@atbas/m-mcp 0.1.0

package/dist/tools/hash-tools.js

@@ -0,0 +1,238 @@
+import { z } from 'zod';
+import { forensicProvenance, requestHashOptions, responseHashOptions, signatureFieldName, UNKNOWN_FLOW_RESPONSE_HASH_OPTIONS, } from '../catalogue/hash-options.js';
+import { JAZZCASH_ENVIRONMENTS } from '../config/environment.js';
+import { buildHashString, computeSecureHash, diagnoseHashMismatch } from '../domain/secure-hash.js';
+import { describeSignatureFor } from '../domain/signature/registry.js';
+import { maskSecrets, REDACTED } from '../telemetry/redaction.js';
+import { formatValidationResult, validatePayload } from '../validation/payload-validator.js';
+import { citations, resolveEnvironment, resolveIntegritySalt, safeHandler, toolResult } from './tool-kit.js';
+/**
+ * Secure hash and payload validation tools.
+ *
+ * These answer the question that generates most support traffic: "why am I
+ * getting HASH_MISMATCH?"
+ */
+const parametersSchema = z
+    .record(z.string(), z.union([z.string(), z.number(), z.null()]))
+    .describe('The request or response payload, exactly as you send or receive it.');
+const environmentSchema = z
+    .enum(JAZZCASH_ENVIRONMENTS)
+    .optional()
+    .describe('Which credential profile to take the Integrity Salt from. Defaults to the configured environment.');
+const integritySaltSchema = z
+    .string()
+    .optional()
+    .describe("Integrity Salt to use instead of the configured one. Useful when debugging a merchant's own value.");
+/** Replace the salt in a hash string so a transcript cannot leak it by default. */
+function maskHashString(hashString, salt) {
+    return hashString.startsWith(`${salt}&`)
+        ? `${REDACTED}&${hashString.slice(salt.length + 1)}`
+        : hashString.replace(salt, REDACTED);
+}
+export const registerBuildSecureHash = (server, deps) => {
+    server.registerTool('jazzcash_build_secure_hash', {
+        title: 'Compute a JazzCash pp_SecureHash',
+        description: 'Compute pp_SecureHash for a payload and show exactly which fields contributed, in what order, and why each excluded field was excluded. Use this to check your own implementation field by field.',
+        inputSchema: {
+            flowId: z.string().optional().describe("Apply this flow's hash configuration. Omit for the default rules."),
+            parameters: parametersSchema,
+            integritySalt: integritySaltSchema,
+            environment: environmentSchema,
+            revealHashString: z
+                .boolean()
+                .optional()
+                .describe('Show the Integrity Salt inside the returned hash string. Off by default so the salt is not written into a shared transcript. Only applies to a salt passed as integritySalt: a salt taken from the configured credentials is scrubbed from every tool result and cannot be shown.'),
+        },
+    }, safeHandler(deps, 'jazzcash_build_secure_hash', ({ flowId, parameters, integritySalt, environment, revealHashString }) => {
+        const environmentName = resolveEnvironment(deps, environment);
+        const { salt, source } = resolveIntegritySalt(deps, integritySalt, environmentName);
+        const flow = flowId === undefined ? undefined : deps.catalogue.get(flowId);
+        const options = flow === undefined ? undefined : requestHashOptions(flow);
+        const breakdown = buildHashString(parameters, salt, options);
+        const secureHash = computeSecureHash(parameters, salt, options);
+        // Both the field the digest goes into and the sentence describing how it
+        // was produced come from the flow. Labelled `pp_SecureHash =` and
+        // described as HMAC-SHA256 into lowercase hex for every flow, this tool
+        // told a merchant whose field is `vp_Signature` to write a digest it
+        // does not compute into a field their gateway never reads.
+        const signatureField = flow === undefined ? undefined : signatureFieldName(flow);
+        const signature = describeSignatureFor(options);
+        // `safeHandler` scrubs every configured secret literal from the finished
+        // result, so revealing a configured salt is not something this tool can
+        // deliver however the flag is set. Asking redaction itself is the only
+        // honest test of whether the caller would actually see the value, and
+        // `saltRevealed` reports what happened rather than what was requested.
+        const saltIsRevealable = integritySalt !== undefined &&
+            integritySalt !== '' &&
+            maskSecrets(salt, deps.credentials.allSecrets()) === salt;
+        const saltRevealed = revealHashString === true && saltIsRevealable;
+        const displayed = saltRevealed ? breakdown.hashString : maskHashString(breakdown.hashString, salt);
+        const saltNote = saltRevealed
+            ? ''
+            : saltIsRevealable
+                ? 'The Integrity Salt is masked above. Pass revealHashString: true to see the exact string.'
+                : 'The Integrity Salt is masked above. It is a configured credential, and configured credentials are removed from every tool result, so it cannot be revealed through this transcript.';
+        const text = [
+            `${signatureField ?? 'pp_SecureHash'} = ${secureHash}`,
+            '',
+            `Integrity Salt taken from ${source}.`,
+            flow === undefined ? 'Using the default hash rules.' : `Using the hash rules for ${flow.id}.`,
+            '',
+            `## Fields that contributed (${String(breakdown.includedFields.length)}, sorted by name)`,
+            breakdown.includedFields.map((name, index) => `${String(index + 1)}. ${name}`).join('\n'),
+            '',
+            breakdown.excludedFields.length > 0
+                ? `## Fields excluded\n${breakdown.excludedFields
+                    .map((entry) => `- ${entry.name} — ${entry.reason.replace(/-/g, ' ')}`)
+                    .join('\n')}`
+                : '',
+            '',
+            '## Hash string',
+            '```',
+            displayed,
+            '```',
+            saltNote,
+            '',
+            '## How this signature is built',
+            signature.construction,
+            signature.encoding,
+            citations([{ docId: 'hmac-sha256-calculation', sectionId: 'how-is-hmac-sha256-calculated' }]),
+        ]
+            .filter((line) => line !== '')
+            .join('\n');
+        return toolResult(text, {
+            structuredContent: {
+                secureHash,
+                includedFields: breakdown.includedFields,
+                excludedFields: breakdown.excludedFields,
+                hashString: displayed,
+                saltRevealed,
+            },
+        });
+    }, 
+    // Refused before the payload is read at all: the hash string this tool
+    // renders would otherwise carry the value straight back into the
+    // transcript. `flowId` selects the explanatory sentence; the names refused
+    // are catalogue-wide regardless.
+    { payloadArguments: ['parameters'], flowFrom: 'flowId' }));
+};
+export const registerVerifySecureHash = (server, deps) => {
+    server.registerTool('jazzcash_verify_secure_hash', {
+        title: 'Verify a JazzCash pp_SecureHash and diagnose a mismatch',
+        description: "Check a secure hash against a payload. On a mismatch, replays the known-wrong constructions for the flow's own signature scheme against your parameters and reports which one reproduces your hash, so the cause is demonstrated rather than guessed.",
+        inputSchema: {
+            parameters: parametersSchema,
+            expectedHash: z.string().min(1).describe('The pp_SecureHash you produced or received.'),
+            flowId: z.string().optional().describe("Apply this flow's hash configuration."),
+            direction: z
+                .enum(['request', 'response'])
+                .optional()
+                .describe('Whether this is a request you sent or a response you received. Response verification is best-effort; see the note in the result.'),
+            integritySalt: integritySaltSchema,
+            environment: environmentSchema,
+        },
+    }, safeHandler(deps, 'jazzcash_verify_secure_hash', ({ parameters, expectedHash, flowId, direction, integritySalt, environment }) => {
+        const environmentName = resolveEnvironment(deps, environment);
+        const { salt } = resolveIntegritySalt(deps, integritySalt, environmentName);
+        const flow = flowId === undefined ? undefined : deps.catalogue.get(flowId);
+        const isResponse = direction === 'response';
+        // Requests and responses use different field selections. Spreading the
+        // request spec into a response check filters out every field of a card
+        // or BNPL refund response, reducing the hash input to the bare salt and
+        // making verification vacuous. See catalogue/hash-options.ts.
+        const options = isResponse
+            ? flow === undefined
+                ? UNKNOWN_FLOW_RESPONSE_HASH_OPTIONS
+                : responseHashOptions(flow)
+            : flow === undefined
+                ? undefined
+                : requestHashOptions(flow);
+        // A reproduction is only evidence under the construction the payload was
+        // signed with. On the response side that construction is this server's,
+        // not the flow's, so a foreign provider's CORRECT signature must not come
+        // back as a proven JazzCash construction error. See `forensicProvenance`.
+        const diagnosis = diagnoseHashMismatch(parameters, salt, expectedHash, options, forensicProvenance(flow, isResponse ? 'response' : 'request'));
+        if (diagnosis.matches) {
+            return toolResult([
+                'The hash MATCHES.',
+                '',
+                `Computed and supplied hashes are identical (${diagnosis.expectedHash}).`,
+                `${String(diagnosis.breakdown.includedFields.length)} field(s) contributed: ${diagnosis.breakdown.includedFields.join(', ')}.`,
+            ].join('\n'), { structuredContent: { matches: true, verdict: 'match', expectedHash: diagnosis.expectedHash } });
+        }
+        // Assumption A2: no guide states which response fields feed the response
+        // hash, so a response mismatch is reported as unverified, never as failed.
+        const verdict = isResponse ? 'unverified' : 'mismatch';
+        const text = [
+            isResponse
+                ? 'The response hash could NOT be verified — treat this as UNVERIFIED, not as a failure.'
+                : 'The hash does NOT match.',
+            '',
+            `Expected (computed here): ${diagnosis.expectedHash}`,
+            `Supplied:                 ${diagnosis.providedHash}`,
+            '',
+            diagnosis.summary,
+            '',
+            '## Likely causes',
+            diagnosis.hypotheses
+                .map((entry, index) => `${String(index + 1)}. **${entry.label}** (${entry.confidence})\n   ${entry.explanation}\n   Fix: ${entry.fix}`)
+                .join('\n\n'),
+            '',
+            `## Fields used\nContributed (${String(diagnosis.breakdown.includedFields.length)}): ${diagnosis.breakdown.includedFields.join(', ')}`,
+            diagnosis.breakdown.excludedFields.length > 0
+                ? `Excluded: ${diagnosis.breakdown.excludedFields.map((entry) => `${entry.name} (${entry.reason})`).join(', ')}`
+                : '',
+            isResponse
+                ? '\nNote: JazzCash does not document which response fields feed the response hash. This server recomputes over all non-empty response fields except the hash field itself. A mismatch here may mean the assumption is wrong rather than that your integration is broken — do not tell a merchant their integration has failed on this basis alone.'
+                : '',
+            citations([{ docId: 'hmac-sha256-calculation', sectionId: 'common-failures' }]),
+        ]
+            .filter((line) => line !== '')
+            .join('\n');
+        return toolResult(text, {
+            structuredContent: {
+                matches: false,
+                verdict,
+                expectedHash: diagnosis.expectedHash,
+                providedHash: diagnosis.providedHash,
+                hypotheses: diagnosis.hypotheses,
+                includedFields: diagnosis.breakdown.includedFields,
+            },
+        });
+    }, 
+    // A response payload is refused on the same terms as a request one, so the
+    // declaration names the one argument either arrives in. A per-tool
+    // exemption is how a boundary rule stops being a boundary.
+    { payloadArguments: ['parameters'], flowFrom: 'flowId' }));
+};
+export const registerValidatePayload = (server, deps) => {
+    server.registerTool('jazzcash_validate_payload', {
+        title: 'Validate a JazzCash payload',
+        description: 'Check a payload against its flow specification: missing and extra fields, empty-string rules, modified constants, minor-unit amounts, Pakistan-time timestamps, expiry window, reference formats, Return URL, MSISDN and CNIC. Returns each problem with a concrete fix.',
+        inputSchema: {
+            flowId: z.string().describe('Flow to validate against, e.g. "mwallet-rest-v1.1".'),
+            parameters: parametersSchema,
+            environment: environmentSchema,
+        },
+    }, safeHandler(deps, 'jazzcash_validate_payload', ({ flowId, parameters, environment }) => {
+        const flow = deps.catalogue.get(flowId);
+        const environmentName = resolveEnvironment(deps, environment);
+        const registeredReturnUrl = deps.credentials.has(environmentName)
+            ? deps.credentials.get(environmentName).returnUrl
+            : undefined;
+        const result = validatePayload(flow, parameters, { registeredReturnUrl });
+        return toolResult(`${formatValidationResult(result)}${citations(flow.docRefs)}`, {
+            structuredContent: {
+                valid: result.valid,
+                flowId: result.flowId,
+                errors: result.errors,
+                warnings: result.warnings,
+            },
+        });
+    }, 
+    // The `tool-argument.forbidden` validation rule would report this field
+    // too, but only after the validator has read the value; refusing at the
+    // boundary means the payload is never inspected at all.
+    { payloadArguments: ['parameters'], flowFrom: 'flowId' }));
+};
+//# sourceMappingURL=hash-tools.js.map

package/dist/tools/hash-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash-tools.js","sourceRoot":"","sources":["../../src/tools/hash-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kCAAkC,GACnC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAEvE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE7G;;;;;GAKG;AAEH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;KAC/D,QAAQ,CAAC,qEAAqE,CAAC,CAAC;AAEnF,MAAM,iBAAiB,GAAG,CAAC;KACxB,IAAI,CAAC,qBAAqB,CAAC;KAC3B,QAAQ,EAAE;KACV,QAAQ,CAAC,mGAAmG,CAAC,CAAC;AAEjH,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,QAAQ,CAAC,oGAAoG,CAAC,CAAC;AAElH,mFAAmF;AACnF,SAAS,cAAc,CAAC,UAAkB,EAAE,IAAY;IACtD,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;QACtC,CAAC,CAAC,GAAG,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE;QACpD,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAc,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;IACjE,MAAM,CAAC,YAAY,CACjB,4BAA4B,EAC5B;QACE,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,mMAAmM;QACrM,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;YAC3G,UAAU,EAAE,gBAAgB;YAC5B,aAAa,EAAE,mBAAmB;YAClC,WAAW,EAAE,iBAAiB;YAC9B,gBAAgB,EAAE,CAAC;iBAChB,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CACP,mRAAmR,CACpR;SACJ;KACF,EACD,WAAW,CACT,IAAI,EACJ,4BAA4B,EAC5B,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE,EAAE,EAAE;QACvE,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,IAAI,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE3E,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAE1E,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAChE,yEAAyE;QACzE,kEAAkE;QAClE,wEAAwE;QACxE,qEAAqE;QACrE,2DAA2D;QAC3D,MAAM,cAAc,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAEhD,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,gBAAgB,GACpB,aAAa,KAAK,SAAS;YAC3B,aAAa,KAAK,EAAE;YACpB,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,KAAK,IAAI,CAAC;QAC5D,MAAM,YAAY,GAAG,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,CAAC;QACnE,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAG,YAAY;YAC3B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,gBAAgB;gBAChB,CAAC,CAAC,0FAA0F;gBAC5F,CAAC,CAAC,qLAAqL,CAAC;QAE5L,MAAM,IAAI,GAAG;YACX,GAAG,cAAc,IAAI,eAAe,MAAM,UAAU,EAAE;YACtD,EAAE;YACF,6BAA6B,MAAM,GAAG;YACtC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,4BAA4B,IAAI,CAAC,EAAE,GAAG;YAC7F,EAAE;YACF,+BAA+B,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,mBAAmB;YACzF,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACzF,EAAE;YACF,SAAS,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,uBAAuB,SAAS,CAAC,cAAc;qBAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;qBACtE,IAAI,CAAC,IAAI,CAAC,EAAE;gBACjB,CAAC,CAAC,EAAE;YACN,EAAE;YACF,gBAAgB;YAChB,KAAK;YACL,SAAS;YACT,KAAK;YACL,QAAQ;YACR,EAAE;YACF,gCAAgC;YAChC,SAAS,CAAC,YAAY;YACtB,SAAS,CAAC,QAAQ;YAClB,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,+BAA+B,EAAE,CAAC,CAAC;SAC9F;aACE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;aAC7B,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,UAAU,CAAC,IAAI,EAAE;YACtB,iBAAiB,EAAE;gBACjB,UAAU;gBACV,cAAc,EAAE,SAAS,CAAC,cAAc;gBACxC,cAAc,EAAE,SAAS,CAAC,cAAc;gBACxC,UAAU,EAAE,SAAS;gBACrB,YAAY;aACb;SACF,CAAC,CAAC;IACL,CAAC;IACD,uEAAuE;IACvE,iEAAiE;IACjE,2EAA2E;IAC3E,iCAAiC;IACjC,EAAE,gBAAgB,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CACzD,CACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAc,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;IAClE,MAAM,CAAC,YAAY,CACjB,6BAA6B,EAC7B;QACE,KAAK,EAAE,yDAAyD;QAChE,WAAW,EACT,uPAAuP;QACzP,WAAW,EAAE;YACX,UAAU,EAAE,gBAAgB;YAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YACvF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;YAC/E,SAAS,EAAE,CAAC;iBACT,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;iBAC7B,QAAQ,EAAE;iBACV,QAAQ,CACP,kIAAkI,CACnI;YACH,aAAa,EAAE,mBAAmB;YAClC,WAAW,EAAE,iBAAiB;SAC/B;KACF,EACD,WAAW,CACT,IAAI,EACJ,6BAA6B,EAC7B,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,EAAE,EAAE;QAC9E,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,EAAE,IAAI,EAAE,GAAG,oBAAoB,CAAC,IAAI,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE3E,MAAM,UAAU,GAAG,SAAS,KAAK,UAAU,CAAC;QAE5C,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,UAAU;YACxB,CAAC,CAAC,IAAI,KAAK,SAAS;gBAClB,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAC7B,CAAC,CAAC,IAAI,KAAK,SAAS;gBAClB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAE/B,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,SAAS,GAAG,oBAAoB,CACpC,UAAU,EACV,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAC9D,CAAC;QAEF,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,UAAU,CACf;gBACE,mBAAmB;gBACnB,EAAE;gBACF,+CAA+C,SAAS,CAAC,YAAY,IAAI;gBACzE,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,0BAA0B,SAAS,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC/H,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,CACjG,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;QAEvD,MAAM,IAAI,GAAG;YACX,UAAU;gBACR,CAAC,CAAC,uFAAuF;gBACzF,CAAC,CAAC,0BAA0B;YAC9B,EAAE;YACF,6BAA6B,SAAS,CAAC,YAAY,EAAE;YACrD,6BAA6B,SAAS,CAAC,YAAY,EAAE;YACrD,EAAE;YACF,SAAS,CAAC,OAAO;YACjB,EAAE;YACF,kBAAkB;YAClB,SAAS,CAAC,UAAU;iBACjB,GAAG,CACF,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,UAAU,SAAS,KAAK,CAAC,WAAW,aAAa,KAAK,CAAC,GAAG,EAAE,CAClH;iBACA,IAAI,CAAC,MAAM,CAAC;YACf,EAAE;YACF,gCAAgC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACtI,SAAS,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBAC3C,CAAC,CAAC,aAAa,SAAS,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChH,CAAC,CAAC,EAAE;YACN,UAAU;gBACR,CAAC,CAAC,kVAAkV;gBACpV,CAAC,CAAC,EAAE;YACN,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;SAChF;aACE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;aAC7B,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,UAAU,CAAC,IAAI,EAAE;YACtB,iBAAiB,EAAE;gBACjB,OAAO,EAAE,KAAK;gBACd,OAAO;gBACP,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,cAAc;aACnD;SACF,CAAC,CAAC;IACL,CAAC;IACD,2EAA2E;IAC3E,mEAAmE;IACnE,2DAA2D;IAC3D,EAAE,gBAAgB,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CACzD,CACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAc,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;IACjE,MAAM,CAAC,YAAY,CACjB,2BAA2B,EAC3B;QACE,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,0QAA0Q;QAC5Q,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;YAClF,UAAU,EAAE,gBAAgB;YAC5B,WAAW,EAAE,iBAAiB;SAC/B;KACF,EACD,WAAW,CACT,IAAI,EACJ,2BAA2B,EAC3B,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,SAAS;YACjD,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAE1E,OAAO,UAAU,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE;YAC/E,iBAAiB,EAAE;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B;SACF,CAAC,CAAC;IACL,CAAC;IACD,wEAAwE;IACxE,wEAAwE;IACxE,wDAAwD;IACxD,EAAE,gBAAgB,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CACzD,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/tools/knowledge-tools.d.ts

@@ -0,0 +1,7 @@
+import type { Registrar } from '../registry.js';
+export declare const registerListIntegrationFlows: Registrar;
+export declare const registerGetIntegrationFlow: Registrar;
+export declare const registerSearchDocs: Registrar;
+export declare const registerGetDocSection: Registrar;
+export declare const registerExplainResponseCode: Registrar;
+//# sourceMappingURL=knowledge-tools.d.ts.map

package/dist/tools/knowledge-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"knowledge-tools.d.ts","sourceRoot":"","sources":["../../src/tools/knowledge-tools.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AA2ChD,eAAO,MAAM,4BAA4B,EAAE,SA8C1C,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,SAyFxC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,SA4ChC,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,SAsCnC,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,SAkCzC,CAAC"}

package/dist/tools/knowledge-tools.js

@@ -0,0 +1,247 @@
+import { z } from 'zod';
+import { PORTAL_URLS, resolveEndpoint } from '../catalogue/endpoints.js';
+import { requestHashOptions } from '../catalogue/hash-options.js';
+import { PRODUCTS } from '../catalogue/types.js';
+import { describeApiResponseCode, describePaymentResponseCode } from '../domain/response-codes.js';
+import { describeSignatureFor } from '../domain/signature/registry.js';
+import { bulletList, citations, safeHandler, toolResult } from './tool-kit.js';
+/**
+ * Documentation and catalogue tools.
+ *
+ * These are the tools that let a merchant's AI answer "how do I…" from the
+ * official guides rather than from general knowledge of payment gateways.
+ */
+/**
+ * Sentence describing where a response signature arrives, or that none does.
+ *
+ * `hashField` is optional because a provider whose REST responses carry no
+ * signature has no field to name. Interpolating it unguarded printed the word
+ * `undefined` at a merchant, which reads as a field called "undefined" rather
+ * than as the absence of one — and absence is the security-relevant fact, since
+ * it means the response cannot be authenticated at all.
+ *
+ * Module-private: both branches are asserted through the rendered output of
+ * `jazzcash_get_integration_flow` in `tests/tools/knowledge-tools.test.ts`,
+ * which is where a merchant actually reads the sentence. Exported for a test,
+ * it was the only sentence in this file a test could reach without going
+ * through the tool that prints it.
+ */
+function responseHashSentence(flow) {
+    return flow.response.hashField === undefined
+        ? 'This response carries no signature, so it cannot be authenticated — treat it as untrusted and confirm the outcome with a status inquiry.'
+        : `The response hash arrives in \`${flow.response.hashField}\`.`;
+}
+function describeFlowBrief(flow) {
+    return [
+        `**${flow.id}** — ${flow.title}`,
+        `  Transport: ${flow.transport} | Version: ${flow.version} | Moves money: ${flow.movesMoney ? 'yes' : 'no'}`,
+        `  Use when: ${flow.useWhen}`,
+        `  Endpoint: ${resolveEndpoint(flow, 'sandbox')}`,
+        flow.companionFlows.length > 0 ? `  Mandatory alongside: ${flow.companionFlows.join(', ')}` : undefined,
+    ]
+        .filter((line) => line !== undefined)
+        .join('\n');
+}
+export const registerListIntegrationFlows = (server, deps) => {
+    server.registerTool('jazzcash_list_integration_flows', {
+        title: 'List JazzCash integration flows',
+        description: 'List every JazzCash integration flow this server knows, with the endpoint, transport and when to use each. Start here when choosing how to integrate.',
+        inputSchema: {
+            product: z
+                .enum(PRODUCTS)
+                .optional()
+                .describe('Restrict to one product family, e.g. "card", "mwallet", "refund".'),
+        },
+    }, safeHandler(deps, 'jazzcash_list_integration_flows', ({ product }) => {
+        const flows = product === undefined ? deps.catalogue.list() : deps.catalogue.byProduct(product);
+        const text = [
+            product === undefined
+                ? `${String(flows.length)} integration flows are available.`
+                : `${String(flows.length)} ${product} flow(s).`,
+            '',
+            flows.map(describeFlowBrief).join('\n\n'),
+            '',
+            'Sandbox and production share identical endpoints in every flow: the environment is determined by the credentials, not the URL.',
+            `Sandbox signup: ${PORTAL_URLS.sandboxSignup}`,
+            `Merchant portal: ${PORTAL_URLS.merchantPortalLogin}`,
+        ].join('\n');
+        return toolResult(text, {
+            structuredContent: {
+                flows: flows.map((flow) => ({
+                    id: flow.id,
+                    title: flow.title,
+                    product: flow.product,
+                    version: flow.version,
+                    transport: flow.transport,
+                    movesMoney: flow.movesMoney,
+                    useWhen: flow.useWhen,
+                    endpoint: resolveEndpoint(flow, 'sandbox'),
+                    companionFlows: flow.companionFlows,
+                })),
+            },
+        });
+    }));
+};
+export const registerGetIntegrationFlow = (server, deps) => {
+    server.registerTool('jazzcash_get_integration_flow', {
+        title: 'Get a JazzCash integration flow specification',
+        description: 'Full specification for one flow: every parameter with its requirement and rules, the secure hash configuration, the response contract, known documentation defects, and citations.',
+        inputSchema: {
+            flowId: z.string().describe('Flow identifier, e.g. "mwallet-rest-v1.1". Use jazzcash_list_integration_flows.'),
+        },
+    }, safeHandler(deps, 'jazzcash_get_integration_flow', ({ flowId }) => {
+        const flow = deps.catalogue.get(flowId);
+        const parameterLines = flow.parameters.map((parameter) => {
+            const bits = [
+                `- \`${parameter.name}\` (${parameter.requirement}, ${parameter.valueType}`,
+                parameter.constantValue === undefined ? '' : `, fixed at "${parameter.constantValue}"`,
+                parameter.maxLength === undefined ? '' : `, max ${String(parameter.maxLength)} chars`,
+                parameter.sensitive ? ', SENSITIVE' : '',
+                `) — ${parameter.notes}`,
+            ];
+            return bits.join('');
+        });
+        // Rendered from the plan the engine will actually execute, not from a
+        // construction spelled out at this call site. A hand-written sentence
+        // describes what its author had in mind rather than what the flow
+        // configured, and the merchant implements the sentence.
+        const signature = describeSignatureFor(requestHashOptions(flow));
+        const text = [
+            `# ${flow.title}`,
+            '',
+            flow.summary,
+            '',
+            `**Use when:** ${flow.useWhen}`,
+            `**Transport:** ${flow.transport} | **Version:** ${flow.version} | **Moves money:** ${flow.movesMoney ? 'yes' : 'no'}`,
+            '',
+            '## Endpoint',
+            `Sandbox:    ${resolveEndpoint(flow, 'sandbox')}`,
+            `Production: ${resolveEndpoint(flow, 'production')}`,
+            flow.sameEndpointForBothEnvironments
+                ? 'These are identical. The environment is determined by the credentials you send, never by the URL.'
+                : '',
+            '',
+            '## Parameters',
+            parameterLines.join('\n'),
+            '',
+            '## Secure hash',
+            `**Request:** ${signature.construction}`,
+            `Excluded from its own input: ${flow.hash.excludeFields.join(', ')}.`,
+            // Responses use a different field selection; stating only the request
+            // rule is what led implementations to verify responses vacuously.
+            `**Response:** ${flow.response.hashFieldPrefixes.length === 0
+                ? 'all non-empty response fields participate — no prefix filter. Card and BNPL refund responses use unprefixed names, so applying the request filter would exclude every field and reduce the hash to the bare salt.'
+                : `only fields prefixed ${flow.response.hashFieldPrefixes.map((prefix) => `\`${prefix}\``).join(' or ')} participate.`} ${responseHashSentence(flow)}`,
+            signature.encoding,
+            '',
+            '## Response',
+            `Success is \`${flow.response.successField}\` = "${flow.response.successValue}". ${responseHashSentence(flow)}`,
+            flow.response.settlement === undefined
+                ? ''
+                : // Both levels must be checked. A service-level success with a
+                    // settlement code that is not the approval value is a DECLINED
+                    // payment, so reporting the first level alone reads a decline as a
+                    // sale.
+                    `Settlement is \`${flow.response.settlement.field}\` = "${flow.response.settlement.successValue}", and both levels must pass.`,
+            flow.response.notableFields.length > 0 ? `Notable fields: ${flow.response.notableFields.join(', ')}.` : '',
+            '',
+            flow.companionFlows.length > 0 ? `## Mandatory alongside\n${bulletList([...flow.companionFlows])}\n` : '',
+            flow.knownIssues.length > 0
+                ? [
+                    '## Known documentation issues',
+                    flow.knownIssues
+                        .map((entry) => `### ${entry.summary}\n${entry.detail}\n\n**Guidance:** ${entry.guidance}`)
+                        .join('\n\n'),
+                ].join('\n')
+                : '',
+            citations(flow.docRefs),
+        ]
+            .filter((line) => line !== '')
+            .join('\n');
+        return toolResult(text, { structuredContent: { flow } });
+    }));
+};
+export const registerSearchDocs = (server, deps) => {
+    server.registerTool('jazzcash_search_docs', {
+        title: 'Search the official JazzCash documentation',
+        description: 'Search the curated 2026 JazzCash integration guides and return ranked passages with citations. Use this to answer merchant questions from the official documentation rather than from general knowledge.',
+        inputSchema: {
+            query: z.string().min(1).describe('What to look up, e.g. "hash mismatch order of fields".'),
+            flowId: z.string().optional().describe('Restrict to documents describing this flow.'),
+            limit: z.number().int().min(1).max(20).optional().describe('Maximum passages to return. Default 5.'),
+        },
+    }, safeHandler(deps, 'jazzcash_search_docs', ({ query, flowId, limit }) => {
+        const results = deps.search.search(query, { flowId, limit });
+        if (results.length === 0) {
+            return toolResult(`No passage in the 2026 JazzCash corpus matches "${query}".\n\nThe corpus covers: ${deps.corpus
+                .documents()
+                .map((document) => document.metadata.title)
+                .join('; ')}.\n\nIf the question is outside these guides, say so rather than answering from general knowledge.`, { structuredContent: { query, results: [] } });
+        }
+        const text = [
+            `${String(results.length)} passage(s) for "${query}":`,
+            '',
+            results
+                .map((result, index) => `## ${String(index + 1)}. ${result.documentTitle} — ${result.sectionTitle}\n${result.uri} (score ${String(result.score)})\n\n${result.excerpt}`)
+                .join('\n\n'),
+            '',
+            'Read a full section with jazzcash_get_doc_section.',
+        ].join('\n');
+        return toolResult(text, { structuredContent: { query, results } });
+    }));
+};
+export const registerGetDocSection = (server, deps) => {
+    server.registerTool('jazzcash_get_doc_section', {
+        title: 'Read a JazzCash documentation section',
+        description: 'Return the full text of a curated documentation section, or the whole document when no section is given.',
+        inputSchema: {
+            docId: z.string().describe('Document identifier, e.g. "status-inquiry".'),
+            sectionId: z
+                .string()
+                .optional()
+                .describe('Section anchor, e.g. "common-failures". Omit for the whole document.'),
+        },
+    }, safeHandler(deps, 'jazzcash_get_doc_section', ({ docId, sectionId }) => {
+        if (sectionId === undefined) {
+            const document = deps.corpus.document(docId);
+            return toolResult(document.markdown, {
+                structuredContent: {
+                    docId,
+                    title: document.metadata.title,
+                    sourcePdf: document.metadata.sourcePdf,
+                    version: document.metadata.version,
+                    sections: document.sections.map((section) => ({ id: section.sectionId, title: section.title })),
+                },
+            });
+        }
+        const section = deps.corpus.section(docId, sectionId);
+        const document = deps.corpus.document(docId);
+        return toolResult(`# ${document.metadata.title} — ${section.title}\n\n${section.text}\n\nSource: ${document.metadata.sourcePdf} (version ${document.metadata.version})`, { structuredContent: { docId, sectionId, title: section.title, text: section.text, uri: section.uri } });
+    }));
+};
+export const registerExplainResponseCode = (server, deps) => {
+    server.registerTool('jazzcash_explain_response_code', {
+        title: 'Explain a JazzCash response code',
+        description: 'Explain what a JazzCash response code means and what to do next. Distinguishes the API-operation code from the payment-status code, which are easy to confuse.',
+        inputSchema: {
+            code: z.string().describe('The code, e.g. "000", "121", "199".'),
+            field: z
+                .enum(['pp_ResponseCode', 'pp_PaymentResponseCode', 'ResponseCode'])
+                .describe('Which field carried it. pp_ResponseCode / ResponseCode describe the API call; pp_PaymentResponseCode describes the payment.'),
+        },
+    }, safeHandler(deps, 'jazzcash_explain_response_code', ({ code, field }) => {
+        const info = field === 'pp_PaymentResponseCode' ? describePaymentResponseCode(code) : describeApiResponseCode(code);
+        const text = [
+            `**${field} = "${code}"**`,
+            '',
+            info.meaning,
+            '',
+            `Outcome: ${info.outcome}${info.documented ? '' : ' (this code is not documented in the 2026 corpus)'}`,
+            '',
+            `What to do: ${info.action}`,
+            citations(info.docRefs),
+        ].join('\n');
+        return toolResult(text, { structuredContent: { ...info } });
+    }));
+};
+//# sourceMappingURL=knowledge-tools.js.map

package/dist/tools/knowledge-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"knowledge-tools.js","sourceRoot":"","sources":["../../src/tools/knowledge-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAwB,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAEvE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE/E;;;;;GAKG;AAEH;;;;;;;;;;;;;;GAcG;AACH,SAAS,oBAAoB,CAAC,IAAqB;IACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;QAC1C,CAAC,CAAC,0IAA0I;QAC5I,CAAC,CAAC,kCAAkC,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,CAAC;AACrE,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAqB;IAC9C,OAAO;QACL,KAAK,IAAI,CAAC,EAAE,QAAQ,IAAI,CAAC,KAAK,EAAE;QAChC,gBAAgB,IAAI,CAAC,SAAS,eAAe,IAAI,CAAC,OAAO,mBAAmB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAC5G,eAAe,IAAI,CAAC,OAAO,EAAE;QAC7B,eAAe,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE;QACjD,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;KACxG;SACE,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SACpD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAc,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,CAAC,YAAY,CACjB,iCAAiC,EACjC;QACE,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,uJAAuJ;QACzJ,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;iBACP,IAAI,CAAC,QAAQ,CAAC;iBACd,QAAQ,EAAE;iBACV,QAAQ,CAAC,mEAAmE,CAAC;SACjF;KACF,EACD,WAAW,CAAC,IAAI,EAAE,iCAAiC,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;QACnE,MAAM,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAEhG,MAAM,IAAI,GAAG;YACX,OAAO,KAAK,SAAS;gBACnB,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,mCAAmC;gBAC5D,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,OAAO,WAAW;YACjD,EAAE;YACF,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YACzC,EAAE;YACF,gIAAgI;YAChI,mBAAmB,WAAW,CAAC,aAAa,EAAE;YAC9C,oBAAoB,WAAW,CAAC,mBAAmB,EAAE;SACtD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,OAAO,UAAU,CAAC,IAAI,EAAE;YACtB,iBAAiB,EAAE;gBACjB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC1B,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,QAAQ,EAAE,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;oBAC1C,cAAc,EAAE,IAAI,CAAC,cAAc;iBACpC,CAAC,CAAC;aACJ;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAc,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;IACpE,MAAM,CAAC,YAAY,CACjB,+BAA+B,EAC/B;QACE,KAAK,EAAE,+CAA+C;QACtD,WAAW,EACT,oLAAoL;QACtL,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iFAAiF,CAAC;SAC/G;KACF,EACD,WAAW,CAAC,IAAI,EAAE,+BAA+B,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAExC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;YACvD,MAAM,IAAI,GAAG;gBACX,OAAO,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,SAAS,EAAE;gBAC3E,SAAS,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,SAAS,CAAC,aAAa,GAAG;gBACtF,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ;gBACrF,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;gBACxC,OAAO,SAAS,CAAC,KAAK,EAAE;aACzB,CAAC;YACF,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,sEAAsE;QACtE,sEAAsE;QACtE,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,SAAS,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAEjE,MAAM,IAAI,GAAG;YACX,KAAK,IAAI,CAAC,KAAK,EAAE;YACjB,EAAE;YACF,IAAI,CAAC,OAAO;YACZ,EAAE;YACF,iBAAiB,IAAI,CAAC,OAAO,EAAE;YAC/B,kBAAkB,IAAI,CAAC,SAAS,mBAAmB,IAAI,CAAC,OAAO,uBAAuB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;YACtH,EAAE;YACF,aAAa;YACb,eAAe,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE;YACjD,eAAe,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE;YACpD,IAAI,CAAC,+BAA+B;gBAClC,CAAC,CAAC,mGAAmG;gBACrG,CAAC,CAAC,EAAE;YACN,EAAE;YACF,eAAe;YACf,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YACzB,EAAE;YACF,gBAAgB;YAChB,gBAAgB,SAAS,CAAC,YAAY,EAAE;YACxC,gCAAgC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACrE,sEAAsE;YACtE,kEAAkE;YAClE,iBACE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC;gBAC1C,CAAC,CAAC,mNAAmN;gBACrN,CAAC,CAAC,wBAAwB,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,eAC3G,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE;YAChC,SAAS,CAAC,QAAQ;YAClB,EAAE;YACF,aAAa;YACb,gBAAgB,IAAI,CAAC,QAAQ,CAAC,YAAY,SAAS,IAAI,CAAC,QAAQ,CAAC,YAAY,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE;YAC/G,IAAI,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,8DAA8D;oBAC9D,+DAA+D;oBAC/D,mEAAmE;oBACnE,QAAQ;oBACR,mBAAmB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,+BAA+B;YAClI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAC1G,EAAE;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YACzG,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBACzB,CAAC,CAAC;oBACE,+BAA+B;oBAC/B,IAAI,CAAC,WAAW;yBACb,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,qBAAqB,KAAK,CAAC,QAAQ,EAAE,CAAC;yBAC1F,IAAI,CAAC,MAAM,CAAC;iBAChB,CAAC,IAAI,CAAC,IAAI,CAAC;gBACd,CAAC,CAAC,EAAE;YACN,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;SACxB;aACE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;aAC7B,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,UAAU,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAc,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;IAC5D,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,4CAA4C;QACnD,WAAW,EACT,0MAA0M;QAC5M,WAAW,EAAE;YACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wDAAwD,CAAC;YAC3F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YACrF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SACrG;KACF,EACD,WAAW,CAAC,IAAI,EAAE,sBAAsB,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAE7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,UAAU,CACf,mDAAmD,KAAK,4BAA4B,IAAI,CAAC,MAAM;iBAC5F,SAAS,EAAE;iBACX,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;iBAC1C,IAAI,CACH,IAAI,CACL,oGAAoG,EACvG,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG;YACX,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,KAAK,IAAI;YACtD,EAAE;YACF,OAAO;iBACJ,GAAG,CACF,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAChB,MAAM,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa,MAAM,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,GAAG,WAAW,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,MAAM,CAAC,OAAO,EAAE,CAClJ;iBACA,IAAI,CAAC,MAAM,CAAC;YACf,EAAE;YACF,oDAAoD;SACrD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,OAAO,UAAU,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAc,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;IAC/D,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EACT,0GAA0G;QAC5G,WAAW,EAAE;YACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YACzE,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,sEAAsE,CAAC;SACpF;KACF,EACD,WAAW,CAAC,IAAI,EAAE,0BAA0B,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE;QACrE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE;gBACnC,iBAAiB,EAAE;oBACjB,KAAK;oBACL,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK;oBAC9B,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS;oBACtC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO;oBAClC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;iBAChG;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE7C,OAAO,UAAU,CACf,KAAK,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,OAAO,CAAC,KAAK,OAAO,OAAO,CAAC,IAAI,eAAe,QAAQ,CAAC,QAAQ,CAAC,SAAS,aAAa,QAAQ,CAAC,QAAQ,CAAC,OAAO,GAAG,EACrJ,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CACxG,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAc,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,CAAC,YAAY,CACjB,gCAAgC,EAChC;QACE,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,gKAAgK;QAClK,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YAChE,KAAK,EAAE,CAAC;iBACL,IAAI,CAAC,CAAC,iBAAiB,EAAE,wBAAwB,EAAE,cAAc,CAAC,CAAC;iBACnE,QAAQ,CACP,6HAA6H,CAC9H;SACJ;KACF,EACD,WAAW,CAAC,IAAI,EAAE,gCAAgC,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACtE,MAAM,IAAI,GACR,KAAK,KAAK,wBAAwB,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAEzG,MAAM,IAAI,GAAG;YACX,KAAK,KAAK,OAAO,IAAI,KAAK;YAC1B,EAAE;YACF,IAAI,CAAC,OAAO;YACZ,EAAE;YACF,YAAY,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mDAAmD,EAAE;YACvG,EAAE;YACF,eAAe,IAAI,CAAC,MAAM,EAAE;YAC5B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;SACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,OAAO,UAAU,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/tools/onboarding-checklist.d.ts

@@ -0,0 +1,3 @@
+import type { Registrar } from '../registry.js';
+export declare const registerOnboardingChecklist: Registrar;
+//# sourceMappingURL=onboarding-checklist.d.ts.map

package/dist/tools/onboarding-checklist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-checklist.d.ts","sourceRoot":"","sources":["../../src/tools/onboarding-checklist.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AA6FhD,eAAO,MAAM,2BAA2B,EAAE,SAwEzC,CAAC"}