internal/guard/wasm_parse.go had duplicated logic for populating description, secrecy, and integrity on difc.LabeledResource in both resource-level and collection-level parsing paths. In a DIFC enforcement path, this duplication increases drift risk when parsing behavior changes.

• Parsing logic consolidation

  • Added fillLabeledResourceFromMap(rawData map[string]any, resource *difc.LabeledResource) to centralize description/secrecy/integrity extraction and default label initialization.

• Call-site simplification

  • Updated parseResourceResponse to delegate resource field population to the helper.
  • Updated parseCollectionLabeledData item-label parsing to reuse the same helper.

• Behavior lock-in via focused tests

  • Added TestFillLabeledResourceFromMap cases for:
    • full population (description, secrecy, integrity)
    • default empty labels when fields are missing or typed incorrectly

resource := &difc.LabeledResource{}
fillLabeledResourceFromMap(resourceData, resource)

// ...

labels := &difc.LabeledResource{}
fillLabeledResourceFromMap(labelsData, labels)