@wowok/agent-mcp 2.4.3 → 2.5.1

package/dist/knowledge/registrar-risk.js

@@ -0,0 +1,217 @@
+import { MAX_ADDRESS_COUNT, MAX_RECORD_COUNT_REGISTRAR, MAX_RECORD_LENGTH, } from "@wowok/wowok";
+const BIT_NO_INFO = 0x00;
+const BIT_LIKE = 0x02;
+const BIT_DISLIKE = 0x04;
+const BIT_AFFILIATION = 0x08;
+const R_REG_01 = {
+    rule: {
+        id: "R-REG-01",
+        level: "HIGH",
+        category: "lifecycle",
+        title: "Entity and Registrar are system singletons — cannot be migrated post-deploy",
+        description: "Entity and Registrar are created once at package init by @0x0 (registrar.move:152-166) " +
+            "and are globally unique. They cannot be re-created, migrated, or re-initialized. If " +
+            "the singleton's storage layout needs to change (e.g. ParentTable schema), the only " +
+            "option is a new package version with a migration path. There is no in-place migration " +
+            "API. All 22 objects depend on these singletons via affiliation, so a migration would " +
+            "cascade to every object.",
+        affected_stakeholders: ["system", "user"],
+        scenario: "Operator wants to migrate Entity to a new schema; no migration API exists",
+        mitigation: "Confirm the schema before deployment. For schema evolution, plan a new package " +
+            "version with an explicit migration script. Never assume the singleton can be 'reset'.",
+        auto_fixable: false,
+    },
+    check: (ctx) => {
+        if (!ctx.expects_singleton_migration)
+            return null;
+        return { ...R_REG_01.rule, evidence: "expects_singleton_migration=true (no migration API)" };
+    },
+};
+const R_REG_02 = {
+    rule: {
+        id: "R-REG-02",
+        level: "MEDIUM",
+        category: "structural",
+        title: `MAX_ADDRESS_COUNT=${MAX_ADDRESS_COUNT} may be insufficient for large deployments`,
+        description: `The Entity and Registrar ParentTables are bounded by MAX_ADDRESS_COUNT=${MAX_ADDRESS_COUNT} ` +
+            `(registrar.move). Exceeding the cap aborts address registration. For mass-market ` +
+            `applications, ${MAX_ADDRESS_COUNT} entries may be too few; the limit is a single ` +
+            `Move constant that requires a package upgrade to change.`,
+        affected_stakeholders: ["system", "user"],
+        scenario: "Popular service reaches 5200 registered users; new registrations abort",
+        mitigation: "Monitor address_count. Plan a package upgrade that raises MAX_ADDRESS_COUNT before " +
+            "hitting the cap. For shardable workloads, consider multiple Entity tables in a future " +
+            "package version.",
+        auto_fixable: false,
+    },
+    check: (ctx) => {
+        if (ctx.address_count === undefined)
+            return null;
+        if (ctx.address_count < MAX_ADDRESS_COUNT)
+            return null;
+        return { ...R_REG_02.rule, evidence: `address_count=${ctx.address_count}, limit=${MAX_ADDRESS_COUNT}` };
+    },
+};
+const R_REG_03 = {
+    rule: {
+        id: "R-REG-03",
+        level: "MEDIUM",
+        category: "semantic",
+        title: `Vote.info uses u8 bitmask — bits 4-7 reserved, future expansion must stay compatible`,
+        description: `Vote.info is a u8 bitmask: BIT_NO_INFO=${BIT_NO_INFO}, BIT_LIKE=${BIT_LIKE}, ` +
+            `BIT_DISLIKE=${BIT_DISLIKE}, BIT_AFFILIATION=${BIT_AFFILIATION}. Bits 4-7 are reserved. ` +
+            `A future version that repurposes bits 4-7 would conflict with any off-chain code that ` +
+            `reads the raw byte. The reserved bits MUST be treated as zero today; non-zero values ` +
+            `in bits 4-7 indicate a forward-incompatible voter.`,
+        affected_stakeholders: ["voter", "system"],
+        scenario: "Future version assigns bit 4 to a new flag; old indexers misread the byte",
+        mitigation: "Off-chain code must mask to bits 0-3 today and ignore bits 4-7. When a new flag is " +
+            "assigned, ship a coordinated Move + SDK + indexer update.",
+        auto_fixable: false,
+    },
+    check: (ctx) => {
+        if (!ctx.uses_reserved_vote_bits)
+            return null;
+        return { ...R_REG_03.rule, evidence: "uses_reserved_vote_bits=true (bits 4-7 are reserved)" };
+    },
+};
+const R_REG_05 = {
+    rule: {
+        id: "R-REG-05",
+        level: "MEDIUM",
+        category: "cross_object",
+        title: "affiliation / disaffiliation emit no events — indexers must poll Registrar.table",
+        description: "affiliation, disaffiliation, and affiliation_change (registrar.move) mutate the " +
+            "Registrar dependency graph but emit no events. External indexers that track the " +
+            "object-dependency graph cannot rely on an event stream; they must poll the " +
+            "ParentTable, which is expensive as the graph grows.",
+        affected_stakeholders: ["system"],
+        scenario: "Indexer expects an AffiliationEvent; none is emitted, dependency graph is stale",
+        mitigation: "Indexers should poll Registrar.table on a cadence and diff. Future versions may add " +
+            "AffiliationEvent; until then, do not build critical UX on affiliation event streams.",
+        auto_fixable: false,
+    },
+    check: (ctx) => {
+        if (!ctx.expects_affiliation_event)
+            return null;
+        return { ...R_REG_05.rule, evidence: "expects_affiliation_event=true (no events)" };
+    },
+};
+const R_REG_04 = {
+    rule: {
+        id: "R-REG-04",
+        level: "LOW",
+        category: "lifecycle",
+        title: "entity_register is idempotent — returns existing Resource, not a fresh one",
+        description: "entity_register (registrar.move:177-187) checks whether the sender already has an " +
+            "Entity record. If so, it returns the existing Resource address without creating a new " +
+            "one. Callers who expect a fresh Resource on each call (e.g. after a forced destroy) " +
+            "will silently receive the old one. Use entity_register_with_resource_forced to " +
+            "force-reallocate, and only when the old Resource is truly gone.",
+        affected_stakeholders: ["user"],
+        scenario: "User destroys their Resource then calls entity_register; gets the old (now-invalid) address",
+        mitigation: "Document the idempotent behavior. After a forced destroy, callers MUST use " +
+            "entity_register_with_resource_forced. SDK should detect destroyed Resource and route " +
+            "accordingly.",
+        auto_fixable: false,
+    },
+    check: (ctx) => {
+        if (!ctx.expects_fresh_resource_on_register)
+            return null;
+        return { ...R_REG_04.rule, evidence: "expects_fresh_resource_on_register=true (idempotent)" };
+    },
+};
+const R_REG_06 = {
+    rule: {
+        id: "R-REG-06",
+        level: "LOW",
+        category: "semantic",
+        title: "Record.typed_value first byte is a ValueType — convention enforced only by docs",
+        description: "Record.typed_value is a vector<u8> whose first byte encodes the ValueType (registrar.move:111). " +
+            "The Move layer validates that the vector is non-empty and within MAX_RECORD_LENGTH=" +
+            `${MAX_RECORD_LENGTH}, but it does not validate that the first byte is a known ValueType. ` +
+            `Off-chain consumers must agree on the ValueType byte layout; a misencoded record will ` +
+            `deserialize to garbage without an on-chain abort. Record count is bounded by ` +
+            `MAX_RECORD_COUNT_REGISTRAR=${MAX_RECORD_COUNT_REGISTRAR}.`,
+        affected_stakeholders: ["user", "system"],
+        scenario: "Caller writes a record with first byte 0xFF; no on-chain error, but consumers cannot decode",
+        mitigation: "SDK must validate the first byte against the ValueType enum before submitting. " +
+            "Document the ValueType byte layout in both Move and SDK. Add a sync test that " +
+            "asserts the ValueType enum matches across layers.",
+        related_move_error: "ERecordTypeEmpty (3) — only catches empty typed_value",
+        auto_fixable: false,
+    },
+    check: (ctx) => {
+        if (!ctx.relies_on_typed_value_convention)
+            return null;
+        return { ...R_REG_06.rule, evidence: "relies_on_typed_value_convention=true (docs-only enforcement)" };
+    },
+};
+const R_REG_07 = {
+    rule: {
+        id: "R-REG-07",
+        level: "MEDIUM",
+        category: "cross_object",
+        title: "entity_resource_transfer detaches Resource from the source address",
+        description: "entity_resource_transfer(resource, new_address, ctx) moves the Resource backing a " +
+            "user's identity mark to a new address. After transfer, the source address has no " +
+            "Resource — any downstream service that keyed identity on the source address loses " +
+            "the binding. There is no automatic forwarding stub left behind.",
+        affected_stakeholders: ["user", "system"],
+        scenario: "User transfers Resource to a new wallet; old-wallet-based services break",
+        mitigation: "Surface a 'transfer will detach the Resource from this address' warning. Consumers " +
+            "should track users by Resource address, not by user address. Provide a migration " +
+            "window where both addresses are valid.",
+        auto_fixable: false,
+    },
+    check: (ctx) => {
+        if (!ctx.is_resource_transfer)
+            return null;
+        return { ...R_REG_07.rule, evidence: "is_resource_transfer=true (source loses Resource)" };
+    },
+};
+const R_REG_08 = {
+    rule: {
+        id: "R-REG-08",
+        level: "LOW",
+        category: "semantic",
+        title: "Vote.time updates on every toggle — including like→no-like",
+        description: "Vote.time (registrar.move) is set to clock.timestamp_ms() on every like/dislike " +
+            "operation, including toggles that remove a like (like→no-like). Consumers who " +
+            "interpret Vote.time as 'last liked at' will be confused when it advances on an " +
+            "un-like. The field semantically means 'last vote op time', not 'last positive vote'.",
+        affected_stakeholders: ["voter", "system"],
+        scenario: "User un-likes; Vote.time advances; indexer reads it as 'recently liked'",
+        mitigation: "Document Vote.time as 'last vote operation time'. For 'last liked at' semantics, " +
+            "track the previous Vote.info state and only record time when BIT_LIKE transitions to set.",
+        auto_fixable: false,
+    },
+    check: (ctx) => {
+        if (!ctx.expects_vote_time_only_on_like)
+            return null;
+        return { ...R_REG_08.rule, evidence: "expects_vote_time_only_on_like=true (updates on toggle)" };
+    },
+};
+export const REGISTRAR_RISK_RULES = [
+    R_REG_01,
+    R_REG_02,
+    R_REG_03,
+    R_REG_04,
+    R_REG_05,
+    R_REG_06,
+    R_REG_07,
+    R_REG_08,
+];
+export const REGISTRAR_RISK_VERSION = "1.0.0";
+export function checkRegistrarRisks(ctx) {
+    const risks = [];
+    for (const rule of REGISTRAR_RISK_RULES) {
+        const r = rule.check(ctx);
+        if (r)
+            risks.push(r);
+    }
+    return risks;
+}
+export function getRegistrarRiskById(id) {
+    return REGISTRAR_RISK_RULES.find(r => r.rule.id === id)?.rule;
+}

package/dist/knowledge/repository-confirm.d.ts

@@ -0,0 +1,36 @@
+export type ConfirmSeverity = "block" | "warn" | "info";
+export interface RepositoryConfirmItem {
+    id: string;
+    severity: ConfirmSeverity;
+    title: string;
+    description: string;
+    passed: boolean;
+    evidence?: string;
+    fix_hint?: string;
+}
+export interface RepositoryPolicyInput {
+    name: string;
+    description?: string;
+    id_from: number | string;
+    write_guard_count: number;
+    has_id_from_submission: boolean;
+    has_data_from_submission: boolean;
+}
+export interface RepositoryOpCheckInput {
+    op: "create" | "policy_add" | "policy_set" | "data_add" | "data_remove" | "rewards";
+    policies?: RepositoryPolicyInput[];
+    existing_policy_count?: number;
+    data_size?: number;
+    id_count_once?: number;
+    reward_count?: number;
+    is_data_remove_with_passport?: boolean;
+    description?: string;
+}
+export declare function preCheckRepositoryOp(input: RepositoryOpCheckInput): RepositoryConfirmItem[];
+export declare function canProceedRepositoryOp(input: RepositoryOpCheckInput): {
+    canProceed: boolean;
+    blockers: RepositoryConfirmItem[];
+    warnings: RepositoryConfirmItem[];
+    info: RepositoryConfirmItem[];
+};
+export declare function formatRepositoryOpSummary(input: RepositoryOpCheckInput): string;

package/dist/knowledge/repository-confirm.js

@@ -0,0 +1,242 @@
+import { MAX_POLICY_COUNT, MAX_POLICY_DESCRIPTION_LEN, MAX_POLICY_GUARD_COUNT, MAX_DATA_SIZE, MAX_ID_COUNT_ONCE, MAX_REWARD_COUNT, } from "@wowok/wowok";
+function normalizeIdFrom(v) {
+    if (typeof v === "number")
+        return v;
+    const lower = String(v).toLowerCase();
+    if (lower === "none")
+        return 0;
+    if (lower === "clock")
+        return 1;
+    if (lower === "signer")
+        return 2;
+    const parsed = Number(v);
+    return Number.isNaN(parsed) ? -1 : parsed;
+}
+function checkPolicyCount(input) {
+    if (!input.policies || input.existing_policy_count === undefined) {
+        return {
+            id: "C-REP-01",
+            severity: "info",
+            title: `Policy count within MAX_POLICY_COUNT (${MAX_POLICY_COUNT})`,
+            description: "Skipped: no policy count provided.",
+            passed: true,
+        };
+    }
+    const total = input.existing_policy_count + input.policies.length;
+    const passed = total <= MAX_POLICY_COUNT;
+    return {
+        id: "C-REP-01",
+        severity: passed ? "info" : "block",
+        title: `Policy count within MAX_POLICY_COUNT (${MAX_POLICY_COUNT})`,
+        description: "A single Repository may hold up to MAX_POLICY_COUNT policies. Exceeding aborts with E_POLICY_COUNT_EXCEEDED (3). " +
+            "Each policy is a named data slot with its own write_guard and id_from routing.",
+        passed,
+        evidence: `existing=${input.existing_policy_count}, adding=${input.policies.length}, total=${total}`,
+        fix_hint: `Consolidate or split across multiple Repository objects. Limit=${MAX_POLICY_COUNT}.`,
+    };
+}
+function checkWriteGuardRequiredWhenIdFromNone(input) {
+    if (!input.policies) {
+        return { id: "C-REP-02", severity: "info", title: "write_guard/id_from consistency (R-D-1)", description: "Skipped: no policies.", passed: true };
+    }
+    const offenders = input.policies.filter(p => normalizeIdFrom(p.id_from) === 0 && p.write_guard_count === 0);
+    const passed = offenders.length === 0;
+    return {
+        id: "C-REP-02",
+        severity: passed ? "info" : "block",
+        title: "write_guard non-empty when id_from=None (R-D-1 Move assert)",
+        description: "When id_from is None, the data ID comes from the caller — without write_guard, ANY address can write " +
+            "data with any ID. Move aborts with E_POLICY_WRITE_GUARD_REQUIRED (22) in policy_add_imp() [R-D-1=A].",
+        passed,
+        evidence: passed ? "all policies with id_from=None have write_guard" :
+            `offenders: ${offenders.map(p => p.name).join(", ")}`,
+        fix_hint: "Add at least one PolicyGuard to write_guard, OR switch id_from to Clock/Signer.",
+    };
+}
+function checkWriteGuardForbiddenWhenIdFromClockSigner(input) {
+    if (!input.policies) {
+        return { id: "C-REP-03", severity: "info", title: "id_from_submission null when id_from=Clock/Signer (R-D-1)", description: "Skipped: no policies.", passed: true };
+    }
+    const offenders = input.policies.filter(p => {
+        const idFrom = normalizeIdFrom(p.id_from);
+        return (idFrom === 1 || idFrom === 2) && p.has_id_from_submission;
+    });
+    const passed = offenders.length === 0;
+    return {
+        id: "C-REP-03",
+        severity: passed ? "info" : "block",
+        title: "id_from_submission null when id_from=Clock/Signer (R-D-1 Move assert)",
+        description: "When id_from is Clock/Signer, the ID is auto-generated — id_from_submission would conflict. " +
+            "data_from_submission is still allowed (used by data_when_id_from_set_with_passport). " +
+            "Move aborts with E_POLICY_ID_FROM_SUBMISSION_FORBIDDEN (23) in policy_add_imp() [R-D-1=A, refined].",
+        passed,
+        evidence: passed ? "all policies with id_from=Clock/Signer have id_from_submission=null" :
+            `offenders: ${offenders.map(p => `${p.name}(id_from=${p.id_from})`).join(", ")}`,
+        fix_hint: "Set id_from_submission=null on all write_guard entries, OR switch id_from to None.",
+    };
+}
+function checkPolicyGuardCount(input) {
+    if (!input.policies) {
+        return { id: "C-REP-04", severity: "info", title: `write_guard count ≤ ${MAX_POLICY_GUARD_COUNT}`, description: "Skipped: no policies.", passed: true };
+    }
+    const offenders = input.policies.filter(p => p.write_guard_count > MAX_POLICY_GUARD_COUNT);
+    const passed = offenders.length === 0;
+    return {
+        id: "C-REP-04",
+        severity: passed ? "info" : "block",
+        title: `Each policy write_guard count ≤ MAX_POLICY_GUARD_COUNT (${MAX_POLICY_GUARD_COUNT})`,
+        description: "Each policy may define up to MAX_POLICY_GUARD_COUNT guard entries. Move aborts with E_POLICY_GUARD_COUNT_EXCEEDED (2).",
+        passed,
+        evidence: passed ? "all policies within limit" :
+            `offenders: ${offenders.map(p => `${p.name}(${p.write_guard_count})`).join(", ")}`,
+        fix_hint: `Reduce write_guard entries to ≤ ${MAX_POLICY_GUARD_COUNT} per policy.`,
+    };
+}
+function checkPolicyDescription(input) {
+    if (!input.policies) {
+        return { id: "C-REP-05", severity: "info", title: `Policy description ≤ ${MAX_POLICY_DESCRIPTION_LEN}`, description: "Skipped: no policies.", passed: true };
+    }
+    const offenders = input.policies.filter(p => p.description !== undefined && p.description.length > MAX_POLICY_DESCRIPTION_LEN);
+    const passed = offenders.length === 0;
+    return {
+        id: "C-REP-05",
+        severity: passed ? "info" : "block",
+        title: `Each policy description ≤ MAX_POLICY_DESCRIPTION_LEN (${MAX_POLICY_DESCRIPTION_LEN})`,
+        description: "Policy description is bounded by MAX_POLICY_DESCRIPTION_LEN. Move aborts with E_POLICY_DESCRIPTION_EXCEEDED (1).",
+        passed,
+        evidence: passed ? "all descriptions within limit" :
+            `offenders: ${offenders.map(p => `${p.name}(len=${p.description.length})`).join(", ")}`,
+        fix_hint: `Shorten policy descriptions to ≤ ${MAX_POLICY_DESCRIPTION_LEN} chars.`,
+    };
+}
+function checkDataSize(input) {
+    if (input.data_size === undefined) {
+        return { id: "C-REP-06", severity: "info", title: `Data value ≤ MAX_DATA_SIZE (${MAX_DATA_SIZE})`, description: "Skipped: no data_size.", passed: true };
+    }
+    const passed = input.data_size <= MAX_DATA_SIZE;
+    return {
+        id: "C-REP-06",
+        severity: passed ? "info" : "block",
+        title: `Data value ≤ MAX_DATA_SIZE (${MAX_DATA_SIZE} bytes)`,
+        description: "Each data value must be ≤ MAX_DATA_SIZE bytes (BCS-serialized, type-tag prefixed). Move aborts with E_DATA_EXCEEDED (4). " +
+            "Store large payloads off-chain and reference by hash.",
+        passed,
+        evidence: `data_size=${input.data_size}, limit=${MAX_DATA_SIZE}`,
+        fix_hint: `Store large data off-chain; write only the content hash. Limit=${MAX_DATA_SIZE} bytes.`,
+    };
+}
+function checkIdCountOnce(input) {
+    if (input.id_count_once === undefined) {
+        return { id: "C-REP-07", severity: "info", title: `ID count ≤ MAX_ID_COUNT_ONCE (${MAX_ID_COUNT_ONCE})`, description: "Skipped: no id_count.", passed: true };
+    }
+    const passed = input.id_count_once <= MAX_ID_COUNT_ONCE;
+    return {
+        id: "C-REP-07",
+        severity: passed ? "info" : "block",
+        title: `ID count per op ≤ MAX_ID_COUNT_ONCE (${MAX_ID_COUNT_ONCE})`,
+        description: "A single Repository call may operate on at most MAX_ID_COUNT_ONCE IDs. Move aborts with E_ID_COUNT_EXCEEDED (5). " +
+            "Batch large operations across multiple transactions.",
+        passed,
+        evidence: `id_count=${input.id_count_once}, limit=${MAX_ID_COUNT_ONCE}`,
+        fix_hint: `Split into batches of ≤ ${MAX_ID_COUNT_ONCE} IDs per transaction.`,
+    };
+}
+function checkRewardCount(input) {
+    if (input.reward_count === undefined) {
+        return { id: "C-REP-08", severity: "info", title: `Reward count ≤ MAX_REWARD_COUNT (${MAX_REWARD_COUNT})`, description: "Skipped: no reward_count.", passed: true };
+    }
+    const passed = input.reward_count <= MAX_REWARD_COUNT;
+    return {
+        id: "C-REP-08",
+        severity: passed ? "info" : "block",
+        title: `Reward count ≤ MAX_REWARD_COUNT (${MAX_REWARD_COUNT})`,
+        description: "A Repository may reference up to MAX_REWARD_COUNT Reward objects. Move aborts with E_MAX_REWARD_COUNT_EXCEEDED (19).",
+        passed,
+        evidence: `reward_count=${input.reward_count}, limit=${MAX_REWARD_COUNT}`,
+        fix_hint: `Consolidate rewards or use a separate Repository. Limit=${MAX_REWARD_COUNT}.`,
+    };
+}
+function checkDataRemoveWithPassportSubmission(input) {
+    if (!input.is_data_remove_with_passport || !input.policies) {
+        return { id: "C-REP-09", severity: "info", title: "id_data_remove_with_passport submission check (R-D-2)", description: "Skipped: not applicable.", passed: true };
+    }
+    const offenders = input.policies.filter(p => p.has_data_from_submission);
+    const passed = offenders.length === 0;
+    return {
+        id: "C-REP-09",
+        severity: passed ? "info" : "block",
+        title: "id_data_remove_with_passport: no data_from_submission (R-D-2 Move assert)",
+        description: "id_data_remove_with_passport only removes data by caller-provided id; it cannot consume Passport " +
+            "submissions. Move now checks BOTH id_from_submission AND data_from_submission are None [R-D-2=A], " +
+            "aborting with E_GUARD_SPECIFIED_ID_FROM_SUBMISSION (11).",
+        passed,
+        evidence: passed ? "no policies with data_from_submission" :
+            `offenders: ${offenders.map(p => p.name).join(", ")}`,
+        fix_hint: "Use id_data_mixed_remove_with_passport for submission-based removal, or unset data_from_submission.",
+    };
+}
+function checkIdFromString(input) {
+    if (!input.policies) {
+        return { id: "C-REP-10", severity: "info", title: "id_from string form valid (P1-2 parseIdFrom)", description: "Skipped: no policies.", passed: true };
+    }
+    const offenders = input.policies.filter(p => {
+        const n = normalizeIdFrom(p.id_from);
+        return n < 0 || n > 2;
+    });
+    const passed = offenders.length === 0;
+    return {
+        id: "C-REP-10",
+        severity: passed ? "info" : "warn",
+        title: "id_from string form is recognized (P1-2 parseIdFrom)",
+        description: "SDK parseIdFrom normalizes string id_from (e.g. \"none\"/\"clock\"/\"signer\") to numeric enum before " +
+            "comparison [P1-2 fix]. Unrecognized values fall through to Move which aborts with E_INVALID_ID_FROM (18).",
+        passed,
+        evidence: passed ? "all id_from values recognized" :
+            `offenders: ${offenders.map(p => `${p.name}(id_from=${p.id_from})`).join(", ")}`,
+        fix_hint: "Use 0/1/2, or 'None'/'Clock'/'Signer' (case-insensitive).",
+    };
+}
+export function preCheckRepositoryOp(input) {
+    return [
+        checkPolicyCount(input),
+        checkWriteGuardRequiredWhenIdFromNone(input),
+        checkWriteGuardForbiddenWhenIdFromClockSigner(input),
+        checkPolicyGuardCount(input),
+        checkPolicyDescription(input),
+        checkDataSize(input),
+        checkIdCountOnce(input),
+        checkRewardCount(input),
+        checkDataRemoveWithPassportSubmission(input),
+        checkIdFromString(input),
+    ];
+}
+export function canProceedRepositoryOp(input) {
+    const items = preCheckRepositoryOp(input);
+    return {
+        canProceed: items.every(i => i.severity !== "block" || i.passed),
+        blockers: items.filter(i => i.severity === "block" && !i.passed),
+        warnings: items.filter(i => i.severity === "warn" && !i.passed),
+        info: items.filter(i => i.severity === "info"),
+    };
+}
+export function formatRepositoryOpSummary(input) {
+    const { canProceed, blockers, warnings, info } = canProceedRepositoryOp(input);
+    const lines = [];
+    lines.push(canProceed ? `✓ Repository ${input.op} pre-check PASSED` : `✗ Repository ${input.op} pre-check FAILED`);
+    lines.push("");
+    if (blockers.length > 0) {
+        lines.push("BLOCKERS (must fix before operation):");
+        blockers.forEach(b => lines.push(`  [${b.id}] ${b.title} — ${b.evidence ?? ""}`));
+        lines.push("");
+    }
+    if (warnings.length > 0) {
+        lines.push("WARNINGS (review recommended):");
+        warnings.forEach(w => lines.push(`  [${w.id}] ${w.title} — ${w.evidence ?? ""}`));
+        lines.push("");
+    }
+    if (info.length > 0) {
+        lines.push("INFO:");
+        info.forEach(i => lines.push(`  [${i.id}] ${i.title}`));
+    }
+    return lines.join("\n");
+}

package/dist/knowledge/repository-risk.d.ts

@@ -0,0 +1,40 @@
+export type RepositoryRiskLevel = "CRITICAL" | "HIGH" | "MEDIUM" | "LOW" | "INFO";
+export type RepositoryRiskCategory = "structural" | "policy" | "routing" | "submission" | "knowledge";
+export type RepositoryStakeholder = "creator" | "writer" | "reader" | "verifier" | "system";
+export interface RepositoryRisk {
+    id: string;
+    level: RepositoryRiskLevel;
+    category: RepositoryRiskCategory;
+    title: string;
+    description: string;
+    affected_stakeholders: RepositoryStakeholder[];
+    scenario: string;
+    mitigation: string;
+    evidence?: string;
+    related_move_error?: string;
+    auto_fixable: boolean;
+}
+export interface RepositoryRiskCheckContext {
+    policies?: Array<{
+        name: string;
+        description?: string;
+        id_from: number | string;
+        write_guard_count: number;
+        has_id_from_submission: boolean;
+        has_data_from_submission: boolean;
+    }>;
+    existing_policy_count?: number;
+    data_size?: number;
+    id_count_once?: number;
+    reward_count?: number;
+    is_data_remove_with_passport?: boolean;
+    constants_synced?: boolean;
+}
+declare function normalizeIdFrom(v: number | string): number;
+export declare const REPOSITORY_RISK_RULES: {
+    rule: RepositoryRisk;
+    check: (ctx: RepositoryRiskCheckContext) => RepositoryRisk | null;
+}[];
+export declare function checkRepositoryRisks(ctx: RepositoryRiskCheckContext): RepositoryRisk[];
+export declare function getRepositoryRiskById(id: string): RepositoryRisk | undefined;
+export { normalizeIdFrom as parseIdFromForRiskCheck };