@wowok/agent-mcp 2.7.0 → 2.7.2

package/dist/knowledge/audit-rules.js

@@ -1,141 +1 @@
-export const AUDIT_RULES = [
-    {
-        id: "audit_machine_bound",
-        description: "Service should have a Machine workflow bound before publish",
-        severity: "warning",
-        check: (d, ctx) => {
-            if (!d?.publish)
-                return true;
-            return !!d?.machine;
-        },
-        message: () => "Publishing a service without a Machine workflow. Customers won't have a structured order process.",
-        recommendation: "Create a Machine (workflow template) and bind it to the service before publishing. The machine field becomes IMMUTABLE after publish.",
-    },
-    {
-        id: "audit_order_allocators",
-        description: "Service should have order_allocators for fund distribution",
-        severity: "warning",
-        check: (d) => {
-            if (!d?.publish)
-                return true;
-            return Array.isArray(d?.order_allocators) && d.order_allocators.length > 0;
-        },
-        message: () => "Publishing a service without order_allocators. Order funds cannot be auto-distributed to suppliers.",
-        recommendation: "Configure order_allocators before publishing — this field becomes IMMUTABLE after publish.",
-    },
-    {
-        id: "audit_buy_guard",
-        description: "Service should have a buy_guard for customer screening",
-        severity: "info",
-        check: (d) => !!d?.buy_guard,
-        message: () => "No buy_guard configured — anyone can purchase this service without verification.",
-        recommendation: "Consider adding a Guard to verify customer eligibility (e.g., identity, wallet balance, location).",
-    },
-    {
-        id: "audit_compensation_fund",
-        description: "Service should have a compensation_fund for trust",
-        severity: "warning",
-        check: (d) => !!d?.compensation_fund,
-        message: () => "No compensation_fund configured. Customers have no financial protection if you fail to deliver.",
-        recommendation: "Lock a compensation_fund (Treasury) to build trust. The fund deters fraud and enables arbitration claims.",
-    },
-    {
-        id: "audit_arbitrations",
-        description: "Service should have arbitration options for dispute resolution",
-        severity: "info",
-        check: (d) => Array.isArray(d?.arbitrations) && d.arbitrations.length > 0,
-        message: () => "No arbitration configured. Disputes cannot be resolved through a third party.",
-        recommendation: "Add at least one Arb object to enable on-chain dispute resolution.",
-    },
-    {
-        id: "audit_price",
-        description: "Service should have a price set",
-        severity: "error",
-        check: (d) => d?.price !== undefined && d?.price !== null,
-        message: () => "Service has no price. Customers cannot place orders without knowing the cost.",
-        recommendation: "Set the price field before publishing.",
-    },
-    {
-        id: "audit_description",
-        description: "Service should have a description",
-        severity: "warning",
-        check: (d) => typeof d?.description === "string" && d.description.length > 0,
-        message: () => "Service has no description. Customers won't understand what you're offering.",
-        recommendation: "Write a clear description of the service, including deliverables, timelines, and terms.",
-    },
-    {
-        id: "audit_named_new_name",
-        description: "Service being created should have a name",
-        severity: "warning",
-        check: (d) => !!d?.namedNew?.name || typeof d?.object === "string",
-        message: () => "Creating a service without a name makes it hard to reference and organize.",
-        recommendation: "Set namedNew.name following the convention: <projectPrefix>_<service>_<purpose>.",
-    },
-    {
-        id: "audit_dangling_deps",
-        description: "Service dependencies should be fully created",
-        severity: "error",
-        check: (d, ctx) => {
-            if (!d?.publish)
-                return true;
-            if (!ctx?.graph)
-                return true;
-            const dangling = ctx.graph?.findDanglingDependencies?.() ?? [];
-            return dangling.length === 0;
-        },
-        message: (d) => "Service references objects that are not yet created. Publishing will lock these references.",
-        recommendation: "Ensure all referenced objects (machine, allocators, guards) are created and finalized before publishing.",
-    },
-    {
-        id: "audit_type_parameter",
-        description: "Service should have a token type specified",
-        severity: "info",
-        check: (d) => !!d?.type_parameter || !!d?.namedNew?.type_parameter,
-        message: () => "No payment token type specified. Defaulting to WOW (0x2::wow::WOW).",
-        recommendation: "Explicitly set type_parameter if you want to accept non-WOW tokens (e.g., USDT, ETH).",
-    },
-];
-const RULE_INDEX = new Map(AUDIT_RULES.map((r) => [r.id, r]));
-export function auditService(data, context) {
-    const findings = [];
-    for (const rule of AUDIT_RULES) {
-        try {
-            if (!rule.check(data, context)) {
-                findings.push({
-                    rule_id: rule.id,
-                    severity: rule.severity,
-                    message: rule.message(data),
-                    recommendation: rule.recommendation,
-                });
-            }
-        }
-        catch {
-        }
-    }
-    return findings;
-}
-export function hasBlockingErrors(findings) {
-    return findings.some((f) => f.severity === "error");
-}
-export function getErrors(findings) {
-    return findings.filter((f) => f.severity === "error");
-}
-export function getWarnings(findings) {
-    return findings.filter((f) => f.severity === "warning");
-}
-export function summarizeFindings(findings) {
-    if (findings.length === 0)
-        return "All audit checks passed.";
-    const errors = getErrors(findings);
-    const warnings = getWarnings(findings);
-    const infos = findings.filter((f) => f.severity === "info");
-    const parts = [];
-    if (errors.length > 0)
-        parts.push(`${errors.length} error(s)`);
-    if (warnings.length > 0)
-        parts.push(`${warnings.length} warning(s)`);
-    if (infos.length > 0)
-        parts.push(`${infos.length} info`);
-    return `Audit: ${parts.join(", ")}. Review before publishing.`;
-}
-export const AUDIT_RULES_VERSION = 1;
+export const AUDIT_RULES=[{'id':'audit_machine_bound','description':'Service\x20should\x20have\x20a\x20Machine\x20workflow\x20bound\x20before\x20publish','severity':'warning','check':(a,b)=>{if(!a?.['publish'])return!![];return!!a?.['machine'];},'message':()=>'Publishing\x20a\x20service\x20without\x20a\x20Machine\x20workflow.\x20Customers\x20won\x27t\x20have\x20a\x20structured\x20order\x20process.','recommendation':'Create\x20a\x20Machine\x20(workflow\x20template)\x20and\x20bind\x20it\x20to\x20the\x20service\x20before\x20publishing.\x20The\x20machine\x20field\x20becomes\x20IMMUTABLE\x20after\x20publish.'},{'id':'audit_order_allocators','description':'Service\x20should\x20have\x20order_allocators\x20for\x20fund\x20distribution','severity':'warning','check':a=>{if(!a?.['publish'])return!![];return Array['isArray'](a?.['order_allocators'])&&a['order_allocators']['length']>0x0;},'message':()=>'Publishing\x20a\x20service\x20without\x20order_allocators.\x20Order\x20funds\x20cannot\x20be\x20auto-distributed\x20to\x20suppliers.','recommendation':'Configure\x20order_allocators\x20before\x20publishing\x20—\x20this\x20field\x20becomes\x20IMMUTABLE\x20after\x20publish.'},{'id':'audit_buy_guard','description':'Service\x20should\x20have\x20a\x20buy_guard\x20for\x20customer\x20screening','severity':'info','check':a=>!!a?.['buy_guard'],'message':()=>'No\x20buy_guard\x20configured\x20—\x20anyone\x20can\x20purchase\x20this\x20service\x20without\x20verification.','recommendation':'Consider\x20adding\x20a\x20Guard\x20to\x20verify\x20customer\x20eligibility\x20(e.g.,\x20identity,\x20wallet\x20balance,\x20location).'},{'id':'audit_compensation_fund','description':'Service\x20should\x20have\x20a\x20compensation_fund\x20for\x20trust','severity':'warning','check':a=>!!a?.['compensation_fund'],'message':()=>'No\x20compensation_fund\x20configured.\x20Customers\x20have\x20no\x20financial\x20protection\x20if\x20you\x20fail\x20to\x20deliver.','recommendation':'Lock\x20a\x20compensation_fund\x20(Treasury)\x20to\x20build\x20trust.\x20The\x20fund\x20deters\x20fraud\x20and\x20enables\x20arbitration\x20claims.'},{'id':'audit_arbitrations','description':'Service\x20should\x20have\x20arbitration\x20options\x20for\x20dispute\x20resolution','severity':'info','check':a=>Array['isArray'](a?.['arbitrations'])&&a['arbitrations']['length']>0x0,'message':()=>'No\x20arbitration\x20configured.\x20Disputes\x20cannot\x20be\x20resolved\x20through\x20a\x20third\x20party.','recommendation':'Add\x20at\x20least\x20one\x20Arb\x20object\x20to\x20enable\x20on-chain\x20dispute\x20resolution.'},{'id':'audit_price','description':'Service\x20should\x20have\x20a\x20price\x20set','severity':'error','check':a=>a?.['price']!==undefined&&a?.['price']!==null,'message':()=>'Service\x20has\x20no\x20price.\x20Customers\x20cannot\x20place\x20orders\x20without\x20knowing\x20the\x20cost.','recommendation':'Set\x20the\x20price\x20field\x20before\x20publishing.'},{'id':'audit_description','description':'Service\x20should\x20have\x20a\x20description','severity':'warning','check':a=>typeof a?.['description']==='string'&&a['description']['length']>0x0,'message':()=>'Service\x20has\x20no\x20description.\x20Customers\x20won\x27t\x20understand\x20what\x20you\x27re\x20offering.','recommendation':'Write\x20a\x20clear\x20description\x20of\x20the\x20service,\x20including\x20deliverables,\x20timelines,\x20and\x20terms.'},{'id':'audit_named_new_name','description':'Service\x20being\x20created\x20should\x20have\x20a\x20name','severity':'warning','check':a=>!!a?.['namedNew']?.['name']||typeof a?.['object']==='string','message':()=>'Creating\x20a\x20service\x20without\x20a\x20name\x20makes\x20it\x20hard\x20to\x20reference\x20and\x20organize.','recommendation':'Set\x20namedNew.name\x20following\x20the\x20convention:\x20<projectPrefix>_<service>_<purpose>.'},{'id':'audit_dangling_deps','description':'Service\x20dependencies\x20should\x20be\x20fully\x20created','severity':'error','check':(a,b)=>{if(!a?.['publish'])return!![];if(!b?.['graph'])return!![];const c=b['graph']?.['findDanglingDependencies']?.()??[];return c['length']===0x0;},'message':a=>'Service\x20references\x20objects\x20that\x20are\x20not\x20yet\x20created.\x20Publishing\x20will\x20lock\x20these\x20references.','recommendation':'Ensure\x20all\x20referenced\x20objects\x20(machine,\x20allocators,\x20guards)\x20are\x20created\x20and\x20finalized\x20before\x20publishing.'},{'id':'audit_type_parameter','description':'Service\x20should\x20have\x20a\x20token\x20type\x20specified','severity':'info','check':a=>!!a?.['type_parameter']||!!a?.['namedNew']?.['type_parameter'],'message':()=>'No\x20payment\x20token\x20type\x20specified.\x20Defaulting\x20to\x20WOW\x20(0x2::wow::WOW).','recommendation':'Explicitly\x20set\x20type_parameter\x20if\x20you\x20want\x20to\x20accept\x20non-WOW\x20tokens\x20(e.g.,\x20USDT,\x20ETH).'}];const RULE_INDEX=new Map(AUDIT_RULES['map'](a=>[a['id'],a]));export function auditService(a,b){const c=[];for(const d of AUDIT_RULES){try{!d['check'](a,b)&&c['push']({'rule_id':d['id'],'severity':d['severity'],'message':d['message'](a),'recommendation':d['recommendation']});}catch{}}return c;}export function hasBlockingErrors(a){return a['some'](b=>b['severity']==='error');}export function getErrors(a){return a['filter'](b=>b['severity']==='error');}export function getWarnings(a){return a['filter'](b=>b['severity']==='warning');}export function summarizeFindings(a){if(a['length']===0x0)return'All\x20audit\x20checks\x20passed.';const b=getErrors(a),c=getWarnings(a),d=a['filter'](g=>g['severity']==='info'),e=[];if(b['length']>0x0)e['push'](b['length']+'\x20error(s)');if(c['length']>0x0)e['push'](c['length']+'\x20warning(s)');if(d['length']>0x0)e['push'](d['length']+'\x20info');return'Audit:\x20'+e['join'](',\x20')+'.\x20Review\x20before\x20publishing.';}export const AUDIT_RULES_VERSION=0x1;

package/dist/knowledge/bridge-risk.js

@@ -1,263 +1 @@
-import { BRIDGE_MESSAGE_VERSION, BRIDGE_EVM_ADDRESS_LENGTH, BRIDGE_CURRENT_VERSION, } from "@wowok/wowok";
-const SUPPORTED_TOKENS = ["ETH", "WETH", "WBTC", "USDC", "USDT"];
-const MAX_IDEMPOTENCY_KEY_LENGTH = 128;
-const BRIDGE_ERROR_CODE_COUNT = 20;
-const R_B_01 = {
-    rule: {
-        id: "R-BRIDGE-01",
-        level: "CRITICAL",
-        category: "permission",
-        title: "Cross-chain asset security — committee signature verification is the single trust root",
-        description: "Bridge committee signatures are the only thing preventing forged cross-chain messages " +
-            "from minting tokens out of thin air (bridge.move:60). If a committee key is " +
-            "compromised, or if the verification logic has a bug, an attacker can claim arbitrary " +
-            "amounts of ETH/WETH/WBTC/USDC/USDT. The TransferLimiter caps single-transfer amounts " +
-            "but does not prevent repeated small attacks.",
-        affected_stakeholders: ["user", "committee", "system"],
-        scenario: "Committee private key leaks; attacker forges an approved transfer and claims funds",
-        mitigation: "Committee members MUST use HSM-backed multi-sig. Rotate keys on a schedule. Audit " +
-            "committee membership and signature verification logic on every release. Monitor " +
-            "limiter utilization for suspicious patterns. Have an EmergencyOp pause plan ready.",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.assumes_committee_infallible)
-            return null;
-        return { ...R_B_01.rule, evidence: "assumes_committee_infallible=true (trust root is single-point)" };
-    },
-};
-const R_B_02 = {
-    rule: {
-        id: "R-BRIDGE-02",
-        level: "HIGH",
-        category: "cross_object",
-        title: "Bridge is mainnet-only — testnet operations will fail",
-        description: "The Bridge is only configured on mainnet. testnet nodes do not have the bridge " +
-            "role configured, so any cross-chain operation (cross_chain_wow_to_evm, " +
-            "cross_chain_evm_to_wow, claim_wow_to_evm, etc.) will abort. Developers who test on " +
-            "testnet will see EBridgeUnavailable (8) and may misdiagnose it as a code bug.",
-        affected_stakeholders: ["user", "operator"],
-        scenario: "Developer runs cross_chain_wow_to_evm on testnet; aborts with EBridgeUnavailable",
-        mitigation: "MCP layer MUST validate mainnet environment before submitting Bridge ops. Document " +
-            "the mainnet-only restriction prominently. For testing, use mainnet small-amount " +
-            "transactions or fork tests.",
-        related_move_error: "EBridgeUnavailable (8)",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.is_non_mainnet)
-            return null;
-        return { ...R_B_02.rule, evidence: "is_non_mainnet=true (Bridge unavailable)" };
-    },
-};
-const R_B_03 = {
-    rule: {
-        id: "R-BRIDGE-03",
-        level: "HIGH",
-        category: "structural",
-        title: "TransferLimiter caps single and cumulative transfer amounts — large transfers reject",
-        description: "The TransferLimiter (bridge.move:64) enforces both per-transfer and cumulative " +
-            "transfer caps per token type. A transfer that exceeds the cap aborts with " +
-            "ETokenAlreadyClaimedOrHitLimit (15) or similar. Users attempting large cross-chain " +
-            "moves will see their transactions rejected and may misdiagnose it as a bug.",
-        affected_stakeholders: ["user"],
-        scenario: "User attempts to bridge 1000 ETH; limiter rejects the transfer",
-        mitigation: "Document the limiter semantics. Before submitting, query the current limiter " +
-            "utilization. For large amounts, split into batches across multiple transactions " +
-            "and/or time windows. Surface the remaining cap in the UI.",
-        related_move_error: "ETokenAlreadyClaimedOrHitLimit (15)",
-        auto_fixable: false,
-    },
-    check: (ctx) => null,
-};
-const R_B_04 = {
-    rule: {
-        id: "R-BRIDGE-04",
-        level: "MEDIUM",
-        category: "permission",
-        title: "activeEvmAccount is a single global EVM account — key leak affects all assets",
-        description: "Bridge uses a single global activeEvmAccount that is auto-generated and transparent " +
-            "to users. All cross-chain EVM-side operations flow through this one account. If its " +
-            "private key leaks, every supported token (ETH/WETH/WBTC/USDC/USDT) on every " +
-            "supported chain is at risk. There is no per-user EVM account isolation.",
-        affected_stakeholders: ["user", "system"],
-        scenario: "activeEvmAccount private key leaks; attacker drains all bridged EVM assets",
-        mitigation: "Store the activeEvmAccount key in an HSM. Rotate the key on a schedule and via " +
-            "Versioned upgrade. Monitor EVM-side balances for anomalous outflows. Have an " +
-            "EmergencyOp pause plan ready.",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.assumes_per_user_evm_account)
-            return null;
-        return { ...R_B_04.rule, evidence: "assumes_per_user_evm_account=true (it is global)" };
-    },
-};
-const R_B_05 = {
-    rule: {
-        id: "R-BRIDGE-05",
-        level: "MEDIUM",
-        category: "cross_object",
-        title: "Public EVM RPCs may rate-limit (HTTP 429) — cross-chain ops stall",
-        description: "Bridge ops that query EVM state (query_active_evm_account, query_supported_evm_chains, " +
-            "query_transfer_status, etc.) depend on an EVM RPC. Public RPCs (e.g. Infura free tier, " +
-            "Alchemy free tier) frequently return HTTP 429 under load. A 429 mid-flow stalls the " +
-            "cross-chain operation and may confuse the user. manage_evm_rpc supports multi-RPC " +
-            "rotation, but it must be configured in advance.",
-        affected_stakeholders: ["user", "operator"],
-        scenario: "User queries transfer status; public RPC returns 429; UI shows generic error",
-        mitigation: "Configure multiple EVM RPCs via manage_evm_rpc and enable failover. Use a paid RPC " +
-            "tier for production. Surface 429 as 'RPC busy, retry' rather than 'operation failed'.",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.uses_public_evm_rpc)
-            return null;
-        return { ...R_B_05.rule, evidence: "uses_public_evm_rpc=true (429 risk)" };
-    },
-};
-const R_B_06 = {
-    rule: {
-        id: "R-BRIDGE-06",
-        level: "MEDIUM",
-        category: "lifecycle",
-        title: "EmergencyOp can pause the Bridge — assets lock during pause",
-        description: "EmergencyOp (bridge.move:89-91) can pause the entire Bridge. While paused, no " +
-            "cross-chain operations proceed — assets in flight cannot be claimed, new transfers " +
-            "cannot be initiated. The pause is intended for incident response, but a prolonged " +
-            "pause locks user funds for the duration.",
-        affected_stakeholders: ["user", "operator"],
-        scenario: "Bridge is paused for incident response; users cannot claim in-flight transfers",
-        mitigation: "Document the pause scenario and the emergency plan. Provide a status page showing " +
-            "pause state. Set expectations on pause duration and recovery. Operators should " +
-            "practice un-pause drills.",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.is_paused)
-            return null;
-        return { ...R_B_06.rule, evidence: "is_paused=true (assets locked)" };
-    },
-};
-const R_B_07 = {
-    rule: {
-        id: "R-BRIDGE-07",
-        level: "LOW",
-        category: "structural",
-        title: `Only ${SUPPORTED_TOKENS.length} tokens supported — unsupported tokens cannot bridge`,
-        description: `Bridge supports exactly ${SUPPORTED_TOKENS.length} tokens: ${SUPPORTED_TOKENS.join(", ")}. ` +
-            `Any other token (e.g. DAI, LINK, custom tokens) cannot be bridged. Users holding ` +
-            `unsupported tokens will see their transfer rejected with EUnexpectedTokenType (3).`,
-        affected_stakeholders: ["user"],
-        scenario: "User attempts to bridge DAI; aborts with EUnexpectedTokenType",
-        mitigation: "Document the supported token list prominently. UI should filter the token picker to " +
-            "supported tokens only. For unsupported tokens, recommend an alternative bridge.",
-        related_move_error: "EUnexpectedTokenType (3)",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.unsupported_token)
-            return null;
-        return { ...R_B_07.rule, evidence: `unsupported_token=${ctx.unsupported_token} (supported: ${SUPPORTED_TOKENS.join(",")})` };
-    },
-};
-const R_B_08 = {
-    rule: {
-        id: "R-BRIDGE-08",
-        level: "MEDIUM",
-        category: "structural",
-        title: `Idempotency key max ${MAX_IDEMPOTENCY_KEY_LENGTH} chars — long keys truncate or reject`,
-        description: `BridgeIdempotencyKeySchema accepts strings of length 1-${MAX_IDEMPOTENCY_KEY_LENGTH}. ` +
-            `Callers who generate idempotency keys from long sources (e.g. full JSON payloads, ` +
-            `UUIDs with prefixes) may exceed the limit and see the operation rejected. The limit ` +
-            `exists to keep on-chain storage bounded.`,
-        affected_stakeholders: ["user"],
-        scenario: "Caller uses a 200-char idempotency key; operation rejected",
-        mitigation: "Generate idempotency keys from a hash (e.g. keccak256 of the payload, hex-encoded = " +
-            "66 chars) or a UUID (36 chars). Validate length client-side before submission.",
-        auto_fixable: true,
-    },
-    check: (ctx) => {
-        if (ctx.idempotency_key_length === undefined)
-            return null;
-        if (ctx.idempotency_key_length <= MAX_IDEMPOTENCY_KEY_LENGTH)
-            return null;
-        return { ...R_B_08.rule, evidence: `idempotency_key_length=${ctx.idempotency_key_length}, limit=${MAX_IDEMPOTENCY_KEY_LENGTH}` };
-    },
-};
-const R_B_09 = {
-    rule: {
-        id: "R-BRIDGE-09",
-        level: "LOW",
-        category: "structural",
-        title: `${BRIDGE_ERROR_CODE_COUNT} error codes — debugging requires a lookup table`,
-        description: `Bridge defines ${BRIDGE_ERROR_CODE_COUNT} error codes (EUnexpectedMessageType=0 ` +
-            `through ETokenValueIsZero=19). Debugging an abort requires mapping the numeric code ` +
-            `back to its name and meaning. New contributors often misread codes because they ` +
-            `are not enumerated in the abort message.`,
-        affected_stakeholders: ["user", "operator"],
-        scenario: "Bridge aborts with code 15; developer does not know what ETokenAlreadyClaimedOrHitLimit means",
-        mitigation: "Publish an error-code lookup table in the docs. SDK should decode abort codes into " +
-            "human-readable strings. MCP layer should surface the decoded name in error messages.",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.expects_simple_error_codes)
-            return null;
-        return { ...R_B_09.rule, evidence: `expects_simple_error_codes=true (there are ${BRIDGE_ERROR_CODE_COUNT})` };
-    },
-};
-const R_B_10 = {
-    rule: {
-        id: "R-BRIDGE-10",
-        level: "MEDIUM",
-        category: "lifecycle",
-        title: `Versioned upgrade (current=${BRIDGE_CURRENT_VERSION}) can brick the Bridge if botched`,
-        description: `Bridge uses Versioned to wrap BridgeInner (bridge.move:49), supporting schema upgrades. ` +
-            `The current version is BRIDGE_CURRENT_VERSION=${BRIDGE_CURRENT_VERSION}. An upgrade ` +
-            `that mishandles the inner version migration can permanently brick the Bridge — ` +
-            `funds in flight would be locked, and recovery requires a new package version. The ` +
-            `message_version (current=${BRIDGE_MESSAGE_VERSION}) and EVM address length ` +
-            `(${BRIDGE_EVM_ADDRESS_LENGTH} bytes) are also versioned.`,
-        affected_stakeholders: ["user", "operator", "system"],
-        scenario: "Upgrade mishandles BridgeInner migration; Bridge becomes unusable",
-        mitigation: "Test upgrades on a fork with full state replay. Keep a rollback package version " +
-            "ready. Stage upgrades with a pause window so users can complete in-flight ops. " +
-            "Audit message_version and EVM address length compatibility on every upgrade.",
-        related_move_error: "EWrongInnerVersion (7)",
-        auto_fixable: false,
-    },
-    check: (ctx) => {
-        if (!ctx.versioned_upgrade_in_progress)
-            return null;
-        return { ...R_B_10.rule, evidence: `versioned_upgrade_in_progress=true (current=${BRIDGE_CURRENT_VERSION})` };
-    },
-};
-export const BRIDGE_RISK_RULES = [
-    R_B_01,
-    R_B_02,
-    R_B_03,
-    R_B_04,
-    R_B_05,
-    R_B_06,
-    R_B_07,
-    R_B_08,
-    R_B_09,
-    R_B_10,
-];
-export const BRIDGE_RISK_VERSION = "1.0.0";
-export function checkBridgeRisks(ctx) {
-    const risks = [];
-    for (const rule of BRIDGE_RISK_RULES) {
-        const r = rule.check(ctx);
-        if (r)
-            risks.push(r);
-    }
-    if (!risks.find(r => r.id === "R-BRIDGE-03")) {
-        risks.push(R_B_03.rule);
-    }
-    return risks;
-}
-export function getBridgeRiskById(id) {
-    return BRIDGE_RISK_RULES.find(r => r.rule.id === id)?.rule;
-}
+import{BRIDGE_MESSAGE_VERSION,BRIDGE_EVM_ADDRESS_LENGTH,BRIDGE_CURRENT_VERSION}from'@wowok/wowok';const SUPPORTED_TOKENS=['ETH','WETH','WBTC','USDC','USDT'],MAX_IDEMPOTENCY_KEY_LENGTH=0x80,BRIDGE_ERROR_CODE_COUNT=0x14,R_B_01={'rule':{'id':'R-BRIDGE-01','level':'CRITICAL','category':'permission','title':'Cross-chain\x20asset\x20security\x20—\x20committee\x20signature\x20verification\x20is\x20the\x20single\x20trust\x20root','description':'Bridge\x20committee\x20signatures\x20are\x20the\x20only\x20thing\x20preventing\x20forged\x20cross-chain\x20messages\x20'+'from\x20minting\x20tokens\x20out\x20of\x20thin\x20air\x20(bridge.move:60).\x20If\x20a\x20committee\x20key\x20is\x20'+'compromised,\x20or\x20if\x20the\x20verification\x20logic\x20has\x20a\x20bug,\x20an\x20attacker\x20can\x20claim\x20arbitrary\x20'+'amounts\x20of\x20ETH/WETH/WBTC/USDC/USDT.\x20The\x20TransferLimiter\x20caps\x20single-transfer\x20amounts\x20'+'but\x20does\x20not\x20prevent\x20repeated\x20small\x20attacks.','affected_stakeholders':['user','committee','system'],'scenario':'Committee\x20private\x20key\x20leaks;\x20attacker\x20forges\x20an\x20approved\x20transfer\x20and\x20claims\x20funds','mitigation':'Committee\x20members\x20MUST\x20use\x20HSM-backed\x20multi-sig.\x20Rotate\x20keys\x20on\x20a\x20schedule.\x20Audit\x20'+'committee\x20membership\x20and\x20signature\x20verification\x20logic\x20on\x20every\x20release.\x20Monitor\x20'+'limiter\x20utilization\x20for\x20suspicious\x20patterns.\x20Have\x20an\x20EmergencyOp\x20pause\x20plan\x20ready.','auto_fixable':![]},'check':a=>{if(!a['assumes_committee_infallible'])return null;return{...R_B_01['rule'],'evidence':'assumes_committee_infallible=true\x20(trust\x20root\x20is\x20single-point)'};}},R_B_02={'rule':{'id':'R-BRIDGE-02','level':'HIGH','category':'cross_object','title':'Bridge\x20is\x20mainnet-only\x20—\x20testnet\x20operations\x20will\x20fail','description':'The\x20Bridge\x20is\x20only\x20configured\x20on\x20mainnet.\x20testnet\x20nodes\x20do\x20not\x20have\x20the\x20bridge\x20'+'role\x20configured,\x20so\x20any\x20cross-chain\x20operation\x20(cross_chain_wow_to_evm,\x20'+'cross_chain_evm_to_wow,\x20claim_wow_to_evm,\x20etc.)\x20will\x20abort.\x20Developers\x20who\x20test\x20on\x20'+'testnet\x20will\x20see\x20EBridgeUnavailable\x20(8)\x20and\x20may\x20misdiagnose\x20it\x20as\x20a\x20code\x20bug.','affected_stakeholders':['user','operator'],'scenario':'Developer\x20runs\x20cross_chain_wow_to_evm\x20on\x20testnet;\x20aborts\x20with\x20EBridgeUnavailable','mitigation':'MCP\x20layer\x20MUST\x20validate\x20mainnet\x20environment\x20before\x20submitting\x20Bridge\x20ops.\x20Document\x20'+'the\x20mainnet-only\x20restriction\x20prominently.\x20For\x20testing,\x20use\x20mainnet\x20small-amount\x20'+'transactions\x20or\x20fork\x20tests.','related_move_error':'EBridgeUnavailable\x20(8)','auto_fixable':![]},'check':a=>{if(!a['is_non_mainnet'])return null;return{...R_B_02['rule'],'evidence':'is_non_mainnet=true\x20(Bridge\x20unavailable)'};}},R_B_03={'rule':{'id':'R-BRIDGE-03','level':'HIGH','category':'structural','title':'TransferLimiter\x20caps\x20single\x20and\x20cumulative\x20transfer\x20amounts\x20—\x20large\x20transfers\x20reject','description':'The\x20TransferLimiter\x20(bridge.move:64)\x20enforces\x20both\x20per-transfer\x20and\x20cumulative\x20'+'transfer\x20caps\x20per\x20token\x20type.\x20A\x20transfer\x20that\x20exceeds\x20the\x20cap\x20aborts\x20with\x20'+'ETokenAlreadyClaimedOrHitLimit\x20(15)\x20or\x20similar.\x20Users\x20attempting\x20large\x20cross-chain\x20'+'moves\x20will\x20see\x20their\x20transactions\x20rejected\x20and\x20may\x20misdiagnose\x20it\x20as\x20a\x20bug.','affected_stakeholders':['user'],'scenario':'User\x20attempts\x20to\x20bridge\x201000\x20ETH;\x20limiter\x20rejects\x20the\x20transfer','mitigation':'Document\x20the\x20limiter\x20semantics.\x20Before\x20submitting,\x20query\x20the\x20current\x20limiter\x20'+'utilization.\x20For\x20large\x20amounts,\x20split\x20into\x20batches\x20across\x20multiple\x20transactions\x20'+'and/or\x20time\x20windows.\x20Surface\x20the\x20remaining\x20cap\x20in\x20the\x20UI.','related_move_error':'ETokenAlreadyClaimedOrHitLimit\x20(15)','auto_fixable':![]},'check':a=>null},R_B_04={'rule':{'id':'R-BRIDGE-04','level':'MEDIUM','category':'permission','title':'activeEvmAccount\x20is\x20a\x20single\x20global\x20EVM\x20account\x20—\x20key\x20leak\x20affects\x20all\x20assets','description':'Bridge\x20uses\x20a\x20single\x20global\x20activeEvmAccount\x20that\x20is\x20auto-generated\x20and\x20transparent\x20'+'to\x20users.\x20All\x20cross-chain\x20EVM-side\x20operations\x20flow\x20through\x20this\x20one\x20account.\x20If\x20its\x20'+'private\x20key\x20leaks,\x20every\x20supported\x20token\x20(ETH/WETH/WBTC/USDC/USDT)\x20on\x20every\x20'+'supported\x20chain\x20is\x20at\x20risk.\x20There\x20is\x20no\x20per-user\x20EVM\x20account\x20isolation.','affected_stakeholders':['user','system'],'scenario':'activeEvmAccount\x20private\x20key\x20leaks;\x20attacker\x20drains\x20all\x20bridged\x20EVM\x20assets','mitigation':'Store\x20the\x20activeEvmAccount\x20key\x20in\x20an\x20HSM.\x20Rotate\x20the\x20key\x20on\x20a\x20schedule\x20and\x20via\x20'+'Versioned\x20upgrade.\x20Monitor\x20EVM-side\x20balances\x20for\x20anomalous\x20outflows.\x20Have\x20an\x20'+'EmergencyOp\x20pause\x20plan\x20ready.','auto_fixable':![]},'check':a=>{if(!a['assumes_per_user_evm_account'])return null;return{...R_B_04['rule'],'evidence':'assumes_per_user_evm_account=true\x20(it\x20is\x20global)'};}},R_B_05={'rule':{'id':'R-BRIDGE-05','level':'MEDIUM','category':'cross_object','title':'Public\x20EVM\x20RPCs\x20may\x20rate-limit\x20(HTTP\x20429)\x20—\x20cross-chain\x20ops\x20stall','description':'Bridge\x20ops\x20that\x20query\x20EVM\x20state\x20(query_active_evm_account,\x20query_supported_evm_chains,\x20'+'query_transfer_status,\x20etc.)\x20depend\x20on\x20an\x20EVM\x20RPC.\x20Public\x20RPCs\x20(e.g.\x20Infura\x20free\x20tier,\x20'+'Alchemy\x20free\x20tier)\x20frequently\x20return\x20HTTP\x20429\x20under\x20load.\x20A\x20429\x20mid-flow\x20stalls\x20the\x20'+'cross-chain\x20operation\x20and\x20may\x20confuse\x20the\x20user.\x20manage_evm_rpc\x20supports\x20multi-RPC\x20'+'rotation,\x20but\x20it\x20must\x20be\x20configured\x20in\x20advance.','affected_stakeholders':['user','operator'],'scenario':'User\x20queries\x20transfer\x20status;\x20public\x20RPC\x20returns\x20429;\x20UI\x20shows\x20generic\x20error','mitigation':'Configure\x20multiple\x20EVM\x20RPCs\x20via\x20manage_evm_rpc\x20and\x20enable\x20failover.\x20Use\x20a\x20paid\x20RPC\x20'+'tier\x20for\x20production.\x20Surface\x20429\x20as\x20\x27RPC\x20busy,\x20retry\x27\x20rather\x20than\x20\x27operation\x20failed\x27.','auto_fixable':![]},'check':a=>{if(!a['uses_public_evm_rpc'])return null;return{...R_B_05['rule'],'evidence':'uses_public_evm_rpc=true\x20(429\x20risk)'};}},R_B_06={'rule':{'id':'R-BRIDGE-06','level':'MEDIUM','category':'lifecycle','title':'EmergencyOp\x20can\x20pause\x20the\x20Bridge\x20—\x20assets\x20lock\x20during\x20pause','description':'EmergencyOp\x20(bridge.move:89-91)\x20can\x20pause\x20the\x20entire\x20Bridge.\x20While\x20paused,\x20no\x20'+'cross-chain\x20operations\x20proceed\x20—\x20assets\x20in\x20flight\x20cannot\x20be\x20claimed,\x20new\x20transfers\x20'+'cannot\x20be\x20initiated.\x20The\x20pause\x20is\x20intended\x20for\x20incident\x20response,\x20but\x20a\x20prolonged\x20'+'pause\x20locks\x20user\x20funds\x20for\x20the\x20duration.','affected_stakeholders':['user','operator'],'scenario':'Bridge\x20is\x20paused\x20for\x20incident\x20response;\x20users\x20cannot\x20claim\x20in-flight\x20transfers','mitigation':'Document\x20the\x20pause\x20scenario\x20and\x20the\x20emergency\x20plan.\x20Provide\x20a\x20status\x20page\x20showing\x20'+'pause\x20state.\x20Set\x20expectations\x20on\x20pause\x20duration\x20and\x20recovery.\x20Operators\x20should\x20'+'practice\x20un-pause\x20drills.','auto_fixable':![]},'check':a=>{if(!a['is_paused'])return null;return{...R_B_06['rule'],'evidence':'is_paused=true\x20(assets\x20locked)'};}},R_B_07={'rule':{'id':'R-BRIDGE-07','level':'LOW','category':'structural','title':'Only\x20'+SUPPORTED_TOKENS['length']+'\x20tokens\x20supported\x20—\x20unsupported\x20tokens\x20cannot\x20bridge','description':'Bridge\x20supports\x20exactly\x20'+SUPPORTED_TOKENS['length']+'\x20tokens:\x20'+SUPPORTED_TOKENS['join'](',\x20')+'.\x20'+'Any\x20other\x20token\x20(e.g.\x20DAI,\x20LINK,\x20custom\x20tokens)\x20cannot\x20be\x20bridged.\x20Users\x20holding\x20'+'unsupported\x20tokens\x20will\x20see\x20their\x20transfer\x20rejected\x20with\x20EUnexpectedTokenType\x20(3).','affected_stakeholders':['user'],'scenario':'User\x20attempts\x20to\x20bridge\x20DAI;\x20aborts\x20with\x20EUnexpectedTokenType','mitigation':'Document\x20the\x20supported\x20token\x20list\x20prominently.\x20UI\x20should\x20filter\x20the\x20token\x20picker\x20to\x20'+'supported\x20tokens\x20only.\x20For\x20unsupported\x20tokens,\x20recommend\x20an\x20alternative\x20bridge.','related_move_error':'EUnexpectedTokenType\x20(3)','auto_fixable':![]},'check':a=>{if(!a['unsupported_token'])return null;return{...R_B_07['rule'],'evidence':'unsupported_token='+a['unsupported_token']+'\x20(supported:\x20'+SUPPORTED_TOKENS['join'](',')+')'};}},R_B_08={'rule':{'id':'R-BRIDGE-08','level':'MEDIUM','category':'structural','title':'Idempotency\x20key\x20max\x20'+MAX_IDEMPOTENCY_KEY_LENGTH+'\x20chars\x20—\x20long\x20keys\x20truncate\x20or\x20reject','description':'BridgeIdempotencyKeySchema\x20accepts\x20strings\x20of\x20length\x201-'+MAX_IDEMPOTENCY_KEY_LENGTH+'.\x20'+'Callers\x20who\x20generate\x20idempotency\x20keys\x20from\x20long\x20sources\x20(e.g.\x20full\x20JSON\x20payloads,\x20'+'UUIDs\x20with\x20prefixes)\x20may\x20exceed\x20the\x20limit\x20and\x20see\x20the\x20operation\x20rejected.\x20The\x20limit\x20'+'exists\x20to\x20keep\x20on-chain\x20storage\x20bounded.','affected_stakeholders':['user'],'scenario':'Caller\x20uses\x20a\x20200-char\x20idempotency\x20key;\x20operation\x20rejected','mitigation':'Generate\x20idempotency\x20keys\x20from\x20a\x20hash\x20(e.g.\x20keccak256\x20of\x20the\x20payload,\x20hex-encoded\x20=\x20'+'66\x20chars)\x20or\x20a\x20UUID\x20(36\x20chars).\x20Validate\x20length\x20client-side\x20before\x20submission.','auto_fixable':!![]},'check':a=>{if(a['idempotency_key_length']===undefined)return null;if(a['idempotency_key_length']<=MAX_IDEMPOTENCY_KEY_LENGTH)return null;return{...R_B_08['rule'],'evidence':'idempotency_key_length='+a['idempotency_key_length']+',\x20limit='+MAX_IDEMPOTENCY_KEY_LENGTH};}},R_B_09={'rule':{'id':'R-BRIDGE-09','level':'LOW','category':'structural','title':BRIDGE_ERROR_CODE_COUNT+'\x20error\x20codes\x20—\x20debugging\x20requires\x20a\x20lookup\x20table','description':'Bridge\x20defines\x20'+BRIDGE_ERROR_CODE_COUNT+'\x20error\x20codes\x20(EUnexpectedMessageType=0\x20'+'through\x20ETokenValueIsZero=19).\x20Debugging\x20an\x20abort\x20requires\x20mapping\x20the\x20numeric\x20code\x20'+'back\x20to\x20its\x20name\x20and\x20meaning.\x20New\x20contributors\x20often\x20misread\x20codes\x20because\x20they\x20'+'are\x20not\x20enumerated\x20in\x20the\x20abort\x20message.','affected_stakeholders':['user','operator'],'scenario':'Bridge\x20aborts\x20with\x20code\x2015;\x20developer\x20does\x20not\x20know\x20what\x20ETokenAlreadyClaimedOrHitLimit\x20means','mitigation':'Publish\x20an\x20error-code\x20lookup\x20table\x20in\x20the\x20docs.\x20SDK\x20should\x20decode\x20abort\x20codes\x20into\x20'+'human-readable\x20strings.\x20MCP\x20layer\x20should\x20surface\x20the\x20decoded\x20name\x20in\x20error\x20messages.','auto_fixable':![]},'check':a=>{if(!a['expects_simple_error_codes'])return null;return{...R_B_09['rule'],'evidence':'expects_simple_error_codes=true\x20(there\x20are\x20'+BRIDGE_ERROR_CODE_COUNT+')'};}},R_B_10={'rule':{'id':'R-BRIDGE-10','level':'MEDIUM','category':'lifecycle','title':'Versioned\x20upgrade\x20(current='+BRIDGE_CURRENT_VERSION+')\x20can\x20brick\x20the\x20Bridge\x20if\x20botched','description':'Bridge\x20uses\x20Versioned\x20to\x20wrap\x20BridgeInner\x20(bridge.move:49),\x20supporting\x20schema\x20upgrades.\x20'+('The\x20current\x20version\x20is\x20BRIDGE_CURRENT_VERSION='+BRIDGE_CURRENT_VERSION+'.\x20An\x20upgrade\x20')+'that\x20mishandles\x20the\x20inner\x20version\x20migration\x20can\x20permanently\x20brick\x20the\x20Bridge\x20—\x20'+'funds\x20in\x20flight\x20would\x20be\x20locked,\x20and\x20recovery\x20requires\x20a\x20new\x20package\x20version.\x20The\x20'+('message_version\x20(current='+BRIDGE_MESSAGE_VERSION+')\x20and\x20EVM\x20address\x20length\x20')+('('+BRIDGE_EVM_ADDRESS_LENGTH+'\x20bytes)\x20are\x20also\x20versioned.'),'affected_stakeholders':['user','operator','system'],'scenario':'Upgrade\x20mishandles\x20BridgeInner\x20migration;\x20Bridge\x20becomes\x20unusable','mitigation':'Test\x20upgrades\x20on\x20a\x20fork\x20with\x20full\x20state\x20replay.\x20Keep\x20a\x20rollback\x20package\x20version\x20'+'ready.\x20Stage\x20upgrades\x20with\x20a\x20pause\x20window\x20so\x20users\x20can\x20complete\x20in-flight\x20ops.\x20'+'Audit\x20message_version\x20and\x20EVM\x20address\x20length\x20compatibility\x20on\x20every\x20upgrade.','related_move_error':'EWrongInnerVersion\x20(7)','auto_fixable':![]},'check':a=>{if(!a['versioned_upgrade_in_progress'])return null;return{...R_B_10['rule'],'evidence':'versioned_upgrade_in_progress=true\x20(current='+BRIDGE_CURRENT_VERSION+')'};}};export const BRIDGE_RISK_RULES=[R_B_01,R_B_02,R_B_03,R_B_04,R_B_05,R_B_06,R_B_07,R_B_08,R_B_09,R_B_10];export const BRIDGE_RISK_VERSION='1.0.0';export function checkBridgeRisks(a){const b=[];for(const c of BRIDGE_RISK_RULES){const d=c['check'](a);if(d)b['push'](d);}return!b['find'](e=>e['id']==='R-BRIDGE-03')&&b['push'](R_B_03['rule']),b;}export function getBridgeRiskById(a){return BRIDGE_RISK_RULES['find'](b=>b['rule']['id']===a)?.['rule'];}