@wowok/agent-mcp 2.7.1 → 2.7.2

package/dist/knowledge/proof-confirm.js

@@ -1,187 +1 @@
-import { MAX_PROOF_SIZE, MAX_SERVER_PUBKEY_SIZE, MAX_SERVER_SIGNATURE_SIZE, WOWOK_WTS_PROOF_TYPE, } from "@wowok/wowok";
-function checkDescription(input) {
-    const passed = !!input.description && input.description.length > 0;
-    return {
-        id: "C-PROOF-01",
-        severity: passed ? "info" : "warn",
-        title: "description is provided and non-empty",
-        description: "description is a REQUIRED field (PF-D-2=A). Move contract stores it as String; SDK enforces isValidDescription. " +
-            "Empty string (\"\") is technically valid but makes the Proof hard to identify in queries.",
-        passed,
-        evidence: input.description === undefined ? "undefined" : `length=${input.description.length}`,
-        fix_hint: "Provide a one-line description like \"KYC attestation for user 0xabc\".",
-    };
-}
-function checkProofContent(input) {
-    const len = input.proof?.length ?? 0;
-    const passed = len > 0 && len <= MAX_PROOF_SIZE;
-    return {
-        id: "C-PROOF-02",
-        severity: passed ? "info" : "block",
-        title: `proof content within MAX_PROOF_SIZE (${MAX_PROOF_SIZE} bytes)`,
-        description: "The 'proof' string field must be non-empty and ≤ MAX_PROOF_SIZE bytes. Move aborts with E_MAX_PROOF_SIZE (1) on overflow. " +
-            "Typically holds a merkle root or compact digest — large data should go in a Repository.",
-        passed,
-        evidence: `length=${len}, limit=${MAX_PROOF_SIZE}`,
-        fix_hint: `Keep proof content compact. Current overflow: ${Math.max(0, len - MAX_PROOF_SIZE)} bytes.`,
-    };
-}
-function checkServerPubkey(input) {
-    const len = input.server_pubkey?.length ?? 0;
-    const passed = len > 0 && len <= MAX_SERVER_PUBKEY_SIZE;
-    return {
-        id: "C-PROOF-03",
-        severity: passed ? "info" : "block",
-        title: `server_pubkey within MAX_SERVER_PUBKEY_SIZE (${MAX_SERVER_PUBKEY_SIZE} bytes)`,
-        description: "server_pubkey must be non-empty and ≤ MAX_SERVER_PUBKEY_SIZE bytes. Move aborts with E_MAX_SERVER_PUBKEY_SIZE (2). " +
-            "Submit raw public key bytes (hex-encoded), not a certificate chain.",
-        passed,
-        evidence: `length=${len}, limit=${MAX_SERVER_PUBKEY_SIZE}`,
-        fix_hint: "Submit only the raw public key (Ed25519=32B, RSA-2048=256B, BLS12-381 G1=48B, G2=96B).",
-    };
-}
-function checkServerSignature(input) {
-    const len = input.server_signature?.length ?? 0;
-    const passed = len > 0 && len <= MAX_SERVER_SIGNATURE_SIZE;
-    return {
-        id: "C-PROOF-04",
-        severity: passed ? "info" : "block",
-        title: `server_signature within MAX_SERVER_SIGNATURE_SIZE (${MAX_SERVER_SIGNATURE_SIZE} bytes)`,
-        description: "server_signature must be non-empty and ≤ MAX_SERVER_SIGNATURE_SIZE bytes. Move aborts with E_MAX_SERVER_SIGNATURE_SIZE (3). " +
-            "Submit raw signature bytes, not bundled metadata.",
-        passed,
-        evidence: `length=${len}, limit=${MAX_SERVER_SIGNATURE_SIZE}`,
-        fix_hint: "Submit only the raw signature (Ed25519=64B, ECDSA=64-72B, BLS12-381=96B, RSA-2048=256B).",
-    };
-}
-function checkProofType(input) {
-    if (input.proof_type === undefined || input.proof_type === null) {
-        return {
-            id: "C-PROOF-05",
-            severity: "block",
-            title: "proof_type is provided",
-            description: `proof_type is a required u64. ${WOWOK_WTS_PROOF_TYPE}=WOWOK_WTS_PROOF_TYPE (WTS proof); 2-100 reserved for Wowok; >100 user-defined.`,
-            passed: false,
-            evidence: "undefined",
-            fix_hint: `Use ${WOWOK_WTS_PROOF_TYPE} for WTS proofs, or >100 for custom types.`,
-        };
-    }
-    const n = typeof input.proof_type === "string" ? BigInt(input.proof_type) : BigInt(input.proof_type);
-    const passed = n >= 1n;
-    const severity = passed
-        ? (n > 1n && n <= 100n ? "warn" : "info")
-        : "block";
-    return {
-        id: "C-PROOF-05",
-        severity,
-        title: `proof_type valid (${WOWOK_WTS_PROOF_TYPE}=WTS, 2-100 reserved, >100 user-defined)`,
-        description: `proof_type must be ≥ 1 (P-PROOF-P2-2). Value ${WOWOK_WTS_PROOF_TYPE}=WOWOK_WTS_PROOF_TYPE (WTS proof signed by off-chain server). ` +
-            `Values 2-100 are reserved for future Wowok-defined types — using them without authority creates semantic confusion.`,
-        passed,
-        evidence: `proof_type=${input.proof_type}`,
-        fix_hint: passed ? undefined : `Use ≥ 1. For custom types, use > 100.`,
-    };
-}
-function checkAboutAddress(input) {
-    const addr = input.about_address;
-    if (addr === null || addr === undefined || addr === "") {
-        return {
-            id: "C-PROOF-06",
-            severity: "info",
-            title: "about_address is null → free-standing Proof (no on-chain entity binding)",
-            description: "about_address=null is valid (PF-D-1=A, SDK sends Option::none). Use this for free-standing cryptographic statements. " +
-                "For entity-bound attestations, set about_address to the on-chain entity address (raw 0x-prefixed, not a name).",
-            passed: true,
-            evidence: "null/empty → Option::none",
-        };
-    }
-    const isValid = /^0x[0-9a-fA-F]{64}$/.test(addr);
-    return {
-        id: "C-PROOF-06",
-        severity: isValid ? "info" : "block",
-        title: "about_address is a valid raw 0x-prefixed address (or null)",
-        description: "When provided, about_address must be a raw address (NOT a name). SDK isValidAddress check enforces 0x-prefixed 64-hex format. " +
-            "Name resolution is NOT performed at the SDK layer for this field.",
-        passed: isValid,
-        evidence: `about_address=${addr.substring(0, 10)}...`,
-        fix_hint: "Use 0x-prefixed 64-hex address. Names are not accepted.",
-    };
-}
-function checkItemCount(input) {
-    if (input.item_count === undefined || input.item_count === null) {
-        return {
-            id: "C-PROOF-07",
-            severity: "info",
-            title: "item_count is optional (null → Option::none)",
-            description: "item_count is an optional u64. Use it to indicate the number of items in the off-chain data structure (e.g. merkle tree leaf count). " +
-                "When null, SDK sends Option::none to Move.",
-            passed: true,
-            evidence: "optional/none",
-        };
-    }
-    const n = typeof input.item_count === "string" ? BigInt(input.item_count) : BigInt(input.item_count);
-    const passed = n >= 0n;
-    return {
-        id: "C-PROOF-07",
-        severity: passed ? "info" : "block",
-        title: "item_count is a non-negative u64 (or null)",
-        description: "When provided, item_count must be ≥ 0. Used to indicate off-chain data structure size (e.g. merkle leaf count).",
-        passed,
-        evidence: `item_count=${input.item_count}`,
-    };
-}
-function checkNamedNew(input) {
-    const has = !!input.namedNew;
-    return {
-        id: "C-PROOF-08",
-        severity: has ? "info" : "warn",
-        title: "namedNew is provided (recommended for discoverability)",
-        description: "namedNew={name, tag?} is optional but recommended. Without it, the Proof is created without a local mark, " +
-            "making it harder to reference in subsequent operations. The 'name' should be descriptive (e.g. \"kyc_user_abc\").",
-        passed: has,
-        evidence: has ? `name=${input.namedNew.name}` : "not provided",
-        fix_hint: "Provide namedNew={name: \"descriptive_name\"} for easier subsequent reference.",
-    };
-}
-export function preCheckProofCreation(input) {
-    return [
-        checkDescription(input),
-        checkProofContent(input),
-        checkServerPubkey(input),
-        checkServerSignature(input),
-        checkProofType(input),
-        checkAboutAddress(input),
-        checkItemCount(input),
-        checkNamedNew(input),
-    ];
-}
-export function canCreateProof(input) {
-    const items = preCheckProofCreation(input);
-    return {
-        canCreate: items.every(i => i.severity !== "block" || i.passed),
-        blockers: items.filter(i => i.severity === "block" && !i.passed),
-        warnings: items.filter(i => i.severity === "warn" && !i.passed),
-        info: items.filter(i => i.severity === "info"),
-    };
-}
-export function formatProofCreationSummary(input) {
-    const { canCreate, blockers, warnings, info } = canCreateProof(input);
-    const lines = [];
-    lines.push(canCreate ? "✓ Proof creation pre-check PASSED" : "✗ Proof creation pre-check FAILED");
-    lines.push("");
-    if (blockers.length > 0) {
-        lines.push("BLOCKERS (must fix before creation):");
-        blockers.forEach(b => lines.push(`  [${b.id}] ${b.title} — ${b.evidence ?? ""}`));
-        lines.push("");
-    }
-    if (warnings.length > 0) {
-        lines.push("WARNINGS (review recommended):");
-        warnings.forEach(w => lines.push(`  [${w.id}] ${w.title} — ${w.evidence ?? ""}`));
-        lines.push("");
-    }
-    if (info.length > 0) {
-        lines.push("INFO:");
-        info.forEach(i => lines.push(`  [${i.id}] ${i.title}`));
-    }
-    return lines.join("\n");
-}
+import{MAX_PROOF_SIZE,MAX_SERVER_PUBKEY_SIZE,MAX_SERVER_SIGNATURE_SIZE,WOWOK_WTS_PROOF_TYPE}from'@wowok/wowok';function checkDescription(a){const b=!!a['description']&&a['description']['length']>0x0;return{'id':'C-PROOF-01','severity':b?'info':'warn','title':'description\x20is\x20provided\x20and\x20non-empty','description':'description\x20is\x20a\x20REQUIRED\x20field\x20(PF-D-2=A).\x20Move\x20contract\x20stores\x20it\x20as\x20String;\x20SDK\x20enforces\x20isValidDescription.\x20'+'Empty\x20string\x20(\x22\x22)\x20is\x20technically\x20valid\x20but\x20makes\x20the\x20Proof\x20hard\x20to\x20identify\x20in\x20queries.','passed':b,'evidence':a['description']===undefined?'undefined':'length='+a['description']['length'],'fix_hint':'Provide\x20a\x20one-line\x20description\x20like\x20\x22KYC\x20attestation\x20for\x20user\x200xabc\x22.'};}function checkProofContent(a){const b=a['proof']?.['length']??0x0,c=b>0x0&&b<=MAX_PROOF_SIZE;return{'id':'C-PROOF-02','severity':c?'info':'block','title':'proof\x20content\x20within\x20MAX_PROOF_SIZE\x20('+MAX_PROOF_SIZE+'\x20bytes)','description':'The\x20\x27proof\x27\x20string\x20field\x20must\x20be\x20non-empty\x20and\x20≤\x20MAX_PROOF_SIZE\x20bytes.\x20Move\x20aborts\x20with\x20E_MAX_PROOF_SIZE\x20(1)\x20on\x20overflow.\x20'+'Typically\x20holds\x20a\x20merkle\x20root\x20or\x20compact\x20digest\x20—\x20large\x20data\x20should\x20go\x20in\x20a\x20Repository.','passed':c,'evidence':'length='+b+',\x20limit='+MAX_PROOF_SIZE,'fix_hint':'Keep\x20proof\x20content\x20compact.\x20Current\x20overflow:\x20'+Math['max'](0x0,b-MAX_PROOF_SIZE)+'\x20bytes.'};}function checkServerPubkey(a){const b=a['server_pubkey']?.['length']??0x0,c=b>0x0&&b<=MAX_SERVER_PUBKEY_SIZE;return{'id':'C-PROOF-03','severity':c?'info':'block','title':'server_pubkey\x20within\x20MAX_SERVER_PUBKEY_SIZE\x20('+MAX_SERVER_PUBKEY_SIZE+'\x20bytes)','description':'server_pubkey\x20must\x20be\x20non-empty\x20and\x20≤\x20MAX_SERVER_PUBKEY_SIZE\x20bytes.\x20Move\x20aborts\x20with\x20E_MAX_SERVER_PUBKEY_SIZE\x20(2).\x20'+'Submit\x20raw\x20public\x20key\x20bytes\x20(hex-encoded),\x20not\x20a\x20certificate\x20chain.','passed':c,'evidence':'length='+b+',\x20limit='+MAX_SERVER_PUBKEY_SIZE,'fix_hint':'Submit\x20only\x20the\x20raw\x20public\x20key\x20(Ed25519=32B,\x20RSA-2048=256B,\x20BLS12-381\x20G1=48B,\x20G2=96B).'};}function checkServerSignature(a){const b=a['server_signature']?.['length']??0x0,c=b>0x0&&b<=MAX_SERVER_SIGNATURE_SIZE;return{'id':'C-PROOF-04','severity':c?'info':'block','title':'server_signature\x20within\x20MAX_SERVER_SIGNATURE_SIZE\x20('+MAX_SERVER_SIGNATURE_SIZE+'\x20bytes)','description':'server_signature\x20must\x20be\x20non-empty\x20and\x20≤\x20MAX_SERVER_SIGNATURE_SIZE\x20bytes.\x20Move\x20aborts\x20with\x20E_MAX_SERVER_SIGNATURE_SIZE\x20(3).\x20'+'Submit\x20raw\x20signature\x20bytes,\x20not\x20bundled\x20metadata.','passed':c,'evidence':'length='+b+',\x20limit='+MAX_SERVER_SIGNATURE_SIZE,'fix_hint':'Submit\x20only\x20the\x20raw\x20signature\x20(Ed25519=64B,\x20ECDSA=64-72B,\x20BLS12-381=96B,\x20RSA-2048=256B).'};}function checkProofType(a){if(a['proof_type']===undefined||a['proof_type']===null)return{'id':'C-PROOF-05','severity':'block','title':'proof_type\x20is\x20provided','description':'proof_type\x20is\x20a\x20required\x20u64.\x20'+WOWOK_WTS_PROOF_TYPE+'=WOWOK_WTS_PROOF_TYPE\x20(WTS\x20proof);\x202-100\x20reserved\x20for\x20Wowok;\x20>100\x20user-defined.','passed':![],'evidence':'undefined','fix_hint':'Use\x20'+WOWOK_WTS_PROOF_TYPE+'\x20for\x20WTS\x20proofs,\x20or\x20>100\x20for\x20custom\x20types.'};const b=typeof a['proof_type']==='string'?BigInt(a['proof_type']):BigInt(a['proof_type']),c=b>=0x1n,d=c?b>0x1n&&b<=0x64n?'warn':'info':'block';return{'id':'C-PROOF-05','severity':d,'title':'proof_type\x20valid\x20('+WOWOK_WTS_PROOF_TYPE+'=WTS,\x202-100\x20reserved,\x20>100\x20user-defined)','description':'proof_type\x20must\x20be\x20≥\x201\x20(P-PROOF-P2-2).\x20Value\x20'+WOWOK_WTS_PROOF_TYPE+'=WOWOK_WTS_PROOF_TYPE\x20(WTS\x20proof\x20signed\x20by\x20off-chain\x20server).\x20'+'Values\x202-100\x20are\x20reserved\x20for\x20future\x20Wowok-defined\x20types\x20—\x20using\x20them\x20without\x20authority\x20creates\x20semantic\x20confusion.','passed':c,'evidence':'proof_type='+a['proof_type'],'fix_hint':c?undefined:'Use\x20≥\x201.\x20For\x20custom\x20types,\x20use\x20>\x20100.'};}function checkAboutAddress(a){const b=a['about_address'];if(b===null||b===undefined||b==='')return{'id':'C-PROOF-06','severity':'info','title':'about_address\x20is\x20null\x20→\x20free-standing\x20Proof\x20(no\x20on-chain\x20entity\x20binding)','description':'about_address=null\x20is\x20valid\x20(PF-D-1=A,\x20SDK\x20sends\x20Option::none).\x20Use\x20this\x20for\x20free-standing\x20cryptographic\x20statements.\x20'+'For\x20entity-bound\x20attestations,\x20set\x20about_address\x20to\x20the\x20on-chain\x20entity\x20address\x20(raw\x200x-prefixed,\x20not\x20a\x20name).','passed':!![],'evidence':'null/empty\x20→\x20Option::none'};const c=/^0x[0-9a-fA-F]{64}$/['test'](b);return{'id':'C-PROOF-06','severity':c?'info':'block','title':'about_address\x20is\x20a\x20valid\x20raw\x200x-prefixed\x20address\x20(or\x20null)','description':'When\x20provided,\x20about_address\x20must\x20be\x20a\x20raw\x20address\x20(NOT\x20a\x20name).\x20SDK\x20isValidAddress\x20check\x20enforces\x200x-prefixed\x2064-hex\x20format.\x20'+'Name\x20resolution\x20is\x20NOT\x20performed\x20at\x20the\x20SDK\x20layer\x20for\x20this\x20field.','passed':c,'evidence':'about_address='+b['substring'](0x0,0xa)+'...','fix_hint':'Use\x200x-prefixed\x2064-hex\x20address.\x20Names\x20are\x20not\x20accepted.'};}function checkItemCount(a){if(a['item_count']===undefined||a['item_count']===null)return{'id':'C-PROOF-07','severity':'info','title':'item_count\x20is\x20optional\x20(null\x20→\x20Option::none)','description':'item_count\x20is\x20an\x20optional\x20u64.\x20Use\x20it\x20to\x20indicate\x20the\x20number\x20of\x20items\x20in\x20the\x20off-chain\x20data\x20structure\x20(e.g.\x20merkle\x20tree\x20leaf\x20count).\x20'+'When\x20null,\x20SDK\x20sends\x20Option::none\x20to\x20Move.','passed':!![],'evidence':'optional/none'};const b=typeof a['item_count']==='string'?BigInt(a['item_count']):BigInt(a['item_count']),c=b>=0x0n;return{'id':'C-PROOF-07','severity':c?'info':'block','title':'item_count\x20is\x20a\x20non-negative\x20u64\x20(or\x20null)','description':'When\x20provided,\x20item_count\x20must\x20be\x20≥\x200.\x20Used\x20to\x20indicate\x20off-chain\x20data\x20structure\x20size\x20(e.g.\x20merkle\x20leaf\x20count).','passed':c,'evidence':'item_count='+a['item_count']};}function checkNamedNew(a){const b=!!a['namedNew'];return{'id':'C-PROOF-08','severity':b?'info':'warn','title':'namedNew\x20is\x20provided\x20(recommended\x20for\x20discoverability)','description':'namedNew={name,\x20tag?}\x20is\x20optional\x20but\x20recommended.\x20Without\x20it,\x20the\x20Proof\x20is\x20created\x20without\x20a\x20local\x20mark,\x20'+'making\x20it\x20harder\x20to\x20reference\x20in\x20subsequent\x20operations.\x20The\x20\x27name\x27\x20should\x20be\x20descriptive\x20(e.g.\x20\x22kyc_user_abc\x22).','passed':b,'evidence':b?'name='+a['namedNew']['name']:'not\x20provided','fix_hint':'Provide\x20namedNew={name:\x20\x22descriptive_name\x22}\x20for\x20easier\x20subsequent\x20reference.'};}export function preCheckProofCreation(a){return[checkDescription(a),checkProofContent(a),checkServerPubkey(a),checkServerSignature(a),checkProofType(a),checkAboutAddress(a),checkItemCount(a),checkNamedNew(a)];}export function canCreateProof(a){const b=preCheckProofCreation(a);return{'canCreate':b['every'](c=>c['severity']!=='block'||c['passed']),'blockers':b['filter'](c=>c['severity']==='block'&&!c['passed']),'warnings':b['filter'](c=>c['severity']==='warn'&&!c['passed']),'info':b['filter'](c=>c['severity']==='info')};}export function formatProofCreationSummary(a){const {canCreate:b,blockers:c,warnings:d,info:e}=canCreateProof(a),f=[];return f['push'](b?'✓\x20Proof\x20creation\x20pre-check\x20PASSED':'✗\x20Proof\x20creation\x20pre-check\x20FAILED'),f['push'](''),c['length']>0x0&&(f['push']('BLOCKERS\x20(must\x20fix\x20before\x20creation):'),c['forEach'](g=>f['push']('\x20\x20['+g['id']+']\x20'+g['title']+'\x20—\x20'+(g['evidence']??''))),f['push']('')),d['length']>0x0&&(f['push']('WARNINGS\x20(review\x20recommended):'),d['forEach'](g=>f['push']('\x20\x20['+g['id']+']\x20'+g['title']+'\x20—\x20'+(g['evidence']??''))),f['push']('')),e['length']>0x0&&(f['push']('INFO:'),e['forEach'](g=>f['push']('\x20\x20['+g['id']+']\x20'+g['title']))),f['join']('\x0a');}

package/dist/knowledge/proof-risk.js

@@ -1,207 +1 @@
-import { MAX_PROOF_SIZE, MAX_SERVER_PUBKEY_SIZE, MAX_SERVER_SIGNATURE_SIZE, WOWOK_WTS_PROOF_TYPE, } from "@wowok/wowok";
-const R_PR_1_01 = {
-    rule: {
-        id: "R-PROOF-01",
-        level: "HIGH",
-        category: "structural",
-        title: `proof content exceeds MAX_PROOF_SIZE (${MAX_PROOF_SIZE} bytes)`,
-        description: `The 'proof' string field is bounded by MAX_PROOF_SIZE=${MAX_PROOF_SIZE} bytes (Move source: proof.move:27). ` +
-            `Exceeding this limit aborts with E_MAX_PROOF_SIZE (1). The proof content typically holds a merkle tree root ` +
-            `or similar compact cryptographic digest — large data should be stored in a Repository and referenced by address, ` +
-            `not inlined into the Proof object.`,
-        affected_stakeholders: ["creator"],
-        scenario: "Caller submits a proof string longer than 10240 bytes",
-        mitigation: `Keep proof content compact (merkle root, hash digest). For larger payloads, store data in a Repository ` +
-            `object and set about_address to the Repository address, or use item_count to indicate the off-chain data size.`,
-        related_move_error: "E_MAX_PROOF_SIZE (1)",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.proof)
-            return null;
-        if (ctx.proof.length <= MAX_PROOF_SIZE)
-            return null;
-        return { ...R_PR_1_01.rule, evidence: `proof.length=${ctx.proof.length}, limit=${MAX_PROOF_SIZE}` };
-    },
-};
-const R_PR_1_02 = {
-    rule: {
-        id: "R-PROOF-02",
-        level: "MEDIUM",
-        category: "structural",
-        title: `server_pubkey exceeds MAX_SERVER_PUBKEY_SIZE (${MAX_SERVER_PUBKEY_SIZE} bytes)`,
-        description: `The 'server_pubkey' field is bounded by MAX_SERVER_PUBKEY_SIZE=${MAX_SERVER_PUBKEY_SIZE} bytes (Move source: proof.move:28). ` +
-            `Exceeding this limit aborts with E_MAX_SERVER_PUBKEY_SIZE (2). Typical public keys (Ed25519=32 bytes, RSA-2048=256 bytes, ` +
-            `BLS12-381 G1=48 bytes, G2=96 bytes) fit comfortably within this limit.`,
-        affected_stakeholders: ["creator"],
-        scenario: "Caller submits an oversized server public key (e.g. certificate chain instead of raw key)",
-        mitigation: "Submit only the raw public key bytes (hex-encoded), not a full certificate or JWK structure.",
-        related_move_error: "E_MAX_SERVER_PUBKEY_SIZE (2)",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.server_pubkey)
-            return null;
-        if (ctx.server_pubkey.length <= MAX_SERVER_PUBKEY_SIZE)
-            return null;
-        return { ...R_PR_1_02.rule, evidence: `server_pubkey.length=${ctx.server_pubkey.length}, limit=${MAX_SERVER_PUBKEY_SIZE}` };
-    },
-};
-const R_PR_1_03 = {
-    rule: {
-        id: "R-PROOF-03",
-        level: "MEDIUM",
-        category: "structural",
-        title: `server_signature exceeds MAX_SERVER_SIGNATURE_SIZE (${MAX_SERVER_SIGNATURE_SIZE} bytes)`,
-        description: `The 'server_signature' field is bounded by MAX_SERVER_SIGNATURE_SIZE=${MAX_SERVER_SIGNATURE_SIZE} bytes ` +
-            `(Move source: proof.move:29). Exceeding this limit aborts with E_MAX_SERVER_SIGNATURE_SIZE (3). ` +
-            `Most signature schemes produce signatures well under this limit (Ed25519=64 bytes, ECDSA=64-72 bytes, ` +
-            `BLS12-381=96 bytes, RSA-2048=256 bytes).`,
-        affected_stakeholders: ["creator"],
-        scenario: "Caller submits an oversized signature (e.g. bundled with metadata)",
-        mitigation: "Submit only the raw signature bytes (hex-encoded), not bundled metadata or certificate chains.",
-        related_move_error: "E_MAX_SERVER_SIGNATURE_SIZE (3)",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.server_signature)
-            return null;
-        if (ctx.server_signature.length <= MAX_SERVER_SIGNATURE_SIZE)
-            return null;
-        return { ...R_PR_1_03.rule, evidence: `server_signature.length=${ctx.server_signature.length}, limit=${MAX_SERVER_SIGNATURE_SIZE}` };
-    },
-};
-const R_PR_2_01 = {
-    rule: {
-        id: "R-PROOF-04",
-        level: "MEDIUM",
-        category: "semantic",
-        title: `proof_type in reserved range without authority (1-100 reserved for Wowok)`,
-        description: `proof_type=${WOWOK_WTS_PROOF_TYPE} is WOWOK_WTS_PROOF_TYPE (Will-To-Sign). Values 2-100 are reserved for ` +
-            `future Wowok-defined proof types. User-defined proof types must use values > 100. While the Move contract ` +
-            `does not currently enforce this range at the type level (it accepts any u64), using a reserved value without ` +
-            `authority creates semantic confusion: consumers may misinterpret the proof's verification rules.`,
-        affected_stakeholders: ["creator", "consumer", "verifier"],
-        scenario: "User creates a custom proof with proof_type=5 (a reserved value)",
-        mitigation: "Use proof_type > 100 for user-defined proof types. Use proof_type=1 only for WTS proofs signed by an " +
-            "off-chain server (with server_pubkey + server_signature). Document the verification rule for custom types.",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (ctx.proof_type === undefined || ctx.proof_type === null)
-            return null;
-        const n = typeof ctx.proof_type === "string" ? BigInt(ctx.proof_type) : BigInt(ctx.proof_type);
-        if (n === BigInt(WOWOK_WTS_PROOF_TYPE) || n > 100n)
-            return null;
-        return { ...R_PR_2_01.rule, evidence: `proof_type=${ctx.proof_type} (reserved range 2-100)` };
-    },
-};
-const R_PR_2_02 = {
-    rule: {
-        id: "R-PROOF-05",
-        level: "LOW",
-        category: "semantic",
-        title: "about_address not provided — consumers cannot locate the referenced entity",
-        description: "about_address is the on-chain address of the entity being proved (e.g. a user, an order, a Repository). " +
-            "When null/undefined, the Proof has no on-chain binding — it is a free-standing cryptographic statement. " +
-            "Consumers (Repository, Service, etc.) that reference this Proof cannot automatically resolve which entity " +
-            "it applies to. This is acceptable for generic proofs but problematic for entity-bound attestations.",
-        affected_stakeholders: ["creator", "consumer"],
-        scenario: "Caller creates a Proof without about_address, then a Repository tries to bind it to a data entry",
-        mitigation: "Set about_address when the Proof attests to a specific on-chain entity. Leave it null only for " +
-            "free-standing cryptographic statements (e.g. a server's timestamp attestation).",
-        auto_fixable: true,
-    },
-    check: (ctx) => {
-        if (ctx.about_address)
-            return null;
-        return { ...R_PR_2_02.rule, evidence: "about_address=null/undefined" };
-    },
-};
-const R_PR_3_01 = {
-    rule: {
-        id: "R-PROOF-06",
-        level: "LOW",
-        category: "lifecycle",
-        title: "description missing — Proof hard to identify in queries and audit logs",
-        description: "description is a REQUIRED field (PF-D-2=A). The Move contract stores it as a String field and SDK " +
-            "passes it to create_wowok_proof. An empty description (\"\") is technically valid but makes the Proof " +
-            "hard to identify in query results and audit logs. Non-empty descriptions are strongly recommended.",
-        affected_stakeholders: ["creator", "verifier"],
-        scenario: "Caller passes description=\"\" to save typing",
-        mitigation: "Provide a one-line description like \"KYC attestation for user 0xabc\" or \"merkle root for batch #42\".",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (ctx.description === undefined)
-            return null;
-        if (ctx.description.length > 0)
-            return null;
-        return { ...R_PR_3_01.rule, evidence: "description=\"\" (empty)" };
-    },
-};
-const R_PR_3_02 = {
-    rule: {
-        id: "R-PROOF-07",
-        level: "HIGH",
-        category: "lifecycle",
-        title: "Proof is immutable — cannot modify after creation (freeze_object)",
-        description: "Proof is created via transfer::freeze_object(obj) in Move (proof.move:65). Once frozen, the object " +
-            "cannot be modified, transferred, or deleted. All fields (proof, server_pubkey, server_signature, " +
-            "about, proof_type, signer, time, description, item_count) are permanently fixed at the value set " +
-            "during create_wowok_proof(). To 'update' a Proof, create a new one and update references.",
-        affected_stakeholders: ["creator", "consumer"],
-        scenario: "Caller wants to update server_signature after key rotation — cannot, must create new Proof",
-        mitigation: "Verify all fields before calling create_wowok_proof. For scenarios requiring key rotation, " +
-            "create a new Proof and update the referencing object (Repository data, Service config, etc.) to " +
-            "point to the new Proof address.",
-        auto_fixable: false,
-    },
-    check: (ctx) => null,
-};
-const R_PR_4_01 = {
-    rule: {
-        id: "R-PROOF-08",
-        level: "INFO",
-        category: "knowledge",
-        title: "Knowledge layer & constant sync — RESOLVED",
-        description: "All 4 Proof constants (WOWOK_WTS_PROOF_TYPE, MAX_PROOF_SIZE, MAX_SERVER_PUBKEY_SIZE, " +
-            "MAX_SERVER_SIGNATURE_SIZE) are now synced to onchain-constants.ts (P-PROOF-P2-5). The MCP Knowledge " +
-            "layer now includes proof-risk.ts, proof-confirm.ts, proof-translation.ts (P-PROOF-P2-6). " +
-            "This risk rule is retained for historical audit and to detect future regressions.",
-        affected_stakeholders: ["system"],
-        scenario: "Future regression: someone removes a Proof constant from onchain-constants.ts",
-        mitigation: "Run the onchain-constants sync test to detect drift.",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (ctx.constants_synced)
-            return null;
-        return { ...R_PR_4_01.rule, evidence: "constants_synced=false" };
-    },
-};
-export const PROOF_RISK_RULES = [
-    R_PR_1_01,
-    R_PR_1_02,
-    R_PR_1_03,
-    R_PR_2_01,
-    R_PR_2_02,
-    R_PR_3_01,
-    R_PR_3_02,
-    R_PR_4_01,
-];
-export function checkProofRisks(ctx) {
-    const risks = [];
-    for (const rule of PROOF_RISK_RULES) {
-        const r = rule.check(ctx);
-        if (r)
-            risks.push(r);
-    }
-    if (!risks.find(r => r.id === "R-PROOF-07")) {
-        risks.push(R_PR_3_02.rule);
-    }
-    return risks;
-}
-export function getProofRiskById(id) {
-    return PROOF_RISK_RULES.find(r => r.rule.id === id)?.rule;
-}
+import{MAX_PROOF_SIZE,MAX_SERVER_PUBKEY_SIZE,MAX_SERVER_SIGNATURE_SIZE,WOWOK_WTS_PROOF_TYPE}from'@wowok/wowok';const R_PR_1_01={'rule':{'id':'R-PROOF-01','level':'HIGH','category':'structural','title':'proof\x20content\x20exceeds\x20MAX_PROOF_SIZE\x20('+MAX_PROOF_SIZE+'\x20bytes)','description':'The\x20\x27proof\x27\x20string\x20field\x20is\x20bounded\x20by\x20MAX_PROOF_SIZE='+MAX_PROOF_SIZE+'\x20bytes\x20(Move\x20source:\x20proof.move:27).\x20'+'Exceeding\x20this\x20limit\x20aborts\x20with\x20E_MAX_PROOF_SIZE\x20(1).\x20The\x20proof\x20content\x20typically\x20holds\x20a\x20merkle\x20tree\x20root\x20'+'or\x20similar\x20compact\x20cryptographic\x20digest\x20—\x20large\x20data\x20should\x20be\x20stored\x20in\x20a\x20Repository\x20and\x20referenced\x20by\x20address,\x20'+'not\x20inlined\x20into\x20the\x20Proof\x20object.','affected_stakeholders':['creator'],'scenario':'Caller\x20submits\x20a\x20proof\x20string\x20longer\x20than\x2010240\x20bytes','mitigation':'Keep\x20proof\x20content\x20compact\x20(merkle\x20root,\x20hash\x20digest).\x20For\x20larger\x20payloads,\x20store\x20data\x20in\x20a\x20Repository\x20'+'object\x20and\x20set\x20about_address\x20to\x20the\x20Repository\x20address,\x20or\x20use\x20item_count\x20to\x20indicate\x20the\x20off-chain\x20data\x20size.','related_move_error':'E_MAX_PROOF_SIZE\x20(1)','auto_fixable':![]},'check':a=>{if(!a['proof'])return null;if(a['proof']['length']<=MAX_PROOF_SIZE)return null;return{...R_PR_1_01['rule'],'evidence':'proof.length='+a['proof']['length']+',\x20limit='+MAX_PROOF_SIZE};}},R_PR_1_02={'rule':{'id':'R-PROOF-02','level':'MEDIUM','category':'structural','title':'server_pubkey\x20exceeds\x20MAX_SERVER_PUBKEY_SIZE\x20('+MAX_SERVER_PUBKEY_SIZE+'\x20bytes)','description':'The\x20\x27server_pubkey\x27\x20field\x20is\x20bounded\x20by\x20MAX_SERVER_PUBKEY_SIZE='+MAX_SERVER_PUBKEY_SIZE+'\x20bytes\x20(Move\x20source:\x20proof.move:28).\x20'+'Exceeding\x20this\x20limit\x20aborts\x20with\x20E_MAX_SERVER_PUBKEY_SIZE\x20(2).\x20Typical\x20public\x20keys\x20(Ed25519=32\x20bytes,\x20RSA-2048=256\x20bytes,\x20'+'BLS12-381\x20G1=48\x20bytes,\x20G2=96\x20bytes)\x20fit\x20comfortably\x20within\x20this\x20limit.','affected_stakeholders':['creator'],'scenario':'Caller\x20submits\x20an\x20oversized\x20server\x20public\x20key\x20(e.g.\x20certificate\x20chain\x20instead\x20of\x20raw\x20key)','mitigation':'Submit\x20only\x20the\x20raw\x20public\x20key\x20bytes\x20(hex-encoded),\x20not\x20a\x20full\x20certificate\x20or\x20JWK\x20structure.','related_move_error':'E_MAX_SERVER_PUBKEY_SIZE\x20(2)','auto_fixable':![]},'check':a=>{if(!a['server_pubkey'])return null;if(a['server_pubkey']['length']<=MAX_SERVER_PUBKEY_SIZE)return null;return{...R_PR_1_02['rule'],'evidence':'server_pubkey.length='+a['server_pubkey']['length']+',\x20limit='+MAX_SERVER_PUBKEY_SIZE};}},R_PR_1_03={'rule':{'id':'R-PROOF-03','level':'MEDIUM','category':'structural','title':'server_signature\x20exceeds\x20MAX_SERVER_SIGNATURE_SIZE\x20('+MAX_SERVER_SIGNATURE_SIZE+'\x20bytes)','description':'The\x20\x27server_signature\x27\x20field\x20is\x20bounded\x20by\x20MAX_SERVER_SIGNATURE_SIZE='+MAX_SERVER_SIGNATURE_SIZE+'\x20bytes\x20'+'(Move\x20source:\x20proof.move:29).\x20Exceeding\x20this\x20limit\x20aborts\x20with\x20E_MAX_SERVER_SIGNATURE_SIZE\x20(3).\x20'+'Most\x20signature\x20schemes\x20produce\x20signatures\x20well\x20under\x20this\x20limit\x20(Ed25519=64\x20bytes,\x20ECDSA=64-72\x20bytes,\x20'+'BLS12-381=96\x20bytes,\x20RSA-2048=256\x20bytes).','affected_stakeholders':['creator'],'scenario':'Caller\x20submits\x20an\x20oversized\x20signature\x20(e.g.\x20bundled\x20with\x20metadata)','mitigation':'Submit\x20only\x20the\x20raw\x20signature\x20bytes\x20(hex-encoded),\x20not\x20bundled\x20metadata\x20or\x20certificate\x20chains.','related_move_error':'E_MAX_SERVER_SIGNATURE_SIZE\x20(3)','auto_fixable':![]},'check':a=>{if(!a['server_signature'])return null;if(a['server_signature']['length']<=MAX_SERVER_SIGNATURE_SIZE)return null;return{...R_PR_1_03['rule'],'evidence':'server_signature.length='+a['server_signature']['length']+',\x20limit='+MAX_SERVER_SIGNATURE_SIZE};}},R_PR_2_01={'rule':{'id':'R-PROOF-04','level':'MEDIUM','category':'semantic','title':'proof_type\x20in\x20reserved\x20range\x20without\x20authority\x20(1-100\x20reserved\x20for\x20Wowok)','description':'proof_type='+WOWOK_WTS_PROOF_TYPE+'\x20is\x20WOWOK_WTS_PROOF_TYPE\x20(Will-To-Sign).\x20Values\x202-100\x20are\x20reserved\x20for\x20'+'future\x20Wowok-defined\x20proof\x20types.\x20User-defined\x20proof\x20types\x20must\x20use\x20values\x20>\x20100.\x20While\x20the\x20Move\x20contract\x20'+'does\x20not\x20currently\x20enforce\x20this\x20range\x20at\x20the\x20type\x20level\x20(it\x20accepts\x20any\x20u64),\x20using\x20a\x20reserved\x20value\x20without\x20'+'authority\x20creates\x20semantic\x20confusion:\x20consumers\x20may\x20misinterpret\x20the\x20proof\x27s\x20verification\x20rules.','affected_stakeholders':['creator','consumer','verifier'],'scenario':'User\x20creates\x20a\x20custom\x20proof\x20with\x20proof_type=5\x20(a\x20reserved\x20value)','mitigation':'Use\x20proof_type\x20>\x20100\x20for\x20user-defined\x20proof\x20types.\x20Use\x20proof_type=1\x20only\x20for\x20WTS\x20proofs\x20signed\x20by\x20an\x20'+'off-chain\x20server\x20(with\x20server_pubkey\x20+\x20server_signature).\x20Document\x20the\x20verification\x20rule\x20for\x20custom\x20types.','auto_fixable':![]},'check':a=>{if(a['proof_type']===undefined||a['proof_type']===null)return null;const b=typeof a['proof_type']==='string'?BigInt(a['proof_type']):BigInt(a['proof_type']);if(b===BigInt(WOWOK_WTS_PROOF_TYPE)||b>0x64n)return null;return{...R_PR_2_01['rule'],'evidence':'proof_type='+a['proof_type']+'\x20(reserved\x20range\x202-100)'};}},R_PR_2_02={'rule':{'id':'R-PROOF-05','level':'LOW','category':'semantic','title':'about_address\x20not\x20provided\x20—\x20consumers\x20cannot\x20locate\x20the\x20referenced\x20entity','description':'about_address\x20is\x20the\x20on-chain\x20address\x20of\x20the\x20entity\x20being\x20proved\x20(e.g.\x20a\x20user,\x20an\x20order,\x20a\x20Repository).\x20'+'When\x20null/undefined,\x20the\x20Proof\x20has\x20no\x20on-chain\x20binding\x20—\x20it\x20is\x20a\x20free-standing\x20cryptographic\x20statement.\x20'+'Consumers\x20(Repository,\x20Service,\x20etc.)\x20that\x20reference\x20this\x20Proof\x20cannot\x20automatically\x20resolve\x20which\x20entity\x20'+'it\x20applies\x20to.\x20This\x20is\x20acceptable\x20for\x20generic\x20proofs\x20but\x20problematic\x20for\x20entity-bound\x20attestations.','affected_stakeholders':['creator','consumer'],'scenario':'Caller\x20creates\x20a\x20Proof\x20without\x20about_address,\x20then\x20a\x20Repository\x20tries\x20to\x20bind\x20it\x20to\x20a\x20data\x20entry','mitigation':'Set\x20about_address\x20when\x20the\x20Proof\x20attests\x20to\x20a\x20specific\x20on-chain\x20entity.\x20Leave\x20it\x20null\x20only\x20for\x20'+'free-standing\x20cryptographic\x20statements\x20(e.g.\x20a\x20server\x27s\x20timestamp\x20attestation).','auto_fixable':!![]},'check':a=>{if(a['about_address'])return null;return{...R_PR_2_02['rule'],'evidence':'about_address=null/undefined'};}},R_PR_3_01={'rule':{'id':'R-PROOF-06','level':'LOW','category':'lifecycle','title':'description\x20missing\x20—\x20Proof\x20hard\x20to\x20identify\x20in\x20queries\x20and\x20audit\x20logs','description':'description\x20is\x20a\x20REQUIRED\x20field\x20(PF-D-2=A).\x20The\x20Move\x20contract\x20stores\x20it\x20as\x20a\x20String\x20field\x20and\x20SDK\x20'+'passes\x20it\x20to\x20create_wowok_proof.\x20An\x20empty\x20description\x20(\x22\x22)\x20is\x20technically\x20valid\x20but\x20makes\x20the\x20Proof\x20'+'hard\x20to\x20identify\x20in\x20query\x20results\x20and\x20audit\x20logs.\x20Non-empty\x20descriptions\x20are\x20strongly\x20recommended.','affected_stakeholders':['creator','verifier'],'scenario':'Caller\x20passes\x20description=\x22\x22\x20to\x20save\x20typing','mitigation':'Provide\x20a\x20one-line\x20description\x20like\x20\x22KYC\x20attestation\x20for\x20user\x200xabc\x22\x20or\x20\x22merkle\x20root\x20for\x20batch\x20#42\x22.','auto_fixable':![]},'check':a=>{if(a['description']===undefined)return null;if(a['description']['length']>0x0)return null;return{...R_PR_3_01['rule'],'evidence':'description=\x22\x22\x20(empty)'};}},R_PR_3_02={'rule':{'id':'R-PROOF-07','level':'HIGH','category':'lifecycle','title':'Proof\x20is\x20immutable\x20—\x20cannot\x20modify\x20after\x20creation\x20(freeze_object)','description':'Proof\x20is\x20created\x20via\x20transfer::freeze_object(obj)\x20in\x20Move\x20(proof.move:65).\x20Once\x20frozen,\x20the\x20object\x20'+'cannot\x20be\x20modified,\x20transferred,\x20or\x20deleted.\x20All\x20fields\x20(proof,\x20server_pubkey,\x20server_signature,\x20'+'about,\x20proof_type,\x20signer,\x20time,\x20description,\x20item_count)\x20are\x20permanently\x20fixed\x20at\x20the\x20value\x20set\x20'+'during\x20create_wowok_proof().\x20To\x20\x27update\x27\x20a\x20Proof,\x20create\x20a\x20new\x20one\x20and\x20update\x20references.','affected_stakeholders':['creator','consumer'],'scenario':'Caller\x20wants\x20to\x20update\x20server_signature\x20after\x20key\x20rotation\x20—\x20cannot,\x20must\x20create\x20new\x20Proof','mitigation':'Verify\x20all\x20fields\x20before\x20calling\x20create_wowok_proof.\x20For\x20scenarios\x20requiring\x20key\x20rotation,\x20'+'create\x20a\x20new\x20Proof\x20and\x20update\x20the\x20referencing\x20object\x20(Repository\x20data,\x20Service\x20config,\x20etc.)\x20to\x20'+'point\x20to\x20the\x20new\x20Proof\x20address.','auto_fixable':![]},'check':a=>null},R_PR_4_01={'rule':{'id':'R-PROOF-08','level':'INFO','category':'knowledge','title':'Knowledge\x20layer\x20&\x20constant\x20sync\x20—\x20RESOLVED','description':'All\x204\x20Proof\x20constants\x20(WOWOK_WTS_PROOF_TYPE,\x20MAX_PROOF_SIZE,\x20MAX_SERVER_PUBKEY_SIZE,\x20'+'MAX_SERVER_SIGNATURE_SIZE)\x20are\x20now\x20synced\x20to\x20onchain-constants.ts\x20(P-PROOF-P2-5).\x20The\x20MCP\x20Knowledge\x20'+'layer\x20now\x20includes\x20proof-risk.ts,\x20proof-confirm.ts,\x20proof-translation.ts\x20(P-PROOF-P2-6).\x20'+'This\x20risk\x20rule\x20is\x20retained\x20for\x20historical\x20audit\x20and\x20to\x20detect\x20future\x20regressions.','affected_stakeholders':['system'],'scenario':'Future\x20regression:\x20someone\x20removes\x20a\x20Proof\x20constant\x20from\x20onchain-constants.ts','mitigation':'Run\x20the\x20onchain-constants\x20sync\x20test\x20to\x20detect\x20drift.','auto_fixable':![]},'check':a=>{if(a['constants_synced'])return null;return{...R_PR_4_01['rule'],'evidence':'constants_synced=false'};}};export const PROOF_RISK_RULES=[R_PR_1_01,R_PR_1_02,R_PR_1_03,R_PR_2_01,R_PR_2_02,R_PR_3_01,R_PR_3_02,R_PR_4_01];export function checkProofRisks(a){const b=[];for(const c of PROOF_RISK_RULES){const d=c['check'](a);if(d)b['push'](d);}return!b['find'](e=>e['id']==='R-PROOF-07')&&b['push'](R_PR_3_02['rule']),b;}export function getProofRiskById(a){return PROOF_RISK_RULES['find'](b=>b['rule']['id']===a)?.['rule'];}