@ottochain/sdk 2.2.5 → 2.4.0

package/dist/cjs/apps/governance/state-machines/governance-simple.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.govSimpleDef = void 0;
 const fiber_app_js_1 = require("../../../schema/fiber-app.js");
+const guards_js_1 = require("../../../schema/guards.js");
 /**
  * Simple org governance: manage members, update rules, resolve disputes.
  */
@@ -92,11 +93,8 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
             },
         },
         finalize: {
-            description: "Finalize the voting period",
-            required: ["forCount"],
-            properties: {
-                forCount: { type: "number" },
-            },
+            description: "Finalize the voting period (for-count derived from recorded ballots)",
+            properties: {},
         },
         file_dispute: {
             description: "File a dispute against a member",
@@ -125,18 +123,47 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
             },
         },
         dissolve: {
-            description: "Dissolve the organization (requires 90% approval)",
-            required: ["approvalCount"],
-            properties: {
-                approvalCount: { type: "number" },
-            },
+            description: "Dissolve the organization (requires every member to sign this op — verified unanimity)",
+            properties: {},
         },
     },
     states: {
-        ACTIVE: { id: "ACTIVE", isFinal: false, metadata: null },
-        VOTING: { id: "VOTING", isFinal: false, metadata: null },
-        DISPUTE: { id: "DISPUTE", isFinal: false, metadata: null },
-        DISSOLVED: { id: "DISSOLVED", isFinal: true, metadata: null },
+        ACTIVE: {
+            id: "ACTIVE",
+            isFinal: false,
+            metadata: {
+                label: "Active",
+                description: "Governance is idle and ready to accept a proposal",
+                category: "initial",
+            },
+        },
+        VOTING: {
+            id: "VOTING",
+            isFinal: false,
+            metadata: {
+                label: "Voting",
+                description: "A proposal is open for voting",
+                category: "pending",
+            },
+        },
+        DISPUTE: {
+            id: "DISPUTE",
+            isFinal: false,
+            metadata: {
+                label: "Dispute",
+                description: "A proposal outcome is being disputed",
+                category: "pending",
+            },
+        },
+        DISSOLVED: {
+            id: "DISSOLVED",
+            isFinal: true,
+            metadata: {
+                label: "Dissolved",
+                description: "Governance entity dissolved (terminal)",
+                category: "terminal",
+            },
+        },
     },
     initialState: "ACTIVE",
     transitions: [
@@ -145,16 +172,16 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "ACTIVE",
             to: "ACTIVE",
             eventName: "add_member",
-            guard: { in: [{ var: "event.agent" }, { var: "state.admins" }] },
+            guard: (0, guards_js_1.signerInSet)("state.admins"),
             effect: {
                 merge: [
                     { var: "state" },
                     {
                         members: {
-                            setKey: [
+                            set: [
                                 { var: "state.members" },
                                 { var: "event.member" },
-                                { role: { var: "event.role" }, addedAt: { var: "$timestamp" } },
+                                { role: { var: "event.role" }, addedAt: { var: "$ordinal" } },
                             ],
                         },
                     },
@@ -167,13 +194,13 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "ACTIVE",
             to: "ACTIVE",
             eventName: "remove_member",
-            guard: { in: [{ var: "event.agent" }, { var: "state.admins" }] },
+            guard: (0, guards_js_1.signerInSet)("state.admins"),
             effect: {
                 merge: [
                     { var: "state" },
                     {
                         members: {
-                            deleteKey: [{ var: "state.members" }, { var: "event.member" }],
+                            unset: [{ var: "state.members" }, { var: "event.member" }],
                         },
                     },
                 ],
@@ -185,7 +212,9 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "ACTIVE",
             to: "VOTING",
             eventName: "propose",
-            guard: { getKey: [{ var: "state.members" }, { var: "event.agent" }] },
+            // S1/A2 coupled fix: a CHAIN-VERIFIED signer must be a member (getKey is not a
+            // JLVM opcode; signerHasEntry checks signer ∈ keys(state.members) via `has`).
+            guard: (0, guards_js_1.signerHasEntry)("state.members"),
             effect: {
                 merge: [
                     { var: "state" },
@@ -195,9 +224,9 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
                             type: { var: "event.type" },
                             changes: { var: "event.changes" },
                             proposer: { var: "event.agent" },
-                            proposedAt: { var: "$timestamp" },
+                            proposedAt: { var: "$ordinal" },
                             deadline: {
-                                "+": [{ var: "$timestamp" }, { var: "state.votingPeriodMs" }],
+                                "+": [{ var: "$ordinal" }, { var: "state.votingPeriodMs" }],
                             },
                         },
                         votes: {},
@@ -211,12 +240,14 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "VOTING",
             to: "VOTING",
             eventName: "vote",
+            // S1/A2 coupled fix: bind event.agent to a verified signer who is a member (actorHasEntry),
+            // and block a re-vote by that SAME bound actor — so the ballot is recorded under, and deduped
+            // on, the chain-verified voter. Without the binding, signerHasEntry only proves SOME signer is a
+            // member, letting one member stuff votes under arbitrary keys (set is the rc.5 map-write opcode).
             guard: {
                 and: [
-                    { getKey: [{ var: "state.members" }, { var: "event.agent" }] },
-                    {
-                        "!": [{ getKey: [{ var: "state.votes" }, { var: "event.agent" }] }],
-                    },
+                    (0, guards_js_1.actorHasEntry)("state.members"),
+                    { "!": [{ has: [{ var: "state.votes" }, { var: "event.agent" }] }] },
                 ],
             },
             effect: {
@@ -224,10 +255,10 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
                     { var: "state" },
                     {
                         votes: {
-                            setKey: [
+                            set: [
                                 { var: "state.votes" },
                                 { var: "event.agent" },
-                                { vote: { var: "event.vote" }, votedAt: { var: "$timestamp" } },
+                                { vote: { var: "event.vote" }, votedAt: { var: "$ordinal" } },
                             ],
                         },
                     },
@@ -240,12 +271,24 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "VOTING",
             to: "ACTIVE",
             eventName: "finalize",
+            // S2/A2 coupled fix: the for-count is DERIVED from recorded ballots in
+            // state.votes (length of the "for" entries), never read from the attacker's
+            // event.forCount. members is a Map so its count is length(keys(members)).
             guard: {
                 ">=": [
-                    { var: "event.forCount" },
+                    {
+                        length: [
+                            {
+                                filter: [
+                                    { values: [{ var: "state.votes" }] },
+                                    { "===": [{ var: "vote" }, "for"] },
+                                ],
+                            },
+                        ],
+                    },
                     {
                         "*": [
-                            { size: { var: "state.members" } },
+                            { length: [{ keys: [{ var: "state.members" }] }] },
                             { var: "state.passingThreshold" },
                         ],
                     },
@@ -269,7 +312,7 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
                                         type: "rule_change",
                                         proposal: { var: "state.proposal" },
                                         outcome: "passed",
-                                        finalizedAt: { var: "$timestamp" },
+                                        finalizedAt: { var: "$ordinal" },
                                     },
                                 ],
                             ],
@@ -286,12 +329,23 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "VOTING",
             to: "ACTIVE",
             eventName: "finalize",
+            // S2/A2 coupled fix (failed arm): derive the for-count from recorded ballots in
+            // state.votes; never from event.forCount. members count = length(keys(members)).
             guard: {
                 "<": [
-                    { var: "event.forCount" },
+                    {
+                        length: [
+                            {
+                                filter: [
+                                    { values: [{ var: "state.votes" }] },
+                                    { "===": [{ var: "vote" }, "for"] },
+                                ],
+                            },
+                        ],
+                    },
                     {
                         "*": [
-                            { size: { var: "state.members" } },
+                            { length: [{ keys: [{ var: "state.members" }] }] },
                             { var: "state.passingThreshold" },
                         ],
                     },
@@ -309,7 +363,7 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
                                         type: "rule_change",
                                         proposal: { var: "state.proposal" },
                                         outcome: "failed",
-                                        finalizedAt: { var: "$timestamp" },
+                                        finalizedAt: { var: "$ordinal" },
                                     },
                                 ],
                             ],
@@ -326,7 +380,9 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "ACTIVE",
             to: "DISPUTE",
             eventName: "file_dispute",
-            guard: { getKey: [{ var: "state.members" }, { var: "event.agent" }] },
+            // S1/A2 coupled fix: only a CHAIN-VERIFIED member may file (getKey is not a JLVM
+            // opcode; signerHasEntry checks signer ∈ keys(state.members) via `has`).
+            guard: (0, guards_js_1.signerHasEntry)("state.members"),
             effect: {
                 merge: [
                     { var: "state" },
@@ -336,7 +392,7 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
                             plaintiff: { var: "event.agent" },
                             defendant: { var: "event.defendant" },
                             claim: { var: "event.claim" },
-                            filedAt: { var: "$timestamp" },
+                            filedAt: { var: "$ordinal" },
                             evidence: [],
                         },
                         votes: {},
@@ -350,16 +406,10 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "DISPUTE",
             to: "DISPUTE",
             eventName: "submit_evidence",
-            guard: {
-                or: [
-                    {
-                        "===": [{ var: "event.agent" }, { var: "state.dispute.plaintiff" }],
-                    },
-                    {
-                        "===": [{ var: "event.agent" }, { var: "state.dispute.defendant" }],
-                    },
-                ],
-            },
+            guard: (0, guards_js_1.signerIsAnyParty)([
+                "state.dispute.plaintiff",
+                "state.dispute.defendant",
+            ]),
             effect: {
                 merge: [
                     { var: "state" },
@@ -375,7 +425,7 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
                                                 {
                                                     from: { var: "event.agent" },
                                                     content: { var: "event.content" },
-                                                    at: { var: "$timestamp" },
+                                                    at: { var: "$ordinal" },
                                                 },
                                             ],
                                         ],
@@ -393,18 +443,16 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "DISPUTE",
             to: "DISPUTE",
             eventName: "vote",
+            // S1/A2 coupled fix: bind event.agent to a verified member (actorHasEntry), exclude the parties,
+            // and block a re-vote by that SAME bound actor — so the dispute ballot is recorded under, and
+            // deduped on, the chain-verified voter (set is the rc.5 map-write opcode; signerIsNotParty still
+            // excludes any signer who is a party, which covers the bound actor).
             guard: {
                 and: [
-                    { getKey: [{ var: "state.members" }, { var: "event.agent" }] },
-                    {
-                        "!==": [{ var: "event.agent" }, { var: "state.dispute.plaintiff" }],
-                    },
-                    {
-                        "!==": [{ var: "event.agent" }, { var: "state.dispute.defendant" }],
-                    },
-                    {
-                        "!": [{ getKey: [{ var: "state.votes" }, { var: "event.agent" }] }],
-                    },
+                    (0, guards_js_1.actorHasEntry)("state.members"),
+                    (0, guards_js_1.signerIsNotParty)("state.dispute.plaintiff"),
+                    (0, guards_js_1.signerIsNotParty)("state.dispute.defendant"),
+                    { "!": [{ has: [{ var: "state.votes" }, { var: "event.agent" }] }] },
                 ],
             },
             effect: {
@@ -412,12 +460,12 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
                     { var: "state" },
                     {
                         votes: {
-                            setKey: [
+                            set: [
                                 { var: "state.votes" },
                                 { var: "event.agent" },
                                 {
                                     ruling: { var: "event.ruling" },
-                                    votedAt: { var: "$timestamp" },
+                                    votedAt: { var: "$ordinal" },
                                 },
                             ],
                         },
@@ -431,9 +479,11 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "DISPUTE",
             to: "ACTIVE",
             eventName: "resolve",
+            // A2 fix: count recorded ballots. votes is a Map, and `length` rejects Maps, so
+            // count its keys: length(keys(state.votes)). (size is not a JLVM opcode.)
             guard: {
                 ">=": [
-                    { size: { var: "state.votes" } },
+                    { length: [{ keys: [{ var: "state.votes" }] }] },
                     { var: "state.disputeQuorum" },
                 ],
             },
@@ -450,7 +500,7 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
                                         dispute: { var: "state.dispute" },
                                         ruling: { var: "event.ruling" },
                                         remedy: { var: "event.remedy" },
-                                        resolvedAt: { var: "$timestamp" },
+                                        resolvedAt: { var: "$ordinal" },
                                     },
                                 ],
                             ],
@@ -467,14 +517,28 @@ exports.govSimpleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "ACTIVE",
             to: "DISSOLVED",
             eventName: "dissolve",
+            // S2/A2 coupled fix: dissolution must not trust an attacker-supplied
+            // approvalCount. Derive consent from the CHAIN-VERIFIED signers — every member
+            // (a key in state.members) must be among proofs[].address, with a non-empty
+            // belt. members is a Map, so iterate keys(members); size is not a JLVM opcode.
             guard: {
-                ">=": [
-                    { var: "event.approvalCount" },
-                    { "*": [{ size: { var: "state.members" } }, 0.9] },
+                and: [
+                    { ">": [{ length: [{ keys: [{ var: "state.members" }] }] }, 0] },
+                    {
+                        all: [
+                            { keys: [{ var: "state.members" }] },
+                            {
+                                in: [
+                                    { var: "" },
+                                    { map: [{ var: "proofs" }, { var: "address" }] },
+                                ],
+                            },
+                        ],
+                    },
                 ],
             },
             effect: {
-                merge: [{ var: "state" }, { dissolvedAt: { var: "$timestamp" } }],
+                merge: [{ var: "state" }, { dissolvedAt: { var: "$ordinal" } }],
             },
             dependencies: [],
         },

package/dist/cjs/apps/governance/state-machines/governance-universal.js

@@ -52,9 +52,33 @@ exports.govUniversalDef = (0, fiber_app_js_1.defineFiberApp)({
         },
     },
     states: {
-        ACTIVE: { id: "ACTIVE", isFinal: false, metadata: null },
-        VOTING: { id: "VOTING", isFinal: false, metadata: null },
-        DISSOLVED: { id: "DISSOLVED", isFinal: true, metadata: null },
+        ACTIVE: {
+            id: "ACTIVE",
+            isFinal: false,
+            metadata: {
+                label: "Active",
+                description: "Governance is idle and ready to accept a proposal",
+                category: "initial",
+            },
+        },
+        VOTING: {
+            id: "VOTING",
+            isFinal: false,
+            metadata: {
+                label: "Voting",
+                description: "A proposal is open for voting",
+                category: "pending",
+            },
+        },
+        DISSOLVED: {
+            id: "DISSOLVED",
+            isFinal: true,
+            metadata: {
+                label: "Dissolved",
+                description: "Governance entity dissolved (terminal)",
+                category: "terminal",
+            },
+        },
     },
     initialState: "ACTIVE",
     transitions: [
@@ -69,7 +93,7 @@ exports.govUniversalDef = (0, fiber_app_js_1.defineFiberApp)({
                     {
                         status: "VOTING",
                         proposal: { var: "event.proposal" },
-                        proposedAt: { var: "$timestamp" },
+                        proposedAt: { var: "$ordinal" },
                         votes: {},
                     },
                 ],
@@ -128,7 +152,7 @@ exports.govUniversalDef = (0, fiber_app_js_1.defineFiberApp)({
                     { var: "state" },
                     {
                         status: "DISSOLVED",
-                        dissolvedAt: { var: "$timestamp" },
+                        dissolvedAt: { var: "$ordinal" },
                     },
                 ],
             },

package/dist/cjs/apps/identity/constants.js

@@ -7,7 +7,11 @@
  * @packageDocumentation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getReputationDelta = exports.canTransition = exports.ATTESTATION_DELTAS = exports.AGENT_TRANSITIONS = exports.IDENTITY_TRANSITIONS = void 0;
+exports.REGISTRY_ROLE_MAP = exports.REGISTRY_ROLES = exports.ATTESTATION_DELTAS = exports.AGENT_TRANSITIONS = exports.IDENTITY_TRANSITIONS = void 0;
+exports.registryRolePath = registryRolePath;
+exports.registryReputationPath = registryReputationPath;
+exports.canTransition = canTransition;
+exports.getReputationDelta = getReputationDelta;
 const identity_js_1 = require("../../generated/ottochain/apps/identity/v1/identity.js");
 const attestation_js_1 = require("../../generated/ottochain/apps/identity/v1/attestation.js");
 // ---------------------------------------------------------------------------
@@ -19,25 +23,25 @@ const attestation_js_1 = require("../../generated/ottochain/apps/identity/v1/att
  * Note: Some transitions are type-specific (agent vs oracle)
  */
 exports.IDENTITY_TRANSITIONS = {
-    [identity_js_1.IdentityState.IDENTITY_STATE_UNSPECIFIED]: [],
-    [identity_js_1.IdentityState.IDENTITY_STATE_UNREGISTERED]: ["register"],
-    [identity_js_1.IdentityState.IDENTITY_STATE_REGISTERED]: ["activate", "withdraw"],
-    [identity_js_1.IdentityState.IDENTITY_STATE_ACTIVE]: [
+    [identity_js_1.State.IDENTITY_STATE_UNSPECIFIED]: [],
+    [identity_js_1.State.IDENTITY_STATE_UNREGISTERED]: ["register"],
+    [identity_js_1.State.IDENTITY_STATE_REGISTERED]: ["activate", "withdraw"],
+    [identity_js_1.State.IDENTITY_STATE_ACTIVE]: [
         "challenge",
         "slash",
         "deactivate",
         "withdraw",
     ],
-    [identity_js_1.IdentityState.IDENTITY_STATE_CHALLENGED]: [
+    [identity_js_1.State.IDENTITY_STATE_CHALLENGED]: [
         "uphold_challenge",
         "dismiss_challenge",
     ],
-    [identity_js_1.IdentityState.IDENTITY_STATE_SUSPENDED]: ["begin_probation"],
-    [identity_js_1.IdentityState.IDENTITY_STATE_PROBATION]: ["complete_probation"],
-    [identity_js_1.IdentityState.IDENTITY_STATE_SLASHED]: ["reactivate", "withdraw"],
-    [identity_js_1.IdentityState.IDENTITY_STATE_INACTIVE]: ["activate", "withdraw"],
-    [identity_js_1.IdentityState.IDENTITY_STATE_WITHDRAWN]: [], // Terminal state
-    [identity_js_1.IdentityState.UNRECOGNIZED]: [],
+    [identity_js_1.State.IDENTITY_STATE_SUSPENDED]: ["begin_probation"],
+    [identity_js_1.State.IDENTITY_STATE_PROBATION]: ["complete_probation"],
+    [identity_js_1.State.IDENTITY_STATE_SLASHED]: ["reactivate", "withdraw"],
+    [identity_js_1.State.IDENTITY_STATE_INACTIVE]: ["activate", "withdraw"],
+    [identity_js_1.State.IDENTITY_STATE_WITHDRAWN]: [], // Terminal state
+    [identity_js_1.State.UNRECOGNIZED]: [],
 };
 // Legacy alias
 exports.AGENT_TRANSITIONS = exports.IDENTITY_TRANSITIONS;
@@ -56,17 +60,54 @@ exports.ATTESTATION_DELTAS = {
     [attestation_js_1.AttestationType.ATTESTATION_TYPE_BEHAVIORAL]: 3,
     [attestation_js_1.AttestationType.UNRECOGNIZED]: 0,
 };
+// ---------------------------------------------------------------------------
+// Identity Registry — role attestations
+// ---------------------------------------------------------------------------
+/**
+ * Role-attestation types issued by the identity registry (identity-registry fiber).
+ * These are the ecosystem-wide authority roles consumer apps gate on via the registry
+ * dependency + `signerHasRole` (see docs/design/app-hardening-identity-integration.md §4.2).
+ */
+exports.REGISTRY_ROLES = {
+    ARBITER: "ARBITER",
+    SLASHER: "SLASHER",
+    ISSUER: "ISSUER",
+    BOARD_MEMBER: "BOARD_MEMBER",
+};
+/**
+ * Maps each role to the registry's flat per-role state-map field. A consumer app reads
+ * `machines.<registryDep>.state.<field>` (a `{ <address>: true }` map) and binds membership to a
+ * verified signer with `signerHasRole`. Kept in lock-step with the identity-registry stateSchema.
+ */
+exports.REGISTRY_ROLE_MAP = {
+    ARBITER: "arbiters",
+    SLASHER: "slashers",
+    ISSUER: "issuers",
+    BOARD_MEMBER: "boardMembers",
+};
+/**
+ * Build the `machines.<registryDep>.state.<roleMap>` var path a consumer guard reads to check a role,
+ * e.g. `registryRolePath("reg-uuid", "ARBITER")` → `"machines.reg-uuid.state.arbiters"`.
+ */
+function registryRolePath(registryDep, role) {
+    return `machines.${registryDep}.state.${exports.REGISTRY_ROLE_MAP[role]}`;
+}
+/**
+ * Build the `machines.<registryDep>.state.reputations` var path a consumer guard reads for a
+ * reputation gate (`signerHasReputation`).
+ */
+function registryReputationPath(registryDep) {
+    return `machines.${registryDep}.state.reputations`;
+}
 /**
  * Check if a transition is valid for the given state.
  */
 function canTransition(state, event) {
     return exports.IDENTITY_TRANSITIONS[state]?.includes(event) ?? false;
 }
-exports.canTransition = canTransition;
 /**
  * Get reputation delta for an attestation type.
  */
 function getReputationDelta(type) {
     return exports.ATTESTATION_DELTAS[type] ?? 0;
 }
-exports.getReputationDelta = getReputationDelta;

package/dist/cjs/apps/identity/index.js

@@ -18,11 +18,14 @@
  * @packageDocumentation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getIdentityDefinition = exports.IDENTITY_DEFINITIONS = exports.identityOracleDef = exports.identityAgentDef = exports.identityUniversalDef = exports.DEFAULT_REPUTATION_CONFIG = exports.getReputationDelta = exports.canTransition = exports.ATTESTATION_DELTAS = exports.AGENT_TRANSITIONS = exports.IDENTITY_TRANSITIONS = exports.attestationTypeToJSON = exports.attestationTypeFromJSON = exports.ReputationConfig = exports.ChallengeRequest = exports.VouchRequest = exports.Attestation = exports.ReputationDelta = exports.AttestationType = exports.AgentState = exports.platformToJSON = exports.platformFromJSON = exports.identityStateToJSON = exports.identityStateFromJSON = exports.identityTypeToJSON = exports.identityTypeFromJSON = exports.IdentityDefinition = exports.WithdrawIdentityRequest = exports.AddStakeRequest = exports.ChallengeIdentityRequest = exports.LinkPlatformRequest = exports.ActivateIdentityRequest = exports.RegisterIdentityRequest = exports.Identity = exports.PenaltyEvent = exports.Reputation = exports.PlatformLink = exports.Platform = exports.IdentityState = exports.IdentityType = void 0;
-// Re-export generated protobuf types (source of truth)
+exports.IDENTITY_DEFINITIONS = exports.identityRegistryDef = exports.identityOracleDef = exports.identityAgentDef = exports.identityUniversalDef = exports.DEFAULT_REPUTATION_CONFIG = exports.getReputationDelta = exports.canTransition = exports.registryReputationPath = exports.registryRolePath = exports.REGISTRY_ROLE_MAP = exports.REGISTRY_ROLES = exports.ATTESTATION_DELTAS = exports.AGENT_TRANSITIONS = exports.IDENTITY_TRANSITIONS = exports.attestationTypeToJSON = exports.attestationTypeFromJSON = exports.ReputationConfig = exports.ChallengeRequest = exports.VouchRequest = exports.Attestation = exports.ReputationDelta = exports.AttestationType = exports.identityStateToJSON = exports.identityStateFromJSON = exports.identityTypeToJSON = exports.identityTypeFromJSON = exports.IdentityState = exports.IdentityType = exports.AgentState = exports.platformToJSON = exports.platformFromJSON = exports.stateToJSON = exports.stateFromJSON = exports.typeToJSON = exports.typeFromJSON = exports.IdentityDefinition = exports.WithdrawIdentityRequest = exports.AddStakeRequest = exports.ChallengeIdentityRequest = exports.LinkPlatformRequest = exports.ActivateIdentityRequest = exports.RegisterIdentityRequest = exports.Identity = exports.PenaltyEvent = exports.Reputation = exports.PlatformLink = exports.Platform = exports.State = exports.Type = void 0;
+exports.getIdentityDefinition = getIdentityDefinition;
+// Re-export generated protobuf types (source of truth).
+// The nested lifecycle/kind enums dropped their app prefix in the proto; under
+// this app-scoped entrypoint they are unambiguously Type / State.
 var identity_js_1 = require("../../generated/ottochain/apps/identity/v1/identity.js");
-Object.defineProperty(exports, "IdentityType", { enumerable: true, get: function () { return identity_js_1.IdentityType; } });
-Object.defineProperty(exports, "IdentityState", { enumerable: true, get: function () { return identity_js_1.IdentityState; } });
+Object.defineProperty(exports, "Type", { enumerable: true, get: function () { return identity_js_1.Type; } });
+Object.defineProperty(exports, "State", { enumerable: true, get: function () { return identity_js_1.State; } });
 Object.defineProperty(exports, "Platform", { enumerable: true, get: function () { return identity_js_1.Platform; } });
 Object.defineProperty(exports, "PlatformLink", { enumerable: true, get: function () { return identity_js_1.PlatformLink; } });
 Object.defineProperty(exports, "Reputation", { enumerable: true, get: function () { return identity_js_1.Reputation; } });
@@ -35,15 +38,23 @@ Object.defineProperty(exports, "ChallengeIdentityRequest", { enumerable: true, g
 Object.defineProperty(exports, "AddStakeRequest", { enumerable: true, get: function () { return identity_js_1.AddStakeRequest; } });
 Object.defineProperty(exports, "WithdrawIdentityRequest", { enumerable: true, get: function () { return identity_js_1.WithdrawIdentityRequest; } });
 Object.defineProperty(exports, "IdentityDefinition", { enumerable: true, get: function () { return identity_js_1.IdentityDefinition; } });
-Object.defineProperty(exports, "identityTypeFromJSON", { enumerable: true, get: function () { return identity_js_1.identityTypeFromJSON; } });
-Object.defineProperty(exports, "identityTypeToJSON", { enumerable: true, get: function () { return identity_js_1.identityTypeToJSON; } });
-Object.defineProperty(exports, "identityStateFromJSON", { enumerable: true, get: function () { return identity_js_1.identityStateFromJSON; } });
-Object.defineProperty(exports, "identityStateToJSON", { enumerable: true, get: function () { return identity_js_1.identityStateToJSON; } });
+Object.defineProperty(exports, "typeFromJSON", { enumerable: true, get: function () { return identity_js_1.typeFromJSON; } });
+Object.defineProperty(exports, "typeToJSON", { enumerable: true, get: function () { return identity_js_1.typeToJSON; } });
+Object.defineProperty(exports, "stateFromJSON", { enumerable: true, get: function () { return identity_js_1.stateFromJSON; } });
+Object.defineProperty(exports, "stateToJSON", { enumerable: true, get: function () { return identity_js_1.stateToJSON; } });
 Object.defineProperty(exports, "platformFromJSON", { enumerable: true, get: function () { return identity_js_1.platformFromJSON; } });
 Object.defineProperty(exports, "platformToJSON", { enumerable: true, get: function () { return identity_js_1.platformToJSON; } });
 // Legacy aliases for backward compatibility
 var identity_js_2 = require("../../generated/ottochain/apps/identity/v1/identity.js");
-Object.defineProperty(exports, "AgentState", { enumerable: true, get: function () { return identity_js_2.IdentityState; } });
+Object.defineProperty(exports, "AgentState", { enumerable: true, get: function () { return identity_js_2.State; } });
+// Deprecated app-prefixed aliases (renamed to Type / State); kept for compat.
+var identity_js_3 = require("../../generated/ottochain/apps/identity/v1/identity.js");
+Object.defineProperty(exports, "IdentityType", { enumerable: true, get: function () { return identity_js_3.Type; } });
+Object.defineProperty(exports, "IdentityState", { enumerable: true, get: function () { return identity_js_3.State; } });
+Object.defineProperty(exports, "identityTypeFromJSON", { enumerable: true, get: function () { return identity_js_3.typeFromJSON; } });
+Object.defineProperty(exports, "identityTypeToJSON", { enumerable: true, get: function () { return identity_js_3.typeToJSON; } });
+Object.defineProperty(exports, "identityStateFromJSON", { enumerable: true, get: function () { return identity_js_3.stateFromJSON; } });
+Object.defineProperty(exports, "identityStateToJSON", { enumerable: true, get: function () { return identity_js_3.stateToJSON; } });
 var attestation_js_1 = require("../../generated/ottochain/apps/identity/v1/attestation.js");
 Object.defineProperty(exports, "AttestationType", { enumerable: true, get: function () { return attestation_js_1.AttestationType; } });
 Object.defineProperty(exports, "ReputationDelta", { enumerable: true, get: function () { return attestation_js_1.ReputationDelta; } });
@@ -58,6 +69,10 @@ var constants_js_1 = require("./constants.js");
 Object.defineProperty(exports, "IDENTITY_TRANSITIONS", { enumerable: true, get: function () { return constants_js_1.IDENTITY_TRANSITIONS; } });
 Object.defineProperty(exports, "AGENT_TRANSITIONS", { enumerable: true, get: function () { return constants_js_1.AGENT_TRANSITIONS; } });
 Object.defineProperty(exports, "ATTESTATION_DELTAS", { enumerable: true, get: function () { return constants_js_1.ATTESTATION_DELTAS; } });
+Object.defineProperty(exports, "REGISTRY_ROLES", { enumerable: true, get: function () { return constants_js_1.REGISTRY_ROLES; } });
+Object.defineProperty(exports, "REGISTRY_ROLE_MAP", { enumerable: true, get: function () { return constants_js_1.REGISTRY_ROLE_MAP; } });
+Object.defineProperty(exports, "registryRolePath", { enumerable: true, get: function () { return constants_js_1.registryRolePath; } });
+Object.defineProperty(exports, "registryReputationPath", { enumerable: true, get: function () { return constants_js_1.registryReputationPath; } });
 Object.defineProperty(exports, "canTransition", { enumerable: true, get: function () { return constants_js_1.canTransition; } });
 Object.defineProperty(exports, "getReputationDelta", { enumerable: true, get: function () { return constants_js_1.getReputationDelta; } });
 // ---------------------------------------------------------------------------
@@ -82,17 +97,18 @@ const index_js_1 = require("./state-machines/index.js");
 Object.defineProperty(exports, "identityUniversalDef", { enumerable: true, get: function () { return index_js_1.identityUniversalDef; } });
 Object.defineProperty(exports, "identityAgentDef", { enumerable: true, get: function () { return index_js_1.identityAgentDef; } });
 Object.defineProperty(exports, "identityOracleDef", { enumerable: true, get: function () { return index_js_1.identityOracleDef; } });
+Object.defineProperty(exports, "identityRegistryDef", { enumerable: true, get: function () { return index_js_1.identityRegistryDef; } });
 /** All identity state machine definitions */
 exports.IDENTITY_DEFINITIONS = {
     universal: index_js_1.identityUniversalDef,
     agent: index_js_1.identityAgentDef,
     oracle: index_js_1.identityOracleDef,
+    registry: index_js_1.identityRegistryDef,
 };
 /**
  * Get an identity state machine definition by type.
- * @param type - 'universal' | 'agent' | 'oracle' (default: 'agent')
+ * @param type - 'universal' | 'agent' | 'oracle' | 'registry' (default: 'agent')
  */
 function getIdentityDefinition(type = "agent") {
     return exports.IDENTITY_DEFINITIONS[type];
 }
-exports.getIdentityDefinition = getIdentityDefinition;