@wowok/agent-mcp 3.1.0 → 3.1.3

package/dist/knowledge/order-risk.js

@@ -1 +1 @@
-import{MAX_AGENT_COUNT,MAX_DISPUTE_COUNT}from'@wowok/wowok';import{findSceneById}from'./order-ledger.js';const R_O_1_01={'id':'R-O-1-01','category':'structural','trigger':'Order\x20has\x2014\x20fields\x20but\x20no\x20Permission\x20field\x20(unique\x20among\x2022\x20objects)','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-1-01','level':'LOW','category':'structural','title':'Order\x20uses\x20owner/agent\x20dual-layer\x20(no\x20Permission)','description':'Order\x20is\x20the\x20only\x20business\x20object\x20among\x2022\x20WoWok\x20objects\x20that\x20does\x20NOT\x20use\x20the\x20Permission\x20system.\x20All\x20access\x20control\x20flows\x20through\x20assert_owner\x20and\x20has_op_permission\x20inline\x20functions.','affected_stakeholders':['system','owner','agent'],'scenario':'Developer\x20assumes\x20Order\x20uses\x20Permission\x20and\x20writes\x20permission::check\x20logic','mitigation':'Use\x20owner/agent\x20checks\x20directly.\x20Do\x20NOT\x20attempt\x20to\x20apply\x20a\x20Permission\x20object\x20to\x20Order.','evidence':'no_permission_field'};return null;}},R_O_1_02={'id':'R-O-1-02','category':'structural','trigger':'Item\x20count\x20check\x20(informational;\x20no\x20Move-level\x20limit\x20on\x20items)','check':a=>{if(!a['items']||a['items']['length']===0x0)return null;if(a['items']['length']>0x32)return{'id':'R-O-1-02','level':'LOW','category':'structural','title':'Large\x20items\x20list\x20may\x20exceed\x20tx\x20size\x20limits','description':a['items']['length']+'\x20items\x20in\x20a\x20single\x20Order\x20—\x20no\x20protocol\x20limit,\x20but\x20large\x20lists\x20increase\x20transaction\x20size\x20and\x20may\x20hit\x20gas/size\x20limits','affected_stakeholders':['owner'],'scenario':'Bulk\x20purchase\x20with\x20many\x20line\x20items','mitigation':'Split\x20into\x20multiple\x20Orders\x20if\x20items\x20>\x2050','evidence':'items_count='+a['items']['length']};return null;}},R_O_1_03={'id':'R-O-1-03','category':'structural','trigger':'dispute\x20count\x20>=\x20MAX_DISPUTE_COUNT\x20(10)','check':a=>{const b=a['current_dispute_count']??0x0;if(b>=MAX_DISPUTE_COUNT)return{'id':'R-O-1-03','level':'HIGH','category':'structural','title':'Dispute\x20count\x20at\x20MAX_DISPUTE_COUNT\x20limit','description':'Order\x20already\x20has\x20'+b+'\x20disputes\x20(MAX_DISPUTE_COUNT='+MAX_DISPUTE_COUNT+').\x20Next\x20dispute()\x20call\x20will\x20abort\x20E_MAX_DISPUTE_COUNT.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'Filing\x2011th\x20dispute\x20on\x20an\x20Order\x20with\x2010\x20existing\x20disputes','mitigation':'Resolve\x20existing\x20disputes\x20(via\x20arb_claim_compensation)\x20before\x20filing\x20new\x20ones.\x20Note:\x20claimed_by\x20blocks\x20ALL\x20future\x20disputes.','evidence':'dispute_count='+b};return null;}},R_O_1_04={'id':'R-O-1-04','category':'structural','trigger':'agent_set\x20—\x20list\x20REPLACEMENT\x20semantics\x20(omitted\x20agents\x20lose\x20access)\x20and\x20distinct\x20count\x20limit','check':a=>{if(!a['agent_set'])return null;const b=new Set(a['agent_set']['agents'])['size'];if(b>MAX_AGENT_COUNT)return{'id':'R-O-1-04','level':'HIGH','category':'structural','title':'Distinct\x20agent\x20count\x20exceeds\x20MAX_AGENT_COUNT','description':'Attempting\x20to\x20set\x20'+b+'\x20distinct\x20agents\x20(input\x20'+a['agent_set']['agents']['length']+';\x20duplicates\x20are\x20deduped\x20on-chain).\x20Move\x20asserts\x20length\x20<\x20MAX_AGENT_COUNT\x20('+MAX_AGENT_COUNT+')\x20before\x20each\x20push\x20—\x20the\x20call\x20will\x20abort\x20E_MAX_AGENT_COUNT.','affected_stakeholders':['owner','system'],'scenario':'Setting\x2011\x20distinct\x20agents\x20in\x20one\x20call','mitigation':'Reduce\x20to\x20at\x20most\x20'+MAX_AGENT_COUNT+'\x20distinct\x20agents\x20per\x20call,\x20or\x20set\x20in\x20two\x20batches\x20(second\x20call\x20REPLACES\x20the\x20first\x20—\x20union\x20the\x20lists\x20manually).','evidence':'distinct_agents='+b+',\x20input_count='+a['agent_set']['agents']['length']+',\x20max='+MAX_AGENT_COUNT};return null;}},R_O_1_05={'id':'R-O-1-05','category':'structural','trigger':'wip_hash\x20is\x20empty\x20string\x20in\x20any\x20item','check':a=>{if(!a['items'])return null;const b=a['items']['find'](c=>!c['wip_hash']||c['wip_hash']==='');if(b)return{'id':'R-O-1-05','level':'HIGH','category':'structural','title':'Empty\x20wip_hash\x20in\x20item','description':'Item\x20\x22'+b['name']+'\x22\x20has\x20empty\x20wip_hash.\x20Move\x20rejects\x20empty\x20strings\x20(F-O-18).','affected_stakeholders':['owner'],'scenario':'User\x20submits\x20item\x20without\x20computing\x20WIP\x20hash','mitigation':'Compute\x20wip_hash\x20from\x20the\x20work-in-progress\x20file\x20content\x20before\x20service::buy().','evidence':'item_name='+b['name']};return null;}},R_O_2_01={'id':'R-O-2-01','category':'semantic','trigger':'Order.machine\x20snapshot\x20differs\x20from\x20current\x20Service.machine','check':a=>{if(!a['current_service_machine']||!a['order_machine_snapshot'])return null;if(a['current_service_machine']!==a['order_machine_snapshot'])return{'id':'R-O-2-01','level':'HIGH','category':'semantic','title':'Machine\x20snapshot\x20diverges\x20from\x20Service.machine','description':'Order.machine='+a['order_machine_snapshot']+'\x20was\x20snapshotted\x20at\x20buy\x20time.\x20Service.machine\x20is\x20now\x20'+a['current_service_machine']+'.\x20Same\x20Service\x20has\x20Orders\x20running\x20different\x20Machine\x20versions.','affected_stakeholders':['owner','service_provider','arbitrator'],'scenario':'Service\x20provider\x20upgrades\x20Machine\x20after\x20some\x20Orders\x20are\x20created','mitigation':'Audit\x20each\x20Order\x27s\x20machine\x20snapshot\x20separately.\x20Document\x20Machine\x20version\x20per\x20Order.\x20Plan\x20migration\x20paths\x20for\x20legacy\x20Orders.','evidence':'order_machine='+a['order_machine_snapshot']+',\x20service_machine='+a['current_service_machine']};return null;}},R_O_2_02={'id':'R-O-2-02','category':'semantic','trigger':'SDK\x20uses\x20\x27builder\x27\x20field\x20for\x20Move\x27s\x20\x27owner\x27\x20field\x20(naming\x20deviation)','check':a=>{if(a['object'])return{'id':'R-O-2-02','level':'MEDIUM','category':'semantic','title':'SDK\x20builder\x20≠\x20Move\x20owner\x20(only\x20naming\x20deviation\x20in\x2022\x20objects)','description':'SDK\x20ObjectOrder.builder\x20corresponds\x20to\x20Move\x20Order.owner.\x20This\x20is\x20the\x20only\x20field\x20name\x20deviation\x20across\x20all\x2022\x20WoWok\x20objects.\x20All\x20Order\x20knowledge\x20uses\x20Move\x27s\x20\x27owner\x27\x20as\x20canonical.','affected_stakeholders':['system'],'scenario':'Developer\x20reads\x20SDK\x20\x27builder\x27\x20and\x20assumes\x20it\x27s\x20a\x20different\x20concept\x20from\x20owner','mitigation':'Use\x20moveToSdkField()/sdkToMoveField()\x20helpers\x20from\x20order-ledger.ts.\x20Document\x20\x27builder\x20=\x20owner\x27\x20in\x20all\x20SDK\x20consumers.','evidence':'sdk_field=builder,\x20move_field=owner'};return null;}},R_O_2_03={'id':'R-O-2-03','category':'semantic','trigger':'E_PROGRESS_NOT_SPECIFIED\x20—\x20single\x20real\x20semantics\x20(order::create\x20without\x20Progress),\x20commonly\x20misdocumented\x20as\x20an\x20agent_set/owner_change\x20freeze','check':a=>{if(!a['operation'])return null;if(a['operation']==='service_buy'&&a['progress_bound']===![])return{'id':'R-O-2-03','level':'HIGH','category':'semantic','title':'order::create\x20will\x20abort\x20E_PROGRESS_NOT_SPECIFIED\x20—\x20machine\x20bound\x20but\x20Progress\x20missing','description':'order::create\x20asserts\x20progress.is_some()\x20whenever\x20machine.is_some()\x20(order.move:132).\x20A\x20buy\x20against\x20a\x20machine-driven\x20Service\x20MUST\x20bind\x20a\x20Progress\x20object\x20(service::order_progress)\x20before\x20order::create,\x20else\x20E_PROGRESS_NOT_SPECIFIED\x20(code\x203).','affected_stakeholders':['owner'],'scenario':'Machine-driven\x20Service\x20purchased\x20without\x20creating/binding\x20the\x20Progress\x20object\x20first','mitigation':'Bind\x20Progress\x20before\x20order::create:\x20call\x20service::order_progress(service,\x20order,\x20machine,\x20...)\x20which\x20invokes\x20order::on_progress.\x20Note:\x20agent_set/owner_change\x20are\x20NOT\x20affected\x20—\x20they\x20are\x20never\x20frozen\x20by\x20Progress\x20binding.','evidence':'operation='+a['operation']+',\x20progress_bound='+a['progress_bound']};return null;}},R_O_2_04={'id':'R-O-2-04','category':'semantic','trigger':'SaleItem.item\x20→\x20PurchasedItem.name\x20field\x20name\x20mapping','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-2-04','level':'LOW','category':'semantic','title':'SaleItem.item\x20(Move)\x20maps\x20to\x20PurchasedItem.name\x20(SDK)','description':'Move\x20struct\x20SaleItem\x20uses\x20field\x20\x27item\x27,\x20but\x20SDK\x20ObjectOrder.items\x20uses\x20field\x20\x27name\x27.\x20This\x20is\x20the\x20second\x20naming\x20deviation\x20in\x20Order\x20system\x20(after\x20builder/owner).','affected_stakeholders':['system'],'scenario':'Cross-layer\x20data\x20mapping\x20between\x20Move\x20and\x20SDK','mitigation':'Use\x20consistent\x20SDK\x20field\x20names\x20in\x20user-facing\x20code;\x20document\x20Move\x20↔\x20SDK\x20mapping\x20in\x20audit\x20logs.','evidence':'move_field=SaleItem.item,\x20sdk_field=PurchasedItem.name'};return null;}},R_O_3_01={'id':'R-O-3-01','category':'authority','trigger':'Agent\x20attempts\x20receive\x20or\x20transfer_to\x20(L1\x20owner-only\x20operations)','check':a=>{if(!a['operation'])return null;if((a['operation']==='receive'||a['operation']==='transfer_to')&&a['caller_is_agent']&&!a['caller_is_owner'])return{'id':'R-O-3-01','level':'HIGH','category':'authority','title':'Agent\x20attempting\x20owner-only\x20operation','description':'Agent\x20cannot\x20call\x20'+a['operation']+'\x20—\x20these\x20are\x20L1\x20owner-only\x20operations\x20(assert_owner).\x20Agent\x20can\x20operate\x20progress/arb_*/required_info\x20but\x20CANNOT\x20receive\x20funds\x20or\x20transfer\x20ownership.','affected_stakeholders':['agent','owner'],'scenario':'Logistics\x20agent\x20tries\x20to\x20collect\x20payment\x20on\x20behalf\x20of\x20buyer','mitigation':'Owner\x20must\x20call\x20receive/transfer_to\x20directly.\x20If\x20delegation\x20is\x20needed,\x20owner\x20can\x20transfer_to\x20a\x20multi-sig\x20wallet\x20that\x20includes\x20the\x20agent.','evidence':'operation='+a['operation']+',\x20caller=agent'};return null;}},R_O_3_02={'id':'R-O-3-02','category':'authority','trigger':'Non-owner\x20non-agent\x20attempts\x20operation\x20(no\x20permission)','check':a=>{if(!a['operation'])return null;if(a['caller_is_owner']===![]&&a['caller_is_agent']===![])return{'id':'R-O-3-02','level':'HIGH','category':'authority','title':'Non-owner\x20non-agent\x20attempting\x20operation','description':'Caller\x20is\x20neither\x20owner\x20nor\x20agent.\x20L2\x20operations\x20(progress,\x20arb_confirm,\x20arb_objection)\x20require\x20has_op_permission\x20—\x20aborts\x20E_NOT_OP_PERMISSION.\x20L1\x20operations\x20(transfer_to,\x20agent_set,\x20required_info_update)\x20additionally\x20require\x20assert_owner\x20—\x20aborts\x20E_NOT_THE_OWNER.','affected_stakeholders':['system'],'scenario':'Random\x20address\x20attempts\x20to\x20advance\x20someone\x20else\x27s\x20Order','mitigation':'Verify\x20caller\x20is\x20owner\x20or\x20in\x20agent[]\x20before\x20submitting\x20transaction.','evidence':'operation='+a['operation']+',\x20caller=unauthorized'};return null;}},R_O_3_03={'id':'R-O-3-03','category':'authority','trigger':'arb_claim_compensation\x20called\x20(sets\x20claimed_by,\x20irreversible)','check':a=>{if(a['operation']!=='arb_claim_compensation')return null;return{'id':'R-O-3-03','level':'HIGH','category':'authority','title':'arb_claim_compensation\x20is\x20IRREVERSIBLE\x20(claimed_by\x20one-time\x20set)','description':'Setting\x20claimed_by\x20is\x20permanent.\x20After\x20this\x20call:\x20(1)\x20claimed_by\x20cannot\x20be\x20reset,\x20(2)\x20NO\x20new\x20disputes\x20can\x20be\x20filed\x20(E_ORDER_ALREADY_CLAIMED),\x20(3)\x20all\x20unresolved\x20disputes\x20become\x20unactionable.\x20If\x20first\x20compensation\x20is\x20insufficient,\x20buyer\x20has\x20no\x20recourse.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'Buyer\x20claims\x20partial\x20compensation,\x20then\x20discovers\x20additional\x20damages','mitigation':'BEFORE\x20claiming:\x20(1)\x20enumerate\x20ALL\x20disputes,\x20(2)\x20ensure\x20proposition\x20covers\x20all\x20damages,\x20(3)\x20confirm\x20Arb\x20ruling\x20is\x20final.\x20Add\x20explicit\x20user\x20confirmation\x20(C-O-08).','evidence':'operation=arb_claim_compensation,\x20current_claimed_by='+(a['claimed_by_set']??![])};}},R_O_3_04={'id':'R-O-3-04','category':'authority','trigger':'dispute\x20attempted\x20after\x20claimed_by\x20is\x20set','check':a=>{if(a['claimed_by_set']&&(a['operation']==='arb_confirm'||a['operation']==='arb_objection'))return{'id':'R-O-3-04','level':'HIGH','category':'authority','title':'Cannot\x20file\x20new\x20dispute\x20after\x20claimed_by\x20is\x20set','description':'Order.claimed_by\x20is\x20set\x20—\x20any\x20new\x20dispute()\x20call\x20aborts\x20E_ORDER_ALREADY_CLAIMED.\x20arb_confirm/arb_objection\x20trigger\x20dispute()\x20internally.','affected_stakeholders':['owner','agent'],'scenario':'Buyer\x20claims\x20compensation\x20then\x20tries\x20to\x20file\x20additional\x20dispute','mitigation':'Resolve\x20ALL\x20disputes\x20BEFORE\x20calling\x20arb_claim_compensation.\x20claimed_by\x20is\x20terminal\x20for\x20dispute\x20flow.','evidence':'operation='+a['operation']+',\x20claimed_by_set=true'};return null;}},R_O_4_01={'id':'R-O-4-01','category':'lifecycle','trigger':'Attempt\x20to\x20create\x20Order\x20independently\x20(not\x20via\x20service::buy)','check':a=>{if(a['is_buy_operation']===![]&&a['operation']==='service_buy'&&!a['object'])return{'id':'R-O-4-01','level':'CRITICAL','category':'lifecycle','title':'Order\x20cannot\x20be\x20created\x20independently\x20(compound\x20creation\x20only)','description':'order::new()\x20is\x20package-only\x20—\x20only\x20service::buy()\x20can\x20create\x20Orders.\x20Any\x20attempt\x20to\x20call\x20order::new\x20directly\x20will\x20fail\x20at\x20the\x20Move\x20module\x20boundary.\x20Order\x20+\x20Allocation\x20+\x20Progress\x20are\x20created\x20atomically\x20in\x20one\x20transaction.','affected_stakeholders':['system','owner'],'scenario':'Developer\x20tries\x20to\x20construct\x20Order\x20independently\x20for\x20testing','mitigation':'Always\x20use\x20service::buy()\x20to\x20create\x20Orders.\x20For\x20testing,\x20deploy\x20a\x20minimal\x20Service\x20with\x20machine/allocators\x20configured.','evidence':'independent_creation_attempted'};return null;}},R_O_4_02={'id':'R-O-4-02','category':'lifecycle','trigger':'agent_set\x20attempted\x20mid-fulfillment\x20(Progress\x20bound)\x20—\x20replacement\x20may\x20revoke\x20active\x20agents','check':a=>{if(!a['operation'])return null;if(a['operation']==='agent_set'&&a['progress_bound'])return{'id':'R-O-4-02','level':'MEDIUM','category':'lifecycle','title':'Mid-fulfillment\x20agent_set\x20—\x20replacement\x20may\x20silently\x20revoke\x20active\x20agents','description':'agent_set\x20is\x20allowed\x20at\x20ANY\x20time\x20(no\x20Progress\x20freeze\x20exists\x20on-chain),\x20but\x20it\x20REPLACES\x20the\x20entire\x20list:\x20an\x20active\x20agent\x20omitted\x20from\x20the\x20new\x20list\x20immediately\x20loses\x20L2\x20access\x20(Progress\x20advance,\x20arb\x20operations)\x20and\x20their\x20EntityOrders\x20role\x20record\x20is\x20removed.\x20A\x20workflow\x20waiting\x20on\x20that\x20agent\x20to\x20advance\x20Progress\x20would\x20stall.','affected_stakeholders':['owner','agent'],'scenario':'Owner\x20adjusts\x20the\x20agent\x20list\x20mid-fulfillment\x20and\x20accidentally\x20drops\x20the\x20agent\x20responsible\x20for\x20the\x20next\x20Progress\x20node','mitigation':'When\x20changing\x20agents\x20mid-fulfillment,\x20always\x20include\x20the\x20union\x20of\x20current\x20active\x20agents\x20plus\x20the\x20additions.\x20Query\x20the\x20current\x20agent\x20list\x20first\x20(order\x20query),\x20merge,\x20then\x20submit.','evidence':'operation=agent_set,\x20progress_bound='+a['progress_bound']};return null;}},R_O_4_03={'id':'R-O-4-03','category':'lifecycle','trigger':'Progress\x20advance\x20attempted\x20without\x20progress\x20bound','check':a=>{if(a['operation']==='progress_advance'&&a['progress_bound']===![])return{'id':'R-O-4-03','level':'HIGH','category':'lifecycle','title':'Cannot\x20advance\x20Progress\x20—\x20no\x20Progress\x20bound\x20to\x20Order','description':'Order\x20has\x20no\x20progress\x20field\x20set\x20(Service\x20had\x20no\x20machine\x20configured).\x20Cannot\x20advance\x20a\x20non-existent\x20Progress.\x20SDK\x20CallOrder\x20validates\x20this\x20pre-flight\x20(CallOrder_Data.progress\x20requires\x20order.machine\x20and\x20order.progress).','affected_stakeholders':['owner','agent'],'scenario':'Buyer\x20tries\x20to\x20advance\x20Progress\x20on\x20an\x20Order\x20created\x20from\x20a\x20Service\x20without\x20machine','mitigation':'Use\x20a\x20Service\x20with\x20machine\x20configured.\x20If\x20manual\x20lifecycle\x20is\x20needed,\x20track\x20state\x20off-chain.','evidence':'operation=progress_advance,\x20progress_bound=false'};return null;}},R_O_4_04={'id':'R-O-4-04','category':'lifecycle','trigger':'arb_confirm/arb_objection/arb_claim_compensation\x20(irreversible\x20Arb\x20operations)','check':a=>{if(!a['operation'])return null;if(a['operation']==='arb_confirm'||a['operation']==='arb_objection'||a['operation']==='arb_claim_compensation')return{'id':'R-O-4-04','level':'HIGH','category':'lifecycle','title':a['operation']+'\x20is\x20irreversible\x20(triggers\x20Arb\x20flow)','description':a['operation']+'\x20triggers\x20the\x20Arbitration\x20workflow\x20which\x20cannot\x20be\x20undone.\x20arb_confirm\x20files\x20a\x20new\x20dispute,\x20arb_objection\x20requests\x20re-arbitration,\x20arb_claim_compensation\x20sets\x20claimed_by\x20permanently.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'User\x20accidentally\x20files\x20arb_confirm\x20without\x20understanding\x20consequences','mitigation':'Add\x20explicit\x20user\x20confirmation\x20(C-O-08,\x20C-O-11,\x20C-O-12)\x20before\x20these\x20operations.\x20Show\x20warning\x20text\x20describing\x20irreversibility.','evidence':'operation='+a['operation']};return null;}},R_O_4_05={'id':'R-O-4-05','category':'lifecycle','trigger':'receive\x20attempted\x20but\x20no\x20Receiving\x20exists\x20at\x20the\x20caller\x27s\x20address\x20(allocation::alloc\x20has\x20not\x20distributed\x20a\x20payment)','check':a=>{if(a['operation']==='receive'&&a['receiving_exists']===![])return{'id':'R-O-4-05','level':'HIGH','category':'lifecycle','title':'receive\x20blocked\x20—\x20no\x20Receiving\x20object\x20(allocation::alloc\x20has\x20not\x20run)','description':'owner_receive\x20is\x20gated\x20by\x20Receiving\x20existence:\x20allocation::alloc\x20must\x20have\x20run\x20on\x20the\x20Order\x27s\x20Allocation\x20object\x20and\x20included\x20the\x20caller\x27s\x20address\x20in\x20the\x20payment\x20recipients.\x20Without\x20a\x20Receiving,\x20the\x20transaction\x20cannot\x20be\x20constructed\x20(no\x20E_ORDER_DELIVERING\x20abort\x20exists\x20on-chain\x20—\x20Progress\x20terminal\x20state\x20is\x20NOT\x20a\x20receive\x20gate).','affected_stakeholders':['owner'],'scenario':'Buyer\x20tries\x20to\x20collect\x20a\x20payment\x20before\x20the\x20allocation\x20flow\x20has\x20distributed\x20it','mitigation':'1)\x20Confirm\x20allocation::alloc\x20has\x20run\x20on\x20the\x20Order\x27s\x20Allocation\x20(query\x20its\x20payment\x20vector)\x202)\x20Confirm\x20the\x20caller\x27s\x20address\x20is\x20in\x20the\x20allocator\x27s\x20sharing\x20recipients\x203)\x20Retry\x20receive\x20with\x20the\x20correct\x20Receiving\x20object\x20ID.\x20If\x20the\x20merchant\x20withholds\x20allocation,\x20file\x20arb_confirm\x20to\x20dispute.','evidence':'operation=receive,\x20receiving_exists='+a['receiving_exists']};return null;}},R_O_4_06={'id':'R-O-4-06','category':'lifecycle','trigger':'transfer_to\x20attempted\x20(irreversible\x20ownership\x20transfer)','check':a=>{if(a['operation']!=='transfer_to')return null;return{'id':'R-O-4-06','level':'CRITICAL','category':'lifecycle','title':'transfer_to\x20is\x20IRREVERSIBLE\x20—\x20new\x20owner\x20takes\x20over\x20ALL\x20permissions','description':'Ownership\x20transfer\x20to\x20'+(a['transfer_to_new_owner']??'(unknown)')+'\x20is\x20permanent.\x20New\x20owner\x20becomes\x20the\x20sole\x20receiver\x20of\x20payments\x20and\x20gains\x20full\x20L1\x20control.\x20Original\x20owner\x20loses\x20ALL\x20access.','affected_stakeholders':['owner'],'scenario':'Buyer\x20transfers\x20Order\x20to\x20wrong\x20address\x20by\x20mistake','mitigation':'1)\x20Verify\x20new\x20owner\x20address\x20twice.\x202)\x20Coordinate\x20with\x20new\x20owner\x20before\x20transfer.\x203)\x20Add\x20explicit\x20user\x20confirmation\x20(C-O-10).\x20Note:\x20transfer_to\x20is\x20allowed\x20at\x20any\x20time\x20(no\x20Progress\x20freeze\x20exists).','evidence':'new_owner='+a['transfer_to_new_owner']};}},R_O_5_01={'id':'R-O-5-01','category':'cross_object','trigger':'Service.machine\x20upgraded\x20after\x20Order\x20creation\x20(snapshot\x20divergence)','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-5-01','level':'LOW','category':'cross_object','title':'Service\x20snapshot\x20mechanism\x20—\x20order.machine\x20is\x20a\x20copy,\x20not\x20a\x20reference','description':'When\x20service::buy()\x20creates\x20an\x20Order,\x20order.machine\x20is\x20COPIED\x20from\x20service.machine.\x20Future\x20Service.machine\x20upgrades\x20do\x20NOT\x20affect\x20this\x20Order.\x20Same\x20Service\x20may\x20have\x20Orders\x20running\x20different\x20Machine\x20versions.','affected_stakeholders':['owner','service_provider','arbitrator'],'scenario':'Service\x20provider\x20upgrades\x20Machine\x20workflow\x20—\x20old\x20Orders\x20keep\x20old\x20workflow','mitigation':'Track\x20Machine\x20version\x20per\x20Order\x20(via\x20order.machine\x20address).\x20Plan\x20migration\x20paths\x20for\x20legacy\x20Orders.\x20Document\x20that\x20old\x20Orders\x20are\x20decoupled.','evidence':'snapshot_mechanism'};return null;}},R_O_5_02={'id':'R-O-5-02','category':'cross_object','trigger':'Order\x20references\x20Progress\x20that\x20no\x20longer\x20exists\x20or\x20is\x20corrupted','check':a=>{if(a['progress_bound']&&a['object'])return{'id':'R-O-5-02','level':'MEDIUM','category':'cross_object','title':'Order-Progress\x201:1\x20binding\x20(E_PROGRESS_ALREADY_SPECIFIED)','description':'Order.progress\x20is\x20one-time-set\x20via\x20on_progress\x20(package-only).\x20Cannot\x20be\x20rebound.\x20If\x20Progress\x20object\x20is\x20corrupted,\x20Order\x20becomes\x20stuck\x20—\x20cannot\x20advance,\x20cannot\x20rebind.','affected_stakeholders':['owner','agent'],'scenario':'Progress\x20object\x20becomes\x20unresponsive\x20or\x20corrupted','mitigation':'Ensure\x20Progress\x20integrity\x20via\x20Machine\x20audit\x20before\x20publishing\x20Service.\x20Use\x20arb_claim_compensation\x20as\x20escape\x20hatch\x20if\x20Progress\x20is\x20stuck.','evidence':'progress_bound='+a['progress_bound']};return null;}},R_O_5_03={'id':'R-O-5-03','category':'cross_object','trigger':'Order\x20references\x20Allocation\x20that\x20no\x20longer\x20exists\x20or\x20is\x20corrupted','check':a=>{if(a['object']&&a['progress_bound'])return{'id':'R-O-5-03','level':'MEDIUM','category':'cross_object','title':'Order-Allocation\x201:1\x20binding\x20(E_ALLOCATION_ALREADY_SPECIFIED)','description':'Order.allocation\x20is\x20one-time-set\x20via\x20on_allocation\x20(package-only).\x20Cannot\x20be\x20rebound.\x20If\x20Allocation\x20object\x20is\x20corrupted,\x20fund\x20distribution\x20is\x20blocked.','affected_stakeholders':['owner','service_provider'],'scenario':'Allocation\x20object\x20has\x20wrong\x20allocator\x20configuration','mitigation':'Audit\x20order_allocators\x20configuration\x20on\x20Service\x20BEFORE\x20publishing.\x20Use\x20compensation_fund\x20as\x20fallback\x20fund\x20source.','evidence':'allocation_binding'};return null;}},R_O_5_04={'id':'R-O-5-04','category':'cross_object','trigger':'Arbitration\x20dispute\x20appended\x20to\x20Order.dispute\x20list','check':a=>{if(a['operation']==='arb_confirm')return{'id':'R-O-5-04','level':'LOW','category':'cross_object','title':'Arb\x20object\x20will\x20be\x20appended\x20to\x20order.dispute\x20(package-only\x20dispute())','description':'arb_confirm\x20triggers\x20Arb\x20module\x20to\x20call\x20order::dispute(arb_address),\x20appending\x20the\x20Arb\x20object\x20to\x20order.dispute\x20list.\x20Max\x2010\x20disputes\x20(MAX_DISPUTE_COUNT).\x20Frozen\x20when\x20claimed_by\x20is\x20set.','affected_stakeholders':['arbitrator','owner','agent'],'scenario':'Multiple\x20arb_confirm\x20calls\x20create\x20multiple\x20Arb\x20objects\x20on\x20same\x20Order','mitigation':'Track\x20dispute\x20count.\x20Once\x20at\x2010,\x20no\x20more\x20disputes\x20can\x20be\x20filed.\x20Resolve\x20existing\x20disputes\x20before\x20filing\x20new\x20ones.','evidence':'operation=arb_confirm,\x20current_disputes='+(a['current_dispute_count']??0x0)};return null;}},R_O_5_05={'id':'R-O-5-05','category':'cross_object','trigger':'External\x20system\x20expects\x20OrderCompletedEvent\x20(does\x20not\x20exist)','check':a=>{if(a['is_buy_operation']||a['object'])return{'id':'R-O-5-05','level':'MEDIUM','category':'cross_object','title':'Only\x20NewOrderEvent\x20emitted\x20—\x20no\x20OrderCompletedEvent','description':'Move\x20contract\x20ONLY\x20emits\x20NewOrderEvent\x20at\x20creation.\x20Order\x20completion/cancellation/refund\x20are\x20IMPLICIT\x20—\x20must\x20be\x20inferred\x20by\x20querying\x20Progress.current_node\x20(terminal?\x20cancel?)\x20or\x20Order.claimed_by.\x20External\x20monitoring\x20requires\x20polling,\x20not\x20event-driven.','affected_stakeholders':['system'],'scenario':'Analytics\x20dashboard\x20expects\x20OrderCompletedEvent\x20to\x20track\x20completion\x20rate','mitigation':'Build\x20composite\x20query:\x20NewOrderEvent\x20+\x20Order.progress\x20query\x20→\x20infer\x20completion.\x20Document\x20this\x20limitation\x20in\x20monitoring\x20tools.\x20Long-term:\x20advocate\x20for\x20Move\x20upgrade\x20to\x20add\x20OrderCompletedEvent.','evidence':'no_order_completed_event'};return null;}},R_O_5_06={'id':'R-O-5-06','category':'cross_object','trigger':'service::buy\x20pre-flight:\x20Service\x20not\x20published\x20or\x20paused','check':a=>{if(!a['is_buy_operation'])return null;if(a['service_published']===![])return{'id':'R-O-5-06','level':'CRITICAL','category':'cross_object','title':'Service\x20not\x20published\x20—\x20service::buy\x20will\x20abort\x20E_NOT_PUBLISHED','description':'Cannot\x20create\x20Order\x20from\x20an\x20unpublished\x20Service.\x20Service\x20must\x20be\x20published\x20(bPublished=true)\x20before\x20service::buy()\x20can\x20be\x20called.','affected_stakeholders':['owner'],'scenario':'Buyer\x20attempts\x20to\x20purchase\x20from\x20a\x20draft\x20Service','mitigation':'Verify\x20Service.bPublished=true\x20before\x20service::buy().\x20Service\x20owner\x20must\x20call\x20service::publish()\x20first.','evidence':'service_published='+a['service_published']};if(a['service_paused']===!![])return{'id':'R-O-5-06','level':'CRITICAL','category':'cross_object','title':'Service\x20paused\x20—\x20service::buy\x20will\x20abort\x20E_PAUSED','description':'Cannot\x20create\x20Order\x20from\x20a\x20paused\x20Service.\x20Service\x20must\x20be\x20unpaused\x20before\x20service::buy()\x20can\x20be\x20called.','affected_stakeholders':['owner'],'scenario':'Buyer\x20attempts\x20to\x20purchase\x20from\x20a\x20paused\x20Service\x20(e.g.\x20during\x20maintenance)','mitigation':'Wait\x20for\x20Service\x20owner\x20to\x20call\x20service::pause(false).\x20Check\x20Service.paused\x20before\x20service::buy().','evidence':'service_paused='+a['service_paused']};return null;}},ALL_RULES=[R_O_1_01,R_O_1_02,R_O_1_03,R_O_1_04,R_O_1_05,R_O_2_01,R_O_2_02,R_O_2_03,R_O_2_04,R_O_3_01,R_O_3_02,R_O_3_03,R_O_3_04,R_O_4_01,R_O_4_02,R_O_4_03,R_O_4_04,R_O_4_05,R_O_4_06,R_O_5_01,R_O_5_02,R_O_5_03,R_O_5_04,R_O_5_05,R_O_5_06];export const ORDER_RISK_VERSION='1.0.0';export function getAllOrderRiskRules(){return[...ALL_RULES];}export function getOrderRiskRulesCount(){return ALL_RULES['length'];}export function getOrderRiskRulesByCategory(a){return ALL_RULES['filter'](b=>b['category']===a);}export function getOrderRiskRuleById(a){return ALL_RULES['find'](b=>b['id']===a);}export function assessOrderRisks(a){const b=[];for(const g of ALL_RULES){const h=g['check'](a);if(h)b['push'](h);}const c=b['length']===0x0?'LOW':b['some'](i=>i['level']==='CRITICAL')?'CRITICAL':b['some'](i=>i['level']==='HIGH')?'HIGH':b['some'](i=>i['level']==='MEDIUM')?'MEDIUM':'LOW',d={};for(const i of b){d[i['category']]=(d[i['category']]??0x0)+0x1;}const e={};for(const j of b){for(const k of j['affected_stakeholders']){if(!e[k])e[k]=[];e[k]['push'](j['id']+':\x20'+j['mitigation']);}}let f;if(a['operation']){const l={'agent_set':'order_set_agent','required_info_update':'order_required_info','progress_advance':'order_advance','arb_confirm':'order_arb_confirm','arb_objection':'order_arb_objection','arb_claim_compensation':'order_arb_claim_compensation','receive':'order_receive','transfer_to':'order_transfer','service_buy':'order_create'};f=findSceneById(l[a['operation']]??'');}return{'summary':'Assessed\x20'+b['length']+'\x20risk(s)\x20across\x20'+Object['keys'](d)['length']+'\x20categories','scene':f,'risks':b,'overall_risk':c,'risks_by_category':d,'stakeholder_advice':e,'needs_human_review':b['some'](m=>m['level']==='CRITICAL'||m['level']==='HIGH')};}export function checkPermissionLayer(a,b,c){const d=['transfer_to','owner_change','agent_set','required_info_update'],e=['progress_advance','arb_confirm','arb_objection'],f=['on_progress','on_allocation','dispute','compensate'],g=['receive','arb_claim_compensation'];if(f['includes'](a))return{'allowed':![],'layer':'L3_package_only','reason':'Package-only\x20—\x20not\x20callable\x20externally'};if(d['includes'](a)){if(!b)return{'allowed':![],'layer':'L1_owner_only','reason':'Owner-only\x20operation\x20('+a+')\x20—\x20agent\x20or\x20unauthorized\x20caller'};return{'allowed':!![],'layer':'L1_owner_only'};}if(e['includes'](a)){if(!b&&!c)return{'allowed':![],'layer':'L2_owner_or_agent','reason':'Requires\x20owner\x20or\x20agent\x20permission\x20('+a+')'};return{'allowed':!![],'layer':'L2_owner_or_agent'};}if(g['includes'](a)){if(a==='receive')return{'allowed':!![],'layer':'L4_object_gated','reason':'No\x20permission\x20assert\x20—\x20caller\x20must\x20hold\x20a\x20Receiving\x20created\x20by\x20allocation::alloc;\x20funds\x20always\x20go\x20to\x20order.owner'};return{'allowed':!![],'layer':'L4_object_gated','reason':'No\x20op-permission\x20assert\x20—\x20gated\x20by\x20Arb\x20status\x20(must\x20be\x20Arbirated);\x20compensation\x20paid\x20to\x20tx\x20sender'};}return{'allowed':![],'layer':'L3_package_only','reason':'Unknown\x20operation:\x20'+a};}
+import{MAX_AGENT_COUNT,MAX_DISPUTE_COUNT}from'@wowok/wowok';import{findSceneById}from'./order-ledger.js';const R_O_1_01={'id':'R-O-1-01','category':'structural','trigger':'Order\x20has\x2014\x20fields\x20but\x20no\x20Permission\x20field\x20(unique\x20among\x2022\x20objects)','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-1-01','level':'LOW','category':'structural','title':'Order\x20uses\x20owner/agent\x20dual-layer\x20(no\x20Permission)','description':'Order\x20is\x20the\x20only\x20business\x20object\x20among\x2022\x20WoWok\x20objects\x20that\x20does\x20NOT\x20use\x20the\x20Permission\x20system.\x20All\x20access\x20control\x20flows\x20through\x20assert_owner\x20and\x20has_op_permission\x20inline\x20functions.','affected_stakeholders':['system','owner','agent'],'scenario':'Developer\x20assumes\x20Order\x20uses\x20Permission\x20and\x20writes\x20permission::check\x20logic','mitigation':'Use\x20owner/agent\x20checks\x20directly.\x20Do\x20NOT\x20attempt\x20to\x20apply\x20a\x20Permission\x20object\x20to\x20Order.','evidence':'no_permission_field'};return null;}},R_O_1_02={'id':'R-O-1-02','category':'structural','trigger':'Item\x20count\x20check\x20(informational;\x20no\x20Move-level\x20limit\x20on\x20items)','check':a=>{if(!a['items']||a['items']['length']===0x0)return null;if(a['items']['length']>0x32)return{'id':'R-O-1-02','level':'LOW','category':'structural','title':'Large\x20items\x20list\x20may\x20exceed\x20tx\x20size\x20limits','description':a['items']['length']+'\x20items\x20in\x20a\x20single\x20Order\x20—\x20no\x20protocol\x20limit,\x20but\x20large\x20lists\x20increase\x20transaction\x20size\x20and\x20may\x20hit\x20gas/size\x20limits','affected_stakeholders':['owner'],'scenario':'Bulk\x20purchase\x20with\x20many\x20line\x20items','mitigation':'Split\x20into\x20multiple\x20Orders\x20if\x20items\x20>\x2050','evidence':'items_count='+a['items']['length']};return null;}},R_O_1_03={'id':'R-O-1-03','category':'structural','trigger':'dispute\x20count\x20>=\x20MAX_DISPUTE_COUNT\x20(10)','check':a=>{const b=a['current_dispute_count']??0x0;if(b>=MAX_DISPUTE_COUNT)return{'id':'R-O-1-03','level':'HIGH','category':'structural','title':'Dispute\x20count\x20at\x20MAX_DISPUTE_COUNT\x20limit','description':'Order\x20already\x20has\x20'+b+'\x20disputes\x20(MAX_DISPUTE_COUNT='+MAX_DISPUTE_COUNT+').\x20Next\x20dispute()\x20call\x20will\x20abort\x20E_MAX_DISPUTE_COUNT.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'Filing\x2011th\x20dispute\x20on\x20an\x20Order\x20with\x2010\x20existing\x20disputes','mitigation':'Resolve\x20existing\x20disputes\x20(via\x20arb_claim_compensation)\x20before\x20filing\x20new\x20ones.\x20Note:\x20claimed_by\x20blocks\x20ALL\x20future\x20disputes.','evidence':'dispute_count='+b};return null;}},R_O_1_04={'id':'R-O-1-04','category':'structural','trigger':'agent_set\x20—\x20list\x20REPLACEMENT\x20semantics\x20(omitted\x20agents\x20lose\x20access)\x20and\x20distinct\x20count\x20limit','check':a=>{if(!a['agent_set'])return null;const b=new Set(a['agent_set']['agents'])['size'];if(b>MAX_AGENT_COUNT)return{'id':'R-O-1-04','level':'HIGH','category':'structural','title':'Distinct\x20agent\x20count\x20exceeds\x20MAX_AGENT_COUNT','description':'Attempting\x20to\x20set\x20'+b+'\x20distinct\x20agents\x20(input\x20'+a['agent_set']['agents']['length']+';\x20duplicates\x20are\x20deduped\x20on-chain).\x20Move\x20asserts\x20length\x20<\x20MAX_AGENT_COUNT\x20('+MAX_AGENT_COUNT+')\x20before\x20each\x20push\x20—\x20the\x20call\x20will\x20abort\x20E_MAX_AGENT_COUNT.','affected_stakeholders':['owner','system'],'scenario':'Setting\x2011\x20distinct\x20agents\x20in\x20one\x20call','mitigation':'Reduce\x20to\x20at\x20most\x20'+MAX_AGENT_COUNT+'\x20distinct\x20agents\x20per\x20call,\x20or\x20set\x20in\x20two\x20batches\x20(second\x20call\x20REPLACES\x20the\x20first\x20—\x20union\x20the\x20lists\x20manually).','evidence':'distinct_agents='+b+',\x20input_count='+a['agent_set']['agents']['length']+',\x20max='+MAX_AGENT_COUNT};return null;}},R_O_1_05={'id':'R-O-1-05','category':'structural','trigger':'wip_hash\x20is\x20empty\x20string\x20in\x20any\x20item','check':a=>{if(!a['items'])return null;const b=a['items']['find'](c=>!c['wip_hash']||c['wip_hash']==='');if(b)return{'id':'R-O-1-05','level':'HIGH','category':'structural','title':'Empty\x20wip_hash\x20in\x20item','description':'Item\x20\x22'+b['name']+'\x22\x20has\x20empty\x20wip_hash.\x20Move\x20rejects\x20empty\x20strings\x20(F-O-18).','affected_stakeholders':['owner'],'scenario':'User\x20submits\x20item\x20without\x20computing\x20WIP\x20hash','mitigation':'Compute\x20wip_hash\x20from\x20the\x20work-in-progress\x20file\x20content\x20before\x20service::buy().','evidence':'item_name='+b['name']};return null;}},R_O_2_01={'id':'R-O-2-01','category':'semantic','trigger':'Order.machine\x20snapshot\x20differs\x20from\x20current\x20Service.machine','check':a=>{if(!a['current_service_machine']||!a['order_machine_snapshot'])return null;if(a['current_service_machine']!==a['order_machine_snapshot'])return{'id':'R-O-2-01','level':'HIGH','category':'semantic','title':'Machine\x20snapshot\x20diverges\x20from\x20Service.machine','description':'Order.machine='+a['order_machine_snapshot']+'\x20was\x20snapshotted\x20at\x20buy\x20time.\x20Service.machine\x20is\x20now\x20'+a['current_service_machine']+'.\x20Same\x20Service\x20has\x20Orders\x20running\x20different\x20Machine\x20versions.','affected_stakeholders':['owner','service_provider','arbitrator'],'scenario':'Service\x20provider\x20upgrades\x20Machine\x20after\x20some\x20Orders\x20are\x20created','mitigation':'Audit\x20each\x20Order\x27s\x20machine\x20snapshot\x20separately.\x20Document\x20Machine\x20version\x20per\x20Order.\x20Plan\x20migration\x20paths\x20for\x20legacy\x20Orders.','evidence':'order_machine='+a['order_machine_snapshot']+',\x20service_machine='+a['current_service_machine']};return null;}},R_O_2_02={'id':'R-O-2-02','category':'semantic','trigger':'SDK\x20uses\x20\x27builder\x27\x20field\x20for\x20Move\x27s\x20\x27owner\x27\x20field\x20(naming\x20deviation)','check':a=>{if(a['object'])return{'id':'R-O-2-02','level':'MEDIUM','category':'semantic','title':'SDK\x20builder\x20≠\x20Move\x20owner\x20(only\x20naming\x20deviation\x20in\x2022\x20objects)','description':'SDK\x20ObjectOrder.builder\x20corresponds\x20to\x20Move\x20Order.owner.\x20This\x20is\x20the\x20only\x20field\x20name\x20deviation\x20across\x20all\x2022\x20WoWok\x20objects.\x20All\x20Order\x20knowledge\x20uses\x20Move\x27s\x20\x27owner\x27\x20as\x20canonical.','affected_stakeholders':['system'],'scenario':'Developer\x20reads\x20SDK\x20\x27builder\x27\x20and\x20assumes\x20it\x27s\x20a\x20different\x20concept\x20from\x20owner','mitigation':'Use\x20moveToSdkField()/sdkToMoveField()\x20helpers\x20from\x20order-ledger.ts.\x20Document\x20\x27builder\x20=\x20owner\x27\x20in\x20all\x20SDK\x20consumers.','evidence':'sdk_field=builder,\x20move_field=owner'};return null;}},R_O_2_03={'id':'R-O-2-03','category':'semantic','trigger':'E_PROGRESS_NOT_SPECIFIED\x20—\x20single\x20real\x20semantics\x20(order::create\x20without\x20Progress),\x20commonly\x20misdocumented\x20as\x20an\x20agent_set/owner_change\x20freeze','check':a=>{if(!a['operation'])return null;if(a['operation']==='service_buy'&&a['progress_bound']===![])return{'id':'R-O-2-03','level':'HIGH','category':'semantic','title':'order::create\x20will\x20abort\x20E_PROGRESS_NOT_SPECIFIED\x20—\x20machine\x20bound\x20but\x20Progress\x20missing','description':'order::create\x20asserts\x20progress.is_some()\x20whenever\x20machine.is_some()\x20(order.move:132).\x20A\x20buy\x20against\x20a\x20machine-driven\x20Service\x20MUST\x20bind\x20a\x20Progress\x20object\x20(service::order_progress)\x20before\x20order::create,\x20else\x20E_PROGRESS_NOT_SPECIFIED\x20(code\x203).','affected_stakeholders':['owner'],'scenario':'Machine-driven\x20Service\x20purchased\x20without\x20creating/binding\x20the\x20Progress\x20object\x20first','mitigation':'Bind\x20Progress\x20before\x20order::create:\x20call\x20service::order_progress(service,\x20order,\x20machine,\x20...)\x20which\x20invokes\x20order::on_progress.\x20Note:\x20agent_set/owner_change\x20are\x20NOT\x20affected\x20—\x20they\x20are\x20never\x20frozen\x20by\x20Progress\x20binding.','evidence':'operation='+a['operation']+',\x20progress_bound='+a['progress_bound']};return null;}},R_O_2_04={'id':'R-O-2-04','category':'semantic','trigger':'SaleItem.item\x20→\x20PurchasedItem.name\x20field\x20name\x20mapping','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-2-04','level':'LOW','category':'semantic','title':'SaleItem.item\x20(Move)\x20maps\x20to\x20PurchasedItem.name\x20(SDK)','description':'Move\x20struct\x20SaleItem\x20uses\x20field\x20\x27item\x27,\x20but\x20SDK\x20ObjectOrder.items\x20uses\x20field\x20\x27name\x27.\x20This\x20is\x20the\x20second\x20naming\x20deviation\x20in\x20Order\x20system\x20(after\x20builder/owner).','affected_stakeholders':['system'],'scenario':'Cross-layer\x20data\x20mapping\x20between\x20Move\x20and\x20SDK','mitigation':'Use\x20consistent\x20SDK\x20field\x20names\x20in\x20user-facing\x20code;\x20document\x20Move\x20↔\x20SDK\x20mapping\x20in\x20audit\x20logs.','evidence':'move_field=SaleItem.item,\x20sdk_field=PurchasedItem.name'};return null;}},R_O_3_01={'id':'R-O-3-01','category':'authority','trigger':'Agent\x20attempts\x20receive\x20or\x20transfer_to\x20(L1\x20owner-only\x20operations)','check':a=>{if(!a['operation'])return null;if((a['operation']==='receive'||a['operation']==='transfer_to')&&a['caller_is_agent']&&!a['caller_is_owner'])return{'id':'R-O-3-01','level':'HIGH','category':'authority','title':'Agent\x20attempting\x20owner-only\x20operation','description':'Agent\x20cannot\x20call\x20'+a['operation']+'\x20—\x20these\x20are\x20L1\x20owner-only\x20operations\x20(assert_owner).\x20Agent\x20can\x20operate\x20progress/arb_*/required_info\x20but\x20CANNOT\x20receive\x20funds\x20or\x20transfer\x20ownership.','affected_stakeholders':['agent','owner'],'scenario':'Logistics\x20agent\x20tries\x20to\x20collect\x20payment\x20on\x20behalf\x20of\x20buyer','mitigation':'Owner\x20must\x20call\x20receive/transfer_to\x20directly.\x20If\x20delegation\x20is\x20needed,\x20owner\x20can\x20transfer_to\x20a\x20multi-sig\x20wallet\x20that\x20includes\x20the\x20agent.','evidence':'operation='+a['operation']+',\x20caller=agent'};return null;}},R_O_3_02={'id':'R-O-3-02','category':'authority','trigger':'Non-owner\x20non-agent\x20attempts\x20operation\x20(no\x20permission)','check':a=>{if(!a['operation'])return null;if(a['caller_is_owner']===![]&&a['caller_is_agent']===![])return{'id':'R-O-3-02','level':'HIGH','category':'authority','title':'Non-owner\x20non-agent\x20attempting\x20operation','description':'Caller\x20is\x20neither\x20owner\x20nor\x20agent.\x20L2\x20operations\x20(progress,\x20arb_confirm,\x20arb_objection)\x20require\x20has_op_permission\x20—\x20aborts\x20E_NOT_OP_PERMISSION.\x20L1\x20operations\x20(transfer_to,\x20agent_set,\x20required_info_update)\x20additionally\x20require\x20assert_owner\x20—\x20aborts\x20E_NOT_THE_OWNER.','affected_stakeholders':['system'],'scenario':'Random\x20address\x20attempts\x20to\x20advance\x20someone\x20else\x27s\x20Order','mitigation':'Verify\x20caller\x20is\x20owner\x20or\x20in\x20agent[]\x20before\x20submitting\x20transaction.','evidence':'operation='+a['operation']+',\x20caller=unauthorized'};return null;}},R_O_3_03={'id':'R-O-3-03','category':'authority','trigger':'arb_claim_compensation\x20called\x20(sets\x20claimed_by,\x20irreversible)','check':a=>{if(a['operation']!=='arb_claim_compensation')return null;return{'id':'R-O-3-03','level':'HIGH','category':'authority','title':'arb_claim_compensation\x20is\x20IRREVERSIBLE\x20(claimed_by\x20one-time\x20set)','description':'Setting\x20claimed_by\x20is\x20permanent.\x20After\x20this\x20call:\x20(1)\x20claimed_by\x20cannot\x20be\x20reset,\x20(2)\x20NO\x20new\x20disputes\x20can\x20be\x20filed\x20(E_ORDER_ALREADY_CLAIMED),\x20(3)\x20all\x20unresolved\x20disputes\x20become\x20unactionable.\x20If\x20first\x20compensation\x20is\x20insufficient,\x20buyer\x20has\x20no\x20recourse.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'Buyer\x20claims\x20partial\x20compensation,\x20then\x20discovers\x20additional\x20damages','mitigation':'BEFORE\x20claiming:\x20(1)\x20enumerate\x20ALL\x20disputes,\x20(2)\x20ensure\x20proposition\x20covers\x20all\x20damages,\x20(3)\x20confirm\x20Arb\x20ruling\x20is\x20final.\x20Add\x20explicit\x20user\x20confirmation\x20(C-O-08).','evidence':'operation=arb_claim_compensation,\x20current_claimed_by='+(a['claimed_by_set']??![])};}},R_O_3_04={'id':'R-O-3-04','category':'authority','trigger':'dispute\x20attempted\x20after\x20claimed_by\x20is\x20set','check':a=>{if(a['claimed_by_set']&&(a['operation']==='arb_confirm'||a['operation']==='arb_objection'))return{'id':'R-O-3-04','level':'HIGH','category':'authority','title':'Cannot\x20file\x20new\x20dispute\x20after\x20claimed_by\x20is\x20set','description':'Order.claimed_by\x20is\x20set\x20—\x20any\x20new\x20dispute()\x20call\x20aborts\x20E_ORDER_ALREADY_CLAIMED.\x20arb_confirm/arb_objection\x20trigger\x20dispute()\x20internally.','affected_stakeholders':['owner','agent'],'scenario':'Buyer\x20claims\x20compensation\x20then\x20tries\x20to\x20file\x20additional\x20dispute','mitigation':'Resolve\x20ALL\x20disputes\x20BEFORE\x20calling\x20arb_claim_compensation.\x20claimed_by\x20is\x20terminal\x20for\x20dispute\x20flow.','evidence':'operation='+a['operation']+',\x20claimed_by_set=true'};return null;}},R_O_4_01={'id':'R-O-4-01','category':'lifecycle','trigger':'Attempt\x20to\x20create\x20Order\x20independently\x20(not\x20via\x20service::buy)','check':a=>{if(a['is_buy_operation']===![]&&a['operation']==='service_buy'&&!a['object'])return{'id':'R-O-4-01','level':'CRITICAL','category':'lifecycle','title':'Order\x20cannot\x20be\x20created\x20independently\x20(compound\x20creation\x20only)','description':'order::new()\x20is\x20package-only\x20—\x20only\x20service::buy()\x20can\x20create\x20Orders.\x20Any\x20attempt\x20to\x20call\x20order::new\x20directly\x20will\x20fail\x20at\x20the\x20Move\x20module\x20boundary.\x20Order\x20+\x20Allocation\x20+\x20Progress\x20are\x20created\x20atomically\x20in\x20one\x20transaction.','affected_stakeholders':['system','owner'],'scenario':'Developer\x20tries\x20to\x20construct\x20Order\x20independently\x20for\x20testing','mitigation':'Always\x20use\x20service::buy()\x20to\x20create\x20Orders.\x20For\x20testing,\x20deploy\x20a\x20minimal\x20Service\x20with\x20machine/allocators\x20configured.','evidence':'independent_creation_attempted'};return null;}},R_O_4_02={'id':'R-O-4-02','category':'lifecycle','trigger':'agent_set\x20attempted\x20mid-fulfillment\x20(Progress\x20bound)\x20—\x20replacement\x20may\x20revoke\x20active\x20agents','check':a=>{if(!a['operation'])return null;if(a['operation']==='agent_set'&&a['progress_bound'])return{'id':'R-O-4-02','level':'MEDIUM','category':'lifecycle','title':'Mid-fulfillment\x20agent_set\x20—\x20replacement\x20may\x20silently\x20revoke\x20active\x20agents','description':'agent_set\x20is\x20allowed\x20at\x20ANY\x20time\x20(no\x20Progress\x20freeze\x20exists\x20on-chain),\x20but\x20it\x20REPLACES\x20the\x20entire\x20list:\x20an\x20active\x20agent\x20omitted\x20from\x20the\x20new\x20list\x20immediately\x20loses\x20L2\x20access\x20(Progress\x20advance,\x20arb\x20operations)\x20and\x20their\x20EntityOrders\x20role\x20record\x20is\x20removed.\x20A\x20workflow\x20waiting\x20on\x20that\x20agent\x20to\x20advance\x20Progress\x20would\x20stall.','affected_stakeholders':['owner','agent'],'scenario':'Owner\x20adjusts\x20the\x20agent\x20list\x20mid-fulfillment\x20and\x20accidentally\x20drops\x20the\x20agent\x20responsible\x20for\x20the\x20next\x20Progress\x20node','mitigation':'When\x20changing\x20agents\x20mid-fulfillment,\x20always\x20include\x20the\x20union\x20of\x20current\x20active\x20agents\x20plus\x20the\x20additions.\x20Query\x20the\x20current\x20agent\x20list\x20first\x20(order\x20query),\x20merge,\x20then\x20submit.','evidence':'operation=agent_set,\x20progress_bound='+a['progress_bound']};return null;}},R_O_4_03={'id':'R-O-4-03','category':'lifecycle','trigger':'Progress\x20advance\x20attempted\x20without\x20progress\x20bound','check':a=>{if(a['operation']==='progress_advance'&&a['progress_bound']===![])return{'id':'R-O-4-03','level':'HIGH','category':'lifecycle','title':'Cannot\x20advance\x20Progress\x20—\x20no\x20Progress\x20bound\x20to\x20Order','description':'Order\x20has\x20no\x20progress\x20field\x20set\x20(Service\x20had\x20no\x20machine\x20configured).\x20Cannot\x20advance\x20a\x20non-existent\x20Progress.\x20SDK\x20CallOrder\x20validates\x20this\x20pre-flight\x20(CallOrder_Data.progress\x20requires\x20order.machine\x20and\x20order.progress).','affected_stakeholders':['owner','agent'],'scenario':'Buyer\x20tries\x20to\x20advance\x20Progress\x20on\x20an\x20Order\x20created\x20from\x20a\x20Service\x20without\x20machine','mitigation':'Use\x20a\x20Service\x20with\x20machine\x20configured.\x20If\x20manual\x20lifecycle\x20is\x20needed,\x20track\x20state\x20off-chain.','evidence':'operation=progress_advance,\x20progress_bound=false'};return null;}},R_O_4_04={'id':'R-O-4-04','category':'lifecycle','trigger':'arb_confirm/arb_objection/arb_claim_compensation\x20(irreversible\x20Arb\x20operations)','check':a=>{if(!a['operation'])return null;if(a['operation']==='arb_confirm'||a['operation']==='arb_objection'||a['operation']==='arb_claim_compensation')return{'id':'R-O-4-04','level':'HIGH','category':'lifecycle','title':a['operation']+'\x20is\x20irreversible\x20(triggers\x20Arb\x20flow)','description':a['operation']+'\x20triggers\x20the\x20Arbitration\x20workflow\x20which\x20cannot\x20be\x20undone.\x20arb_confirm\x20files\x20a\x20new\x20dispute,\x20arb_objection\x20requests\x20re-arbitration,\x20arb_claim_compensation\x20sets\x20claimed_by\x20permanently.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'User\x20accidentally\x20files\x20arb_confirm\x20without\x20understanding\x20consequences','mitigation':'Add\x20explicit\x20user\x20confirmation\x20(C-O-08,\x20C-O-11,\x20C-O-12)\x20before\x20these\x20operations.\x20Show\x20warning\x20text\x20describing\x20irreversibility.','evidence':'operation='+a['operation']};return null;}},R_O_4_05={'id':'R-O-4-05','category':'lifecycle','trigger':'receive\x20attempted\x20but\x20no\x20Receiving\x20exists\x20at\x20the\x20caller\x27s\x20address\x20(allocation::alloc\x20has\x20not\x20distributed\x20a\x20payment)','check':a=>{if(a['operation']==='receive'&&a['receiving_exists']===![])return{'id':'R-O-4-05','level':'HIGH','category':'lifecycle','title':'receive\x20blocked\x20—\x20no\x20Receiving\x20object\x20(allocation::alloc\x20has\x20not\x20run)','description':'owner_receive\x20is\x20gated\x20by\x20Receiving\x20existence:\x20allocation::alloc\x20must\x20have\x20run\x20on\x20the\x20Order\x27s\x20Allocation\x20object\x20and\x20included\x20the\x20caller\x27s\x20address\x20in\x20the\x20payment\x20recipients.\x20Without\x20a\x20Receiving,\x20the\x20transaction\x20cannot\x20be\x20constructed\x20(no\x20E_ORDER_DELIVERING\x20abort\x20exists\x20on-chain\x20—\x20Progress\x20terminal\x20state\x20is\x20NOT\x20a\x20receive\x20gate).','affected_stakeholders':['owner'],'scenario':'Buyer\x20tries\x20to\x20collect\x20a\x20payment\x20before\x20the\x20allocation\x20flow\x20has\x20distributed\x20it','mitigation':'1)\x20Confirm\x20allocation::alloc\x20has\x20run\x20on\x20the\x20Order\x27s\x20Allocation\x20(query\x20its\x20payment\x20vector)\x202)\x20Confirm\x20the\x20caller\x27s\x20address\x20is\x20in\x20the\x20allocator\x27s\x20sharing\x20recipients\x203)\x20Retry\x20receive\x20with\x20the\x20correct\x20Receiving\x20object\x20ID.\x20If\x20the\x20merchant\x20withholds\x20allocation,\x20file\x20arb_confirm\x20to\x20dispute.','evidence':'operation=receive,\x20receiving_exists='+a['receiving_exists']};return null;}},R_O_4_06={'id':'R-O-4-06','category':'lifecycle','trigger':'transfer_to\x20attempted\x20(irreversible\x20ownership\x20transfer)','check':a=>{if(a['operation']!=='transfer_to')return null;return{'id':'R-O-4-06','level':'CRITICAL','category':'lifecycle','title':'transfer_to\x20is\x20IRREVERSIBLE\x20—\x20new\x20owner\x20takes\x20over\x20ALL\x20permissions','description':'Ownership\x20transfer\x20to\x20'+(a['transfer_to_new_owner']??'(unknown)')+'\x20is\x20permanent.\x20New\x20owner\x20becomes\x20the\x20sole\x20receiver\x20of\x20payments\x20and\x20gains\x20full\x20L1\x20control.\x20Original\x20owner\x20loses\x20ALL\x20access.','affected_stakeholders':['owner'],'scenario':'Buyer\x20transfers\x20Order\x20to\x20wrong\x20address\x20by\x20mistake','mitigation':'1)\x20Verify\x20new\x20owner\x20address\x20twice.\x202)\x20Coordinate\x20with\x20new\x20owner\x20before\x20transfer.\x203)\x20Add\x20explicit\x20user\x20confirmation\x20(C-O-10).\x20Note:\x20transfer_to\x20is\x20allowed\x20at\x20any\x20time\x20(no\x20Progress\x20freeze\x20exists).','evidence':'new_owner='+a['transfer_to_new_owner']};}},R_O_5_01={'id':'R-O-5-01','category':'cross_object','trigger':'Service.machine\x20upgraded\x20after\x20Order\x20creation\x20(snapshot\x20divergence)','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-5-01','level':'LOW','category':'cross_object','title':'Service\x20snapshot\x20mechanism\x20—\x20order.machine\x20is\x20a\x20copy,\x20not\x20a\x20reference','description':'When\x20service::buy()\x20creates\x20an\x20Order,\x20order.machine\x20is\x20COPIED\x20from\x20service.machine.\x20Future\x20Service.machine\x20upgrades\x20do\x20NOT\x20affect\x20this\x20Order.\x20Same\x20Service\x20may\x20have\x20Orders\x20running\x20different\x20Machine\x20versions.','affected_stakeholders':['owner','service_provider','arbitrator'],'scenario':'Service\x20provider\x20upgrades\x20Machine\x20workflow\x20—\x20old\x20Orders\x20keep\x20old\x20workflow','mitigation':'Track\x20Machine\x20version\x20per\x20Order\x20(via\x20order.machine\x20address).\x20Plan\x20migration\x20paths\x20for\x20legacy\x20Orders.\x20Document\x20that\x20old\x20Orders\x20are\x20decoupled.','evidence':'snapshot_mechanism'};return null;}},R_O_5_02={'id':'R-O-5-02','category':'cross_object','trigger':'Order\x20references\x20Progress\x20that\x20no\x20longer\x20exists\x20or\x20is\x20corrupted','check':a=>{if(a['progress_bound']&&a['object'])return{'id':'R-O-5-02','level':'MEDIUM','category':'cross_object','title':'Order-Progress\x201:1\x20binding\x20(E_PROGRESS_ALREADY_SPECIFIED)','description':'Order.progress\x20is\x20one-time-set\x20via\x20on_progress\x20(package-only).\x20Cannot\x20be\x20rebound.\x20If\x20Progress\x20object\x20is\x20corrupted,\x20Order\x20becomes\x20stuck\x20—\x20cannot\x20advance,\x20cannot\x20rebind.','affected_stakeholders':['owner','agent'],'scenario':'Progress\x20object\x20becomes\x20unresponsive\x20or\x20corrupted','mitigation':'Ensure\x20Progress\x20integrity\x20via\x20Machine\x20audit\x20before\x20publishing\x20Service.\x20Use\x20arb_claim_compensation\x20as\x20escape\x20hatch\x20if\x20Progress\x20is\x20stuck.','evidence':'progress_bound='+a['progress_bound']};return null;}},R_O_5_03={'id':'R-O-5-03','category':'cross_object','trigger':'Order\x20references\x20Allocation\x20that\x20no\x20longer\x20exists\x20or\x20is\x20corrupted','check':a=>{if(a['object']&&a['progress_bound'])return{'id':'R-O-5-03','level':'MEDIUM','category':'cross_object','title':'Order-Allocation\x201:1\x20binding\x20(E_ALLOCATION_ALREADY_SPECIFIED)','description':'Order.allocation\x20is\x20one-time-set\x20via\x20on_allocation\x20(package-only).\x20Cannot\x20be\x20rebound.\x20If\x20Allocation\x20object\x20is\x20corrupted,\x20fund\x20distribution\x20is\x20blocked.','affected_stakeholders':['owner','service_provider'],'scenario':'Allocation\x20object\x20has\x20wrong\x20allocator\x20configuration','mitigation':'Audit\x20order_allocators\x20configuration\x20on\x20Service\x20BEFORE\x20publishing.\x20Use\x20compensation_fund\x20as\x20fallback\x20fund\x20source.','evidence':'allocation_binding'};return null;}},R_O_5_04={'id':'R-O-5-04','category':'cross_object','trigger':'Arbitration\x20dispute\x20appended\x20to\x20Order.dispute\x20list','check':a=>{if(a['operation']==='arb_confirm')return{'id':'R-O-5-04','level':'LOW','category':'cross_object','title':'Arb\x20object\x20will\x20be\x20appended\x20to\x20order.dispute\x20(package-only\x20dispute())','description':'arb_confirm\x20triggers\x20Arb\x20module\x20to\x20call\x20order::dispute(arb_address),\x20appending\x20the\x20Arb\x20object\x20to\x20order.dispute\x20list.\x20Max\x2010\x20disputes\x20(MAX_DISPUTE_COUNT).\x20Frozen\x20when\x20claimed_by\x20is\x20set.','affected_stakeholders':['arbitrator','owner','agent'],'scenario':'Multiple\x20arb_confirm\x20calls\x20create\x20multiple\x20Arb\x20objects\x20on\x20same\x20Order','mitigation':'Track\x20dispute\x20count.\x20Once\x20at\x2010,\x20no\x20more\x20disputes\x20can\x20be\x20filed.\x20Resolve\x20existing\x20disputes\x20before\x20filing\x20new\x20ones.','evidence':'operation=arb_confirm,\x20current_disputes='+(a['current_dispute_count']??0x0)};return null;}},R_O_5_05={'id':'R-O-5-05','category':'cross_object','trigger':'External\x20system\x20expects\x20OrderCompletedEvent\x20(does\x20not\x20exist)','check':a=>{if(a['is_buy_operation']||a['object'])return{'id':'R-O-5-05','level':'MEDIUM','category':'cross_object','title':'Only\x20NewOrderEvent\x20emitted\x20—\x20no\x20OrderCompletedEvent','description':'Move\x20contract\x20ONLY\x20emits\x20NewOrderEvent\x20at\x20creation.\x20Order\x20completion/cancellation/refund\x20are\x20IMPLICIT\x20—\x20must\x20be\x20inferred\x20by\x20querying\x20Progress.current_node\x20(terminal?\x20cancel?)\x20or\x20Order.claimed_by.\x20External\x20monitoring\x20requires\x20polling,\x20not\x20event-driven.','affected_stakeholders':['system'],'scenario':'Analytics\x20dashboard\x20expects\x20OrderCompletedEvent\x20to\x20track\x20completion\x20rate','mitigation':'Build\x20composite\x20query:\x20NewOrderEvent\x20+\x20Order.progress\x20query\x20→\x20infer\x20completion.\x20Document\x20this\x20limitation\x20in\x20monitoring\x20tools.\x20Long-term:\x20advocate\x20for\x20Move\x20upgrade\x20to\x20add\x20OrderCompletedEvent.','evidence':'no_order_completed_event'};return null;}},R_O_5_06={'id':'R-O-5-06','category':'cross_object','trigger':'service::buy\x20pre-flight:\x20Service\x20not\x20published\x20or\x20paused','check':a=>{if(!a['is_buy_operation'])return null;if(a['service_published']===![])return{'id':'R-O-5-06','level':'CRITICAL','category':'cross_object','title':'Service\x20not\x20published\x20—\x20service::buy\x20will\x20abort\x20E_NOT_PUBLISHED','description':'Cannot\x20create\x20Order\x20from\x20an\x20unpublished\x20Service.\x20Service\x20must\x20be\x20published\x20(bPublished=true)\x20before\x20service::buy()\x20can\x20be\x20called.','affected_stakeholders':['owner'],'scenario':'Buyer\x20attempts\x20to\x20purchase\x20from\x20a\x20draft\x20Service','mitigation':'Verify\x20Service.bPublished=true\x20before\x20service::buy().\x20Service\x20owner\x20must\x20call\x20service::publish()\x20first.','evidence':'service_published='+a['service_published']};if(a['service_paused']===!![])return{'id':'R-O-5-06','level':'CRITICAL','category':'cross_object','title':'Service\x20paused\x20—\x20service::buy\x20will\x20abort\x20E_PAUSED','description':'Cannot\x20create\x20Order\x20from\x20a\x20paused\x20Service.\x20Service\x20must\x20be\x20unpaused\x20before\x20service::buy()\x20can\x20be\x20called.','affected_stakeholders':['owner'],'scenario':'Buyer\x20attempts\x20to\x20purchase\x20from\x20a\x20paused\x20Service\x20(e.g.\x20during\x20maintenance)','mitigation':'Wait\x20for\x20Service\x20owner\x20to\x20call\x20service::pause(false).\x20Check\x20Service.paused\x20before\x20service::buy().','evidence':'service_paused='+a['service_paused']};return null;}},ALL_RULES=[R_O_1_01,R_O_1_02,R_O_1_03,R_O_1_04,R_O_1_05,R_O_2_01,R_O_2_02,R_O_2_03,R_O_2_04,R_O_3_01,R_O_3_02,R_O_3_03,R_O_3_04,R_O_4_01,R_O_4_02,R_O_4_03,R_O_4_04,R_O_4_05,R_O_4_06,R_O_5_01,R_O_5_02,R_O_5_03,R_O_5_04,R_O_5_05,R_O_5_06];export const ORDER_RISK_VERSION='1.0.0';export function getAllOrderRiskRules(){return[...ALL_RULES];}export function assessOrderRisks(a){const b=[];for(const g of ALL_RULES){const h=g['check'](a);if(h)b['push'](h);}const c=b['length']===0x0?'LOW':b['some'](i=>i['level']==='CRITICAL')?'CRITICAL':b['some'](i=>i['level']==='HIGH')?'HIGH':b['some'](i=>i['level']==='MEDIUM')?'MEDIUM':'LOW',d={};for(const i of b){d[i['category']]=(d[i['category']]??0x0)+0x1;}const e={};for(const j of b){for(const k of j['affected_stakeholders']){if(!e[k])e[k]=[];e[k]['push'](j['id']+':\x20'+j['mitigation']);}}let f;if(a['operation']){const l={'agent_set':'order_set_agent','required_info_update':'order_required_info','progress_advance':'order_advance','arb_confirm':'order_arb_confirm','arb_objection':'order_arb_objection','arb_claim_compensation':'order_arb_claim_compensation','receive':'order_receive','transfer_to':'order_transfer','service_buy':'order_create'};f=findSceneById(l[a['operation']]??'');}return{'summary':'Assessed\x20'+b['length']+'\x20risk(s)\x20across\x20'+Object['keys'](d)['length']+'\x20categories','scene':f,'risks':b,'overall_risk':c,'risks_by_category':d,'stakeholder_advice':e,'needs_human_review':b['some'](m=>m['level']==='CRITICAL'||m['level']==='HIGH')};}

package/dist/knowledge/payment-risk.d.ts

@@ -34,4 +34,3 @@ export declare const PAYMENT_RISK_RULES: {
 }[];
 export declare const PAYMENT_RISK_VERSION = "1.0.0";
 export declare function checkPaymentRisks(ctx: PaymentRiskCheckContext): PaymentRisk[];
-export declare function getPaymentRiskById(id: string): PaymentRisk | undefined;

package/dist/knowledge/payment-risk.js

@@ -1 +1 @@
-import{MAX_RECIPIENT_COUNT}from'@wowok/wowok';const R_P_01={'rule':{'id':'R-PAYMENT-01','level':'HIGH','category':'permission','title':'unwrap()\x20performs\x20no\x20Payment\x20match\x20check\x20—\x20may\x20unwrap\x20wrong\x20CoinWrapper','description':'unwrap(wrapper,\x20ctx)\x20(payment.move:50)\x20returns\x20(Coin,\x20payment_address)\x20without\x20'+'verifying\x20that\x20wrapper.payment\x20matches\x20any\x20expected\x20Payment.\x20Callers\x20who\x20use\x20unwrap\x20'+'instead\x20of\x20unwrap_with_check\x20can\x20unwrap\x20a\x20CoinWrapper\x20that\x20was\x20minted\x20for\x20a\x20different\x20'+'Payment,\x20leading\x20to\x20fund\x20loss\x20or\x20accounting\x20corruption.\x20unwrap_with_check(payment_check)\x20'+'exists\x20specifically\x20to\x20enforce\x20the\x20match\x20(payment.move:54).','affected_stakeholders':['signer','recipient'],'scenario':'Caller\x20uses\x20unwrap\x20on\x20a\x20wrapper\x20from\x20a\x20different\x20Payment;\x20funds\x20are\x20released\x20anyway','mitigation':'SDK\x20should\x20force\x20callers\x20to\x20use\x20unwrap_with_check\x20and\x20deprecate\x20direct\x20unwrap\x20calls.\x20'+'The\x20only\x20safe\x20use\x20of\x20unwrap\x20is\x20when\x20the\x20caller\x20has\x20already\x20verified\x20the\x20match\x20off-chain.','related_move_error':'EPAYMENT_NOT_MATCH\x20(3)\x20—\x20only\x20raised\x20by\x20unwrap_with_check','auto_fixable':![]},'check':a=>{if(!a['uses_unsafe_unwrap'])return null;return{...R_P_01['rule'],'evidence':'uses_unsafe_unwrap=true\x20(no\x20Payment\x20match\x20check)'};}},R_P_02={'rule':{'id':'R-PAYMENT-02','level':'MEDIUM','category':'structural','title':'MAX_RECIPIENT_COUNT='+MAX_RECIPIENT_COUNT+'\x20permissive\x20—\x20gas\x20and\x20confirmation\x20cost','description':'A\x20single\x20Payment\x20may\x20carry\x20up\x20to\x20MAX_RECIPIENT_COUNT='+MAX_RECIPIENT_COUNT+'\x20recipients\x20'+'(payment.move:14).\x20The\x20limit\x20aborts\x20with\x20ERECIPIENT_COUNT_EXCEEDED\x20(1)\x20only\x20at\x20the\x20boundary.\x20'+'200\x20recipients\x20in\x20one\x20transaction\x20inflates\x20gas,\x20slows\x20finalization,\x20and\x20complicates\x20'+'retry\x20on\x20partial\x20failure.','affected_stakeholders':['signer','recipient'],'scenario':'Caller\x20submits\x20a\x20Payment\x20with\x20200\x20recipients;\x20transaction\x20is\x20heavy\x20and\x20slow','mitigation':'Business\x20layer\x20should\x20self-limit\x20recipient\x20count\x20(e.g.\x20≤50).\x20For\x20mass\x20payouts,\x20split\x20'+'across\x20multiple\x20Payment\x20objects\x20in\x20separate\x20transactions.','related_move_error':'ERECIPIENT_COUNT_EXCEEDED\x20(1)','auto_fixable':![]},'check':a=>{if(a['recipient_count']===undefined)return null;if(a['recipient_count']<MAX_RECIPIENT_COUNT)return null;return{...R_P_02['rule'],'evidence':'recipient_count='+a['recipient_count']+',\x20limit='+MAX_RECIPIENT_COUNT};}},R_P_03={'rule':{'id':'R-PAYMENT-03','level':'LOW','category':'lifecycle','title':'Payment\x20is\x20immutable\x20after\x20create\x20—\x20errors\x20cannot\x20be\x20corrected','description':'create()\x20calls\x20transfer::freeze_object(payment)\x20(payment.move:160).\x20All\x20fields\x20'+'(amount,\x20time,\x20info,\x20from_object,\x20signer,\x20record)\x20are\x20permanently\x20fixed.\x20There\x20is\x20no\x20'+'update,\x20refund,\x20or\x20void\x20API\x20on\x20the\x20Payment\x20object\x20itself\x20—\x20correction\x20requires\x20a\x20new\x20'+'Payment\x20(and\x20off-chain\x20reconciliation).','affected_stakeholders':['signer','consumer'],'scenario':'Signer\x20mistypes\x20a\x20recipient\x20address;\x20the\x20Payment\x20cannot\x20be\x20edited\x20post-create','mitigation':'Verify\x20all\x20fields\x20before\x20calling\x20create.\x20For\x20refunds,\x20create\x20a\x20new\x20Payment\x20in\x20the\x20'+'opposite\x20direction.\x20Off-chain\x20systems\x20should\x20treat\x20Payment\x20as\x20an\x20immutable\x20receipt.','auto_fixable':![]},'check':a=>{if(!a['expects_mutation'])return null;return{...R_P_03['rule'],'evidence':'expects_mutation=true\x20(Payment\x20is\x20frozen\x20at\x20create)'};}},R_P_04={'rule':{'id':'R-PAYMENT-04','level':'MEDIUM','category':'structural','title':'CoinWrapper\x20suppresses\x20coin_field\x20lint\x20—\x20Balance<T>\x20stored\x20in\x20a\x20struct\x20field','description':'CoinWrapper<phantom\x20T>\x20stores\x20Balance<T>\x20directly\x20in\x20a\x20struct\x20field\x20and\x20uses\x20'+'#[allow(lint(coin_field))]\x20to\x20suppress\x20the\x20Wow\x20lint\x20(payment.move:43-48).\x20The\x20lint\x20'+'normally\x20warns\x20against\x20storing\x20Balance\x20in\x20arbitrary\x20structs\x20because\x20of\x20object\x20'+'lifecycle\x20concerns.\x20The\x20suppression\x20is\x20intentional\x20but\x20should\x20be\x20reviewed\x20whenever\x20'+'the\x20Wow\x20framework\x20updates\x20its\x20coin_field\x20rules.','affected_stakeholders':['system'],'scenario':'Wow\x20framework\x20tightens\x20coin_field\x20lint\x20semantics;\x20CoinWrapper\x20becomes\x20non-compliant','mitigation':'Review\x20the\x20coin_field\x20suppression\x20on\x20each\x20Wow\x20upgrade.\x20Confirm\x20that\x20Balance<T>\x20'+'ownership\x20transfer\x20in\x20unwrap/unwrap_with_check\x20is\x20correct.','auto_fixable':![]},'check':a=>{if(a['coin_field_lint_reviewed'])return null;return{...R_P_04['rule'],'evidence':'coin_field_lint_reviewed=false\x20(needs\x20review)'};}},R_P_05={'rule':{'id':'R-PAYMENT-05','level':'LOW','category':'semantic','title':'PaymentInfo\x20has\x204\x20constructor\x20variants\x20—\x20caller\x20may\x20pick\x20the\x20wrong\x20one','description':'PaymentInfo\x20can\x20be\x20built\x20via\x20payment_info\x20(for_object+remark+index),\x20payment_info2\x20'+'(remark+index,\x20no\x20for_object),\x20payment_info_with_guard\x20(for_object+for_guard+remark+index),\x20'+'or\x20payment_info2_with_guard\x20(for_guard+remark+index,\x20no\x20for_object).\x20Selecting\x20the\x20'+'wrong\x20variant\x20leaves\x20for_object/for_guard\x20as\x20None,\x20breaking\x20downstream\x20lookups.','affected_stakeholders':['signer','consumer'],'scenario':'Caller\x20uses\x20payment_info2\x20when\x20they\x20meant\x20payment_info_with_guard;\x20for_object\x20is\x20lost','mitigation':'Document\x20each\x20variant\x27s\x20use\x20case\x20clearly.\x20SDK\x20should\x20pick\x20the\x20variant\x20automatically\x20'+'based\x20on\x20which\x20optional\x20fields\x20the\x20caller\x20provides.','auto_fixable':!![]},'check':a=>null},R_P_06={'rule':{'id':'R-PAYMENT-06','level':'MEDIUM','category':'cross_object','title':'object-linker\x20tx\x20registration\x20filters\x20recipients\x20by\x20is_object_address\x20—\x20user\x20addresses\x20skipped','description':'create()\x20iterates\x20recipients\x20and\x20only\x20calls\x20object_linker::affiliation_tx\x20for\x20addresses\x20that\x20'+'pass\x20util::is_object_address\x20(payment.move:147-161).\x20User\x20addresses\x20(EOAs)\x20are\x20not\x20'+'registered\x20in\x20the\x20object-linker\x20tx\x20index.\x20Callers\x20who\x20expect\x20every\x20recipient\x20to\x20'+'appear\x20in\x20object-linker\x20tx\x20queries\x20will\x20miss\x20EOA\x20recipients.','affected_stakeholders':['signer','consumer'],'scenario':'Caller\x20queries\x20object-linker\x20tx\x20for\x20all\x20Payment\x20recipients;\x20EOA\x20recipients\x20are\x20missing','mitigation':'Document\x20that\x20affiliation_tx\x20is\x20registered\x20only\x20for\x20object-address\x20recipients.\x20Off-chain\x20'+'systems\x20should\x20track\x20EOA\x20recipients\x20via\x20the\x20NewPaymentEvent\x20record,\x20not\x20via\x20object-linker\x20tx.','auto_fixable':![]},'check':a=>{if(!a['expects_user_recipient_registered'])return null;return{...R_P_06['rule'],'evidence':'expects_user_recipient_registered=true\x20(EOAs\x20are\x20skipped)'};}},R_P_07={'rule':{'id':'R-PAYMENT-07','level':'LOW','category':'semantic','title':'Payment.signer\x20records\x20payer\x20—\x20useful\x20for\x20provenance\x20but\x20not\x20authorization','description':'Payment.signer\x20is\x20set\x20to\x20ctx.sender()\x20at\x20creation\x20(payment.move).\x20It\x20can\x20be\x20read\x20via\x20'+'payment_signer<T>(payment)\x20for\x20provenance\x20(e.g.\x20\x27who\x20paid\x20for\x20this\x20order\x27).\x20It\x20is\x20'+'purely\x20informational\x20—\x20it\x20does\x20NOT\x20authorize\x20any\x20later\x20operation.\x20Consumers\x20must\x20not\x20'+'treat\x20signer\x20as\x20a\x20permission\x20grant.','affected_stakeholders':['consumer'],'scenario':'Consumer\x20treats\x20Payment.signer\x20as\x20authorizing\x20a\x20refund;\x20signer\x20is\x20just\x20provenance','mitigation':'Use\x20Payment.signer\x20only\x20for\x20audit/provenance.\x20Authorization\x20must\x20come\x20from\x20the\x20'+'referencing\x20object\x27s\x20own\x20Permission,\x20not\x20from\x20Payment.signer.','auto_fixable':![]},'check':a=>{if(!a['uses_signer_for_provenance'])return null;return{...R_P_07['rule'],'evidence':'uses_signer_for_provenance=true\x20(informational\x20only)'};}},R_P_08={'rule':{'id':'R-PAYMENT-08','level':'MEDIUM','category':'semantic','title':'Payment\x20scene\x20binding\x20(for_object\x20+\x20for_guard\x20+\x20index)\x20—\x20anti-reuse\x20for\x20exception\x20branches','description':'PaymentInfo\x20supports\x20for_object\x20(binds\x20to\x20specific\x20Order),\x20for_guard\x20(binds\x20to\x20specific\x20Guard),\x20'+'and\x20index\x20(binds\x20to\x20specific\x20Progress\x20step)\x20—\x20payment.move#L66-71.\x20When\x20all\x20three\x20are\x20set\x20via\x20'+'payment_info_with_guard\x20(payment.move#L82-86),\x20the\x20Payment\x20is\x20scene-bound:\x20it\x20can\x20ONLY\x20be\x20used\x20'+'in\x20the\x20specific\x20order\x20+\x20guard\x20+\x20progress\x20context.\x20This\x20is\x20the\x20anti-reuse\x20design\x20for\x20exception\x20'+'branch\x20compensation\x20(e.g.,\x20delivery\x20delay\x20>30min\x20triggers\x20auto-compensation).\x20'+'Payment\x20is\x20immutable\x20(freeze_object,\x20payment.move#L160)\x20—\x20binding\x20cannot\x20be\x20altered.\x20'+'VERIFIER-EVIDENCE\x20DESIGN:\x20customer\x20submits\x20Payment,\x20Guard\x20verifies\x20binding\x20fields\x20match\x20current\x20context.','affected_stakeholders':['signer','recipient','consumer'],'scenario':'Treasury\x20creates\x20compensation\x20Payment\x20with\x20PaymentInfo(for_object=order,\x20for_guard=exception_guard,\x20index=current_progress)\x20for\x20delivery\x20delay','mitigation':'Use\x20payment_info_with_guard\x20for\x20all\x20exception\x20branch\x20Payments.\x20Ensure\x20for_object,\x20for_guard,\x20and\x20index\x20'+'all\x20match\x20the\x20intended\x20context.\x20Use\x20tpl_payment_exception_compensation\x20(guard-templates.ts)\x20as\x20design\x20template.','auto_fixable':![]},'check':a=>{if(!a['uses_scene_binding'])return null;const b=[];if(!a['has_for_object'])b['push']('for_object\x20not\x20set\x20(Order\x20binding\x20missing)');if(!a['has_for_guard'])b['push']('for_guard\x20not\x20set\x20(Guard\x20binding\x20missing)');if(!a['has_index'])b['push']('index\x20not\x20set\x20(Progress\x20step\x20binding\x20missing)');if(b['length']===0x0)return null;return{...R_P_08['rule'],'evidence':'incomplete\x20scene\x20binding:\x20'+b['join'](',\x20')};}},R_P_09={'rule':{'id':'R-PAYMENT-09','level':'LOW','category':'semantic','title':'PaymentInfo\x20variant\x20selection\x20—\x20use\x20payment_info_with_guard\x20for\x20exception\x20branches','description':'PaymentInfo\x20has\x204\x20constructor\x20variants\x20(payment.move#L66-86):\x20'+'payment_info\x20(for_object+remark+index,\x20no\x20for_guard),\x20'+'payment_info2\x20(remark+index,\x20no\x20for_object/for_guard),\x20'+'payment_info_with_guard\x20(for_object+for_guard+remark+index\x20—\x20FULL\x20binding),\x20'+'payment_info2_with_guard\x20(for_guard+remark+index,\x20no\x20for_object).\x20'+'For\x20exception\x20branch\x20compensation,\x20ALWAYS\x20use\x20payment_info_with_guard\x20to\x20get\x20full\x20scene\x20binding.\x20'+'Using\x20payment_info\x20(without\x20for_guard)\x20or\x20payment_info2\x20(without\x20for_object)\x20weakens\x20anti-reuse\x20protection.','affected_stakeholders':['signer','consumer'],'scenario':'Caller\x20uses\x20payment_info\x20instead\x20of\x20payment_info_with_guard\x20for\x20exception\x20compensation;\x20for_guard\x20is\x20lost','mitigation':'For\x20exception\x20branch\x20Payments:\x20always\x20use\x20payment_info_with_guard(for_object,\x20for_guard,\x20remark,\x20index).\x20'+'For\x20simple\x20Payments\x20without\x20scene\x20binding:\x20payment_info\x20or\x20payment_info2\x20is\x20fine.\x20'+'SDK\x20should\x20auto-select\x20the\x20variant\x20based\x20on\x20which\x20fields\x20are\x20provided.','auto_fixable':!![]},'check':a=>{if(!a['uses_scene_binding'])return null;if(a['payment_info_variant']==='payment_info_with_guard')return null;return{...R_P_09['rule'],'evidence':'uses_scene_binding=true\x20but\x20variant='+(a['payment_info_variant']??'unknown')+'\x20(should\x20be\x20payment_info_with_guard)'};}};export const PAYMENT_RISK_RULES=[R_P_01,R_P_02,R_P_03,R_P_04,R_P_05,R_P_06,R_P_07,R_P_08,R_P_09];export const PAYMENT_RISK_VERSION='1.0.0';export function checkPaymentRisks(a){const b=[];for(const c of PAYMENT_RISK_RULES){const d=c['check'](a);if(d)b['push'](d);}return!b['find'](e=>e['id']==='R-PAYMENT-05')&&b['push'](R_P_05['rule']),b;}export function getPaymentRiskById(a){return PAYMENT_RISK_RULES['find'](b=>b['rule']['id']===a)?.['rule'];}
+import{MAX_RECIPIENT_COUNT}from'@wowok/wowok';const R_P_01={'rule':{'id':'R-PAYMENT-01','level':'HIGH','category':'permission','title':'unwrap()\x20performs\x20no\x20Payment\x20match\x20check\x20—\x20may\x20unwrap\x20wrong\x20CoinWrapper','description':'unwrap(wrapper,\x20ctx)\x20(payment.move:50)\x20returns\x20(Coin,\x20payment_address)\x20without\x20'+'verifying\x20that\x20wrapper.payment\x20matches\x20any\x20expected\x20Payment.\x20Callers\x20who\x20use\x20unwrap\x20'+'instead\x20of\x20unwrap_with_check\x20can\x20unwrap\x20a\x20CoinWrapper\x20that\x20was\x20minted\x20for\x20a\x20different\x20'+'Payment,\x20leading\x20to\x20fund\x20loss\x20or\x20accounting\x20corruption.\x20unwrap_with_check(payment_check)\x20'+'exists\x20specifically\x20to\x20enforce\x20the\x20match\x20(payment.move:54).','affected_stakeholders':['signer','recipient'],'scenario':'Caller\x20uses\x20unwrap\x20on\x20a\x20wrapper\x20from\x20a\x20different\x20Payment;\x20funds\x20are\x20released\x20anyway','mitigation':'SDK\x20should\x20force\x20callers\x20to\x20use\x20unwrap_with_check\x20and\x20deprecate\x20direct\x20unwrap\x20calls.\x20'+'The\x20only\x20safe\x20use\x20of\x20unwrap\x20is\x20when\x20the\x20caller\x20has\x20already\x20verified\x20the\x20match\x20off-chain.','related_move_error':'EPAYMENT_NOT_MATCH\x20(3)\x20—\x20only\x20raised\x20by\x20unwrap_with_check','auto_fixable':![]},'check':a=>{if(!a['uses_unsafe_unwrap'])return null;return{...R_P_01['rule'],'evidence':'uses_unsafe_unwrap=true\x20(no\x20Payment\x20match\x20check)'};}},R_P_02={'rule':{'id':'R-PAYMENT-02','level':'MEDIUM','category':'structural','title':'MAX_RECIPIENT_COUNT='+MAX_RECIPIENT_COUNT+'\x20permissive\x20—\x20gas\x20and\x20confirmation\x20cost','description':'A\x20single\x20Payment\x20may\x20carry\x20up\x20to\x20MAX_RECIPIENT_COUNT='+MAX_RECIPIENT_COUNT+'\x20recipients\x20'+'(payment.move:14).\x20The\x20limit\x20aborts\x20with\x20ERECIPIENT_COUNT_EXCEEDED\x20(1)\x20only\x20at\x20the\x20boundary.\x20'+'200\x20recipients\x20in\x20one\x20transaction\x20inflates\x20gas,\x20slows\x20finalization,\x20and\x20complicates\x20'+'retry\x20on\x20partial\x20failure.','affected_stakeholders':['signer','recipient'],'scenario':'Caller\x20submits\x20a\x20Payment\x20with\x20200\x20recipients;\x20transaction\x20is\x20heavy\x20and\x20slow','mitigation':'Business\x20layer\x20should\x20self-limit\x20recipient\x20count\x20(e.g.\x20≤50).\x20For\x20mass\x20payouts,\x20split\x20'+'across\x20multiple\x20Payment\x20objects\x20in\x20separate\x20transactions.','related_move_error':'ERECIPIENT_COUNT_EXCEEDED\x20(1)','auto_fixable':![]},'check':a=>{if(a['recipient_count']===undefined)return null;if(a['recipient_count']<MAX_RECIPIENT_COUNT)return null;return{...R_P_02['rule'],'evidence':'recipient_count='+a['recipient_count']+',\x20limit='+MAX_RECIPIENT_COUNT};}},R_P_03={'rule':{'id':'R-PAYMENT-03','level':'LOW','category':'lifecycle','title':'Payment\x20is\x20immutable\x20after\x20create\x20—\x20errors\x20cannot\x20be\x20corrected','description':'create()\x20calls\x20transfer::freeze_object(payment)\x20(payment.move:160).\x20All\x20fields\x20'+'(amount,\x20time,\x20info,\x20from_object,\x20signer,\x20record)\x20are\x20permanently\x20fixed.\x20There\x20is\x20no\x20'+'update,\x20refund,\x20or\x20void\x20API\x20on\x20the\x20Payment\x20object\x20itself\x20—\x20correction\x20requires\x20a\x20new\x20'+'Payment\x20(and\x20off-chain\x20reconciliation).','affected_stakeholders':['signer','consumer'],'scenario':'Signer\x20mistypes\x20a\x20recipient\x20address;\x20the\x20Payment\x20cannot\x20be\x20edited\x20post-create','mitigation':'Verify\x20all\x20fields\x20before\x20calling\x20create.\x20For\x20refunds,\x20create\x20a\x20new\x20Payment\x20in\x20the\x20'+'opposite\x20direction.\x20Off-chain\x20systems\x20should\x20treat\x20Payment\x20as\x20an\x20immutable\x20receipt.','auto_fixable':![]},'check':a=>{if(!a['expects_mutation'])return null;return{...R_P_03['rule'],'evidence':'expects_mutation=true\x20(Payment\x20is\x20frozen\x20at\x20create)'};}},R_P_04={'rule':{'id':'R-PAYMENT-04','level':'MEDIUM','category':'structural','title':'CoinWrapper\x20suppresses\x20coin_field\x20lint\x20—\x20Balance<T>\x20stored\x20in\x20a\x20struct\x20field','description':'CoinWrapper<phantom\x20T>\x20stores\x20Balance<T>\x20directly\x20in\x20a\x20struct\x20field\x20and\x20uses\x20'+'#[allow(lint(coin_field))]\x20to\x20suppress\x20the\x20Wow\x20lint\x20(payment.move:43-48).\x20The\x20lint\x20'+'normally\x20warns\x20against\x20storing\x20Balance\x20in\x20arbitrary\x20structs\x20because\x20of\x20object\x20'+'lifecycle\x20concerns.\x20The\x20suppression\x20is\x20intentional\x20but\x20should\x20be\x20reviewed\x20whenever\x20'+'the\x20Wow\x20framework\x20updates\x20its\x20coin_field\x20rules.','affected_stakeholders':['system'],'scenario':'Wow\x20framework\x20tightens\x20coin_field\x20lint\x20semantics;\x20CoinWrapper\x20becomes\x20non-compliant','mitigation':'Review\x20the\x20coin_field\x20suppression\x20on\x20each\x20Wow\x20upgrade.\x20Confirm\x20that\x20Balance<T>\x20'+'ownership\x20transfer\x20in\x20unwrap/unwrap_with_check\x20is\x20correct.','auto_fixable':![]},'check':a=>{if(a['coin_field_lint_reviewed'])return null;return{...R_P_04['rule'],'evidence':'coin_field_lint_reviewed=false\x20(needs\x20review)'};}},R_P_05={'rule':{'id':'R-PAYMENT-05','level':'LOW','category':'semantic','title':'PaymentInfo\x20has\x204\x20constructor\x20variants\x20—\x20caller\x20may\x20pick\x20the\x20wrong\x20one','description':'PaymentInfo\x20can\x20be\x20built\x20via\x20payment_info\x20(for_object+remark+index),\x20payment_info2\x20'+'(remark+index,\x20no\x20for_object),\x20payment_info_with_guard\x20(for_object+for_guard+remark+index),\x20'+'or\x20payment_info2_with_guard\x20(for_guard+remark+index,\x20no\x20for_object).\x20Selecting\x20the\x20'+'wrong\x20variant\x20leaves\x20for_object/for_guard\x20as\x20None,\x20breaking\x20downstream\x20lookups.','affected_stakeholders':['signer','consumer'],'scenario':'Caller\x20uses\x20payment_info2\x20when\x20they\x20meant\x20payment_info_with_guard;\x20for_object\x20is\x20lost','mitigation':'Document\x20each\x20variant\x27s\x20use\x20case\x20clearly.\x20SDK\x20should\x20pick\x20the\x20variant\x20automatically\x20'+'based\x20on\x20which\x20optional\x20fields\x20the\x20caller\x20provides.','auto_fixable':!![]},'check':a=>null},R_P_06={'rule':{'id':'R-PAYMENT-06','level':'MEDIUM','category':'cross_object','title':'object-linker\x20tx\x20registration\x20filters\x20recipients\x20by\x20is_object_address\x20—\x20user\x20addresses\x20skipped','description':'create()\x20iterates\x20recipients\x20and\x20only\x20calls\x20object_linker::affiliation_tx\x20for\x20addresses\x20that\x20'+'pass\x20util::is_object_address\x20(payment.move:147-161).\x20User\x20addresses\x20(EOAs)\x20are\x20not\x20'+'registered\x20in\x20the\x20object-linker\x20tx\x20index.\x20Callers\x20who\x20expect\x20every\x20recipient\x20to\x20'+'appear\x20in\x20object-linker\x20tx\x20queries\x20will\x20miss\x20EOA\x20recipients.','affected_stakeholders':['signer','consumer'],'scenario':'Caller\x20queries\x20object-linker\x20tx\x20for\x20all\x20Payment\x20recipients;\x20EOA\x20recipients\x20are\x20missing','mitigation':'Document\x20that\x20affiliation_tx\x20is\x20registered\x20only\x20for\x20object-address\x20recipients.\x20Off-chain\x20'+'systems\x20should\x20track\x20EOA\x20recipients\x20via\x20the\x20NewPaymentEvent\x20record,\x20not\x20via\x20object-linker\x20tx.','auto_fixable':![]},'check':a=>{if(!a['expects_user_recipient_registered'])return null;return{...R_P_06['rule'],'evidence':'expects_user_recipient_registered=true\x20(EOAs\x20are\x20skipped)'};}},R_P_07={'rule':{'id':'R-PAYMENT-07','level':'LOW','category':'semantic','title':'Payment.signer\x20records\x20payer\x20—\x20useful\x20for\x20provenance\x20but\x20not\x20authorization','description':'Payment.signer\x20is\x20set\x20to\x20ctx.sender()\x20at\x20creation\x20(payment.move).\x20It\x20can\x20be\x20read\x20via\x20'+'payment_signer<T>(payment)\x20for\x20provenance\x20(e.g.\x20\x27who\x20paid\x20for\x20this\x20order\x27).\x20It\x20is\x20'+'purely\x20informational\x20—\x20it\x20does\x20NOT\x20authorize\x20any\x20later\x20operation.\x20Consumers\x20must\x20not\x20'+'treat\x20signer\x20as\x20a\x20permission\x20grant.','affected_stakeholders':['consumer'],'scenario':'Consumer\x20treats\x20Payment.signer\x20as\x20authorizing\x20a\x20refund;\x20signer\x20is\x20just\x20provenance','mitigation':'Use\x20Payment.signer\x20only\x20for\x20audit/provenance.\x20Authorization\x20must\x20come\x20from\x20the\x20'+'referencing\x20object\x27s\x20own\x20Permission,\x20not\x20from\x20Payment.signer.','auto_fixable':![]},'check':a=>{if(!a['uses_signer_for_provenance'])return null;return{...R_P_07['rule'],'evidence':'uses_signer_for_provenance=true\x20(informational\x20only)'};}},R_P_08={'rule':{'id':'R-PAYMENT-08','level':'MEDIUM','category':'semantic','title':'Payment\x20scene\x20binding\x20(for_object\x20+\x20for_guard\x20+\x20index)\x20—\x20anti-reuse\x20for\x20exception\x20branches','description':'PaymentInfo\x20supports\x20for_object\x20(binds\x20to\x20specific\x20Order),\x20for_guard\x20(binds\x20to\x20specific\x20Guard),\x20'+'and\x20index\x20(binds\x20to\x20specific\x20Progress\x20step)\x20—\x20payment.move#L66-71.\x20When\x20all\x20three\x20are\x20set\x20via\x20'+'payment_info_with_guard\x20(payment.move#L82-86),\x20the\x20Payment\x20is\x20scene-bound:\x20it\x20can\x20ONLY\x20be\x20used\x20'+'in\x20the\x20specific\x20order\x20+\x20guard\x20+\x20progress\x20context.\x20This\x20is\x20the\x20anti-reuse\x20design\x20for\x20exception\x20'+'branch\x20compensation\x20(e.g.,\x20delivery\x20delay\x20>30min\x20triggers\x20auto-compensation).\x20'+'Payment\x20is\x20immutable\x20(freeze_object,\x20payment.move#L160)\x20—\x20binding\x20cannot\x20be\x20altered.\x20'+'VERIFIER-EVIDENCE\x20DESIGN:\x20customer\x20submits\x20Payment,\x20Guard\x20verifies\x20binding\x20fields\x20match\x20current\x20context.','affected_stakeholders':['signer','recipient','consumer'],'scenario':'Treasury\x20creates\x20compensation\x20Payment\x20with\x20PaymentInfo(for_object=order,\x20for_guard=exception_guard,\x20index=current_progress)\x20for\x20delivery\x20delay','mitigation':'Use\x20payment_info_with_guard\x20for\x20all\x20exception\x20branch\x20Payments.\x20Ensure\x20for_object,\x20for_guard,\x20and\x20index\x20'+'all\x20match\x20the\x20intended\x20context.\x20Use\x20tpl_payment_exception_compensation\x20(guard-templates.ts)\x20as\x20design\x20template.','auto_fixable':![]},'check':a=>{if(!a['uses_scene_binding'])return null;const b=[];if(!a['has_for_object'])b['push']('for_object\x20not\x20set\x20(Order\x20binding\x20missing)');if(!a['has_for_guard'])b['push']('for_guard\x20not\x20set\x20(Guard\x20binding\x20missing)');if(!a['has_index'])b['push']('index\x20not\x20set\x20(Progress\x20step\x20binding\x20missing)');if(b['length']===0x0)return null;return{...R_P_08['rule'],'evidence':'incomplete\x20scene\x20binding:\x20'+b['join'](',\x20')};}},R_P_09={'rule':{'id':'R-PAYMENT-09','level':'LOW','category':'semantic','title':'PaymentInfo\x20variant\x20selection\x20—\x20use\x20payment_info_with_guard\x20for\x20exception\x20branches','description':'PaymentInfo\x20has\x204\x20constructor\x20variants\x20(payment.move#L66-86):\x20'+'payment_info\x20(for_object+remark+index,\x20no\x20for_guard),\x20'+'payment_info2\x20(remark+index,\x20no\x20for_object/for_guard),\x20'+'payment_info_with_guard\x20(for_object+for_guard+remark+index\x20—\x20FULL\x20binding),\x20'+'payment_info2_with_guard\x20(for_guard+remark+index,\x20no\x20for_object).\x20'+'For\x20exception\x20branch\x20compensation,\x20ALWAYS\x20use\x20payment_info_with_guard\x20to\x20get\x20full\x20scene\x20binding.\x20'+'Using\x20payment_info\x20(without\x20for_guard)\x20or\x20payment_info2\x20(without\x20for_object)\x20weakens\x20anti-reuse\x20protection.','affected_stakeholders':['signer','consumer'],'scenario':'Caller\x20uses\x20payment_info\x20instead\x20of\x20payment_info_with_guard\x20for\x20exception\x20compensation;\x20for_guard\x20is\x20lost','mitigation':'For\x20exception\x20branch\x20Payments:\x20always\x20use\x20payment_info_with_guard(for_object,\x20for_guard,\x20remark,\x20index).\x20'+'For\x20simple\x20Payments\x20without\x20scene\x20binding:\x20payment_info\x20or\x20payment_info2\x20is\x20fine.\x20'+'SDK\x20should\x20auto-select\x20the\x20variant\x20based\x20on\x20which\x20fields\x20are\x20provided.','auto_fixable':!![]},'check':a=>{if(!a['uses_scene_binding'])return null;if(a['payment_info_variant']==='payment_info_with_guard')return null;return{...R_P_09['rule'],'evidence':'uses_scene_binding=true\x20but\x20variant='+(a['payment_info_variant']??'unknown')+'\x20(should\x20be\x20payment_info_with_guard)'};}};export const PAYMENT_RISK_RULES=[R_P_01,R_P_02,R_P_03,R_P_04,R_P_05,R_P_06,R_P_07,R_P_08,R_P_09];export const PAYMENT_RISK_VERSION='1.0.0';export function checkPaymentRisks(a){const b=[];for(const c of PAYMENT_RISK_RULES){const d=c['check'](a);if(d)b['push'](d);}return!b['find'](e=>e['id']==='R-PAYMENT-05')&&b['push'](R_P_05['rule']),b;}

package/dist/knowledge/permission-risk.d.ts

@@ -61,9 +61,6 @@ export interface RiskCheckContext {
     target_objects_types?: string[];
 }
 export declare const PERMISSION_RISK_VERSION = "1.0.0";
-export declare function getAllRiskRules(): RiskRule[];
-export declare function getRiskRulesCount(): number;
-export declare function getRiskRulesByCategory(category: RiskCategory): RiskRule[];
 export interface PermissionRiskAssessment {
     summary: string;
     scene?: PermissionScene;

package/dist/knowledge/permission-risk.js

@@ -1 +1 @@
-import{USER_DEFINED_PERM_INDEX_START,MAX_ENTITY_COUNT,MAX_PERM_FOR_ENTITY,MAX_ADMIN_COUNT}from'@wowok/wowok';import{isBuiltinPermission,findSceneByPermissionIndex}from'./permission-ledger.js';const R_P_01={'id':'R-P-1-01','category':'structural','trigger':'Custom\x20permission\x20index\x20<\x20USER_DEFINED_PERM_INDEX_START\x20(1000)\x20and\x20not\x20builtin','check':a=>{if(!a['table'])return null;if('index'in a['table']&&typeof a['table']['index']==='number'){const b=a['table']['index'];if(b<USER_DEFINED_PERM_INDEX_START&&!isBuiltinPermission(b))return{'id':'R-P-1-01','level':'CRITICAL','category':'structural','title':'Invalid\x20permission\x20index\x20(<\x201000\x20and\x20not\x20builtin)','description':'Permission\x20index\x20'+b+'\x20is\x20below\x20USER_DEFINED_PERM_INDEX_START\x20('+USER_DEFINED_PERM_INDEX_START+')\x20and\x20not\x20a\x20builtin\x20permission.\x20Custom\x20indexes\x20must\x20be\x20>=\x201000.','affected_stakeholders':['owner','admin','system'],'scenario':'User\x20defines\x20a\x20custom\x20permission\x20with\x20index\x20<\x201000','mitigation':'Use\x20index\x20>=\x20'+USER_DEFINED_PERM_INDEX_START+'\x20for\x20custom\x20permissions,\x20or\x20use\x20a\x20builtin\x20index\x20if\x20applicable','evidence':'index='+b};}return null;}},R_P_02={'id':'R-P-1-02','category':'structural','trigger':'Entity\x20count\x20exceeds\x20MAX_ENTITY_COUNT\x20(1000)','check':a=>{const b=a['current_entity_count']??0x0;if(b>MAX_ENTITY_COUNT)return{'id':'R-P-1-02','level':'HIGH','category':'structural','title':'Entity\x20count\x20exceeds\x20limit','description':'Permission\x20has\x20'+b+'\x20entities,\x20exceeds\x20MAX_ENTITY_COUNT\x20'+MAX_ENTITY_COUNT,'affected_stakeholders':['owner','admin'],'scenario':'Adding\x20entities\x20beyond\x20the\x20protocol\x20limit','mitigation':'Split\x20into\x20multiple\x20Permission\x20objects\x20or\x20remove\x20inactive\x20entities','evidence':'entity_count='+b};return null;}},R_P_03={'id':'R-P-1-03','category':'structural','trigger':'Per-entity\x20permission\x20count\x20exceeds\x20MAX_PERM_FOR_ENTITY\x20(1000)','check':a=>{if(a['table']&&'index'in a['table']&&Array['isArray'](a['table']['index'])){if(a['table']['index']['length']>MAX_PERM_FOR_ENTITY)return{'id':'R-P-1-03','level':'HIGH','category':'structural','title':'Per-entity\x20permission\x20count\x20exceeds\x20limit','description':'Entity\x20'+a['table']['entity']+'\x20has\x20'+a['table']['index']['length']+'\x20permissions,\x20exceeds\x20MAX_PERM_FOR_ENTITY\x20'+MAX_PERM_FOR_ENTITY,'affected_stakeholders':['entity','admin'],'scenario':'Granting\x20too\x20many\x20permissions\x20to\x20one\x20entity','mitigation':'Consolidate\x20similar\x20permissions\x20or\x20split\x20entity\x20into\x20multiple\x20roles','evidence':'perm_count='+a['table']['index']['length']};}return null;}},R_P_04={'id':'R-P-1-04','category':'structural','trigger':'Admin\x20count\x20exceeds\x20MAX_ADMIN_COUNT\x20(500)','check':a=>{if(a['admin']){const b=a['admin']['op']==='add'?(a['current_admin_count']??0x0)+a['admin']['addresses']['length']:a['admin']['addresses']['length'];if(b>MAX_ADMIN_COUNT)return{'id':'R-P-1-04','level':'HIGH','category':'structural','title':'Admin\x20count\x20exceeds\x20limit','description':'Admin\x20count\x20would\x20be\x20'+b+',\x20exceeds\x20MAX_ADMIN_COUNT\x20'+MAX_ADMIN_COUNT,'affected_stakeholders':['owner','admin'],'scenario':'Adding\x20too\x20many\x20admins','mitigation':'Remove\x20inactive\x20admins\x20before\x20adding\x20new\x20ones','evidence':'admin_count='+b};}return null;}},R_P_2_01={'id':'R-P-2-01','category':'semantic','trigger':'Builtin\x20permission\x20index\x20used\x20outside\x20its\x20host\x20object\x20scene','check':a=>{if(!a['table']||!('index'in a['table'])||typeof a['table']['index']!=='number')return null;const b=a['table']['index'];if(!isBuiltinPermission(b))return null;const c=findSceneByPermissionIndex(b);if(!c)return null;if(a['target_objects_types']&&a['target_objects_types']['length']>0x0){const d=a['target_objects_types']['filter'](e=>e!==c['host_object']);if(d['length']>0x0)return{'id':'R-P-2-01','level':'HIGH','category':'semantic','title':'Permission\x20index\x20host\x20object\x20mismatch','description':'Permission\x20'+b+'\x20('+c['builtin_indexes']['find'](e=>e['index']===b)?.['name']+')\x20is\x20for\x20'+c['host_object']+',\x20but\x20apply\x20targets:\x20'+d['join'](',\x20'),'affected_stakeholders':['owner','admin'],'scenario':'Using\x20SERVICE_*\x20index\x20on\x20Machine\x20object','mitigation':'Use\x20'+c['host_object']+'-specific\x20permission\x20indexes\x20for\x20'+d['join'](',\x20'),'evidence':'index='+b+',\x20targets='+d['join'](',')};}return null;}},R_P_2_02={'id':'R-P-2-02','category':'semantic','trigger':'Custom\x20permission\x20(>=\x201000)\x20without\x20remark','check':a=>{if(!a['table']||!('index'in a['table'])||typeof a['table']['index']!=='number')return null;const b=a['table']['index'];if(b<USER_DEFINED_PERM_INDEX_START)return null;if(a['remark']&&a['remark']['op']==='set'&&a['remark']['index']===b)return null;return{'id':'R-P-2-02','level':'LOW','category':'semantic','title':'Custom\x20permission\x20without\x20remark','description':'Custom\x20permission\x20'+b+'\x20has\x20no\x20remark;\x20future\x20maintainers\x20won\x27t\x20know\x20its\x20purpose','affected_stakeholders':['admin'],'scenario':'Adding\x20custom\x20permission\x20without\x20documentation','mitigation':'Add\x20remark:\x20{\x20op:\x20\x22set\x22,\x20index:\x20'+b+',\x20remark:\x20\x22<purpose>\x22\x20}','evidence':'index='+b};}},R_P_3_01={'id':'R-P-3-01','category':'authority','trigger':'Permission\x20over-concentration:\x20owner\x20is\x20the\x20only\x20admin','check':a=>{if(!a['admin']||a['admin']['op']!=='set')return null;if(a['admin']['addresses']['length']===0x1)return{'id':'R-P-3-01','level':'MEDIUM','category':'authority','title':'Permission\x20over-concentration','description':'Only\x20one\x20admin\x20(likely\x20owner);\x20loss\x20of\x20owner\x20key\x20means\x20permanent\x20lockout','affected_stakeholders':['owner'],'scenario':'Single-admin\x20Permission','mitigation':'Add\x201-2\x20backup\x20admins\x20with\x20limited\x20permission\x20indexes','evidence':'admin_count=1'};return null;}},R_P_3_02={'id':'R-P-3-02','category':'authority','trigger':'Permission\x20over-dispersion:\x20admin\x20count\x20>\x2050','check':a=>{if(!a['admin'])return null;const b=a['admin']['op']==='set'?a['admin']['addresses']['length']:a['current_admin_count']??0x0;if(b>0x32)return{'id':'R-P-3-02','level':'MEDIUM','category':'authority','title':'Permission\x20over-dispersion','description':b+'\x20admins\x20increases\x20coordination\x20cost\x20and\x20key-management\x20risk','affected_stakeholders':['owner','admin'],'scenario':'Large\x20admin\x20committee','mitigation':'Use\x20multi-sig\x20or\x20hierarchical\x20admin\x20structure','evidence':'admin_count='+b};return null;}},R_P_3_03={'id':'R-P-3-03','category':'authority','trigger':'UM\x20is\x20owner\x20self-reference','check':a=>{if(a['um']===undefined||a['um']===null)return null;if(a['builder']&&a['um']===a['builder'])return{'id':'R-P-3-03','level':'MEDIUM','category':'authority','title':'UM\x20is\x20owner\x20self-reference','description':'Setting\x20UM\x20to\x20owner\x20address\x20defeats\x20separation\x20of\x20concerns','affected_stakeholders':['owner'],'scenario':'Owner\x20delegates\x20UM\x20to\x20self','mitigation':'Use\x20a\x20separate\x20Contact\x20object\x20address\x20for\x20UM','evidence':'um='+a['um']};return null;}},R_P_4_01={'id':'R-P-4-01','category':'lifecycle','trigger':'Ownership\x20transfer\x20operation\x20(builder\x20field\x20set)','check':a=>{if(!a['builder'])return null;return{'id':'R-P-4-01','level':'HIGH','category':'lifecycle','title':'Ownership\x20transfer\x20—\x20irreversible','description':'Transferring\x20Permission\x20to\x20'+a['builder']+'.\x20Once\x20executed,\x20original\x20owner\x20loses\x20ALL\x20control\x20permanently.','affected_stakeholders':['owner'],'scenario':'Owner\x20transfers\x20Permission\x20to\x20new\x20address','mitigation':'1)\x20Verify\x20new\x20owner\x20address\x20twice.\x202)\x20Export\x20Permission\x20JSON\x20before\x20transfer.\x203)\x20Coordinate\x20with\x20new\x20owner\x20to\x20confirm\x20receipt.','evidence':'new_owner='+a['builder']};}},R_P_4_02={'id':'R-P-4-02','category':'lifecycle','trigger':'Apply\x20to\x20multiple\x20objects\x20at\x20once','check':a=>{if(!a['apply']||a['apply']['length']===0x0)return null;if(a['apply']['length']>0x3)return{'id':'R-P-4-02','level':'MEDIUM','category':'lifecycle','title':'Batch\x20apply\x20to\x20multiple\x20objects','description':'Applying\x20Permission\x20to\x20'+a['apply']['length']+'\x20objects\x20at\x20once;\x20if\x20any\x20object\x20type\x20mismatches,\x20transaction\x20may\x20fail\x20or\x20silently\x20misalign','affected_stakeholders':['owner'],'scenario':'Batch\x20apply\x20across\x20heterogeneous\x20objects','mitigation':'Apply\x20to\x201-3\x20objects\x20at\x20a\x20time;\x20verify\x20each\x20object\x20type\x20matches\x20permission\x20indexes','evidence':'apply_count='+a['apply']['length']};return null;}},R_P_4_03={'id':'R-P-4-03','category':'lifecycle','trigger':'Entity\x20replace\x20operation\x20(destructive)','check':a=>{if(!a['entity']||a['entity']['op']!=='replace')return null;return{'id':'R-P-4-03','level':'MEDIUM','category':'lifecycle','title':'Entity\x20replace\x20—\x20destructive','description':'Replacing\x20'+a['entity']['entity1']+'\x20with\x20'+a['entity']['entity2']+';\x20entity1\x20loses\x20ALL\x20permissions\x20permanently','affected_stakeholders':['entity'],'scenario':'Replacing\x20a\x20user\x20who\x20left\x20the\x20organization','mitigation':'Prefer\x20\x27copy\x27\x20over\x20\x27replace\x27\x20if\x20entity1\x20should\x20retain\x20permissions','evidence':'entity1='+a['entity']['entity1']+',\x20entity2='+a['entity']['entity2']};}},R_P_5_01={'id':'R-P-5-01','category':'cross_object','trigger':'Apply\x20to\x20Progress\x20object\x20(Permission\x20becomes\x20immutable\x20on\x20bind)','check':a=>{if(!a['apply'])return null;if(a['target_objects_types']?.['includes']('Progress'))return{'id':'R-P-5-01','level':'MEDIUM','category':'cross_object','title':'Apply\x20to\x20Progress\x20—\x20post-bind\x20mutability\x20limited','description':'Once\x20Permission\x20is\x20bound\x20to\x20Progress\x20(which\x20binds\x20Machine),\x20permission\x20table\x20changes\x20may\x20not\x20affect\x20already-published\x20Machine\x20workflow','affected_stakeholders':['owner'],'scenario':'Permission\x20shared\x20across\x20Machine/Progress','mitigation':'Configure\x20all\x20permission\x20indexes\x20before\x20Machine\x20publish','evidence':'target=Progress'};return null;}},R_P_5_02={'id':'R-P-5-02','category':'cross_object','trigger':'Permission\x20reused\x20across\x20multiple\x20host\x20object\x20types','check':a=>{if(!a['target_objects_types']||a['target_objects_types']['length']<0x2)return null;const b=new Set(a['target_objects_types']);if(b['size']>0x1)return{'id':'R-P-5-02','level':'MEDIUM','category':'cross_object','title':'Permission\x20shared\x20across\x20heterogeneous\x20objects','description':'Single\x20Permission\x20applied\x20to\x20'+[...b]['join'](',\x20')+';\x20permission\x20indexes\x20may\x20have\x20different\x20semantics\x20per\x20object','affected_stakeholders':['owner','admin'],'scenario':'One\x20Permission\x20for\x20both\x20Service\x20and\x20Treasury','mitigation':'Use\x20separate\x20Permission\x20objects\x20per\x20host\x20object\x20type\x20for\x20clarity','evidence':'types='+[...b]['join'](',')};return null;}},R_P_5_03={'id':'R-P-5-03','category':'cross_object','trigger':'Treasury\x20external_*_guard\x20management\x20(255/256)\x20granted\x20—\x20verify\x20guard\x20lists\x20are\x20populated','check':a=>{if(!a['table']||!('index'in a['table'])||typeof a['table']['index']!=='number')return null;const b=a['table']['index'];if(b===0xff||b===0x100)return{'id':'R-P-5-03','level':'HIGH','category':'cross_object','title':'Treasury\x20external\x20guard\x20management\x20granted\x20—\x20populate\x20guard\x20lists','description':'Permission\x20'+b+'\x20('+(b===0xff?'TREASURY_EXTERNAL_DEPOSIT_GUARD':'TREASURY_EXTERNAL_WITHDRAW_GUARD')+')\x20granted;\x20ensure\x20external_'+(b===0xff?'deposit':'withdraw')+'_guard\x20list\x20is\x20populated\x20via\x20external_*_guard_add\x20so\x20external\x20operations\x20are\x20authorized','affected_stakeholders':['owner','admin'],'scenario':'External\x20treasury\x20guard\x20management\x20without\x20populated\x20guard\x20lists','mitigation':'Call\x20treasury.external_'+(b===0xff?'deposit':'withdraw')+'_guard_add\x20to\x20register\x20Guard\x20objects;\x20external_deposit/external_withdraw\x20require\x20Guard\x20+\x20Passport\x20(no\x20Permission\x20index)','evidence':'index='+b};return null;}},ALL_RULES=[R_P_01,R_P_02,R_P_03,R_P_04,R_P_2_01,R_P_2_02,R_P_3_01,R_P_3_02,R_P_3_03,R_P_4_01,R_P_4_02,R_P_4_03,R_P_5_01,R_P_5_02,R_P_5_03];export const PERMISSION_RISK_VERSION='1.0.0';export function getAllRiskRules(){return[...ALL_RULES];}export function getRiskRulesCount(){return ALL_RULES['length'];}export function getRiskRulesByCategory(a){return ALL_RULES['filter'](b=>b['category']===a);}export function assessPermissionRisks(a){const b=[];for(const f of ALL_RULES){const g=f['check'](a);if(g)b['push'](g);}const c=b['length']===0x0?'LOW':b['some'](h=>h['level']==='CRITICAL')?'CRITICAL':b['some'](h=>h['level']==='HIGH')?'HIGH':b['some'](h=>h['level']==='MEDIUM')?'MEDIUM':'LOW',d={};for(const h of b){d[h['category']]=(d[h['category']]??0x0)+0x1;}const e={};for(const i of b){for(const j of i['affected_stakeholders']){if(!e[j])e[j]=[];e[j]['push'](i['id']+':\x20'+i['mitigation']);}}return{'summary':'Assessed\x20'+b['length']+'\x20risk(s)\x20across\x20'+Object['keys'](d)['length']+'\x20categories','risks':b,'overall_risk':c,'risks_by_category':d,'stakeholder_advice':e,'needs_human_review':b['some'](k=>k['level']==='CRITICAL'||k['level']==='HIGH')};}
+import{USER_DEFINED_PERM_INDEX_START,MAX_ENTITY_COUNT,MAX_PERM_FOR_ENTITY,MAX_ADMIN_COUNT}from'@wowok/wowok';import{isBuiltinPermission,findSceneByPermissionIndex}from'./permission-ledger.js';const R_P_01={'id':'R-P-1-01','category':'structural','trigger':'Custom\x20permission\x20index\x20<\x20USER_DEFINED_PERM_INDEX_START\x20(1000)\x20and\x20not\x20builtin','check':a=>{if(!a['table'])return null;if('index'in a['table']&&typeof a['table']['index']==='number'){const b=a['table']['index'];if(b<USER_DEFINED_PERM_INDEX_START&&!isBuiltinPermission(b))return{'id':'R-P-1-01','level':'CRITICAL','category':'structural','title':'Invalid\x20permission\x20index\x20(<\x201000\x20and\x20not\x20builtin)','description':'Permission\x20index\x20'+b+'\x20is\x20below\x20USER_DEFINED_PERM_INDEX_START\x20('+USER_DEFINED_PERM_INDEX_START+')\x20and\x20not\x20a\x20builtin\x20permission.\x20Custom\x20indexes\x20must\x20be\x20>=\x201000.','affected_stakeholders':['owner','admin','system'],'scenario':'User\x20defines\x20a\x20custom\x20permission\x20with\x20index\x20<\x201000','mitigation':'Use\x20index\x20>=\x20'+USER_DEFINED_PERM_INDEX_START+'\x20for\x20custom\x20permissions,\x20or\x20use\x20a\x20builtin\x20index\x20if\x20applicable','evidence':'index='+b};}return null;}},R_P_02={'id':'R-P-1-02','category':'structural','trigger':'Entity\x20count\x20exceeds\x20MAX_ENTITY_COUNT\x20(1000)','check':a=>{const b=a['current_entity_count']??0x0;if(b>MAX_ENTITY_COUNT)return{'id':'R-P-1-02','level':'HIGH','category':'structural','title':'Entity\x20count\x20exceeds\x20limit','description':'Permission\x20has\x20'+b+'\x20entities,\x20exceeds\x20MAX_ENTITY_COUNT\x20'+MAX_ENTITY_COUNT,'affected_stakeholders':['owner','admin'],'scenario':'Adding\x20entities\x20beyond\x20the\x20protocol\x20limit','mitigation':'Split\x20into\x20multiple\x20Permission\x20objects\x20or\x20remove\x20inactive\x20entities','evidence':'entity_count='+b};return null;}},R_P_03={'id':'R-P-1-03','category':'structural','trigger':'Per-entity\x20permission\x20count\x20exceeds\x20MAX_PERM_FOR_ENTITY\x20(1000)','check':a=>{if(a['table']&&'index'in a['table']&&Array['isArray'](a['table']['index'])){if(a['table']['index']['length']>MAX_PERM_FOR_ENTITY)return{'id':'R-P-1-03','level':'HIGH','category':'structural','title':'Per-entity\x20permission\x20count\x20exceeds\x20limit','description':'Entity\x20'+a['table']['entity']+'\x20has\x20'+a['table']['index']['length']+'\x20permissions,\x20exceeds\x20MAX_PERM_FOR_ENTITY\x20'+MAX_PERM_FOR_ENTITY,'affected_stakeholders':['entity','admin'],'scenario':'Granting\x20too\x20many\x20permissions\x20to\x20one\x20entity','mitigation':'Consolidate\x20similar\x20permissions\x20or\x20split\x20entity\x20into\x20multiple\x20roles','evidence':'perm_count='+a['table']['index']['length']};}return null;}},R_P_04={'id':'R-P-1-04','category':'structural','trigger':'Admin\x20count\x20exceeds\x20MAX_ADMIN_COUNT\x20(500)','check':a=>{if(a['admin']){const b=a['admin']['op']==='add'?(a['current_admin_count']??0x0)+a['admin']['addresses']['length']:a['admin']['addresses']['length'];if(b>MAX_ADMIN_COUNT)return{'id':'R-P-1-04','level':'HIGH','category':'structural','title':'Admin\x20count\x20exceeds\x20limit','description':'Admin\x20count\x20would\x20be\x20'+b+',\x20exceeds\x20MAX_ADMIN_COUNT\x20'+MAX_ADMIN_COUNT,'affected_stakeholders':['owner','admin'],'scenario':'Adding\x20too\x20many\x20admins','mitigation':'Remove\x20inactive\x20admins\x20before\x20adding\x20new\x20ones','evidence':'admin_count='+b};}return null;}},R_P_2_01={'id':'R-P-2-01','category':'semantic','trigger':'Builtin\x20permission\x20index\x20used\x20outside\x20its\x20host\x20object\x20scene','check':a=>{if(!a['table']||!('index'in a['table'])||typeof a['table']['index']!=='number')return null;const b=a['table']['index'];if(!isBuiltinPermission(b))return null;const c=findSceneByPermissionIndex(b);if(!c)return null;if(a['target_objects_types']&&a['target_objects_types']['length']>0x0){const d=a['target_objects_types']['filter'](e=>e!==c['host_object']);if(d['length']>0x0)return{'id':'R-P-2-01','level':'HIGH','category':'semantic','title':'Permission\x20index\x20host\x20object\x20mismatch','description':'Permission\x20'+b+'\x20('+c['builtin_indexes']['find'](e=>e['index']===b)?.['name']+')\x20is\x20for\x20'+c['host_object']+',\x20but\x20apply\x20targets:\x20'+d['join'](',\x20'),'affected_stakeholders':['owner','admin'],'scenario':'Using\x20SERVICE_*\x20index\x20on\x20Machine\x20object','mitigation':'Use\x20'+c['host_object']+'-specific\x20permission\x20indexes\x20for\x20'+d['join'](',\x20'),'evidence':'index='+b+',\x20targets='+d['join'](',')};}return null;}},R_P_2_02={'id':'R-P-2-02','category':'semantic','trigger':'Custom\x20permission\x20(>=\x201000)\x20without\x20remark','check':a=>{if(!a['table']||!('index'in a['table'])||typeof a['table']['index']!=='number')return null;const b=a['table']['index'];if(b<USER_DEFINED_PERM_INDEX_START)return null;if(a['remark']&&a['remark']['op']==='set'&&a['remark']['index']===b)return null;return{'id':'R-P-2-02','level':'LOW','category':'semantic','title':'Custom\x20permission\x20without\x20remark','description':'Custom\x20permission\x20'+b+'\x20has\x20no\x20remark;\x20future\x20maintainers\x20won\x27t\x20know\x20its\x20purpose','affected_stakeholders':['admin'],'scenario':'Adding\x20custom\x20permission\x20without\x20documentation','mitigation':'Add\x20remark:\x20{\x20op:\x20\x22set\x22,\x20index:\x20'+b+',\x20remark:\x20\x22<purpose>\x22\x20}','evidence':'index='+b};}},R_P_3_01={'id':'R-P-3-01','category':'authority','trigger':'Permission\x20over-concentration:\x20owner\x20is\x20the\x20only\x20admin','check':a=>{if(!a['admin']||a['admin']['op']!=='set')return null;if(a['admin']['addresses']['length']===0x1)return{'id':'R-P-3-01','level':'MEDIUM','category':'authority','title':'Permission\x20over-concentration','description':'Only\x20one\x20admin\x20(likely\x20owner);\x20loss\x20of\x20owner\x20key\x20means\x20permanent\x20lockout','affected_stakeholders':['owner'],'scenario':'Single-admin\x20Permission','mitigation':'Add\x201-2\x20backup\x20admins\x20with\x20limited\x20permission\x20indexes','evidence':'admin_count=1'};return null;}},R_P_3_02={'id':'R-P-3-02','category':'authority','trigger':'Permission\x20over-dispersion:\x20admin\x20count\x20>\x2050','check':a=>{if(!a['admin'])return null;const b=a['admin']['op']==='set'?a['admin']['addresses']['length']:a['current_admin_count']??0x0;if(b>0x32)return{'id':'R-P-3-02','level':'MEDIUM','category':'authority','title':'Permission\x20over-dispersion','description':b+'\x20admins\x20increases\x20coordination\x20cost\x20and\x20key-management\x20risk','affected_stakeholders':['owner','admin'],'scenario':'Large\x20admin\x20committee','mitigation':'Use\x20multi-sig\x20or\x20hierarchical\x20admin\x20structure','evidence':'admin_count='+b};return null;}},R_P_3_03={'id':'R-P-3-03','category':'authority','trigger':'UM\x20is\x20owner\x20self-reference','check':a=>{if(a['um']===undefined||a['um']===null)return null;if(a['builder']&&a['um']===a['builder'])return{'id':'R-P-3-03','level':'MEDIUM','category':'authority','title':'UM\x20is\x20owner\x20self-reference','description':'Setting\x20UM\x20to\x20owner\x20address\x20defeats\x20separation\x20of\x20concerns','affected_stakeholders':['owner'],'scenario':'Owner\x20delegates\x20UM\x20to\x20self','mitigation':'Use\x20a\x20separate\x20Contact\x20object\x20address\x20for\x20UM','evidence':'um='+a['um']};return null;}},R_P_4_01={'id':'R-P-4-01','category':'lifecycle','trigger':'Ownership\x20transfer\x20operation\x20(builder\x20field\x20set)','check':a=>{if(!a['builder'])return null;return{'id':'R-P-4-01','level':'HIGH','category':'lifecycle','title':'Ownership\x20transfer\x20—\x20irreversible','description':'Transferring\x20Permission\x20to\x20'+a['builder']+'.\x20Once\x20executed,\x20original\x20owner\x20loses\x20ALL\x20control\x20permanently.','affected_stakeholders':['owner'],'scenario':'Owner\x20transfers\x20Permission\x20to\x20new\x20address','mitigation':'1)\x20Verify\x20new\x20owner\x20address\x20twice.\x202)\x20Export\x20Permission\x20JSON\x20before\x20transfer.\x203)\x20Coordinate\x20with\x20new\x20owner\x20to\x20confirm\x20receipt.','evidence':'new_owner='+a['builder']};}},R_P_4_02={'id':'R-P-4-02','category':'lifecycle','trigger':'Apply\x20to\x20multiple\x20objects\x20at\x20once','check':a=>{if(!a['apply']||a['apply']['length']===0x0)return null;if(a['apply']['length']>0x3)return{'id':'R-P-4-02','level':'MEDIUM','category':'lifecycle','title':'Batch\x20apply\x20to\x20multiple\x20objects','description':'Applying\x20Permission\x20to\x20'+a['apply']['length']+'\x20objects\x20at\x20once;\x20if\x20any\x20object\x20type\x20mismatches,\x20transaction\x20may\x20fail\x20or\x20silently\x20misalign','affected_stakeholders':['owner'],'scenario':'Batch\x20apply\x20across\x20heterogeneous\x20objects','mitigation':'Apply\x20to\x201-3\x20objects\x20at\x20a\x20time;\x20verify\x20each\x20object\x20type\x20matches\x20permission\x20indexes','evidence':'apply_count='+a['apply']['length']};return null;}},R_P_4_03={'id':'R-P-4-03','category':'lifecycle','trigger':'Entity\x20replace\x20operation\x20(destructive)','check':a=>{if(!a['entity']||a['entity']['op']!=='replace')return null;return{'id':'R-P-4-03','level':'MEDIUM','category':'lifecycle','title':'Entity\x20replace\x20—\x20destructive','description':'Replacing\x20'+a['entity']['entity1']+'\x20with\x20'+a['entity']['entity2']+';\x20entity1\x20loses\x20ALL\x20permissions\x20permanently','affected_stakeholders':['entity'],'scenario':'Replacing\x20a\x20user\x20who\x20left\x20the\x20organization','mitigation':'Prefer\x20\x27copy\x27\x20over\x20\x27replace\x27\x20if\x20entity1\x20should\x20retain\x20permissions','evidence':'entity1='+a['entity']['entity1']+',\x20entity2='+a['entity']['entity2']};}},R_P_5_01={'id':'R-P-5-01','category':'cross_object','trigger':'Apply\x20to\x20Progress\x20object\x20(Permission\x20becomes\x20immutable\x20on\x20bind)','check':a=>{if(!a['apply'])return null;if(a['target_objects_types']?.['includes']('Progress'))return{'id':'R-P-5-01','level':'MEDIUM','category':'cross_object','title':'Apply\x20to\x20Progress\x20—\x20post-bind\x20mutability\x20limited','description':'Once\x20Permission\x20is\x20bound\x20to\x20Progress\x20(which\x20binds\x20Machine),\x20permission\x20table\x20changes\x20may\x20not\x20affect\x20already-published\x20Machine\x20workflow','affected_stakeholders':['owner'],'scenario':'Permission\x20shared\x20across\x20Machine/Progress','mitigation':'Configure\x20all\x20permission\x20indexes\x20before\x20Machine\x20publish','evidence':'target=Progress'};return null;}},R_P_5_02={'id':'R-P-5-02','category':'cross_object','trigger':'Permission\x20reused\x20across\x20multiple\x20host\x20object\x20types','check':a=>{if(!a['target_objects_types']||a['target_objects_types']['length']<0x2)return null;const b=new Set(a['target_objects_types']);if(b['size']>0x1)return{'id':'R-P-5-02','level':'MEDIUM','category':'cross_object','title':'Permission\x20shared\x20across\x20heterogeneous\x20objects','description':'Single\x20Permission\x20applied\x20to\x20'+[...b]['join'](',\x20')+';\x20permission\x20indexes\x20may\x20have\x20different\x20semantics\x20per\x20object','affected_stakeholders':['owner','admin'],'scenario':'One\x20Permission\x20for\x20both\x20Service\x20and\x20Treasury','mitigation':'Use\x20separate\x20Permission\x20objects\x20per\x20host\x20object\x20type\x20for\x20clarity','evidence':'types='+[...b]['join'](',')};return null;}},R_P_5_03={'id':'R-P-5-03','category':'cross_object','trigger':'Treasury\x20external_*_guard\x20management\x20(255/256)\x20granted\x20—\x20verify\x20guard\x20lists\x20are\x20populated','check':a=>{if(!a['table']||!('index'in a['table'])||typeof a['table']['index']!=='number')return null;const b=a['table']['index'];if(b===0xff||b===0x100)return{'id':'R-P-5-03','level':'HIGH','category':'cross_object','title':'Treasury\x20external\x20guard\x20management\x20granted\x20—\x20populate\x20guard\x20lists','description':'Permission\x20'+b+'\x20('+(b===0xff?'TREASURY_EXTERNAL_DEPOSIT_GUARD':'TREASURY_EXTERNAL_WITHDRAW_GUARD')+')\x20granted;\x20ensure\x20external_'+(b===0xff?'deposit':'withdraw')+'_guard\x20list\x20is\x20populated\x20via\x20external_*_guard_add\x20so\x20external\x20operations\x20are\x20authorized','affected_stakeholders':['owner','admin'],'scenario':'External\x20treasury\x20guard\x20management\x20without\x20populated\x20guard\x20lists','mitigation':'Call\x20treasury.external_'+(b===0xff?'deposit':'withdraw')+'_guard_add\x20to\x20register\x20Guard\x20objects;\x20external_deposit/external_withdraw\x20require\x20Guard\x20+\x20Passport\x20(no\x20Permission\x20index)','evidence':'index='+b};return null;}},ALL_RULES=[R_P_01,R_P_02,R_P_03,R_P_04,R_P_2_01,R_P_2_02,R_P_3_01,R_P_3_02,R_P_3_03,R_P_4_01,R_P_4_02,R_P_4_03,R_P_5_01,R_P_5_02,R_P_5_03];export const PERMISSION_RISK_VERSION='1.0.0';export function assessPermissionRisks(a){const b=[];for(const f of ALL_RULES){const g=f['check'](a);if(g)b['push'](g);}const c=b['length']===0x0?'LOW':b['some'](h=>h['level']==='CRITICAL')?'CRITICAL':b['some'](h=>h['level']==='HIGH')?'HIGH':b['some'](h=>h['level']==='MEDIUM')?'MEDIUM':'LOW',d={};for(const h of b){d[h['category']]=(d[h['category']]??0x0)+0x1;}const e={};for(const i of b){for(const j of i['affected_stakeholders']){if(!e[j])e[j]=[];e[j]['push'](i['id']+':\x20'+i['mitigation']);}}return{'summary':'Assessed\x20'+b['length']+'\x20risk(s)\x20across\x20'+Object['keys'](d)['length']+'\x20categories','risks':b,'overall_risk':c,'risks_by_category':d,'stakeholder_advice':e,'needs_human_review':b['some'](k=>k['level']==='CRITICAL'||k['level']==='HIGH')};}

package/dist/knowledge/personal-risk.d.ts

@@ -33,4 +33,3 @@ export declare const PERSONAL_RISK_RULES: {
 }[];
 export declare const PERSONAL_RISK_VERSION = "1.0.0";
 export declare function checkPersonalRisks(ctx: PersonalRiskCheckContext): PersonalRisk[];
-export declare function getPersonalRiskById(id: string): PersonalRisk | undefined;

package/dist/knowledge/personal-risk.js

@@ -1 +1 @@
-import{MAX_ADDRESS_COUNT,MAX_RECORD_COUNT_REGISTRAR,MAX_RECORD_LENGTH,MAX_TAGS_COUNT}from'@wowok/wowok';function detectSensitiveInformation(a){const b=[];for(const c of a){const d=typeof c['value']==='string'?c['value']:String(c['value']??''),f=d['toLowerCase']();if(/^\+?\d{10,15}$/['test'](d))b['push'](c['name']+'=phone-like');if(/[^\s@]+@[^\s@]+\.[^\s@]+/['test'](d))b['push'](c['name']+'=email-like');if(/^(0x)?[0-9a-fA-F]{64}$/['test'](d))b['push'](c['name']+'=private-key-like');if(/^([a-z]{3,8}\s){11,23}[a-z]{3,8}$/['test'](d['trim']()))b['push'](c['name']+'=mnemonic-like');if(/private[_-]?key|secret|mnemonic|seed/i['test'](c['name']))b['push'](c['name']+'=secret-named');void f;}return b;}const R_PE_01={'rule':{'id':'R-PERSONAL-01','level':'HIGH','category':'semantic','title':'Sensitive\x20information\x20leakage\x20—\x20on-chain\x20data\x20is\x20permanent','description':'information\x20is\x20stored\x20via\x20Entity.info_add\x20as\x20on-chain\x20Records.\x20The\x20schema\x20description\x20'+'warns\x20\x27NEVER:\x20phone,\x20address,\x20private\x20keys\x27\x20but\x20the\x20Move\x20layer\x20does\x20not\x20validate\x20'+'content.\x20Once\x20a\x20phone\x20number,\x20physical\x20address,\x20email,\x20or\x20private\x20key\x20is\x20written\x20'+'on-chain,\x20it\x20is\x20permanent\x20and\x20publicly\x20readable\x20—\x20there\x20is\x20no\x20delete\x20(info_remove\x20'+'only\x20removes\x20the\x20named\x20entry\x20from\x20the\x20user\x27s\x20record;\x20the\x20data\x20remains\x20in\x20the\x20'+'transaction\x20history).','affected_stakeholders':['user'],'scenario':'User\x20adds\x20information\x20{name:\x20\x27phone\x27,\x20value:\x20\x27+8613800000000\x27};\x20number\x20is\x20public\x20forever','mitigation':'MCP\x20schema\x20description\x20MUST\x20warn.\x20AI\x20agents\x20MUST\x20re-confirm\x20before\x20adding\x20any\x20'+'information\x20entry.\x20Business\x20layer\x20should\x20run\x20a\x20sensitive-data\x20regex\x20(phone/email/'+'private-key/mnemonic)\x20and\x20reject\x20matches.\x20Use\x20the\x20\x27local\x27\x20tool\x20for\x20private\x20data.','auto_fixable':![]},'check':a=>{if(!a['information_entries']||a['information_entries']['length']===0x0)return null;const b=detectSensitiveInformation(a['information_entries']);if(b['length']===0x0)return null;return{...R_PE_01['rule'],'evidence':'sensitive\x20patterns:\x20'+b['join'](';\x20')};}},R_PE_02={'rule':{'id':'R-PERSONAL-02','level':'MEDIUM','category':'lifecycle','title':'mark\x20destroy\x20is\x20irreversible\x20—\x20identity\x20mark\x20permanently\x20lost','description':'The\x20\x27destroy\x27\x20mark\x20op\x20permanently\x20deletes\x20the\x20Resource\x20object\x20backing\x20the\x20user\x27s\x20'+'identity\x20mark.\x20There\x20is\x20no\x20archive,\x20no\x20event,\x20and\x20no\x20rollback.\x20After\x20destroy,\x20the\x20'+'user\x20has\x20no\x20on-chain\x20identity\x20mark\x20until\x20they\x20create\x20a\x20new\x20one,\x20and\x20any\x20external\x20'+'system\x20keyed\x20on\x20the\x20old\x20Resource\x20address\x20breaks.','affected_stakeholders':['user','consumer'],'scenario':'User\x20destroys\x20their\x20mark;\x20downstream\x20services\x20keyed\x20on\x20the\x20old\x20Resource\x20address\x20fail','mitigation':'Require\x20explicit\x20confirmation\x20before\x20destroy.\x20SDK\x20should\x20refuse\x20destroy\x20if\x20any\x20'+'live\x20consumer\x20still\x20references\x20the\x20mark.\x20Provide\x20a\x20\x27replace\x27\x20alternative\x20that\x20'+'swaps\x20the\x20underlying\x20Resource\x20without\x20losing\x20continuity.','auto_fixable':![]},'check':a=>{if(!a['is_mark_destroy'])return null;return{...R_PE_02['rule'],'evidence':'is_mark_destroy=true\x20(irreversible)'};}},R_PE_03={'rule':{'id':'R-PERSONAL-03','level':'MEDIUM','category':'semantic','title':'referrer\x20chain\x20can\x20be\x20abused\x20to\x20fabricate\x20trust\x20signals','description':'When\x20registering,\x20a\x20user\x20may\x20specify\x20any\x20referrer\x20address.\x20There\x20is\x20no\x20on-chain\x20'+'verification\x20that\x20the\x20referrer\x20actually\x20invited\x20the\x20user.\x20A\x20sybil\x20attacker\x20can\x20'+'register\x20many\x20accounts\x20chained\x20to\x20a\x20reputable\x20address,\x20fabricating\x20an\x20association\x20'+'to\x20borrow\x20trust.\x20The\x20Registrar\x20records\x20referrer\x20but\x20does\x20not\x20validate\x20consent.','affected_stakeholders':['user','consumer'],'scenario':'Attacker\x20registers\x20100\x20accounts\x20all\x20citing\x20a\x20reputable\x20merchant\x20as\x20referrer','mitigation':'Business\x20layer\x20should\x20treat\x20referrer\x20as\x20a\x20self-attested\x20hint,\x20not\x20a\x20verified\x20trust\x20'+'signal.\x20Audit\x20referrer\x20chains\x20off-chain;\x20require\x20the\x20referrer\x20to\x20co-sign\x20if\x20used\x20for\x20'+'trust\x20scoring.','auto_fixable':![]},'check':a=>{if(!a['has_referrer'])return null;return{...R_PE_03['rule'],'evidence':'has_referrer=true\x20(self-attested,\x20unverified)'};}},R_PE_04={'rule':{'id':'R-PERSONAL-04','level':'LOW','category':'structural','title':'information\x20inherits\x20MAX_RECORD_COUNT_REGISTRAR='+MAX_RECORD_COUNT_REGISTRAR+'\x20—\x20permissive','description':'Personal\x20does\x20not\x20define\x20its\x20own\x20record\x20cap;\x20it\x20inherits\x20Entity\x27s\x20'+('MAX_RECORD_COUNT_REGISTRAR='+MAX_RECORD_COUNT_REGISTRAR+'\x20(registrar.move)\x20and\x20')+('MAX_RECORD_LENGTH='+MAX_RECORD_LENGTH+'\x20per\x20record.\x20'+MAX_RECORD_COUNT_REGISTRAR+'\x20records\x20')+'per\x20user\x20is\x20generous\x20and\x20can\x20bloat\x20on-chain\x20storage\x20if\x20users\x20add\x20many\x20entries.\x20'+('MAX_ADDRESS_COUNT='+MAX_ADDRESS_COUNT+'\x20and\x20MAX_TAGS_COUNT='+MAX_TAGS_COUNT+'\x20also\x20apply\x20via\x20Entity/Resource.'),'affected_stakeholders':['user','system'],'scenario':'User\x20adds\x201000\x20information\x20entries;\x20Entity\x20record\x20storage\x20is\x20heavy\x20and\x20slow\x20to\x20read','mitigation':'Business\x20layer\x20should\x20self-limit\x20information\x20count\x20(e.g.\x20≤50).\x20For\x20bulk\x20profile\x20data,\x20'+'store\x20off-chain\x20and\x20reference\x20via\x20a\x20Repository\x20or\x20Proof.','auto_fixable':![]},'check':a=>{if(a['information_count']===undefined)return null;if(a['information_count']<MAX_RECORD_COUNT_REGISTRAR)return null;return{...R_PE_04['rule'],'evidence':'information_count='+a['information_count']+',\x20limit='+MAX_RECORD_COUNT_REGISTRAR};}},R_PE_05={'rule':{'id':'R-PERSONAL-05','level':'MEDIUM','category':'lifecycle','title':'mark\x20transfer\x20loses\x20identity\x20mark\x20at\x20the\x20source\x20address','description':'The\x20\x27transfer\x27\x20mark\x20op\x20moves\x20the\x20Resource\x20backing\x20the\x20identity\x20mark\x20to\x20a\x20new\x20address.\x20'+'After\x20transfer,\x20the\x20source\x20address\x20has\x20no\x20mark\x20—\x20any\x20service\x20that\x20keyed\x20identity\x20on\x20'+'the\x20source\x20address\x20loses\x20the\x20binding.\x20There\x20is\x20no\x20automatic\x20forwarding\x20stub\x20left\x20behind.','affected_stakeholders':['user','consumer'],'scenario':'User\x20transfers\x20mark\x20to\x20a\x20new\x20wallet;\x20old-wallet-based\x20logins\x20all\x20break','mitigation':'Surface\x20a\x20\x27transfer\x20will\x20detach\x20the\x20mark\x20from\x20this\x20address\x27\x20warning.\x20Consumers\x20should\x20'+'track\x20marks\x20by\x20Resource\x20address,\x20not\x20by\x20user\x20address.\x20Provide\x20a\x20migration\x20window\x20'+'where\x20both\x20addresses\x20are\x20valid.','auto_fixable':![]},'check':a=>{if(!a['is_mark_transfer'])return null;return{...R_PE_05['rule'],'evidence':'is_mark_transfer=true\x20(source\x20loses\x20mark)'};}},R_PE_06={'rule':{'id':'R-PERSONAL-06','level':'LOW','category':'cross_object','title':'Personal\x20has\x20no\x20dedicated\x20Move\x20struct\x20—\x20depends\x20entirely\x20on\x20Entity\x20+\x20Resource','description':'Personal\x20is\x20an\x20SDK-layer\x20construct:\x20there\x20is\x20no\x20personal.move.\x20The\x20SDK\x20composes\x20'+'Entity\x20(information/description)\x20and\x20Resource\x20(mark)\x20on\x20behalf\x20of\x20the\x20user.\x20Any\x20'+'breaking\x20change\x20in\x20Entity\x20or\x20Resource\x20directly\x20affects\x20Personal.\x20The\x20MCP\x20layer\x20'+'cannot\x20fix\x20Personal\x20bugs\x20without\x20touching\x20Entity/Resource.','affected_stakeholders':['system'],'scenario':'Entity\x20schema\x20changes;\x20Personal.information\x20silently\x20breaks','mitigation':'Track\x20Entity\x20and\x20Resource\x20changelogs\x20as\x20first-order\x20dependencies\x20of\x20Personal.\x20Add\x20'+'integration\x20tests\x20that\x20exercise\x20Personal\x20flows\x20whenever\x20Entity/Resource\x20change.','auto_fixable':![]},'check':a=>{if(!a['expects_dedicated_move_struct'])return null;return{...R_PE_06['rule'],'evidence':'expects_dedicated_move_struct=true\x20(none\x20exists)'};}},R_PE_07={'rule':{'id':'R-PERSONAL-07','level':'MEDIUM','category':'lifecycle','title':'Singleton\x20assumption\x20—\x20if\x20violated,\x20multiple\x20Personal\x20instances\x20conflict','description':'Personal\x20assumes\x20each\x20account\x20has\x20exactly\x20one\x20Entity\x20record\x20(and\x20one\x20Resource\x20mark).\x20'+'The\x20Move\x20layer\x20enforces\x20this\x20via\x20entity_register\x27s\x20idempotency\x20(returns\x20the\x20existing\x20'+'Resource\x20for\x20already-registered\x20users).\x20But\x20if\x20the\x20SDK\x20ever\x20bypasses\x20entity_register\x20'+'and\x20creates\x20duplicates\x20(e.g.\x20via\x20entity_register_with_resource_forced),\x20downstream\x20'+'code\x20that\x20assumes\x20a\x20singleton\x20would\x20see\x20inconsistent\x20state.','affected_stakeholders':['user','consumer'],'scenario':'SDK\x20calls\x20entity_register_with_resource_forced;\x20user\x20now\x20has\x20two\x20Resource\x20marks','mitigation':'SDK\x20MUST\x20enforce\x20the\x20singleton\x20invariant:\x20refuse\x20to\x20call\x20entity_register_with_resource_forced\x20'+'unless\x20the\x20user\x20explicitly\x20opts\x20in.\x20Document\x20that\x20forced\x20re-registration\x20invalidates\x20'+'the\x20old\x20Resource\x20address.','auto_fixable':![]},'check':a=>{if(a['singleton_enforced'])return null;return{...R_PE_07['rule'],'evidence':'singleton_enforced=false\x20(needs\x20SDK\x20guard)'};}};export const PERSONAL_RISK_RULES=[R_PE_01,R_PE_02,R_PE_03,R_PE_04,R_PE_05,R_PE_06,R_PE_07];export const PERSONAL_RISK_VERSION='1.0.0';export function checkPersonalRisks(a){const b=[];for(const c of PERSONAL_RISK_RULES){const d=c['check'](a);if(d)b['push'](d);}return b;}export function getPersonalRiskById(a){return PERSONAL_RISK_RULES['find'](b=>b['rule']['id']===a)?.['rule'];}
+import{MAX_ADDRESS_COUNT,MAX_RECORD_COUNT_REGISTRAR,MAX_RECORD_LENGTH,MAX_TAGS_COUNT}from'@wowok/wowok';function detectSensitiveInformation(a){const b=[];for(const c of a){const d=typeof c['value']==='string'?c['value']:String(c['value']??''),f=d['toLowerCase']();if(/^\+?\d{10,15}$/['test'](d))b['push'](c['name']+'=phone-like');if(/[^\s@]+@[^\s@]+\.[^\s@]+/['test'](d))b['push'](c['name']+'=email-like');if(/^(0x)?[0-9a-fA-F]{64}$/['test'](d))b['push'](c['name']+'=private-key-like');if(/^([a-z]{3,8}\s){11,23}[a-z]{3,8}$/['test'](d['trim']()))b['push'](c['name']+'=mnemonic-like');if(/private[_-]?key|secret|mnemonic|seed/i['test'](c['name']))b['push'](c['name']+'=secret-named');void f;}return b;}const R_PE_01={'rule':{'id':'R-PERSONAL-01','level':'HIGH','category':'semantic','title':'Sensitive\x20information\x20leakage\x20—\x20on-chain\x20data\x20is\x20permanent','description':'information\x20is\x20stored\x20via\x20Entity.info_add\x20as\x20on-chain\x20Records.\x20The\x20schema\x20description\x20'+'warns\x20\x27NEVER:\x20phone,\x20address,\x20private\x20keys\x27\x20but\x20the\x20Move\x20layer\x20does\x20not\x20validate\x20'+'content.\x20Once\x20a\x20phone\x20number,\x20physical\x20address,\x20email,\x20or\x20private\x20key\x20is\x20written\x20'+'on-chain,\x20it\x20is\x20permanent\x20and\x20publicly\x20readable\x20—\x20there\x20is\x20no\x20delete\x20(info_remove\x20'+'only\x20removes\x20the\x20named\x20entry\x20from\x20the\x20user\x27s\x20record;\x20the\x20data\x20remains\x20in\x20the\x20'+'transaction\x20history).','affected_stakeholders':['user'],'scenario':'User\x20adds\x20information\x20{name:\x20\x27phone\x27,\x20value:\x20\x27+8613800000000\x27};\x20number\x20is\x20public\x20forever','mitigation':'MCP\x20schema\x20description\x20MUST\x20warn.\x20AI\x20agents\x20MUST\x20re-confirm\x20before\x20adding\x20any\x20'+'information\x20entry.\x20Business\x20layer\x20should\x20run\x20a\x20sensitive-data\x20regex\x20(phone/email/'+'private-key/mnemonic)\x20and\x20reject\x20matches.\x20Use\x20the\x20\x27local\x27\x20tool\x20for\x20private\x20data.','auto_fixable':![]},'check':a=>{if(!a['information_entries']||a['information_entries']['length']===0x0)return null;const b=detectSensitiveInformation(a['information_entries']);if(b['length']===0x0)return null;return{...R_PE_01['rule'],'evidence':'sensitive\x20patterns:\x20'+b['join'](';\x20')};}},R_PE_02={'rule':{'id':'R-PERSONAL-02','level':'MEDIUM','category':'lifecycle','title':'mark\x20destroy\x20is\x20irreversible\x20—\x20identity\x20mark\x20permanently\x20lost','description':'The\x20\x27destroy\x27\x20mark\x20op\x20permanently\x20deletes\x20the\x20Resource\x20object\x20backing\x20the\x20user\x27s\x20'+'identity\x20mark.\x20There\x20is\x20no\x20archive,\x20no\x20event,\x20and\x20no\x20rollback.\x20After\x20destroy,\x20the\x20'+'user\x20has\x20no\x20on-chain\x20identity\x20mark\x20until\x20they\x20create\x20a\x20new\x20one,\x20and\x20any\x20external\x20'+'system\x20keyed\x20on\x20the\x20old\x20Resource\x20address\x20breaks.','affected_stakeholders':['user','consumer'],'scenario':'User\x20destroys\x20their\x20mark;\x20downstream\x20services\x20keyed\x20on\x20the\x20old\x20Resource\x20address\x20fail','mitigation':'Require\x20explicit\x20confirmation\x20before\x20destroy.\x20SDK\x20should\x20refuse\x20destroy\x20if\x20any\x20'+'live\x20consumer\x20still\x20references\x20the\x20mark.\x20Provide\x20a\x20\x27replace\x27\x20alternative\x20that\x20'+'swaps\x20the\x20underlying\x20Resource\x20without\x20losing\x20continuity.','auto_fixable':![]},'check':a=>{if(!a['is_mark_destroy'])return null;return{...R_PE_02['rule'],'evidence':'is_mark_destroy=true\x20(irreversible)'};}},R_PE_03={'rule':{'id':'R-PERSONAL-03','level':'MEDIUM','category':'semantic','title':'referrer\x20chain\x20can\x20be\x20abused\x20to\x20fabricate\x20trust\x20signals','description':'When\x20registering,\x20a\x20user\x20may\x20specify\x20any\x20referrer\x20address.\x20There\x20is\x20no\x20on-chain\x20'+'verification\x20that\x20the\x20referrer\x20actually\x20invited\x20the\x20user.\x20A\x20sybil\x20attacker\x20can\x20'+'register\x20many\x20accounts\x20chained\x20to\x20a\x20reputable\x20address,\x20fabricating\x20an\x20association\x20'+'to\x20borrow\x20trust.\x20The\x20Registrar\x20records\x20referrer\x20but\x20does\x20not\x20validate\x20consent.','affected_stakeholders':['user','consumer'],'scenario':'Attacker\x20registers\x20100\x20accounts\x20all\x20citing\x20a\x20reputable\x20merchant\x20as\x20referrer','mitigation':'Business\x20layer\x20should\x20treat\x20referrer\x20as\x20a\x20self-attested\x20hint,\x20not\x20a\x20verified\x20trust\x20'+'signal.\x20Audit\x20referrer\x20chains\x20off-chain;\x20require\x20the\x20referrer\x20to\x20co-sign\x20if\x20used\x20for\x20'+'trust\x20scoring.','auto_fixable':![]},'check':a=>{if(!a['has_referrer'])return null;return{...R_PE_03['rule'],'evidence':'has_referrer=true\x20(self-attested,\x20unverified)'};}},R_PE_04={'rule':{'id':'R-PERSONAL-04','level':'LOW','category':'structural','title':'information\x20inherits\x20MAX_RECORD_COUNT_REGISTRAR='+MAX_RECORD_COUNT_REGISTRAR+'\x20—\x20permissive','description':'Personal\x20does\x20not\x20define\x20its\x20own\x20record\x20cap;\x20it\x20inherits\x20Entity\x27s\x20'+('MAX_RECORD_COUNT_REGISTRAR='+MAX_RECORD_COUNT_REGISTRAR+'\x20(registrar.move)\x20and\x20')+('MAX_RECORD_LENGTH='+MAX_RECORD_LENGTH+'\x20per\x20record.\x20'+MAX_RECORD_COUNT_REGISTRAR+'\x20records\x20')+'per\x20user\x20is\x20generous\x20and\x20can\x20bloat\x20on-chain\x20storage\x20if\x20users\x20add\x20many\x20entries.\x20'+('MAX_ADDRESS_COUNT='+MAX_ADDRESS_COUNT+'\x20and\x20MAX_TAGS_COUNT='+MAX_TAGS_COUNT+'\x20also\x20apply\x20via\x20Entity/Resource.'),'affected_stakeholders':['user','system'],'scenario':'User\x20adds\x201000\x20information\x20entries;\x20Entity\x20record\x20storage\x20is\x20heavy\x20and\x20slow\x20to\x20read','mitigation':'Business\x20layer\x20should\x20self-limit\x20information\x20count\x20(e.g.\x20≤50).\x20For\x20bulk\x20profile\x20data,\x20'+'store\x20off-chain\x20and\x20reference\x20via\x20a\x20Repository\x20or\x20Proof.','auto_fixable':![]},'check':a=>{if(a['information_count']===undefined)return null;if(a['information_count']<MAX_RECORD_COUNT_REGISTRAR)return null;return{...R_PE_04['rule'],'evidence':'information_count='+a['information_count']+',\x20limit='+MAX_RECORD_COUNT_REGISTRAR};}},R_PE_05={'rule':{'id':'R-PERSONAL-05','level':'MEDIUM','category':'lifecycle','title':'mark\x20transfer\x20loses\x20identity\x20mark\x20at\x20the\x20source\x20address','description':'The\x20\x27transfer\x27\x20mark\x20op\x20moves\x20the\x20Resource\x20backing\x20the\x20identity\x20mark\x20to\x20a\x20new\x20address.\x20'+'After\x20transfer,\x20the\x20source\x20address\x20has\x20no\x20mark\x20—\x20any\x20service\x20that\x20keyed\x20identity\x20on\x20'+'the\x20source\x20address\x20loses\x20the\x20binding.\x20There\x20is\x20no\x20automatic\x20forwarding\x20stub\x20left\x20behind.','affected_stakeholders':['user','consumer'],'scenario':'User\x20transfers\x20mark\x20to\x20a\x20new\x20wallet;\x20old-wallet-based\x20logins\x20all\x20break','mitigation':'Surface\x20a\x20\x27transfer\x20will\x20detach\x20the\x20mark\x20from\x20this\x20address\x27\x20warning.\x20Consumers\x20should\x20'+'track\x20marks\x20by\x20Resource\x20address,\x20not\x20by\x20user\x20address.\x20Provide\x20a\x20migration\x20window\x20'+'where\x20both\x20addresses\x20are\x20valid.','auto_fixable':![]},'check':a=>{if(!a['is_mark_transfer'])return null;return{...R_PE_05['rule'],'evidence':'is_mark_transfer=true\x20(source\x20loses\x20mark)'};}},R_PE_06={'rule':{'id':'R-PERSONAL-06','level':'LOW','category':'cross_object','title':'Personal\x20has\x20no\x20dedicated\x20Move\x20struct\x20—\x20depends\x20entirely\x20on\x20Entity\x20+\x20Resource','description':'Personal\x20is\x20an\x20SDK-layer\x20construct:\x20there\x20is\x20no\x20personal.move.\x20The\x20SDK\x20composes\x20'+'Entity\x20(information/description)\x20and\x20Resource\x20(mark)\x20on\x20behalf\x20of\x20the\x20user.\x20Any\x20'+'breaking\x20change\x20in\x20Entity\x20or\x20Resource\x20directly\x20affects\x20Personal.\x20The\x20MCP\x20layer\x20'+'cannot\x20fix\x20Personal\x20bugs\x20without\x20touching\x20Entity/Resource.','affected_stakeholders':['system'],'scenario':'Entity\x20schema\x20changes;\x20Personal.information\x20silently\x20breaks','mitigation':'Track\x20Entity\x20and\x20Resource\x20changelogs\x20as\x20first-order\x20dependencies\x20of\x20Personal.\x20Add\x20'+'integration\x20tests\x20that\x20exercise\x20Personal\x20flows\x20whenever\x20Entity/Resource\x20change.','auto_fixable':![]},'check':a=>{if(!a['expects_dedicated_move_struct'])return null;return{...R_PE_06['rule'],'evidence':'expects_dedicated_move_struct=true\x20(none\x20exists)'};}},R_PE_07={'rule':{'id':'R-PERSONAL-07','level':'MEDIUM','category':'lifecycle','title':'Singleton\x20assumption\x20—\x20if\x20violated,\x20multiple\x20Personal\x20instances\x20conflict','description':'Personal\x20assumes\x20each\x20account\x20has\x20exactly\x20one\x20Entity\x20record\x20(and\x20one\x20Resource\x20mark).\x20'+'The\x20Move\x20layer\x20enforces\x20this\x20via\x20entity_register\x27s\x20idempotency\x20(returns\x20the\x20existing\x20'+'Resource\x20for\x20already-registered\x20users).\x20But\x20if\x20the\x20SDK\x20ever\x20bypasses\x20entity_register\x20'+'and\x20creates\x20duplicates\x20(e.g.\x20via\x20entity_register_with_resource_forced),\x20downstream\x20'+'code\x20that\x20assumes\x20a\x20singleton\x20would\x20see\x20inconsistent\x20state.','affected_stakeholders':['user','consumer'],'scenario':'SDK\x20calls\x20entity_register_with_resource_forced;\x20user\x20now\x20has\x20two\x20Resource\x20marks','mitigation':'SDK\x20MUST\x20enforce\x20the\x20singleton\x20invariant:\x20refuse\x20to\x20call\x20entity_register_with_resource_forced\x20'+'unless\x20the\x20user\x20explicitly\x20opts\x20in.\x20Document\x20that\x20forced\x20re-registration\x20invalidates\x20'+'the\x20old\x20Resource\x20address.','auto_fixable':![]},'check':a=>{if(a['singleton_enforced'])return null;return{...R_PE_07['rule'],'evidence':'singleton_enforced=false\x20(needs\x20SDK\x20guard)'};}};export const PERSONAL_RISK_RULES=[R_PE_01,R_PE_02,R_PE_03,R_PE_04,R_PE_05,R_PE_06,R_PE_07];export const PERSONAL_RISK_VERSION='1.0.0';export function checkPersonalRisks(a){const b=[];for(const c of PERSONAL_RISK_RULES){const d=c['check'](a);if(d)b['push'](d);}return b;}

package/dist/knowledge/progress-risk.d.ts

@@ -60,8 +60,6 @@ export interface ProgressRiskCheckContext {
 }
 export declare const PROGRESS_RISK_VERSION = "1.0.0";
 export declare function getAllProgressRiskRules(): ProgressRiskRule[];
-export declare function getProgressRiskRulesCount(): number;
-export declare function getProgressRiskRulesByCategory(category: ProgressRiskCategory): ProgressRiskRule[];
 export interface ProgressRiskAssessment {
     summary: string;
     scene?: ProgressScene;

package/dist/knowledge/progress-risk.js

@@ -1 +1 @@
-import{MAX_NAMED_OPERATOR_COUNT,MAX_NAMED_OPERATOR_ADDRESS_COUNT,MAX_CONTEXT_REPOSITORY_COUNT}from'@wowok/wowok';const R_PR_1_01={'id':'R-PR-1-01','category':'structural','trigger':'named_operator\x20addresses\x20count\x20>\x20MAX_NAMED_OPERATOR_ADDRESS_COUNT\x20(80)','check':a=>{if(!a['progress_namedOperator'])return null;const b=a['progress_namedOperator']['operators']['length'];if(b>MAX_NAMED_OPERATOR_ADDRESS_COUNT)return{'id':'R-PR-1-01','level':'HIGH','category':'structural','title':'named_operator\x20address\x20count\x20exceeds\x20limit','description':'named_operator\x20\x22'+a['progress_namedOperator']['name']+'\x22\x20has\x20'+b+'\x20addresses,\x20'+('exceeds\x20MAX_NAMED_OPERATOR_ADDRESS_COUNT\x20'+MAX_NAMED_OPERATOR_ADDRESS_COUNT+'.\x20')+'Move\x20aborts\x20with\x20E_MAX_NAMED_OPERATOR_ADDRESS_COUNT.','affected_stakeholders':['owner','named_operator'],'scenario':'Adding\x20>\x2080\x20addresses\x20to\x20a\x20single\x20named\x20operator','mitigation':'Split\x20into\x20multiple\x20named_operator\x20names,\x20or\x20remove\x20inactive\x20addresses\x20first','evidence':'addr_count='+b};return null;}},R_PR_1_02={'id':'R-PR-1-02','category':'structural','trigger':'Adding\x20new\x20named_operator\x20would\x20exceed\x20MAX_NAMED_OPERATOR_COUNT\x20(60)','check':a=>{if(!a['progress_namedOperator']||a['progress_namedOperator']['op']!=='add')return null;const b=a['current_named_operator_count']??0x0;if(b>=MAX_NAMED_OPERATOR_COUNT)return{'id':'R-PR-1-02','level':'HIGH','category':'structural','title':'named_operator\x20namespace\x20count\x20at\x20limit','description':'Progress\x20already\x20has\x20'+b+'\x20named\x20operators,\x20'+('at\x20MAX_NAMED_OPERATOR_COUNT\x20'+MAX_NAMED_OPERATOR_COUNT+'.\x20Adding\x20a\x20new\x20name\x20will\x20abort\x20with\x20E_MAX_NAMED_OPERATOR_COUNT.'),'affected_stakeholders':['owner'],'scenario':'Adding\x20a\x2061st\x20named_operator\x20name\x20to\x20a\x20full\x20Progress','mitigation':'Use\x20\x27set\x27\x20on\x20an\x20existing\x20name\x20(replace\x20address\x20list),\x20or\x20remove\x20an\x20unused\x20name\x20first','evidence':'named_operator_count='+b};return null;}},R_PR_1_03={'id':'R-PR-1-03','category':'structural','trigger':'context_repository\x20add\x20would\x20exceed\x20MAX_CONTEXT_REPOSITORY_COUNT\x20(30)','check':a=>{if(!a['repository'])return null;if(a['repository']['op']==='clear')return null;const b=a['repository']['op']==='remove'?0x0:a['repository']['objects']['length'];if(b===0x0)return null;const c=a['current_context_repository_count']??0x0;if(c+b>MAX_CONTEXT_REPOSITORY_COUNT)return{'id':'R-PR-1-03','level':'HIGH','category':'structural','title':'context_repository\x20count\x20exceeds\x20limit','description':'Progress\x20has\x20'+c+'\x20repositories,\x20adding\x20'+b+'\x20would\x20total\x20'+(c+b)+',\x20'+('exceeds\x20MAX_CONTEXT_REPOSITORY_COUNT\x20'+MAX_CONTEXT_REPOSITORY_COUNT+'.\x20Move\x20aborts\x20with\x20E_MAX_CONTEXT_REPOSITORY_COUNT.'),'affected_stakeholders':['owner'],'scenario':'Adding\x20too\x20many\x20context\x20repositories','mitigation':'Remove\x20unused\x20repositories\x20first,\x20or\x20use\x20repository\x20\x27set\x27\x20to\x20replace\x20the\x20list','evidence':'current='+c+',\x20add='+b};return null;}},R_PR_1_04={'id':'R-PR-1-04','category':'structural','trigger':'named_operator\x20name\x20is\x20empty\x20string\x20but\x20is_order_holder_namespace=false','check':a=>{if(!a['progress_namedOperator'])return null;if(a['progress_namedOperator']['name']===''&&a['progress_namedOperator']['op']!=='remove')return{'id':'R-PR-1-04','level':'MEDIUM','category':'structural','title':'named_operator\x20name\x20is\x20empty\x20(OrderHolder\x20namespace)','description':'progress_namedOperator.name=\x22\x22\x20—\x20empty\x20string\x20maps\x20to\x20the\x20OrderHolder\x20namespace\x20'+'(machine::init_node_name()).\x20This\x20is\x20typically\x20set\x20by\x20service::buy,\x20not\x20by\x20direct\x20user\x20op.\x20'+'Manual\x20manipulation\x20may\x20overwrite\x20order-payer\x20authorization.','affected_stakeholders':['owner','named_operator'],'scenario':'User\x20manually\x20setting\x20the\x20empty-name\x20namespace','mitigation':'If\x20intentional\x20(e.g.\x20order_owner_set\x20internal\x20call),\x20confirm.\x20Otherwise\x20use\x20a\x20non-empty\x20name.','evidence':'name=\x22\x22'};return null;}},R_PR_2_01={'id':'R-PR-2-01','category':'semantic','trigger':'task_set\x20on\x20Progress\x20that\x20already\x20has\x20a\x20task\x20(E_TASK_ALREADY_SET)','check':a=>{if(!a['task'])return null;if(a['current_task']!==null&&a['current_task']!==undefined)return{'id':'R-PR-2-01','level':'HIGH','category':'semantic','title':'task_set\x20on\x20already-bound\x20Progress\x20(irreversible)','description':'Progress\x20already\x20has\x20task='+a['current_task']+'.\x20task_set\x20is\x20one-time;\x20'+'Move\x20aborts\x20with\x20E_TASK_ALREADY_SET.\x20There\x20is\x20no\x20way\x20to\x20change\x20the\x20task\x20after\x20first\x20set.','affected_stakeholders':['owner','submitter'],'scenario':'User\x20tries\x20to\x20rebind\x20Progress\x20to\x20a\x20different\x20Order','mitigation':'Create\x20a\x20new\x20Progress\x20via\x20service::buy\x20with\x20the\x20new\x20Order;\x20the\x20old\x20Progress\x20is\x20permanently\x20bound','evidence':'current_task='+a['current_task']};return null;}},R_PR_2_02={'id':'R-PR-2-02','category':'semantic','trigger':'operate.message\x20exceeds\x20MAX_LONG_NAME_LENGTH\x20(long-name\x20constraint)','check':a=>{if(!a['operate']?.['message'])return null;const b=a['operate']['message'];if(b['length']>0x400)return{'id':'R-PR-2-02','level':'MEDIUM','category':'semantic','title':'operate.message\x20exceeds\x20long-name\x20length','description':'operate.message\x20length\x20'+b['length']+'\x20exceeds\x20MAX_LONG_NAME_LENGTH\x20(1024).\x20'+'Move\x20aborts\x20in\x20common::LONG_NAME\x20check.','affected_stakeholders':['submitter'],'scenario':'Long\x20deliverable\x20message','mitigation':'Truncate\x20message\x20to\x20≤\x201024\x20chars;\x20store\x20full\x20payload\x20in\x20a\x20context\x20Repository','evidence':'msg_len='+b['length']};return null;}},R_PR_2_03={'id':'R-PR-2-03','category':'semantic','trigger':'operate.op\x20is\x20not\x20a\x20valid\x20enum\x20value\x20(schema-enforced,\x20defense-in-depth)','check':a=>{if(!a['operate'])return null;const b=['next','hold','unhold','adminUnhold'];if(a['operate']['op']&&!b['includes'](a['operate']['op']))return{'id':'R-PR-2-03','level':'HIGH','category':'semantic','title':'operate.op\x20must\x20be\x20one\x20of:\x20'+b['join'](',\x20'),'description':'op\x20enum\x20selects\x20the\x20Move\x20function:\x20next=accomplish,\x20hold=hold(bHold=true),\x20'+'unhold=hold(bHold=false),\x20adminUnhold=unhold\x20(224\x20permission).','affected_stakeholders':['submitter'],'scenario':'Schema\x20validation\x20bypassed\x20or\x20stale\x20client','mitigation':'Use\x20one\x20of:\x20'+b['join'](',\x20'),'evidence':'op='+a['operate']['op']};return null;}},R_PR_3_01={'id':'R-PR-3-01','category':'permission','trigger':'op=\x27adminUnhold\x27\x20(224\x20permission)\x20—\x20force\x20release\x20bypassing\x20holder\x20check','check':a=>{if(a['operate']?.['op']!=='adminUnhold')return null;return{'id':'R-PR-3-01','level':'HIGH','category':'permission','title':'adminUnhold\x20bypasses\x20holder\x20check\x20(broad\x20blast\x20radius)','description':'adminUnhold\x20uses\x20224\x20permission\x20to\x20release\x20a\x20held\x20forward\x20WITHOUT\x20verifying\x20sender\x20==\x20holder.\x20'+'If\x20224\x20is\x20granted\x20too\x20broadly,\x20any\x20224-holder\x20can\x20release\x20ANY\x20held\x20forward\x20in\x20this\x20Progress.','affected_stakeholders':['owner','named_operator','submitter'],'scenario':'Admin\x20force-releases\x20a\x20forward\x20that\x20the\x20original\x20holder\x20still\x20wanted\x20held','mitigation':'1)\x20Grant\x20224\x20only\x20to\x20dedicated\x20recovery\x20addresses.\x202)\x20Log\x20every\x20adminUnhold\x20for\x20audit.\x20'+'3)\x20Prefer\x20normal\x20unhold\x20(holder\x20self-release)\x20when\x20possible.','evidence':'adminUnhold=true,\x20forward='+a['operate']['operation']['forward']};}},R_PR_3_02={'id':'R-PR-3-02','category':'permission','trigger':'namedOperator\x20short-circuit\x20bypasses\x20220-225\x20permission\x20check','check':a=>{if(!a['operate'])return null;if(a['forward_named_operator']&&a['forward_named_operator']!=='')return{'id':'R-PR-3-02','level':'MEDIUM','category':'permission','title':'Forward\x20advance\x20via\x20named_operator\x20short-circuits\x20220-225\x20check','description':'Forward\x20\x22'+a['operate']['operation']['forward']+'\x22\x20uses\x20namedOperator=\x22'+a['forward_named_operator']+'\x22.\x20'+'Move\x27s\x20ASSERT_PERMISSION\x20returns\x20immediately\x20if\x20IsNamedOperator()\x20succeeds,\x20WITHOUT\x20checking\x20'+'any\x20permission\x20index.\x20Anyone\x20in\x20the\x20named_operator\x20list\x20can\x20advance\x20this\x20forward.','affected_stakeholders':['owner','named_operator'],'scenario':'Operator\x20list\x20too\x20permissive\x20(e.g.\x20includes\x20expired/compromised\x20addresses)','mitigation':'1)\x20Keep\x20named_operator\x20lists\x20minimal.\x202)\x20Use\x20namedOperator_remove\x20to\x20revoke\x20access\x20promptly.\x20'+'3)\x20For\x20sensitive\x20forwards,\x20prefer\x20Forward.permissionIndex\x20(Some)\x20for\x20dual-check.','evidence':'named_operator='+a['forward_named_operator']};return null;}},R_PR_3_03={'id':'R-PR-3-03','category':'permission','trigger':'Forward\x20has\x20guard\x20(Some)\x20—\x20Passport\x20required\x20but\x20not\x20provided','check':a=>{if(!a['operate'])return null;if(a['forward_has_guard']&&!a['forward_permission_index'])return{'id':'R-PR-3-03','level':'HIGH','category':'permission','title':'Forward\x20guard\x20requires\x20Passport','description':'Forward\x20\x22'+a['operate']['operation']['forward']+'\x22\x20has\x20a\x20guard\x20(Some).\x20'+'Move\x27s\x20next_imp\x20asserts\x20E_NEED_PASSPORT\x20for\x20guarded\x20forwards\x20when\x20called\x20without\x20passport.\x20'+'Use\x20next_with_passport\x20/\x20order_next_with_passport\x20instead.','affected_stakeholders':['submitter'],'scenario':'User\x20calls\x20next()\x20on\x20a\x20guarded\x20forward\x20without\x20passport','mitigation':'Submit\x20via\x20*_with_passport\x20variant;\x20ensure\x20submission\x20data\x20is\x20valid\x20for\x20the\x20Guard','evidence':'forward='+a['operate']['operation']['forward']+',\x20has_guard='+a['forward_has_guard']};return null;}},R_PR_4_01={'id':'R-PR-4-01','category':'lifecycle','trigger':'Machine\x20not\x20published\x20—\x20Progress\x20cannot\x20be\x20created','check':a=>{if(a['machine_published']===![])return{'id':'R-PR-4-01','level':'CRITICAL','category':'lifecycle','title':'Machine\x20not\x20published\x20—\x20Progress\x20creation\x20blocked','description':'Machine\x20'+(a['current_machine']??'(unknown)')+'\x20is\x20not\x20published.\x20'+'Progress\x20requires\x20a\x20published\x20Machine\x20(machine::on_progress_new\x20asserts\x20published\x20state).\x20'+'All\x20Progress\x20ops\x20will\x20fail\x20with\x20E_MACHINE_NOT_MATCH\x20or\x20similar.','affected_stakeholders':['owner'],'scenario':'User\x20attempts\x20to\x20create\x20Progress\x20before\x20Machine\x20publish','mitigation':'Publish\x20the\x20Machine\x20first\x20(machine::publish,\x20205\x20permission),\x20then\x20create\x20Progress','evidence':'machine='+a['current_machine']+',\x20published=false'};return null;}},R_PR_4_02={'id':'R-PR-4-02','category':'lifecycle','trigger':'operate\x20on\x20already-accomplished\x20forward\x20(E_FORWARD_ALREADY_ACCOMPLISHED)','check':a=>{if(!a['operate'])return null;if(a['forward_already_accomplished'])return{'id':'R-PR-4-02','level':'MEDIUM','category':'lifecycle','title':'Forward\x20already\x20accomplished\x20—\x20re-hold\x20blocked','description':'Forward\x20\x22'+a['operate']['operation']['forward']+'\x22\x20to\x20\x22'+a['operate']['operation']['next_node_name']+'\x22\x20'+'is\x20already\x20accomplished.\x20Move\x20aborts\x20with\x20E_FORWARD_ALREADY_ACCOMPLISHED\x20on\x20any\x20re-hold\x20attempt.','affected_stakeholders':['submitter'],'scenario':'User\x20retries\x20an\x20already-completed\x20forward\x20(race\x20condition\x20or\x20stale\x20state)','mitigation':'Query\x20Progress.current\x20—\x20if\x20already\x20past\x20target,\x20no\x20action\x20needed;\x20if\x20parallel\x20session,\x20use\x20a\x20different\x20forward','evidence':'forward='+a['operate']['operation']['forward']+',\x20accomplished=true'};return null;}},R_PR_4_03={'id':'R-PR-4-03','category':'lifecycle','trigger':'unhold\x20by\x20non-holder\x20without\x20224\x20permission\x20(E_NOT_THE_HOLDER)','check':a=>{if(!a['operate']||a['operate']['op']!=='unhold')return null;if(a['holder_address']&&a['signer']&&a['holder_address']!==a['signer'])return{'id':'R-PR-4-03','level':'HIGH','category':'lifecycle','title':'unhold\x20by\x20non-holder\x20—\x20Move\x20will\x20abort\x20E_NOT_THE_HOLDER','description':'Forward\x20is\x20held\x20by\x20'+a['holder_address']+',\x20but\x20signer\x20is\x20'+a['signer']+'.\x20'+'Move\x20aborts\x20with\x20E_NOT_THE_HOLDER\x20unless\x20signer\x20has\x20224\x20permission\x20(adminUnhold\x20path).','affected_stakeholders':['submitter'],'scenario':'User\x20other\x20than\x20holder\x20tries\x20to\x20release\x20a\x20hold','mitigation':'1)\x20Have\x20the\x20original\x20holder\x20call\x20unhold.\x202)\x20If\x20holder\x20is\x20unresponsive,\x20use\x20adminUnhold=true\x20(requires\x20224).','evidence':'holder='+a['holder_address']+',\x20signer='+a['signer']};return null;}},R_PR_5_01={'id':'R-PR-5-01','category':'cross_object','trigger':'operate.order_next\x20called\x20but\x20progress.task\x20!=\x20order\x20address\x20(E_ORDER_NOT_MATCH)','check':a=>{if(!a['operate'])return null;if(a['current_task']&&a['signer'])return null;return null;}},R_PR_5_02={'id':'R-PR-5-02','category':'cross_object','trigger':'context_repository_add\x20without\x20object-linker\x20tx\x20binding\x20check','check':a=>{if(!a['repository']||a['repository']['op']!=='add')return null;return{'id':'R-PR-5-02','level':'LOW','category':'cross_object','title':'context_repository_add\x20creates\x20object-linker\x20tx\x20binding','description':'Adding\x20'+a['repository']['objects']['length']+'\x20repository(ies)\x20creates\x20object-linker\x20tx\x20binding\x20'+'entries.\x20If\x20the\x20Repository\x20is\x20later\x20removed\x20(object_linker::disaffiliation_tx),\x20cross-object\x20queries\x20'+'that\x20depend\x20on\x20it\x20will\x20return\x20empty\x20results\x20without\x20warning.','affected_stakeholders':['owner','system'],'scenario':'Repository\x20deleted\x20while\x20Progress\x20still\x20references\x20it','mitigation':'Use\x20context_repository_remove\x20before\x20deleting\x20a\x20Repository;\x20audit\x20object-linker\x20bindings\x20periodically','evidence':'add_count='+a['repository']['objects']['length']};}},R_PR_5_03={'id':'R-PR-5-03','category':'cross_object','trigger':'Permission\x20used\x20by\x20Progress\x20is\x20shared\x20with\x20other\x20host\x20objects','check':a=>{if(!a['target_objects_types']||a['target_objects_types']['length']<0x2)return null;const b=new Set(a['target_objects_types']);if(b['size']>0x1)return{'id':'R-PR-5-03','level':'MEDIUM','category':'cross_object','title':'Permission\x20shared\x20across\x20heterogeneous\x20host\x20objects','description':'Single\x20Permission\x20applied\x20to\x20'+[...b]['join'](',\x20')+'.\x20'+'Progress\x20builtin\x20indexes\x20(220-225)\x20have\x20different\x20semantics\x20per\x20host\x20object;\x20'+'granting\x20221\x20(PROGRESS_NAMED_OPERATOR)\x20to\x20a\x20non-Progress\x20entity\x20is\x20meaningless.','affected_stakeholders':['owner'],'scenario':'One\x20Permission\x20for\x20both\x20Progress\x20and\x20Machine','mitigation':'Use\x20separate\x20Permission\x20objects\x20per\x20host\x20object\x20type','evidence':'types='+[...b]['join'](',')};return null;}},R_PR_5_04={'id':'R-PR-5-04','category':'cross_object','trigger':'Progress\x20without\x20bound\x20Order\x20(order=null)\x20—\x20order_next/order_hold\x20blocked','check':a=>{if(!a['operate'])return null;if(a['current_task']===null&&a['operate']['op']!==undefined)return{'id':'R-PR-5-04','level':'MEDIUM','category':'cross_object','title':'operate\x20without\x20bound\x20Order\x20—\x20order_next/order_hold\x20unavailable','description':'Progress\x20has\x20no\x20bound\x20task\x20(task=null).\x20order_next\x20and\x20order_hold\x20require\x20'+'progress.task\x20==\x20order\x20address\x20(E_ORDER_NOT_MATCH).\x20Use\x20plain\x20next()/hold()\x20instead.','affected_stakeholders':['submitter'],'scenario':'User\x20tries\x20order\x20variant\x20on\x20a\x20task-less\x20Progress','mitigation':'Use\x20non-order\x20next()/hold()\x20variant,\x20OR\x20call\x20task_set\x20first\x20to\x20bind\x20an\x20Order','evidence':'task=null'};return null;}},ALL_RULES=[R_PR_1_01,R_PR_1_02,R_PR_1_03,R_PR_1_04,R_PR_2_01,R_PR_2_02,R_PR_2_03,R_PR_3_01,R_PR_3_02,R_PR_3_03,R_PR_4_01,R_PR_4_02,R_PR_4_03,R_PR_5_01,R_PR_5_02,R_PR_5_03,R_PR_5_04];export const PROGRESS_RISK_VERSION='1.0.0';export function getAllProgressRiskRules(){return[...ALL_RULES];}export function getProgressRiskRulesCount(){return ALL_RULES['length'];}export function getProgressRiskRulesByCategory(a){return ALL_RULES['filter'](b=>b['category']===a);}export function assessProgressRisks(a){const b=[];for(const f of ALL_RULES){const g=f['check'](a);if(g)b['push'](g);}const c=b['length']===0x0?'LOW':b['some'](h=>h['level']==='CRITICAL')?'CRITICAL':b['some'](h=>h['level']==='HIGH')?'HIGH':b['some'](h=>h['level']==='MEDIUM')?'MEDIUM':'LOW',d={};for(const h of b){d[h['category']]=(d[h['category']]??0x0)+0x1;}const e={};for(const i of b){for(const j of i['affected_stakeholders']){if(!e[j])e[j]=[];e[j]['push'](i['id']+':\x20'+i['mitigation']);}}return{'summary':'Assessed\x20'+b['length']+'\x20risk(s)\x20across\x20'+Object['keys'](d)['length']+'\x20categories','risks':b,'overall_risk':c,'risks_by_category':d,'stakeholder_advice':e,'needs_human_review':b['some'](k=>k['level']==='CRITICAL'||k['level']==='HIGH')};}
+import{MAX_NAMED_OPERATOR_COUNT,MAX_NAMED_OPERATOR_ADDRESS_COUNT,MAX_CONTEXT_REPOSITORY_COUNT}from'@wowok/wowok';const R_PR_1_01={'id':'R-PR-1-01','category':'structural','trigger':'named_operator\x20addresses\x20count\x20>\x20MAX_NAMED_OPERATOR_ADDRESS_COUNT\x20(80)','check':a=>{if(!a['progress_namedOperator'])return null;const b=a['progress_namedOperator']['operators']['length'];if(b>MAX_NAMED_OPERATOR_ADDRESS_COUNT)return{'id':'R-PR-1-01','level':'HIGH','category':'structural','title':'named_operator\x20address\x20count\x20exceeds\x20limit','description':'named_operator\x20\x22'+a['progress_namedOperator']['name']+'\x22\x20has\x20'+b+'\x20addresses,\x20'+('exceeds\x20MAX_NAMED_OPERATOR_ADDRESS_COUNT\x20'+MAX_NAMED_OPERATOR_ADDRESS_COUNT+'.\x20')+'Move\x20aborts\x20with\x20E_MAX_NAMED_OPERATOR_ADDRESS_COUNT.','affected_stakeholders':['owner','named_operator'],'scenario':'Adding\x20>\x2080\x20addresses\x20to\x20a\x20single\x20named\x20operator','mitigation':'Split\x20into\x20multiple\x20named_operator\x20names,\x20or\x20remove\x20inactive\x20addresses\x20first','evidence':'addr_count='+b};return null;}},R_PR_1_02={'id':'R-PR-1-02','category':'structural','trigger':'Adding\x20new\x20named_operator\x20would\x20exceed\x20MAX_NAMED_OPERATOR_COUNT\x20(60)','check':a=>{if(!a['progress_namedOperator']||a['progress_namedOperator']['op']!=='add')return null;const b=a['current_named_operator_count']??0x0;if(b>=MAX_NAMED_OPERATOR_COUNT)return{'id':'R-PR-1-02','level':'HIGH','category':'structural','title':'named_operator\x20namespace\x20count\x20at\x20limit','description':'Progress\x20already\x20has\x20'+b+'\x20named\x20operators,\x20'+('at\x20MAX_NAMED_OPERATOR_COUNT\x20'+MAX_NAMED_OPERATOR_COUNT+'.\x20Adding\x20a\x20new\x20name\x20will\x20abort\x20with\x20E_MAX_NAMED_OPERATOR_COUNT.'),'affected_stakeholders':['owner'],'scenario':'Adding\x20a\x2061st\x20named_operator\x20name\x20to\x20a\x20full\x20Progress','mitigation':'Use\x20\x27set\x27\x20on\x20an\x20existing\x20name\x20(replace\x20address\x20list),\x20or\x20remove\x20an\x20unused\x20name\x20first','evidence':'named_operator_count='+b};return null;}},R_PR_1_03={'id':'R-PR-1-03','category':'structural','trigger':'context_repository\x20add\x20would\x20exceed\x20MAX_CONTEXT_REPOSITORY_COUNT\x20(30)','check':a=>{if(!a['repository'])return null;if(a['repository']['op']==='clear')return null;const b=a['repository']['op']==='remove'?0x0:a['repository']['objects']['length'];if(b===0x0)return null;const c=a['current_context_repository_count']??0x0;if(c+b>MAX_CONTEXT_REPOSITORY_COUNT)return{'id':'R-PR-1-03','level':'HIGH','category':'structural','title':'context_repository\x20count\x20exceeds\x20limit','description':'Progress\x20has\x20'+c+'\x20repositories,\x20adding\x20'+b+'\x20would\x20total\x20'+(c+b)+',\x20'+('exceeds\x20MAX_CONTEXT_REPOSITORY_COUNT\x20'+MAX_CONTEXT_REPOSITORY_COUNT+'.\x20Move\x20aborts\x20with\x20E_MAX_CONTEXT_REPOSITORY_COUNT.'),'affected_stakeholders':['owner'],'scenario':'Adding\x20too\x20many\x20context\x20repositories','mitigation':'Remove\x20unused\x20repositories\x20first,\x20or\x20use\x20repository\x20\x27set\x27\x20to\x20replace\x20the\x20list','evidence':'current='+c+',\x20add='+b};return null;}},R_PR_1_04={'id':'R-PR-1-04','category':'structural','trigger':'named_operator\x20name\x20is\x20empty\x20string\x20but\x20is_order_holder_namespace=false','check':a=>{if(!a['progress_namedOperator'])return null;if(a['progress_namedOperator']['name']===''&&a['progress_namedOperator']['op']!=='remove')return{'id':'R-PR-1-04','level':'MEDIUM','category':'structural','title':'named_operator\x20name\x20is\x20empty\x20(OrderHolder\x20namespace)','description':'progress_namedOperator.name=\x22\x22\x20—\x20empty\x20string\x20maps\x20to\x20the\x20OrderHolder\x20namespace\x20'+'(machine::init_node_name()).\x20This\x20is\x20typically\x20set\x20by\x20service::buy,\x20not\x20by\x20direct\x20user\x20op.\x20'+'Manual\x20manipulation\x20may\x20overwrite\x20order-payer\x20authorization.','affected_stakeholders':['owner','named_operator'],'scenario':'User\x20manually\x20setting\x20the\x20empty-name\x20namespace','mitigation':'If\x20intentional\x20(e.g.\x20order_owner_set\x20internal\x20call),\x20confirm.\x20Otherwise\x20use\x20a\x20non-empty\x20name.','evidence':'name=\x22\x22'};return null;}},R_PR_2_01={'id':'R-PR-2-01','category':'semantic','trigger':'task_set\x20on\x20Progress\x20that\x20already\x20has\x20a\x20task\x20(E_TASK_ALREADY_SET)','check':a=>{if(!a['task'])return null;if(a['current_task']!==null&&a['current_task']!==undefined)return{'id':'R-PR-2-01','level':'HIGH','category':'semantic','title':'task_set\x20on\x20already-bound\x20Progress\x20(irreversible)','description':'Progress\x20already\x20has\x20task='+a['current_task']+'.\x20task_set\x20is\x20one-time;\x20'+'Move\x20aborts\x20with\x20E_TASK_ALREADY_SET.\x20There\x20is\x20no\x20way\x20to\x20change\x20the\x20task\x20after\x20first\x20set.','affected_stakeholders':['owner','submitter'],'scenario':'User\x20tries\x20to\x20rebind\x20Progress\x20to\x20a\x20different\x20Order','mitigation':'Create\x20a\x20new\x20Progress\x20via\x20service::buy\x20with\x20the\x20new\x20Order;\x20the\x20old\x20Progress\x20is\x20permanently\x20bound','evidence':'current_task='+a['current_task']};return null;}},R_PR_2_02={'id':'R-PR-2-02','category':'semantic','trigger':'operate.message\x20exceeds\x20MAX_LONG_NAME_LENGTH\x20(long-name\x20constraint)','check':a=>{if(!a['operate']?.['message'])return null;const b=a['operate']['message'];if(b['length']>0x400)return{'id':'R-PR-2-02','level':'MEDIUM','category':'semantic','title':'operate.message\x20exceeds\x20long-name\x20length','description':'operate.message\x20length\x20'+b['length']+'\x20exceeds\x20MAX_LONG_NAME_LENGTH\x20(1024).\x20'+'Move\x20aborts\x20in\x20common::LONG_NAME\x20check.','affected_stakeholders':['submitter'],'scenario':'Long\x20deliverable\x20message','mitigation':'Truncate\x20message\x20to\x20≤\x201024\x20chars;\x20store\x20full\x20payload\x20in\x20a\x20context\x20Repository','evidence':'msg_len='+b['length']};return null;}},R_PR_2_03={'id':'R-PR-2-03','category':'semantic','trigger':'operate.op\x20is\x20not\x20a\x20valid\x20enum\x20value\x20(schema-enforced,\x20defense-in-depth)','check':a=>{if(!a['operate'])return null;const b=['next','hold','unhold','adminUnhold'];if(a['operate']['op']&&!b['includes'](a['operate']['op']))return{'id':'R-PR-2-03','level':'HIGH','category':'semantic','title':'operate.op\x20must\x20be\x20one\x20of:\x20'+b['join'](',\x20'),'description':'op\x20enum\x20selects\x20the\x20Move\x20function:\x20next=accomplish,\x20hold=hold(bHold=true),\x20'+'unhold=hold(bHold=false),\x20adminUnhold=unhold\x20(224\x20permission).','affected_stakeholders':['submitter'],'scenario':'Schema\x20validation\x20bypassed\x20or\x20stale\x20client','mitigation':'Use\x20one\x20of:\x20'+b['join'](',\x20'),'evidence':'op='+a['operate']['op']};return null;}},R_PR_3_01={'id':'R-PR-3-01','category':'permission','trigger':'op=\x27adminUnhold\x27\x20(224\x20permission)\x20—\x20force\x20release\x20bypassing\x20holder\x20check','check':a=>{if(a['operate']?.['op']!=='adminUnhold')return null;return{'id':'R-PR-3-01','level':'HIGH','category':'permission','title':'adminUnhold\x20bypasses\x20holder\x20check\x20(broad\x20blast\x20radius)','description':'adminUnhold\x20uses\x20224\x20permission\x20to\x20release\x20a\x20held\x20forward\x20WITHOUT\x20verifying\x20sender\x20==\x20holder.\x20'+'If\x20224\x20is\x20granted\x20too\x20broadly,\x20any\x20224-holder\x20can\x20release\x20ANY\x20held\x20forward\x20in\x20this\x20Progress.','affected_stakeholders':['owner','named_operator','submitter'],'scenario':'Admin\x20force-releases\x20a\x20forward\x20that\x20the\x20original\x20holder\x20still\x20wanted\x20held','mitigation':'1)\x20Grant\x20224\x20only\x20to\x20dedicated\x20recovery\x20addresses.\x202)\x20Log\x20every\x20adminUnhold\x20for\x20audit.\x20'+'3)\x20Prefer\x20normal\x20unhold\x20(holder\x20self-release)\x20when\x20possible.','evidence':'adminUnhold=true,\x20forward='+a['operate']['operation']['forward']};}},R_PR_3_02={'id':'R-PR-3-02','category':'permission','trigger':'namedOperator\x20short-circuit\x20bypasses\x20220-225\x20permission\x20check','check':a=>{if(!a['operate'])return null;if(a['forward_named_operator']&&a['forward_named_operator']!=='')return{'id':'R-PR-3-02','level':'MEDIUM','category':'permission','title':'Forward\x20advance\x20via\x20named_operator\x20short-circuits\x20220-225\x20check','description':'Forward\x20\x22'+a['operate']['operation']['forward']+'\x22\x20uses\x20namedOperator=\x22'+a['forward_named_operator']+'\x22.\x20'+'Move\x27s\x20ASSERT_PERMISSION\x20returns\x20immediately\x20if\x20IsNamedOperator()\x20succeeds,\x20WITHOUT\x20checking\x20'+'any\x20permission\x20index.\x20Anyone\x20in\x20the\x20named_operator\x20list\x20can\x20advance\x20this\x20forward.','affected_stakeholders':['owner','named_operator'],'scenario':'Operator\x20list\x20too\x20permissive\x20(e.g.\x20includes\x20expired/compromised\x20addresses)','mitigation':'1)\x20Keep\x20named_operator\x20lists\x20minimal.\x202)\x20Use\x20namedOperator_remove\x20to\x20revoke\x20access\x20promptly.\x20'+'3)\x20For\x20sensitive\x20forwards,\x20prefer\x20Forward.permissionIndex\x20(Some)\x20for\x20dual-check.','evidence':'named_operator='+a['forward_named_operator']};return null;}},R_PR_3_03={'id':'R-PR-3-03','category':'permission','trigger':'Forward\x20has\x20guard\x20(Some)\x20—\x20Passport\x20required\x20but\x20not\x20provided','check':a=>{if(!a['operate'])return null;if(a['forward_has_guard']&&!a['forward_permission_index'])return{'id':'R-PR-3-03','level':'HIGH','category':'permission','title':'Forward\x20guard\x20requires\x20Passport','description':'Forward\x20\x22'+a['operate']['operation']['forward']+'\x22\x20has\x20a\x20guard\x20(Some).\x20'+'Move\x27s\x20next_imp\x20asserts\x20E_NEED_PASSPORT\x20for\x20guarded\x20forwards\x20when\x20called\x20without\x20passport.\x20'+'Use\x20next_with_passport\x20/\x20order_next_with_passport\x20instead.','affected_stakeholders':['submitter'],'scenario':'User\x20calls\x20next()\x20on\x20a\x20guarded\x20forward\x20without\x20passport','mitigation':'Submit\x20via\x20*_with_passport\x20variant;\x20ensure\x20submission\x20data\x20is\x20valid\x20for\x20the\x20Guard','evidence':'forward='+a['operate']['operation']['forward']+',\x20has_guard='+a['forward_has_guard']};return null;}},R_PR_4_01={'id':'R-PR-4-01','category':'lifecycle','trigger':'Machine\x20not\x20published\x20—\x20Progress\x20cannot\x20be\x20created','check':a=>{if(a['machine_published']===![])return{'id':'R-PR-4-01','level':'CRITICAL','category':'lifecycle','title':'Machine\x20not\x20published\x20—\x20Progress\x20creation\x20blocked','description':'Machine\x20'+(a['current_machine']??'(unknown)')+'\x20is\x20not\x20published.\x20'+'Progress\x20requires\x20a\x20published\x20Machine\x20(machine::on_progress_new\x20asserts\x20published\x20state).\x20'+'All\x20Progress\x20ops\x20will\x20fail\x20with\x20E_MACHINE_NOT_MATCH\x20or\x20similar.','affected_stakeholders':['owner'],'scenario':'User\x20attempts\x20to\x20create\x20Progress\x20before\x20Machine\x20publish','mitigation':'Publish\x20the\x20Machine\x20first\x20(machine::publish,\x20205\x20permission),\x20then\x20create\x20Progress','evidence':'machine='+a['current_machine']+',\x20published=false'};return null;}},R_PR_4_02={'id':'R-PR-4-02','category':'lifecycle','trigger':'operate\x20on\x20already-accomplished\x20forward\x20(E_FORWARD_ALREADY_ACCOMPLISHED)','check':a=>{if(!a['operate'])return null;if(a['forward_already_accomplished'])return{'id':'R-PR-4-02','level':'MEDIUM','category':'lifecycle','title':'Forward\x20already\x20accomplished\x20—\x20re-hold\x20blocked','description':'Forward\x20\x22'+a['operate']['operation']['forward']+'\x22\x20to\x20\x22'+a['operate']['operation']['next_node_name']+'\x22\x20'+'is\x20already\x20accomplished.\x20Move\x20aborts\x20with\x20E_FORWARD_ALREADY_ACCOMPLISHED\x20on\x20any\x20re-hold\x20attempt.','affected_stakeholders':['submitter'],'scenario':'User\x20retries\x20an\x20already-completed\x20forward\x20(race\x20condition\x20or\x20stale\x20state)','mitigation':'Query\x20Progress.current\x20—\x20if\x20already\x20past\x20target,\x20no\x20action\x20needed;\x20if\x20parallel\x20session,\x20use\x20a\x20different\x20forward','evidence':'forward='+a['operate']['operation']['forward']+',\x20accomplished=true'};return null;}},R_PR_4_03={'id':'R-PR-4-03','category':'lifecycle','trigger':'unhold\x20by\x20non-holder\x20without\x20224\x20permission\x20(E_NOT_THE_HOLDER)','check':a=>{if(!a['operate']||a['operate']['op']!=='unhold')return null;if(a['holder_address']&&a['signer']&&a['holder_address']!==a['signer'])return{'id':'R-PR-4-03','level':'HIGH','category':'lifecycle','title':'unhold\x20by\x20non-holder\x20—\x20Move\x20will\x20abort\x20E_NOT_THE_HOLDER','description':'Forward\x20is\x20held\x20by\x20'+a['holder_address']+',\x20but\x20signer\x20is\x20'+a['signer']+'.\x20'+'Move\x20aborts\x20with\x20E_NOT_THE_HOLDER\x20unless\x20signer\x20has\x20224\x20permission\x20(adminUnhold\x20path).','affected_stakeholders':['submitter'],'scenario':'User\x20other\x20than\x20holder\x20tries\x20to\x20release\x20a\x20hold','mitigation':'1)\x20Have\x20the\x20original\x20holder\x20call\x20unhold.\x202)\x20If\x20holder\x20is\x20unresponsive,\x20use\x20adminUnhold=true\x20(requires\x20224).','evidence':'holder='+a['holder_address']+',\x20signer='+a['signer']};return null;}},R_PR_5_01={'id':'R-PR-5-01','category':'cross_object','trigger':'operate.order_next\x20called\x20but\x20progress.task\x20!=\x20order\x20address\x20(E_ORDER_NOT_MATCH)','check':a=>{if(!a['operate'])return null;if(a['current_task']&&a['signer'])return null;return null;}},R_PR_5_02={'id':'R-PR-5-02','category':'cross_object','trigger':'context_repository_add\x20without\x20object-linker\x20tx\x20binding\x20check','check':a=>{if(!a['repository']||a['repository']['op']!=='add')return null;return{'id':'R-PR-5-02','level':'LOW','category':'cross_object','title':'context_repository_add\x20creates\x20object-linker\x20tx\x20binding','description':'Adding\x20'+a['repository']['objects']['length']+'\x20repository(ies)\x20creates\x20object-linker\x20tx\x20binding\x20'+'entries.\x20If\x20the\x20Repository\x20is\x20later\x20removed\x20(object_linker::disaffiliation_tx),\x20cross-object\x20queries\x20'+'that\x20depend\x20on\x20it\x20will\x20return\x20empty\x20results\x20without\x20warning.','affected_stakeholders':['owner','system'],'scenario':'Repository\x20deleted\x20while\x20Progress\x20still\x20references\x20it','mitigation':'Use\x20context_repository_remove\x20before\x20deleting\x20a\x20Repository;\x20audit\x20object-linker\x20bindings\x20periodically','evidence':'add_count='+a['repository']['objects']['length']};}},R_PR_5_03={'id':'R-PR-5-03','category':'cross_object','trigger':'Permission\x20used\x20by\x20Progress\x20is\x20shared\x20with\x20other\x20host\x20objects','check':a=>{if(!a['target_objects_types']||a['target_objects_types']['length']<0x2)return null;const b=new Set(a['target_objects_types']);if(b['size']>0x1)return{'id':'R-PR-5-03','level':'MEDIUM','category':'cross_object','title':'Permission\x20shared\x20across\x20heterogeneous\x20host\x20objects','description':'Single\x20Permission\x20applied\x20to\x20'+[...b]['join'](',\x20')+'.\x20'+'Progress\x20builtin\x20indexes\x20(220-225)\x20have\x20different\x20semantics\x20per\x20host\x20object;\x20'+'granting\x20221\x20(PROGRESS_NAMED_OPERATOR)\x20to\x20a\x20non-Progress\x20entity\x20is\x20meaningless.','affected_stakeholders':['owner'],'scenario':'One\x20Permission\x20for\x20both\x20Progress\x20and\x20Machine','mitigation':'Use\x20separate\x20Permission\x20objects\x20per\x20host\x20object\x20type','evidence':'types='+[...b]['join'](',')};return null;}},R_PR_5_04={'id':'R-PR-5-04','category':'cross_object','trigger':'Progress\x20without\x20bound\x20Order\x20(order=null)\x20—\x20order_next/order_hold\x20blocked','check':a=>{if(!a['operate'])return null;if(a['current_task']===null&&a['operate']['op']!==undefined)return{'id':'R-PR-5-04','level':'MEDIUM','category':'cross_object','title':'operate\x20without\x20bound\x20Order\x20—\x20order_next/order_hold\x20unavailable','description':'Progress\x20has\x20no\x20bound\x20task\x20(task=null).\x20order_next\x20and\x20order_hold\x20require\x20'+'progress.task\x20==\x20order\x20address\x20(E_ORDER_NOT_MATCH).\x20Use\x20plain\x20next()/hold()\x20instead.','affected_stakeholders':['submitter'],'scenario':'User\x20tries\x20order\x20variant\x20on\x20a\x20task-less\x20Progress','mitigation':'Use\x20non-order\x20next()/hold()\x20variant,\x20OR\x20call\x20task_set\x20first\x20to\x20bind\x20an\x20Order','evidence':'task=null'};return null;}},ALL_RULES=[R_PR_1_01,R_PR_1_02,R_PR_1_03,R_PR_1_04,R_PR_2_01,R_PR_2_02,R_PR_2_03,R_PR_3_01,R_PR_3_02,R_PR_3_03,R_PR_4_01,R_PR_4_02,R_PR_4_03,R_PR_5_01,R_PR_5_02,R_PR_5_03,R_PR_5_04];export const PROGRESS_RISK_VERSION='1.0.0';export function getAllProgressRiskRules(){return[...ALL_RULES];}export function assessProgressRisks(a){const b=[];for(const f of ALL_RULES){const g=f['check'](a);if(g)b['push'](g);}const c=b['length']===0x0?'LOW':b['some'](h=>h['level']==='CRITICAL')?'CRITICAL':b['some'](h=>h['level']==='HIGH')?'HIGH':b['some'](h=>h['level']==='MEDIUM')?'MEDIUM':'LOW',d={};for(const h of b){d[h['category']]=(d[h['category']]??0x0)+0x1;}const e={};for(const i of b){for(const j of i['affected_stakeholders']){if(!e[j])e[j]=[];e[j]['push'](i['id']+':\x20'+i['mitigation']);}}return{'summary':'Assessed\x20'+b['length']+'\x20risk(s)\x20across\x20'+Object['keys'](d)['length']+'\x20categories','risks':b,'overall_risk':c,'risks_by_category':d,'stakeholder_advice':e,'needs_human_review':b['some'](k=>k['level']==='CRITICAL'||k['level']==='HIGH')};}

package/dist/knowledge/proof-risk.d.ts

@@ -30,4 +30,3 @@ export declare const PROOF_RISK_RULES: {
     check: (ctx: ProofRiskCheckContext) => ProofRisk | null;
 }[];
 export declare function checkProofRisks(ctx: ProofRiskCheckContext): ProofRisk[];
-export declare function getProofRiskById(id: string): ProofRisk | undefined;