@atbas/m-mcp 0.1.0

package/dist/domain/response-codes.d.ts

@@ -0,0 +1,116 @@
+import type { FlowResponseSpec } from '../catalogue/types.js';
+import type { DocRef } from '../errors.js';
+/**
+ * Response code interpretation.
+ *
+ * The 2026 corpus documents exactly three codes and one status literal:
+ *
+ *  - `pp_ResponseCode` `000` — the API operation was performed successfully.
+ *  - `pp_PaymentResponseCode` `121` — the transaction completed and the amount
+ *    was debited.
+ *  - `199`, `999` and "others" — failed transactions (IPN guide).
+ *  - `pp_Status` `Completed`.
+ *
+ * Anything else is reported as `unknown`. Inventing a plausible meaning for an
+ * undocumented code is worse than admitting the corpus does not cover it: a
+ * merchant who is told "probably a timeout" will stop investigating.
+ */
+/**
+ * Which question a code answers.
+ *
+ * `settlement` is the acquirer's own verdict, which some providers report
+ * alongside a service-level code. It answers "did the card issuer approve
+ * this?", a different question from "was the request processed?".
+ */
+export type CodeFamily = 'api-operation' | 'payment-status' | 'settlement';
+export type CodeOutcome = 'success' | 'failure' | 'unknown';
+export interface ResponseCodeInfo {
+    readonly code: string;
+    readonly family: CodeFamily;
+    /**
+     * True when the code's meaning comes from a document rather than a guess:
+     * the 2026 JazzCash guides, or the success value a flow specification
+     * transcribes from its own provider's guide.
+     */
+    readonly documented: boolean;
+    readonly meaning: string;
+    readonly outcome: CodeOutcome;
+    readonly action: string;
+    readonly docRefs: readonly DocRef[];
+}
+export declare const API_SUCCESS_CODE = "000";
+export declare const PAYMENT_COMPLETED_CODE = "121";
+/** Failure codes named explicitly in the IPN guide. */
+export declare const DOCUMENTED_PAYMENT_FAILURE_CODES: readonly string[];
+/** Describe a `pp_ResponseCode` / `ResponseCode` value: did the API call work? */
+export declare function describeApiResponseCode(code: string): ResponseCodeInfo;
+/** Describe a `pp_PaymentResponseCode` value: did the payment succeed? */
+export declare function describePaymentResponseCode(code: string): ResponseCodeInfo;
+export type TransactionClassification = 'completed' | 'failed' | 'pending' | 'unknown';
+/**
+ * Which API produced the response.
+ *
+ * This changes what the codes mean. A direct payment API reports the payment
+ * outcome in `pp_ResponseCode`; Status Inquiry reports the API outcome there and
+ * the payment outcome in `pp_PaymentResponseCode`; an inbound IPN notification
+ * carries the payment outcome in `pp_ResponseCode`.
+ */
+export type ResponseContext = 'payment' | 'inquiry' | 'refund' | 'ipn' | 'token';
+export interface ClassifiedResponse {
+    readonly classification: TransactionClassification;
+    readonly reason: string;
+    readonly apiOperation: ResponseCodeInfo | undefined;
+    readonly paymentStatus: ResponseCodeInfo | undefined;
+    /** The acquirer's verdict, where the flow declares a settlement level. */
+    readonly settlement?: ResponseCodeInfo | undefined;
+    readonly statusLiteral: string | undefined;
+    readonly message: string | undefined;
+    readonly nextSteps: readonly string[];
+}
+/**
+ * The success rule a flow specification declares, for codes this module does
+ * not document.
+ *
+ * Derived from the catalogue's own inferred flow type rather than restated, so
+ * renaming a field in `responseSpecBase` fails this module at compile time.
+ * Hand-declaring the same three members compiled happily against a schema that
+ * no longer produced them, which turns a rename into a runtime surprise on the
+ * path that decides whether a card was approved.
+ *
+ * It is the `response` section of a flow, so a caller passes `flow.response` and
+ * cannot assemble a contract from one flow's field name and another's success
+ * value. The codes themselves are compared literally: this module holds no table
+ * for a provider whose guides it has not transcribed, and a guessed meaning is
+ * worse than an admitted gap.
+ */
+export type ResponseSuccessContract = Pick<FlowResponseSpec, 'successField' | 'successValue' | 'settlement'>;
+/**
+ * The acquirer level of a two-level success rule.
+ *
+ * A gateway that answers a card sale at two levels reports first that it
+ * accepted and processed the request, and separately whether the card issuer
+ * approved it. The second answer is the one that says whether money moved.
+ */
+export type SettlementContract = NonNullable<ResponseSuccessContract['settlement']>;
+/**
+ * Classify a gateway response into a single actionable outcome.
+ *
+ * `contract` is the flow's own `response` section. Supplied, it names the field
+ * carrying the outcome and, where the provider answers at two levels, the
+ * acquirer field that says whether the card was actually approved. Passed as
+ * `undefined` — as it is for an inbound IPN, which arrives without a flow — the
+ * JazzCash tables above are used, which is what this server shipped with.
+ *
+ * Required rather than optional, and that is the point. While it was optional,
+ * two of the three call sites simply left it off: one of them had `flow` in
+ * scope on the same line. Both then reported a DECLINED card as a service-level
+ * success, because the settlement veto is carried by the contract. A call site
+ * that genuinely has no flow must now say so in writing.
+ *
+ * A contract naming one of the documented JazzCash success fields still takes
+ * the documented path: those codes have meanings, a pending state and a
+ * separate payment code, and a literal comparison against `000` would throw all
+ * of that away.
+ */
+export declare function classifyResponse(response: Readonly<Record<string, unknown>>, context: ResponseContext, contract: ResponseSuccessContract | undefined): ClassifiedResponse;
+//# sourceMappingURL=response-codes.d.ts.map

package/dist/domain/response-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-codes.d.ts","sourceRoot":"","sources":["../../src/domain/response-codes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C;;;;;;;;;;;;;;GAcG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,gBAAgB,GAAG,YAAY,CAAC;AAE3E,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE5D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,eAAO,MAAM,gBAAgB,QAAQ,CAAC;AAEtC,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAE5C,uDAAuD;AACvD,eAAO,MAAM,gCAAgC,EAAE,SAAS,MAAM,EAAmB,CAAC;AAkBlF,kFAAkF;AAClF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CActE;AAED,0EAA0E;AAC1E,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAyB1E;AAMD,MAAM,MAAM,yBAAyB,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAEvF;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC;AAEjF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,aAAa,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACrD,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAyMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,gBAAgB,EAAE,cAAc,GAAG,cAAc,GAAG,YAAY,CAAC,CAAC;AAE7G;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC;AA6JpF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC3C,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,uBAAuB,GAAG,SAAS,GAC5C,kBAAkB,CAOpB"}

package/dist/domain/response-codes.js

@@ -0,0 +1,380 @@
+export const API_SUCCESS_CODE = '000';
+export const PAYMENT_COMPLETED_CODE = '121';
+/** Failure codes named explicitly in the IPN guide. */
+export const DOCUMENTED_PAYMENT_FAILURE_CODES = ['199', '999'];
+const STATUS_INQUIRY_REF = { docId: 'status-inquiry', sectionId: 'introduction' };
+const IPN_REF = { docId: 'ipn-implementation', sectionId: 'expected-ipn-response' };
+function unknownCode(code, family) {
+    return {
+        code,
+        family,
+        documented: false,
+        meaning: `Code ${code} is not documented in the 2026 JazzCash integration guides.`,
+        outcome: 'unknown',
+        action: "Read the accompanying pp_ResponseMessage, which carries the gateway's own description, then confirm the meaning with JazzCash support before treating the transaction as settled or failed.",
+        docRefs: [STATUS_INQUIRY_REF],
+    };
+}
+/** Describe a `pp_ResponseCode` / `ResponseCode` value: did the API call work? */
+export function describeApiResponseCode(code) {
+    if (code === API_SUCCESS_CODE) {
+        return {
+            code,
+            family: 'api-operation',
+            documented: true,
+            meaning: 'The API operation was performed successfully.',
+            outcome: 'success',
+            action: 'For a direct payment or refund call this also means the transaction succeeded. For Status Inquiry it means only that the enquiry worked — read pp_PaymentResponseCode for the payment outcome.',
+            docRefs: [STATUS_INQUIRY_REF],
+        };
+    }
+    return unknownCode(code, 'api-operation');
+}
+/** Describe a `pp_PaymentResponseCode` value: did the payment succeed? */
+export function describePaymentResponseCode(code) {
+    if (code === PAYMENT_COMPLETED_CODE) {
+        return {
+            code,
+            family: 'payment-status',
+            documented: true,
+            meaning: 'The transaction is completed and the amount has been debited.',
+            outcome: 'success',
+            action: 'Mark the order as paid and acknowledge the notification with pp_ResponseCode "000".',
+            docRefs: [STATUS_INQUIRY_REF, IPN_REF],
+        };
+    }
+    if (DOCUMENTED_PAYMENT_FAILURE_CODES.includes(code)) {
+        return {
+            code,
+            family: 'payment-status',
+            documented: true,
+            meaning: 'The transaction failed.',
+            outcome: 'failure',
+            action: 'Do not release goods. Read pp_PaymentResponseMessage for the reason, and re-run Status Inquiry at least ten minutes after initiation if the outcome was previously pending.',
+            docRefs: [IPN_REF],
+        };
+    }
+    return unknownCode(code, 'payment-status');
+}
+/**
+ * Read a field that JazzCash spells inconsistently.
+ *
+ * Card and BNPL refund responses use bare `ResponseCode` / `ResponseMessage` /
+ * `SecureHash`; every other documented response prefixes them with `pp_`.
+ *
+ * A JSON number is accepted as well as a string because a service-level code is
+ * commonly `0`, not `"0"`; requiring a string would read every such response as
+ * carrying no code at all and classify a plain success as unresolved. The value
+ * is compared as written, so a provider that sends a zero-padded `0` where the
+ * flow declares `"00"` reads as a decline rather than as an approval — the safe
+ * direction, and a reason to transcribe the value exactly as the guide prints it.
+ *
+ * One reader for every path, deliberately. Two readers with different tolerance
+ * meant the same `pp_ResponseCode: 0` was "no recognisable response code" to the
+ * documented classifier and a success to the declared one.
+ */
+function readField(response, ...names) {
+    for (const name of names) {
+        const value = response[name];
+        if (typeof value === 'number' && Number.isFinite(value)) {
+            return String(value);
+        }
+        if (typeof value === 'string' && value.trim() !== '') {
+            return value.trim();
+        }
+    }
+    return undefined;
+}
+/** The message fields the corpus documents; absent for a provider it does not cover. */
+function readMessage(response) {
+    return readField(response, 'pp_PaymentResponseMessage', 'pp_ResponseMessage', 'ResponseMessage');
+}
+/**
+ * What `pp_Status` may contribute when the payment code is undocumented.
+ *
+ * `Completed` is deliberately NOT honoured here. An undocumented code beside it
+ * is exactly the case whose own advice is to confirm the meaning with JazzCash
+ * before treating the transaction as settled, and automation reads the
+ * classification rather than the advice: promoting it to `completed` releases
+ * goods on a code nobody in this repository can explain. The literals that are
+ * honoured all steer a merchant AWAY from releasing goods, so the fallback can
+ * delay a decision but never make one.
+ */
+function fallbackFromStatusLiteral(status) {
+    const normalised = status.toLowerCase();
+    if (normalised.includes('pending') || normalised.includes('progress')) {
+        return 'pending';
+    }
+    if (normalised.includes('fail') || normalised.includes('unsuccessful') || normalised.includes('cancel')) {
+        return 'failed';
+    }
+    return 'unknown';
+}
+const PENDING_STEPS = [
+    'Wait at least ten minutes from the transaction time, then call the Status Inquiry API again.',
+    'Do not release goods and do not re-charge the customer while the outcome is pending.',
+];
+/**
+ * Advice for an outcome nobody can name yet.
+ *
+ * The opening sentence is the one that matters and is the same wherever the
+ * response came from: an unresolved transaction is not a failed one, and a
+ * merchant who reads it as failed re-charges a customer who may already have
+ * paid. Only the escalation route differs, so it is the only part a caller
+ * supplies — two hand-written arrays drifted apart on the shared line before.
+ */
+function unresolvedSteps(...escalation) {
+    return ['Treat the transaction as unresolved rather than failed.', ...escalation];
+}
+const UNKNOWN_STEPS = unresolvedSteps('Call the Status Inquiry API to obtain an authoritative outcome.', 'If the code remains undocumented, escalate to JazzCash with the pp_TxnRefNo and pp_RetrievalReferenceNo.');
+function classificationFromOutcome(outcome) {
+    if (outcome === 'success') {
+        return 'completed';
+    }
+    return outcome === 'failure' ? 'failed' : 'unknown';
+}
+/**
+ * Which code carries the PAYMENT outcome for this context.
+ *
+ * A Status Inquiry reports it in `pp_PaymentResponseCode`. An inbound IPN has no
+ * such field and reports it in `pp_ResponseCode` instead. Every other context
+ * has no separate payment code at all.
+ */
+function resolvePaymentInfo(context, apiCode, paymentCode) {
+    if (paymentCode !== undefined) {
+        return describePaymentResponseCode(paymentCode);
+    }
+    if (context === 'ipn' && apiCode !== undefined) {
+        return describePaymentResponseCode(apiCode);
+    }
+    return undefined;
+}
+/** Advice for a classification. `action` is the code-specific step, where one applies. */
+function nextStepsFor(classification, action) {
+    switch (classification) {
+        case 'completed':
+        case 'failed':
+            return [action];
+        case 'pending':
+            return PENDING_STEPS;
+        case 'unknown':
+            return UNKNOWN_STEPS;
+    }
+}
+const NO_RECOGNISABLE_CODE = {
+    classification: 'unknown',
+    reason: 'The response carries no recognisable response code field.',
+    apiOperation: undefined,
+    paymentStatus: undefined,
+    statusLiteral: undefined,
+    message: undefined,
+    nextSteps: UNKNOWN_STEPS,
+};
+/**
+ * Classify a response whose codes the 2026 JazzCash guides document.
+ *
+ * Precedence is deliberate: the explicit payment code outranks the API code,
+ * because a Status Inquiry that succeeds (`000`) tells you nothing about whether
+ * the money moved. `pp_Status` is used only to distinguish pending from unknown,
+ * since `Completed` is the sole literal the guides document.
+ */
+function classifyDocumentedResponse(response, context) {
+    const apiCode = readField(response, 'pp_ResponseCode', 'ResponseCode');
+    const paymentCode = readField(response, 'pp_PaymentResponseCode');
+    const statusLiteral = readField(response, 'pp_Status');
+    const message = readMessage(response);
+    const apiOperation = apiCode === undefined ? undefined : describeApiResponseCode(apiCode);
+    const paymentInfo = resolvePaymentInfo(context, apiCode, paymentCode);
+    if (paymentInfo !== undefined) {
+        // An undocumented payment code falls back to pp_Status, which is the only
+        // other signal the guides define — and only as far as pending or failed.
+        const classification = paymentInfo.outcome === 'unknown' && statusLiteral !== undefined
+            ? fallbackFromStatusLiteral(statusLiteral)
+            : classificationFromOutcome(paymentInfo.outcome);
+        return {
+            classification,
+            reason: paymentInfo.meaning,
+            // An IPN's pp_ResponseCode has already been read as the payment outcome;
+            // reporting it a second time as an API outcome would be misleading.
+            apiOperation: context === 'ipn' ? undefined : apiOperation,
+            paymentStatus: paymentInfo,
+            statusLiteral,
+            message,
+            nextSteps: nextStepsFor(classification, paymentInfo.action),
+        };
+    }
+    if (apiOperation === undefined) {
+        return { ...NO_RECOGNISABLE_CODE, statusLiteral, message };
+    }
+    // Direct payment, refund and token APIs report the outcome of the operation
+    // itself in pp_ResponseCode; there is no separate payment code to consult.
+    // A Status Inquiry without a payment code is not yet resolved.
+    const inquiryAwaitingOutcome = context === 'inquiry' && apiOperation.outcome === 'success';
+    const classification = inquiryAwaitingOutcome ? 'pending' : classificationFromOutcome(apiOperation.outcome);
+    return {
+        classification,
+        reason: inquiryAwaitingOutcome
+            ? 'The Status Inquiry call succeeded but returned no pp_PaymentResponseCode, so the payment outcome is not yet determined.'
+            : apiOperation.meaning,
+        apiOperation,
+        paymentStatus: undefined,
+        statusLiteral,
+        message,
+        nextSteps: nextStepsFor(classification, apiOperation.action),
+    };
+}
+/** Success fields whose codes the tables above actually describe. */
+const DOCUMENTED_SUCCESS_FIELDS = ['pp_ResponseCode', 'ResponseCode'];
+const DECLARED_UNKNOWN_STEPS = unresolvedSteps("Query the provider's own status API for an authoritative outcome.", 'Do not release goods and do not charge the customer again while the outcome is unresolved.');
+/** Classify against a declared success field whose codes carry no documented table. */
+function classifyDeclaredContract(response, contract) {
+    const message = readMessage(response);
+    const code = readField(response, contract.successField);
+    if (code === undefined) {
+        return {
+            ...NO_RECOGNISABLE_CODE,
+            reason: `The response carries no ${contract.successField}, which is the field this flow declares as its outcome.`,
+            message,
+            nextSteps: DECLARED_UNKNOWN_STEPS,
+        };
+    }
+    if (code !== contract.successValue) {
+        // Not the declared success value means NOT a success. It does not mean a
+        // known failure: the value may name a timeout or an in-progress state, and
+        // reporting that as failed invites a second charge for a payment that may
+        // already have gone through.
+        const info = {
+            code,
+            family: 'api-operation',
+            documented: false,
+            meaning: `${contract.successField} is "${code}", not the success value "${contract.successValue}" this flow declares.`,
+            outcome: 'unknown',
+            action: `Read the provider's own response message, then confirm what ${contract.successField} "${code}" means with the provider before treating the transaction as settled or failed.`,
+            docRefs: [],
+        };
+        return {
+            classification: 'unknown',
+            reason: info.meaning,
+            apiOperation: info,
+            paymentStatus: undefined,
+            statusLiteral: undefined,
+            message,
+            nextSteps: DECLARED_UNKNOWN_STEPS,
+        };
+    }
+    const info = {
+        code,
+        family: 'api-operation',
+        documented: true,
+        meaning: `${contract.successField} is "${code}", the success value this flow declares.`,
+        outcome: 'success',
+        action: "Record the provider's own reference for the transaction and reconcile it against the provider's settlement report.",
+        docRefs: [],
+    };
+    return {
+        classification: 'completed',
+        reason: info.meaning,
+        apiOperation: info,
+        paymentStatus: undefined,
+        statusLiteral: undefined,
+        message,
+        nextSteps: [info.action],
+    };
+}
+/**
+ * Apply the settlement level on top of a service-level result.
+ *
+ * The two levels answer different questions, and a contract that checks only
+ * the first classifies a DECLINED card as a successful payment: the gateway
+ * accepted and processed the request exactly as asked, and the issuer refused
+ * it. A merchant who releases goods on that classification is never paid.
+ *
+ * The settlement check can only VETO a success. It never promotes a
+ * service-level failure or an unresolved outcome into a completed payment: an
+ * approval code beside a request the gateway says it did not process describes
+ * an authorisation for something else, or a response being read wrongly, and
+ * neither is evidence that this transaction completed.
+ */
+function applySettlementLevel(base, response, settlement) {
+    if (settlement === undefined || base.classification !== 'completed') {
+        return base;
+    }
+    const code = readField(response, settlement.field);
+    if (code === undefined) {
+        const info = {
+            // Empty because there genuinely was no code. Reported rather than omitted,
+            // so a caller can see that the settlement level was consulted and came
+            // back with nothing — which is not the same as a flow that has no such
+            // level at all.
+            code: '',
+            family: 'settlement',
+            documented: false,
+            meaning: `The response carries no ${settlement.field}, so the acquirer's verdict is missing from a call that declares one.`,
+            outcome: 'unknown',
+            action: `Ask the provider for the ${settlement.field} of this transaction before releasing goods. A service-level success on its own does not say the card was approved.`,
+            docRefs: [],
+        };
+        return {
+            ...base,
+            classification: 'unknown',
+            reason: info.meaning,
+            settlement: info,
+            nextSteps: DECLARED_UNKNOWN_STEPS,
+        };
+    }
+    if (code === settlement.successValue) {
+        const info = {
+            code,
+            family: 'settlement',
+            documented: true,
+            meaning: `${settlement.field} is "${code}", the approval value this flow declares.`,
+            outcome: 'success',
+            action: base.nextSteps[0] ?? "Reconcile the transaction against the provider's settlement report.",
+            docRefs: [],
+        };
+        return { ...base, settlement: info };
+    }
+    const info = {
+        code,
+        family: 'settlement',
+        documented: false,
+        meaning: `${settlement.field} is "${code}", not the approval value "${settlement.successValue}". The gateway processed the request, and the card was NOT approved: no money moved.`,
+        outcome: 'failure',
+        action: `Do not release goods. Read the provider's settlement message for the reason, ask the customer for another payment method, and quote ${settlement.field} "${code}" if you raise it with the provider.`,
+        docRefs: [],
+    };
+    return {
+        ...base,
+        classification: 'failed',
+        reason: info.meaning,
+        settlement: info,
+        nextSteps: [info.action],
+    };
+}
+/**
+ * Classify a gateway response into a single actionable outcome.
+ *
+ * `contract` is the flow's own `response` section. Supplied, it names the field
+ * carrying the outcome and, where the provider answers at two levels, the
+ * acquirer field that says whether the card was actually approved. Passed as
+ * `undefined` — as it is for an inbound IPN, which arrives without a flow — the
+ * JazzCash tables above are used, which is what this server shipped with.
+ *
+ * Required rather than optional, and that is the point. While it was optional,
+ * two of the three call sites simply left it off: one of them had `flow` in
+ * scope on the same line. Both then reported a DECLINED card as a service-level
+ * success, because the settlement veto is carried by the contract. A call site
+ * that genuinely has no flow must now say so in writing.
+ *
+ * A contract naming one of the documented JazzCash success fields still takes
+ * the documented path: those codes have meanings, a pending state and a
+ * separate payment code, and a literal comparison against `000` would throw all
+ * of that away.
+ */
+export function classifyResponse(response, context, contract) {
+    const serviceLevel = contract !== undefined && !DOCUMENTED_SUCCESS_FIELDS.includes(contract.successField)
+        ? classifyDeclaredContract(response, contract)
+        : classifyDocumentedResponse(response, context);
+    return applySettlementLevel(serviceLevel, response, contract?.settlement);
+}
+//# sourceMappingURL=response-codes.js.map

package/dist/domain/response-codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-codes.js","sourceRoot":"","sources":["../../src/domain/response-codes.ts"],"names":[],"mappings":"AA6CA,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAEtC,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAE5C,uDAAuD;AACvD,MAAM,CAAC,MAAM,gCAAgC,GAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAElF,MAAM,kBAAkB,GAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AAC1F,MAAM,OAAO,GAAW,EAAE,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC;AAE5F,SAAS,WAAW,CAAC,IAAY,EAAE,MAAkB;IACnD,OAAO;QACL,IAAI;QACJ,MAAM;QACN,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,QAAQ,IAAI,6DAA6D;QAClF,OAAO,EAAE,SAAS;QAClB,MAAM,EACJ,6LAA6L;QAC/L,OAAO,EAAE,CAAC,kBAAkB,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,eAAe;YACvB,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,+CAA+C;YACxD,OAAO,EAAE,SAAS;YAClB,MAAM,EACJ,gMAAgM;YAClM,OAAO,EAAE,CAAC,kBAAkB,CAAC;SAC9B,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AAC5C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACpC,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,gBAAgB;YACxB,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,+DAA+D;YACxE,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,qFAAqF;YAC7F,OAAO,EAAE,CAAC,kBAAkB,EAAE,OAAO,CAAC;SACvC,CAAC;IACJ,CAAC;IACD,IAAI,gCAAgC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,gBAAgB;YACxB,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,yBAAyB;YAClC,OAAO,EAAE,SAAS;YAClB,MAAM,EACJ,6KAA6K;YAC/K,OAAO,EAAE,CAAC,OAAO,CAAC;SACnB,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AAC7C,CAAC;AA8BD;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,SAAS,CAAC,QAA2C,EAAE,GAAG,KAAwB;IACzF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wFAAwF;AACxF,SAAS,WAAW,CAAC,QAA2C;IAC9D,OAAO,SAAS,CAAC,QAAQ,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,yBAAyB,CAAC,MAAc;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxG,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,aAAa,GAAsB;IACvC,8FAA8F;IAC9F,sFAAsF;CACvF,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,GAAG,UAA6B;IACvD,OAAO,CAAC,yDAAyD,EAAE,GAAG,UAAU,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,aAAa,GAAsB,eAAe,CACtD,iEAAiE,EACjE,0GAA0G,CAC3G,CAAC;AAEF,SAAS,yBAAyB,CAAC,OAAoB;IACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CACzB,OAAwB,EACxB,OAA2B,EAC3B,WAA+B;IAE/B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0FAA0F;AAC1F,SAAS,YAAY,CAAC,cAAyC,EAAE,MAAc;IAC7E,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,WAAW,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,oBAAoB,GAAuB;IAC/C,cAAc,EAAE,SAAS;IACzB,MAAM,EAAE,2DAA2D;IACnE,YAAY,EAAE,SAAS;IACvB,aAAa,EAAE,SAAS;IACxB,aAAa,EAAE,SAAS;IACxB,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,aAAa;CACzB,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,0BAA0B,CACjC,QAA2C,EAC3C,OAAwB;IAExB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAEtC,MAAM,YAAY,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC1F,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAEtE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,cAAc,GAClB,WAAW,CAAC,OAAO,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS;YAC9D,CAAC,CAAC,yBAAyB,CAAC,aAAa,CAAC;YAC1C,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAErD,OAAO;YACL,cAAc;YACd,MAAM,EAAE,WAAW,CAAC,OAAO;YAC3B,yEAAyE;YACzE,oEAAoE;YACpE,YAAY,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY;YAC1D,aAAa,EAAE,WAAW;YAC1B,aAAa;YACb,OAAO;YACP,SAAS,EAAE,YAAY,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,oBAAoB,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IAC7D,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,sBAAsB,GAAG,OAAO,KAAK,SAAS,IAAI,YAAY,CAAC,OAAO,KAAK,SAAS,CAAC;IAC3F,MAAM,cAAc,GAAG,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAE5G,OAAO;QACL,cAAc;QACd,MAAM,EAAE,sBAAsB;YAC5B,CAAC,CAAC,yHAAyH;YAC3H,CAAC,CAAC,YAAY,CAAC,OAAO;QACxB,YAAY;QACZ,aAAa,EAAE,SAAS;QACxB,aAAa;QACb,OAAO;QACP,SAAS,EAAE,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC;KAC7D,CAAC;AACJ,CAAC;AAiCD,qEAAqE;AACrE,MAAM,yBAAyB,GAAsB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;AAEzF,MAAM,sBAAsB,GAAsB,eAAe,CAC/D,mEAAmE,EACnE,4FAA4F,CAC7F,CAAC;AAEF,uFAAuF;AACvF,SAAS,wBAAwB,CAC/B,QAA2C,EAC3C,QAAiC;IAEjC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IAExD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,oBAAoB;YACvB,MAAM,EAAE,2BAA2B,QAAQ,CAAC,YAAY,yDAAyD;YACjH,OAAO;YACP,SAAS,EAAE,sBAAsB;SAClC,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;QACnC,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,6BAA6B;QAC7B,MAAM,IAAI,GAAqB;YAC7B,IAAI;YACJ,MAAM,EAAE,eAAe;YACvB,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,GAAG,QAAQ,CAAC,YAAY,QAAQ,IAAI,6BAA6B,QAAQ,CAAC,YAAY,uBAAuB;YACtH,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,+DAA+D,QAAQ,CAAC,YAAY,KAAK,IAAI,iFAAiF;YACtL,OAAO,EAAE,EAAE;SACZ,CAAC;QAEF,OAAO;YACL,cAAc,EAAE,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,SAAS;YACxB,aAAa,EAAE,SAAS;YACxB,OAAO;YACP,SAAS,EAAE,sBAAsB;SAClC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAqB;QAC7B,IAAI;QACJ,MAAM,EAAE,eAAe;QACvB,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,GAAG,QAAQ,CAAC,YAAY,QAAQ,IAAI,0CAA0C;QACvF,OAAO,EAAE,SAAS;QAClB,MAAM,EACJ,oHAAoH;QACtH,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF,OAAO;QACL,cAAc,EAAE,WAAW;QAC3B,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,SAAS;QACxB,aAAa,EAAE,SAAS;QACxB,OAAO;QACP,SAAS,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,oBAAoB,CAC3B,IAAwB,EACxB,QAA2C,EAC3C,UAA0C;IAE1C,IAAI,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,WAAW,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAEnD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,GAAqB;YAC7B,2EAA2E;YAC3E,uEAAuE;YACvE,uEAAuE;YACvE,gBAAgB;YAChB,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,2BAA2B,UAAU,CAAC,KAAK,uEAAuE;YAC3H,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,4BAA4B,UAAU,CAAC,KAAK,qHAAqH;YACzK,OAAO,EAAE,EAAE;SACZ,CAAC;QAEF,OAAO;YACL,GAAG,IAAI;YACP,cAAc,EAAE,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,sBAAsB;SAClC,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,UAAU,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,IAAI,GAAqB;YAC7B,IAAI;YACJ,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,GAAG,UAAU,CAAC,KAAK,QAAQ,IAAI,2CAA2C;YACnF,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,qEAAqE;YAClG,OAAO,EAAE,EAAE;SACZ,CAAC;QAEF,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAqB;QAC7B,IAAI;QACJ,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,GAAG,UAAU,CAAC,KAAK,QAAQ,IAAI,8BAA8B,UAAU,CAAC,YAAY,sFAAsF;QACnL,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,uIAAuI,UAAU,CAAC,KAAK,KAAK,IAAI,sCAAsC;QAC9M,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF,OAAO;QACL,GAAG,IAAI;QACP,cAAc,EAAE,QAAQ;QACxB,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA2C,EAC3C,OAAwB,EACxB,QAA6C;IAE7C,MAAM,YAAY,GAChB,QAAQ,KAAK,SAAS,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAClF,CAAC,CAAC,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC9C,CAAC,CAAC,0BAA0B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEpD,OAAO,oBAAoB,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC5E,CAAC"}

package/dist/domain/secure-hash.d.ts

@@ -0,0 +1,78 @@
+import { type SignatureOptions } from './signature/registry.js';
+import { type JazzCashSignatureSettings } from './signature/jazzcash.js';
+import type { SchemeProvenance, SignatureBreakdown, SignatureDiagnosis, SignatureVariant, SignatureVerification } from './signature/scheme.js';
+import type { RawParameters } from './types.js';
+/**
+ * `pp_SecureHash` construction, verification and mismatch diagnosis.
+ *
+ * The construction itself, the JazzCash forensic table and the engine that runs
+ * them live in `./signature/`. This module is the JazzCash-named entry point the
+ * builder, the gateway client and the tools were written against, kept so that
+ * naming a second scheme is a change to the options a call site passes rather
+ * than a rewrite of every call site at once. A half-migrated call site would
+ * sign with the wrong construction and report the resulting rejection as a
+ * merchant bug.
+ *
+ * Only the names with importers are re-exported. An alias nobody uses reads as
+ * a supported entry point, and the next module reaches for it instead of the
+ * provider-neutral name in `./signature/`, which is where a second provider has
+ * to be served from.
+ *
+ * Every function here selects the JazzCash scheme unless the options name
+ * another one; see `SignatureOptions`.
+ */
+/** The exact string a payload is digested from, and why each field is in it. */
+export type HashStringBreakdown = SignatureBreakdown;
+/**
+ * The JazzCash forensic table.
+ *
+ * Reachable only as this scheme's property. Several entries describe how other
+ * gateways sign correctly, so a table shared between providers would report
+ * working code as a proven defect.
+ */
+export declare const HASH_VARIANTS: readonly SignatureVariant<JazzCashSignatureSettings>[];
+/**
+ * Build the exact string that gets hashed, plus the reasoning behind it.
+ *
+ * Returning the breakdown rather than only the digest is the point: a merchant
+ * debugging `HASH_MISMATCH` needs to see which fields were used and in what
+ * order, which is precisely what no error message from the gateway tells them.
+ */
+export declare function buildHashString(parameters: RawParameters, integritySalt: string, options?: SignatureOptions): HashStringBreakdown;
+/** HMAC-SHA256 a prepared string with the Integrity Salt as key. Lowercase hex. */
+export declare function hmacSha256Hex(message: string, key: string): string;
+/** Compute `pp_SecureHash` for a payload. Lowercase hex, as PHP's `hash_hmac` emits. */
+export declare function computeSecureHash(parameters: RawParameters, integritySalt: string, options?: SignatureOptions): string;
+/**
+ * Constant-time, case-insensitive hash comparison.
+ *
+ * Case insensitivity is required, not merely tolerant: request samples in the
+ * guides are lowercase (PHP `hash_hmac` output) while response samples are
+ * uppercase. Both are the same digest.
+ */
+export declare function hashesMatch(left: string, right: string): boolean;
+/** Verify a supplied hash against a freshly computed one. */
+export declare function verifySecureHash(parameters: RawParameters, integritySalt: string, providedHash: string, options?: SignatureOptions): SignatureVerification;
+/**
+ * Explain why a hash does not match.
+ *
+ * Runs the selected scheme's known wrong constructions against the merchant's
+ * own parameters. A variant that reproduces their hash is reported as
+ * `confirmed`: that is not a guess, it is a demonstration of what their code
+ * did — which is why only the scheme the payload was signed under may be asked,
+ * and why `provenance` says whether the payload named that scheme.
+ *
+ * `provenance` is required rather than defaulted, for the same reason it is
+ * required on `diagnoseSignatureFor`: the safe value is the one that reports
+ * less, and a default of `declared` is the unsafe one, so a call site that
+ * forgot the argument would accuse a merchant of a construction error
+ * demonstrated under a construction nobody said they used. `declared` is the
+ * answer for every REQUEST — a flow's own hash specification selects the
+ * construction, and the flowless default selects `pp_`/`ppmpf_` fields only, so
+ * another provider's payload contributes nothing to it and no variant can
+ * reproduce that provider's signature. The response derivations are the ones
+ * that must pass `assumed`; see `requestHashOptions`, `responseHashOptions` and
+ * `forensicProvenance` in `src/catalogue/hash-options.ts`.
+ */
+export declare function diagnoseHashMismatch(parameters: RawParameters, integritySalt: string, providedHash: string, options: SignatureOptions | undefined, provenance: SchemeProvenance): SignatureDiagnosis;
+//# sourceMappingURL=secure-hash.d.ts.map

package/dist/domain/secure-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-hash.d.ts","sourceRoot":"","sources":["../../src/domain/secure-hash.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAmB,KAAK,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAE1F,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;;;;;;;;;;;;;;GAkBG;AAEH,gFAAgF;AAChF,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,gBAAgB,CAAC,yBAAyB,CAAC,EAA6B,CAAC;AAE9G;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,aAAa,EACzB,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,mBAAmB,CAErB;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wFAAwF;AACxF,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,aAAa,EACzB,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,CAER;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,aAAa,EACzB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,gBAAgB,GACzB,qBAAqB,CAEvB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,aAAa,EACzB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,gBAAgB,GAAG,SAAS,EACrC,UAAU,EAAE,gBAAgB,GAC3B,kBAAkB,CAEpB"}