@wowok/agent-mcp 2.7.1 → 2.7.2

package/dist/knowledge/allocation-risk.js

@@ -1,568 +1 @@
-import { MAX_ALLOCATOR_COUNT, RATE_TOTAL_FULL, ALLOCATION_ERROR_CODES, } from "./allocation-ledger.js";
-const R_A_1_01 = {
-    id: "R-A-1-01",
-    category: "structural",
-    trigger: "allocators is empty or sharing arrays are empty",
-    check: (ctx) => {
-        if (!ctx.allocators_config)
-            return null;
-        const allocators = ctx.allocators_config.allocators;
-        if (allocators.length === 0) {
-            return {
-                id: "R-A-1-01",
-                level: "CRITICAL",
-                category: "structural",
-                title: "Empty allocators — funds will be permanently locked",
-                description: "Allocation has empty allocators.allocators. Service publish with empty order_allocators causes order funds to be permanently locked in the Allocation object.",
-                affected_stakeholders: ["owner", "service_provider", "system"],
-                scenario: "Service published without configuring any Allocator",
-                mitigation: "Configure at least 1 Allocator. If no distribution is needed yet, use a single Allocator with Rate=10000 to the merchant address.",
-                evidence: "allocators.length=0",
-                related_move_error: "EALLOCATORS_EMPTY (8) / ENO_ALLOCATOR (3)",
-                auto_fixable: false,
-            };
-        }
-        for (let i = 0; i < allocators.length; i++) {
-            if (allocators[i].sharing.length === 0) {
-                return {
-                    id: "R-A-1-01",
-                    level: "CRITICAL",
-                    category: "structural",
-                    title: `Allocator ${i} has empty sharing — will never distribute`,
-                    description: `Allocator at index ${i} (guard=${allocators[i].guard}) has empty sharing array. Even if its Guard passes verification, no funds will be distributed.`,
-                    affected_stakeholders: ["owner", "recipient"],
-                    scenario: "Allocator with empty sharing vector",
-                    mitigation: `Add at least 1 sharing entry to Allocator ${i}`,
-                    evidence: `allocator[${i}].sharing.length=0`,
-                    related_move_error: "ENO_ALLOCATOR (3)",
-                    auto_fixable: false,
-                };
-            }
-        }
-        return null;
-    },
-};
-const R_A_1_02 = {
-    id: "R-A-1-02",
-    category: "structural",
-    trigger: "Pure Rate mode sum != 10000 or Rate+Surplus sum > 10000",
-    check: (ctx) => {
-        if (!ctx.allocators_config)
-            return null;
-        for (let i = 0; i < ctx.allocators_config.allocators.length; i++) {
-            const a = ctx.allocators_config.allocators[i];
-            const rateSum = a.sharing
-                .filter(s => s.mode === "Rate")
-                .reduce((sum, s) => sum + Number(s.sharing), 0);
-            const hasSurplus = a.sharing.some(s => s.mode === "Surplus");
-            if (!hasSurplus && rateSum > 0 && rateSum !== RATE_TOTAL_FULL) {
-                return {
-                    id: "R-A-1-02",
-                    level: "HIGH",
-                    category: "structural",
-                    title: `Pure Rate mode sum ${rateSum} != ${RATE_TOTAL_FULL}`,
-                    description: `Allocator ${i} (guard=${a.guard}) uses pure Rate mode (no Surplus), but sum(rates)=${rateSum} ≠ ${RATE_TOTAL_FULL}. Funds will be permanently locked (if sum<10000) or Move will abort with ERATE_NOT_10000 (if sum != 10000 exactly).`,
-                    affected_stakeholders: ["owner", "recipient"],
-                    scenario: "Misconfigured rate proportions",
-                    mitigation: `Adjust sharing.sharing values so sum(rates)=${RATE_TOTAL_FULL}, OR add 1 Surplus sharing to absorb the remainder.`,
-                    evidence: `rateSum=${rateSum}, expected=${RATE_TOTAL_FULL}`,
-                    related_move_error: "ERATE_NOT_10000 (4)",
-                    auto_fixable: true,
-                };
-            }
-            if (hasSurplus && rateSum > RATE_TOTAL_FULL) {
-                return {
-                    id: "R-A-1-02",
-                    level: "HIGH",
-                    category: "structural",
-                    title: `Rate + Surplus sum ${rateSum} > ${RATE_TOTAL_FULL}`,
-                    description: `Allocator ${i} (guard=${a.guard}) uses Rate+Surplus mode, but sum(rates)=${rateSum} > ${RATE_TOTAL_FULL}. Move will abort with ERATE_EXCEEDS_10000.`,
-                    affected_stakeholders: ["owner"],
-                    scenario: "Rate percentages exceed 100% before Surplus",
-                    mitigation: `Reduce sum(rates) to ≤ ${RATE_TOTAL_FULL}.`,
-                    evidence: `rateSum=${rateSum}, max=${RATE_TOTAL_FULL}`,
-                    related_move_error: "ERATE_EXCEEDS_10000 (6)",
-                    auto_fixable: true,
-                };
-            }
-        }
-        return null;
-    },
-};
-const R_A_1_03 = {
-    id: "R-A-1-03",
-    category: "structural",
-    trigger: "Multiple Surplus sharing in one Allocator, or Amount sum violates threshold/max",
-    check: (ctx) => {
-        if (!ctx.allocators_config)
-            return null;
-        for (let i = 0; i < ctx.allocators_config.allocators.length; i++) {
-            const a = ctx.allocators_config.allocators[i];
-            const surplusCount = a.sharing.filter(s => s.mode === "Surplus").length;
-            if (surplusCount > 1) {
-                return {
-                    id: "R-A-1-03",
-                    level: "MEDIUM",
-                    category: "structural",
-                    title: `Allocator ${i} has ${surplusCount} Surplus sharing — at most 1 allowed`,
-                    description: `Allocator ${i} (guard=${a.guard}) has ${surplusCount} Surplus sharing entries. Move will abort with EMULTIPLE_SURPLUS at alloc() time.`,
-                    affected_stakeholders: ["owner"],
-                    scenario: "Multiple Surplus entries in one Allocator",
-                    mitigation: "Keep at most 1 Surplus per Allocator. Use Rate mode for multi-party remainder distribution.",
-                    evidence: `surplusCount=${surplusCount}`,
-                    related_move_error: "EMULTIPLE_SURPLUS (5)",
-                    auto_fixable: true,
-                };
-            }
-            const amountSum = a.sharing
-                .filter(s => s.mode === "Amount")
-                .reduce((sum, s) => sum + Number(s.sharing), 0);
-            const threshold = Number(ctx.allocators_config.threshold);
-            if (amountSum > 0 && amountSum < threshold) {
-                return {
-                    id: "R-A-1-03",
-                    level: "HIGH",
-                    category: "structural",
-                    title: `Amount sum ${amountSum} < threshold ${threshold}`,
-                    description: `Allocator ${i} pure Amount mode fix=${amountSum} < threshold=${threshold}. Move will abort with EAMOUNT_BELOW_THRESHOLD at allocator_add time.`,
-                    affected_stakeholders: ["owner"],
-                    scenario: "Amount sum insufficient to trigger alloc",
-                    mitigation: "Either lower threshold to <= fix, or increase Amount sharing values.",
-                    evidence: `fix=${amountSum}, threshold=${threshold}`,
-                    related_move_error: "EAMOUNT_BELOW_THRESHOLD (12)",
-                    auto_fixable: false,
-                };
-            }
-            if (a.max != null && amountSum > Number(a.max)) {
-                return {
-                    id: "R-A-1-03",
-                    level: "MEDIUM",
-                    category: "structural",
-                    title: `Amount sum ${amountSum} > max ${Number(a.max)}`,
-                    description: `Allocator ${i} Amount sum exceeds max. Move will abort with EAMOUNT_EXCEEDS_MAX.`,
-                    affected_stakeholders: ["owner"],
-                    scenario: "Amount sum exceeds max cap",
-                    mitigation: "Increase max or reduce Amount sharing values.",
-                    evidence: `fix=${amountSum}, max=${Number(a.max)}`,
-                    related_move_error: "EAMOUNT_EXCEEDS_MAX (13)",
-                    auto_fixable: true,
-                };
-            }
-        }
-        return null;
-    },
-};
-const R_A_2_01 = {
-    id: "R-A-2-01",
-    category: "semantic",
-    trigger: "sharing.who=Signer without Guard Signer binding — fund theft risk",
-    check: (ctx) => {
-        if (!ctx.allocators_config)
-            return null;
-        for (let i = 0; i < ctx.allocators_config.allocators.length; i++) {
-            const a = ctx.allocators_config.allocators[i];
-            const hasSignerRecipient = a.sharing.some(s => "Signer" in s.who);
-            if (!hasSignerRecipient)
-                continue;
-            const guardBound = ctx.guard_signer_bindings?.[a.guard] === true;
-            if (!guardBound) {
-                return {
-                    id: "R-A-2-01",
-                    level: "CRITICAL",
-                    category: "semantic",
-                    title: "sharing.who=Signer without Guard Signer binding — fund theft risk",
-                    description: `Allocator ${i} (guard=${a.guard}) has sharing.who=Signer, but the Guard does not bind context(Signer)==authorized. Anyone who passes the Guard can steal 100% of funds. This is the most severe Allocation risk (linked to guard-risk.ts R-C3-06).`,
-                    affected_stakeholders: ["owner", "recipient", "service_provider"],
-                    scenario: "Signer recipient without Guard Signer authentication",
-                    mitigation: "Option A (preferred): change sharing.who to Entity (Treasury or fixed address). Option B: add Signer-binding check to the Guard (context(Signer)==authorized_address).",
-                    evidence: `guard=${a.guard}, guardSignerBound=${guardBound}`,
-                    related_guard_risk: "R-C3-06",
-                    auto_fixable: false,
-                };
-            }
-        }
-        return null;
-    },
-};
-const R_A_2_02 = {
-    id: "R-A-2-02",
-    category: "semantic",
-    trigger: "sharing.who=GuardIdentifier but Passport table entry is not address type",
-    check: (ctx) => {
-        if (!ctx.allocators_config)
-            return null;
-        if (!ctx.passport_identifier_types)
-            return null;
-        for (let i = 0; i < ctx.allocators_config.allocators.length; i++) {
-            const a = ctx.allocators_config.allocators[i];
-            const guardIdSharing = a.sharing.find(s => "GuardIdentifier" in s.who);
-            if (!guardIdSharing)
-                continue;
-            const identifier = guardIdSharing.who.GuardIdentifier;
-            const idType = ctx.passport_identifier_types[identifier];
-            if (idType !== undefined && idType !== "address") {
-                return {
-                    id: "R-A-2-02",
-                    level: "MEDIUM",
-                    category: "semantic",
-                    title: `GuardIdentifier ${identifier} resolves to non-address type (${idType})`,
-                    description: `Allocator ${i} uses sharing.who=GuardIdentifier(${identifier}), but Passport table[${identifier}] is of type ${idType}, not address. Move will abort with ERECIPIENT_IDENTIFIER_NOT_ADDRESS at alloc() time.`,
-                    affected_stakeholders: ["recipient"],
-                    scenario: "Passport table entry type mismatch",
-                    mitigation: `Ensure Passport table[${identifier}] is address-typed, OR use sharing.who=Entity with a static address.`,
-                    evidence: `identifier=${identifier}, type=${idType}`,
-                    related_move_error: "ERECIPIENT_IDENTIFIER_NOT_ADDRESS (1)",
-                    auto_fixable: false,
-                };
-            }
-        }
-        return null;
-    },
-};
-const R_A_2_03 = {
-    id: "R-A-2-03",
-    category: "semantic",
-    trigger: "Duplicate Guard addresses in allocators (alloc_by_guard address match only hits the first one)",
-    check: (ctx) => {
-        if (!ctx.allocators_config)
-            return null;
-        const guards = ctx.allocators_config.allocators.map(a => a.guard);
-        const unique = new Set(guards);
-        if (unique.size !== guards.length) {
-            const dupes = guards.filter((g, i) => guards.indexOf(g) !== i);
-            return {
-                id: "R-A-2-03",
-                level: "MEDIUM",
-                category: "semantic",
-                title: "Duplicate Guard addresses in allocators",
-                description: `Multiple Allocators reference the same Guard object: ${dupes.join(", ")}. alloc_by_guard locates the Allocator by iterating guard addresses; duplicate addresses only match the first one, so subsequent duplicate Allocators are unreachable (dead code).`,
-                affected_stakeholders: ["owner", "allocator"],
-                scenario: "Reusing same Guard object across multiple Allocators",
-                mitigation: "Create independent Guard objects for each Allocator (they may share root/table but must differ in description).",
-                evidence: `total=${guards.length}, unique=${unique.size}, dupes=${dupes.join(",")}`,
-                auto_fixable: true,
-            };
-        }
-        return null;
-    },
-};
-const R_A_3_01 = {
-    id: "R-A-3-01",
-    category: "authority",
-    trigger: "Service already published — order_allocators is immutable",
-    check: (ctx) => {
-        if (!ctx.host_service_published)
-            return null;
-        return {
-            id: "R-A-3-01",
-            level: "HIGH",
-            category: "authority",
-            title: "order_allocators immutable after Service publish",
-            description: "Service is already published. order_allocators field is now immutable (safety-rules.ts:170-174). Any configuration error (wrong Guard, wrong sharing proportion, wrong Entity address) will affect ALL subsequent orders and cannot be fixed without creating a new Service.",
-            affected_stakeholders: ["owner", "service_provider"],
-            scenario: "Attempting to modify order_allocators after Service publish",
-            mitigation: "1) Verify the configuration is correct before publish. 2) Use deploy-scanner pre-publish validation. 3) If already published with errors, create a new Service to replace.",
-            evidence: `host_service_published=${ctx.host_service_published}`,
-            auto_fixable: false,
-        };
-    },
-};
-const R_A_3_02 = {
-    id: "R-A-3-02",
-    category: "authority",
-    trigger: "Treasury Permission inconsistent with Service Permission",
-    check: (ctx) => {
-        if (!ctx.allocators_config)
-            return null;
-        if (!ctx.referenced_treasuries_permissions)
-            return null;
-        if (!ctx.host_service_permission)
-            return null;
-        for (const allocator of ctx.allocators_config.allocators) {
-            for (const s of allocator.sharing) {
-                if (!("Entity" in s.who))
-                    continue;
-                const entityAddr = s.who.Entity;
-                const treasuryPerm = ctx.referenced_treasuries_permissions[entityAddr];
-                if (treasuryPerm && treasuryPerm !== ctx.host_service_permission) {
-                    return {
-                        id: "R-A-3-02",
-                        level: "MEDIUM",
-                        category: "authority",
-                        title: "Treasury Permission inconsistent with Service Permission",
-                        description: `sharing.who=Entity points to Treasury ${entityAddr} whose Permission (${treasuryPerm}) differs from Service Permission (${ctx.host_service_permission}). Two different permission organizations control fund flow, creating potential authority conflicts.`,
-                        affected_stakeholders: ["owner", "service_provider"],
-                        scenario: "Treasury owned by different party than Service",
-                        mitigation: "Create Treasury with the same Permission object as the Service, OR ensure both are owned by the same address.",
-                        evidence: `treasury=${entityAddr}, treasuryPerm=${treasuryPerm}, servicePerm=${ctx.host_service_permission}`,
-                        auto_fixable: false,
-                    };
-                }
-            }
-        }
-        return null;
-    },
-};
-const R_A_3_03 = {
-    id: "R-A-3-03",
-    category: "authority",
-    trigger: "No ALLOCATION_* builtin permission index — Allocation has no independent access control",
-    check: (ctx) => {
-        if (ctx.operation_type !== "create")
-            return null;
-        const isStandalone = ctx.trigger_source === "standalone";
-        return {
-            id: "R-A-3-03",
-            level: "LOW",
-            category: "authority",
-            title: "Allocation has no builtin permission index (passive-object design)",
-            description: isStandalone
-                ? "BuiltinPermissionIndex has no ALLOCATION_* entries. Allocation's access control is fully delegated to Guard + Passport. In standalone mode (trigger_source=standalone), there is no Service/Arbitration layer to enforce caller authorization — Guard MUST provide sufficient access control (see R-A-3-04). This is the 'passive object' design philosophy, not a defect, but standalone mode shifts full responsibility to the Guard configuration."
-                : "BuiltinPermissionIndex has no ALLOCATION_* entries. Allocation's access control is fully delegated to Service (SERVICE_ORDER_ALLOCATOR=313) or Arbitration (ARBITRATION_FEES_ALLOC=365). This is the 'passive object' design philosophy, not a defect. In embedded mode, the host Service/Arbitration provides an additional access-control layer on top of Guard + Passport.",
-            affected_stakeholders: ["system"],
-            scenario: isStandalone
-                ? "Standalone Allocation creation (user-initiated, no Service context)"
-                : "Embedded Allocation creation (via Service order_allocators or Arbitration fees_alloc)",
-            mitigation: isStandalone
-                ? "For standalone Allocation, ensure Guard binds Signer or enforces time-lock (see R-A-3-04). Document this design choice explicitly."
-                : "For embedded Allocation, ensure Service/Arbitration permission configuration is correct. Document this design choice explicitly.",
-            evidence: `BuiltinPermissionIndex has no ALLOCATION_* entries; trigger_source=${ctx.trigger_source ?? "unknown"}`,
-            auto_fixable: false,
-        };
-    },
-};
-const R_A_3_04 = {
-    id: "R-A-3-04",
-    category: "authority",
-    trigger: "Standalone Allocation (trigger_source=standalone) with Guard lacking both Signer binding and time-lock",
-    check: (ctx) => {
-        if (ctx.trigger_source !== "standalone")
-            return null;
-        if (!ctx.allocators_config)
-            return null;
-        const weakGuards = [];
-        for (const a of ctx.allocators_config.allocators) {
-            const signerBound = ctx.guard_signer_bindings?.[a.guard] === true;
-            const hasTimeLock = ctx.guard_has_time_lock?.[a.guard] === true;
-            if (!signerBound && !hasTimeLock) {
-                weakGuards.push(a.guard);
-            }
-        }
-        if (weakGuards.length === 0)
-            return null;
-        return {
-            id: "R-A-3-04",
-            level: "HIGH",
-            category: "authority",
-            title: `Standalone Allocation: ${weakGuards.length} Guard(s) lack Signer binding AND time-lock`,
-            description: `Standalone Allocation (trigger_source=standalone) has no Service-layer access control. The following Guard(s) lack both Signer binding (context(Signer)==authorized) and time-lock (context(Clock).timestamp>=unlock): ${weakGuards.join(", ")}. Anyone who passes these Guards can trigger alloc() and receive funds, with no additional authorization layer. This is the most severe standalone-mode risk.`,
-            affected_stakeholders: ["owner", "recipient", "system"],
-            scenario: "Standalone Allocation created with weak Guard (no Signer binding, no time-lock)",
-            mitigation: "Option A (preferred): configure Guard to bind context(Signer)==authorized_address, so only the owner can trigger alloc(). Option B: configure Guard with time-lock (context(Clock).timestamp>=unlock_time) for vesting-style releases. Option C: switch to embedded mode (via Service) to leverage Service-layer access control. Until fixed, this Allocation should not receive funds.",
-            evidence: `trigger_source=standalone, weakGuards=${weakGuards.join(",")}`,
-            related_guard_risk: "R-C3-06 (Signer binding) / time-lock patterns",
-            auto_fixable: false,
-        };
-    },
-};
-const R_A_4_01 = {
-    id: "R-A-4-01",
-    category: "lifecycle",
-    trigger: "caller-specified guard with no matching Allocator — silent return causes funds to be stuck",
-    check: (ctx) => {
-        if (!ctx.allocators_config)
-            return null;
-        if (ctx.allocators_config.allocators.length <= 1)
-            return null;
-        if (ctx.has_fallback_allocator)
-            return null;
-        return {
-            id: "R-A-4-01",
-            level: "CRITICAL",
-            category: "lifecycle",
-            title: "caller-specified guard with no matching Allocator — silent return causes funds to be stuck",
-            description: `Multi-Allocation configuration (${ctx.allocators_config.allocators.length} Allocators) without alternative Allocator. alloc() is driven by the caller explicitly specifying an Allocator via alloc_by_guard: if the guard address does not match any allocators[].guard, alloc() silently returns (no error, no distribution), funds remain stuck in Allocation.balance, and the caller gets no immediate signal. Linked to guard-risk.ts R-X1-05.`,
-            affected_stakeholders: ["owner", "service_provider", "system"],
-            scenario: "Caller passes a guard address not present in allocators[] (e.g. wrong Guard object, or order state not matching any terminal node)",
-            mitigation: "1) The caller should verify alloc_by_guard ∈ allocators[].guard address set before calling alloc(). 2) Provide an alternative Allocator and document the caller's retry strategy. 3) Caller should check balance==0 after alloc() to detect no-match.",
-            evidence: `allocators=${ctx.allocators_config.allocators.length}, hasFallback=${ctx.has_fallback_allocator ?? false}`,
-            related_guard_risk: "R-X1-05",
-            auto_fixable: false,
-        };
-    },
-};
-const R_A_4_02 = {
-    id: "R-A-4-02",
-    category: "lifecycle",
-    trigger: "Multi-Allocation without mutually exclusive Guard conditions (design clarity issue, not a correctness requirement)",
-    check: (ctx) => {
-        if (!ctx.allocators_config)
-            return null;
-        if (ctx.allocators_config.allocators.length <= 1)
-            return null;
-        if (ctx.guard_conditions_mutually_exclusive)
-            return null;
-        return {
-            id: "R-A-4-02",
-            level: "MEDIUM",
-            category: "lifecycle",
-            title: "Multi-Allocation without mutually exclusive Guard conditions",
-            description: `Multi-Allocation (${ctx.allocators_config.allocators.length} Allocators) without verified mutual exclusion. Under caller-specified guard semantics, the caller explicitly selects an Allocator via alloc_by_guard, so there is no correctness problem of "the latter is unreachable"; however, if two Guard conditions can both pass simultaneously and the caller has no explicit selection strategy, the caller may be confused or bind to an unexpected path.`,
-            affected_stakeholders: ["owner"],
-            scenario: "Two Guard conditions overlap (e.g. amount<1000 and amount<500), caller Passport satisfies both",
-            mitigation: "It is recommended that Guard conditions be strictly mutually exclusive (e.g. amount<1000 vs amount>=1000) to avoid caller confusion; alternatively, document explicitly which path the caller should prefer.",
-            evidence: `allocators=${ctx.allocators_config.allocators.length}, mutuallyExclusive=${ctx.guard_conditions_mutually_exclusive ?? false}`,
-            auto_fixable: false,
-        };
-    },
-};
-const R_A_4_03 = {
-    id: "R-A-4-03",
-    category: "lifecycle",
-    trigger: "Pure Amount mode without Surplus — residual balance reentrancy",
-    check: (ctx) => {
-        if (!ctx.allocators_config)
-            return null;
-        for (let i = 0; i < ctx.allocators_config.allocators.length; i++) {
-            const a = ctx.allocators_config.allocators[i];
-            const hasOnlyAmount = a.sharing.length > 0 && a.sharing.every(s => s.mode === "Amount");
-            if (!hasOnlyAmount)
-                continue;
-            return {
-                id: "R-A-4-03",
-                level: "LOW",
-                category: "lifecycle",
-                title: "Pure Amount mode without Surplus — residual balance reentrancy",
-                description: `Allocator ${i} uses pure Amount mode (no Rate, no Surplus). After alloc(), if fix < balance, residual funds remain in Allocation.balance and can be claimed by re-triggering alloc(). Linked to guard-risk.ts reentrancy LOW.`,
-                affected_stakeholders: ["owner", "system"],
-                scenario: "Pure Amount mode leaves residual balance",
-                mitigation: "1) Preferred: add a Surplus sharing to absorb remainder. 2) Or use Rate mode. 3) Or add anti-reentrancy Guard check: logic_not(query('order.allocation some', object=order)).",
-                evidence: `allocator[${i}].mode=pure-amount`,
-                related_guard_risk: "reentrancy LOW",
-                auto_fixable: false,
-            };
-        }
-        return null;
-    },
-};
-const R_A_5_01 = {
-    id: "R-A-5-01",
-    category: "cross_object",
-    trigger: "Order already has an Allocation bound (1:1 constraint)",
-    check: (ctx) => {
-        if (!ctx.order_already_has_allocation)
-            return null;
-        return {
-            id: "R-A-5-01",
-            level: "HIGH",
-            category: "cross_object",
-            title: "Order already has an Allocation — 1:1 constraint violation",
-            description: `Order ${ctx.bound_order ?? "(unknown)"} already has an Allocation bound. Move layer will abort with E_ALLOCATION_ALREADY_SPECIFIED (order.move) when attempting to bind a second Allocation.`,
-            affected_stakeholders: ["owner", "service_provider"],
-            scenario: "Attempting to bind a second Allocation to the same Order",
-            mitigation: "Use the existing Allocation, or unbind it first (if supported), or create a new Order.",
-            evidence: `bound_order=${ctx.bound_order ?? "unknown"}, alreadyHasAllocation=${ctx.order_already_has_allocation}`,
-            related_move_error: "E_ALLOCATION_ALREADY_SPECIFIED (order.move)",
-            auto_fixable: false,
-        };
-    },
-};
-const R_A_5_02 = {
-    id: "R-A-5-02",
-    category: "cross_object",
-    trigger: "payment_info missing for alloc() — ENO_PAYMENT_INFO",
-    check: (ctx) => {
-        if (ctx.has_payment_info)
-            return null;
-        if (ctx.operation_type !== "alloc_by_guard")
-            return null;
-        return {
-            id: "R-A-5-02",
-            level: "HIGH",
-            category: "cross_object",
-            title: "payment_info missing — alloc() will abort with ENO_PAYMENT_INFO",
-            description: "Allocation has no payment_info set. Move alloc() requires payment_info.is_some() at step 1 (pre_check). The entire alloc() transaction will revert, funds remain in Allocation.",
-            affected_stakeholders: ["owner"],
-            scenario: "Triggering alloc() before setting payment_info",
-            mitigation: "Ensure payment_info is set during Allocation creation (CallAllocation_Create requires payment_info field).",
-            evidence: `has_payment_info=${ctx.has_payment_info ?? false}`,
-            related_move_error: "ENO_PAYMENT_INFO (9)",
-            auto_fixable: false,
-        };
-    },
-};
-const R_A_5_03 = {
-    id: "R-A-5-03",
-    category: "cross_object",
-    trigger: "MAX_ALLOCATOR_COUNT not synced to onchain-constants.ts",
-    check: (_ctx) => {
-        return {
-            id: "R-A-5-03",
-            level: "LOW",
-            category: "cross_object",
-            title: "MAX_ALLOCATOR_COUNT not synced to onchain-constants.ts",
-            description: `Move layer allocation.move:16 defines MAX_ALLOCATOR_COUNT=${MAX_ALLOCATOR_COUNT}, but onchain-constants.ts does NOT export this constant. SDK allocation.ts:318 defines it locally, creating a double-definition risk. MCP knowledge imports the local definition.`,
-            affected_stakeholders: ["system"],
-            scenario: "Constant sync drift between Move / SDK / MCP",
-            mitigation: "1) Add MAX_ALLOCATOR_COUNT=100 to onchain-constants.ts. 2) Update SDK allocation.ts to import from onchain-constants.js. 3) Delete local definition.",
-            evidence: `MAX_ALLOCATOR_COUNT=${MAX_ALLOCATOR_COUNT} (local), not in onchain-constants.ts`,
-            auto_fixable: true,
-        };
-    },
-};
-const ALL_RULES = [
-    R_A_1_01, R_A_1_02, R_A_1_03,
-    R_A_2_01, R_A_2_02, R_A_2_03,
-    R_A_3_01, R_A_3_02, R_A_3_03, R_A_3_04,
-    R_A_4_01, R_A_4_02, R_A_4_03,
-    R_A_5_01, R_A_5_02, R_A_5_03,
-];
-export const ALLOCATION_RISK_VERSION = "1.0.0";
-export function getAllRiskRules() {
-    return [...ALL_RULES];
-}
-export function getRiskRulesCount() {
-    return ALL_RULES.length;
-}
-export function getRiskRulesByCategory(category) {
-    return ALL_RULES.filter(r => r.category === category);
-}
-export function assessAllocationRisks(ctx) {
-    const risks = [];
-    for (const rule of ALL_RULES) {
-        const r = rule.check(ctx);
-        if (r)
-            risks.push(r);
-    }
-    const overall = risks.length === 0
-        ? "LOW"
-        : risks.some(r => r.level === "CRITICAL") ? "CRITICAL"
-            : risks.some(r => r.level === "HIGH") ? "HIGH"
-                : risks.some(r => r.level === "MEDIUM") ? "MEDIUM"
-                    : "LOW";
-    const byCategory = {};
-    const byLevel = {};
-    for (const r of risks) {
-        byCategory[r.category] = (byCategory[r.category] ?? 0) + 1;
-        byLevel[r.level] = (byLevel[r.level] ?? 0) + 1;
-    }
-    const advice = {};
-    for (const r of risks) {
-        for (const s of r.affected_stakeholders) {
-            if (!advice[s])
-                advice[s] = [];
-            advice[s].push(`${r.id}: ${r.mitigation}`);
-        }
-    }
-    return {
-        summary: `Assessed ${risks.length} risk(s) across ${Object.keys(byCategory).length} categories`,
-        risks,
-        overall_risk: overall,
-        risks_by_category: byCategory,
-        risks_by_level: byLevel,
-        stakeholder_advice: advice,
-        needs_human_review: risks.some(r => r.level === "CRITICAL" || r.level === "HIGH"),
-        blocks_publish: risks.some(r => r.level === "CRITICAL"),
-    };
-}
-export { ALLOCATION_ERROR_CODES };
+import{MAX_ALLOCATOR_COUNT,RATE_TOTAL_FULL,ALLOCATION_ERROR_CODES}from'./allocation-ledger.js';const R_A_1_01={'id':'R-A-1-01','category':'structural','trigger':'allocators\x20is\x20empty\x20or\x20sharing\x20arrays\x20are\x20empty','check':a=>{if(!a['allocators_config'])return null;const b=a['allocators_config']['allocators'];if(b['length']===0x0)return{'id':'R-A-1-01','level':'CRITICAL','category':'structural','title':'Empty\x20allocators\x20—\x20funds\x20will\x20be\x20permanently\x20locked','description':'Allocation\x20has\x20empty\x20allocators.allocators.\x20Service\x20publish\x20with\x20empty\x20order_allocators\x20causes\x20order\x20funds\x20to\x20be\x20permanently\x20locked\x20in\x20the\x20Allocation\x20object.','affected_stakeholders':['owner','service_provider','system'],'scenario':'Service\x20published\x20without\x20configuring\x20any\x20Allocator','mitigation':'Configure\x20at\x20least\x201\x20Allocator.\x20If\x20no\x20distribution\x20is\x20needed\x20yet,\x20use\x20a\x20single\x20Allocator\x20with\x20Rate=10000\x20to\x20the\x20merchant\x20address.','evidence':'allocators.length=0','related_move_error':'EALLOCATORS_EMPTY\x20(8)\x20/\x20ENO_ALLOCATOR\x20(3)','auto_fixable':![]};for(let c=0x0;c<b['length'];c++){if(b[c]['sharing']['length']===0x0)return{'id':'R-A-1-01','level':'CRITICAL','category':'structural','title':'Allocator\x20'+c+'\x20has\x20empty\x20sharing\x20—\x20will\x20never\x20distribute','description':'Allocator\x20at\x20index\x20'+c+'\x20(guard='+b[c]['guard']+')\x20has\x20empty\x20sharing\x20array.\x20Even\x20if\x20its\x20Guard\x20passes\x20verification,\x20no\x20funds\x20will\x20be\x20distributed.','affected_stakeholders':['owner','recipient'],'scenario':'Allocator\x20with\x20empty\x20sharing\x20vector','mitigation':'Add\x20at\x20least\x201\x20sharing\x20entry\x20to\x20Allocator\x20'+c,'evidence':'allocator['+c+'].sharing.length=0','related_move_error':'ENO_ALLOCATOR\x20(3)','auto_fixable':![]};}return null;}},R_A_1_02={'id':'R-A-1-02','category':'structural','trigger':'Pure\x20Rate\x20mode\x20sum\x20!=\x2010000\x20or\x20Rate+Surplus\x20sum\x20>\x2010000','check':b=>{if(!b['allocators_config'])return null;for(let c=0x0;c<b['allocators_config']['allocators']['length'];c++){const d=b['allocators_config']['allocators'][c],e=d['sharing']['filter'](g=>g['mode']==='Rate')['reduce']((g,h)=>g+Number(h['sharing']),0x0),f=d['sharing']['some'](g=>g['mode']==='Surplus');if(!f&&e>0x0&&e!==RATE_TOTAL_FULL)return{'id':'R-A-1-02','level':'HIGH','category':'structural','title':'Pure\x20Rate\x20mode\x20sum\x20'+e+'\x20!=\x20'+RATE_TOTAL_FULL,'description':'Allocator\x20'+c+'\x20(guard='+d['guard']+')\x20uses\x20pure\x20Rate\x20mode\x20(no\x20Surplus),\x20but\x20sum(rates)='+e+'\x20≠\x20'+RATE_TOTAL_FULL+'.\x20Funds\x20will\x20be\x20permanently\x20locked\x20(if\x20sum<10000)\x20or\x20Move\x20will\x20abort\x20with\x20ERATE_NOT_10000\x20(if\x20sum\x20!=\x2010000\x20exactly).','affected_stakeholders':['owner','recipient'],'scenario':'Misconfigured\x20rate\x20proportions','mitigation':'Adjust\x20sharing.sharing\x20values\x20so\x20sum(rates)='+RATE_TOTAL_FULL+',\x20OR\x20add\x201\x20Surplus\x20sharing\x20to\x20absorb\x20the\x20remainder.','evidence':'rateSum='+e+',\x20expected='+RATE_TOTAL_FULL,'related_move_error':'ERATE_NOT_10000\x20(4)','auto_fixable':!![]};if(f&&e>RATE_TOTAL_FULL)return{'id':'R-A-1-02','level':'HIGH','category':'structural','title':'Rate\x20+\x20Surplus\x20sum\x20'+e+'\x20>\x20'+RATE_TOTAL_FULL,'description':'Allocator\x20'+c+'\x20(guard='+d['guard']+')\x20uses\x20Rate+Surplus\x20mode,\x20but\x20sum(rates)='+e+'\x20>\x20'+RATE_TOTAL_FULL+'.\x20Move\x20will\x20abort\x20with\x20ERATE_EXCEEDS_10000.','affected_stakeholders':['owner'],'scenario':'Rate\x20percentages\x20exceed\x20100%\x20before\x20Surplus','mitigation':'Reduce\x20sum(rates)\x20to\x20≤\x20'+RATE_TOTAL_FULL+'.','evidence':'rateSum='+e+',\x20max='+RATE_TOTAL_FULL,'related_move_error':'ERATE_EXCEEDS_10000\x20(6)','auto_fixable':!![]};}return null;}},R_A_1_03={'id':'R-A-1-03','category':'structural','trigger':'Multiple\x20Surplus\x20sharing\x20in\x20one\x20Allocator,\x20or\x20Amount\x20sum\x20violates\x20threshold/max','check':b=>{if(!b['allocators_config'])return null;for(let c=0x0;c<b['allocators_config']['allocators']['length'];c++){const d=b['allocators_config']['allocators'][c],e=d['sharing']['filter'](h=>h['mode']==='Surplus')['length'];if(e>0x1)return{'id':'R-A-1-03','level':'MEDIUM','category':'structural','title':'Allocator\x20'+c+'\x20has\x20'+e+'\x20Surplus\x20sharing\x20—\x20at\x20most\x201\x20allowed','description':'Allocator\x20'+c+'\x20(guard='+d['guard']+')\x20has\x20'+e+'\x20Surplus\x20sharing\x20entries.\x20Move\x20will\x20abort\x20with\x20EMULTIPLE_SURPLUS\x20at\x20alloc()\x20time.','affected_stakeholders':['owner'],'scenario':'Multiple\x20Surplus\x20entries\x20in\x20one\x20Allocator','mitigation':'Keep\x20at\x20most\x201\x20Surplus\x20per\x20Allocator.\x20Use\x20Rate\x20mode\x20for\x20multi-party\x20remainder\x20distribution.','evidence':'surplusCount='+e,'related_move_error':'EMULTIPLE_SURPLUS\x20(5)','auto_fixable':!![]};const f=d['sharing']['filter'](h=>h['mode']==='Amount')['reduce']((h,j)=>h+Number(j['sharing']),0x0),g=Number(b['allocators_config']['threshold']);if(f>0x0&&f<g)return{'id':'R-A-1-03','level':'HIGH','category':'structural','title':'Amount\x20sum\x20'+f+'\x20<\x20threshold\x20'+g,'description':'Allocator\x20'+c+'\x20pure\x20Amount\x20mode\x20fix='+f+'\x20<\x20threshold='+g+'.\x20Move\x20will\x20abort\x20with\x20EAMOUNT_BELOW_THRESHOLD\x20at\x20allocator_add\x20time.','affected_stakeholders':['owner'],'scenario':'Amount\x20sum\x20insufficient\x20to\x20trigger\x20alloc','mitigation':'Either\x20lower\x20threshold\x20to\x20<=\x20fix,\x20or\x20increase\x20Amount\x20sharing\x20values.','evidence':'fix='+f+',\x20threshold='+g,'related_move_error':'EAMOUNT_BELOW_THRESHOLD\x20(12)','auto_fixable':![]};if(d['max']!=null&&f>Number(d['max']))return{'id':'R-A-1-03','level':'MEDIUM','category':'structural','title':'Amount\x20sum\x20'+f+'\x20>\x20max\x20'+Number(d['max']),'description':'Allocator\x20'+c+'\x20Amount\x20sum\x20exceeds\x20max.\x20Move\x20will\x20abort\x20with\x20EAMOUNT_EXCEEDS_MAX.','affected_stakeholders':['owner'],'scenario':'Amount\x20sum\x20exceeds\x20max\x20cap','mitigation':'Increase\x20max\x20or\x20reduce\x20Amount\x20sharing\x20values.','evidence':'fix='+f+',\x20max='+Number(d['max']),'related_move_error':'EAMOUNT_EXCEEDS_MAX\x20(13)','auto_fixable':!![]};}return null;}},R_A_2_01={'id':'R-A-2-01','category':'semantic','trigger':'sharing.who=Signer\x20without\x20Guard\x20Signer\x20binding\x20—\x20fund\x20theft\x20risk','check':b=>{if(!b['allocators_config'])return null;for(let c=0x0;c<b['allocators_config']['allocators']['length'];c++){const d=b['allocators_config']['allocators'][c],e=d['sharing']['some'](g=>'Signer'in g['who']);if(!e)continue;const f=b['guard_signer_bindings']?.[d['guard']]===!![];if(!f)return{'id':'R-A-2-01','level':'CRITICAL','category':'semantic','title':'sharing.who=Signer\x20without\x20Guard\x20Signer\x20binding\x20—\x20fund\x20theft\x20risk','description':'Allocator\x20'+c+'\x20(guard='+d['guard']+')\x20has\x20sharing.who=Signer,\x20but\x20the\x20Guard\x20does\x20not\x20bind\x20context(Signer)==authorized.\x20Anyone\x20who\x20passes\x20the\x20Guard\x20can\x20steal\x20100%\x20of\x20funds.\x20This\x20is\x20the\x20most\x20severe\x20Allocation\x20risk\x20(linked\x20to\x20guard-risk.ts\x20R-C3-06).','affected_stakeholders':['owner','recipient','service_provider'],'scenario':'Signer\x20recipient\x20without\x20Guard\x20Signer\x20authentication','mitigation':'Option\x20A\x20(preferred):\x20change\x20sharing.who\x20to\x20Entity\x20(Treasury\x20or\x20fixed\x20address).\x20Option\x20B:\x20add\x20Signer-binding\x20check\x20to\x20the\x20Guard\x20(context(Signer)==authorized_address).','evidence':'guard='+d['guard']+',\x20guardSignerBound='+f,'related_guard_risk':'R-C3-06','auto_fixable':![]};}return null;}},R_A_2_02={'id':'R-A-2-02','category':'semantic','trigger':'sharing.who=GuardIdentifier\x20but\x20Passport\x20table\x20entry\x20is\x20not\x20address\x20type','check':b=>{if(!b['allocators_config'])return null;if(!b['passport_identifier_types'])return null;for(let c=0x0;c<b['allocators_config']['allocators']['length'];c++){const d=b['allocators_config']['allocators'][c],e=d['sharing']['find'](h=>'GuardIdentifier'in h['who']);if(!e)continue;const f=e['who']['GuardIdentifier'],g=b['passport_identifier_types'][f];if(g!==undefined&&g!=='address')return{'id':'R-A-2-02','level':'MEDIUM','category':'semantic','title':'GuardIdentifier\x20'+f+'\x20resolves\x20to\x20non-address\x20type\x20('+g+')','description':'Allocator\x20'+c+'\x20uses\x20sharing.who=GuardIdentifier('+f+'),\x20but\x20Passport\x20table['+f+']\x20is\x20of\x20type\x20'+g+',\x20not\x20address.\x20Move\x20will\x20abort\x20with\x20ERECIPIENT_IDENTIFIER_NOT_ADDRESS\x20at\x20alloc()\x20time.','affected_stakeholders':['recipient'],'scenario':'Passport\x20table\x20entry\x20type\x20mismatch','mitigation':'Ensure\x20Passport\x20table['+f+']\x20is\x20address-typed,\x20OR\x20use\x20sharing.who=Entity\x20with\x20a\x20static\x20address.','evidence':'identifier='+f+',\x20type='+g,'related_move_error':'ERECIPIENT_IDENTIFIER_NOT_ADDRESS\x20(1)','auto_fixable':![]};}return null;}},R_A_2_03={'id':'R-A-2-03','category':'semantic','trigger':'Duplicate\x20Guard\x20addresses\x20in\x20allocators\x20(alloc_by_guard\x20address\x20match\x20only\x20hits\x20the\x20first\x20one)','check':a=>{if(!a['allocators_config'])return null;const b=a['allocators_config']['allocators']['map'](d=>d['guard']),c=new Set(b);if(c['size']!==b['length']){const d=b['filter']((e,f)=>b['indexOf'](e)!==f);return{'id':'R-A-2-03','level':'MEDIUM','category':'semantic','title':'Duplicate\x20Guard\x20addresses\x20in\x20allocators','description':'Multiple\x20Allocators\x20reference\x20the\x20same\x20Guard\x20object:\x20'+d['join'](',\x20')+'.\x20alloc_by_guard\x20locates\x20the\x20Allocator\x20by\x20iterating\x20guard\x20addresses;\x20duplicate\x20addresses\x20only\x20match\x20the\x20first\x20one,\x20so\x20subsequent\x20duplicate\x20Allocators\x20are\x20unreachable\x20(dead\x20code).','affected_stakeholders':['owner','allocator'],'scenario':'Reusing\x20same\x20Guard\x20object\x20across\x20multiple\x20Allocators','mitigation':'Create\x20independent\x20Guard\x20objects\x20for\x20each\x20Allocator\x20(they\x20may\x20share\x20root/table\x20but\x20must\x20differ\x20in\x20description).','evidence':'total='+b['length']+',\x20unique='+c['size']+',\x20dupes='+d['join'](','),'auto_fixable':!![]};}return null;}},R_A_3_01={'id':'R-A-3-01','category':'authority','trigger':'Service\x20already\x20published\x20—\x20order_allocators\x20is\x20immutable','check':a=>{if(!a['host_service_published'])return null;return{'id':'R-A-3-01','level':'HIGH','category':'authority','title':'order_allocators\x20immutable\x20after\x20Service\x20publish','description':'Service\x20is\x20already\x20published.\x20order_allocators\x20field\x20is\x20now\x20immutable\x20(safety-rules.ts:170-174).\x20Any\x20configuration\x20error\x20(wrong\x20Guard,\x20wrong\x20sharing\x20proportion,\x20wrong\x20Entity\x20address)\x20will\x20affect\x20ALL\x20subsequent\x20orders\x20and\x20cannot\x20be\x20fixed\x20without\x20creating\x20a\x20new\x20Service.','affected_stakeholders':['owner','service_provider'],'scenario':'Attempting\x20to\x20modify\x20order_allocators\x20after\x20Service\x20publish','mitigation':'1)\x20Verify\x20the\x20configuration\x20is\x20correct\x20before\x20publish.\x202)\x20Use\x20deploy-scanner\x20pre-publish\x20validation.\x203)\x20If\x20already\x20published\x20with\x20errors,\x20create\x20a\x20new\x20Service\x20to\x20replace.','evidence':'host_service_published='+a['host_service_published'],'auto_fixable':![]};}},R_A_3_02={'id':'R-A-3-02','category':'authority','trigger':'Treasury\x20Permission\x20inconsistent\x20with\x20Service\x20Permission','check':a=>{if(!a['allocators_config'])return null;if(!a['referenced_treasuries_permissions'])return null;if(!a['host_service_permission'])return null;for(const b of a['allocators_config']['allocators']){for(const c of b['sharing']){if(!('Entity'in c['who']))continue;const d=c['who']['Entity'],e=a['referenced_treasuries_permissions'][d];if(e&&e!==a['host_service_permission'])return{'id':'R-A-3-02','level':'MEDIUM','category':'authority','title':'Treasury\x20Permission\x20inconsistent\x20with\x20Service\x20Permission','description':'sharing.who=Entity\x20points\x20to\x20Treasury\x20'+d+'\x20whose\x20Permission\x20('+e+')\x20differs\x20from\x20Service\x20Permission\x20('+a['host_service_permission']+').\x20Two\x20different\x20permission\x20organizations\x20control\x20fund\x20flow,\x20creating\x20potential\x20authority\x20conflicts.','affected_stakeholders':['owner','service_provider'],'scenario':'Treasury\x20owned\x20by\x20different\x20party\x20than\x20Service','mitigation':'Create\x20Treasury\x20with\x20the\x20same\x20Permission\x20object\x20as\x20the\x20Service,\x20OR\x20ensure\x20both\x20are\x20owned\x20by\x20the\x20same\x20address.','evidence':'treasury='+d+',\x20treasuryPerm='+e+',\x20servicePerm='+a['host_service_permission'],'auto_fixable':![]};}}return null;}},R_A_3_03={'id':'R-A-3-03','category':'authority','trigger':'No\x20ALLOCATION_*\x20builtin\x20permission\x20index\x20—\x20Allocation\x20has\x20no\x20independent\x20access\x20control','check':a=>{if(a['operation_type']!=='create')return null;const b=a['trigger_source']==='standalone';return{'id':'R-A-3-03','level':'LOW','category':'authority','title':'Allocation\x20has\x20no\x20builtin\x20permission\x20index\x20(passive-object\x20design)','description':b?'BuiltinPermissionIndex\x20has\x20no\x20ALLOCATION_*\x20entries.\x20Allocation\x27s\x20access\x20control\x20is\x20fully\x20delegated\x20to\x20Guard\x20+\x20Passport.\x20In\x20standalone\x20mode\x20(trigger_source=standalone),\x20there\x20is\x20no\x20Service/Arbitration\x20layer\x20to\x20enforce\x20caller\x20authorization\x20—\x20Guard\x20MUST\x20provide\x20sufficient\x20access\x20control\x20(see\x20R-A-3-04).\x20This\x20is\x20the\x20\x27passive\x20object\x27\x20design\x20philosophy,\x20not\x20a\x20defect,\x20but\x20standalone\x20mode\x20shifts\x20full\x20responsibility\x20to\x20the\x20Guard\x20configuration.':'BuiltinPermissionIndex\x20has\x20no\x20ALLOCATION_*\x20entries.\x20Allocation\x27s\x20access\x20control\x20is\x20fully\x20delegated\x20to\x20Service\x20(SERVICE_ORDER_ALLOCATOR=313)\x20or\x20Arbitration\x20(ARBITRATION_FEES_ALLOC=365).\x20This\x20is\x20the\x20\x27passive\x20object\x27\x20design\x20philosophy,\x20not\x20a\x20defect.\x20In\x20embedded\x20mode,\x20the\x20host\x20Service/Arbitration\x20provides\x20an\x20additional\x20access-control\x20layer\x20on\x20top\x20of\x20Guard\x20+\x20Passport.','affected_stakeholders':['system'],'scenario':b?'Standalone\x20Allocation\x20creation\x20(user-initiated,\x20no\x20Service\x20context)':'Embedded\x20Allocation\x20creation\x20(via\x20Service\x20order_allocators\x20or\x20Arbitration\x20fees_alloc)','mitigation':b?'For\x20standalone\x20Allocation,\x20ensure\x20Guard\x20binds\x20Signer\x20or\x20enforces\x20time-lock\x20(see\x20R-A-3-04).\x20Document\x20this\x20design\x20choice\x20explicitly.':'For\x20embedded\x20Allocation,\x20ensure\x20Service/Arbitration\x20permission\x20configuration\x20is\x20correct.\x20Document\x20this\x20design\x20choice\x20explicitly.','evidence':'BuiltinPermissionIndex\x20has\x20no\x20ALLOCATION_*\x20entries;\x20trigger_source='+(a['trigger_source']??'unknown'),'auto_fixable':![]};}},R_A_3_04={'id':'R-A-3-04','category':'authority','trigger':'Standalone\x20Allocation\x20(trigger_source=standalone)\x20with\x20Guard\x20lacking\x20both\x20Signer\x20binding\x20and\x20time-lock','check':b=>{if(b['trigger_source']!=='standalone')return null;if(!b['allocators_config'])return null;const c=[];for(const d of b['allocators_config']['allocators']){const e=b['guard_signer_bindings']?.[d['guard']]===!![],f=b['guard_has_time_lock']?.[d['guard']]===!![];!e&&!f&&c['push'](d['guard']);}if(c['length']===0x0)return null;return{'id':'R-A-3-04','level':'HIGH','category':'authority','title':'Standalone\x20Allocation:\x20'+c['length']+'\x20Guard(s)\x20lack\x20Signer\x20binding\x20AND\x20time-lock','description':'Standalone\x20Allocation\x20(trigger_source=standalone)\x20has\x20no\x20Service-layer\x20access\x20control.\x20The\x20following\x20Guard(s)\x20lack\x20both\x20Signer\x20binding\x20(context(Signer)==authorized)\x20and\x20time-lock\x20(context(Clock).timestamp>=unlock):\x20'+c['join'](',\x20')+'.\x20Anyone\x20who\x20passes\x20these\x20Guards\x20can\x20trigger\x20alloc()\x20and\x20receive\x20funds,\x20with\x20no\x20additional\x20authorization\x20layer.\x20This\x20is\x20the\x20most\x20severe\x20standalone-mode\x20risk.','affected_stakeholders':['owner','recipient','system'],'scenario':'Standalone\x20Allocation\x20created\x20with\x20weak\x20Guard\x20(no\x20Signer\x20binding,\x20no\x20time-lock)','mitigation':'Option\x20A\x20(preferred):\x20configure\x20Guard\x20to\x20bind\x20context(Signer)==authorized_address,\x20so\x20only\x20the\x20owner\x20can\x20trigger\x20alloc().\x20Option\x20B:\x20configure\x20Guard\x20with\x20time-lock\x20(context(Clock).timestamp>=unlock_time)\x20for\x20vesting-style\x20releases.\x20Option\x20C:\x20switch\x20to\x20embedded\x20mode\x20(via\x20Service)\x20to\x20leverage\x20Service-layer\x20access\x20control.\x20Until\x20fixed,\x20this\x20Allocation\x20should\x20not\x20receive\x20funds.','evidence':'trigger_source=standalone,\x20weakGuards='+c['join'](','),'related_guard_risk':'R-C3-06\x20(Signer\x20binding)\x20/\x20time-lock\x20patterns','auto_fixable':![]};}},R_A_4_01={'id':'R-A-4-01','category':'lifecycle','trigger':'caller-specified\x20guard\x20with\x20no\x20matching\x20Allocator\x20—\x20silent\x20return\x20causes\x20funds\x20to\x20be\x20stuck','check':a=>{if(!a['allocators_config'])return null;if(a['allocators_config']['allocators']['length']<=0x1)return null;if(a['has_fallback_allocator'])return null;return{'id':'R-A-4-01','level':'CRITICAL','category':'lifecycle','title':'caller-specified\x20guard\x20with\x20no\x20matching\x20Allocator\x20—\x20silent\x20return\x20causes\x20funds\x20to\x20be\x20stuck','description':'Multi-Allocation\x20configuration\x20('+a['allocators_config']['allocators']['length']+'\x20Allocators)\x20without\x20alternative\x20Allocator.\x20alloc()\x20is\x20driven\x20by\x20the\x20caller\x20explicitly\x20specifying\x20an\x20Allocator\x20via\x20alloc_by_guard:\x20if\x20the\x20guard\x20address\x20does\x20not\x20match\x20any\x20allocators[].guard,\x20alloc()\x20silently\x20returns\x20(no\x20error,\x20no\x20distribution),\x20funds\x20remain\x20stuck\x20in\x20Allocation.balance,\x20and\x20the\x20caller\x20gets\x20no\x20immediate\x20signal.\x20Linked\x20to\x20guard-risk.ts\x20R-X1-05.','affected_stakeholders':['owner','service_provider','system'],'scenario':'Caller\x20passes\x20a\x20guard\x20address\x20not\x20present\x20in\x20allocators[]\x20(e.g.\x20wrong\x20Guard\x20object,\x20or\x20order\x20state\x20not\x20matching\x20any\x20terminal\x20node)','mitigation':'1)\x20The\x20caller\x20should\x20verify\x20alloc_by_guard\x20∈\x20allocators[].guard\x20address\x20set\x20before\x20calling\x20alloc().\x202)\x20Provide\x20an\x20alternative\x20Allocator\x20and\x20document\x20the\x20caller\x27s\x20retry\x20strategy.\x203)\x20Caller\x20should\x20check\x20balance==0\x20after\x20alloc()\x20to\x20detect\x20no-match.','evidence':'allocators='+a['allocators_config']['allocators']['length']+',\x20hasFallback='+(a['has_fallback_allocator']??![]),'related_guard_risk':'R-X1-05','auto_fixable':![]};}},R_A_4_02={'id':'R-A-4-02','category':'lifecycle','trigger':'Multi-Allocation\x20without\x20mutually\x20exclusive\x20Guard\x20conditions\x20(design\x20clarity\x20issue,\x20not\x20a\x20correctness\x20requirement)','check':a=>{if(!a['allocators_config'])return null;if(a['allocators_config']['allocators']['length']<=0x1)return null;if(a['guard_conditions_mutually_exclusive'])return null;return{'id':'R-A-4-02','level':'MEDIUM','category':'lifecycle','title':'Multi-Allocation\x20without\x20mutually\x20exclusive\x20Guard\x20conditions','description':'Multi-Allocation\x20('+a['allocators_config']['allocators']['length']+'\x20Allocators)\x20without\x20verified\x20mutual\x20exclusion.\x20Under\x20caller-specified\x20guard\x20semantics,\x20the\x20caller\x20explicitly\x20selects\x20an\x20Allocator\x20via\x20alloc_by_guard,\x20so\x20there\x20is\x20no\x20correctness\x20problem\x20of\x20\x22the\x20latter\x20is\x20unreachable\x22;\x20however,\x20if\x20two\x20Guard\x20conditions\x20can\x20both\x20pass\x20simultaneously\x20and\x20the\x20caller\x20has\x20no\x20explicit\x20selection\x20strategy,\x20the\x20caller\x20may\x20be\x20confused\x20or\x20bind\x20to\x20an\x20unexpected\x20path.','affected_stakeholders':['owner'],'scenario':'Two\x20Guard\x20conditions\x20overlap\x20(e.g.\x20amount<1000\x20and\x20amount<500),\x20caller\x20Passport\x20satisfies\x20both','mitigation':'It\x20is\x20recommended\x20that\x20Guard\x20conditions\x20be\x20strictly\x20mutually\x20exclusive\x20(e.g.\x20amount<1000\x20vs\x20amount>=1000)\x20to\x20avoid\x20caller\x20confusion;\x20alternatively,\x20document\x20explicitly\x20which\x20path\x20the\x20caller\x20should\x20prefer.','evidence':'allocators='+a['allocators_config']['allocators']['length']+',\x20mutuallyExclusive='+(a['guard_conditions_mutually_exclusive']??![]),'auto_fixable':![]};}},R_A_4_03={'id':'R-A-4-03','category':'lifecycle','trigger':'Pure\x20Amount\x20mode\x20without\x20Surplus\x20—\x20residual\x20balance\x20reentrancy','check':b=>{if(!b['allocators_config'])return null;for(let c=0x0;c<b['allocators_config']['allocators']['length'];c++){const d=b['allocators_config']['allocators'][c],e=d['sharing']['length']>0x0&&d['sharing']['every'](f=>f['mode']==='Amount');if(!e)continue;return{'id':'R-A-4-03','level':'LOW','category':'lifecycle','title':'Pure\x20Amount\x20mode\x20without\x20Surplus\x20—\x20residual\x20balance\x20reentrancy','description':'Allocator\x20'+c+'\x20uses\x20pure\x20Amount\x20mode\x20(no\x20Rate,\x20no\x20Surplus).\x20After\x20alloc(),\x20if\x20fix\x20<\x20balance,\x20residual\x20funds\x20remain\x20in\x20Allocation.balance\x20and\x20can\x20be\x20claimed\x20by\x20re-triggering\x20alloc().\x20Linked\x20to\x20guard-risk.ts\x20reentrancy\x20LOW.','affected_stakeholders':['owner','system'],'scenario':'Pure\x20Amount\x20mode\x20leaves\x20residual\x20balance','mitigation':'1)\x20Preferred:\x20add\x20a\x20Surplus\x20sharing\x20to\x20absorb\x20remainder.\x202)\x20Or\x20use\x20Rate\x20mode.\x203)\x20Or\x20add\x20anti-reentrancy\x20Guard\x20check:\x20logic_not(query(\x27order.allocation\x20some\x27,\x20object=order)).','evidence':'allocator['+c+'].mode=pure-amount','related_guard_risk':'reentrancy\x20LOW','auto_fixable':![]};}return null;}},R_A_5_01={'id':'R-A-5-01','category':'cross_object','trigger':'Order\x20already\x20has\x20an\x20Allocation\x20bound\x20(1:1\x20constraint)','check':a=>{if(!a['order_already_has_allocation'])return null;return{'id':'R-A-5-01','level':'HIGH','category':'cross_object','title':'Order\x20already\x20has\x20an\x20Allocation\x20—\x201:1\x20constraint\x20violation','description':'Order\x20'+(a['bound_order']??'(unknown)')+'\x20already\x20has\x20an\x20Allocation\x20bound.\x20Move\x20layer\x20will\x20abort\x20with\x20E_ALLOCATION_ALREADY_SPECIFIED\x20(order.move)\x20when\x20attempting\x20to\x20bind\x20a\x20second\x20Allocation.','affected_stakeholders':['owner','service_provider'],'scenario':'Attempting\x20to\x20bind\x20a\x20second\x20Allocation\x20to\x20the\x20same\x20Order','mitigation':'Use\x20the\x20existing\x20Allocation,\x20or\x20unbind\x20it\x20first\x20(if\x20supported),\x20or\x20create\x20a\x20new\x20Order.','evidence':'bound_order='+(a['bound_order']??'unknown')+',\x20alreadyHasAllocation='+a['order_already_has_allocation'],'related_move_error':'E_ALLOCATION_ALREADY_SPECIFIED\x20(order.move)','auto_fixable':![]};}},R_A_5_02={'id':'R-A-5-02','category':'cross_object','trigger':'payment_info\x20missing\x20for\x20alloc()\x20—\x20ENO_PAYMENT_INFO','check':a=>{if(a['has_payment_info'])return null;if(a['operation_type']!=='alloc_by_guard')return null;return{'id':'R-A-5-02','level':'HIGH','category':'cross_object','title':'payment_info\x20missing\x20—\x20alloc()\x20will\x20abort\x20with\x20ENO_PAYMENT_INFO','description':'Allocation\x20has\x20no\x20payment_info\x20set.\x20Move\x20alloc()\x20requires\x20payment_info.is_some()\x20at\x20step\x201\x20(pre_check).\x20The\x20entire\x20alloc()\x20transaction\x20will\x20revert,\x20funds\x20remain\x20in\x20Allocation.','affected_stakeholders':['owner'],'scenario':'Triggering\x20alloc()\x20before\x20setting\x20payment_info','mitigation':'Ensure\x20payment_info\x20is\x20set\x20during\x20Allocation\x20creation\x20(CallAllocation_Create\x20requires\x20payment_info\x20field).','evidence':'has_payment_info='+(a['has_payment_info']??![]),'related_move_error':'ENO_PAYMENT_INFO\x20(9)','auto_fixable':![]};}},R_A_5_03={'id':'R-A-5-03','category':'cross_object','trigger':'MAX_ALLOCATOR_COUNT\x20not\x20synced\x20to\x20onchain-constants.ts','check':a=>{return{'id':'R-A-5-03','level':'LOW','category':'cross_object','title':'MAX_ALLOCATOR_COUNT\x20not\x20synced\x20to\x20onchain-constants.ts','description':'Move\x20layer\x20allocation.move:16\x20defines\x20MAX_ALLOCATOR_COUNT='+MAX_ALLOCATOR_COUNT+',\x20but\x20onchain-constants.ts\x20does\x20NOT\x20export\x20this\x20constant.\x20SDK\x20allocation.ts:318\x20defines\x20it\x20locally,\x20creating\x20a\x20double-definition\x20risk.\x20MCP\x20knowledge\x20imports\x20the\x20local\x20definition.','affected_stakeholders':['system'],'scenario':'Constant\x20sync\x20drift\x20between\x20Move\x20/\x20SDK\x20/\x20MCP','mitigation':'1)\x20Add\x20MAX_ALLOCATOR_COUNT=100\x20to\x20onchain-constants.ts.\x202)\x20Update\x20SDK\x20allocation.ts\x20to\x20import\x20from\x20onchain-constants.js.\x203)\x20Delete\x20local\x20definition.','evidence':'MAX_ALLOCATOR_COUNT='+MAX_ALLOCATOR_COUNT+'\x20(local),\x20not\x20in\x20onchain-constants.ts','auto_fixable':!![]};}},ALL_RULES=[R_A_1_01,R_A_1_02,R_A_1_03,R_A_2_01,R_A_2_02,R_A_2_03,R_A_3_01,R_A_3_02,R_A_3_03,R_A_3_04,R_A_4_01,R_A_4_02,R_A_4_03,R_A_5_01,R_A_5_02,R_A_5_03];export const ALLOCATION_RISK_VERSION='1.0.0';export function getAllRiskRules(){return[...ALL_RULES];}export function getRiskRulesCount(){return ALL_RULES['length'];}export function getRiskRulesByCategory(a){return ALL_RULES['filter'](b=>b['category']===a);}export function assessAllocationRisks(a){const b=[];for(const g of ALL_RULES){const h=g['check'](a);if(h)b['push'](h);}const c=b['length']===0x0?'LOW':b['some'](i=>i['level']==='CRITICAL')?'CRITICAL':b['some'](i=>i['level']==='HIGH')?'HIGH':b['some'](i=>i['level']==='MEDIUM')?'MEDIUM':'LOW',d={},e={};for(const i of b){d[i['category']]=(d[i['category']]??0x0)+0x1,e[i['level']]=(e[i['level']]??0x0)+0x1;}const f={};for(const j of b){for(const k of j['affected_stakeholders']){if(!f[k])f[k]=[];f[k]['push'](j['id']+':\x20'+j['mitigation']);}}return{'summary':'Assessed\x20'+b['length']+'\x20risk(s)\x20across\x20'+Object['keys'](d)['length']+'\x20categories','risks':b,'overall_risk':c,'risks_by_category':d,'risks_by_level':e,'stakeholder_advice':f,'needs_human_review':b['some'](l=>l['level']==='CRITICAL'||l['level']==='HIGH'),'blocks_publish':b['some'](l=>l['level']==='CRITICAL')};}export{ALLOCATION_ERROR_CODES};