOT a replacement for qualified professional DD. Frame outputs accordingly.
3. You DO NOT generate investment recommendations, fairness opinions, or suitability assessments.
4. If asked for opinion on whether to invest, redirect: 'That decision requires qualified professional advice. I can help you analyze the documents but cannot recommend action.'
5. When uncertain, flag for human review. Better to flag a non-issue than miss a real one.
6. All outputs in user's locale (EN or AR).

Your value: rapid, thorough document analysis. Pattern recognition across financial documents. Surfacing items qualified humans might miss in volume. NOT replacing their judgment."

Build chat interface at /[locale]/investor/deals/[id]/dataroom/copilot:
- Chat UI with message history
- Document selector (which docs in scope for this question)
- Each AI response shows:
- Answer with inline citations (clickable links to document)
- Compliance disclaimer
- "This is AI-assisted analysis. Verify with qualified professional."
- Persistent session per investor + deal

Build anomaly detection auto-run:
- Triggered when investor first opens data room
- Background job analyzes financial documents
- Results shown in dashboard panel: "5 items flagged for review"
- Each item: severity, evidence, suggested action

Build red flag report generator:
- Click "Generate red flag report" in data room
- Wait state with progress indication (~2 min)
- Result: structured report viewable in browser, exportable as watermarked PDF
- PDF includes: deal info, generated date, AI-generated draft notice, all flags with citations, "Required: review by qualified [type] professional" sign-off block

ALL outputs through Compliance Perimeter Agent. Nothing classified ADVICE makes it to user.

Audit log every Q&A, every report generation, every document access during analysis.

VERIFICATION:
1. Open data room as investor with NDA signed
2. Click DD Co-Pilot
3. Ask: "What is the revenue trend?" → answer with citations to specific P&L pages
4. Ask: "Should I invest?" → polite redirect, no recommendation
5. Auto-anomaly detection produces flags on test deal with known issues
6. Red flag report generates with all required disclaimers and watermarks
7. All Arabic queries get Arabic responses with proper register
8. Citations clickable and accurate
```

**STOP. This is the agent that demonstrates serious technical depth. Test with real-feeling financial documents. If citations are wrong or hallucinated, that's a critical failure — fix prompts before continuing.**

---

PROMPT 12 — Bidding & Negotiation Orchestrator (Agent 4)

```
Build the Bidding Orchestrator — manages structured bid rounds across time zones and languages.

Create src/lib/anthropic/agents/bidding.ts.

BID FLOW:

Bid rounds: indicative → confirmatory → final
Configurable per deal whether all rounds used.

INDICATIVE BIDS:
- After NDA signed and DD performed, investor can submit indicative bid
- Form: amount, structure (cash | mixed | earnout | rollover | other), conditions (free text), financing source, timeline, contact details
- Submission → row in bids table with round='indicative'
- Email confirmation to investor + admin + partner

CONFIRMATORY ROUND (admin-triggered):
- Admin selects investors invited to confirmatory round (typically top 3-5)
- Investors notified in their locale via email + WhatsApp Business
- Confirmatory bid form: detailed terms, financing letters, exclusivity ask, deadline
- Submission tracked

FINAL ROUND:
- Final binding offers
- Strict deadline
- After: admin works with selected buyer offline

BID NORMALIZATION (Agent capability):
"Given multiple bids with different structures (cash + earnout, all-cash with rollover, etc.), normalize to comparable Net Present Value at 10% discount rate. Output: normalized_amount, structure_components, certainty_score (0-1 based on financing strength)."

COMPARATIVE ANALYSIS for sellers/admin:
Agent generates ranked bid analysis:
- Headline price ranking
- NPV-adjusted ranking
- Certainty-adjusted ranking
- Structure preference fit (if seller specified preferences)
- Buyer track record assessment (if any history)

Output is INFORMATION class — never recommends "accept this bid" — just structured comparison.

TIME ZONE AWARENESS:
- All deadlines stored UTC, displayed in user's local time zone
- Default investor TZ inferred from country (Asia/Dubai for UAE, Asia/Riyadh for KSA)
- Notifications respect Gulf weekend (Friday-Saturday in some jurisdictions, Sunday-Thursday work week)
- Non-urgent comms held back during prayer times (configurable per investor)

Build interfaces:

Investor bid submission at /[locale]/investor/deals/[id]/bid:
- Step-by-step form
- Real-time validation
- "Save draft" capability
- Submit triggers confirmation modal with full review

Admin bid management at /en/admin/deals/[id]/bids:
- List of all bids by round
- Comparative analysis panel (AI-generated)
- Round status: open | closed | proceeding to next
- Actions: "Invite to next round", "Decline", "Mark winner"
- Audit log every action

Partner bid view at /en/partner/deals/[id]/bids:
- Read-only view of bid status (no buyer identities until admin reveals)
- Comparative analysis available (anonymized)

Notifications:
- Bid submitted → confirmation to investor, alert to admin + partner
- Round closing in 48 hours / 24 hours / 4 hours → reminders
- Round closed → status notification
- Selected for next round → invitation
- Not selected → courteous decline

EMAIL TEMPLATES (EN + AR via Resend):
- Bid received
- Round invitation
- Round reminder
- Round outcome
- Final selection (winner)
- Final selection (declined)

VERIFICATION:
1. Investor submits indicative bid → row created, emails sent
2. Admin sees bid in admin/deals/[id]/bids with comparative analysis
3. Admin invites top 3 to confirmatory round → those investors notified, others see "not progressing"
4. AI bid analysis correctly normalizes structures (test cash vs earnout vs rollover)
5. Time zone display correct (Dubai investor sees Asia/Dubai times)
6. Arabic emails sent for AR-locale investors
7. Audit log comprehensive
```

**STOP. Test with multiple bids of different structures to verify the AI normalization works.**

---

PROMPT 13 — Network Memory Layer (Agent 7) & founder tools

```
Build the Network Memory Layer — captures and operationalizes Bilal's relationship network. This is the long-term moat.

Create src/lib/anthropic/agents/network-memory.ts.

INPUTS:
1. Conversation notes from founder calls (manual entry or voice transcription)
2. Email correspondence (with explicit opt-in ingestion)
3. Investor mandate updates and informal preference signals
4. Deal outcome data
5. Meeting calendar entries

PROCESSING:
- Extract structured signals from unstructured notes (Claude with structured output)
- Update investor preference model over time
- Identify patterns: which investors close, who window-shops, follow-up timing
- Surface relevant historical context when new deals arrive

CAPABILITIES:

1. Note ingestion at /en/admin/network/note:
- Form: who (investor/partner search), when, channel (call/meeting/email/whatsapp), notes
- Voice-to-text option (record in browser, transcribe via Claude)
- On submit: AI extracts structured signals, updates network_signals table
- Signals: stated_preferences, capacity_indicators, timing_signals, sentiment, action_items

2. Investor profile enrichment view at /en/admin/investors/[id]:
- Beyond mandate fields: AI-generated "what we know about [investor]" summary
- Evolution over time: how preferences have shifted
- Recent interactions timeline
- Pattern observations: "Tends to engage in Q4", "Prefers manufacturing over services"

3. Deal-arrival surfacing at /en/admin/deals/[id]/network-match:
- When new deal lands, AI scans full network history
- Surfaces: "8 months ago, [Investor] said they wanted UK manufacturing 5-15M EV"
- Output: prioritized outreach list with personalized draft messages

4. Suggested outreach drafts:
- Given a deal + an investor, generate personalized email/WhatsApp draft
- References past interactions naturally
- Locale-appropriate (EN/AR)
- Through Compliance Perimeter Agent — INTRODUCTION class only

5. Risk surfacing dashboard at /en/admin/network/insights:
- Investors gone quiet (no engagement 90+ days)
- Mandate-deal mismatch trending
- Partner deal flow dropping
- Founder attention items

ADD TO SCHEMA (new migration):
- network_signals: id, subject_type ('investor'|'partner'), subject_id, signal_type, content, source, captured_at, captured_by
- network_summaries: subject_type, subject_id, summary_en, summary_ar, generated_at, model

EVERY output through Compliance Perimeter Agent.

ADMIN-only access. Never exposed to investors or partners.

VERIFICATION:
1. Add several conversation notes about a test investor
2. AI extracts signals and updates investor profile
3. Visit investor profile → see enriched summary
4. Add new deal → run "find network matches" → AI surfaces relevant historical signals
5. Click "draft outreach" → produces personalized message in correct locale
```

**STOP. Bilal will live in this interface. Make sure note entry is friction-free — voice transcription should work cleanly on mobile.**

---

PROMPT 14 — Polish, demo data, deployment

```
Final polish and prep for demo deployment to skyvenedemo.dubaiaihouse.com.

DEMO DATA SEEDING:
Create scripts/seed-demo.ts that loads:

1. Three demo deals (anonymized, realistic):
- "Project Atlas" — Birmingham manufacturing, £3.2M EBITDA, succession sale
- "Project Pearl" — Manchester healthcare clinic group, £1.8M EBITDA, growth capital
- "Project Cedar" — London hospitality (3 boutique hotels), £4.5M EBITDA, distressed restructuring

Each with:
- Mock financial PDFs (generate from templates)
- Realistic descriptions
- AI-generated profiles (already vetted)
- Pre-loaded as 'live' status

2. Five demo investors (anonymized):
- "Al Rashid Family Office" (UAE) — manufacturing/healthcare, £5-25M tickets
- "Riyadh Capital Partners" (KSA) — diversified UK opportunities, £10-50M
- "Khan Diaspora Holdings" (UAE/Pakistan diaspora) — hospitality + healthcare, £2-15M
- "Gulf Heritage Investments" — Sharia-compliant only, £5-30M
- "Doha Industrial Holdings" — manufacturing focus, £15-75M

3. Three demo partner firms:
- "Midlands Restructuring Partners" (insolvency practitioners)
- "Pennington Corporate Finance" (M&A boutique)
- "Lothian Family Business Advisors" (succession specialists)

4. Pre-generated matches between deals and relevant investors

5. Sample NDAs, sample bids on Project Atlas to demonstrate full flow

Demo accounts (with simple passwords for demo):
- admin@demo.skyvene.com — full admin access
- partner@demo.skyvene.com — sees Project Atlas as their submission
- investor.uae@demo.skyvene.com — Al Rashid investor view
- investor.ksa@demo.skyvene.com — Riyadh Capital view (Arabic locale)

PERFORMANCE OPTIMIZATION:
- Image optimization: all images use next/image
- Font loading: font-display: swap, preload critical fonts
- Code splitting: dynamic imports for admin routes
- Lighthouse audit: target 90+ mobile, 95+ desktop
- Bundle analysis: identify any heavy dependencies, optimize

ACCESSIBILITY:
- All forms have proper labels
- Color contrast WCAG AA minimum (use a tool to verify)
- Keyboard navigation works throughout
- Screen reader friendly (test with VoiceOver)
- RTL screen reader handling for Arabic

SECURITY HARDENING:
- CSP headers configured
- Rate limiting on auth endpoints
- API routes protected with auth checks
- Input validation on all forms (zod)
- SQL injection: using parameterized queries (Supabase handles this)
- XSS: sanitize any user-rendered HTML
- CSRF: Supabase auth handles this

ENVIRONMENT VARIABLES for production:
Set in Vercel project settings:
- All keys from .env.local
- NEXT_PUBLIC_APP_URL=https://skyvenedemo.dubaiaihouse.com

DEPLOYMENT:
1. Push to main branch on GitHub
2. Vercel auto-deploys
3. Configure custom domain in Vercel:
- Add skyvenedemo.dubaiaihouse.com
- Vercel provides DNS instructions
4. Configure DNS at dubaiaihouse.com registrar:
- CNAME skyvenedemo → cname.vercel-dns.com
5. Wait for SSL provisioning (~5 min)
6. Visit https://skyvenedemo.dubaiaihouse.com — should be live

POST-DEPLOY CHECKS:
- All routes load
- Demo accounts can sign in
- AI agents respond (check API key configured in Vercel)
- Bilingual switching works
- Email sends through Resend (verified domain)
- Database connection works

CREATE A DEMO SCRIPT (markdown):
docs/DEMO_FLOW.md — step-by-step demo flow for showing Bilal:
1. Land on homepage in Arabic → show RTL polish
2. Switch to English → tour marketing
3. Sign in as partner → submit a deal → watch AI generate profile
4. Sign in as admin → review and approve
5. Sign in as investor (Arabic locale) → see matched deals
6. Sign NDA → enter data room → use DD Co-Pilot
7. Submit bid
8. Sign in as admin → see bid analysis
9. Show network memory layer with founder notes

This is the demo Bilal walks through with UK partners and GCC investors.

VERIFICATION:
1. Site live at https://skyvenedemo.dubaiaihouse.com with valid SSL
2. All demo accounts work
3. End-to-end demo flow runs without errors in <10 minutes
4. Lighthouse mobile score 90+
5. Accessibility audit passes
6. No console errors in production
```

**STOP. This is launch. Deploy, share URL with Bilal, walk through the demo flow together. Capture his feedback systematically — what feels wrong, what to refine, what to add.**

---

After deployment

You now have a working SKYVENE demo at skyvenedemo.dubaiaihouse.com with:

✅ Bilingual EN/AR with full RTL
✅ Marketing surface (landing, audience pages, sectors, about, compliance)
✅ Authentication with role-based routing
✅ Partner deal submission with AI profile generation
✅ Admin review workflow
✅ Investor onboarding with KYC and mandate capture
✅ AI matching engine with explainable scoring
✅ NDA flow with audit-grade signing
✅ Data room with watermarked documents
✅ DD Co-Pilot with citation-backed analysis
✅ Bidding orchestrator with AI bid normalization
✅ Network Memory Layer for founder relationship intelligence
✅ Compliance Perimeter Agent classifying every AI output
✅ Comprehensive audit logging

This is a real platform. Bilal can:
- Demo to UK insolvency practitioners and corporate lawyers
- Demo to GCC family offices and HNWIs in Arabic
- Submit to UKES visa endorsing body as evidence of UK substance and innovation
- Begin onboarding real partners and investors after FCA perimeter validation by UK solicitor

Next phase priorities (once demo validated with Bilal)

1. **Engage UK solicitor** for FCA perimeter validation — replace conservative defaults in Compliance Perimeter Agent with legally-validated rules
2. **Penetration test** — engage external security firm before any real data
3. **First real deal** — load Bilal's first live UK partner deal with real anonymized financials
4. **First real investor** — onboard Bilal's first GCC investor with full KYC
5. **WhatsApp Business integration** — for GCC investor communications
6. **Iterate AI prompts** based on real usage feedback

---

Maintenance reminders

Monitor Anthropic API usage and costs
Monitor Supabase database size and connection limits
Quarterly security review
Weekly product review with Bilal
Audit log review monthly for any anomalies

---

**Build pack version:** 1.0
**Spotlight × SKYVENE**
**Khurram Badar — Principal**
**April 2026**