@wowok/agent-mcp 2.4.1 → 2.5.0

package/dist/knowledge/deployment-scanner.js

@@ -0,0 +1,762 @@
+import * as fs from 'fs';
+import { MAX_NODE_COUNT, USER_DEFINED_PERM_INDEX_START, } from "./onchain-constants.js";
+import { traceSubsteps, } from "../project/substep-trace.js";
+import { aggregateProjectRisks, } from "../project/risk-aggregator.js";
+function add(findings, check_id, severity, message, location, suggestion) {
+    findings.push({ check_id, severity, message, location, suggestion });
+}
+function fromDeploymentDocInput(input) {
+    const version = input.version ?? "v1";
+    const namespace_tag = `${input.project_prefix}_${version}`;
+    const topological_order = input.steps.map((s) => s.entry_id);
+    const testnet_blocks = [];
+    const mainnet_blocks = [];
+    for (const step of input.steps) {
+        const phase = step.network_phase;
+        if (phase === "both" || phase === "testnet")
+            testnet_blocks.push(synthesizeBlock(step, input, "testnet"));
+        if (phase === "both" || phase === "mainnet")
+            mainnet_blocks.push(synthesizeBlock(step, input, "mainnet"));
+    }
+    const testnet_verification = new Map();
+    for (let i = 1; i <= 11; i++)
+        testnet_verification.set(`V-T-${String(i).padStart(2, "0")}`, false);
+    const mainnet_verification = new Map();
+    for (let i = 1; i <= 5; i++)
+        mainnet_verification.set(`V-M-${String(i).padStart(2, "0")}`, false);
+    const completeness_checklist = new Map();
+    for (let i = 1; i <= 18; i++)
+        completeness_checklist.set(`D-${String(i).padStart(2, "0")}`, false);
+    return {
+        project_name: input.project_prefix, version, namespace_tag,
+        objects: input.objects ?? [], edges: input.edges ?? [],
+        steps: input.steps ?? [], scenarios: input.scenarios ?? [],
+        testnet_blocks, mainnet_blocks,
+        testnet_verification, mainnet_verification,
+        completeness_checklist, topological_order,
+    };
+}
+function synthesizeBlock(step, input, network) {
+    const obj = input.objects.find((o) => o.entry_id === step.entry_id);
+    const name = obj?.name ?? `${step.object_type}_${step.step}`;
+    const replaceExistName = network === "testnet";
+    const tag = network === "testnet" ? "T" : "M";
+    return {
+        step: step.step,
+        operation_type: step.object_type,
+        data: {
+            object: { name, replaceExistName },
+            description: `${step.operation} ${step.object_type} (step ${step.step})`,
+        },
+        env: {
+            account: `${input.project_prefix}_merchant_${network}`,
+            network, replaceExistName, confirmed: true,
+        },
+        substeps: [{
+                id: `${tag}${step.step}.1`,
+                name: `${step.operation} ${step.object_type}`,
+                inputs: [],
+                outputs: [`${tag}${step.step}.output`],
+            }],
+    };
+}
+function parseDeploymentMarkdown(mdPath) {
+    const content = fs.readFileSync(mdPath, "utf-8");
+    const lines = content.split("\n");
+    const objects = parseTable(lines, "Object List", (r) => ({
+        entry_id: r["entry_id"] ?? "",
+        object_type: r["object_type"],
+        name: r["name"] ?? "",
+        reused_from: r["reused_from"] || undefined,
+        publish_required: r["publish_required"] === "true",
+        description: r["description"] || undefined,
+    })).filter((o) => o.entry_id && o.name);
+    const edges = parseTable(lines, "Dependency Edges", (r) => ({
+        from: r["from"] ?? "",
+        to: r["to"] ?? "",
+        edge_kind: r["edge_kind"] ?? "",
+        field_path: r["field_path"] ?? "",
+        required_at_publish: r["required_at_publish"] === "true",
+    })).filter((e) => e.from && e.to);
+    const scenarios = parseTable(lines, "Scenario Matrix", (r) => ({
+        scenario_id: r["scenario_id"] ?? "",
+        description: r["description"] ?? "",
+        primary_object: r["primary_object"] ?? "",
+        supporting_objects: (r["supporting_objects"] ?? "").split(",").map((s) => s.trim()).filter(Boolean),
+        test_step_refs: r["test_step_refs"] ? r["test_step_refs"].split(",").map((s) => s.trim()).filter(Boolean) : undefined,
+    })).filter((s) => s.scenario_id);
+    const steps = parseTable(lines, "Topological Execution Plan", (r) => {
+        const phase = r["network_phase"] === "testnet" || r["network_phase"] === "mainnet" || r["network_phase"] === "both"
+            ? r["network_phase"]
+            : "both";
+        return {
+            step: parseInt(r["step"] ?? "0", 10) || 0,
+            object_type: r["object_type"],
+            operation: r["operation"] ?? "",
+            substep_count: parseInt(r["substep_count"] ?? "0", 10) || 0,
+            depends_on: (r["depends_on"] ?? "").replace(/[\[\]]/g, "").split(",").map((s) => s.trim()).filter(Boolean).map((n) => parseInt(n, 10) || 0),
+            entry_id: r["entry_id"] ?? "",
+            network_phase: phase,
+        };
+    }).filter((s) => s.step > 0);
+    const allBlocks = extractJsonBlocks(lines);
+    const testnet_blocks = [];
+    const mainnet_blocks = [];
+    for (const b of allBlocks) {
+        if (b.env?.network === "mainnet")
+            mainnet_blocks.push(b);
+        else
+            testnet_blocks.push(b);
+    }
+    const testnet_verification = parseStatusMap(lines, "V-T-");
+    const mainnet_verification = parseStatusMap(lines, "V-M-");
+    const completeness_checklist = parseStatusMap(lines, "D-", "Completeness Checklist");
+    const meta = parseMetaTable(lines);
+    const project_name = meta.get("project_name") ?? deriveProjectFromPath(mdPath);
+    const version = meta.get("version") ?? "v1";
+    const namespace_tag = meta.get("namespace tag") ?? meta.get("namespace_tag") ?? `${project_name}_${version}`;
+    const topological_order = steps.map((s) => s.entry_id);
+    return {
+        project_name, version, namespace_tag,
+        objects, edges, steps, scenarios,
+        testnet_blocks, mainnet_blocks,
+        testnet_verification, mainnet_verification,
+        completeness_checklist, topological_order,
+    };
+}
+function parseTable(lines, headerHint, mapper) {
+    return parseMarkdownTable(lines, headerHint).map(mapper);
+}
+function parseMarkdownTable(lines, headerHint) {
+    const rows = [];
+    for (let i = 0; i < lines.length; i++) {
+        if (!lines[i].includes(headerHint))
+            continue;
+        let headerIdx = -1;
+        for (let k = i; k < Math.min(i + 10, lines.length); k++) {
+            if (lines[k].trim().startsWith("|") && lines[k].includes("|")) {
+                headerIdx = k;
+                break;
+            }
+        }
+        if (headerIdx === -1)
+            break;
+        const headers = splitTableRow(lines[headerIdx]);
+        let rowIdx = headerIdx + 1;
+        if (rowIdx < lines.length && /^\s*\|[\s-:|]+\|\s*$/.test(lines[rowIdx]))
+            rowIdx++;
+        while (rowIdx < lines.length && lines[rowIdx].trim().startsWith("|")) {
+            const cells = splitTableRow(lines[rowIdx]);
+            if (cells.length === 0)
+                break;
+            const row = {};
+            for (let h = 0; h < headers.length; h++)
+                row[headers[h].trim()] = (cells[h] ?? "").trim();
+            rows.push(row);
+            rowIdx++;
+        }
+        break;
+    }
+    return rows;
+}
+function splitTableRow(line) {
+    const trimmed = line.trim();
+    if (!trimmed.startsWith("|"))
+        return [];
+    return trimmed.slice(1, trimmed.endsWith("|") ? -1 : undefined).split("|");
+}
+function parseStatusMap(lines, prefix, hint) {
+    const result = new Map();
+    const rows = hint ? parseMarkdownTable(lines, hint) : parseMarkdownTable(lines, "Verification Checklist");
+    for (const r of rows) {
+        const id = r["verification_id"] ?? r["check_id"] ?? "";
+        if (!id.startsWith(prefix))
+            continue;
+        const status = (r["status"] ?? "").trim();
+        result.set(id, status.includes("✅") || status.toLowerCase().includes("pass"));
+    }
+    return result;
+}
+function parseMetaTable(lines) {
+    const result = new Map();
+    for (const r of parseMarkdownTable(lines, "Project Metadata")) {
+        const key = r["field"] ?? "";
+        const value = r["value"] ?? "";
+        if (key)
+            result.set(key.trim(), value.trim());
+    }
+    return result;
+}
+function extractJsonBlocks(lines) {
+    const blocks = [];
+    let i = 0;
+    while (i < lines.length) {
+        if (lines[i].trim().startsWith("```json")) {
+            const body = [];
+            let j = i + 1;
+            while (j < lines.length && !lines[j].trim().startsWith("```")) {
+                body.push(lines[j]);
+                j++;
+            }
+            try {
+                const parsed = JSON.parse(body.join("\n"));
+                if (parsed && typeof parsed === "object" && "operation_type" in parsed) {
+                    const env = (parsed.env ?? {});
+                    const data = (parsed.data ?? {});
+                    const substepsRaw = parsed.substeps;
+                    const substeps = Array.isArray(substepsRaw) ? substepsRaw.map(normalizeSubstep) : undefined;
+                    blocks.push({
+                        step: typeof parsed.step === "number" ? parsed.step : 0,
+                        operation_type: String(parsed.operation_type ?? ""),
+                        data,
+                        env: {
+                            network: typeof env.network === "string" ? env.network : undefined,
+                            replaceExistName: typeof env.replaceExistName === "boolean" ? env.replaceExistName : undefined,
+                            forceClaim: typeof env.forceClaim === "boolean" ? env.forceClaim : undefined,
+                            confirmed: typeof env.confirmed === "boolean" ? env.confirmed : undefined,
+                            ...env,
+                        },
+                        substeps,
+                    });
+                }
+            }
+            catch { }
+            i = j + 1;
+        }
+        else {
+            i++;
+        }
+    }
+    return blocks;
+}
+function normalizeSubstep(raw) {
+    if (!raw || typeof raw !== "object")
+        return { id: "", inputs: [], outputs: [] };
+    const s = raw;
+    return {
+        id: String(s.id ?? ""),
+        name: typeof s.name === "string" ? s.name : undefined,
+        inputs: Array.isArray(s.inputs) ? s.inputs.map(String) : [],
+        outputs: Array.isArray(s.outputs) ? s.outputs.map(String) : [],
+    };
+}
+function deriveProjectFromPath(mdPath) {
+    const base = mdPath.split(/[\\/]/).pop() ?? "project";
+    return base.replace(/_v\d+_deployment\.md$/i, "").replace(/\.md$/i, "");
+}
+function* walkPermissionIndices(value) {
+    if (value === null || value === undefined || typeof value !== "object")
+        return;
+    if (Array.isArray(value)) {
+        for (const v of value)
+            yield* walkPermissionIndices(v);
+        return;
+    }
+    const obj = value;
+    if (typeof obj.permissionIndex === "number")
+        yield obj.permissionIndex;
+    if (typeof obj.permission_index === "number")
+        yield obj.permission_index;
+    if (typeof obj.index === "number" && obj.__isPermission === true)
+        yield obj.index;
+    for (const v of Object.values(obj))
+        yield* walkPermissionIndices(v);
+}
+function countMachineNodes(block) {
+    const node = block.data?.node;
+    const nodes = node?.nodes;
+    return Array.isArray(nodes) ? nodes.length : 0;
+}
+function deriveEntryIdFromBlock(block, doc) {
+    const obj = block.data.object;
+    let name;
+    if (typeof obj === "string")
+        name = obj;
+    else if (obj && typeof obj === "object") {
+        const o = obj;
+        if (typeof o.name === "string")
+            name = o.name;
+    }
+    if (!name)
+        return undefined;
+    return doc.objects.find((o) => o.name === name)?.entry_id;
+}
+export function analyzeObjectDependencyCompleteness(input) {
+    const findings = [];
+    try {
+        const doc = normalizeInput(input);
+        if (!doc) {
+            add(findings, "D-01", "critical", "No deployment document provided (need document_path or deployment_doc)");
+            return findings;
+        }
+        const definedIds = new Set(doc.objects.map((o) => o.entry_id));
+        const referencedIds = new Set();
+        for (const e of doc.edges) {
+            referencedIds.add(e.from);
+            referencedIds.add(e.to);
+        }
+        for (const ref of referencedIds) {
+            if (ref.endsWith(":*"))
+                continue;
+            if (!definedIds.has(ref)) {
+                add(findings, "D-01", "critical", `Object '${ref}' is referenced in §1.2 but not defined in §1.1`, "§1.2 Dependency Edges", `Add '${ref}' to §1.1 Object List or remove the reference.`);
+            }
+        }
+        for (const e of doc.edges) {
+            const fromOk = definedIds.has(e.from) || e.from.endsWith(":*");
+            const toOk = definedIds.has(e.to) || e.to.endsWith(":*");
+            if (!fromOk || !toOk) {
+                add(findings, "D-02", "critical", `Dangling dependency: ${e.from} → ${e.to} (edge_kind='${e.edge_kind}')`, "§1.2 Dependency Edges", "Create the missing object or remove the edge.");
+            }
+        }
+        for (const g of doc.objects.filter((o) => o.object_type === "guard")) {
+            const hasCreate = doc.testnet_blocks.some((b) => b.operation_type === "guard" &&
+                b.data.object?.name === g.name);
+            const hasGenPassport = doc.testnet_blocks.some((b) => b.operation_type === "passport" || b.data.gen_passport === true || b.data.object === g.name);
+            if (!hasCreate)
+                add(findings, "D-08", "critical", `Guard '${g.entry_id}' has no create step in §3.2`, `§3.2 (guard: ${g.name})`, `Add a guard creation JSON block for '${g.name}'.`);
+            if (!hasGenPassport)
+                add(findings, "D-08", "critical", `Guard '${g.entry_id}' has no gen_passport step in §3.2`, `§3.2 (guard: ${g.name})`, `Add a passport/gen_passport JSON block after the guard creation step.`);
+        }
+    }
+    catch (err) {
+        add(findings, "D-01", "warning", `analyzeObjectDependencyCompleteness failed: ${err.message}`);
+    }
+    return findings;
+}
+export function analyzeSubstepCoherence(input) {
+    const findings = [];
+    try {
+        const doc = normalizeInput(input);
+        if (!doc)
+            return [];
+        for (const network of ["testnet", "mainnet"]) {
+            const substeps = collectSubsteps(network === "testnet" ? doc.testnet_blocks : doc.mainnet_blocks, network);
+            const result = traceSubsteps({
+                project_prefix: doc.project_name, version: doc.version, network, substeps,
+            });
+            emitCoherenceFindings(result, network, findings);
+        }
+    }
+    catch (err) {
+        add(findings, "D-10", "warning", `analyzeSubstepCoherence failed: ${err.message}`);
+    }
+    return findings;
+}
+function collectSubsteps(blocks, network) {
+    const records = [];
+    const tag = network === "testnet" ? "T" : "M";
+    for (const block of blocks) {
+        if (!block.substeps)
+            continue;
+        const parentStep = `${tag}${block.step}`;
+        for (const s of block.substeps) {
+            if (!s.id)
+                continue;
+            records.push({
+                step_id: s.id, parent_step: parentStep,
+                object_type: block.operation_type,
+                entry_id: "", operation_type: block.operation_type, network,
+                input: { data: block.data, input_refs: s.inputs },
+                timestamp: 0, status: "PENDING",
+                dependencies: {
+                    input_refs: s.inputs,
+                    output_refs: s.outputs.map((field_path) => ({ substep_id: s.id, field_path })),
+                },
+            });
+        }
+    }
+    return records;
+}
+function emitCoherenceFindings(result, network, findings) {
+    for (const d of result.dangling_inputs) {
+        add(findings, "D-10", "critical", `[${network}] Dangling input: substep '${d.substep_id}' references missing '${d.missing_ref}'`, `${network} §substeps`, `Ensure '${d.missing_ref}' is produced by an earlier substep.`);
+    }
+    for (const c of result.circular_refs) {
+        add(findings, "D-10", "critical", `[${network}] Circular reference: ${c.cycle.join(" → ")}`, `${network} §substeps`, "Break the cycle by removing one dependency.");
+    }
+    for (const m of result.missing_outputs) {
+        add(findings, "D-10", "warning", `[${network}] Missing output: substep '${m.substep_id}' did not produce '${m.expected_field}'`, `${network} §substeps`, `Ensure '${m.substep_id}' produces '${m.expected_field}'.`);
+    }
+    for (const b of result.cross_step_breaks) {
+        add(findings, "D-10", "critical", `[${network}] Cross-step break: failed step '${b.source_step}' blocks '${b.target_step}'`, `${network} §substeps`, `Fix step '${b.source_step}' or adjust the dependency.`);
+    }
+}
+export function analyzeNetworkConsistency(input) {
+    const findings = [];
+    try {
+        const doc = normalizeInput(input);
+        if (!doc)
+            return [];
+        const testnetBlocks = doc.testnet_blocks;
+        const mainnetBlocks = doc.mainnet_blocks;
+        const expectedOrder = doc.topological_order;
+        if (expectedOrder.length > 0 && testnetBlocks.length > 0) {
+            for (let i = 0; i < testnetBlocks.length; i++) {
+                const expected = expectedOrder[i];
+                if (!expected)
+                    break;
+                const blockEntryId = deriveEntryIdFromBlock(testnetBlocks[i], doc);
+                if (blockEntryId && blockEntryId !== expected) {
+                    add(findings, "D-04", "critical", `testnet step ${testnetBlocks[i].step} order mismatch: expected '${expected}', got '${blockEntryId}'`, "§3.2 testnet JSON Operation Sequence", "Reorder testnet JSON blocks to match §2 topological order.");
+                    break;
+                }
+            }
+        }
+        for (const b of testnetBlocks) {
+            if (b.env.network !== "testnet")
+                add(findings, "D-05", "critical", `testnet step ${b.step} env.network is '${b.env.network ?? "(missing)"}', expected 'testnet'`, `§3.2 step ${b.step}`, "Set env.network = 'testnet' on all §3.2 JSON blocks.");
+        }
+        for (const b of testnetBlocks) {
+            if (b.env.replaceExistName !== true)
+                add(findings, "D-06", "critical", `testnet step ${b.step} env.replaceExistName is '${b.env.replaceExistName ?? "(missing)"}', expected true`, `§3.2 step ${b.step}`, "Set env.replaceExistName = true on all §3.2 JSON blocks (testnet allows overwrite).");
+        }
+        if (testnetBlocks.length !== mainnetBlocks.length) {
+            add(findings, "D-11", "critical", `mainnet step count (${mainnetBlocks.length}) != testnet step count (${testnetBlocks.length})`, "§3.2 vs §4.2", "Ensure mainnet JSON blocks correspond 1:1 with testnet blocks.");
+        }
+        else {
+            for (let i = 0; i < mainnetBlocks.length; i++) {
+                const t = testnetBlocks[i];
+                const m = mainnetBlocks[i];
+                if (t.step !== m.step)
+                    add(findings, "D-11", "critical", `mainnet step ${m.step} does not match testnet step ${t.step}`, `§4.2 step ${m.step}`, "Ensure mainnet step numbers match testnet.");
+                if (t.operation_type !== m.operation_type)
+                    add(findings, "D-11", "critical", `step ${m.step} operation_type mismatch: testnet='${t.operation_type}', mainnet='${m.operation_type}'`, `§4.2 step ${m.step}`, "Align mainnet operation_type with testnet.");
+            }
+        }
+        for (const b of mainnetBlocks) {
+            if (b.env.network !== "mainnet")
+                add(findings, "D-12", "critical", `mainnet step ${b.step} env.network is '${b.env.network ?? "(missing)"}', expected 'mainnet'`, `§4.2 step ${b.step}`, "Set env.network = 'mainnet' on all §4.2 JSON blocks.");
+        }
+        for (const b of mainnetBlocks) {
+            if (b.env.replaceExistName !== false && !b.env.forceClaim)
+                add(findings, "D-13", "critical", `mainnet step ${b.step} env.replaceExistName is '${b.env.replaceExistName ?? "(missing)"}', expected false (or set forceClaim=true)`, `§4.2 step ${b.step}`, "Set env.replaceExistName = false on all §4.2 JSON blocks (mainnet must not overwrite).");
+        }
+    }
+    catch (err) {
+        add(findings, "D-04", "warning", `analyzeNetworkConsistency failed: ${err.message}`);
+    }
+    return findings;
+}
+const NAME_REGEX = /^[a-z][a-z0-9_]{2,63}$/;
+export function analyzeNamingConvention(input) {
+    const findings = [];
+    try {
+        const doc = normalizeInput(input);
+        if (!doc)
+            return [];
+        const prefix = doc.project_name;
+        const versionSuffix = `_${doc.version}`;
+        for (const obj of doc.objects) {
+            if (obj.reused_from)
+                continue;
+            if (!NAME_REGEX.test(obj.name)) {
+                add(findings, "NAMING-01", "warning", `Object '${obj.entry_id}' name '${obj.name}' does not match ${NAME_REGEX}`, `§1.1 (${obj.entry_id})`, `Rename to match ^[a-z][a-z0-9_]{2,63}$ and start with project prefix '${prefix}'.`);
+            }
+            else if (prefix && !obj.name.startsWith(`${prefix}_`)) {
+                add(findings, "NAMING-01", "warning", `Object '${obj.entry_id}' name '${obj.name}' does not start with project prefix '${prefix}_'`, `§1.1 (${obj.entry_id})`, `Rename to start with '${prefix}_'.`);
+            }
+            if (versionSuffix && !obj.name.endsWith(versionSuffix)) {
+                add(findings, "NAMING-02", "warning", `Object '${obj.entry_id}' name '${obj.name}' is missing version suffix '${versionSuffix}'`, `§1.1 (${obj.entry_id})`, `Append '${versionSuffix}' to the name.`);
+            }
+        }
+    }
+    catch (err) {
+        add(findings, "NAMING-01", "warning", `analyzeNamingConvention failed: ${err.message}`);
+    }
+    return findings;
+}
+export function analyzePermissionIndexRange(input) {
+    const findings = [];
+    try {
+        const doc = normalizeInput(input);
+        if (!doc)
+            return [];
+        const allBlocks = [...doc.testnet_blocks, ...doc.mainnet_blocks];
+        for (const block of allBlocks) {
+            for (const idx of walkPermissionIndices(block.data)) {
+                if (idx < USER_DEFINED_PERM_INDEX_START)
+                    add(findings, "D-07", "critical", `permissionIndex ${idx} < ${USER_DEFINED_PERM_INDEX_START} (USER_DEFINED_PERM_INDEX_START) in step ${block.step} (${block.operation_type})`, `${block.env.network ?? "?"} step ${block.step}`, `Use a permissionIndex >= ${USER_DEFINED_PERM_INDEX_START}.`);
+            }
+        }
+        for (const block of allBlocks) {
+            if (block.operation_type !== "machine")
+                continue;
+            const count = countMachineNodes(block);
+            if (count > MAX_NODE_COUNT)
+                add(findings, "D-09", "critical", `Machine in step ${block.step} has ${count} nodes > MAX_NODE_COUNT (${MAX_NODE_COUNT})`, `${block.env.network ?? "?"} step ${block.step}`, `Reduce node count to <= ${MAX_NODE_COUNT} or split into multiple Machines.`);
+        }
+    }
+    catch (err) {
+        add(findings, "D-07", "warning", `analyzePermissionIndexRange failed: ${err.message}`);
+    }
+    return findings;
+}
+const REQUIRED_SCENARIO_KEYWORDS = ["normal_order", "refund", "dispute", "machine_publish", "service_publish"];
+export function analyzeScenarioCoverage(input) {
+    const findings = [];
+    try {
+        const doc = normalizeInput(input);
+        if (!doc)
+            return [];
+        const coveredKeywords = new Set();
+        for (const s of doc.scenarios) {
+            const text = `${s.scenario_id} ${s.description}`.toLowerCase();
+            for (const kw of REQUIRED_SCENARIO_KEYWORDS) {
+                if (text.includes(kw.toLowerCase()))
+                    coveredKeywords.add(kw);
+            }
+        }
+        if (coveredKeywords.size < 3) {
+            const missing = REQUIRED_SCENARIO_KEYWORDS.filter((k) => !coveredKeywords.has(k));
+            add(findings, "D-03", "warning", `Scenario matrix covers ${coveredKeywords.size}/${REQUIRED_SCENARIO_KEYWORDS.length} required keywords; missing: ${missing.join(", ")}`, "§1.3 Scenario Matrix", "Add scenarios covering the missing keywords (normal_order, refund, dispute, machine_publish, service_publish).");
+        }
+        const definedIds = new Set(doc.objects.map((o) => o.entry_id));
+        for (const s of doc.scenarios) {
+            const refs = [s.primary_object, ...s.supporting_objects];
+            for (const ref of refs) {
+                if (ref.endsWith(":*"))
+                    continue;
+                if (!definedIds.has(ref))
+                    add(findings, "D-03", "warning", `Scenario '${s.scenario_id}' references undefined object '${ref}'`, `§1.3 (${s.scenario_id})`, `Add '${ref}' to §1.1 or fix the scenario reference.`);
+            }
+        }
+    }
+    catch (err) {
+        add(findings, "D-03", "warning", `analyzeScenarioCoverage failed: ${err.message}`);
+    }
+    return findings;
+}
+const TESTNET_VERIFICATION_ITEMS = ["V-T-01", "V-T-02", "V-T-03", "V-T-04", "V-T-05", "V-T-06", "V-T-07", "V-T-08", "V-T-09", "V-T-10", "V-T-11"];
+const MAINNET_VERIFICATION_ITEMS = ["V-M-01", "V-M-02", "V-M-03", "V-M-04", "V-M-05"];
+const COMPLETENESS_CHECK_IDS = Array.from({ length: 18 }, (_, i) => `D-${String(i + 1).padStart(2, "0")}`);
+export function analyzeVerificationChecklist(input) {
+    const findings = [];
+    try {
+        const doc = normalizeInput(input);
+        if (!doc)
+            return [];
+        for (const id of TESTNET_VERIFICATION_ITEMS) {
+            if (!doc.testnet_verification.has(id))
+                add(findings, "D-14", "warning", `testnet verification item '${id}' is missing from §3.3`, "§3.3 testnet Verification Checklist", `Add row '${id}' to §3.3.`);
+        }
+        for (const id of MAINNET_VERIFICATION_ITEMS) {
+            if (!doc.mainnet_verification.has(id))
+                add(findings, "D-15", "warning", `mainnet verification item '${id}' is missing from §4.3`, "§4.3 mainnet Verification Checklist", `Add row '${id}' to §4.3.`);
+        }
+        for (const id of COMPLETENESS_CHECK_IDS) {
+            if (!doc.completeness_checklist.has(id))
+                add(findings, "D-18", "warning", `completeness checklist item '${id}' is missing from §6`, "§6 Completeness Checklist", `Add row '${id}' to §6.`);
+        }
+    }
+    catch (err) {
+        add(findings, "D-14", "warning", `analyzeVerificationChecklist failed: ${err.message}`);
+    }
+    return findings;
+}
+export function analyzeDeployableReadiness(input) {
+    const findings = [];
+    try {
+        const riskResult = resolveRiskResult(input);
+        if (!riskResult) {
+            add(findings, "D-16", "info", "Risk aggregation result not available; D-16/D-17 skipped (provide project_graph with puzzles, or set deployment_doc.risk_status).", undefined, "Run C2 risk-aggregator first, or provide deployment_doc.risk_status.");
+            return findings;
+        }
+        const criticalCount = riskResult.severity_summary.CRITICAL ?? 0;
+        if (criticalCount > 0) {
+            const ruleIds = riskResult.findings.filter((f) => f.severity === "CRITICAL").map((f) => f.risk_rule_id).join(", ");
+            add(findings, "D-16", "critical", `${criticalCount} CRITICAL risk(s) remain: ${ruleIds}`, "C2 risk-aggregator output", "Return to stage 2 (business puzzle) and fix all CRITICAL risks before deploying.");
+        }
+        const confirmedHighs = new Set(input.user_confirmed_high_risks ?? []);
+        const unconfirmedHighs = riskResult.findings.filter((f) => f.severity === "HIGH" && !confirmedHighs.has(f.risk_rule_id));
+        if (unconfirmedHighs.length > 0) {
+            const ruleIds = unconfirmedHighs.map((f) => f.risk_rule_id).join(", ");
+            add(findings, "D-17", "critical", `${unconfirmedHighs.length} unconfirmed HIGH risk(s): ${ruleIds}`, "C2 risk-aggregator output", "User must confirm each HIGH risk (ACCEPT_AND_PROCEED) or fix them.");
+        }
+    }
+    catch (err) {
+        add(findings, "D-16", "warning", `analyzeDeployableReadiness failed: ${err.message}`);
+    }
+    return findings;
+}
+function resolveRiskResult(input) {
+    const pg = input.project_graph;
+    if (pg && typeof pg === "object") {
+        const obj = pg;
+        if (typeof obj.severity_summary === "object" && Array.isArray(obj.findings)) {
+            return pg;
+        }
+        if (typeof obj.project_prefix === "string" && typeof obj.puzzles === "object") {
+            try {
+                return aggregateProjectRisks(pg);
+            }
+            catch { }
+        }
+    }
+    const dd = input.deployment_doc;
+    if (dd && dd.risk_status) {
+        const critical = dd.risk_critical_count ?? 0;
+        const high = dd.risk_high_count ?? 0;
+        const findings = [];
+        for (let i = 0; i < critical; i++)
+            findings.push({
+                risk_rule_id: `R-CRITICAL-${i}`, object_type: "service", entry_id: "*",
+                severity: "CRITICAL",
+                message: "(synthesized from deployment_doc.risk_critical_count)",
+                fix_suggestion: "See C2 risk-aggregator report for details.",
+            });
+        for (let i = 0; i < high; i++)
+            findings.push({
+                risk_rule_id: `R-HIGH-${i}`, object_type: "service", entry_id: "*",
+                severity: "HIGH",
+                message: "(synthesized from deployment_doc.risk_high_count)",
+                fix_suggestion: "See C2 risk-aggregator report for details.",
+            });
+        return {
+            namespace: { prefix: dd.project_prefix, version: dd.version, industry: dd.industry },
+            findings,
+            severity_summary: { CRITICAL: critical, HIGH: high, MEDIUM: 0, LOW: 0, INFO: 0 },
+            status: dd.risk_status,
+            calibrated_at: Date.now(),
+            warnings: [],
+        };
+    }
+    return undefined;
+}
+export function scanDeployment(input) {
+    const allFindings = [
+        ...analyzeObjectDependencyCompleteness(input),
+        ...analyzeSubstepCoherence(input),
+        ...analyzeNetworkConsistency(input),
+        ...analyzeNamingConvention(input),
+        ...analyzePermissionIndexRange(input),
+        ...analyzeScenarioCoverage(input),
+        ...analyzeVerificationChecklist(input),
+        ...analyzeDeployableReadiness(input),
+    ];
+    return {
+        project_name: input.project_name,
+        document_path: input.document_path,
+        overall_readiness: computeReadiness(allFindings),
+        findings: allFindings,
+        coverage: computeCoverage(input),
+        checks: computeChecks(allFindings),
+        scanned_at: Date.now(),
+        scanner_version: DEPLOYMENT_SCANNER_VERSION,
+    };
+}
+function computeChecks(findings) {
+    const has = (id) => findings.some((f) => f.check_id === id);
+    return {
+        D01_object_defined: has("D-01") ? "fail" : "pass",
+        D02_dependency_complete: has("D-02") ? "fail" : "pass",
+        D03_scenario_covered: has("D-03") ? "fail" : "pass",
+        D04_testnet_topo_order: has("D-04") ? "fail" : "pass",
+        D05_testnet_network: has("D-05") ? "fail" : "pass",
+        D06_testnet_replace: has("D-06") ? "fail" : "pass",
+        D07_permission_index: has("D-07") ? "fail" : "pass",
+        D08_guard_gen_passport: has("D-08") ? "fail" : "pass",
+        D09_machine_node_count: has("D-09") ? "fail" : "pass",
+        D10_substep_coherence: has("D-10") ? "fail" : "pass",
+        D11_mainnet_testnet_match: has("D-11") ? "fail" : "pass",
+        D12_mainnet_network: has("D-12") ? "fail" : "pass",
+        D13_mainnet_replace: has("D-13") ? "fail" : "pass",
+        D14_testnet_verification: has("D-14") ? "fail" : "pass",
+        D15_mainnet_verification: has("D-15") ? "fail" : "pass",
+        D16_no_critical_risk: has("D-16") ? "fail" : "pass",
+        D17_no_high_risk: has("D-17") ? "fail" : "pass",
+        D18_completeness_checklist: has("D-18") ? "fail" : "pass",
+    };
+}
+function computeCoverage(input) {
+    const doc = normalizeInput(input);
+    if (!doc) {
+        return { objects_defined: 0, objects_with_scenario: 0, testnet_steps: 0, mainnet_steps: 0, verification_items: 0 };
+    }
+    const scenarioObjectIds = new Set();
+    for (const s of doc.scenarios) {
+        scenarioObjectIds.add(s.primary_object);
+        for (const o of s.supporting_objects)
+            scenarioObjectIds.add(o);
+    }
+    const objects_with_scenario = doc.objects.filter((o) => scenarioObjectIds.has(o.entry_id) || scenarioObjectIds.has(`${o.object_type}:*`)).length;
+    return {
+        objects_defined: doc.objects.length,
+        objects_with_scenario,
+        testnet_steps: doc.testnet_blocks.length,
+        mainnet_steps: doc.mainnet_blocks.length,
+        verification_items: doc.testnet_verification.size + doc.mainnet_verification.size,
+    };
+}
+function computeReadiness(findings) {
+    const dFindings = findings.filter((f) => f.check_id.startsWith("D-"));
+    if (dFindings.some((f) => f.severity === "critical"))
+        return "blocked";
+    if (dFindings.some((f) => f.severity === "warning"))
+        return "warnings";
+    return "ready";
+}
+function normalizeInput(input) {
+    if (input.deployment_doc)
+        return fromDeploymentDocInput(input.deployment_doc);
+    if (input.document_path) {
+        if (!fs.existsSync(input.document_path))
+            return undefined;
+        return parseDeploymentMarkdown(input.document_path);
+    }
+    return undefined;
+}
+export function isReady(scan) {
+    return scan.overall_readiness === "ready";
+}
+export function isBlocked(scan) {
+    return scan.overall_readiness === "blocked";
+}
+export function summarizeScan(scan) {
+    const L = [];
+    L.push(`# Deployment Scan Report — ${scan.project_name}`, "");
+    L.push(`- **Overall readiness**: ${scan.overall_readiness}`);
+    L.push(`- **Scanned at**: ${new Date(scan.scanned_at).toISOString()}`);
+    L.push(`- **Scanner version**: ${scan.scanner_version}`);
+    if (scan.document_path)
+        L.push(`- **Document**: ${scan.document_path}`);
+    L.push("", "## Coverage", "", "| Metric | Count |", "|--------|-------|");
+    L.push(`| Objects defined | ${scan.coverage.objects_defined} |`);
+    L.push(`| Objects with scenario | ${scan.coverage.objects_with_scenario} |`);
+    L.push(`| testnet steps | ${scan.coverage.testnet_steps} |`);
+    L.push(`| mainnet steps | ${scan.coverage.mainnet_steps} |`);
+    L.push(`| verification items | ${scan.coverage.verification_items} |`, "");
+    L.push("## Checks (D-01 ~ D-18)", "", "| Check ID | Status |", "|----------|--------|");
+    const entries = Object.entries(scan.checks);
+    for (const [id, status] of entries)
+        L.push(`| ${id} | ${status === "pass" ? "✅ pass" : "❌ fail"} |`);
+    L.push("", `## Findings (${scan.findings.length})`, "");
+    if (scan.findings.length === 0) {
+        L.push("✅ No issues detected.", "");
+    }
+    else {
+        const bySeverity = new Map();
+        for (const f of scan.findings) {
+            const list = bySeverity.get(f.severity) ?? [];
+            list.push(f);
+            bySeverity.set(f.severity, list);
+        }
+        for (const sev of ["critical", "warning", "info"]) {
+            const list = bySeverity.get(sev);
+            if (!list || list.length === 0)
+                continue;
+            L.push(`### ${sev.toUpperCase()} (${list.length})`, "");
+            for (const f of list) {
+                L.push(`- **[${f.check_id}]** ${f.message}`);
+                if (f.location)
+                    L.push(`  - Location: ${f.location}`);
+                if (f.suggestion)
+                    L.push(`  - Suggestion: ${f.suggestion}`);
+                L.push("");
+            }
+        }
+    }
+    L.push("---", "", "*End of report.*");
+    return L.join("\n");
+}
+export const DEPLOYMENT_SCANNER_VERSION = "2.0.0";