@wowok/agent-mcp 2.7.0 → 2.7.2

package/dist/knowledge/repository-risk.js

@@ -1,373 +1 @@
-import { MAX_POLICY_COUNT, MAX_POLICY_GUARD_COUNT, MAX_DATA_SIZE, MAX_ID_COUNT_ONCE, MAX_REWARD_COUNT, } from "@wowok/wowok";
-function normalizeIdFrom(v) {
-    if (typeof v === "number")
-        return v;
-    const lower = String(v).toLowerCase();
-    if (lower === "none")
-        return 0;
-    if (lower === "clock")
-        return 1;
-    if (lower === "signer")
-        return 2;
-    const parsed = Number(v);
-    return Number.isNaN(parsed) ? -1 : parsed;
-}
-const R_REP_1_01 = {
-    rule: {
-        id: "R-REP-01",
-        level: "MEDIUM",
-        category: "structural",
-        title: `Policy count exceeds MAX_POLICY_COUNT (${MAX_POLICY_COUNT})`,
-        description: `A single Repository may hold up to MAX_POLICY_COUNT=${MAX_POLICY_COUNT} policies (Move source: repository.move:22). ` +
-            `Exceeding this limit aborts with E_POLICY_COUNT_EXCEEDED (3) in policy_add_imp(). Each policy defines a named ` +
-            `data slot with its own write_guard list and id_from routing — having too many policies makes the Repository ` +
-            `hard to audit and increases gas cost for policy lookups (O(n) scan in policy_by_name).`,
-        affected_stakeholders: ["creator"],
-        scenario: "Caller adds 51 policies to a single Repository",
-        mitigation: "Consolidate related data under fewer policies. If truly needed, split data across multiple Repository " +
-            "objects and reference them via Service.repository or Progress.context_repositories.",
-        related_move_error: "E_POLICY_COUNT_EXCEEDED (3)",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.policies || ctx.existing_policy_count === undefined)
-            return null;
-        const total = ctx.existing_policy_count + ctx.policies.length;
-        if (total <= MAX_POLICY_COUNT)
-            return null;
-        return { ...R_REP_1_01.rule, evidence: `existing=${ctx.existing_policy_count}, adding=${ctx.policies.length}, total=${total}, limit=${MAX_POLICY_COUNT}` };
-    },
-};
-const R_REP_2_01 = {
-    rule: {
-        id: "R-REP-02",
-        level: "HIGH",
-        category: "policy",
-        title: `write_guard empty when id_from=None — unauthorized writes (R-D-1 Move assert)`,
-        description: "When id_from is None, the data ID must be provided by the caller (via id_data_with_passport or " +
-            "id_data_mixed_with_passport). Without a write_guard, ANY address can write data with any ID — this " +
-            "is almost certainly a misconfiguration. The Move contract now enforces this via " +
-            "E_POLICY_WRITE_GUARD_REQUIRED (22) in policy_add_imp() [R-D-1=A].",
-        affected_stakeholders: ["creator", "writer"],
-        scenario: "Caller creates a policy with id_from=None and empty write_guard list",
-        mitigation: "When id_from=None, provide at least one PolicyGuard entry in write_guard. If you want unrestricted " +
-            "writes, use id_from=Clock or id_from=Signer instead (which auto-generates the ID and requires empty write_guard).",
-        related_move_error: "E_POLICY_WRITE_GUARD_REQUIRED (22)",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.policies)
-            return null;
-        const offenders = ctx.policies.filter(p => normalizeIdFrom(p.id_from) === 0 && p.write_guard_count === 0);
-        if (offenders.length === 0)
-            return null;
-        return {
-            ...R_REP_2_01.rule,
-            evidence: `policies with id_from=None + empty write_guard: ${offenders.map(p => p.name).join(", ")}`,
-        };
-    },
-};
-const R_REP_2_02 = {
-    rule: {
-        id: "R-REP-03",
-        level: "HIGH",
-        category: "policy",
-        title: `id_from_submission set when id_from=Clock/Signer — id routing conflict (R-D-1 Move assert)`,
-        description: "When id_from is Clock or Signer, the data ID is auto-generated (timestamp or signer address). " +
-            "A PolicyGuard with id_from_submission set would try to route the id from a Passport submission, " +
-            "conflicting with the auto-generated id_from path. The Move contract enforces that id_from_submission " +
-            "MUST be None for every PolicyGuard when id_from is Clock/Signer (data_from_submission is still " +
-            "allowed — it is used by data_when_id_from_set_with_passport to extract data from the submission). " +
-            "Violations abort with E_POLICY_ID_FROM_SUBMISSION_FORBIDDEN (23) in policy_add_imp() [R-D-1=A, refined].",
-        affected_stakeholders: ["creator", "writer"],
-        scenario: "Caller creates a policy with id_from=Clock and a write_guard entry whose id_from_submission is set",
-        mitigation: "When id_from=Clock or Signer, ensure every PolicyGuard has id_from_submission=null. " +
-            "data_from_submission may still be set if you want the guard to supply the data payload " +
-            "(routed via data_when_id_from_set_with_passport). If you need submission-derived ids, " +
-            "switch to id_from=None and set id_from_submission on the guard.",
-        related_move_error: "E_POLICY_ID_FROM_SUBMISSION_FORBIDDEN (23)",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.policies)
-            return null;
-        const offenders = ctx.policies.filter(p => {
-            const idFrom = normalizeIdFrom(p.id_from);
-            return (idFrom === 1 || idFrom === 2) && p.has_id_from_submission;
-        });
-        if (offenders.length === 0)
-            return null;
-        return {
-            ...R_REP_2_02.rule,
-            evidence: `policies with id_from=Clock/Signer + id_from_submission set: ${offenders.map(p => `${p.name}(id_from=${p.id_from})`).join(", ")}`,
-        };
-    },
-};
-const R_REP_1_02 = {
-    rule: {
-        id: "R-REP-04",
-        level: "MEDIUM",
-        category: "structural",
-        title: `Policy write_guard count exceeds MAX_POLICY_GUARD_COUNT (${MAX_POLICY_GUARD_COUNT})`,
-        description: `Each policy may define up to MAX_POLICY_GUARD_COUNT=${MAX_POLICY_GUARD_COUNT} guard entries in its write_guard list ` +
-            `(Move source: repository.move:23). Exceeding this limit aborts with E_POLICY_GUARD_COUNT_EXCEEDED (2). ` +
-            `Each entry maps to a Guard object that must be verified via Passport submission, so more guards = ` +
-            `more complex write authorization semantics.`,
-        affected_stakeholders: ["creator"],
-        scenario: "Caller creates a policy with 11 guard entries in write_guard",
-        mitigation: "Consolidate guard logic. If multiple guards must verify the same data, consider composing them into a " +
-            "single Guard with relies/rep fields, or split the data across multiple policies with fewer guards each.",
-        related_move_error: "E_POLICY_GUARD_COUNT_EXCEEDED (2)",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.policies)
-            return null;
-        const offenders = ctx.policies.filter(p => p.write_guard_count > MAX_POLICY_GUARD_COUNT);
-        if (offenders.length === 0)
-            return null;
-        return {
-            ...R_REP_1_02.rule,
-            evidence: `policies exceeding guard count: ${offenders.map(p => `${p.name}(${p.write_guard_count})`).join(", ")}`,
-        };
-    },
-};
-const R_REP_1_03 = {
-    rule: {
-        id: "R-REP-05",
-        level: "MEDIUM",
-        category: "structural",
-        title: `Data value exceeds MAX_DATA_SIZE (${MAX_DATA_SIZE} bytes)`,
-        description: `A single Repository data value must be ≤ MAX_DATA_SIZE=${MAX_DATA_SIZE} bytes (Move source: repository.move:24). ` +
-            `Exceeding this limit aborts with E_DATA_EXCEEDED (4). The value is stored as a BCS-serialized vector<u8> ` +
-            `with a type-tag prefix byte. Large data should be stored off-chain (e.g. IPFS, Walrus) and referenced ` +
-            `by hash/address, NOT inlined into the Repository data value.`,
-        affected_stakeholders: ["writer"],
-        scenario: "Caller writes a 50KB JSON blob as a Repository data value",
-        mitigation: "Store large payloads off-chain and write only the content hash (32-64 bytes) to the Repository. " +
-            "Use about_address on a Proof object to bind the off-chain data to an on-chain attestation.",
-        related_move_error: "E_DATA_EXCEEDED (4)",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (ctx.data_size === undefined)
-            return null;
-        if (ctx.data_size <= MAX_DATA_SIZE)
-            return null;
-        return { ...R_REP_1_03.rule, evidence: `data_size=${ctx.data_size}, limit=${MAX_DATA_SIZE}` };
-    },
-};
-const R_REP_3_01 = {
-    rule: {
-        id: "R-REP-06",
-        level: "LOW",
-        category: "routing",
-        title: `Policy has data_from_submission but no id_from_submission — verify Mode 5 routing intent`,
-        description: "When a PolicyGuard has data_from_submission set (data comes from Passport submission) but no " +
-            "id_from_submission (id comes from caller), the SDK routes to id_data_mixed_with_passport (Mode 5). " +
-            "This is a valid but advanced pattern — ensure the caller provides matching id vectors. The SDK " +
-            "hasSubmissionSettings helper now correctly detects this case [P1-1 fix, R-D-3=A].",
-        affected_stakeholders: ["creator", "writer"],
-        scenario: "Policy has a guard with data_from_submission=2, id_from_submission=undefined",
-        mitigation: "Document the expected caller input shape. Ensure the caller provides both the id vector (positional) " +
-            "and the Passport submission (for data). Verify routing via the SDK hasSubmissionSettings helper.",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.policies)
-            return null;
-        const offenders = ctx.policies.filter(p => p.has_data_from_submission && !p.has_id_from_submission);
-        if (offenders.length === 0)
-            return null;
-        return {
-            ...R_REP_3_01.rule,
-            evidence: `policies with data_from_submission but no id_from_submission: ${offenders.map(p => p.name).join(", ")}`,
-        };
-    },
-};
-const R_REP_4_01 = {
-    rule: {
-        id: "R-REP-07",
-        level: "HIGH",
-        category: "submission",
-        title: `data_from_submission set on a policy used in id_data_remove_with_passport — Move will abort (R-D-2)`,
-        description: "id_data_remove_with_passport only removes data identified by the caller-provided id vector; it " +
-            "cannot consume Passport submissions for either id or data. The Move contract now enforces that BOTH " +
-            "id_from_submission AND data_from_submission MUST be None for this entry point [R-D-2=A], aborting " +
-            "with E_GUARD_SPECIFIED_ID_FROM_SUBMISSION (11). Previously, only id_from_submission was checked, " +
-            "allowing data_from_submission to be silently ignored — masking a routing bug.",
-        affected_stakeholders: ["writer", "verifier"],
-        scenario: "Caller uses id_data_remove_with_passport on a policy whose guard has data_from_submission=2",
-        mitigation: "For data removal via Passport, use id_data_mixed_remove_with_passport instead (which requires " +
-            "id_from_submission and derives the id from the submission). Do not set data_from_submission on " +
-            "policies intended for id_data_remove_with_passport.",
-        related_move_error: "E_GUARD_SPECIFIED_ID_FROM_SUBMISSION (11)",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.is_data_remove_with_passport || !ctx.policies)
-            return null;
-        const offenders = ctx.policies.filter(p => p.has_data_from_submission);
-        if (offenders.length === 0)
-            return null;
-        return {
-            ...R_REP_4_01.rule,
-            evidence: `policies with data_from_submission used in id_data_remove_with_passport: ${offenders.map(p => p.name).join(", ")}`,
-        };
-    },
-};
-const R_REP_1_04 = {
-    rule: {
-        id: "R-REP-08",
-        level: "LOW",
-        category: "structural",
-        title: `ID count per single op exceeds MAX_ID_COUNT_ONCE (${MAX_ID_COUNT_ONCE})`,
-        description: `A single Repository call (data_add, data_remove, id_data_*) may operate on at most ` +
-            `MAX_ID_COUNT_ONCE=${MAX_ID_COUNT_ONCE} IDs (Move source: repository.move:25). Exceeding this limit ` +
-            `aborts with E_ID_COUNT_EXCEEDED (5). Batch large operations across multiple transactions.`,
-        affected_stakeholders: ["writer"],
-        scenario: "Caller passes 150 IDs in a single data_remove call",
-        mitigation: `Split into batches of ≤ ${MAX_ID_COUNT_ONCE} IDs per transaction.`,
-        related_move_error: "E_ID_COUNT_EXCEEDED (5)",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (ctx.id_count_once === undefined)
-            return null;
-        if (ctx.id_count_once <= MAX_ID_COUNT_ONCE)
-            return null;
-        return { ...R_REP_1_04.rule, evidence: `id_count=${ctx.id_count_once}, limit=${MAX_ID_COUNT_ONCE}` };
-    },
-};
-const R_REP_1_05 = {
-    rule: {
-        id: "R-REP-09",
-        level: "INFO",
-        category: "structural",
-        title: `Reward count approaches MAX_REWARD_COUNT (${MAX_REWARD_COUNT})`,
-        description: `A Repository may reference up to MAX_REWARD_COUNT=${MAX_REWARD_COUNT} Reward objects (Move source: repository.move:26). ` +
-            `Exceeding this limit aborts with E_MAX_REWARD_COUNT_EXCEEDED (19). Rewards incentivize data contribution; ` +
-            `having many rewards is fine but increases accounting complexity.`,
-        affected_stakeholders: ["creator"],
-        scenario: "Caller adds 20 rewards to a Repository (at the limit)",
-        mitigation: "Monitor reward count. If more incentives are needed, consolidate rewards or use a separate Repository.",
-        related_move_error: "E_MAX_REWARD_COUNT_EXCEEDED (19)",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (ctx.reward_count === undefined)
-            return null;
-        if (ctx.reward_count < MAX_REWARD_COUNT)
-            return null;
-        return { ...R_REP_1_05.rule, evidence: `reward_count=${ctx.reward_count}, limit=${MAX_REWARD_COUNT}` };
-    },
-};
-const R_REP_5_01 = {
-    rule: {
-        id: "R-REP-10",
-        level: "INFO",
-        category: "knowledge",
-        title: "Knowledge layer & constant sync — RESOLVED",
-        description: "All 6 Repository constants (MAX_POLICY_COUNT, MAX_POLICY_DESCRIPTION_LEN, MAX_POLICY_GUARD_COUNT, " +
-            "MAX_DATA_SIZE, MAX_ID_COUNT_ONCE, MAX_REWARD_COUNT) are now synced to onchain-constants.ts. " +
-            "The MCP Knowledge layer now includes repository-risk.ts, repository-confirm.ts, " +
-            "repository-translation.ts (R-D-4=A). The SDK hasSubmissionSettings helper now correctly checks both " +
-            "id_from_submission AND data_from_submission (P1-1). parseIdFrom is used in data/data_remove (P1-2). " +
-            "This risk rule is retained for historical audit and to detect future regressions.",
-        affected_stakeholders: ["system"],
-        scenario: "Future regression: someone removes a Repository constant from onchain-constants.ts",
-        mitigation: "Run the onchain-constants sync test to detect drift.",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (ctx.constants_synced)
-            return null;
-        return { ...R_REP_5_01.rule, evidence: "constants_synced=false" };
-    },
-};
-const R_REP_6_01 = {
-    rule: {
-        id: "R-REP-11",
-        level: "HIGH",
-        category: "policy",
-        title: "quote_guard must be is_depended (immutable + rep=true + no relies) — Move assert",
-        description: "Repository policy's quote_guard must satisfy guard::is_depended (guard.move#L133-135): " +
-            "immutable=true, relies empty, rep=true. This ensures the quote_guard is a stable, " +
-            "repository-querying guard that can be depended upon. Move aborts with " +
-            "E_NEED_DEPENDENT_GUARD (repository.move#L422) if the guard is not is_depended. " +
-            "VERIFIED: passport.rs#L545-612 (check_repository_quote_guard enforces this at query time).",
-        affected_stakeholders: ["creator", "reader"],
-        scenario: "Creator sets quote_guard to a Guard that is not is_depended (e.g., has relies or is mutable)",
-        mitigation: "Ensure the quote_guard Guard object has: immutable=true, relies=empty, rep=true. " +
-            "Use pattern.repository_quote_guard_subscription as the design template.",
-        related_move_error: "E_NEED_DEPENDENT_GUARD",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.has_quote_guard)
-            return null;
-        if (ctx.quote_guard_is_depended)
-            return null;
-        return { ...R_REP_6_01.rule, evidence: "quote_guard set but not is_depended (immutable + rep=true + no relies)" };
-    },
-};
-const R_REP_6_02 = {
-    rule: {
-        id: "R-REP-12",
-        level: "MEDIUM",
-        category: "knowledge",
-        title: "quote_guard data subscription design — verify Payment verification + owner_receive revenue",
-        description: "When using quote_guard for data subscription (Repository+quote_guard+Payment pattern), " +
-            "ensure: (1) quote_guard verifies Payment fields (for_object matches Repository, amount meets price), " +
-            "(2) Repository has owner_receive<T> configured to accept Payment as subscription revenue " +
-            "(repository.move#L714-717). VERIFIED: passport.rs#L545-612, repository.move#L714-717. " +
-            "DESIGN: quote_guard is a RIGID verification requirement — any guard querying this Repository's " +
-            "data MUST satisfy the quote_guard (see R-X1-10 in guard-risk.ts).",
-        affected_stakeholders: ["creator", "reader", "verifier"],
-        scenario: "Creator sets quote_guard but does not configure Payment verification or owner_receive",
-        mitigation: "1) Ensure quote_guard verifies Payment (for_object, amount); " +
-            "2) Configure Repository owner_receive<T> to accept subscription Payment revenue; " +
-            "3) Use pattern.repository_quote_guard_subscription (guard-design-patterns.ts) and " +
-            "tpl_repository_quote_guard_subscription (guard-templates.ts) as design templates.",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.has_quote_guard)
-            return null;
-        if (ctx.quote_guard_verifies_payment && ctx.has_owner_receive)
-            return null;
-        const missing = [];
-        if (!ctx.quote_guard_verifies_payment)
-            missing.push("quote_guard does not verify Payment");
-        if (!ctx.has_owner_receive)
-            missing.push("Repository missing owner_receive for revenue");
-        return { ...R_REP_6_02.rule, evidence: missing.join("; ") };
-    },
-};
-export const REPOSITORY_RISK_RULES = [
-    R_REP_1_01,
-    R_REP_2_01,
-    R_REP_2_02,
-    R_REP_1_02,
-    R_REP_1_03,
-    R_REP_3_01,
-    R_REP_4_01,
-    R_REP_1_04,
-    R_REP_1_05,
-    R_REP_5_01,
-    R_REP_6_01,
-    R_REP_6_02,
-];
-export function checkRepositoryRisks(ctx) {
-    const risks = [];
-    for (const rule of REPOSITORY_RISK_RULES) {
-        const r = rule.check(ctx);
-        if (r)
-            risks.push(r);
-    }
-    return risks;
-}
-export function getRepositoryRiskById(id) {
-    return REPOSITORY_RISK_RULES.find(r => r.rule.id === id)?.rule;
-}
-export { normalizeIdFrom as parseIdFromForRiskCheck };
+import{MAX_POLICY_COUNT,MAX_POLICY_GUARD_COUNT,MAX_DATA_SIZE,MAX_ID_COUNT_ONCE,MAX_REWARD_COUNT}from'@wowok/wowok';function normalizeIdFrom(a){if(typeof a==='number')return a;const b=String(a)['toLowerCase']();if(b==='none')return 0x0;if(b==='clock')return 0x1;if(b==='signer')return 0x2;const c=Number(a);return Number['isNaN'](c)?-0x1:c;}const R_REP_1_01={'rule':{'id':'R-REP-01','level':'MEDIUM','category':'structural','title':'Policy\x20count\x20exceeds\x20MAX_POLICY_COUNT\x20('+MAX_POLICY_COUNT+')','description':'A\x20single\x20Repository\x20may\x20hold\x20up\x20to\x20MAX_POLICY_COUNT='+MAX_POLICY_COUNT+'\x20policies\x20(Move\x20source:\x20repository.move:22).\x20'+'Exceeding\x20this\x20limit\x20aborts\x20with\x20E_POLICY_COUNT_EXCEEDED\x20(3)\x20in\x20policy_add_imp().\x20Each\x20policy\x20defines\x20a\x20named\x20'+'data\x20slot\x20with\x20its\x20own\x20write_guard\x20list\x20and\x20id_from\x20routing\x20—\x20having\x20too\x20many\x20policies\x20makes\x20the\x20Repository\x20'+'hard\x20to\x20audit\x20and\x20increases\x20gas\x20cost\x20for\x20policy\x20lookups\x20(O(n)\x20scan\x20in\x20policy_by_name).','affected_stakeholders':['creator'],'scenario':'Caller\x20adds\x2051\x20policies\x20to\x20a\x20single\x20Repository','mitigation':'Consolidate\x20related\x20data\x20under\x20fewer\x20policies.\x20If\x20truly\x20needed,\x20split\x20data\x20across\x20multiple\x20Repository\x20'+'objects\x20and\x20reference\x20them\x20via\x20Service.repository\x20or\x20Progress.context_repositories.','related_move_error':'E_POLICY_COUNT_EXCEEDED\x20(3)','auto_fixable':![]},'check':a=>{if(!a['policies']||a['existing_policy_count']===undefined)return null;const b=a['existing_policy_count']+a['policies']['length'];if(b<=MAX_POLICY_COUNT)return null;return{...R_REP_1_01['rule'],'evidence':'existing='+a['existing_policy_count']+',\x20adding='+a['policies']['length']+',\x20total='+b+',\x20limit='+MAX_POLICY_COUNT};}},R_REP_2_01={'rule':{'id':'R-REP-02','level':'HIGH','category':'policy','title':'write_guard\x20empty\x20when\x20id_from=None\x20—\x20unauthorized\x20writes\x20(R-D-1\x20Move\x20assert)','description':'When\x20id_from\x20is\x20None,\x20the\x20data\x20ID\x20must\x20be\x20provided\x20by\x20the\x20caller\x20(via\x20id_data_with_passport\x20or\x20'+'id_data_mixed_with_passport).\x20Without\x20a\x20write_guard,\x20ANY\x20address\x20can\x20write\x20data\x20with\x20any\x20ID\x20—\x20this\x20'+'is\x20almost\x20certainly\x20a\x20misconfiguration.\x20The\x20Move\x20contract\x20now\x20enforces\x20this\x20via\x20'+'E_POLICY_WRITE_GUARD_REQUIRED\x20(22)\x20in\x20policy_add_imp()\x20[R-D-1=A].','affected_stakeholders':['creator','writer'],'scenario':'Caller\x20creates\x20a\x20policy\x20with\x20id_from=None\x20and\x20empty\x20write_guard\x20list','mitigation':'When\x20id_from=None,\x20provide\x20at\x20least\x20one\x20PolicyGuard\x20entry\x20in\x20write_guard.\x20If\x20you\x20want\x20unrestricted\x20'+'writes,\x20use\x20id_from=Clock\x20or\x20id_from=Signer\x20instead\x20(which\x20auto-generates\x20the\x20ID\x20and\x20requires\x20empty\x20write_guard).','related_move_error':'E_POLICY_WRITE_GUARD_REQUIRED\x20(22)','auto_fixable':![]},'check':a=>{if(!a['policies'])return null;const b=a['policies']['filter'](c=>normalizeIdFrom(c['id_from'])===0x0&&c['write_guard_count']===0x0);if(b['length']===0x0)return null;return{...R_REP_2_01['rule'],'evidence':'policies\x20with\x20id_from=None\x20+\x20empty\x20write_guard:\x20'+b['map'](c=>c['name'])['join'](',\x20')};}},R_REP_2_02={'rule':{'id':'R-REP-03','level':'HIGH','category':'policy','title':'id_from_submission\x20set\x20when\x20id_from=Clock/Signer\x20—\x20id\x20routing\x20conflict\x20(R-D-1\x20Move\x20assert)','description':'When\x20id_from\x20is\x20Clock\x20or\x20Signer,\x20the\x20data\x20ID\x20is\x20auto-generated\x20(timestamp\x20or\x20signer\x20address).\x20'+'A\x20PolicyGuard\x20with\x20id_from_submission\x20set\x20would\x20try\x20to\x20route\x20the\x20id\x20from\x20a\x20Passport\x20submission,\x20'+'conflicting\x20with\x20the\x20auto-generated\x20id_from\x20path.\x20The\x20Move\x20contract\x20enforces\x20that\x20id_from_submission\x20'+'MUST\x20be\x20None\x20for\x20every\x20PolicyGuard\x20when\x20id_from\x20is\x20Clock/Signer\x20(data_from_submission\x20is\x20still\x20'+'allowed\x20—\x20it\x20is\x20used\x20by\x20data_when_id_from_set_with_passport\x20to\x20extract\x20data\x20from\x20the\x20submission).\x20'+'Violations\x20abort\x20with\x20E_POLICY_ID_FROM_SUBMISSION_FORBIDDEN\x20(23)\x20in\x20policy_add_imp()\x20[R-D-1=A,\x20refined].','affected_stakeholders':['creator','writer'],'scenario':'Caller\x20creates\x20a\x20policy\x20with\x20id_from=Clock\x20and\x20a\x20write_guard\x20entry\x20whose\x20id_from_submission\x20is\x20set','mitigation':'When\x20id_from=Clock\x20or\x20Signer,\x20ensure\x20every\x20PolicyGuard\x20has\x20id_from_submission=null.\x20'+'data_from_submission\x20may\x20still\x20be\x20set\x20if\x20you\x20want\x20the\x20guard\x20to\x20supply\x20the\x20data\x20payload\x20'+'(routed\x20via\x20data_when_id_from_set_with_passport).\x20If\x20you\x20need\x20submission-derived\x20ids,\x20'+'switch\x20to\x20id_from=None\x20and\x20set\x20id_from_submission\x20on\x20the\x20guard.','related_move_error':'E_POLICY_ID_FROM_SUBMISSION_FORBIDDEN\x20(23)','auto_fixable':![]},'check':a=>{if(!a['policies'])return null;const b=a['policies']['filter'](c=>{const d=normalizeIdFrom(c['id_from']);return(d===0x1||d===0x2)&&c['has_id_from_submission'];});if(b['length']===0x0)return null;return{...R_REP_2_02['rule'],'evidence':'policies\x20with\x20id_from=Clock/Signer\x20+\x20id_from_submission\x20set:\x20'+b['map'](c=>c['name']+'(id_from='+c['id_from']+')')['join'](',\x20')};}},R_REP_1_02={'rule':{'id':'R-REP-04','level':'MEDIUM','category':'structural','title':'Policy\x20write_guard\x20count\x20exceeds\x20MAX_POLICY_GUARD_COUNT\x20('+MAX_POLICY_GUARD_COUNT+')','description':'Each\x20policy\x20may\x20define\x20up\x20to\x20MAX_POLICY_GUARD_COUNT='+MAX_POLICY_GUARD_COUNT+'\x20guard\x20entries\x20in\x20its\x20write_guard\x20list\x20'+'(Move\x20source:\x20repository.move:23).\x20Exceeding\x20this\x20limit\x20aborts\x20with\x20E_POLICY_GUARD_COUNT_EXCEEDED\x20(2).\x20'+'Each\x20entry\x20maps\x20to\x20a\x20Guard\x20object\x20that\x20must\x20be\x20verified\x20via\x20Passport\x20submission,\x20so\x20more\x20guards\x20=\x20'+'more\x20complex\x20write\x20authorization\x20semantics.','affected_stakeholders':['creator'],'scenario':'Caller\x20creates\x20a\x20policy\x20with\x2011\x20guard\x20entries\x20in\x20write_guard','mitigation':'Consolidate\x20guard\x20logic.\x20If\x20multiple\x20guards\x20must\x20verify\x20the\x20same\x20data,\x20consider\x20composing\x20them\x20into\x20a\x20'+'single\x20Guard\x20with\x20relies/rep\x20fields,\x20or\x20split\x20the\x20data\x20across\x20multiple\x20policies\x20with\x20fewer\x20guards\x20each.','related_move_error':'E_POLICY_GUARD_COUNT_EXCEEDED\x20(2)','auto_fixable':![]},'check':a=>{if(!a['policies'])return null;const b=a['policies']['filter'](c=>c['write_guard_count']>MAX_POLICY_GUARD_COUNT);if(b['length']===0x0)return null;return{...R_REP_1_02['rule'],'evidence':'policies\x20exceeding\x20guard\x20count:\x20'+b['map'](c=>c['name']+'('+c['write_guard_count']+')')['join'](',\x20')};}},R_REP_1_03={'rule':{'id':'R-REP-05','level':'MEDIUM','category':'structural','title':'Data\x20value\x20exceeds\x20MAX_DATA_SIZE\x20('+MAX_DATA_SIZE+'\x20bytes)','description':'A\x20single\x20Repository\x20data\x20value\x20must\x20be\x20≤\x20MAX_DATA_SIZE='+MAX_DATA_SIZE+'\x20bytes\x20(Move\x20source:\x20repository.move:24).\x20'+'Exceeding\x20this\x20limit\x20aborts\x20with\x20E_DATA_EXCEEDED\x20(4).\x20The\x20value\x20is\x20stored\x20as\x20a\x20BCS-serialized\x20vector<u8>\x20'+'with\x20a\x20type-tag\x20prefix\x20byte.\x20Large\x20data\x20should\x20be\x20stored\x20off-chain\x20(e.g.\x20IPFS,\x20Walrus)\x20and\x20referenced\x20'+'by\x20hash/address,\x20NOT\x20inlined\x20into\x20the\x20Repository\x20data\x20value.','affected_stakeholders':['writer'],'scenario':'Caller\x20writes\x20a\x2050KB\x20JSON\x20blob\x20as\x20a\x20Repository\x20data\x20value','mitigation':'Store\x20large\x20payloads\x20off-chain\x20and\x20write\x20only\x20the\x20content\x20hash\x20(32-64\x20bytes)\x20to\x20the\x20Repository.\x20'+'Use\x20about_address\x20on\x20a\x20Proof\x20object\x20to\x20bind\x20the\x20off-chain\x20data\x20to\x20an\x20on-chain\x20attestation.','related_move_error':'E_DATA_EXCEEDED\x20(4)','auto_fixable':![]},'check':a=>{if(a['data_size']===undefined)return null;if(a['data_size']<=MAX_DATA_SIZE)return null;return{...R_REP_1_03['rule'],'evidence':'data_size='+a['data_size']+',\x20limit='+MAX_DATA_SIZE};}},R_REP_3_01={'rule':{'id':'R-REP-06','level':'LOW','category':'routing','title':'Policy\x20has\x20data_from_submission\x20but\x20no\x20id_from_submission\x20—\x20verify\x20Mode\x205\x20routing\x20intent','description':'When\x20a\x20PolicyGuard\x20has\x20data_from_submission\x20set\x20(data\x20comes\x20from\x20Passport\x20submission)\x20but\x20no\x20'+'id_from_submission\x20(id\x20comes\x20from\x20caller),\x20the\x20SDK\x20routes\x20to\x20id_data_mixed_with_passport\x20(Mode\x205).\x20'+'This\x20is\x20a\x20valid\x20but\x20advanced\x20pattern\x20—\x20ensure\x20the\x20caller\x20provides\x20matching\x20id\x20vectors.\x20The\x20SDK\x20'+'hasSubmissionSettings\x20helper\x20now\x20correctly\x20detects\x20this\x20case\x20[P1-1\x20fix,\x20R-D-3=A].','affected_stakeholders':['creator','writer'],'scenario':'Policy\x20has\x20a\x20guard\x20with\x20data_from_submission=2,\x20id_from_submission=undefined','mitigation':'Document\x20the\x20expected\x20caller\x20input\x20shape.\x20Ensure\x20the\x20caller\x20provides\x20both\x20the\x20id\x20vector\x20(positional)\x20'+'and\x20the\x20Passport\x20submission\x20(for\x20data).\x20Verify\x20routing\x20via\x20the\x20SDK\x20hasSubmissionSettings\x20helper.','auto_fixable':![]},'check':a=>{if(!a['policies'])return null;const b=a['policies']['filter'](c=>c['has_data_from_submission']&&!c['has_id_from_submission']);if(b['length']===0x0)return null;return{...R_REP_3_01['rule'],'evidence':'policies\x20with\x20data_from_submission\x20but\x20no\x20id_from_submission:\x20'+b['map'](c=>c['name'])['join'](',\x20')};}},R_REP_4_01={'rule':{'id':'R-REP-07','level':'HIGH','category':'submission','title':'data_from_submission\x20set\x20on\x20a\x20policy\x20used\x20in\x20id_data_remove_with_passport\x20—\x20Move\x20will\x20abort\x20(R-D-2)','description':'id_data_remove_with_passport\x20only\x20removes\x20data\x20identified\x20by\x20the\x20caller-provided\x20id\x20vector;\x20it\x20'+'cannot\x20consume\x20Passport\x20submissions\x20for\x20either\x20id\x20or\x20data.\x20The\x20Move\x20contract\x20now\x20enforces\x20that\x20BOTH\x20'+'id_from_submission\x20AND\x20data_from_submission\x20MUST\x20be\x20None\x20for\x20this\x20entry\x20point\x20[R-D-2=A],\x20aborting\x20'+'with\x20E_GUARD_SPECIFIED_ID_FROM_SUBMISSION\x20(11).\x20Previously,\x20only\x20id_from_submission\x20was\x20checked,\x20'+'allowing\x20data_from_submission\x20to\x20be\x20silently\x20ignored\x20—\x20masking\x20a\x20routing\x20bug.','affected_stakeholders':['writer','verifier'],'scenario':'Caller\x20uses\x20id_data_remove_with_passport\x20on\x20a\x20policy\x20whose\x20guard\x20has\x20data_from_submission=2','mitigation':'For\x20data\x20removal\x20via\x20Passport,\x20use\x20id_data_mixed_remove_with_passport\x20instead\x20(which\x20requires\x20'+'id_from_submission\x20and\x20derives\x20the\x20id\x20from\x20the\x20submission).\x20Do\x20not\x20set\x20data_from_submission\x20on\x20'+'policies\x20intended\x20for\x20id_data_remove_with_passport.','related_move_error':'E_GUARD_SPECIFIED_ID_FROM_SUBMISSION\x20(11)','auto_fixable':![]},'check':a=>{if(!a['is_data_remove_with_passport']||!a['policies'])return null;const b=a['policies']['filter'](c=>c['has_data_from_submission']);if(b['length']===0x0)return null;return{...R_REP_4_01['rule'],'evidence':'policies\x20with\x20data_from_submission\x20used\x20in\x20id_data_remove_with_passport:\x20'+b['map'](c=>c['name'])['join'](',\x20')};}},R_REP_1_04={'rule':{'id':'R-REP-08','level':'LOW','category':'structural','title':'ID\x20count\x20per\x20single\x20op\x20exceeds\x20MAX_ID_COUNT_ONCE\x20('+MAX_ID_COUNT_ONCE+')','description':'A\x20single\x20Repository\x20call\x20(data_add,\x20data_remove,\x20id_data_*)\x20may\x20operate\x20on\x20at\x20most\x20'+('MAX_ID_COUNT_ONCE='+MAX_ID_COUNT_ONCE+'\x20IDs\x20(Move\x20source:\x20repository.move:25).\x20Exceeding\x20this\x20limit\x20')+'aborts\x20with\x20E_ID_COUNT_EXCEEDED\x20(5).\x20Batch\x20large\x20operations\x20across\x20multiple\x20transactions.','affected_stakeholders':['writer'],'scenario':'Caller\x20passes\x20150\x20IDs\x20in\x20a\x20single\x20data_remove\x20call','mitigation':'Split\x20into\x20batches\x20of\x20≤\x20'+MAX_ID_COUNT_ONCE+'\x20IDs\x20per\x20transaction.','related_move_error':'E_ID_COUNT_EXCEEDED\x20(5)','auto_fixable':![]},'check':a=>{if(a['id_count_once']===undefined)return null;if(a['id_count_once']<=MAX_ID_COUNT_ONCE)return null;return{...R_REP_1_04['rule'],'evidence':'id_count='+a['id_count_once']+',\x20limit='+MAX_ID_COUNT_ONCE};}},R_REP_1_05={'rule':{'id':'R-REP-09','level':'INFO','category':'structural','title':'Reward\x20count\x20approaches\x20MAX_REWARD_COUNT\x20('+MAX_REWARD_COUNT+')','description':'A\x20Repository\x20may\x20reference\x20up\x20to\x20MAX_REWARD_COUNT='+MAX_REWARD_COUNT+'\x20Reward\x20objects\x20(Move\x20source:\x20repository.move:26).\x20'+'Exceeding\x20this\x20limit\x20aborts\x20with\x20E_MAX_REWARD_COUNT_EXCEEDED\x20(19).\x20Rewards\x20incentivize\x20data\x20contribution;\x20'+'having\x20many\x20rewards\x20is\x20fine\x20but\x20increases\x20accounting\x20complexity.','affected_stakeholders':['creator'],'scenario':'Caller\x20adds\x2020\x20rewards\x20to\x20a\x20Repository\x20(at\x20the\x20limit)','mitigation':'Monitor\x20reward\x20count.\x20If\x20more\x20incentives\x20are\x20needed,\x20consolidate\x20rewards\x20or\x20use\x20a\x20separate\x20Repository.','related_move_error':'E_MAX_REWARD_COUNT_EXCEEDED\x20(19)','auto_fixable':![]},'check':a=>{if(a['reward_count']===undefined)return null;if(a['reward_count']<MAX_REWARD_COUNT)return null;return{...R_REP_1_05['rule'],'evidence':'reward_count='+a['reward_count']+',\x20limit='+MAX_REWARD_COUNT};}},R_REP_5_01={'rule':{'id':'R-REP-10','level':'INFO','category':'knowledge','title':'Knowledge\x20layer\x20&\x20constant\x20sync\x20—\x20RESOLVED','description':'All\x206\x20Repository\x20constants\x20(MAX_POLICY_COUNT,\x20MAX_POLICY_DESCRIPTION_LEN,\x20MAX_POLICY_GUARD_COUNT,\x20'+'MAX_DATA_SIZE,\x20MAX_ID_COUNT_ONCE,\x20MAX_REWARD_COUNT)\x20are\x20now\x20synced\x20to\x20onchain-constants.ts.\x20'+'The\x20MCP\x20Knowledge\x20layer\x20now\x20includes\x20repository-risk.ts,\x20repository-confirm.ts,\x20'+'repository-translation.ts\x20(R-D-4=A).\x20The\x20SDK\x20hasSubmissionSettings\x20helper\x20now\x20correctly\x20checks\x20both\x20'+'id_from_submission\x20AND\x20data_from_submission\x20(P1-1).\x20parseIdFrom\x20is\x20used\x20in\x20data/data_remove\x20(P1-2).\x20'+'This\x20risk\x20rule\x20is\x20retained\x20for\x20historical\x20audit\x20and\x20to\x20detect\x20future\x20regressions.','affected_stakeholders':['system'],'scenario':'Future\x20regression:\x20someone\x20removes\x20a\x20Repository\x20constant\x20from\x20onchain-constants.ts','mitigation':'Run\x20the\x20onchain-constants\x20sync\x20test\x20to\x20detect\x20drift.','auto_fixable':![]},'check':a=>{if(a['constants_synced'])return null;return{...R_REP_5_01['rule'],'evidence':'constants_synced=false'};}},R_REP_6_01={'rule':{'id':'R-REP-11','level':'HIGH','category':'policy','title':'quote_guard\x20must\x20be\x20is_depended\x20(immutable\x20+\x20rep=true\x20+\x20no\x20relies)\x20—\x20Move\x20assert','description':'Repository\x20policy\x27s\x20quote_guard\x20must\x20satisfy\x20guard::is_depended\x20(guard.move#L133-135):\x20'+'immutable=true,\x20relies\x20empty,\x20rep=true.\x20This\x20ensures\x20the\x20quote_guard\x20is\x20a\x20stable,\x20'+'repository-querying\x20guard\x20that\x20can\x20be\x20depended\x20upon.\x20Move\x20aborts\x20with\x20'+'E_NEED_DEPENDENT_GUARD\x20(repository.move#L422)\x20if\x20the\x20guard\x20is\x20not\x20is_depended.\x20'+'VERIFIED:\x20passport.rs#L545-612\x20(check_repository_quote_guard\x20enforces\x20this\x20at\x20query\x20time).','affected_stakeholders':['creator','reader'],'scenario':'Creator\x20sets\x20quote_guard\x20to\x20a\x20Guard\x20that\x20is\x20not\x20is_depended\x20(e.g.,\x20has\x20relies\x20or\x20is\x20mutable)','mitigation':'Ensure\x20the\x20quote_guard\x20Guard\x20object\x20has:\x20immutable=true,\x20relies=empty,\x20rep=true.\x20'+'Use\x20pattern.repository_quote_guard_subscription\x20as\x20the\x20design\x20template.','related_move_error':'E_NEED_DEPENDENT_GUARD','auto_fixable':![]},'check':a=>{if(!a['has_quote_guard'])return null;if(a['quote_guard_is_depended'])return null;return{...R_REP_6_01['rule'],'evidence':'quote_guard\x20set\x20but\x20not\x20is_depended\x20(immutable\x20+\x20rep=true\x20+\x20no\x20relies)'};}},R_REP_6_02={'rule':{'id':'R-REP-12','level':'MEDIUM','category':'knowledge','title':'quote_guard\x20data\x20subscription\x20design\x20—\x20verify\x20Payment\x20verification\x20+\x20owner_receive\x20revenue','description':'When\x20using\x20quote_guard\x20for\x20data\x20subscription\x20(Repository+quote_guard+Payment\x20pattern),\x20'+'ensure:\x20(1)\x20quote_guard\x20verifies\x20Payment\x20fields\x20(for_object\x20matches\x20Repository,\x20amount\x20meets\x20price),\x20'+'(2)\x20Repository\x20has\x20owner_receive<T>\x20configured\x20to\x20accept\x20Payment\x20as\x20subscription\x20revenue\x20'+'(repository.move#L714-717).\x20VERIFIED:\x20passport.rs#L545-612,\x20repository.move#L714-717.\x20'+'DESIGN:\x20quote_guard\x20is\x20a\x20RIGID\x20verification\x20requirement\x20—\x20any\x20guard\x20querying\x20this\x20Repository\x27s\x20'+'data\x20MUST\x20satisfy\x20the\x20quote_guard\x20(see\x20R-X1-10\x20in\x20guard-risk.ts).','affected_stakeholders':['creator','reader','verifier'],'scenario':'Creator\x20sets\x20quote_guard\x20but\x20does\x20not\x20configure\x20Payment\x20verification\x20or\x20owner_receive','mitigation':'1)\x20Ensure\x20quote_guard\x20verifies\x20Payment\x20(for_object,\x20amount);\x20'+'2)\x20Configure\x20Repository\x20owner_receive<T>\x20to\x20accept\x20subscription\x20Payment\x20revenue;\x20'+'3)\x20Use\x20pattern.repository_quote_guard_subscription\x20(guard-design-patterns.ts)\x20and\x20'+'tpl_repository_quote_guard_subscription\x20(guard-templates.ts)\x20as\x20design\x20templates.','auto_fixable':![]},'check':a=>{if(!a['has_quote_guard'])return null;if(a['quote_guard_verifies_payment']&&a['has_owner_receive'])return null;const b=[];if(!a['quote_guard_verifies_payment'])b['push']('quote_guard\x20does\x20not\x20verify\x20Payment');if(!a['has_owner_receive'])b['push']('Repository\x20missing\x20owner_receive\x20for\x20revenue');return{...R_REP_6_02['rule'],'evidence':b['join'](';\x20')};}};export const REPOSITORY_RISK_RULES=[R_REP_1_01,R_REP_2_01,R_REP_2_02,R_REP_1_02,R_REP_1_03,R_REP_3_01,R_REP_4_01,R_REP_1_04,R_REP_1_05,R_REP_5_01,R_REP_6_01,R_REP_6_02];export function checkRepositoryRisks(a){const b=[];for(const c of REPOSITORY_RISK_RULES){const d=c['check'](a);if(d)b['push'](d);}return b;}export function getRepositoryRiskById(a){return REPOSITORY_RISK_RULES['find'](b=>b['rule']['id']===a)?.['rule'];}export{normalizeIdFrom as parseIdFromForRiskCheck};