@atbas/m-mcp 0.1.0

package/dist/telemetry/redaction.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Redaction helpers.
+ *
+ * Merchant credentials must never reach a log file, an AI transcript, or a
+ * generated source file. Two distinct policies exist:
+ *
+ *  - {@link redactForLog} is aggressive and is applied to everything the logger
+ *    writes. It also masks `pp_SecureHash`, which is not itself a secret but is
+ *    derived from the Integrity Salt; logging hash and payload together would
+ *    hand an attacker an offline verification oracle.
+ *  - The transcript policy is narrow and is applied where a tool must
+ *    legitimately return a payload to the caller. It has two layers, and both
+ *    are needed: {@link maskSecrets} removes known credential literals, and the
+ *    {@link CREDENTIAL_PARAMETER_NAMES} layer removes the credentials that are
+ *    too short to match literally. {@link scrubTextForTranscript} applies both
+ *    to a text block and {@link maskSecretsDeep} applies both to a structured
+ *    value, so the two transcript surfaces cannot disagree about a credential.
+ */
+export declare const REDACTED = "[redacted]";
+/** True when a parameter name indicates a value that must not be logged. */
+export declare function isSensitiveKey(key: string): boolean;
+/**
+ * Recursively redact sensitive values for logging.
+ *
+ * Depth is bounded so a cyclic or pathological structure cannot hang the logger.
+ */
+export declare function redactForLog(value: unknown, depth?: number): unknown;
+/**
+ * Parameter names whose values are credentials and are redacted by name.
+ *
+ * Deliberately narrow. `pp_SecureHash` is not included because returning it is
+ * the entire purpose of several tools, and `pp_CNIC` is not included because the
+ * caller supplied it and needs to see it echoed back to check it.
+ */
+export declare const CREDENTIAL_PARAMETER_NAMES: readonly string[];
+/**
+ * Replace every occurrence of a known secret literal in free text.
+ *
+ * Used for error messages and generated output, where a credential may have been
+ * interpolated into a string rather than held in a named field.
+ */
+export declare function maskSecrets(text: string, secrets: readonly string[]): string;
+/**
+ * Replace the value of every JSON-encoded credential field in free text.
+ *
+ * A text block routinely embeds a payload as a JSON code fence, so the
+ * name-based layer that protects `structuredContent` has to reach into text as
+ * well: a four-digit MPIN is below {@link MINIMUM_LITERAL_SECRET_LENGTH} and
+ * {@link maskSecrets} alone would print it verbatim.
+ *
+ * Only a quoted credential key followed by a quoted value is rewritten, so prose
+ * is untouched and the `pp_SecureHash` and `pp_CNIC` fields that several tools
+ * exist to return survive intact.
+ */
+export declare function maskCredentialFields(text: string): string;
+/**
+ * Scrub one text block on its way into the transcript.
+ *
+ * Text and `structuredContent` are the same disclosure surface, so both get both
+ * masking layers. Applying only {@link maskSecrets} here — as this server once
+ * did — disclosed every credential shorter than
+ * {@link MINIMUM_LITERAL_SECRET_LENGTH}, the Merchant MPIN among them.
+ */
+export declare function scrubTextForTranscript(text: string, secrets: readonly string[]): string;
+/**
+ * Recursively replace known secret literals inside a structured value.
+ *
+ * Applied to every tool result's `structuredContent`. Literal replacement is
+ * used rather than key-based redaction so that fields a tool legitimately
+ * returns — `pp_SecureHash`, a generated reference — survive intact, while a
+ * password or Integrity Salt is removed wherever it sits. Credentials too short
+ * to match literally are removed by name instead; see
+ * {@link CREDENTIAL_PARAMETER_NAMES}.
+ *
+ * Recursion is bounded and the bound fails closed: a subtree deeper than
+ * {@link MAXIMUM_REDACTION_DEPTH} is replaced by {@link TRUNCATED} rather than
+ * returned unmasked, because a deeply nested gateway response would otherwise
+ * be a route past every layer above.
+ */
+export declare function maskSecretsDeep<T>(value: T, secrets: readonly string[], depth?: number): T;
+/**
+ * Mask all but the final `visible` characters of a value.
+ *
+ * Used where a caller needs to confirm *which* credential is in play without
+ * being shown it, for example when reporting the resolved profile.
+ */
+export declare function maskTail(value: string, visible?: number): string;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/telemetry/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../src/telemetry/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,eAAO,MAAM,QAAQ,eAAe,CAAC;AAqDrC,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMnD;AAeD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAsB/D;AAaD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAAuC,CAAC;AAEhG;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAS5E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAazD;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEvF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,SAAI,GAAG,CAAC,CAuBrF;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,SAAI,GAAG,MAAM,CAK3D"}

package/dist/telemetry/redaction.js

@@ -0,0 +1,238 @@
+/**
+ * Redaction helpers.
+ *
+ * Merchant credentials must never reach a log file, an AI transcript, or a
+ * generated source file. Two distinct policies exist:
+ *
+ *  - {@link redactForLog} is aggressive and is applied to everything the logger
+ *    writes. It also masks `pp_SecureHash`, which is not itself a secret but is
+ *    derived from the Integrity Salt; logging hash and payload together would
+ *    hand an attacker an offline verification oracle.
+ *  - The transcript policy is narrow and is applied where a tool must
+ *    legitimately return a payload to the caller. It has two layers, and both
+ *    are needed: {@link maskSecrets} removes known credential literals, and the
+ *    {@link CREDENTIAL_PARAMETER_NAMES} layer removes the credentials that are
+ *    too short to match literally. {@link scrubTextForTranscript} applies both
+ *    to a text block and {@link maskSecretsDeep} applies both to a structured
+ *    value, so the two transcript surfaces cannot disagree about a credential.
+ */
+export const REDACTED = '[redacted]';
+/**
+ * Parameter names whose values must never be logged.
+ *
+ * Matched case-insensitively as substrings so that both `pp_Password` and a
+ * merchant's own `password` field are covered.
+ *
+ * The card-data fragments are the second line behind the tool boundary, not the
+ * first: `refuseForbiddenArguments` stops a flagged field being processed at
+ * all. They are here because the boundary refuses by flow-declared name, so a
+ * card number arriving under a name no flow declares — a merchant's own
+ * `cardNumber`, a gateway echoing `Pan` in a response body — would otherwise be
+ * written to a log file in clear, and a log file outlives the conversation it
+ * came from. Over-redaction is the cheap direction here — a masked `cardType`
+ * costs a line of debugging, a logged PAN costs a compliance incident — so the
+ * few names that must stay readable are named in {@link NON_SENSITIVE_KEYS}
+ * rather than paid for by narrowing a fragment.
+ */
+const SENSITIVE_KEY_FRAGMENTS = [
+    'password',
+    'mpin',
+    'salt',
+    'securehash',
+    'secure_hash',
+    'cnic',
+    'token',
+    'msisdn',
+    'mobilenumber',
+    'mobile_number',
+    'authorization',
+    'apikey',
+    'api_key',
+    'secret',
+    'pan',
+    'card',
+    'cvv',
+    'cvc',
+    'expiry',
+];
+/**
+ * Names that match a fragment above but carry nothing worth hiding.
+ *
+ * Exact spellings rather than fragments, and each needs a reason: an allowlist
+ * inside a denylist is a hole by construction, so it stays as short as the
+ * diagnostics require. `pp_TxnExpiryDateTime` is a transaction deadline, not a
+ * card expiry, and an elapsed one is a routine cause of a rejected request —
+ * masking it would remove from the request preview the very field a merchant
+ * needs in order to diagnose that.
+ */
+const NON_SENSITIVE_KEYS = ['pp_TxnExpiryDateTime'];
+/** True when a parameter name indicates a value that must not be logged. */
+export function isSensitiveKey(key) {
+    if (NON_SENSITIVE_KEYS.includes(key)) {
+        return false;
+    }
+    const normalised = key.toLowerCase();
+    return SENSITIVE_KEY_FRAGMENTS.some((fragment) => normalised.includes(fragment));
+}
+/**
+ * Deepest level either recursive redactor descends to.
+ *
+ * Bounded so a cyclic or pathological structure cannot hang the server. Both
+ * redactors fail closed at the bound — an unexplored subtree is replaced by
+ * {@link TRUNCATED} rather than passed through — because a gateway response of
+ * arbitrary nesting would otherwise carry a secret past the bound untouched.
+ */
+const MAXIMUM_REDACTION_DEPTH = 8;
+/** Stands in for a subtree deeper than {@link MAXIMUM_REDACTION_DEPTH}. */
+const TRUNCATED = '[truncated]';
+/**
+ * Recursively redact sensitive values for logging.
+ *
+ * Depth is bounded so a cyclic or pathological structure cannot hang the logger.
+ */
+export function redactForLog(value, depth = 0) {
+    if (depth > MAXIMUM_REDACTION_DEPTH) {
+        return TRUNCATED;
+    }
+    if (value === null || value === undefined) {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactForLog(entry, depth + 1));
+    }
+    if (value instanceof Error) {
+        return { name: value.name, message: value.message };
+    }
+    if (typeof value === 'object') {
+        const source = value;
+        const result = {};
+        for (const key of Object.keys(source)) {
+            result[key] = isSensitiveKey(key) ? REDACTED : redactForLog(source[key], depth + 1);
+        }
+        return result;
+    }
+    return value;
+}
+/**
+ * Shortest secret worth replacing by literal substring match.
+ *
+ * A Merchant MPIN is four digits. Substring-replacing it would corrupt any
+ * unrelated value that happens to contain those digits — a CNIC fragment, an
+ * amount, a transaction reference — which is a worse failure than not masking a
+ * low-entropy value the merchant already knows. Short credentials are instead
+ * redacted by parameter name; see {@link CREDENTIAL_PARAMETER_NAMES}.
+ */
+const MINIMUM_LITERAL_SECRET_LENGTH = 8;
+/**
+ * Parameter names whose values are credentials and are redacted by name.
+ *
+ * Deliberately narrow. `pp_SecureHash` is not included because returning it is
+ * the entire purpose of several tools, and `pp_CNIC` is not included because the
+ * caller supplied it and needs to see it echoed back to check it.
+ */
+export const CREDENTIAL_PARAMETER_NAMES = ['pp_Password', 'pp_MerchantMPIN'];
+/**
+ * Replace every occurrence of a known secret literal in free text.
+ *
+ * Used for error messages and generated output, where a credential may have been
+ * interpolated into a string rather than held in a named field.
+ */
+export function maskSecrets(text, secrets) {
+    let result = text;
+    for (const secret of secrets) {
+        if (secret.length < MINIMUM_LITERAL_SECRET_LENGTH) {
+            continue;
+        }
+        result = result.split(secret).join(REDACTED);
+    }
+    return result;
+}
+/**
+ * Replace the value of every JSON-encoded credential field in free text.
+ *
+ * A text block routinely embeds a payload as a JSON code fence, so the
+ * name-based layer that protects `structuredContent` has to reach into text as
+ * well: a four-digit MPIN is below {@link MINIMUM_LITERAL_SECRET_LENGTH} and
+ * {@link maskSecrets} alone would print it verbatim.
+ *
+ * Only a quoted credential key followed by a quoted value is rewritten, so prose
+ * is untouched and the `pp_SecureHash` and `pp_CNIC` fields that several tools
+ * exist to return survive intact.
+ */
+export function maskCredentialFields(text) {
+    let result = text;
+    for (const name of CREDENTIAL_PARAMETER_NAMES) {
+        // Built per call rather than once per module: a shared global-flag pattern
+        // carries `lastIndex` between calls, which is mutable state this module has
+        // no reason to hold. The names are plain identifiers, so they need no
+        // escaping. The value pattern spans escapes so an embedded quote cannot end
+        // the match early, and `\s*` covers the pretty-printed spacing JSON.stringify
+        // emits.
+        const field = new RegExp(`("${name}"\\s*:\\s*)"(?:\\\\.|[^"\\\\])*"`, 'g');
+        result = result.replace(field, `$1"${REDACTED}"`);
+    }
+    return result;
+}
+/**
+ * Scrub one text block on its way into the transcript.
+ *
+ * Text and `structuredContent` are the same disclosure surface, so both get both
+ * masking layers. Applying only {@link maskSecrets} here — as this server once
+ * did — disclosed every credential shorter than
+ * {@link MINIMUM_LITERAL_SECRET_LENGTH}, the Merchant MPIN among them.
+ */
+export function scrubTextForTranscript(text, secrets) {
+    return maskCredentialFields(maskSecrets(text, secrets));
+}
+/**
+ * Recursively replace known secret literals inside a structured value.
+ *
+ * Applied to every tool result's `structuredContent`. Literal replacement is
+ * used rather than key-based redaction so that fields a tool legitimately
+ * returns — `pp_SecureHash`, a generated reference — survive intact, while a
+ * password or Integrity Salt is removed wherever it sits. Credentials too short
+ * to match literally are removed by name instead; see
+ * {@link CREDENTIAL_PARAMETER_NAMES}.
+ *
+ * Recursion is bounded and the bound fails closed: a subtree deeper than
+ * {@link MAXIMUM_REDACTION_DEPTH} is replaced by {@link TRUNCATED} rather than
+ * returned unmasked, because a deeply nested gateway response would otherwise
+ * be a route past every layer above.
+ */
+export function maskSecretsDeep(value, secrets, depth = 0) {
+    if (depth > MAXIMUM_REDACTION_DEPTH) {
+        return TRUNCATED;
+    }
+    if (typeof value === 'string') {
+        return maskSecrets(value, secrets);
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => maskSecretsDeep(entry, secrets, depth + 1));
+    }
+    if (typeof value === 'object' && value !== null) {
+        const source = value;
+        const result = {};
+        for (const key of Object.keys(source)) {
+            // Short, low-entropy credentials cannot be masked by substring match
+            // without corrupting unrelated values, so they are masked by name.
+            result[key] = CREDENTIAL_PARAMETER_NAMES.includes(key)
+                ? REDACTED
+                : maskSecretsDeep(source[key], secrets, depth + 1);
+        }
+        return result;
+    }
+    return value;
+}
+/**
+ * Mask all but the final `visible` characters of a value.
+ *
+ * Used where a caller needs to confirm *which* credential is in play without
+ * being shown it, for example when reporting the resolved profile.
+ */
+export function maskTail(value, visible = 4) {
+    if (value.length <= visible) {
+        return REDACTED;
+    }
+    return `${'*'.repeat(Math.min(value.length - visible, 12))}${value.slice(-visible)}`;
+}
+//# sourceMappingURL=redaction.js.map

package/dist/telemetry/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../src/telemetry/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,uBAAuB,GAAsB;IACjD,UAAU;IACV,MAAM;IACN,MAAM;IACN,YAAY;IACZ,aAAa;IACb,MAAM;IACN,OAAO;IACP,QAAQ;IACR,cAAc;IACd,eAAe;IACf,eAAe;IACf,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,QAAQ;CACT,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAsB,CAAC,sBAAsB,CAAC,CAAC;AAEvE,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC,2EAA2E;AAC3E,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IACpD,IAAI,KAAK,GAAG,uBAAuB,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;AAEhG;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAA0B;IAClE,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,6BAA6B,EAAE,CAAC;YAClD,SAAS;QACX,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,0BAA0B,EAAE,CAAC;QAC9C,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,4EAA4E;QAC5E,8EAA8E;QAC9E,SAAS;QACT,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,IAAI,kCAAkC,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,QAAQ,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,OAA0B;IAC7E,OAAO,oBAAoB,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAI,KAAQ,EAAE,OAA0B,EAAE,KAAK,GAAG,CAAC;IAChF,IAAI,KAAK,GAAG,uBAAuB,EAAE,CAAC;QACpC,OAAO,SAAyB,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC,KAAK,EAAE,OAAO,CAAiB,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAiB,CAAC;IACnG,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,CAAC,GAAG,CAAC,GAAG,0BAA0B,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACpD,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,MAAsB,CAAC;IAChC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,OAAO,GAAG,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,OAAO,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACvF,CAAC"}

package/dist/tools/build-transaction-parameters.d.ts

@@ -0,0 +1,10 @@
+import type { CoreRegistrar } from '../core/registry.js';
+/**
+ * The recommended entry point for building a request.
+ *
+ * Fills constants, formats Pakistan-time timestamps, converts the amount to
+ * minor units, generates unique references, validates, and signs — in that
+ * order, with the hash computed last from exactly the map that will be sent.
+ */
+export declare const registerBuildTransactionParameters: CoreRegistrar;
+//# sourceMappingURL=build-transaction-parameters.d.ts.map

package/dist/tools/build-transaction-parameters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-transaction-parameters.d.ts","sourceRoot":"","sources":["../../src/tools/build-transaction-parameters.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKzD;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,EAAE,aAkKhD,CAAC"}

package/dist/tools/build-transaction-parameters.js

@@ -0,0 +1,154 @@
+import { z } from 'zod';
+import { buildTransaction } from '../builder/transaction-builder.js';
+import { resolveEndpoint } from '../catalogue/endpoints.js';
+import { JAZZCASH_ENVIRONMENTS } from '../config/environment.js';
+import { fromMinorUnits } from '../domain/amount.js';
+import { describeHowToSend } from '../gateway/transport.js';
+import { maskSecretsDeep } from '../telemetry/redaction.js';
+import { formatValidationResult } from '../validation/payload-validator.js';
+import { citations, resolveEnvironment, safeHandler, toolResult } from './tool-kit.js';
+/**
+ * The recommended entry point for building a request.
+ *
+ * Fills constants, formats Pakistan-time timestamps, converts the amount to
+ * minor units, generates unique references, validates, and signs — in that
+ * order, with the hash computed last from exactly the map that will be sent.
+ */
+export const registerBuildTransactionParameters = (server, deps) => {
+    server.registerTool('jazzcash_build_transaction_parameters', {
+        title: 'Build a complete, validated, signed JazzCash payload',
+        description: 'Assemble a ready-to-send payload for a flow. Fills constants and empty fields, formats timestamps in Pakistan Standard Time, converts the amount to minor units, generates a unique transaction reference, validates against the flow specification, and computes pp_SecureHash last. Prefer this over assembling a payload by hand.',
+        inputSchema: {
+            flowId: z.string().describe('Flow to build for, e.g. "card-page-redirection-v1.1".'),
+            environment: z
+                .enum(JAZZCASH_ENVIRONMENTS)
+                .optional()
+                .describe('Credential profile to use. Defaults to the configured environment. This does NOT change the endpoint.'),
+            amount: z
+                .union([z.string(), z.number()])
+                .optional()
+                .describe('Amount in major units, e.g. "100.00" or 100. Converted to minor units for you.'),
+            amountMinorUnits: z
+                .string()
+                .optional()
+                .describe('Amount already multiplied by 100, e.g. "10000". Takes precedence over `amount`.'),
+            billReference: z.string().optional().describe('Alphanumeric bill reference. Generated if omitted.'),
+            description: z.string().optional().describe('Order or product description.'),
+            txnRefNo: z
+                .string()
+                .optional()
+                .describe('Transaction reference. Generated as a timestamp plus random characters if omitted.'),
+            requestId: z
+                .string()
+                .optional()
+                .describe('Request identifier for linking and token flows. Generated if omitted.'),
+            referencePrefix: z
+                .string()
+                .optional()
+                .describe('Up to three alphanumeric characters for generated references, e.g. the first three letters of your domain.'),
+            expiryDays: z
+                .number()
+                .int()
+                .min(1)
+                .max(30)
+                .optional()
+                .describe('Expiry window in days. Defaults to the documented 1.'),
+            extras: z
+                .record(z.string(), z.string())
+                .optional()
+                .describe('Flow-specific fields you must supply, e.g. { "pp_MobileNumber": "03123456789", "pp_CNIC": "123456" } or { "ppmpf_1": "03123456789" }.'),
+        },
+    }, safeHandler(deps, 'jazzcash_build_transaction_parameters', (args) => {
+        const flow = deps.catalogue.get(args.flowId);
+        const environment = resolveEnvironment(deps, args.environment);
+        const profile = deps.credentials.get(environment);
+        const built = buildTransaction(flow, {
+            amount: args.amount,
+            amountMinorUnits: args.amountMinorUnits,
+            billReference: args.billReference,
+            description: args.description,
+            txnRefNo: args.txnRefNo,
+            requestId: args.requestId,
+            referencePrefix: args.referencePrefix,
+            expiryDays: args.expiryDays,
+            extras: args.extras,
+        }, profile);
+        if (!built.validation.valid) {
+            return toolResult([
+                `Could not build a ${flow.id} payload — the request is incomplete or invalid, so it has NOT been signed.`,
+                '',
+                formatValidationResult(built.validation),
+                '',
+                'Supply the missing values and call this tool again. Flow-specific fields go in `extras`.',
+                citations(flow.docRefs),
+            ].join('\n'), {
+                isError: true,
+                structuredContent: {
+                    flowId: flow.id,
+                    valid: false,
+                    errors: built.validation.errors,
+                    warnings: built.validation.warnings,
+                },
+            });
+        }
+        const amountValue = built.parameters['pp_Amount'];
+        // The payload is rendered from a masked copy rather than relying on the
+        // scrub in safeHandler alone: this tool is the one that fills credentials
+        // in from the profile, so it must not hand a real MPIN or password to any
+        // downstream formatting in the first place.
+        const maskedParameters = maskSecretsDeep(built.parameters, deps.credentials.allSecrets());
+        const summary = [
+            `Built and signed a ${flow.title} payload for the **${environment}** environment.`,
+            '',
+            `Endpoint (${flow.transport}): ${resolveEndpoint(flow, environment)}`,
+            flow.sameEndpointForBothEnvironments
+                ? 'Sandbox and production share this URL. The environment above refers to the credentials, not the endpoint.'
+                : '',
+            amountValue === undefined ? '' : `Amount: ${amountValue} minor units (PKR ${fromMinorUnits(amountValue)})`,
+            '',
+            '## Payload',
+            '```json',
+            JSON.stringify(maskedParameters, null, 2),
+            '```',
+            '',
+            'Credential fields show `[redacted]` above so they do not enter this transcript. `pp_SecureHash` was computed over the REAL values, so substitute your own credentials before sending by hand — or pass this payload to `jazzcash_send_gateway_request`, which restores the credential fields from the server configuration and re-signs before sending.',
+            '',
+            Object.keys(built.generated).length > 0
+                ? `## Generated for you\n${Object.entries(built.generated)
+                    .map(([name, value]) => `- ${name} = ${value}`)
+                    .join('\n')}`
+                : '',
+            '',
+            built.validation.warnings.length > 0
+                ? `## Warnings\n${built.validation.warnings.map((entry) => `- [${entry.code}] ${entry.message}\n  Fix: ${entry.fix}`).join('\n')}`
+                : 'No warnings.',
+            '',
+            // Read from the transport rather than branched on `form-post` here:
+            // the else-half of that ternary told the caller to send any non-JSON
+            // transport as JSON, to an endpoint that does not parse it. See
+            // `describeHowToSend`.
+            describeHowToSend(flow),
+            citations(flow.docRefs),
+        ]
+            .filter((line) => line !== '')
+            .join('\n');
+        return toolResult(summary, {
+            structuredContent: {
+                flowId: flow.id,
+                environment,
+                endpoint: resolveEndpoint(flow, environment),
+                transport: flow.transport,
+                parameters: built.parameters,
+                secureHash: built.secureHash,
+                generated: built.generated,
+                warnings: built.validation.warnings,
+            },
+        });
+    }, 
+    // Declared here rather than branched on in the body: `extras` is the only
+    // argument that addresses a parameter by name, and the rest are typed
+    // business fields the builder routes by value type. `flowId` selects the
+    // explanatory sentence; the names refused are catalogue-wide regardless.
+    { payloadArguments: ['extras'], flowFrom: 'flowId' }));
+};
+//# sourceMappingURL=build-transaction-parameters.js.map

package/dist/tools/build-transaction-parameters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-transaction-parameters.js","sourceRoot":"","sources":["../../src/tools/build-transaction-parameters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;IAChF,MAAM,CAAC,YAAY,CACjB,uCAAuC,EACvC;QACE,KAAK,EAAE,sDAAsD;QAC7D,WAAW,EACT,sUAAsU;QACxU,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;YACpF,WAAW,EAAE,CAAC;iBACX,IAAI,CAAC,qBAAqB,CAAC;iBAC3B,QAAQ,EAAE;iBACV,QAAQ,CACP,uGAAuG,CACxG;YACH,MAAM,EAAE,CAAC;iBACN,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;iBAC/B,QAAQ,EAAE;iBACV,QAAQ,CAAC,gFAAgF,CAAC;YAC7F,gBAAgB,EAAE,CAAC;iBAChB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,iFAAiF,CAAC;YAC9F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;YACnG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;YAC5E,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,oFAAoF,CAAC;YACjG,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,uEAAuE,CAAC;YACpF,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,4GAA4G,CAC7G;YACH,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC;iBACN,GAAG,CAAC,EAAE,CAAC;iBACP,QAAQ,EAAE;iBACV,QAAQ,CAAC,sDAAsD,CAAC;YACnE,MAAM,EAAE,CAAC;iBACN,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;iBAC9B,QAAQ,EAAE;iBACV,QAAQ,CACP,uIAAuI,CACxI;SACJ;KACF,EACD,WAAW,CACT,IAAI,EACJ,uCAAuC,EACvC,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAElD,MAAM,KAAK,GAAG,gBAAgB,CAC5B,IAAI,EACJ;YACE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,EACD,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,UAAU,CACf;gBACE,qBAAqB,IAAI,CAAC,EAAE,6EAA6E;gBACzG,EAAE;gBACF,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC;gBACxC,EAAE;gBACF,0FAA0F;gBAC1F,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;aACxB,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ;gBACE,OAAO,EAAE,IAAI;gBACb,iBAAiB,EAAE;oBACjB,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;oBAC/B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;iBACpC;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAClD,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM,gBAAgB,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAG;YACd,sBAAsB,IAAI,CAAC,KAAK,sBAAsB,WAAW,iBAAiB;YAClF,EAAE;YACF,aAAa,IAAI,CAAC,SAAS,MAAM,eAAe,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE;YACrE,IAAI,CAAC,+BAA+B;gBAClC,CAAC,CAAC,2GAA2G;gBAC7G,CAAC,CAAC,EAAE;YACN,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,WAAW,qBAAqB,cAAc,CAAC,WAAW,CAAC,GAAG;YAC1G,EAAE;YACF,YAAY;YACZ,SAAS;YACT,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,KAAK;YACL,EAAE;YACF,yVAAyV;YACzV,EAAE;YACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;gBACrC,CAAC,CAAC,yBAAyB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;qBACrD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,MAAM,KAAK,EAAE,CAAC;qBAC9C,IAAI,CAAC,IAAI,CAAC,EAAE;gBACjB,CAAC,CAAC,EAAE;YACN,EAAE;YACF,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAClC,CAAC,CAAC,gBAAgB,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,YAAY,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAClI,CAAC,CAAC,cAAc;YAClB,EAAE;YACF,oEAAoE;YACpE,qEAAqE;YACrE,gEAAgE;YAChE,uBAAuB;YACvB,iBAAiB,CAAC,IAAI,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;SACxB;aACE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;aAC7B,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,UAAU,CAAC,OAAO,EAAE;YACzB,iBAAiB,EAAE;gBACjB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,WAAW;gBACX,QAAQ,EAAE,eAAe,CAAC,IAAI,EAAE,WAAW,CAAC;gBAC5C,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;aACpC;SACF,CAAC,CAAC;IACL,CAAC;IACD,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,EAAE,gBAAgB,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CACrD,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/tools/call-context.d.ts

@@ -0,0 +1,47 @@
+import type { CoreDependencies } from '../core/dependencies.js';
+import type { Logger } from '../telemetry/logger.js';
+/**
+ * Per-call identity for a tool invocation.
+ *
+ * One tool call is one unit of work, but until now nothing tied its log records
+ * to it: the logger's only binding is a static server name, so a merchant
+ * reporting "the refund tool failed" left an operator reading a stream of
+ * records that could not be separated from any other call in the session. A
+ * context created once per call, and carried into the handler, is what makes a
+ * failure attributable to the call that produced it.
+ *
+ * The context is derived from {@link CoreDependencies}, never from the SDK's
+ * `extra` argument; `safeHandler` in `tool-kit.ts` records why.
+ */
+export interface CallContext {
+    /** Registered tool name, e.g. `jazzcash_build_secure_hash`. */
+    readonly toolName: string;
+    /**
+     * Identifier for this call.
+     *
+     * A UUID rather than a per-process counter, because a counter restarts at 1
+     * every time the server is respawned — which an IDE does on every reload — so
+     * identifiers would repeat across runs and point an operator at the wrong call
+     * in an aggregated log.
+     */
+    readonly requestId: string;
+    /**
+     * Wall-clock epoch milliseconds at which the call began.
+     *
+     * Wall clock rather than a monotonic reading: the logger stamps every record
+     * with an ISO wall-clock timestamp, and a monotonic value measured from an
+     * arbitrary process origin could not be lined up against those records, which
+     * is the only reason to record a start at all.
+     */
+    readonly startedAt: number;
+    /**
+     * Logger bound to this call's identity.
+     *
+     * Handlers must log through this rather than through `deps.logger`, otherwise
+     * the record loses the `requestId` and becomes unattributable again.
+     */
+    readonly logger: Logger;
+}
+/** Build the context for a single invocation of `toolName`. */
+export declare function createCallContext(deps: CoreDependencies, toolName: string): CallContext;
+//# sourceMappingURL=call-context.d.ts.map

package/dist/tools/call-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-context.d.ts","sourceRoot":"","sources":["../../src/tools/call-context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,CAWvF"}

package/dist/tools/call-context.js

@@ -0,0 +1,15 @@
+import { randomUUID } from 'node:crypto';
+/** Build the context for a single invocation of `toolName`. */
+export function createCallContext(deps, toolName) {
+    const requestId = randomUUID();
+    return {
+        toolName,
+        requestId,
+        startedAt: Date.now(),
+        // Bound here rather than at each log site so that every record a handler
+        // emits carries the identity, including ones added later by code that never
+        // read this module.
+        logger: deps.logger.child({ tool: toolName, requestId }),
+    };
+}
+//# sourceMappingURL=call-context.js.map

package/dist/tools/call-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-context.js","sourceRoot":"","sources":["../../src/tools/call-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiDzC,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,IAAsB,EAAE,QAAgB;IACxE,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,OAAO;QACL,QAAQ;QACR,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,yEAAyE;QACzE,4EAA4E;QAC5E,oBAAoB;QACpB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC"}

package/dist/tools/codegen-tools.d.ts

@@ -0,0 +1,4 @@
+import type { Registrar } from '../registry.js';
+export declare const registerGenerateIntegrationCode: Registrar;
+export declare const registerGenerateIpnHandler: Registrar;
+//# sourceMappingURL=codegen-tools.d.ts.map

package/dist/tools/codegen-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codegen-tools.d.ts","sourceRoot":"","sources":["../../src/tools/codegen-tools.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AA2ChD,eAAO,MAAM,+BAA+B,EAAE,SA6D7C,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,SAwDxC,CAAC"}