@atbas/m-mcp 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Eren Atbas
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,364 @@
+# JazzCash MCP Integration Server
+
+An MCP server that performs JazzCash payment-gateway integrations inside a merchant's own AI tooling — Claude Desktop, Claude Code, Cursor, or any other MCP client.
+
+## The problem
+
+Merchant onboarding at JazzCash depends on two resident engineers, one seat vacant, walking every merchant's developer through the same hosted checkout, the same credentials, the same hash generation, the same return URLs, the same sandbox tests. Go-live speed is capped by engineer hours rather than by how ready the merchant is, and the knowledge leaves with the people.
+
+This server encodes what those engineers know so the merchant's own AI can do the integration: look up the official guidance, generate correct code, validate parameters and secure hashes, run sandbox transactions, and diagnose failures — while the engineers keep the parts that need judgement.
+
+> **Status:** Phase 1 pilot — documentation lookup, code generation and sandbox validation. The merchant-dashboard assistant is a later phase and is not built here.
+
+## What is in this repository
+
+Three deliverables share this tree, because they share one definition of what each tool does and where it is allowed to run.
+
+**The MCP server** is the repository root, package `@atbas/m-mcp`, and is what the rest of this README describes. A merchant installs it in their own AI tooling, it answers from the corpus in `knowledge/`, and it reports to nobody. Neither project below changes its behaviour or its safety model.
+
+**`dashboard/`** is a Next.js admin console that also hosts the credential-free half of the tool surface over HTTP. It creates merchants, mints and revokes scoped access tokens, applies rate limits and quotas, and records what each token called — method, tool, outcome and duration, never arguments and never results. It holds no merchant credential of any kind: the four tools that need one are not part of the hosted surface at all, and the server it builds is constructed from an explicit environment carrying no `JAZZCASH_*` value, so those tools could not authenticate even if something asked them to. It is the operator's console for this project, not the merchant-portal assistant the status note above refers to. Its root path is the merchant-facing install guide — the one page it serves to somebody with no session — and the console proper sits behind the operator sign-in at `/admin`.
+
+**`connector/`** is `@atbas/m-mcp-connector`, the package a merchant installs in place of the bare server to reach the hosted tier, which is live. The four credential-requiring tools run locally from it, against the merchant's own environment, so no password, Integrity Salt or MPIN leaves their machine; everything else is proxied to the hosted endpoint under their token. With no token, or with that endpoint unreachable, the local half keeps working. It is licensed MIT and is released from `github.com/eatbas/m-mcp-connector`, a mirror generated from this tree; this repository stays the only place any of it is edited. **No version of it is on npm yet** — the package is built and its release procedure is written down, and neither has been run; [`docs/mcp/PUBLISHING.md`](docs/mcp/PUBLISHING.md) records what remains.
+
+The MCP server is what most of this README documents. [The hosted tier](#the-hosted-tier) below covers how the three fit together, how an operator deploys the dashboard and the endpoint, and how a merchant reaches them; [`docs/mcp/HOSTED.md`](docs/mcp/HOSTED.md) is that tier's threat model and operating manual. Once the connector is released, it is a merchant's whole install: one line, and they never see this repository at all.
+
+## Safety first
+
+Sandbox and production share **identical gateway URLs** in every official JazzCash guide. The environment is a property of the _credentials_, not the endpoint.
+
+- Every network tool requires an explicit `environment` argument.
+- Production money movement requires **both** `JAZZCASH_ALLOW_LIVE=true` in the server environment **and** `confirmLiveEnvironment: true` on the call.
+- Money-moving calls are never retried automatically.
+- Credentials are scrubbed from every tool result, both text and structured output.
+
+Read [`docs/mcp/SAFETY.md`](docs/mcp/SAFETY.md) before pointing this at production.
+
+## What it knows
+
+The knowledge corpus is transcribed from the fourteen 2026 JazzCash merchant guides in `docs/integration_documents/`, covering **14 integration flows**: card and BNPL hosted checkout, MWallet REST v1.1 and v2.0, token payment, wallet linking, token inquiry and delete, Status Inquiry v1.1 and v2.0, and four refund variants — plus IPN, the merchant portal, WooCommerce and Shopify.
+
+It also encodes the places those guides contradict themselves, because those are where merchants get stuck. Among them: the official PHP sample silently drops a value of integer `0` from the hash; the wallet-linking sample publishes the Integrity Salt in browser JavaScript; card and BNPL refunds return unprefixed response fields; the MWallet v2.0 sample sets an expiry two days out while the same page says one; the token payment sample sets an expiry two months _before_ its transaction. All are recorded, tested against, and corrected in generated code.
+
+Open questions raised by this work are collected in [`docs/mcp/JAZZCASH-CLARIFICATIONS.md`](docs/mcp/JAZZCASH-CLARIFICATIONS.md) for the acquiring team.
+
+## Install
+
+### For merchants — once published
+
+```bash
+npx -y @atbas/m-mcp        # nothing to clone, nothing to build
+```
+
+Or register it directly with your AI tool and let the tool fetch it:
+
+```json
+{ "mcpServers": { "m-mcp": { "command": "npx", "args": ["-y", "@atbas/m-mcp"] } } }
+```
+
+`npx` keeps merchants on the current corpus automatically, which matters because JazzCash reissues these guides yearly.
+
+> **Not yet published.** Nothing is on npm under either name: `npm view jazzcash-mcp` returned a 404 on 2026-08-23, and the package was renamed to `@atbas/m-mcp` later the same day without a version ever being published under it — so neither command above resolves anything today. What was holding it is settled: redistribution of the transcribed corpus was authorised by the product director on 2026-08-23 (assumption A7), the licence decision is MIT, and `package.json` now carries that licence and no `"private"` key. `npm pack` works and the tarball has been verified end to end; [`docs/mcp/PUBLISHING.md`](docs/mcp/PUBLISHING.md) lists the steps that remain, and the one question — trademark — that is still JazzCash's to answer.
+
+### From this repository
+
+Repository development requires Node.js 24.18.0 or newer and npm 11.16.0. The project records both constraints in `.nvmrc` and `package.json`.
+
+```bash
+npm ci
+npm approve-scripts --allow-scripts-pending  # must report no unreviewed scripts
+npm run deploy          # pick your harness interactively
+```
+
+The clean install fails closed if a dependency adds an unreviewed lifecycle script. `package.json` approves only the reviewed, exact `esbuild` version and explicitly denies the platform-inapplicable `fsevents` script.
+
+`npm run deploy` builds, detects the AI harnesses on your machine and registers the server with the ones you choose. Supported: **Claude Code**, **OpenAI Codex** and **Antigravity**.
+
+```bash
+npm run deploy:list                        # what is detected, what is installed
+npm run deploy -- --all                    # every detected harness
+npm run deploy -- --target=claude,codex
+npm run deploy -- --dry-run --all          # show the changes without writing
+npm run deploy -- --remove --all           # uninstall
+```
+
+Every write preserves the rest of the config file — your other MCP servers, their `env` blocks and your settings are untouched — and leaves a timestamped backup beside it. That backup is a full copy, so it may contain credentials from any server in the file; it is created owner-only and is never pruned, so delete old ones once you no longer need them.
+
+Then restart the harness.
+
+## Credentials
+
+**13 of the 17 tools need no credentials at all.** Documentation lookup, code generation, secure-hash construction and verification, payload validation and diagnosis all work the moment the server is installed. This is an _integration_ server: its job is to teach, generate and check, none of which touches your merchant account.
+
+Four tools call the gateway and do need them: `build_transaction_parameters`, `send_gateway_request`, `run_sandbox_smoke_test`, `build_checkout_form`. The hash tools additionally accept an `integritySalt` argument per call, so a merchant debugging a mismatch configures nothing at all.
+
+When you do need them, use either:
+
+**1. Your harness's own `env` block** — the standard MCP mechanism:
+
+```json
+{
+  "mcpServers": {
+    "m-mcp": {
+      "command": "npx",
+      "args": ["-y", "@atbas/m-mcp"],
+      "env": {
+        "JAZZCASH_SANDBOX_MERCHANT_ID": "MC12345",
+        "JAZZCASH_SANDBOX_PASSWORD": "…",
+        "JAZZCASH_SANDBOX_INTEGRITY_SALT": "…",
+        "JAZZCASH_SANDBOX_RETURN_URL": "https://shop.example.pk/jazzcash/return"
+      }
+    }
+  }
+}
+```
+
+**2. `JAZZCASH_CREDENTIALS_FILE`** pointing at a JSON file kept outside any repository — preferable where the harness config itself is committed.
+
+### The server does not read a `.env`, deliberately
+
+An IDE spawns an MCP server with the **merchant's workspace** as its working directory. A dotenv loader would therefore read the merchant's _own application_ `.env` — which, for a WooCommerce or Node merchant, very plausibly holds `JAZZCASH_MERCHANT_ID` and `JAZZCASH_INTEGRITY_SALT` for their live site.
+
+The server would then silently adopt production credentials that nobody decided to give it. Since sandbox and production share endpoints, which environment is in play must always be an explicit decision, never a side effect of where the process happened to start. So there is no `.env` support and no `.env.example`.
+
+## Using it
+
+The intended entry points are the prompt and one tool:
+
+- **`jazzcash_integration_walkthrough`** — a guided prompt that sequences the whole integration.
+- **`jazzcash_build_transaction_parameters`** — assembles a complete payload from business data alone: constants filled, timestamps in Pakistan Standard Time, amount converted to minor units, references generated, payload validated, and `pp_SecureHash` computed last from exactly the map it returns.
+
+A typical session:
+
+```
+"Add JazzCash mobile wallet payments to my checkout."
+  → jazzcash_list_integration_flows        pick a flow
+  → jazzcash_get_onboarding_checklist      what to do in the portal first
+  → jazzcash_generate_integration_code     working PHP, Node or Python
+  → jazzcash_generate_ipn_handler          the mandatory listener
+  → jazzcash_run_sandbox_smoke_test        prove it end to end (sandbox only)
+
+"I'm getting HASH_MISMATCH."
+  → jazzcash_verify_secure_hash            replays 13 known-wrong constructions
+                                           against your own parameters and reports
+                                           which one reproduces your hash
+```
+
+That last point is the difference between this and a documentation search: when a hash is wrong, the server does not guess. It executes the known construction errors against the merchant's actual payload, and when one reproduces their hash, the cause is demonstrated rather than suggested.
+
+## The hosted tier
+
+The other two deliverables in this tree exist so that a merchant can be given metered, revocable access to the tooling without anybody having to hand over a credential. This section is the operator's and the merchant's route in; [`docs/mcp/HOSTED.md`](docs/mcp/HOSTED.md) is the threat model behind it, and [`docs/mcp/STAGING.md`](docs/mcp/STAGING.md) is how to stand a disposable copy of it up locally and prove the whole loop before a merchant sees it.
+
+### How the three pieces fit
+
+```
+AI client (Claude Code, Claude Desktop, Cursor, Codex, Antigravity)
+  │ stdio
+  ▼
+connector/                                       the merchant's own machine
+  ├── local    the 4 credential-requiring tools, from the merchant's own
+  │            environment — no password, Integrity Salt or MPIN leaves it
+  └── remote   HTTPS POST /api/mcp
+                 Authorization: Bearer mmcp_xxxxxxxx_…
+                 │
+                 ▼
+        dashboard/                               the operator's VPS
+          per-address limit → token → scope → per-token limit and quota
+          → the 13 credential-free tools
+          → one usage row per JSON-RPC entry: method, tool, outcome, duration
+```
+
+All three read one definition of which tool is which. Every tool has a descriptor — name, group, providers it can serve, and whether it needs a credential — and the dashboard and the connector import those descriptors rather than keeping their own copies, because a copy is what drifts. They are declared in two modules on purpose: the four credential-requiring ones in `src/tools/credential-tools.ts`, which the connector imports on its own so that its build never reaches the corpus loader or the code generators, and the rest in `src/tools/register.ts`, which imports that narrow module and re-exports it so the full surface is still one list. A tool added without a descriptor fails `tests/tools/register.test.ts`.
+
+A merchant who is not using the hosted tier is unaffected by any of this: the stdio server described above serves all seventeen tools locally and reports to nobody.
+
+### Deploying it — for an operator
+
+The dashboard is a standalone project with its own lockfile under `dashboard/`, deliberately not an npm workspace, so the publishable root package's dependency tree stays free of a web framework's.
+
+Locally, with Docker:
+
+```bash
+cp dashboard/.env.example dashboard/.env    # then fill it in; it is gitignored
+./start.sh                                  # rebuild the image, start it, wait for healthy
+curl -sS http://localhost:3100/api/health
+```
+
+[`start.sh`](start.sh) is a wrapper around `docker compose --file docker-compose.yml` and nothing more: it rebuilds from the working tree with the layer cache intact, waits for the healthcheck rather than returning the moment the container is _started_, and prints the entrypoint's own refusal when it will not serve. `./start.sh down` stops the stack and leaves the `m_mcp_data` volume — the database — alone; `./start.sh help` lists the rest. Plain `docker compose up --build` remains equivalent for the start itself. Note that the container publishes the port `npm run dev` uses, so the two cannot run at once.
+
+Every `*_HMAC_SECRET` wants 32 characters or more — `openssl rand -base64 48` — and `EMAIL_API_TOKEN` comes from the mail service's operator and is never invented. Note that `docker compose config` resolves and prints every value in `dashboard/.env` in clear text; validate the file with it if you must, but never paste that output anywhere.
+
+On Coolify, the deployment file is [`docker-compose.coolify.yml`](docker-compose.coolify.yml), whose header lists every variable the operator sets in Coolify's own UI and explains each of the four ways it differs from the local file. **It must never be run with the plain `docker compose` CLI** — only `docker-compose.yml` is a supported local entry point. The three HMAC secrets and the mail token exist only in Coolify's UI: never in a file in this repository, never as a build argument.
+
+Whichever path, the container's entrypoint asserts before it serves anything:
+
+- **no `JAZZCASH_*` variable is present** — the hosted tier holds no merchant credential, and a variable that suggests otherwise stops the boot rather than being silently ignored;
+- **`/app/data` is writable by the unprivileged user**, so the database lands on the named volume rather than on a container layer the next redeploy destroys;
+- then it runs the migrations and the idempotent seed, and only then starts the server.
+
+Once it serves, two paths matter to a human. `https://m-mcp.atbas.xyz/` is the merchant-facing install guide — how a merchant installs the connector, and the only page served without a session — and `https://m-mcp.atbas.xyz/admin` is the operator sign-in, with the console itself at `/admin/overview` behind it. Locally the same two are `http://localhost:3100/` and `http://localhost:3100/admin`. Everything a machine talks to is `/api/mcp`.
+
+There is no self-registration. The seed creates the single operator account from `ADMIN_USERNAME`, `ADMIN_PASSWORD`, `ADMIN_EMAIL` and `ADMIN_DISPLAY_NAME`, and signing in needs that password **and** a one-time code sent to `ADMIN_EMAIL` through `mail-api.atbas.xyz`. That account is what creates merchants and mints their access tokens: a minted token is displayed exactly once and stored only as a keyed hash, so a lost token is replaced rather than recovered, and revoking one stops the very next call it makes.
+
+One recurring job completes the deployment: `npm run purge` in `dashboard/`, once a day, as a Coolify scheduled task or a cron entry. It deletes raw usage rows past `USAGE_RETENTION_DAYS` and never touches the daily rollups. `npm run purge -- --dry-run` reports what would go.
+
+### Reaching it — for a merchant
+
+Two ways in, and they are not equivalent.
+
+**The connector** gives both halves: the four credential-requiring tools running locally against your own environment, and everything else proxied to the hosted endpoint under your token. It is `@atbas/m-mcp-connector`, and once it is released to npm — it is not there yet — the whole of it is one entry in your AI client's configuration:
+
+```json
+{ "mcpServers": { "m-mcp": { "command": "npx", "args": ["-y", "@atbas/m-mcp-connector"] } } }
+```
+
+Nothing to clone and nothing to build. The package carries the 14 flow specifications its local tools read and inlines the credential half of this server, so it resolves neither `@atbas/m-mcp` nor the transcribed corpus that [`docs/mcp/PUBLISHING.md`](docs/mcp/PUBLISHING.md) covers. [`connector/README.md`](connector/README.md) is the authority on what it does and how it is configured, and the install guide at `https://m-mcp.atbas.xyz/` is written from that file — where the two differ, the file is right. Supply the token as `M_MCP_TOKEN` in your AI client's `env` block rather than as a command-line flag, because every argument a process was started with is readable by anything else on the machine.
+
+**A direct HTTP registration** gives the hosted half only, for AI clients that speak Streamable HTTP themselves:
+
+```json
+{
+  "mcpServers": {
+    "m-mcp": {
+      "type": "http",
+      "url": "https://m-mcp.atbas.xyz/api/mcp",
+      "headers": { "Authorization": "Bearer mmcp_xxxxxxxx_…" }
+    }
+  }
+}
+```
+
+That route serves the thirteen credential-free tools your token's scope allows, and never the four that need a credential — those exist only where your credentials are.
+
+**Register exactly one of these.** The stdio server above, the connector, and this HTTP entry are three ways of reaching the same product, so every snippet in this file keys them `m-mcp` — which is the server's own name, and what `npm run deploy` writes. They are alternatives rather than layers: pasting two of them into one configuration file leaves you with whichever came last, silently, because they share that key. Pick the row that matches how you want the credential tools to run, and use only that one.
+
+| You want                                           | Register                                | Credential tools run          |
+| -------------------------------------------------- | --------------------------------------- | ----------------------------- |
+| Everything local, your own credentials, no account | the stdio server, `@atbas/m-mcp`        | on your machine               |
+| Both halves, metered under a token                 | the connector, `@atbas/m-mcp-connector` | on your machine               |
+| The hosted half only, no local process             | this HTTP entry                         | nowhere — they are not served |
+
+To check a token by hand:
+
+```bash
+curl -sS -X POST https://m-mcp.atbas.xyz/api/mcp \
+  -H 'Authorization: Bearer mmcp_xxxxxxxx_…' \
+  -H 'Content-Type: application/json' \
+  -H 'Accept: application/json, text/event-stream' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
+```
+
+`401` means the token was not accepted, `403` that it is revoked, expired or its merchant deactivated, and `429` that an allowance was reached — honour the `Retry-After` header. [`docs/mcp/HOSTED.md`](docs/mcp/HOSTED.md) says what to do about each, what the endpoint records about your calls, and what it deliberately never records.
+
+## Development
+
+| Command                    | Purpose                                                                                              |
+| -------------------------- | ---------------------------------------------------------------------------------------------------- |
+| `npm run typecheck`        | Type-check without emitting                                                                          |
+| `npm run lint`             | ESLint, including the stdout and floating-promise guards                                             |
+| `npm run format:check`     | Prettier check                                                                                       |
+| `npm test`                 | Full suite                                                                                           |
+| `npm run test:fast`        | Domain, validation, catalogue and config tests only — the quickest useful signal                     |
+| `npm run test:changed`     | Tests related to changed files                                                                       |
+| `npm run test:coverage`    | Full suite with coverage, which is where the per-file thresholds bite                                |
+| `npm run build`            | Emit `dist/`                                                                                         |
+| `npm run pack:check`       | Build, then `npm pack --dry-run` — proves `knowledge/` is still in the tarball                       |
+| `npm run scan:credentials` | Refuse third-party credential literals and unreviewed binaries under `docs/` (see below)             |
+| `npm run release:check`    | Every gate above in one chain, plus the interpreter guards. What CI runs and what `npm publish` runs |
+| `npm run extract-pdf-text` | Regenerate plain-text extractions of the source PDFs (requires poppler)                              |
+
+`release:check` is a gate, not a survey: it opens with the credential scan and the PHP and Python guards, and **fails when either interpreter is missing or older than the version CI installs** (PHP 8.3, Python 3.12). That is deliberate. `npm test` skips the cross-language checks when an interpreter is absent, which is the right behaviour for a quick local run; a release must not be able to pass with the parity checks quietly skipped.
+
+### Continuous integration
+
+`.github/workflows/ci.yml` runs `release:check` on every push and pull request, with PHP and Python installed first and every action pinned to a commit SHA.
+
+It needs one repository secret, **`CREDENTIAL_PATTERNS`**: an extended-regular-expression alternation of the third-party credential literals that must never reach this corpus. The values are credentials, so they live in the secret and nowhere in the repository. The job sets `CREDENTIAL_PATTERNS_REQUIRED`, so **an unset or empty secret fails the build** rather than reporting a scan that never ran.
+
+Locally the secret is absent, so `npm run scan:credentials` reports that phase as skipped — never as clean — and still enforces the second phase, which fails on any new or changed binary artefact under `docs/`. That phase exists because the literal scan reads text only, and the vendor PDFs are exactly where cleartext credentials would hide.
+
+### Architecture
+
+```
+src/
+  domain/       secure hash, money, Pakistan-time stamps, references, response codes
+  catalogue/    flow specifications loaded from knowledge/flows/*.json
+  validation/   one rule per file, composed by payload-validator.ts
+  builder/      assemble + validate + sign a payload
+  knowledge/    documentation corpus and offline BM25 search
+  codegen/      templates bound to flow specifications
+  gateway/      guards, HTTP transport, REST execution, checkout form
+  diagnostics/  symptom knowledge base
+  tools/        one MCP tool per file
+knowledge/      the data: flows, docs, templates, diagnostics
+```
+
+Two properties are worth preserving if you extend this:
+
+- **The corpus is data, not code.** Flow specifications, documentation, templates and diagnostics all live in `knowledge/`. A correction from JazzCash should be a data change.
+- **Citations are tested.** Every `docRef` on every flow, and every reference in the diagnostics base, is asserted to resolve to a real document _and_ section. An anchor on a heading too deep to be addressable fails at load rather than producing a dead link.
+
+### Testing notes
+
+No test reaches the JazzCash gateway. `tests/helpers/stub-gateway.ts` is a local HTTP server, and the production guard is separately asserted to fire before any request is recorded.
+
+`src/domain/secure-hash.ts`, `src/domain/amount.ts`, `src/gateway/guards.ts` and `src/telemetry/redaction.ts` are held at 100 % statement, branch, function and line coverage by per-file thresholds in `vitest.config.ts` — the run fails, not warns, if that regresses.
+
+Generated PHP is syntax-checked with `php -l` and generated Python with `python -m py_compile`. Under `npm test` those checks skip cleanly when the interpreter is absent. Under `npm run release:check` and `npm publish` they cannot: `scripts/require-php.mjs` and `scripts/require-python.mjs` fail the run outright when the interpreter is missing or older than the version CI installs, because a release that skipped the cross-language HMAC parity checks would be indistinguishable from one that passed them.
+
+### SDK version
+
+Built against `@modelcontextprotocol/sdk` v1.30 using `registerTool` / `registerResource` / `registerPrompt` with v1 raw-shape `inputSchema`. The v2 line replaces raw shapes with `z.object(...)`; when migrating, the SDK surface is confined to `src/core/registry.ts`, which declares the registration signature over `McpServer` and `applyRegistrars` — `src/registry.ts` no longer names the SDK at all, and does nothing but parameterise that signature for the full dependency set — together with the `src/tools`, `src/resources` and `src/prompts` modules.
+
+### The dashboard is held on an unsupported ESLint, deliberately
+
+The root and `connector/` are on ESLint 10. `dashboard/` is on **9.39.5**, which npm now marks
+deprecated — _"This version is no longer supported."_ That is not an oversight and not a preference.
+
+Three plugins reached through `eslint-config-next` still cap their `eslint` peer range at 9, and
+each is already at its newest published release:
+
+| Plugin                   | Latest | Peer range    |
+| ------------------------ | ------ | ------------- |
+| `eslint-plugin-import`   | 2.32.0 | `… \|\| ^9`   |
+| `eslint-plugin-jsx-a11y` | 6.10.2 | `… \|\| ^9`   |
+| `eslint-plugin-react`    | 7.37.5 | `… \|\| ^9.7` |
+
+`eslint-config-next` itself declares the permissive `eslint: >=9.0.0`, so the conflict only surfaces
+one level down. Forcing it with `--legacy-peer-deps` is the wrong move: an overridden peer conflict
+in a lint toolchain fails at rule-load time with an error naming neither the plugin nor the cause,
+and the lint then covers less than it appears to.
+
+**Re-check trigger:** whenever `eslint-config-next` is bumped, run
+
+```bash
+npm view eslint-plugin-import peerDependencies.eslint
+npm view eslint-plugin-jsx-a11y peerDependencies.eslint
+npm view eslint-plugin-react peerDependencies.eslint
+```
+
+and move the dashboard to ESLint 10 the moment all three admit `^10`. Expect the three rules
+`eslint:recommended` gained in v10 — `no-unassigned-vars`, `no-useless-assignment` and
+`preserve-caught-error` — to fire; fix them rather than disabling them. The root and the connector
+already pass all three.
+
+### `@types/node` tracks the floor, not the latest
+
+Each project pins `@types/node` to the major matching its own `engines.node`, and **not** to the
+newest published. The root and the dashboard are on `^24`, matching `.nvmrc`, CI and the
+`node:24-bookworm-slim` image the dashboard deploys on; `connector/` is on `^20`, matching the
+`>=20.19.0` floor it declares so that merchants on Node 20 and 22 LTS are supported.
+
+Bumping any of them to the latest major would let the compiler admit an API the supported runtime
+does not have — a failure no test here catches, because the tests run on Node 24. The connector is
+the one that matters: it is the package merchants install, and `npx` runs it on whatever they have.
+Its typecheck against Node 20 types is therefore a real check of its own advertised floor, and it
+passes.
+
+When a project's `engines.node` moves, move its `@types/node` in the same change. Not before.
+
+## Licence
+
+**MIT**, decided on 2026-08-23 alongside the same day's authorisation of the corpus for redistribution and sale (assumption A7), and carried in `package.json` since. The knowledge corpus is derived from JazzCash merchant guides: MIT covers this repository's own work and makes no claim over JazzCash's documentation, specifications or marks. The use of the mark itself is the one part of item 13 in [`docs/mcp/JAZZCASH-CLARIFICATIONS.md`](docs/mcp/JAZZCASH-CLARIFICATIONS.md) that no decision here can answer, and it is still open.
+
+`connector/` carries the same licence. `@atbas/m-mcp-connector` is MIT, © 2026 Eren Atbas: it ships the 14 flow specifications and the credential half of this server, and none of the transcribed documents, the templates or the diagnostics base. [`docs/mcp/PUBLISHING.md`](docs/mcp/PUBLISHING.md) records exactly what that package and its public mirror each carry, what stays here, and the steps neither package has been through — as of 2026-08-23, neither is on npm.

package/dist/builder/transaction-builder.d.ts

@@ -0,0 +1,53 @@
+import { type CredentialProfile } from '../config/credentials.js';
+import type { IntegrationFlow } from '../catalogue/types.js';
+import { type HashStringBreakdown } from '../domain/secure-hash.js';
+import type { NormalisedParameters } from '../domain/types.js';
+import { type ValidationResult } from '../validation/payload-validator.js';
+/**
+ * Assemble a complete, valid, signed payload for a flow.
+ *
+ * This is the highest-value entry point in the server: it removes the whole
+ * class of errors that come from hand-assembling payloads — a missing constant,
+ * a host-timezone timestamp, an amount in major units, an omitted empty field,
+ * a stale hash. The caller supplies business data; everything else is derived
+ * from the flow specification and the credential profile.
+ */
+export interface TransactionInput {
+    /** Amount in major units, e.g. "100.00" or 100. Converted to minor units. */
+    readonly amount?: string | number | undefined;
+    /** Amount already in minor units, e.g. "10000". Takes precedence over `amount`. */
+    readonly amountMinorUnits?: string | undefined;
+    readonly billReference?: string | undefined;
+    readonly description?: string | undefined;
+    readonly txnRefNo?: string | undefined;
+    readonly requestId?: string | undefined;
+    /** Up to three alphanumeric characters prefixed to generated references. */
+    readonly referencePrefix?: string | undefined;
+    /** Flow-specific fields: pp_MobileNumber, pp_CNIC, pp_MSISDN, pp_PaymentToken, ppmpf_3… */
+    readonly extras?: Readonly<Record<string, string>> | undefined;
+    /** Days between the transaction time and its expiry. Defaults to the documented 1. */
+    readonly expiryDays?: number | undefined;
+    readonly now?: Date | undefined;
+}
+export interface BuiltTransaction {
+    readonly flowId: string;
+    /** Complete payload including the flow's own signature field, ready to transmit. */
+    readonly parameters: NormalisedParameters;
+    readonly secureHash: string;
+    readonly hashBreakdown: HashStringBreakdown;
+    readonly validation: ValidationResult;
+    /** Values this builder derived rather than receiving, for transparency. */
+    readonly generated: Readonly<Record<string, string>>;
+}
+/**
+ * Build and sign a payload.
+ *
+ * The payload is validated before it is hashed, and the hash is computed last,
+ * from exactly the map that will be transmitted, so the two can never disagree.
+ * An invalid payload is still returned, unsigned, with its validation result:
+ * the caller needs to see what is wrong, not just that something is.
+ */
+export declare function buildTransaction(flow: IntegrationFlow, input: TransactionInput, profile: CredentialProfile, integritySalt?: string): BuiltTransaction;
+/** Throwing variant, for callers that cannot proceed with an invalid payload. */
+export declare function buildTransactionOrThrow(flow: IntegrationFlow, input: TransactionInput, profile: CredentialProfile, integritySalt?: string): BuiltTransaction;
+//# sourceMappingURL=transaction-builder.d.ts.map

package/dist/builder/transaction-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction-builder.d.ts","sourceRoot":"","sources":["../../src/builder/transaction-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,OAAO,KAAK,EAAiB,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG5E,OAAO,EAAsC,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAExG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAE5F;;;;;;;;GAQG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC9C,mFAAmF;IACnF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAC/D,sFAAsF;IACtF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD;AA0HD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,iBAAiB,EAC1B,aAAa,GAAE,MAA8B,GAC5C,gBAAgB,CAsDlB;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,iBAAiB,EAC1B,aAAa,GAAE,MAA8B,GAC5C,gBAAgB,CASlB"}

package/dist/builder/transaction-builder.js

@@ -0,0 +1,159 @@
+import { credentialParameterValue } from '../config/credentials.js';
+import { requestHashOptions, signatureFieldName } from '../catalogue/hash-options.js';
+import { toMinorUnits } from '../domain/amount.js';
+import { formatTxnDateTime, txnExpiryDateTime } from '../domain/datetime.js';
+import { buildHashString, computeSecureHash } from '../domain/secure-hash.js';
+import { generateBillReference, generateRequestId, generateTxnRefNo } from '../domain/txn-ref.js';
+import { JazzCashValidationError } from '../errors.js';
+import { validatePayload } from '../validation/payload-validator.js';
+function resolveAmount(input) {
+    if (input.amountMinorUnits !== undefined && input.amountMinorUnits !== '') {
+        return input.amountMinorUnits;
+    }
+    if (input.amount === undefined || input.amount === '') {
+        return undefined;
+    }
+    return toMinorUnits(input.amount);
+}
+/**
+ * Values fixed by the specification or by the credential profile.
+ *
+ * Returns `undefined` when this parameter is not one the flow or the profile
+ * decides, leaving it to {@link deriveGeneratedValue}.
+ */
+function resolveDeclaredValue(parameter, flow, input, profile) {
+    const extra = input.extras?.[parameter.name];
+    if (extra !== undefined) {
+        return extra;
+    }
+    // "No parameters may be added or removed from the request payload." An
+    // optional field may carry a value, but its key must still be transmitted, so
+    // an unsupplied optional field defaults to the empty string rather than being
+    // dropped.
+    if (parameter.requirement === 'must-be-empty' || parameter.requirement === 'optional') {
+        return '';
+    }
+    if (parameter.valueType === 'constant') {
+        return parameter.constantValue ?? flow.constants[parameter.name];
+    }
+    return credentialParameterValue(parameter.name, profile);
+}
+/**
+ * Values this builder computes: amounts, references and timestamps.
+ *
+ * Anything generated rather than supplied is recorded in `generated`, so the
+ * caller can see what was chosen for them.
+ */
+function deriveGeneratedValue(parameter, input, now, generated) {
+    const prefixOption = input.referencePrefix === undefined ? {} : { prefix: input.referencePrefix };
+    const remember = (value) => {
+        generated[parameter.name] = value;
+        return value;
+    };
+    switch (parameter.valueType) {
+        case 'minor-units':
+            return resolveAmount(input);
+        case 'bill-reference':
+            return input.billReference !== undefined && input.billReference !== ''
+                ? input.billReference
+                : remember(generateBillReference({ now, ...prefixOption }));
+        case 'txn-ref':
+            return input.txnRefNo !== undefined && input.txnRefNo !== ''
+                ? input.txnRefNo
+                : remember(generateTxnRefNo({ now, ...prefixOption }));
+        case 'request-id':
+            return input.requestId !== undefined && input.requestId !== ''
+                ? input.requestId
+                : remember(generateRequestId({ now, ...prefixOption }));
+        case 'pkt-datetime':
+            return remember(formatTxnDateTime(now));
+        case 'pkt-expiry':
+            return remember(txnExpiryDateTime(now, input.expiryDays ?? 1));
+        case 'string':
+            return parameter.name === 'pp_Description' ? input.description : undefined;
+        // Flow-specific values the caller must supply through `extras`.
+        case 'constant':
+        case 'url':
+        case 'msisdn':
+        case 'cnic':
+        case 'payment-token':
+        case 'secure-hash':
+            return undefined;
+    }
+}
+/**
+ * Derive the value for one declared parameter.
+ *
+ * Returns `undefined` when the value cannot be derived, leaving the field absent
+ * so that validation reports it with a message naming what to supply. Silently
+ * substituting a placeholder would send a wrong value to a payment gateway.
+ */
+function deriveValue(parameter, flow, input, profile, now, generated) {
+    return (resolveDeclaredValue(parameter, flow, input, profile) ?? deriveGeneratedValue(parameter, input, now, generated));
+}
+/**
+ * Build and sign a payload.
+ *
+ * The payload is validated before it is hashed, and the hash is computed last,
+ * from exactly the map that will be transmitted, so the two can never disagree.
+ * An invalid payload is still returned, unsigned, with its validation result:
+ * the caller needs to see what is wrong, not just that something is.
+ */
+export function buildTransaction(flow, input, profile, integritySalt = profile.integritySalt) {
+    const now = input.now ?? new Date();
+    const generated = {};
+    const parameters = {};
+    for (const parameter of flow.parameters) {
+        if (parameter.valueType === 'secure-hash') {
+            continue;
+        }
+        const value = deriveValue(parameter, flow, input, profile, now, generated);
+        if (value !== undefined) {
+            parameters[parameter.name] = value;
+        }
+    }
+    // Extras naming an undeclared field are kept rather than dropped, so the
+    // unknown-fields rule can tell the caller the field does not belong.
+    for (const [name, value] of Object.entries(input.extras ?? {})) {
+        parameters[name] ??= value;
+    }
+    const validation = validatePayload(flow, parameters, {
+        registeredReturnUrl: profile.returnUrl,
+        now,
+    });
+    if (!validation.valid) {
+        return {
+            flowId: flow.id,
+            parameters,
+            secureHash: '',
+            hashBreakdown: buildHashString(parameters, integritySalt, requestHashOptions(flow)),
+            validation,
+            generated,
+        };
+    }
+    const hashBreakdown = buildHashString(parameters, integritySalt, requestHashOptions(flow));
+    const secureHash = computeSecureHash(parameters, integritySalt, requestHashOptions(flow));
+    // Read from the flow rather than spelled `pp_SecureHash` here. That is
+    // JazzCash's name for the field, and a payload built for a provider that names
+    // its own would carry a correct digest in a field the gateway never reads,
+    // while the field it does read is absent. A flow that declares no signature
+    // field gets no signature key, rather than one under a borrowed name.
+    const signatureField = signatureFieldName(flow);
+    return {
+        flowId: flow.id,
+        parameters: signatureField === undefined ? parameters : { ...parameters, [signatureField]: secureHash },
+        secureHash,
+        hashBreakdown,
+        validation,
+        generated,
+    };
+}
+/** Throwing variant, for callers that cannot proceed with an invalid payload. */
+export function buildTransactionOrThrow(flow, input, profile, integritySalt = profile.integritySalt) {
+    const built = buildTransaction(flow, input, profile, integritySalt);
+    if (!built.validation.valid) {
+        throw new JazzCashValidationError(`Cannot build a ${flow.id} payload: ${built.validation.errors.map((entry) => entry.message).join(' ')}`, { details: { flowId: flow.id, errors: built.validation.errors } });
+    }
+    return built;
+}
+//# sourceMappingURL=transaction-builder.js.map

package/dist/builder/transaction-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction-builder.js","sourceRoot":"","sources":["../../src/builder/transaction-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAA0B,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEtF,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAA4B,MAAM,0BAA0B,CAAC;AACxG,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAElG,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,eAAe,EAAyB,MAAM,oCAAoC,CAAC;AAyC5F,SAAS,aAAa,CAAC,KAAuB;IAC5C,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,KAAK,EAAE,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC,gBAAgB,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,SAAwB,EACxB,IAAqB,EACrB,KAAuB,EACvB,OAA0B;IAE1B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uEAAuE;IACvE,8EAA8E;IAC9E,8EAA8E;IAC9E,WAAW;IACX,IAAI,SAAS,CAAC,WAAW,KAAK,eAAe,IAAI,SAAS,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACtF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,SAAS,CAAC,aAAa,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,wBAAwB,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,SAAwB,EACxB,KAAuB,EACvB,GAAS,EACT,SAAiC;IAEjC,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;IAElG,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAU,EAAE;QACzC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,QAAQ,SAAS,CAAC,SAAS,EAAE,CAAC;QAC5B,KAAK,aAAa;YAChB,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAE9B,KAAK,gBAAgB;YACnB,OAAO,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,EAAE;gBACpE,CAAC,CAAC,KAAK,CAAC,aAAa;gBACrB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC;QAEhE,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE;gBAC1D,CAAC,CAAC,KAAK,CAAC,QAAQ;gBAChB,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC;QAE3D,KAAK,YAAY;YACf,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE;gBAC5D,CAAC,CAAC,KAAK,CAAC,SAAS;gBACjB,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC;QAE5D,KAAK,cAAc;YACjB,OAAO,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QAE1C,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAEjE,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAE7E,gEAAgE;QAChE,KAAK,UAAU,CAAC;QAChB,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,eAAe,CAAC;QACrB,KAAK,aAAa;YAChB,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAClB,SAAwB,EACxB,IAAqB,EACrB,KAAuB,EACvB,OAA0B,EAC1B,GAAS,EACT,SAAiC;IAEjC,OAAO,CACL,oBAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,CAChH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAqB,EACrB,KAAuB,EACvB,OAA0B,EAC1B,gBAAwB,OAAO,CAAC,aAAa;IAE7C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,UAAU,GAA2B,EAAE,CAAC;IAE9C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,IAAI,SAAS,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACrC,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,qEAAqE;IACrE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,UAAU,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC;IAC7B,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE;QACnD,mBAAmB,EAAE,OAAO,CAAC,SAAS;QACtC,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU;YACV,UAAU,EAAE,EAAE;YACd,aAAa,EAAE,eAAe,CAAC,UAAU,EAAE,aAAa,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACnF,UAAU;YACV,SAAS;SACV,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,eAAe,CAAC,UAAU,EAAE,aAAa,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,EAAE,aAAa,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1F,uEAAuE;IACvE,+EAA+E;IAC/E,2EAA2E;IAC3E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAEhD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,UAAU,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE;QACvG,UAAU;QACV,aAAa;QACb,UAAU;QACV,SAAS;KACV,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,uBAAuB,CACrC,IAAqB,EACrB,KAAuB,EACvB,OAA0B,EAC1B,gBAAwB,OAAO,CAAC,aAAa;IAE7C,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAC/B,kBAAkB,IAAI,CAAC,EAAE,aAAa,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EACvG,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}