@wowok/agent-mcp 2.7.1 → 2.7.3

package/dist/knowledge/guard-design-patterns.js

@@ -1,360 +1 @@
-export const GUARD_DESIGN_PATTERNS = [
-    {
-        id: "pattern.identity_check_single",
-        business_requirement: "Only the author can purchase this service (strict single-identity)",
-        data_source: "SystemContext",
-        host: "service_buy_guard",
-        verifier_level: "level1_strict_single",
-        logic_summary: "logic_equal[context(Signer), identifier[N](fixed_address)]",
-        key_queries: [],
-        mitigated_risks: ["R-C4-04"],
-        notes: [
-            "Maximally secure but maximally inconvenient",
-            "If address is unavailable (key loss, rotation), Guard permanently blocks",
-            "Avoid unless role is permanently tied to one address",
-        ],
-    },
-    {
-        id: "pattern.identity_check_allowlist",
-        business_requirement: "Customer must be in an allowlist to purchase",
-        data_source: "SystemContext",
-        host: "service_buy_guard",
-        verifier_level: "level2_identity_set",
-        logic_summary: "vec_contains_address[identifier[N](allowlist_vec), context(Signer)]",
-        key_queries: [],
-        mitigated_risks: ["R-C4-04"],
-        notes: ["Allowlist stored as Address vector in table constant"],
-    },
-    {
-        id: "pattern.identity_check_order_holder",
-        business_requirement: "Only order owner or agent can perform operation",
-        data_source: "OnChainConstant",
-        host: "machine_forward",
-        verifier_level: "level2_identity_set",
-        logic_summary: "logic_or[logic_equal[query(1562 order.owner), context(Signer)], query(1567 order.agent has, Signer)]",
-        key_queries: ["order.owner", "order.agent has"],
-        mitigated_risks: ["R-C4-04", "R-C3-06"],
-        notes: [
-            "1562 returns Address → wrap in logic_equal",
-            "1567 returns Bool → use directly as logic_or child",
-            "Recommended Level 2 alternative to Level 1 strict binding",
-        ],
-    },
-    {
-        id: "pattern.identity_check_service_provider_dynamic",
-        business_requirement: "Verify caller is service's current permission owner (survives permission rotation)",
-        data_source: "SubmittedObject",
-        host: "machine_forward",
-        verifier_level: "level2_identity_set",
-        logic_summary: "logic_and[logic_equal[query(1488 service.permission), identifier[N](submitted_perm)], logic_or[logic_equal[query(1002 permission.owner), context(Signer)], query(1004 permission.admin has, Signer)]]",
-        key_queries: ["service.permission", "permission.owner", "permission.admin has"],
-        mitigated_risks: ["R-C4-04", "R-C3-05"],
-        notes: [
-            "Dynamic permission address (RECOMMENDED) — survives Service permission rotation",
-            "Caller submits permission address; Guard verifies match then checks identity",
-            "More complex than static but far more robust",
-        ],
-    },
-    {
-        id: "pattern.time_lock_progress",
-        business_requirement: "Customer must wait N hours before completing (time-lock)",
-        data_source: "WitnessDerived",
-        host: "machine_forward",
-        verifier_level: "none",
-        logic_summary: "logic_as_u256_ge[context(Clock), calc_number_add[query(1272 progress.current_time, witness=OrderProgress), identifier[N](duration_ms)]]",
-        key_queries: ["progress.current_time"],
-        witness_types: ["OrderProgress"],
-        mitigated_risks: [],
-        notes: [
-            "Use convert_witness=100 (OrderProgress) to derive Progress from submitted Order ID",
-            "Duration in milliseconds — test with small values first",
-        ],
-    },
-    {
-        id: "pattern.time_lock_absolute",
-        business_requirement: "Operation allowed only after a fixed timestamp",
-        data_source: "SystemContext",
-        host: "service_buy_guard",
-        verifier_level: "none",
-        logic_summary: "logic_as_u256_ge[context(Clock), identifier[N](release_timestamp)]",
-        key_queries: [],
-        mitigated_risks: [],
-        notes: ["Useful for pre-sale windows, embargo periods"],
-    },
-    {
-        id: "pattern.repository_data_check",
-        business_requirement: "External data must match expected value (e.g., weather, price feed)",
-        data_source: "OnChainConstant",
-        host: "machine_forward",
-        verifier_level: "none",
-        logic_summary: "logic_equal[query(1167 repository.data, policy, key), identifier[N](expected_value)]",
-        key_queries: ["repository.data"],
-        mitigated_risks: [],
-        notes: [
-            "Repository address declared as table constant",
-            "Timestamp keys may need convert_number_address",
-            "quote_guard context: fails in gen_passport (impack_list empty), works in on-chain business operations (see R-X1-10)",
-        ],
-    },
-    {
-        id: "pattern.repository_quote_guard_subscription",
-        business_requirement: "Repository data access requires payment proof (subscription revenue model)",
-        data_source: "SubmittedObject",
-        host: "repository_write",
-        verifier_level: "level3_scene_combined",
-        logic_summary: "Repository policy sets quote_guard (is_depended: immutable + rep=true). " +
-            "When a Guard queries this Repository's data (query 1167), check_repository_quote_guard verifies " +
-            "the quote_guard is in impack_list. The quote_guard itself verifies a submitted Payment " +
-            "(payment.info.for matches Repository, payment.amount meets subscription price). " +
-            "User submits Payment via Passport → quote_guard verified → added to impack_list → query 1167 passes.",
-        key_queries: ["repository.data", "payment.info.for", "payment.amount"],
-        mitigated_risks: ["R-X1-10"],
-        applicable_industries: ["subscription", "travel", "rental", "education"],
-        notes: [
-            "VERIFIED: passport.rs#L545-612 (check_repository_quote_guard), passport.rs#L758-769 (trigger at query_id==1167)",
-            "Repository.owner_receive<T> accepts Payment as subscription revenue (repository.move#L714-717)",
-            "quote_guard must be is_depended: immutable=true, relies empty, rep=true (guard.move#L133-135)",
-            "VERIFIER-EVIDENCE DESIGN: user submits valid Payment, quote_guard verifies Payment fields — no affiliation needed",
-            "gen_passport context: quote_guard fails (impack_list empty) — only use for on-chain business operations",
-            "Business model: data provider publishes weather/market/oracle data to Repository, " +
-                "users pay subscription to access data in their Machine flows",
-        ],
-    },
-    {
-        id: "pattern.supply_chain_suborder_verification",
-        business_requirement: "Sub-service purchase requires ownership of main service order (supply chain milestone unlock)",
-        data_source: "SubmittedObject",
-        host: "service_buy_guard",
-        verifier_level: "level2_identity_set",
-        logic_summary: "Sub-service buy_guard verifies submitted main Order: " +
-            "logic_and[logic_equal[query(order.owner), context(Signer)], logic_equal[query(order.service), identifier[N](main_service_address)]]. " +
-            "User submits main Order via Passport (b_submission=true), buy_guard verifies ownership + service match.",
-        key_queries: ["order.owner", "order.service"],
-        mitigated_risks: ["R-C3-05"],
-        applicable_industries: ["travel", "rental", "education", "freelance"],
-        notes: [
-            "VERIFIER-EVIDENCE DESIGN: user submits main Order as evidence, buy_guard verifies order.owner==Signer AND order.service==main_service",
-            "Each milestone = one sub-order with its own Service + buy_guard referencing the main order",
-            "Main flow can branch to different sub-services based on Machine node progression",
-            "No parent_order field needed — relationship verified via buy_guard querying submitted Order fields",
-            "Enables supply chain composition: main service → multiple sub-services with conditional access",
-        ],
-    },
-    {
-        id: "pattern.payment_exception_compensation",
-        business_requirement: "Exception branch triggers compensation Payment (e.g., delivery delay > 30min auto-compensates customer)",
-        data_source: "SubmittedObject",
-        host: "machine_forward",
-        verifier_level: "level3_scene_combined",
-        logic_summary: "Exception forward guard verifies 4-dimensional anti-reuse binding: logic_and[" +
-            "logic_equal[query(payment.info.for), identifier[N](order_address)], " +
-            "logic_equal[query(payment.info.guard), identifier[N](this_guard_address)], " +
-            "logic_as_u256_ge[query(payment.amount), identifier[N](compensation_amount)], " +
-            "logic_as_u256_equal[query(payment.info.index), query(progress.history count)], " +
-            "logic_string_nocase_equal[query(payment.info.remark), query(progress.current)]]. " +
-            "Treasury withdraws to customer with PaymentInfo(for_object=order, for_guard=this, index=history_count_at_creation, remark=node_name). " +
-            "Customer submits Payment via Passport; guard verifies index matches current unique step (progress.history count, U64, monotonically increasing — unique even in cycles) AND remark matches current node name (progress.current, String — may repeat across cycles but bound to this step by index).",
-        key_queries: [
-            "payment.info.for",
-            "payment.info.guard",
-            "payment.info.index",
-            "payment.info.remark",
-            "payment.amount",
-            "progress.history count",
-            "progress.current",
-        ],
-        mitigated_risks: [],
-        applicable_industries: ["rental", "travel", "general", "freelance"],
-        notes: [
-            "VERIFIED: payment.move#L66-71 (PaymentInfo: for_object, for_guard, remark, index), payment.move#L82-86 (payment_info_with_guard)",
-            "VERIFIED: treasury.move#L249-264 (withdraw creates Payment via payment::new_singleton + from_object_set)",
-            "Payment is freeze_object (immutable, payment.move#L160) — cannot be modified after creation",
-            "VERIFIED INDEX QUERY: progress.history count (id 1273, U64) — guard-ins.ts#L1228-1237. From progress.move L440-441 (session_accomplish pushes a new History entry) + L475/L482 (parent_table_vec::length returns current session id). This count is the unique monotonically increasing step index — even in cycles, each entry has a different count.",
-            "VERIFIED NODE NAME QUERY: progress.current (id 1253, String) — guard-ins.ts#L1025-1032. Returns the current node name. A node CAN be entered multiple times in cycles, so node name alone is NOT unique — it MUST be paired with progress.history count for uniqueness.",
-            "DESIGN INTENT (USER): to validate index (U64 type), use progress.history count (unique, non-repeating); to validate node name (may repeat in cycles), store it in PaymentInfo.remark and do string comparison with progress.current.",
-            "ANTI-REUSE 4-DIMENSIONAL BINDING: for_object (Order) + for_guard (Guard) + index (unique step via progress.history count) + remark (node name via progress.current). Same Payment cannot be reused in other contexts — at least one field will mismatch.",
-            "VERIFIER-EVIDENCE DESIGN: customer submits Payment, guard verifies binding fields match current context",
-            "Enables user-friendly exception handling: delay → auto-compensation → friendly branch flow",
-            "No affiliation registration needed — guard only verifies submitted Payment's field accuracy",
-        ],
-    },
-    {
-        id: "pattern.verifier_evidence_philosophy",
-        business_requirement: "Guard design philosophy: verifier provides evidence, guard verifies logic + data accuracy (NOT data discovery)",
-        data_source: "SubmittedObject",
-        host: "gen_passport",
-        verifier_level: "none",
-        logic_summary: "Guard is a PURE VERIFICATION engine. Participants submit evidence (Payment, Order, Proof, etc.) " +
-            "via Passport submissions (b_submission=true). Guard verifies: (1) logic completeness, (2) data usage accuracy. " +
-            "Guard does NOT discover/fetch objects via affiliation. Affiliation is for object lifecycle bookkeeping, " +
-            "NOT for guard data discovery.",
-        key_queries: [],
-        mitigated_risks: ["R-C3-05", "R-C3-06"],
-        notes: [
-            "CORE PRINCIPLE: Guard only validates submitted evidence — it never fetches data on its own",
-            "For Payment verification: user submits valid Payment → guard checks for_object/for_guard/index match",
-            "For multi-order verification: verifier submits Order data → guard checks service/owner relationships",
-            "For Repository access: user submits Payment → quote_guard verifies → impack_list updated → data query passes",
-            "Type 3 (SubmittedObject) data source class embodies this philosophy — b_submission=true entries",
-            "This pattern is foundational for all guard designs — always prefer verifier-evidence over complex object discovery",
-        ],
-    },
-    {
-        id: "pattern.progress_state_check",
-        business_requirement: "Specific forward has been accomplished (customer confirms delivery)",
-        data_source: "WitnessDerived",
-        host: "reward_claim",
-        verifier_level: "none",
-        logic_summary: "logic_equal[query_progress_history_find(...).accomplished, identifier[N](true)]",
-        key_queries: ["progress.current", "progress.current_time"],
-        witness_types: ["OrderProgress"],
-        mitigated_risks: [],
-        notes: ["Chain query_progress_history_find → query_progress_history_session_forward_find"],
-    },
-    {
-        id: "pattern.reward_one_time_claim",
-        business_requirement: "User can only claim reward once (no prior claims)",
-        data_source: "OnChainConstant",
-        host: "reward_claim",
-        verifier_level: "none",
-        logic_summary: "logic_equal[query_reward_record_count(recipient=Signer), identifier[N](0)]",
-        key_queries: ["reward.record_count"],
-        mitigated_risks: [],
-        notes: ["Record count check prevents double-claim"],
-    },
-    {
-        id: "pattern.reward_multi_condition",
-        business_requirement: "Order payment > threshold AND reached 'complete' to claim reward",
-        data_source: "WitnessDerived",
-        host: "reward_claim",
-        verifier_level: "none",
-        logic_summary: "logic_and[logic_as_u256_gt[query(order.amount), threshold], logic_equal[query(progress.current), 'complete'], logic_equal[query(order.service), identifier[N](expected_service)]]",
-        key_queries: ["order.amount", "progress.current", "order.service"],
-        witness_types: ["OrderProgress"],
-        mitigated_risks: ["R-C3-05"],
-        notes: ["Multi-condition: amount + progress state + service match"],
-    },
-    {
-        id: "pattern.arbitration_voting_weight",
-        business_requirement: "Vote weight equals reputation score (dynamic weight from Passport)",
-        data_source: "SubmittedObject",
-        host: "arbitration_voting",
-        verifier_level: "none",
-        logic_summary: "GuardIdentifier extracts numeric value from Passport submission",
-        key_queries: [],
-        mitigated_risks: ["R-C3-02"],
-        notes: [
-            "Table needs numeric submission entry at referenced index",
-            "Weight must come from on-chain EntityRegistrar, not submission",
-            "BINDING_01: voting_guard GuardIdentifier must be numeric (U8-U256)",
-        ],
-    },
-    {
-        id: "pattern.arbitration_membership_check",
-        business_requirement: "Only premium members can file disputes",
-        data_source: "OnChainConstant",
-        host: "arbitration_usage",
-        verifier_level: "none",
-        logic_summary: "logic_and[query(entity exists), logic_as_u256_ge[query(entity tier), identifier[N](premium_tier)]]",
-        key_queries: ["entity.registrar", "entity.linker"],
-        mitigated_risks: [],
-        notes: ["ENTITY_REGISTRAR_ADDRESS (0xaab) / ENTITY_LINKER_ADDRESS (0xaaa) must be in table"],
-    },
-    {
-        id: "pattern.scene_allocator_entity_recipient",
-        business_requirement: "Service allocator with sharing.who=Entity — no Signer binding needed",
-        data_source: "OnChainConstant",
-        host: "service_allocator_guard",
-        verifier_level: "level3_scene_combined",
-        logic_summary: "Scene verifies fund flow safety — Guard only validates allocation rules",
-        key_queries: ["service.permission", "order.amount"],
-        mitigated_risks: ["R-C3-06"],
-        notes: [
-            "Funds flow to fixed Treasury/address regardless of caller",
-            "sharing.who=Entity already guarantees recipient safety",
-            "No Signer binding required — R-C3-06 safe",
-        ],
-    },
-    {
-        id: "pattern.scene_machine_forward_operator",
-        business_requirement: "Machine forward with permissionIndex/namedOperator already verifies operator",
-        data_source: "OnChainConstant",
-        host: "machine_forward",
-        verifier_level: "level3_scene_combined",
-        logic_summary: "Forward's permissionIndex/namedOperator verifies operator — Guard only validates submitted data",
-        key_queries: [],
-        mitigated_risks: [],
-        notes: [
-            "Scene verifies operator permission via permissionIndex/namedOperator",
-            "Signer binding only needed if submitted data must belong to operator",
-            "Evaluate scene before adding Signer binding",
-        ],
-    },
-];
-export const VERIFIER_LEVEL_GUIDANCE = [
-    {
-        level: "level1_strict_single",
-        pattern: "logic_equal[context(Signer), identifier[N](fixed_address)]",
-        when_to_use: "Role permanently tied to one address AND designer accepts lock-in risk",
-        risk_rules: ["R-C4-04"],
-        recommendation: "avoid",
-    },
-    {
-        level: "level2_identity_set",
-        pattern: "logic_or of multiple identity checks",
-        when_to_use: "Role-based access — multiple authorized identities",
-        risk_rules: ["R-C4-04 (suppressed)"],
-        recommendation: "recommended",
-    },
-    {
-        level: "level3_scene_combined",
-        pattern: "Scene itself verifies identity — no Signer binding needed",
-        when_to_use: "Scene's host object already verifies operator (e.g., Machine forward, sharing.who=Entity)",
-        risk_rules: [],
-        recommendation: "default",
-    },
-    {
-        level: "none",
-        pattern: "No Signer binding required",
-        when_to_use: "Resource flow matters more than caller identity",
-        risk_rules: [],
-        recommendation: "default",
-    },
-];
-export function getGuardDesignPattern(id) {
-    return GUARD_DESIGN_PATTERNS.find((p) => p.id === id);
-}
-export function searchGuardDesignPatterns(query) {
-    const q = query.toLowerCase();
-    return GUARD_DESIGN_PATTERNS.filter((p) => {
-        if (p.business_requirement.toLowerCase().includes(q))
-            return true;
-        if (p.logic_summary.toLowerCase().includes(q))
-            return true;
-        if (p.key_queries.some((k) => k.toLowerCase().includes(q)))
-            return true;
-        return false;
-    });
-}
-export function getPatternsByHost(host) {
-    return GUARD_DESIGN_PATTERNS.filter((p) => p.host === host);
-}
-export function getPatternsByIndustry(industry) {
-    return GUARD_DESIGN_PATTERNS.filter((p) => p.applicable_industries?.includes(industry));
-}
-export function getPatternsByDataSourceClass(source) {
-    return GUARD_DESIGN_PATTERNS.filter((p) => p.data_source === source);
-}
-export function getVerifierLevelGuidance(level) {
-    return VERIFIER_LEVEL_GUIDANCE.find((g) => g.level === level);
-}
-export function suggestPatternForRequirement(requirement) {
-    const matches = searchGuardDesignPatterns(requirement);
-    if (matches.length === 0) {
-        const fallback = GUARD_DESIGN_PATTERNS[0];
-        return { best: fallback, alternatives: [] };
-    }
-    const [best, ...alternatives] = matches;
-    return { best, alternatives };
-}
-export const GUARD_DESIGN_PATTERNS_VERSION = 1;
+export const GUARD_DESIGN_PATTERNS=[{'id':'pattern.identity_check_single','business_requirement':'Only\x20the\x20author\x20can\x20purchase\x20this\x20service\x20(strict\x20single-identity)','data_source':'SystemContext','host':'service_buy_guard','verifier_level':'level1_strict_single','logic_summary':'logic_equal[context(Signer),\x20identifier[N](fixed_address)]','key_queries':[],'mitigated_risks':['R-C4-04'],'notes':['Maximally\x20secure\x20but\x20maximally\x20inconvenient','If\x20address\x20is\x20unavailable\x20(key\x20loss,\x20rotation),\x20Guard\x20permanently\x20blocks','Avoid\x20unless\x20role\x20is\x20permanently\x20tied\x20to\x20one\x20address']},{'id':'pattern.identity_check_allowlist','business_requirement':'Customer\x20must\x20be\x20in\x20an\x20allowlist\x20to\x20purchase','data_source':'SystemContext','host':'service_buy_guard','verifier_level':'level2_identity_set','logic_summary':'vec_contains_address[identifier[N](allowlist_vec),\x20context(Signer)]','key_queries':[],'mitigated_risks':['R-C4-04'],'notes':['Allowlist\x20stored\x20as\x20Address\x20vector\x20in\x20table\x20constant']},{'id':'pattern.identity_check_order_holder','business_requirement':'Only\x20order\x20owner\x20or\x20agent\x20can\x20perform\x20operation','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'level2_identity_set','logic_summary':'logic_or[logic_equal[query(1562\x20order.owner),\x20context(Signer)],\x20query(1567\x20order.agent\x20has,\x20Signer)]','key_queries':['order.owner','order.agent\x20has'],'mitigated_risks':['R-C4-04','R-C3-06'],'notes':['1562\x20returns\x20Address\x20→\x20wrap\x20in\x20logic_equal','1567\x20returns\x20Bool\x20→\x20use\x20directly\x20as\x20logic_or\x20child','Recommended\x20Level\x202\x20alternative\x20to\x20Level\x201\x20strict\x20binding']},{'id':'pattern.identity_check_service_provider_dynamic','business_requirement':'Verify\x20caller\x20is\x20service\x27s\x20current\x20permission\x20owner\x20(survives\x20permission\x20rotation)','data_source':'SubmittedObject','host':'machine_forward','verifier_level':'level2_identity_set','logic_summary':'logic_and[logic_equal[query(1488\x20service.permission),\x20identifier[N](submitted_perm)],\x20logic_or[logic_equal[query(1002\x20permission.owner),\x20context(Signer)],\x20query(1004\x20permission.admin\x20has,\x20Signer)]]','key_queries':['service.permission','permission.owner','permission.admin\x20has'],'mitigated_risks':['R-C4-04','R-C3-05'],'notes':['Dynamic\x20permission\x20address\x20(RECOMMENDED)\x20—\x20survives\x20Service\x20permission\x20rotation','Caller\x20submits\x20permission\x20address;\x20Guard\x20verifies\x20match\x20then\x20checks\x20identity','More\x20complex\x20than\x20static\x20but\x20far\x20more\x20robust']},{'id':'pattern.time_lock_progress','business_requirement':'Customer\x20must\x20wait\x20N\x20hours\x20before\x20completing\x20(time-lock)','data_source':'WitnessDerived','host':'machine_forward','verifier_level':'none','logic_summary':'logic_as_u256_ge[context(Clock),\x20calc_number_add[query(1272\x20progress.current_time,\x20witness=OrderProgress),\x20identifier[N](duration_ms)]]','key_queries':['progress.current_time'],'witness_types':['OrderProgress'],'mitigated_risks':[],'notes':['Use\x20convert_witness=100\x20(OrderProgress)\x20to\x20derive\x20Progress\x20from\x20submitted\x20Order\x20ID','Duration\x20in\x20milliseconds\x20—\x20test\x20with\x20small\x20values\x20first']},{'id':'pattern.time_lock_absolute','business_requirement':'Operation\x20allowed\x20only\x20after\x20a\x20fixed\x20timestamp','data_source':'SystemContext','host':'service_buy_guard','verifier_level':'none','logic_summary':'logic_as_u256_ge[context(Clock),\x20identifier[N](release_timestamp)]','key_queries':[],'mitigated_risks':[],'notes':['Useful\x20for\x20pre-sale\x20windows,\x20embargo\x20periods']},{'id':'pattern.repository_data_check','business_requirement':'External\x20data\x20must\x20match\x20expected\x20value\x20(e.g.,\x20weather,\x20price\x20feed)','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'none','logic_summary':'logic_equal[query(1167\x20repository.data,\x20policy,\x20key),\x20identifier[N](expected_value)]','key_queries':['repository.data'],'mitigated_risks':[],'notes':['Repository\x20address\x20declared\x20as\x20table\x20constant','Timestamp\x20keys\x20may\x20need\x20convert_number_address','quote_guard\x20context:\x20fails\x20in\x20gen_passport\x20(impack_list\x20empty),\x20works\x20in\x20on-chain\x20business\x20operations\x20(see\x20R-X1-10)']},{'id':'pattern.repository_quote_guard_subscription','business_requirement':'Repository\x20data\x20access\x20requires\x20payment\x20proof\x20(subscription\x20revenue\x20model)','data_source':'SubmittedObject','host':'repository_write','verifier_level':'level3_scene_combined','logic_summary':'Repository\x20policy\x20sets\x20quote_guard\x20(is_depended:\x20immutable\x20+\x20rep=true).\x20'+'When\x20a\x20Guard\x20queries\x20this\x20Repository\x27s\x20data\x20(query\x201167),\x20check_repository_quote_guard\x20verifies\x20'+'the\x20quote_guard\x20is\x20in\x20impack_list.\x20The\x20quote_guard\x20itself\x20verifies\x20a\x20submitted\x20Payment\x20'+'(payment.info.for\x20matches\x20Repository,\x20payment.amount\x20meets\x20subscription\x20price).\x20'+'User\x20submits\x20Payment\x20via\x20Passport\x20→\x20quote_guard\x20verified\x20→\x20added\x20to\x20impack_list\x20→\x20query\x201167\x20passes.','key_queries':['repository.data','payment.info.for','payment.amount'],'mitigated_risks':['R-X1-10'],'applicable_industries':['subscription','travel','rental','education'],'notes':['VERIFIED:\x20passport.rs#L545-612\x20(check_repository_quote_guard),\x20passport.rs#L758-769\x20(trigger\x20at\x20query_id==1167)','Repository.owner_receive<T>\x20accepts\x20Payment\x20as\x20subscription\x20revenue\x20(repository.move#L714-717)','quote_guard\x20must\x20be\x20is_depended:\x20immutable=true,\x20relies\x20empty,\x20rep=true\x20(guard.move#L133-135)','VERIFIER-EVIDENCE\x20DESIGN:\x20user\x20submits\x20valid\x20Payment,\x20quote_guard\x20verifies\x20Payment\x20fields\x20—\x20no\x20affiliation\x20needed','gen_passport\x20context:\x20quote_guard\x20fails\x20(impack_list\x20empty)\x20—\x20only\x20use\x20for\x20on-chain\x20business\x20operations','Business\x20model:\x20data\x20provider\x20publishes\x20weather/market/oracle\x20data\x20to\x20Repository,\x20'+'users\x20pay\x20subscription\x20to\x20access\x20data\x20in\x20their\x20Machine\x20flows','MODE\x20A\x20(direct\x20payment\x20verify)\x20—\x20four\x20verifiable\x20elements\x20on\x20the\x20submitted\x20Payment:\x20'+'1)\x20amount:\x20logic_as_u256_ge[payment.amount,\x20N]\x20(>=\x20subscription\x20price);\x20'+'2)\x20subscription\x20type:\x20payment.info.remark\x20/\x20payment.info.index\x20encodes\x20the\x20tier/plan;\x20'+'3)\x20fixed\x20recipient:\x20payment.record.recipient\x20must\x20equal\x20the\x20designated\x20payee\x20(Treasury/owner\x20address);\x20'+'4)\x20occurrence\x20time:\x20payment.time\x20within\x20the\x20validity\x20window\x20(logic_as_u256_ge/le\x20vs\x20context(Clock))','Payment\x20is\x20freeze_object\x20after\x20creation\x20—\x20all\x20four\x20elements\x20are\x20tamper-proof\x20evidence','For\x20a\x20LOWER\x20user-cost\x20variant\x20(no\x20per-user\x20payment\x20submission),\x20see\x20pattern.repository_whitelist_sync\x20(Mode\x20B)']},{'id':'pattern.repository_whitelist_sync','business_requirement':'Entitlement\x20check\x20via\x20a\x20synced\x20allowlist\x20Repository\x20instead\x20of\x20per-user\x20payment\x20submission\x20(low-friction\x20entitlements:\x20memberships,\x20authorizations,\x20paid-user\x20lists)','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'none','logic_summary':'Off-chain\x20collector\x20gathers\x20eligible\x20users\x20(transfers\x20/\x20Payments\x20to\x20the\x20designated\x20receiving\x20address\x20or\x20object,\x20'+'Service\x20orders,\x20or\x20any\x20off-chain\x20record)\x20and\x20syncs\x20the\x20list\x20into\x20a\x20dedicated\x20Repository\x20object\x20'+'(entries\x20may\x20carry\x20a\x20validity\x20window,\x20e.g.\x20authorized\x20time\x20period).\x20'+'The\x20consuming\x20Guard\x20checks\x20membership\x20via\x20query\x201166/1167\x20(repository.data)\x20keyed\x20by\x20the\x20caller:\x20'+'vec_contains_address-style\x20logic_or\x20over\x20[repository.data(key=Signer)]\x20or\x20logic_equal[repository.data(...),\x20identifier[N](expected)].\x20'+'Repository\x20writes\x20go\x20through\x20id_data\x20/\x20id_data_add\x20/\x20id_data_remove\x20(batch\x20up\x20to\x20100\x20entries\x20per\x20tx).','key_queries':['repository.data'],'mitigated_risks':['R-X1-10'],'applicable_industries':['subscription','travel','rental','education'],'notes':['MODE\x20B\x20(whitelist\x20sync)\x20—\x20user-cost\x20optimization\x20of\x20Mode\x20A\x20(pattern.repository_quote_guard_subscription):\x20'+'users\x20do\x20NOT\x20submit\x20a\x20Payment\x20at\x20verification\x20time;\x20the\x20operator\x20proves\x20eligibility\x20off-chain\x20and\x20syncs\x20the\x20roster','TRADE-OFF:\x20eventual\x20consistency\x20—\x20the\x20roster\x20updates\x20at\x20the\x20collector\x27s\x20sync\x20frequency\x20(slight\x20delay),\x20'+'vs\x20Mode\x20A\x27s\x20instant\x20per-payment\x20proof.\x20Choose\x20by\x20business:\x20high-frequency\x20low-value\x20→\x20Mode\x20B;\x20'+'high-value\x20instant\x20entitlement\x20→\x20Mode\x20A','Entry\x20shape:\x20key\x20=\x20user\x20address\x20(or\x20derived\x20id),\x20value\x20=\x20expiry\x20timestamp\x20/\x20tier\x20/\x20scope;\x20'+'time-window\x20enforcement\x20compares\x20entry\x20value\x20against\x20context(Clock)\x20in\x20the\x20Guard','VERIFIED:\x20repository.move\x20id_data*\x20(batch\x20≤100),\x20guard-ins.ts\x201166/1167\x20(repository.data\x20queries),\x20'+'guard.move\x20is_depended\x20(1167\x20marks\x20query-only\x20repositories)','The\x20collector\x20can\x20source\x20eligibility\x20from:\x20transfers\x20or\x20Payments\x20to\x20a\x20fixed\x20receiving\x20address/object,\x20'+'Service\x20orders\x20(order.service\x20==\x20designated\x20service),\x20or\x20external\x20off-chain\x20records','Repository\x20access\x20economics\x20stay\x20OUT\x20of\x20this\x20pattern\x20(K3\x2010\x20§5\x20D5\x20ruling:\x20reuse\x20Reward/Allocation\x20'+'outside\x20the\x20Repository\x20for\x20payment;\x20the\x20Repository\x20here\x20is\x20the\x20roster,\x20not\x20the\x20payment\x20rail)']},{'id':'pattern.supply_chain_suborder_verification','business_requirement':'Sub-service\x20purchase\x20requires\x20ownership\x20of\x20main\x20service\x20order\x20(supply\x20chain\x20milestone\x20unlock)','data_source':'SubmittedObject','host':'service_buy_guard','verifier_level':'level2_identity_set','logic_summary':'Sub-service\x20buy_guard\x20verifies\x20submitted\x20main\x20Order:\x20'+'logic_and[logic_equal[query(order.owner),\x20context(Signer)],\x20logic_equal[query(order.service),\x20identifier[N](main_service_address)]].\x20'+'User\x20submits\x20main\x20Order\x20via\x20Passport\x20(b_submission=true),\x20buy_guard\x20verifies\x20ownership\x20+\x20service\x20match.','key_queries':['order.owner','order.service'],'mitigated_risks':['R-C3-05'],'applicable_industries':['travel','rental','education','freelance'],'notes':['VERIFIER-EVIDENCE\x20DESIGN:\x20user\x20submits\x20main\x20Order\x20as\x20evidence,\x20buy_guard\x20verifies\x20order.owner==Signer\x20AND\x20order.service==main_service','Each\x20milestone\x20=\x20one\x20sub-order\x20with\x20its\x20own\x20Service\x20+\x20buy_guard\x20referencing\x20the\x20main\x20order','Main\x20flow\x20can\x20branch\x20to\x20different\x20sub-services\x20based\x20on\x20Machine\x20node\x20progression','No\x20parent_order\x20field\x20needed\x20—\x20relationship\x20verified\x20via\x20buy_guard\x20querying\x20submitted\x20Order\x20fields','Enables\x20supply\x20chain\x20composition:\x20main\x20service\x20→\x20multiple\x20sub-services\x20with\x20conditional\x20access']},{'id':'pattern.payment_exception_compensation','business_requirement':'Exception\x20branch\x20triggers\x20compensation\x20Payment\x20(e.g.,\x20delivery\x20delay\x20>\x2030min\x20auto-compensates\x20customer)','data_source':'SubmittedObject','host':'machine_forward','verifier_level':'level3_scene_combined','logic_summary':'Exception\x20forward\x20guard\x20verifies\x204-dimensional\x20anti-reuse\x20binding:\x20logic_and['+'logic_equal[query(payment.info.for),\x20identifier[N](order_address)],\x20'+'logic_equal[query(payment.info.guard),\x20identifier[N](this_guard_address)],\x20'+'logic_as_u256_ge[query(payment.amount),\x20identifier[N](compensation_amount)],\x20'+'logic_as_u256_equal[query(payment.info.index),\x20query(progress.history\x20count)],\x20'+'logic_string_nocase_equal[query(payment.info.remark),\x20query(progress.current)]].\x20'+'Treasury\x20withdraws\x20to\x20customer\x20with\x20PaymentInfo(for_object=order,\x20for_guard=this,\x20index=history_count_at_creation,\x20remark=node_name).\x20'+'Customer\x20submits\x20Payment\x20via\x20Passport;\x20guard\x20verifies\x20index\x20matches\x20current\x20unique\x20step\x20(progress.history\x20count,\x20U64,\x20monotonically\x20increasing\x20—\x20unique\x20even\x20in\x20cycles)\x20AND\x20remark\x20matches\x20current\x20node\x20name\x20(progress.current,\x20String\x20—\x20may\x20repeat\x20across\x20cycles\x20but\x20bound\x20to\x20this\x20step\x20by\x20index).','key_queries':['payment.info.for','payment.info.guard','payment.info.index','payment.info.remark','payment.amount','progress.history\x20count','progress.current'],'mitigated_risks':[],'applicable_industries':['rental','travel','general','freelance'],'notes':['VERIFIED:\x20payment.move#L66-71\x20(PaymentInfo:\x20for_object,\x20for_guard,\x20remark,\x20index),\x20payment.move#L82-86\x20(payment_info_with_guard)','VERIFIED:\x20treasury.move#L249-264\x20(withdraw\x20creates\x20Payment\x20via\x20payment::new_singleton\x20+\x20from_object_set)','Payment\x20is\x20freeze_object\x20(immutable,\x20payment.move#L160)\x20—\x20cannot\x20be\x20modified\x20after\x20creation','VERIFIED\x20INDEX\x20QUERY:\x20progress.history\x20count\x20(id\x201273,\x20U64)\x20—\x20guard-ins.ts#L1228-1237.\x20From\x20progress.move\x20L440-441\x20(session_accomplish\x20pushes\x20a\x20new\x20History\x20entry)\x20+\x20L475/L482\x20(parent_table_vec::length\x20returns\x20current\x20session\x20id).\x20This\x20count\x20is\x20the\x20unique\x20monotonically\x20increasing\x20step\x20index\x20—\x20even\x20in\x20cycles,\x20each\x20entry\x20has\x20a\x20different\x20count.','VERIFIED\x20NODE\x20NAME\x20QUERY:\x20progress.current\x20(id\x201253,\x20String)\x20—\x20guard-ins.ts#L1025-1032.\x20Returns\x20the\x20current\x20node\x20name.\x20A\x20node\x20CAN\x20be\x20entered\x20multiple\x20times\x20in\x20cycles,\x20so\x20node\x20name\x20alone\x20is\x20NOT\x20unique\x20—\x20it\x20MUST\x20be\x20paired\x20with\x20progress.history\x20count\x20for\x20uniqueness.','DESIGN\x20INTENT\x20(USER):\x20to\x20validate\x20index\x20(U64\x20type),\x20use\x20progress.history\x20count\x20(unique,\x20non-repeating);\x20to\x20validate\x20node\x20name\x20(may\x20repeat\x20in\x20cycles),\x20store\x20it\x20in\x20PaymentInfo.remark\x20and\x20do\x20string\x20comparison\x20with\x20progress.current.','ANTI-REUSE\x204-DIMENSIONAL\x20BINDING:\x20for_object\x20(Order)\x20+\x20for_guard\x20(Guard)\x20+\x20index\x20(unique\x20step\x20via\x20progress.history\x20count)\x20+\x20remark\x20(node\x20name\x20via\x20progress.current).\x20Same\x20Payment\x20cannot\x20be\x20reused\x20in\x20other\x20contexts\x20—\x20at\x20least\x20one\x20field\x20will\x20mismatch.','VERIFIER-EVIDENCE\x20DESIGN:\x20customer\x20submits\x20Payment,\x20guard\x20verifies\x20binding\x20fields\x20match\x20current\x20context','Enables\x20user-friendly\x20exception\x20handling:\x20delay\x20→\x20auto-compensation\x20→\x20friendly\x20branch\x20flow','No\x20affiliation\x20registration\x20needed\x20—\x20guard\x20only\x20verifies\x20submitted\x20Payment\x27s\x20field\x20accuracy']},{'id':'pattern.verifier_evidence_philosophy','business_requirement':'Guard\x20design\x20philosophy:\x20verifier\x20provides\x20evidence,\x20guard\x20verifies\x20logic\x20+\x20data\x20accuracy\x20(NOT\x20data\x20discovery)','data_source':'SubmittedObject','host':'gen_passport','verifier_level':'none','logic_summary':'Guard\x20is\x20a\x20PURE\x20VERIFICATION\x20engine.\x20Participants\x20submit\x20evidence\x20(Payment,\x20Order,\x20Proof,\x20etc.)\x20'+'via\x20Passport\x20submissions\x20(b_submission=true).\x20Guard\x20verifies:\x20(1)\x20logic\x20completeness,\x20(2)\x20data\x20usage\x20accuracy.\x20'+'Guard\x20does\x20NOT\x20discover/fetch\x20objects\x20via\x20affiliation.\x20Affiliation\x20is\x20for\x20object\x20lifecycle\x20bookkeeping,\x20'+'NOT\x20for\x20guard\x20data\x20discovery.','key_queries':[],'mitigated_risks':['R-C3-05','R-C3-06'],'notes':['CORE\x20PRINCIPLE:\x20Guard\x20only\x20validates\x20submitted\x20evidence\x20—\x20it\x20never\x20fetches\x20data\x20on\x20its\x20own','For\x20Payment\x20verification:\x20user\x20submits\x20valid\x20Payment\x20→\x20guard\x20checks\x20for_object/for_guard/index\x20match','For\x20multi-order\x20verification:\x20verifier\x20submits\x20Order\x20data\x20→\x20guard\x20checks\x20service/owner\x20relationships','For\x20Repository\x20access:\x20user\x20submits\x20Payment\x20→\x20quote_guard\x20verifies\x20→\x20impack_list\x20updated\x20→\x20data\x20query\x20passes','Type\x203\x20(SubmittedObject)\x20data\x20source\x20class\x20embodies\x20this\x20philosophy\x20—\x20b_submission=true\x20entries','This\x20pattern\x20is\x20foundational\x20for\x20all\x20guard\x20designs\x20—\x20always\x20prefer\x20verifier-evidence\x20over\x20complex\x20object\x20discovery']},{'id':'pattern.progress_state_check','business_requirement':'Specific\x20forward\x20has\x20been\x20accomplished\x20(customer\x20confirms\x20delivery)','data_source':'WitnessDerived','host':'reward_claim','verifier_level':'none','logic_summary':'logic_equal[query_progress_history_find(...).accomplished,\x20identifier[N](true)]','key_queries':['progress.current','progress.current_time'],'witness_types':['OrderProgress'],'mitigated_risks':[],'notes':['Chain\x20query_progress_history_find\x20→\x20query_progress_history_session_forward_find']},{'id':'pattern.reward_one_time_claim','business_requirement':'User\x20can\x20only\x20claim\x20reward\x20once\x20(no\x20prior\x20claims)','data_source':'OnChainConstant','host':'reward_claim','verifier_level':'none','logic_summary':'logic_equal[query_reward_record_count(recipient=Signer),\x20identifier[N](0)]','key_queries':['reward.record_count'],'mitigated_risks':[],'notes':['Record\x20count\x20check\x20prevents\x20double-claim']},{'id':'pattern.reward_multi_condition','business_requirement':'Order\x20payment\x20>\x20threshold\x20AND\x20reached\x20\x27complete\x27\x20to\x20claim\x20reward','data_source':'WitnessDerived','host':'reward_claim','verifier_level':'none','logic_summary':'logic_and[logic_as_u256_gt[query(order.amount),\x20threshold],\x20logic_equal[query(progress.current),\x20\x27complete\x27],\x20logic_equal[query(order.service),\x20identifier[N](expected_service)]]','key_queries':['order.amount','progress.current','order.service'],'witness_types':['OrderProgress'],'mitigated_risks':['R-C3-05'],'notes':['Multi-condition:\x20amount\x20+\x20progress\x20state\x20+\x20service\x20match']},{'id':'pattern.arbitration_voting_weight','business_requirement':'Vote\x20weight\x20equals\x20reputation\x20score\x20(dynamic\x20weight\x20from\x20Passport)','data_source':'SubmittedObject','host':'arbitration_voting','verifier_level':'none','logic_summary':'GuardIdentifier\x20extracts\x20numeric\x20value\x20from\x20Passport\x20submission','key_queries':[],'mitigated_risks':['R-C3-02'],'notes':['Table\x20needs\x20numeric\x20submission\x20entry\x20at\x20referenced\x20index','Weight\x20must\x20come\x20from\x20on-chain\x20EntityRegistrar,\x20not\x20submission','BINDING_01:\x20voting_guard\x20GuardIdentifier\x20must\x20be\x20numeric\x20(U8-U256)']},{'id':'pattern.arbitration_membership_check','business_requirement':'Only\x20premium\x20members\x20can\x20file\x20disputes','data_source':'OnChainConstant','host':'arbitration_usage','verifier_level':'none','logic_summary':'logic_and[query(entity\x20exists),\x20logic_as_u256_ge[query(entity\x20tier),\x20identifier[N](premium_tier)]]','key_queries':['entity.registrar','entity.linker'],'mitigated_risks':[],'notes':['ENTITY_REGISTRAR_ADDRESS\x20(0xaab)\x20/\x20ENTITY_LINKER_ADDRESS\x20(0xaaa)\x20must\x20be\x20in\x20table']},{'id':'pattern.scene_allocator_entity_recipient','business_requirement':'Service\x20allocator\x20with\x20sharing.who=Entity\x20—\x20no\x20Signer\x20binding\x20needed','data_source':'OnChainConstant','host':'service_allocator_guard','verifier_level':'level3_scene_combined','logic_summary':'Scene\x20verifies\x20fund\x20flow\x20safety\x20—\x20Guard\x20only\x20validates\x20allocation\x20rules','key_queries':['service.permission','order.amount'],'mitigated_risks':['R-C3-06'],'notes':['Funds\x20flow\x20to\x20fixed\x20Treasury/address\x20regardless\x20of\x20caller','sharing.who=Entity\x20already\x20guarantees\x20recipient\x20safety','No\x20Signer\x20binding\x20required\x20—\x20R-C3-06\x20safe']},{'id':'pattern.scene_machine_forward_operator','business_requirement':'Machine\x20forward\x20with\x20permissionIndex/namedOperator\x20already\x20verifies\x20operator','data_source':'OnChainConstant','host':'machine_forward','verifier_level':'level3_scene_combined','logic_summary':'Forward\x27s\x20permissionIndex/namedOperator\x20verifies\x20operator\x20—\x20Guard\x20only\x20validates\x20submitted\x20data','key_queries':[],'mitigated_risks':[],'notes':['Scene\x20verifies\x20operator\x20permission\x20via\x20permissionIndex/namedOperator','Signer\x20binding\x20only\x20needed\x20if\x20submitted\x20data\x20must\x20belong\x20to\x20operator','Evaluate\x20scene\x20before\x20adding\x20Signer\x20binding']}];export const VERIFIER_LEVEL_GUIDANCE=[{'level':'level1_strict_single','pattern':'logic_equal[context(Signer),\x20identifier[N](fixed_address)]','when_to_use':'Role\x20permanently\x20tied\x20to\x20one\x20address\x20AND\x20designer\x20accepts\x20lock-in\x20risk','risk_rules':['R-C4-04'],'recommendation':'avoid'},{'level':'level2_identity_set','pattern':'logic_or\x20of\x20multiple\x20identity\x20checks','when_to_use':'Role-based\x20access\x20—\x20multiple\x20authorized\x20identities','risk_rules':['R-C4-04\x20(suppressed)'],'recommendation':'recommended'},{'level':'level3_scene_combined','pattern':'Scene\x20itself\x20verifies\x20identity\x20—\x20no\x20Signer\x20binding\x20needed','when_to_use':'Scene\x27s\x20host\x20object\x20already\x20verifies\x20operator\x20(e.g.,\x20Machine\x20forward,\x20sharing.who=Entity)','risk_rules':[],'recommendation':'default'},{'level':'none','pattern':'No\x20Signer\x20binding\x20required','when_to_use':'Resource\x20flow\x20matters\x20more\x20than\x20caller\x20identity','risk_rules':[],'recommendation':'default'}];export function getGuardDesignPattern(a){return GUARD_DESIGN_PATTERNS['find'](b=>b['id']===a);}export function searchGuardDesignPatterns(a){const b=a['toLowerCase']();return GUARD_DESIGN_PATTERNS['filter'](c=>{if(c['business_requirement']['toLowerCase']()['includes'](b))return!![];if(c['logic_summary']['toLowerCase']()['includes'](b))return!![];if(c['key_queries']['some'](d=>d['toLowerCase']()['includes'](b)))return!![];return![];});}export function getPatternsByHost(a){return GUARD_DESIGN_PATTERNS['filter'](b=>b['host']===a);}export function getPatternsByIndustry(a){return GUARD_DESIGN_PATTERNS['filter'](b=>b['applicable_industries']?.['includes'](a));}export function getPatternsByDataSourceClass(a){return GUARD_DESIGN_PATTERNS['filter'](b=>b['data_source']===a);}export function getVerifierLevelGuidance(a){return VERIFIER_LEVEL_GUIDANCE['find'](b=>b['level']===a);}export function suggestPatternForRequirement(a){const b=searchGuardDesignPatterns(a);if(b['length']===0x0){const e=GUARD_DESIGN_PATTERNS[0x0];return{'best':e,'alternatives':[]};}const [c,...d]=b;return{'best':c,'alternatives':d};}export const GUARD_DESIGN_PATTERNS_VERSION=0x1;