@atbas/m-mcp 0.1.0

package/dist/validation/rules/constants.d.ts

@@ -0,0 +1,9 @@
+import { type ValidationRule } from '../types.js';
+/**
+ * Constant parameters must not be modified.
+ *
+ * "Mandatory constant parameters (such as pp_Language, pp_TxnCurrency,
+ * pp_TxnType and pp_Version) must not be modified."
+ */
+export declare const constantsRule: ValidationRule;
+//# sourceMappingURL=constants.d.ts.map

package/dist/validation/rules/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/validation/rules/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,cAyB3B,CAAC"}

package/dist/validation/rules/constants.js

@@ -0,0 +1,28 @@
+import { issue } from '../types.js';
+/**
+ * Constant parameters must not be modified.
+ *
+ * "Mandatory constant parameters (such as pp_Language, pp_TxnCurrency,
+ * pp_TxnType and pp_Version) must not be modified."
+ */
+export const constantsRule = (context) => {
+    const issues = [];
+    for (const parameter of context.flow.parameters) {
+        if (parameter.valueType !== 'constant' || parameter.constantValue === undefined) {
+            continue;
+        }
+        const value = context.parameters[parameter.name];
+        if (value === undefined || value === parameter.constantValue) {
+            continue;
+        }
+        issues.push(issue(context, {
+            code: 'constants.modified',
+            severity: 'error',
+            field: parameter.name,
+            message: `${parameter.name} is "${value}" but ${context.flow.title} fixes it at "${parameter.constantValue}".`,
+            fix: `Set "${parameter.name}" to "${parameter.constantValue}". ${parameter.notes}`,
+        }));
+    }
+    return issues;
+};
+//# sourceMappingURL=constants.js.map

package/dist/validation/rules/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/validation/rules/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAA6C,MAAM,aAAa,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAmB,CAAC,OAAO,EAA8B,EAAE;IACnF,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,SAAS,CAAC,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAChF,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,CAAC,aAAa,EAAE,CAAC;YAC7D,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,QAAQ,KAAK,SAAS,OAAO,CAAC,IAAI,CAAC,KAAK,iBAAiB,SAAS,CAAC,aAAa,IAAI;YAC9G,GAAG,EAAE,QAAQ,SAAS,CAAC,IAAI,SAAS,SAAS,CAAC,aAAa,MAAM,SAAS,CAAC,KAAK,EAAE;SACnF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/validation/rules/constraints.d.ts

@@ -0,0 +1,3 @@
+import { type ValidationRule } from '../types.js';
+export declare const constraintsRule: ValidationRule;
+//# sourceMappingURL=constraints.d.ts.map

package/dist/validation/rules/constraints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constraints.d.ts","sourceRoot":"","sources":["../../../src/validation/rules/constraints.ts"],"names":[],"mappings":"AACA,OAAO,EAAiD,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAwFjG,eAAO,MAAM,eAAe,EAAE,cAsC7B,CAAC"}

package/dist/validation/rules/constraints.js

@@ -0,0 +1,113 @@
+import { issue } from '../types.js';
+/**
+ * The `maxLength` and `pattern` a flow declares are enforced generically.
+ *
+ * The catalogue is the contract between the corpus and the code, so a correction
+ * from JazzCash must be a data change rather than a code change. Without this
+ * rule the declared constraints are decorative: the 20-character reference limit
+ * would hold only because `domain/txn-ref.ts` hard-codes it, and a `pattern`
+ * added to a flow file would be silently ignored.
+ *
+ * Ordered last in the rule set, because it is the fallback: a value type with a
+ * dedicated rule gets that rule's specific diagnosis first, and this one only
+ * reports the constraints no dedicated rule expresses.
+ */
+/**
+ * Value types whose own rule already enforces the declared length.
+ *
+ * `txn-ref` and `request-id` are length-checked against `parameter.maxLength` by
+ * the reference rule, which can also name the documented shape. Reporting the
+ * same violation here would give the merchant two errors for one mistake.
+ */
+const LENGTH_CHECKED_BY_REFERENCE_RULE = ['txn-ref', 'request-id'];
+function maxLengthIssue(context, parameter, value) {
+    const limit = String(parameter.maxLength);
+    return issue(context, {
+        code: 'constraints.max-length',
+        severity: 'error',
+        field: parameter.name,
+        message: `${parameter.name} is ${String(value.length)} characters; ${context.flow.title} declares a maximum of ${limit}.`,
+        fix: `Shorten ${parameter.name} to ${limit} characters or fewer. ${parameter.notes}`,
+    });
+}
+/**
+ * Report a value that does not satisfy the declared pattern.
+ *
+ * The value is echoed so the merchant can see what was rejected, except for a
+ * parameter the flow marks `sensitive`: those are credentials and personal data,
+ * and this text reaches a transcript.
+ */
+function patternIssue(context, parameter, value, pattern) {
+    const subject = parameter.sensitive
+        ? `${parameter.name} does not match the pattern`
+        : `${parameter.name} is "${value}", which does not match the pattern`;
+    return issue(context, {
+        code: 'constraints.pattern-mismatch',
+        severity: 'error',
+        field: parameter.name,
+        message: `${subject} ${context.flow.title} declares for it (${pattern}).`,
+        fix: `Send a ${parameter.name} matching ${pattern}. ${parameter.notes}`,
+    });
+}
+/**
+ * Report a declared pattern that is not a usable regular expression.
+ *
+ * This is a defect in the flow data, not in the merchant's payload, so it is a
+ * warning addressed to whoever maintains the corpus. Letting `new RegExp` throw
+ * instead would take down every call that touches the flow.
+ */
+function unusablePatternIssue(context, parameter, pattern) {
+    return issue(context, {
+        code: 'constraints.pattern-unusable',
+        severity: 'warning',
+        field: parameter.name,
+        message: `${context.flow.title} declares the pattern ${pattern} for ${parameter.name}, but it is not a valid regular expression, so the constraint was not checked.`,
+        fix: `Correct the "pattern" declared for ${parameter.name} in the flow specification, or remove it.`,
+    });
+}
+/**
+ * Compile a declared pattern, or return `undefined` when it cannot be compiled.
+ *
+ * The source string is used exactly as declared, so a flow that needs a
+ * whole-value match anchors it with `^` and `$` itself.
+ */
+function compilePattern(pattern) {
+    try {
+        return new RegExp(pattern);
+    }
+    catch {
+        return undefined;
+    }
+}
+export const constraintsRule = (context) => {
+    const issues = [];
+    for (const parameter of context.flow.parameters) {
+        const value = context.parameters[parameter.name];
+        // An absent or empty value is the presence rule's diagnosis. A constraint
+        // describes the shape of a value, not whether one is required.
+        if (value === undefined || value === '') {
+            continue;
+        }
+        if (parameter.maxLength !== undefined &&
+            value.length > parameter.maxLength &&
+            !LENGTH_CHECKED_BY_REFERENCE_RULE.includes(parameter.valueType)) {
+            issues.push(maxLengthIssue(context, parameter, value));
+        }
+        if (parameter.pattern === undefined) {
+            continue;
+        }
+        // Compiled once per declared pattern, per validation, rather than cached
+        // across calls: a module-level cache would be shared mutable state in
+        // exchange for microseconds on a payload of at most two dozen fields.
+        const expression = compilePattern(parameter.pattern);
+        if (expression === undefined) {
+            issues.push(unusablePatternIssue(context, parameter, parameter.pattern));
+            continue;
+        }
+        if (!expression.test(value)) {
+            issues.push(patternIssue(context, parameter, value, parameter.pattern));
+        }
+    }
+    return issues;
+};
+//# sourceMappingURL=constraints.js.map

package/dist/validation/rules/constraints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constraints.js","sourceRoot":"","sources":["../../../src/validation/rules/constraints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAA+D,MAAM,aAAa,CAAC;AAEjG;;;;;;;;;;;;GAYG;AAEH;;;;;;GAMG;AACH,MAAM,gCAAgC,GAAyB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AAEzF,SAAS,cAAc,CAAC,OAAoB,EAAE,SAAwB,EAAE,KAAa;IACnF,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,OAAO,EAAE;QACpB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,SAAS,CAAC,IAAI;QACrB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,OAAO,CAAC,IAAI,CAAC,KAAK,0BAA0B,KAAK,GAAG;QACzH,GAAG,EAAE,WAAW,SAAS,CAAC,IAAI,OAAO,KAAK,yBAAyB,SAAS,CAAC,KAAK,EAAE;KACrF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,OAAoB,EAAE,SAAwB,EAAE,KAAa,EAAE,OAAe;IAClG,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS;QACjC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,6BAA6B;QAChD,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,QAAQ,KAAK,qCAAqC,CAAC;IAExE,OAAO,KAAK,CAAC,OAAO,EAAE;QACpB,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,SAAS,CAAC,IAAI;QACrB,OAAO,EAAE,GAAG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,qBAAqB,OAAO,IAAI;QACzE,GAAG,EAAE,UAAU,SAAS,CAAC,IAAI,aAAa,OAAO,KAAK,SAAS,CAAC,KAAK,EAAE;KACxE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,OAAoB,EAAE,SAAwB,EAAE,OAAe;IAC3F,OAAO,KAAK,CAAC,OAAO,EAAE;QACpB,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,SAAS,CAAC,IAAI;QACrB,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,yBAAyB,OAAO,QAAQ,SAAS,CAAC,IAAI,gFAAgF;QACpK,GAAG,EAAE,sCAAsC,SAAS,CAAC,IAAI,2CAA2C;KACrG,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAmB,CAAC,OAAO,EAA8B,EAAE;IACrF,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAEjD,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,IACE,SAAS,CAAC,SAAS,KAAK,SAAS;YACjC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,SAAS;YAClC,CAAC,gCAAgC,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAC/D,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/validation/rules/datetime.d.ts

@@ -0,0 +1,3 @@
+import { type ValidationRule } from '../types.js';
+export declare const dateTimeRule: ValidationRule;
+//# sourceMappingURL=datetime.d.ts.map

package/dist/validation/rules/datetime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"datetime.d.ts","sourceRoot":"","sources":["../../../src/validation/rules/datetime.ts"],"names":[],"mappings":"AACA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAa/E,eAAO,MAAM,YAAY,EAAE,cA8C1B,CAAC"}

package/dist/validation/rules/datetime.js

@@ -0,0 +1,49 @@
+import { formatTxnDateTime, isValidTxnDateTime, daysBetweenTxnDateTimes } from '../../domain/datetime.js';
+import { issue } from '../types.js';
+/**
+ * Timestamp format and plausibility.
+ *
+ * Format errors are hard failures. A stamp that is far from the current
+ * Pakistan time is only a warning: a merchant may legitimately be replaying a
+ * historical payload while debugging, and refusing that would be unhelpful.
+ */
+/** Days either side of now beyond which a transaction stamp looks like a clock error. */
+const PLAUSIBLE_WINDOW_DAYS = 2;
+export const dateTimeRule = (context) => {
+    const issues = [];
+    const nowStamp = formatTxnDateTime(context.now);
+    for (const parameter of context.flow.parameters) {
+        if (parameter.valueType !== 'pkt-datetime' && parameter.valueType !== 'pkt-expiry') {
+            continue;
+        }
+        const value = context.parameters[parameter.name];
+        if (value === undefined || value === '') {
+            continue;
+        }
+        if (!isValidTxnDateTime(value)) {
+            issues.push(issue(context, {
+                code: 'datetime.invalid-format',
+                severity: 'error',
+                field: parameter.name,
+                message: `${parameter.name} is "${value}", which is not a valid YYYYMMDDHHMMSS timestamp.`,
+                fix: `Format the value as 14 digits in Pakistan Standard Time, for example "${nowStamp}". In PHP, call date_default_timezone_set("Asia/Karachi") first.`,
+            }));
+            continue;
+        }
+        if (parameter.valueType !== 'pkt-datetime') {
+            continue;
+        }
+        const drift = daysBetweenTxnDateTimes(nowStamp, value);
+        if (Math.abs(drift) > PLAUSIBLE_WINDOW_DAYS) {
+            issues.push(issue(context, {
+                code: 'datetime.implausible',
+                severity: 'warning',
+                field: parameter.name,
+                message: `${parameter.name} is "${value}", which is ${Math.abs(drift).toFixed(1)} days ${drift > 0 ? 'in the future' : 'in the past'} relative to the current Pakistan time (${nowStamp}).`,
+                fix: 'Confirm the server clock and that the timestamp is generated in Asia/Karachi rather than in the host time zone.',
+            }));
+        }
+    }
+    return issues;
+};
+//# sourceMappingURL=datetime.js.map

package/dist/validation/rules/datetime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"datetime.js","sourceRoot":"","sources":["../../../src/validation/rules/datetime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAC1G,OAAO,EAAE,KAAK,EAA6C,MAAM,aAAa,CAAC;AAE/E;;;;;;GAMG;AAEH,yFAAyF;AACzF,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,MAAM,CAAC,MAAM,YAAY,GAAmB,CAAC,OAAO,EAA8B,EAAE;IAClF,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEhD,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,SAAS,CAAC,SAAS,KAAK,cAAc,IAAI,SAAS,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;YACnF,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,OAAO,EAAE;gBACb,IAAI,EAAE,yBAAyB;gBAC/B,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,SAAS,CAAC,IAAI;gBACrB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,QAAQ,KAAK,mDAAmD;gBAC1F,GAAG,EAAE,yEAAyE,QAAQ,kEAAkE;aACzJ,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;YAC3C,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,qBAAqB,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,OAAO,EAAE;gBACb,IAAI,EAAE,sBAAsB;gBAC5B,QAAQ,EAAE,SAAS;gBACnB,KAAK,EAAE,SAAS,CAAC,IAAI;gBACrB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,QAAQ,KAAK,eAAe,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,2CAA2C,QAAQ,IAAI;gBAC3L,GAAG,EAAE,iHAAiH;aACvH,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/validation/rules/empty-string.d.ts

@@ -0,0 +1,13 @@
+import { type ValidationRule } from '../types.js';
+/**
+ * Unused parameters must be exactly `""`.
+ *
+ * "Parameters with no value must remain as empty strings. Do not replace them
+ * with null and do not remove them from the request."
+ *
+ * A JSON `null` is the common mistake here. It also changes the secure hash,
+ * because a null stringifies differently from an empty string, so the merchant
+ * sees a hash mismatch rather than a field error.
+ */
+export declare const emptyStringRule: ValidationRule;
+//# sourceMappingURL=empty-string.d.ts.map

package/dist/validation/rules/empty-string.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"empty-string.d.ts","sourceRoot":"","sources":["../../../src/validation/rules/empty-string.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAE/E;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,cAyB7B,CAAC"}

package/dist/validation/rules/empty-string.js

@@ -0,0 +1,32 @@
+import { issue } from '../types.js';
+/**
+ * Unused parameters must be exactly `""`.
+ *
+ * "Parameters with no value must remain as empty strings. Do not replace them
+ * with null and do not remove them from the request."
+ *
+ * A JSON `null` is the common mistake here. It also changes the secure hash,
+ * because a null stringifies differently from an empty string, so the merchant
+ * sees a hash mismatch rather than a field error.
+ */
+export const emptyStringRule = (context) => {
+    const issues = [];
+    for (const parameter of context.flow.parameters) {
+        if (parameter.requirement !== 'must-be-empty') {
+            continue;
+        }
+        const value = context.parameters[parameter.name];
+        if (value === undefined || value === '') {
+            continue;
+        }
+        issues.push(issue(context, {
+            code: 'empty-string.unexpected-value',
+            severity: 'error',
+            field: parameter.name,
+            message: `${parameter.name} carries the value "${value}", but ${context.flow.title} requires it to be sent as an empty string.`,
+            fix: `Set "${parameter.name}" to "". Because a non-empty value participates in the secure hash, leaving it populated also causes a hash mismatch.`,
+        }));
+    }
+    return issues;
+};
+//# sourceMappingURL=empty-string.js.map

package/dist/validation/rules/empty-string.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"empty-string.js","sourceRoot":"","sources":["../../../src/validation/rules/empty-string.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAA6C,MAAM,aAAa,CAAC;AAE/E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmB,CAAC,OAAO,EAA8B,EAAE;IACrF,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,SAAS,CAAC,WAAW,KAAK,eAAe,EAAE,CAAC;YAC9C,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,uBAAuB,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,KAAK,6CAA6C;YAC/H,GAAG,EAAE,QAAQ,SAAS,CAAC,IAAI,uHAAuH;SACnJ,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/validation/rules/expiry.d.ts

@@ -0,0 +1,3 @@
+import { type ValidationRule } from '../types.js';
+export declare const expiryRule: ValidationRule;
+//# sourceMappingURL=expiry.d.ts.map

package/dist/validation/rules/expiry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expiry.d.ts","sourceRoot":"","sources":["../../../src/validation/rules/expiry.ts"],"names":[],"mappings":"AACA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAa/E,eAAO,MAAM,UAAU,EAAE,cA+CxB,CAAC"}

package/dist/validation/rules/expiry.js

@@ -0,0 +1,52 @@
+import { daysBetweenTxnDateTimes, isExpiryAfterTransaction, isValidTxnDateTime } from '../../domain/datetime.js';
+import { issue } from '../types.js';
+/**
+ * `pp_TxnExpiryDateTime` must follow `pp_TxnDateTime` by about one day.
+ *
+ * "Must be set to one day after the transaction date." An expiry that precedes
+ * the transaction is an error; a materially different window is a warning,
+ * since the guides state the rule without stating a tolerance.
+ */
+const EXPECTED_WINDOW_DAYS = 1;
+const WINDOW_TOLERANCE_DAYS = 0.5;
+export const expiryRule = (context) => {
+    const transactionField = context.flow.parameters.find((entry) => entry.valueType === 'pkt-datetime');
+    const expiryField = context.flow.parameters.find((entry) => entry.valueType === 'pkt-expiry');
+    if (transactionField === undefined || expiryField === undefined) {
+        return [];
+    }
+    const transaction = context.parameters[transactionField.name];
+    const expiry = context.parameters[expiryField.name];
+    // Format problems are the datetime rule's responsibility.
+    if (transaction === undefined ||
+        expiry === undefined ||
+        !isValidTxnDateTime(transaction) ||
+        !isValidTxnDateTime(expiry)) {
+        return [];
+    }
+    if (!isExpiryAfterTransaction(transaction, expiry)) {
+        return [
+            issue(context, {
+                code: 'expiry.not-after-transaction',
+                severity: 'error',
+                field: expiryField.name,
+                message: `${expiryField.name} ("${expiry}") is not after ${transactionField.name} ("${transaction}"). The transaction would be expired before it began.`,
+                fix: `Set ${expiryField.name} to one day after ${transactionField.name}. In PHP: date('YmdHis', strtotime('+1 Days')).`,
+            }),
+        ];
+    }
+    const window = daysBetweenTxnDateTimes(transaction, expiry);
+    if (Math.abs(window - EXPECTED_WINDOW_DAYS) > WINDOW_TOLERANCE_DAYS) {
+        return [
+            issue(context, {
+                code: 'expiry.unexpected-window',
+                severity: 'warning',
+                field: expiryField.name,
+                message: `${expiryField.name} is ${window.toFixed(2)} days after ${transactionField.name}. The guides specify one day.`,
+                fix: `Set ${expiryField.name} to exactly one day after ${transactionField.name} unless JazzCash has approved a different window for your account.`,
+            }),
+        ];
+    }
+    return [];
+};
+//# sourceMappingURL=expiry.js.map

package/dist/validation/rules/expiry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expiry.js","sourceRoot":"","sources":["../../../src/validation/rules/expiry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACjH,OAAO,EAAE,KAAK,EAA6C,MAAM,aAAa,CAAC;AAE/E;;;;;;GAMG;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,MAAM,CAAC,MAAM,UAAU,GAAmB,CAAC,OAAO,EAA8B,EAAE;IAChF,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC;IACrG,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC;IAE9F,IAAI,gBAAgB,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAEpD,0DAA0D;IAC1D,IACE,WAAW,KAAK,SAAS;QACzB,MAAM,KAAK,SAAS;QACpB,CAAC,kBAAkB,CAAC,WAAW,CAAC;QAChC,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAC3B,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,KAAK,CAAC,OAAO,EAAE;gBACb,IAAI,EAAE,8BAA8B;gBACpC,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,WAAW,CAAC,IAAI;gBACvB,OAAO,EAAE,GAAG,WAAW,CAAC,IAAI,MAAM,MAAM,mBAAmB,gBAAgB,CAAC,IAAI,MAAM,WAAW,uDAAuD;gBACxJ,GAAG,EAAE,OAAO,WAAW,CAAC,IAAI,qBAAqB,gBAAgB,CAAC,IAAI,iDAAiD;aACxH,CAAC;SACH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,oBAAoB,CAAC,GAAG,qBAAqB,EAAE,CAAC;QACpE,OAAO;YACL,KAAK,CAAC,OAAO,EAAE;gBACb,IAAI,EAAE,0BAA0B;gBAChC,QAAQ,EAAE,SAAS;gBACnB,KAAK,EAAE,WAAW,CAAC,IAAI;gBACvB,OAAO,EAAE,GAAG,WAAW,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,gBAAgB,CAAC,IAAI,+BAA+B;gBACvH,GAAG,EAAE,OAAO,WAAW,CAAC,IAAI,6BAA6B,gBAAgB,CAAC,IAAI,oEAAoE;aACnJ,CAAC;SACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC"}

package/dist/validation/rules/msisdn.d.ts

@@ -0,0 +1,3 @@
+import { type ValidationRule } from '../types.js';
+export declare const msisdnRule: ValidationRule;
+//# sourceMappingURL=msisdn.d.ts.map

package/dist/validation/rules/msisdn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"msisdn.d.ts","sourceRoot":"","sources":["../../../src/validation/rules/msisdn.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAc/E,eAAO,MAAM,UAAU,EAAE,cA0CxB,CAAC"}

package/dist/validation/rules/msisdn.js

@@ -0,0 +1,45 @@
+import { issue } from '../types.js';
+/**
+ * Mobile wallet numbers.
+ *
+ * Every sample in the corpus uses the local 11-digit form beginning `03`, for
+ * example `03123456789` and `03002874299`. An international form is accepted
+ * with a warning rather than an error: no guide forbids it, but nothing in the
+ * corpus demonstrates it working either.
+ */
+const LOCAL_FORMAT = /^03\d{9}$/;
+const INTERNATIONAL_FORMAT = /^(?:\+?92)3\d{9}$/;
+export const msisdnRule = (context) => {
+    const issues = [];
+    for (const parameter of context.flow.parameters) {
+        if (parameter.valueType !== 'msisdn') {
+            continue;
+        }
+        const value = context.parameters[parameter.name];
+        if (value === undefined || value === '') {
+            continue;
+        }
+        if (LOCAL_FORMAT.test(value)) {
+            continue;
+        }
+        if (INTERNATIONAL_FORMAT.test(value)) {
+            issues.push(issue(context, {
+                code: 'msisdn.international-format',
+                severity: 'warning',
+                field: parameter.name,
+                message: `${parameter.name} uses an international format. Every documented sample uses the local 11-digit form.`,
+                fix: `Send the number as 03XXXXXXXXX, for example "${value.replace(/^\+?92/, '0')}".`,
+            }));
+            continue;
+        }
+        issues.push(issue(context, {
+            code: 'msisdn.invalid',
+            severity: 'error',
+            field: parameter.name,
+            message: `${parameter.name} is "${value}", which is not a Pakistani mobile number in the documented format.`,
+            fix: 'Send 11 digits beginning 03, for example "03123456789". Remove spaces, dashes and country codes.',
+        }));
+    }
+    return issues;
+};
+//# sourceMappingURL=msisdn.js.map

package/dist/validation/rules/msisdn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msisdn.js","sourceRoot":"","sources":["../../../src/validation/rules/msisdn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAA6C,MAAM,aAAa,CAAC;AAE/E;;;;;;;GAOG;AAEH,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEjD,MAAM,CAAC,MAAM,UAAU,GAAmB,CAAC,OAAO,EAA8B,EAAE;IAChF,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,SAAS,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACrC,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,SAAS;QACX,CAAC;QAED,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,OAAO,EAAE;gBACb,IAAI,EAAE,6BAA6B;gBACnC,QAAQ,EAAE,SAAS;gBACnB,KAAK,EAAE,SAAS,CAAC,IAAI;gBACrB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,sFAAsF;gBAChH,GAAG,EAAE,gDAAgD,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI;aACtF,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,QAAQ,KAAK,qEAAqE;YAC5G,GAAG,EAAE,kGAAkG;SACxG,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/validation/rules/presence.d.ts

@@ -0,0 +1,3 @@
+import { type ValidationRule } from '../types.js';
+export declare const presenceRule: ValidationRule;
+//# sourceMappingURL=presence.d.ts.map

package/dist/validation/rules/presence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presence.d.ts","sourceRoot":"","sources":["../../../src/validation/rules/presence.ts"],"names":[],"mappings":"AACA,OAAO,EAAiD,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAiDjG,eAAO,MAAM,YAAY,EAAE,cAoD1B,CAAC"}

package/dist/validation/rules/presence.js

@@ -0,0 +1,90 @@
+import { issue } from '../types.js';
+/**
+ * Every declared parameter must be present, and a mandatory one must carry a value.
+ *
+ * "Keep all mandatory parameters in every request" and "No parameters may be
+ * added or removed from the request payload" — the guides are explicit that a
+ * field which is unused must still be transmitted, as an empty string.
+ *
+ * Presence alone is not enough to trust a payload. `normaliseParameters`
+ * collapses `null` and `undefined` to `''`, and every value rule defers an empty
+ * value back to this rule, so a payload whose mandatory fields are all blank
+ * would otherwise be reported as valid — losing the reject-before-send guard and
+ * telling the merchant an empty payload is correct.
+ */
+function missingIssue(context, parameter) {
+    return issue(context, {
+        code: 'presence.missing',
+        severity: 'error',
+        field: parameter.name,
+        message: `${parameter.name} is missing from the payload. ${context.flow.title} declares it as ${parameter.requirement}.`,
+        fix: parameter.requirement === 'must-be-empty'
+            ? `Add "${parameter.name}": "" to the payload. Unused parameters must still be sent, as empty strings.`
+            : `Add "${parameter.name}" to the payload. ${parameter.notes}`,
+    });
+}
+function suppliedElsewhereIssue(context, parameter) {
+    return issue(context, {
+        code: 'presence.supplied-elsewhere',
+        severity: 'warning',
+        field: parameter.name,
+        message: `${parameter.name} is mandatory for ${context.flow.title} and is absent here, which is correct: the flow declares it as data that cannot cross the tool boundary. The payload is therefore incomplete as it stands, and the gateway will reject it until that field is added on the route that does carry it.`,
+        fix: `Add "${parameter.name}" in the integration code that runs on your own server — jazzcash_generate_integration_code emits it — or let the provider's hosted page or hosted fields send it straight from the customer's browser to the gateway. Never supply it through this server.`,
+    });
+}
+function emptyIssue(context, parameter) {
+    return issue(context, {
+        code: 'presence.empty',
+        severity: 'error',
+        field: parameter.name,
+        message: `${parameter.name} is present but empty, and ${context.flow.title} declares it as mandatory. An empty value is excluded from the secure hash, so the gateway receives neither the field nor its contribution to pp_SecureHash.`,
+        fix: `Supply a value for "${parameter.name}". ${parameter.notes}`,
+    });
+}
+export const presenceRule = (context) => {
+    const issues = [];
+    for (const parameter of context.flow.parameters) {
+        // The secure hash is added after validation, so both its absence and its
+        // emptiness are expected when validating a payload that is not yet signed.
+        if (parameter.valueType === 'secure-hash') {
+            continue;
+        }
+        // A parameter the flow forbids as a tool argument reaches the gateway by
+        // another route — a hosted field, or the merchant's own server — so its
+        // absence here is correct, and reporting it as an error would tell the
+        // merchant to paste a PAN into the conversation, which is what the flag
+        // exists to stop. Saying nothing at all is the other failure: a card payload
+        // with no PAN, no CVV and no expiry would be certified "valid, no issues
+        // found", which is a statement about a payload no gateway would accept. So
+        // the field is named — never its value, exactly as the tool-boundary
+        // refusal names one — as a warning, which leaves `valid` true and the
+        // builder working while recording that the payload is not yet complete.
+        if (parameter.neverAcceptAsToolArgument) {
+            // A value that did arrive is the `tool-argument.forbidden` rule's
+            // diagnosis, and repeating it here would report one mistake twice.
+            const supplied = context.parameters[parameter.name];
+            if (parameter.requirement === 'mandatory' && (supplied === undefined || supplied === '')) {
+                issues.push(suppliedElsewhereIssue(context, parameter));
+            }
+            continue;
+        }
+        // Normalisation writes a string for every supplied key, so an undefined
+        // lookup means the key itself is absent rather than blank.
+        const value = context.parameters[parameter.name];
+        if (value === undefined) {
+            issues.push(missingIssue(context, parameter));
+            continue;
+        }
+        if (value !== '' || parameter.requirement !== 'mandatory') {
+            continue;
+        }
+        // An empty constant is the constants rule's diagnosis: it can name the value
+        // the flow fixes the field at, which is more use than "supply a value".
+        if (parameter.valueType === 'constant') {
+            continue;
+        }
+        issues.push(emptyIssue(context, parameter));
+    }
+    return issues;
+};
+//# sourceMappingURL=presence.js.map

package/dist/validation/rules/presence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presence.js","sourceRoot":"","sources":["../../../src/validation/rules/presence.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAA+D,MAAM,aAAa,CAAC;AAEjG;;;;;;;;;;;;GAYG;AAEH,SAAS,YAAY,CAAC,OAAoB,EAAE,SAAwB;IAClE,OAAO,KAAK,CAAC,OAAO,EAAE;QACpB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,SAAS,CAAC,IAAI;QACrB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,iCAAiC,OAAO,CAAC,IAAI,CAAC,KAAK,mBAAmB,SAAS,CAAC,WAAW,GAAG;QACxH,GAAG,EACD,SAAS,CAAC,WAAW,KAAK,eAAe;YACvC,CAAC,CAAC,QAAQ,SAAS,CAAC,IAAI,+EAA+E;YACvG,CAAC,CAAC,QAAQ,SAAS,CAAC,IAAI,qBAAqB,SAAS,CAAC,KAAK,EAAE;KACnE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAoB,EAAE,SAAwB;IAC5E,OAAO,KAAK,CAAC,OAAO,EAAE;QACpB,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,SAAS,CAAC,IAAI;QACrB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,qBAAqB,OAAO,CAAC,IAAI,CAAC,KAAK,sPAAsP;QACvT,GAAG,EAAE,QAAQ,SAAS,CAAC,IAAI,6PAA6P;KACzR,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,OAAoB,EAAE,SAAwB;IAChE,OAAO,KAAK,CAAC,OAAO,EAAE;QACpB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,SAAS,CAAC,IAAI;QACrB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,8BAA8B,OAAO,CAAC,IAAI,CAAC,KAAK,8JAA8J;QACxO,GAAG,EAAE,uBAAuB,SAAS,CAAC,IAAI,MAAM,SAAS,CAAC,KAAK,EAAE;KAClE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAmB,CAAC,OAAO,EAA8B,EAAE;IAClF,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,SAAS,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,6EAA6E;QAC7E,yEAAyE;QACzE,2EAA2E;QAC3E,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,SAAS,CAAC,yBAAyB,EAAE,CAAC;YACxC,kEAAkE;YAClE,mEAAmE;YACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,SAAS,CAAC,WAAW,KAAK,WAAW,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,CAAC,EAAE,CAAC;gBACzF,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,SAAS;QACX,CAAC;QAED,wEAAwE;QACxE,2DAA2D;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QAED,IAAI,KAAK,KAAK,EAAE,IAAI,SAAS,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YAC1D,SAAS;QACX,CAAC;QAED,6EAA6E;QAC7E,wEAAwE;QACxE,IAAI,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/validation/rules/return-url.d.ts

@@ -0,0 +1,14 @@
+import { type ValidationRule } from '../types.js';
+/**
+ * `pp_ReturnURL` is part of merchant authentication.
+ *
+ * "This field is mandatory and merchant must share this URL before using API as
+ * it will be a part of merchant profile. URL should always be the same in every
+ * request once shared. It is a part of merchant authentication; difference of
+ * URL will fail the validation."
+ *
+ * The failure this produces at the gateway is opaque, so a mismatch against the
+ * registered value is reported as an error whenever the registered value is known.
+ */
+export declare const returnUrlRule: ValidationRule;
+//# sourceMappingURL=return-url.d.ts.map

package/dist/validation/rules/return-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"return-url.d.ts","sourceRoot":"","sources":["../../../src/validation/rules/return-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,EAAE,cAqD3B,CAAC"}

package/dist/validation/rules/return-url.js

@@ -0,0 +1,58 @@
+import { issue } from '../types.js';
+/**
+ * `pp_ReturnURL` is part of merchant authentication.
+ *
+ * "This field is mandatory and merchant must share this URL before using API as
+ * it will be a part of merchant profile. URL should always be the same in every
+ * request once shared. It is a part of merchant authentication; difference of
+ * URL will fail the validation."
+ *
+ * The failure this produces at the gateway is opaque, so a mismatch against the
+ * registered value is reported as an error whenever the registered value is known.
+ */
+export const returnUrlRule = (context) => {
+    const parameter = context.flow.parameters.find((entry) => entry.valueType === 'url');
+    if (parameter === undefined) {
+        return [];
+    }
+    const value = context.parameters[parameter.name];
+    if (value === undefined || value === '') {
+        return [];
+    }
+    const issues = [];
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return [
+            issue(context, {
+                code: 'return-url.not-absolute',
+                severity: 'error',
+                field: parameter.name,
+                message: `${parameter.name} is "${value}", which is not an absolute URL.`,
+                fix: 'Supply the full absolute URL you registered with JazzCash, including the scheme, for example https://shop.example.pk/jazzcash/return.',
+            }),
+        ];
+    }
+    if (parsed.protocol !== 'https:') {
+        issues.push(issue(context, {
+            code: 'return-url.not-https',
+            severity: 'warning',
+            field: parameter.name,
+            message: `${parameter.name} uses ${parsed.protocol.replace(':', '')}. The payment result is posted to this URL.`,
+            fix: 'Serve the return URL over HTTPS.',
+        }));
+    }
+    if (context.registeredReturnUrl !== undefined && value !== context.registeredReturnUrl) {
+        issues.push(issue(context, {
+            code: 'return-url.does-not-match-registered',
+            severity: 'error',
+            field: parameter.name,
+            message: `${parameter.name} is "${value}" but the URL registered against this merchant profile is "${context.registeredReturnUrl}". The gateway treats any difference — including a trailing slash — as an authentication failure.`,
+            fix: `Send exactly "${context.registeredReturnUrl}", or update the registered URL under Integration > Credentials in the portal.`,
+        }));
+    }
+    return issues;
+};
+//# sourceMappingURL=return-url.js.map

package/dist/validation/rules/return-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"return-url.js","sourceRoot":"","sources":["../../../src/validation/rules/return-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAA6C,MAAM,aAAa,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAmB,CAAC,OAAO,EAA8B,EAAE;IACnF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;IACrF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,MAAuB,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,CAAC,OAAO,EAAE;gBACb,IAAI,EAAE,yBAAyB;gBAC/B,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,SAAS,CAAC,IAAI;gBACrB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,QAAQ,KAAK,kCAAkC;gBACzE,GAAG,EAAE,uIAAuI;aAC7I,CAAC;SACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAE,sBAAsB;YAC5B,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,SAAS,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,6CAA6C;YAChH,GAAG,EAAE,kCAAkC;SACxC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,IAAI,KAAK,KAAK,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAE,sCAAsC;YAC5C,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,QAAQ,KAAK,8DAA8D,OAAO,CAAC,mBAAmB,mGAAmG;YACnO,GAAG,EAAE,iBAAiB,OAAO,CAAC,mBAAmB,gFAAgF;SAClI,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/validation/rules/tool-argument.d.ts

@@ -0,0 +1,16 @@
+import { type ValidationRule } from '../types.js';
+/**
+ * A parameter the flow marks `neverAcceptAsToolArgument` must not appear at all.
+ *
+ * Card flows carry the PAN, the expiry and the CVV. `safeHandler` scrubs tool
+ * OUTPUTS, not inputs, so a value supplied here was written to the conversation
+ * transcript — and to whatever the harness persists of it — before any server
+ * code ran. By the time this rule fires the disclosure has already happened, so
+ * the issue says so plainly instead of offering a correction that would repeat
+ * it: the only safe next step is to route the value around this server and to
+ * treat the one already sent as compromised.
+ *
+ * The value is never echoed back, for the same reason.
+ */
+export declare const toolArgumentRule: ValidationRule;
+//# sourceMappingURL=tool-argument.d.ts.map