wowok 1.0.3

package/src/guard.ts

@@ -0,0 +1,283 @@
+import { SuiObjectResponse, SuiObjectDataOptions, SuiParsedData } from '@mysten/sui.js/client';
+import { TransactionBlock, Inputs, type TransactionResult } from '@mysten/sui.js/transactions';
+import { BCS, getSuiMoveConfig, toHEX, fromHEX, BcsReader } from '@mysten/bcs';
+import { PROTOCOL, GuardAddress, FnCallType, Data_Type, MODULES, GuardObject, OBJECTS_TYPE, OBJECTS_TYPE_PREFIX, Query_Param} from './protocol';
+import { concatenate, array_equal, ulebDecode, array_unique } from './util';
+import { TransactionBlockDataBuilder } from '@mysten/sui.js/dist/cjs/builder/TransactionBlockData';
+
+export enum Guard_Sense_Binder {
+    AND = 1, // first sense of guard always AND; for combining other guards
+    OR = 2,
+}
+
+export type Guard_Sense = { 
+    input: Uint8Array; 
+    notAfterSense: boolean; 
+    binder:Guard_Sense_Binder ;
+};
+
+export type Guard_Creation = {
+    description: string;
+    senses: Guard_Sense[];
+}
+
+export function launch(txb:TransactionBlock, creation:Guard_Creation) : GuardAddress {
+    var guard = txb.moveCall({
+        target: PROTOCOL.GuardFn('new') as FnCallType,
+        arguments: [            txb.pure(creation.description , BCS.STRING),        ],  
+    });
+    creation?.senses.forEach((sense: Guard_Sense) => {
+        txb.moveCall({
+            target: PROTOCOL.GuardFn('sense_add') as FnCallType,
+            arguments:[                guard,                txb.pure([].slice.call(sense.input)),
+                txb.pure(sense.notAfterSense, BCS.BOOL),
+                txb.pure(sense.binder, BCS.U8),
+            ]
+        })
+    });
+    return txb.moveCall({
+        target:PROTOCOL.GuardFn("create") as FnCallType,
+        arguments:[guard]
+    });
+}
+
+export function signer_guard(txb:TransactionBlock) {
+    txb.moveCall({
+        target: PROTOCOL.GuardFn('signer_guard') as FnCallType,
+        arguments: []
+    }); // { kind: 'Result', index: 0 }, ref to address could used by PTB
+}
+
+export function query_description(txb:TransactionBlock, guard:GuardObject) {
+    txb.moveCall({
+        target: PROTOCOL.GuardFn('description') as FnCallType,
+        arguments:[guard]
+    })
+}
+
+export type Sense_Cmd_Type = {
+    module:MODULES, 
+    name:string, 
+    cmd:number, 
+    params:Data_Type[], 
+    result:Data_Type
+};
+
+export const Sense_Cmd:any = [    [MODULES.permission, 'creator', 1, [], Data_Type.TYPE_STATIC_address],
+    [MODULES.permission, 'is_admin', 2, [Data_Type.TYPE_STATIC_address], Data_Type.TYPE_STATIC_bool],
+    [MODULES.permission, 'has_rights', 3, [Data_Type.TYPE_STATIC_address, Data_Type.TYPE_STATIC_u64], Data_Type.TYPE_STATIC_bool],
+    [MODULES.permission, 'contains_address', 4, [Data_Type.TYPE_STATIC_address], Data_Type.TYPE_STATIC_bool],
+    [MODULES.permission, 'contains_index', 5, [Data_Type.TYPE_STATIC_address, Data_Type.TYPE_STATIC_u64], Data_Type.TYPE_STATIC_bool],
+    [MODULES.permission, 'contains_guard', 6, [Data_Type.TYPE_STATIC_address, Data_Type.TYPE_STATIC_u64], Data_Type.TYPE_STATIC_bool],
+    [MODULES.repository, 'permission', 1, [], Data_Type.TYPE_STATIC_address],
+    [MODULES.repository, 'policy_contains', 2, [Data_Type.TYPE_STATIC_vec_u8], Data_Type.TYPE_STATIC_bool],
+    [MODULES.repository, 'policy_has_permission_index', 3, [Data_Type.TYPE_STATIC_vec_u8], Data_Type.TYPE_STATIC_bool],
+    [MODULES.repository, 'policy_permission_index', 4, [Data_Type.TYPE_STATIC_vec_u8], Data_Type.TYPE_STATIC_u64],
+    [MODULES.repository, 'policy_value_type', 5, [Data_Type.TYPE_STATIC_vec_u8], Data_Type.TYPE_STATIC_u8],
+    [MODULES.repository, 'contains_id', 6, [Data_Type.TYPE_STATIC_address], Data_Type.TYPE_STATIC_bool],   
+    [MODULES.repository, 'contains_value', 7, [Data_Type.TYPE_STATIC_address, Data_Type.TYPE_STATIC_vec_u8], Data_Type.TYPE_STATIC_bool],
+    [MODULES.repository, 'value_without_type', 8, [Data_Type.TYPE_STATIC_address, Data_Type.TYPE_STATIC_vec_u8], Data_Type.TYPE_STATIC_vec_u8],       
+    [MODULES.repository, 'value', 9, [Data_Type.TYPE_STATIC_address, Data_Type.TYPE_STATIC_vec_u8], Data_Type.TYPE_STATIC_vec_u8],
+    [MODULES.repository, 'type', 10, [], Data_Type.TYPE_STATIC_u8],   
+    [MODULES.repository, 'policy_mode', 11, [], Data_Type.TYPE_STATIC_u8],   
+]
+
+export class SenseMaker {
+    protected data : Uint8Array[] = [];
+    protected type_validator : Data_Type[] = [];
+
+    constructor() { }
+    // serialize const & data
+    add_param(type:Data_Type, param?:any) : boolean {
+        const bcs = new BCS(getSuiMoveConfig());
+        switch(type)  {
+        case Data_Type.TYPE_STATIC_address: 
+            this.data.push(bcs.ser(BCS.U8, type).toBytes());
+            this.data.push(bcs.ser(BCS.ADDRESS, param).toBytes());
+            this.type_validator.push(type);
+            break;
+        case Data_Type.TYPE_STATIC_bool:
+            this.data.push(bcs.ser(BCS.U8, type).toBytes());
+            this.data.push(bcs.ser(BCS.BOOL, param).toBytes());
+            this.type_validator.push(type);
+            break;
+        case Data_Type.TYPE_STATIC_u8:
+            this.data.push(bcs.ser(BCS.U8, type).toBytes());
+            this.data.push(bcs.ser(BCS.U8, param).toBytes());
+            this.type_validator.push(type);
+            break;
+        case Data_Type.TYPE_STATIC_u64: 
+            this.data.push(bcs.ser(BCS.U8, type).toBytes());
+            this.data.push(bcs.ser(BCS.U64, param).toBytes());
+            this.type_validator.push(type);
+            break;
+        case Data_Type.TYPE_STATIC_vec_u8:
+            this.data.push(bcs.ser(BCS.U8, type).toBytes());
+            this.data.push(bcs.ser("vector<u8>", param).toBytes());
+            this.type_validator.push(type);
+            // this.data[this.data.length-1].forEach((item : number) => console.log(item))
+            break;
+        case Data_Type.TYPE_CONTEXT_SIGNER:
+            this.data.push(bcs.ser(BCS.U8, type).toBytes());
+            this.type_validator.push(Data_Type.TYPE_STATIC_address);
+            break;
+        case Data_Type.TYPE_CONTEXT_CURRENT_CLOCK:
+            this.data.push(bcs.ser(BCS.U8, type).toBytes());
+            this.type_validator.push(Data_Type.TYPE_STATIC_u64);
+            break;
+        case Data_Type.TYPE_CONTEXT_CURRENT_PROGRESS:
+            this.data.push(bcs.ser(BCS.U8, type).toBytes());
+            this.type_validator.push(Data_Type.TYPE_STATIC_address);
+            break;
+        default:
+            return false;
+        };
+        
+        return true;
+    }
+    add_cmd(object_address:string, sense_index:number) : boolean {
+        if (!object_address || sense_index >= Sense_Cmd.length) { return false; }
+        let offset = this.type_validator.length - Sense_Cmd[sense_index][3].length;
+        if (offset < 0) { 
+            return false; 
+        }
+
+        let types = this.type_validator.slice(offset);
+        if (!array_equal(types, Sense_Cmd[sense_index][3])) { // type validate 
+            return false; 
+        }
+        
+        const bcs = new BCS(getSuiMoveConfig());
+        this.data.push(bcs.ser(BCS.U8, Data_Type.TYPE_DYNAMIC_QUERY).toBytes()); // TYPE
+        this.data.push(bcs.ser(BCS.ADDRESS, object_address).toBytes()); // object address
+        this.data.push(bcs.ser(BCS.U8, Sense_Cmd[sense_index][2]).toBytes()); // cmd
+
+        this.type_validator.splice(offset, Sense_Cmd[sense_index][3].length); // delete type stack
+        this.type_validator.push(Sense_Cmd[sense_index][4]); // add the return value type to type stack
+        // console.log(this.type_validator)
+        return true;
+    }
+    add_logic(type:Data_Type) : boolean {
+        switch (type) {
+            case Data_Type.TYPE_LOGIC_OPERATOR_U128_GREATER:
+            case Data_Type.TYPE_LOGIC_OPERATOR_U128_GREATER_EQUAL:
+            case Data_Type.TYPE_LOGIC_OPERATOR_U128_LESSER:
+            case Data_Type.TYPE_LOGIC_OPERATOR_U128_LESSER_EQUAL:
+            case Data_Type.TYPE_LOGIC_OPERATOR_U128_EQUAL:
+                if (this.type_validator.length < 2)  { return false; }
+                if (!match_u128(this.type_validator[this.type_validator.length - 1])) { return false; }
+                if (!match_u128(this.type_validator[this.type_validator.length - 2])) { return false; }
+                break;
+            case Data_Type.TYPE_LOGIC_OPERATOR_EQUAL:
+            case Data_Type.TYPE_LOGIC_OPERATOR_HAS_SUBSTRING:
+                if (this.type_validator.length < 2)  { return false; }
+                break;
+            default:
+                return false;
+        }
+        const bcs = new BCS(getSuiMoveConfig());
+        this.data.push(bcs.ser(BCS.U8, type).toBytes()); // TYPE     
+        this.type_validator.splice(this.type_validator.length - 2); // delete type stack   
+        this.type_validator.push(Data_Type.TYPE_STATIC_bool); // add bool to type stack
+        return true;
+    }
+
+    make(bNotAfterSense:boolean, binder:Guard_Sense_Binder) : undefined | Guard_Sense {
+        //console.log(this.type_validator);
+        //this.data.forEach((value:Uint8Array) => console.log(value));
+        if (this.type_validator.length != 1 || this.type_validator[0] != Data_Type.TYPE_STATIC_bool) { 
+            return undefined;
+        } // ERROR
+
+        let input = concatenate(Uint8Array, ...this.data) as Uint8Array;
+        const sense:Guard_Sense = {input:input, notAfterSense:bNotAfterSense, binder:binder};
+        return sense;
+    }
+}
+
+function match_u128(type:Data_Type) : boolean {
+    if (type == Data_Type.TYPE_STATIC_option_u8 || 
+        type == Data_Type.TYPE_STATIC_option_u64 || 
+        type == Data_Type.TYPE_STATIC_option_u128 ) {
+            return true;
+    }
+    return false;
+}
+
+// parse guard senses input bytes of a guard, return [objectids] for 'query_cmd' 
+export function parse_sense_bsc(chain_sense_bsc:Uint8Array)  : undefined | string[] {
+    // console.log(data);
+    var array = [].slice.call(chain_sense_bsc.reverse());
+    const bcs = new BCS(getSuiMoveConfig());
+    var result = [];
+    while (array.length > 0) {
+        var type : unknown = array.shift() ;
+        // console.log(type);
+        switch (type as Data_Type) {
+            case Data_Type.TYPE_CONTEXT_SIGNER:
+            case Data_Type.TYPE_CONTEXT_CURRENT_CLOCK:
+            case Data_Type.TYPE_CONTEXT_CURRENT_PROGRESS:
+            case Data_Type.TYPE_LOGIC_OPERATOR_U128_GREATER:
+            case Data_Type.TYPE_LOGIC_OPERATOR_U128_GREATER_EQUAL:
+            case Data_Type.TYPE_LOGIC_OPERATOR_U128_LESSER:
+            case Data_Type.TYPE_LOGIC_OPERATOR_U128_LESSER_EQUAL:
+            case Data_Type.TYPE_LOGIC_OPERATOR_U128_EQUAL:
+            case Data_Type.TYPE_LOGIC_OPERATOR_EQUAL:
+            case Data_Type.TYPE_LOGIC_OPERATOR_HAS_SUBSTRING:
+            break;    
+        case Data_Type.TYPE_STATIC_address: 
+            //console.log('0x' + bcs.de(BCS.ADDRESS,  Uint8Array.from(array)).toString());
+            array.splice(0, 32);
+            break;
+        case Data_Type.TYPE_STATIC_bool:
+        case Data_Type.TYPE_STATIC_u8:
+            array.splice(0, 1);
+            break;
+        case Data_Type.TYPE_STATIC_u64: 
+            array.splice(0, 8);
+            break;
+        case Data_Type.TYPE_STATIC_u128: 
+            array.splice(0, 16);
+            break;
+        case Data_Type.TYPE_STATIC_vec_u8:
+            let {value, length} = ulebDecode(Uint8Array.from(array));
+            array.splice(0, value+length);
+            break;     
+        case Data_Type.TYPE_DYNAMIC_QUERY:
+            result.push('0x' + bcs.de(BCS.ADDRESS,  Uint8Array.from(array)).toString());
+            array.splice(0, 33); // address + cmd
+            break;
+        default:
+            // console.log('parse_sense_bsc:undefined');
+            return undefined; // error
+        }
+    } 
+    return result;
+}
+
+const MODULE_GUARD_INDEX = 7;
+export const description_fn = (response:SuiObjectResponse, param:Query_Param, option:SuiObjectDataOptions) => {
+    if (!response.error) {
+        let c = response?.data?.content as any;
+        if (c.type == OBJECTS_TYPE[MODULE_GUARD_INDEX] && c.fields.id.id == param.objectid) { // GUARD OBJECT
+            let description = c.fields.description;
+            if (!param.data.includes(description)) {
+                param.data.push(description);
+            }
+        }        
+    }
+}
+export const sense_objects_fn = (response:SuiObjectResponse, param:Query_Param, option:SuiObjectDataOptions) => {
+    if (!response.error) {
+        let c = response?.data?.content as any;
+        if (c.type == OBJECTS_TYPE[MODULE_GUARD_INDEX] && c.fields.id.id == param.objectid) { // GUARD OBJECT
+            for (let i = 0; i < c.fields.senses.length; i ++) {
+                let sense = c.fields.senses[i];
+                if (sense.type == (OBJECTS_TYPE_PREFIX[MODULE_GUARD_INDEX] + 'Sense')) { // ...::guard::Sense                    
+                    let ids = parse_sense_bsc(Uint8Array.from(sense.fields.input.fields.bytes)) as string[];
+                    param.data = array_unique(param.data.concat(ids));
+                }                         
+            }
+        } 
+    }
+}

package/src/machine.ts

@@ -0,0 +1,257 @@
+import { TransactionBlock, Inputs, type TransactionResult } from '@mysten/sui.js/transactions';
+import { BCS } from '@mysten/bcs';
+import { name_data, CLOCK_OBJECT, PROTOCOL, FnCallType, description_data, MAX_ENDPOINT_LENGTH} from './protocol';
+import { verify,  PassportObject} from './passport'
+import { PermissionIndex, PermissionObject } from './permission'
+import { RepositoryObject } from './repository';
+import { BCS_CONVERT } from './util'
+
+
+export type MachineAddress = TransactionResult;
+export type MachineObject = TransactionResult;
+export type MachineNodeObject = TransactionResult;
+
+export const INITIAL_NODE_NAME = '';
+
+export type Machine_Forward = {
+    name: string; // foward name
+    namedOperator?: string; 
+    permission?: number; // permission-index or named-operator MUST one defined.
+    weight?: number;
+    guard_address?: string;
+}
+export type Machine_Node_Pair = {
+    prior_node: string;
+    threshold: number;
+    forwards: Machine_Forward[];
+}
+export type Machine_Node = {
+    name: string;
+    description: string;
+    pairs: Machine_Node_Pair[];
+}
+
+// node & forward & forward permission string length validation
+export function is_valid_name(name:string):boolean { return name.length > 0 && name.length < 33 }
+
+// 创建新的node加入到machine
+export function machine_add_node(txb:TransactionBlock, machine:MachineObject, permission:PermissionObject, nodes:Machine_Node[], passport?:PassportObject) {
+    let new_nodes: MachineNodeObject[] = [];
+    nodes.forEach((node) => {
+        let n = txb.moveCall({
+            target:PROTOCOL.NodeFn('new') as FnCallType,
+            arguments:[txb.pure(name_data(node.name)), txb.pure(description_data(node.description))]
+        });
+        node.pairs.forEach((pair) => {
+            pair.forwards.forEach((forward) => {
+                if (!forward?.namedOperator && !forward?.permission) { return }
+                let weight = txb.pure(1); 
+                if (forward?.weight && forward.weight >  0) { 
+                    weight = txb.pure(forward.weight) 
+                }
+                
+                let per = txb.pure([], BCS.U8); 
+                if (forward?.permission) {
+                    per = txb.pure(BCS_CONVERT.ser_option_u64(forward.permission as number));
+                }; 
+                let namedOperator = txb.pure('');
+                if (forward?.namedOperator) {
+                    namedOperator = txb.pure(forward.namedOperator)
+                }; let f;
+
+                if (forward?.guard_address) {
+                    f = txb.moveCall({ 
+                        target:PROTOCOL.NodeFn('forward') as FnCallType,
+                            arguments:[namedOperator, weight, txb.object(forward.guard_address), per]
+                    });                        
+                } else {
+                    f = txb.moveCall({ 
+                        target:PROTOCOL.NodeFn('forward2') as FnCallType,
+                            arguments:[namedOperator, weight, per]
+                    });                
+                }
+                txb.moveCall({ // add forward
+                    target:PROTOCOL.NodeFn('forward_add') as FnCallType,
+                        arguments:[n, txb.pure(pair.prior_node), txb.pure(name_data(forward.name)),  
+                            txb.pure(BCS_CONVERT.ser_option_u64(pair.threshold)), f]
+                });                
+            }); 
+        }); 
+        new_nodes.push(n); 
+    }); machine_add_node2(txb, machine, permission, new_nodes, passport)
+}
+// 把个人拥有的node加入到machine
+export function machine_add_node2(txb:TransactionBlock, machine:MachineObject, permission:PermissionObject, nodes:MachineNodeObject[], passport?:PassportObject) {
+    if (passport) {
+        txb.moveCall({ // add node
+            target:PROTOCOL.MachineFn('node_add_with_passport') as FnCallType,
+            arguments:[passport, machine, txb.makeMoveVec({objects:nodes}), permission]
+        });     
+    } else {
+        txb.moveCall({ // add node
+            target:PROTOCOL.MachineFn('node_add') as FnCallType,
+            arguments:[machine, txb.makeMoveVec({objects:nodes}), permission]
+        });     
+    }    
+}
+// 从machine把node移动到个人地址
+export function machine_remove_node(txb:TransactionBlock, machine:MachineObject, permission:TransactionResult, nodes_name:string[], receive_address:string, passport?:PassportObject) {
+    if (passport) {
+        txb.moveCall({
+            target:PROTOCOL.MachineFn('node_remove_with_passport') as FnCallType,
+            arguments:[passport, machine, txb.pure(BCS_CONVERT.ser_vector_string(nodes_name)), permission],
+        });  
+    } else {
+        txb.moveCall({
+            target:PROTOCOL.MachineFn('node_remove') as FnCallType,
+            arguments:[machine, txb.pure(BCS_CONVERT.ser_vector_string(nodes_name)), permission],
+        });
+    } 
+}
+export function machine(txb:TransactionBlock, permission:PermissionObject, description:string, endpoint_url?:string, passport?:PassportObject) : MachineObject | undefined {
+    if (endpoint_url && endpoint_url.length > MAX_ENDPOINT_LENGTH) return undefined;
+    let endpoint = endpoint_url? txb.pure(BCS_CONVERT.ser_option_string(endpoint_url)) : txb.pure([], BCS.U8);
+
+    if (passport) {
+        return txb.moveCall({
+            target:PROTOCOL.MachineFn('new_with_passport') as FnCallType,
+            arguments:[passport, txb.pure(description_data(description)), endpoint, permission],
+        })
+    } else {
+        //console.log(endpoint)
+        return txb.moveCall({
+            target:PROTOCOL.MachineFn('new') as FnCallType,
+            arguments:[txb.pure(description_data(description)), endpoint, permission],
+        })
+    }
+}
+export function destroy(txb:TransactionBlock, machine:MachineObject) {
+    return txb.moveCall({
+        target:PROTOCOL.MachineFn('destroy') as FnCallType,
+        arguments: [machine],
+    })   
+}
+export function launch(txb:TransactionBlock, machine:MachineObject) : MachineAddress {
+    return txb.moveCall({
+        target:PROTOCOL.MachineFn('create') as FnCallType,
+        arguments:[machine],
+    })
+}
+export function machine_set_description(txb:TransactionBlock, machine:MachineObject, permission:PermissionObject, description:string, passport?:PassportObject) {
+    if (passport) {
+        txb.moveCall({
+            target:PROTOCOL.MachineFn('description_set_with_passport') as FnCallType,
+            arguments:[passport, machine, txb.pure(description_data(description)), permission],
+        })
+    } else {
+        txb.moveCall({
+            target:PROTOCOL.MachineFn('description_set') as FnCallType,
+            arguments:[machine, txb.pure(description_data(description)), permission],
+        })
+    }
+}
+export function machine_add_repository(txb:TransactionBlock, machine:MachineObject, permission:PermissionObject, repository:RepositoryObject, passport?:PassportObject) {
+    if (passport) {
+        txb.moveCall({
+            target:PROTOCOL.MachineFn('repository_add_with_passport') as FnCallType,
+            arguments:[passport, machine, repository, permission],
+        })
+    } else {
+        txb.moveCall({
+            target:PROTOCOL.MachineFn('repository_add') as FnCallType,
+            arguments:[machine, repository, permission],
+        })
+    }
+}
+
+export function machine_remove_repository(txb:TransactionBlock, machine:MachineObject, permission:PermissionObject, repositories:string[], removeall?:boolean, passport?:PassportObject) {
+    if (passport) {
+        if (removeall) {
+            txb.moveCall({
+                target:PROTOCOL.MachineFn('repository_remove_all_with_passport') as FnCallType,
+                arguments:[passport, machine, permission],
+            })
+        } else {
+            txb.moveCall({
+                target:PROTOCOL.MachineFn('repository_remove_with_passport') as FnCallType,
+                arguments:[passport, machine, txb.pure(repositories, 'vector<address>'), permission],
+            })
+        }   
+    } else {
+        if (removeall) {
+            txb.moveCall({
+                target:PROTOCOL.MachineFn('repository_remove_all') as FnCallType,
+                arguments:[machine, permission],
+            })
+        } else {
+            txb.moveCall({
+                target:PROTOCOL.MachineFn('repository_remove') as FnCallType,
+                arguments:[machine, txb.pure(repositories, 'vector<address>'), permission],
+            })
+        }   
+    }     
+}
+
+export function machine_clone(txb:TransactionBlock, machine:MachineObject, permission:PermissionObject, passport?:PassportObject) : MachineObject {
+    if (passport) {
+        return txb.moveCall({
+            target:PROTOCOL.MachineFn('clone_with_passport') as FnCallType,
+            arguments:[passport, machine, permission],
+        })
+    } else {
+        return txb.moveCall({
+            target:PROTOCOL.MachineFn('clone') as FnCallType,
+            arguments:[machine, permission],
+        })
+    }
+}
+export function machine_set_endpoint(txb:TransactionBlock, machine:MachineObject, permission:PermissionObject, endpoint_url?:string, passport?:PassportObject) {
+    if (endpoint_url && endpoint_url.length > MAX_ENDPOINT_LENGTH) return undefined;
+    let endpoint = endpoint_url? txb.pure(BCS_CONVERT.ser_option_string(endpoint_url)) : txb.pure([], BCS.U8);
+
+    if (passport) {
+        txb.moveCall({
+            target:PROTOCOL.MachineFn('endpoint_set_with_passport') as FnCallType,
+            arguments:[passport, machine, endpoint, permission],
+        })
+    } else {
+        txb.moveCall({
+            target:PROTOCOL.MachineFn('endpoint_set') as FnCallType,
+            arguments:[machine, endpoint, permission],
+        })
+    }
+}
+export function machine_pause(txb:TransactionBlock, machine:MachineObject, permission:PermissionObject, bPaused:boolean, passport?:PassportObject) {
+    if (passport) {
+        txb.moveCall({
+            target:PROTOCOL.MachineFn('pause_with_passport') as FnCallType,
+            arguments:[passport, machine, txb.pure(bPaused), permission],
+        })
+    } else {
+        txb.moveCall({
+            target:PROTOCOL.MachineFn('pause') as FnCallType,
+            arguments:[machine, txb.pure(bPaused), permission],
+        })
+    }
+}
+export function machine_publish(txb:TransactionBlock, machine:MachineObject, permission:PermissionObject, passport?:PassportObject) {
+    if (passport) {
+        txb.moveCall({
+            target:PROTOCOL.MachineFn('publish_with_passport') as FnCallType,
+            arguments:[passport, machine, permission],
+        })
+    } else {
+        txb.moveCall({
+            target:PROTOCOL.MachineFn('publish') as FnCallType,
+            arguments:[machine, permission],
+        })
+    }
+}
+
+export function change_permission(txb:TransactionBlock, machine:MachineObject, old_permission:PermissionObject, new_permission:PermissionObject) {
+    txb.moveCall({
+        target:PROTOCOL.MachineFn('permission_set') as FnCallType,
+        arguments: [machine, old_permission, new_permission],
+        typeArguments:[]            
+    })    
+}

package/src/passport.ts

@@ -0,0 +1,110 @@
+import { SuiObjectResponse, SuiObjectDataOptions } from '@mysten/sui.js/client';
+import { TransactionBlock, TransactionResult, type TransactionObjectInput, Inputs } from '@mysten/sui.js/transactions';
+import { PROTOCOL, FnCallType, CLOCK_OBJECT, Query_Param, OBJECTS_TYPE, OBJECTS_TYPE_PREFIX} from './protocol';
+import { parse_object_type, array_unique } from './util';
+import { sense_objects_fn } from './guard';
+
+export const MAX_GUARD_COUNT = 4;
+
+// passport verify for some guards, MUST be in ONE pxb:
+// 0. construct Guard_Query_Objects(passport_quries) from queries for guards of objects
+// 1. create passport
+// 2. add all guards
+// 3. verify passport
+// 4. ops using passport(guard set on object)
+// 5. ops using passport(guard set on object)
+// 6. destroy passport
+
+export type PassportObject = TransactionResult;
+
+export const passport_quries = async (guards:string[]) : Promise<Guard_Query_Object[]> => {
+    let sense_objects = guards.map((value) => {
+        return {objectid:value, callback:sense_objects_fn, data:[]} as Query_Param
+    });
+    await PROTOCOL.Query(sense_objects); // objects need quering in guards
+    let sense_objects_result:string[] = [];
+    sense_objects.forEach((value) => {
+        sense_objects_result = sense_objects_result.concat(value.data);
+    });
+    sense_objects_result = array_unique(sense_objects_result);
+    console.log(sense_objects_result);
+
+    let queries = sense_objects_result.map((value) => { 
+        return {objectid:value, callback:query_cmd_fn} as Query_Param;
+    })
+    await PROTOCOL.Query(queries, {'showType':true}); // queries for passport verifing
+    return queries.map((value) => {
+        return value.data as Guard_Query_Object;
+    })
+}
+// return passport object for using
+export function verify(txb:TransactionBlock, passport_queries:Guard_Query_Object[]) : PassportObject | undefined {
+    if (passport_queries.length == 0 || passport_queries.length > MAX_GUARD_COUNT) {
+        return undefined;
+    }
+    let guard_ids = passport_queries.map((value)=>value.id);
+    var passport = txb.moveCall({
+        target: PROTOCOL.PassportFn('new') as FnCallType,
+        arguments: [ txb.object(guard_ids[0]), txb.object(CLOCK_OBJECT)]
+    });
+
+    // add others guards, if any
+    for (let i = 1; i < guard_ids.length; i++) {
+        txb.moveCall({
+            target:PROTOCOL.PassportFn('guard_add') as FnCallType,
+            arguments:[passport, txb.object(guard_ids[i])]
+        });
+    }
+
+    // rules: 'verify' & 'query' in turns；'verify' at final end.
+    for (let i = 0; i < passport_queries.length; i++) {
+        txb.moveCall({
+            target: PROTOCOL.PassportFn('passport_verify') as FnCallType,
+            arguments: [ passport ]
+        }); 
+        txb.moveCall({
+            target: passport_queries[i].target as FnCallType,
+            arguments: [ txb.object(passport_queries[i].object), passport ],
+            typeArguments: passport_queries[i].types,
+        })
+    }
+    txb.moveCall({
+        target: PROTOCOL.PassportFn('passport_verify') as FnCallType,
+        arguments: [ passport ]
+    });     
+
+    return passport;
+}
+
+export function destroy(txb:TransactionBlock, passport:PassportObject) {
+    txb.moveCall({
+        target: PROTOCOL.PassportFn('destroy') as FnCallType,
+        arguments: [ passport ]
+    });  
+}
+
+export type Guard_Query_Object = {
+    target: FnCallType,
+    object: TransactionObjectInput,
+    types: string[],
+    id: string,
+}
+
+// construct Guard_Query_Object of wowok objects for passport verify
+export const query_cmd_fn = (response:SuiObjectResponse, param:Query_Param, option:SuiObjectDataOptions) => {
+    if (!response.error && response.data?.objectId == param.objectid && response.data?.type) {
+        for (let k = 0; k < OBJECTS_TYPE.length; k++) {
+            if (response?.data?.type.includes(OBJECTS_TYPE[k]) ) { // type: pack::m::Object<...>
+                param.data = { target:OBJECTS_TYPE_PREFIX[k] + 'guard_query' as FnCallType,
+                    object:Inputs.SharedObjectRef({
+                        objectId: param.objectid,
+                        mutable: false,
+                        initialSharedVersion: response.data!.version,
+                    }) as TransactionObjectInput,
+                    types:parse_object_type(response?.data?.type as string),
+                    id: param.objectid,
+                } as Guard_Query_Object;
+            }
+        }
+    }
+}