@ottochain/sdk 2.2.5 → 2.4.0

package/dist/cjs/apps/identity/state-machines/identity-agent.js

@@ -132,12 +132,60 @@ exports.identityAgentDef = (0, fiber_app_js_1.defineFiberApp)({
         },
     },
     states: {
-        REGISTERED: { id: "REGISTERED", isFinal: false },
-        ACTIVE: { id: "ACTIVE", isFinal: false },
-        CHALLENGED: { id: "CHALLENGED", isFinal: false },
-        SUSPENDED: { id: "SUSPENDED", isFinal: false },
-        PROBATION: { id: "PROBATION", isFinal: false },
-        WITHDRAWN: { id: "WITHDRAWN", isFinal: true },
+        REGISTERED: {
+            id: "REGISTERED",
+            isFinal: false,
+            metadata: {
+                label: "Registered",
+                description: "Agent registered but not yet activated",
+                category: "initial",
+            },
+        },
+        ACTIVE: {
+            id: "ACTIVE",
+            isFinal: false,
+            metadata: {
+                label: "Active",
+                description: "Agent is active and accruing reputation",
+                category: "active",
+            },
+        },
+        CHALLENGED: {
+            id: "CHALLENGED",
+            isFinal: false,
+            metadata: {
+                label: "Challenged",
+                description: "A challenge has been raised; awaiting resolution",
+                category: "pending",
+            },
+        },
+        SUSPENDED: {
+            id: "SUSPENDED",
+            isFinal: false,
+            metadata: {
+                label: "Suspended",
+                description: "Agent suspended after an upheld challenge",
+                category: "pending",
+            },
+        },
+        PROBATION: {
+            id: "PROBATION",
+            isFinal: false,
+            metadata: {
+                label: "Probation",
+                description: "Conditional reinstatement under monitoring",
+                category: "active",
+            },
+        },
+        WITHDRAWN: {
+            id: "WITHDRAWN",
+            isFinal: true,
+            metadata: {
+                label: "Withdrawn",
+                description: "Agent withdrawn from the registry (terminal)",
+                category: "terminal",
+            },
+        },
     },
     initialState: "REGISTERED",
     transitions: [
@@ -149,7 +197,7 @@ exports.identityAgentDef = (0, fiber_app_js_1.defineFiberApp)({
             effect: {
                 merge: [
                     { var: "state" },
-                    { status: "ACTIVE", activatedAt: { var: "$timestamp" } },
+                    { status: "ACTIVE", activatedAt: { var: "$ordinal" } },
                 ],
             },
         },
@@ -206,7 +254,7 @@ exports.identityAgentDef = (0, fiber_app_js_1.defineFiberApp)({
             effect: {
                 merge: [
                     { var: "state" },
-                    { status: "SUSPENDED", suspendedAt: { var: "$timestamp" } },
+                    { status: "SUSPENDED", suspendedAt: { var: "$ordinal" } },
                 ],
             },
         },
@@ -218,7 +266,7 @@ exports.identityAgentDef = (0, fiber_app_js_1.defineFiberApp)({
             effect: {
                 merge: [
                     { var: "state" },
-                    { status: "PROBATION", probationStartedAt: { var: "$timestamp" } },
+                    { status: "PROBATION", probationStartedAt: { var: "$ordinal" } },
                 ],
             },
         },

package/dist/cjs/apps/identity/state-machines/identity-oracle.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.identityOracleDef = void 0;
 const fiber_app_js_1 = require("../../../schema/fiber-app.js");
+const guards_js_1 = require("../../../schema/guards.js");
 /**
  * Oracle identity with staking, attestations, reputation, and slashing mechanics.
  */
@@ -14,13 +15,18 @@ exports.identityOracleDef = (0, fiber_app_js_1.defineFiberApp)({
         description: "Oracle identity with staking, attestations, reputation, and slashing mechanics",
     },
     createSchema: {
-        required: ["owner", "stake", "domains"],
+        required: ["owner", "stake", "domains", "slasher"],
         properties: {
             owner: {
                 type: "address",
                 description: "Oracle owner DAG address",
                 immutable: true,
             },
+            slasher: {
+                type: "address",
+                description: "DAG address of the slasher authorized to penalize this oracle's stake",
+                immutable: true,
+            },
             stake: {
                 type: "integer",
                 minimum: 0,
@@ -41,6 +47,7 @@ exports.identityOracleDef = (0, fiber_app_js_1.defineFiberApp)({
     stateSchema: {
         properties: {
             owner: { type: "address", immutable: true },
+            slasher: { type: "address", immutable: true },
             address: { type: "address", computed: true },
             stake: { type: "integer", computed: true },
             minStake: { type: "integer" },
@@ -88,7 +95,6 @@ exports.identityOracleDef = (0, fiber_app_js_1.defineFiberApp)({
             required: ["agent"],
             properties: {
                 agent: { type: "address" },
-                adminOverride: { type: "boolean", default: false },
             },
         },
         add_stake: {
@@ -132,11 +138,51 @@ exports.identityOracleDef = (0, fiber_app_js_1.defineFiberApp)({
         },
     },
     states: {
-        UNREGISTERED: { id: "UNREGISTERED", isFinal: false },
-        REGISTERED: { id: "REGISTERED", isFinal: false },
-        ACTIVE: { id: "ACTIVE", isFinal: false },
-        SLASHED: { id: "SLASHED", isFinal: false },
-        WITHDRAWN: { id: "WITHDRAWN", isFinal: true },
+        UNREGISTERED: {
+            id: "UNREGISTERED",
+            isFinal: false,
+            metadata: {
+                label: "Unregistered",
+                description: "Oracle not yet registered; awaiting stake",
+                category: "initial",
+            },
+        },
+        REGISTERED: {
+            id: "REGISTERED",
+            isFinal: false,
+            metadata: {
+                label: "Registered",
+                description: "Oracle staked and registered but not yet active",
+                category: "pending",
+            },
+        },
+        ACTIVE: {
+            id: "ACTIVE",
+            isFinal: false,
+            metadata: {
+                label: "Active",
+                description: "Oracle is active and may submit resolutions",
+                category: "active",
+            },
+        },
+        SLASHED: {
+            id: "SLASHED",
+            isFinal: false,
+            metadata: {
+                label: "Slashed",
+                description: "Oracle penalized for a lost dispute; stake reduced",
+                category: "pending",
+            },
+        },
+        WITHDRAWN: {
+            id: "WITHDRAWN",
+            isFinal: true,
+            metadata: {
+                label: "Withdrawn",
+                description: "Oracle withdrawn and stake reclaimed (terminal)",
+                category: "terminal",
+            },
+        },
     },
     initialState: "UNREGISTERED",
     transitions: [
@@ -152,7 +198,7 @@ exports.identityOracleDef = (0, fiber_app_js_1.defineFiberApp)({
                         status: "REGISTERED",
                         address: { var: "event.agent" },
                         stake: { var: "event.stake" },
-                        registeredAt: { var: "$timestamp" },
+                        registeredAt: { var: "$ordinal" },
                         reputation: {
                             accuracy: 100,
                             totalResolutions: 0,
@@ -169,16 +215,12 @@ exports.identityOracleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "REGISTERED",
             to: "ACTIVE",
             eventName: "activate",
-            guard: {
-                or: [
-                    { "===": [{ var: "event.agent" }, { var: "state.address" }] },
-                    { var: "event.adminOverride" },
-                ],
-            },
+            // authority gate — an ARBITER/SLASHER attestation check layers on additively when the identity registry lands (see docs/design/app-hardening-identity-integration.md §4.2)
+            guard: (0, guards_js_1.signerIsParty)("state.address"),
             effect: {
                 merge: [
                     { var: "state" },
-                    { status: "ACTIVE", activatedAt: { var: "$timestamp" } },
+                    { status: "ACTIVE", activatedAt: { var: "$ordinal" } },
                 ],
             },
         },
@@ -188,7 +230,7 @@ exports.identityOracleDef = (0, fiber_app_js_1.defineFiberApp)({
             eventName: "add_stake",
             guard: {
                 and: [
-                    { "===": [{ var: "event.agent" }, { var: "state.address" }] },
+                    (0, guards_js_1.signerIsParty)("state.address"),
                     { ">": [{ var: "event.amount" }, 0] },
                 ],
             },
@@ -197,7 +239,7 @@ exports.identityOracleDef = (0, fiber_app_js_1.defineFiberApp)({
                     { var: "state" },
                     {
                         stake: { "+": [{ var: "state.stake" }, { var: "event.amount" }] },
-                        lastStakeAt: { var: "$timestamp" },
+                        lastStakeAt: { var: "$ordinal" },
                     },
                 ],
             },
@@ -228,7 +270,7 @@ exports.identityOracleDef = (0, fiber_app_js_1.defineFiberApp)({
                                 },
                             ],
                         },
-                        lastResolutionAt: { var: "$timestamp" },
+                        lastResolutionAt: { var: "$ordinal" },
                     },
                 ],
             },
@@ -237,9 +279,10 @@ exports.identityOracleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "ACTIVE",
             to: "SLASHED",
             eventName: "slash",
+            // authority gate — an ARBITER/SLASHER attestation check layers on additively when the identity registry lands (see docs/design/app-hardening-identity-integration.md §4.2)
             guard: {
                 and: [
-                    { var: "event.reason" },
+                    (0, guards_js_1.signerIsParty)("state.slasher"),
                     { ">": [{ var: "event.amount" }, 0] },
                     { "<=": [{ var: "event.amount" }, { var: "state.stake" }] },
                 ],
@@ -258,12 +301,12 @@ exports.identityOracleDef = (0, fiber_app_js_1.defineFiberApp)({
                                         reason: { var: "event.reason" },
                                         amount: { var: "event.amount" },
                                         marketId: { var: "event.marketId" },
-                                        slashedAt: { var: "$timestamp" },
+                                        slashedAt: { var: "$ordinal" },
                                     },
                                 ],
                             ],
                         },
-                        slashedAt: { var: "$timestamp" },
+                        slashedAt: { var: "$ordinal" },
                     },
                 ],
             },
@@ -274,14 +317,14 @@ exports.identityOracleDef = (0, fiber_app_js_1.defineFiberApp)({
             eventName: "reactivate",
             guard: {
                 and: [
-                    { "===": [{ var: "event.agent" }, { var: "state.address" }] },
+                    (0, guards_js_1.signerIsParty)("state.address"),
                     { ">=": [{ var: "state.stake" }, { var: "state.minStake" }] },
                 ],
             },
             effect: {
                 merge: [
                     { var: "state" },
-                    { status: "ACTIVE", reactivatedAt: { var: "$timestamp" } },
+                    { status: "ACTIVE", reactivatedAt: { var: "$ordinal" } },
                 ],
             },
         },
@@ -289,13 +332,13 @@ exports.identityOracleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "ACTIVE",
             to: "WITHDRAWN",
             eventName: "withdraw",
-            guard: { "===": [{ var: "event.agent" }, { var: "state.address" }] },
+            guard: (0, guards_js_1.signerIsParty)("state.address"),
             effect: {
                 merge: [
                     { var: "state" },
                     {
                         status: "WITHDRAWN",
-                        withdrawnAt: { var: "$timestamp" },
+                        withdrawnAt: { var: "$ordinal" },
                         finalStake: { var: "state.stake" },
                     },
                 ],
@@ -305,13 +348,13 @@ exports.identityOracleDef = (0, fiber_app_js_1.defineFiberApp)({
             from: "SLASHED",
             to: "WITHDRAWN",
             eventName: "withdraw",
-            guard: { "===": [{ var: "event.agent" }, { var: "state.address" }] },
+            guard: (0, guards_js_1.signerIsParty)("state.address"),
             effect: {
                 merge: [
                     { var: "state" },
                     {
                         status: "WITHDRAWN",
-                        withdrawnAt: { var: "$timestamp" },
+                        withdrawnAt: { var: "$ordinal" },
                         finalStake: { var: "state.stake" },
                     },
                 ],

package/dist/cjs/apps/identity/state-machines/identity-registry.js

@@ -0,0 +1,288 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identityRegistryDef = void 0;
+const fiber_app_js_1 = require("../../../schema/fiber-app.js");
+const guards_js_1 = require("../../../schema/guards.js");
+/**
+ * Identity Registry — the ecosystem authority & reputation source.
+ *
+ * Aggregates, under a single authority-governed fiber:
+ *  - `reputations: { <address>: int }`  — the public reputation read by reputation-gated apps
+ *    (dao-reputation, credit-scoring) via a declared dependency + the `signerHasReputation` helper.
+ *  - role attestations (ARBITER / SLASHER / ISSUER / BOARD_MEMBER) as FLAT per-role maps
+ *    `{ <address>: true }`, read via the `signerHasRole` helper for judicial / issuance / governance
+ *    authority gates.
+ *
+ * Writes are gated to the registry's pinned `authority` (immutable, set at create) and bound to the
+ * CHAIN-VERIFIED signer via `signerIsParty("state.authority")` — never `event.agent`. Reads happen
+ * cross-fiber: a consumer app declares this registry as a dependency and reads
+ * `machines.<registryDep>.state.reputations` / `.arbiters` / … bound to `proofs[].address`.
+ *
+ * Roles are flat per-role maps rather than a nested `roles[addr][ROLE]` map on purpose: metakit
+ * `get`/`has` on a NULL inner map throw (they are not null-total), so a nested read would error for
+ * any signer with no roles entry — the common case. Flat maps keep both the write (`set`/`unset`) and
+ * the read (`has`) total and fail-closed. New role types are added as new state maps + a cascade arm.
+ *
+ * See docs/design/app-hardening-identity-integration.md §3–§4 and src/schema/guards.ts
+ * (signerHasReputation / signerHasRole).
+ */
+exports.identityRegistryDef = (0, fiber_app_js_1.defineFiberApp)({
+    metadata: {
+        name: "IdentityRegistry",
+        app: "identity",
+        type: "registry",
+        version: "1.0.0",
+        description: "Ecosystem reputation + role-attestation registry; authority-gated writes, dependency reads.",
+        crossReferences: {
+            IdentityAgent: "per-agent reputation source",
+            Governance: "reputation-gated participation",
+            Contracts: "ARBITER-gated dispute settlement",
+            Corporate: "ISSUER / BOARD_MEMBER authority",
+        },
+    },
+    createSchema: {
+        required: ["authority"],
+        properties: {
+            authority: {
+                type: "address",
+                description: "DAG address authorized to write reputation + role attestations (immutable)",
+                immutable: true,
+            },
+        },
+    },
+    stateSchema: {
+        properties: {
+            authority: { type: "address", immutable: true },
+            // { <address>: int } — public reputation, read via signerHasReputation
+            reputations: { type: "object", computed: true },
+            // FLAT per-role attestation maps { <address>: true }, read via signerHasRole
+            arbiters: { type: "object", computed: true },
+            slashers: { type: "object", computed: true },
+            issuers: { type: "object", computed: true },
+            boardMembers: { type: "object", computed: true },
+        },
+    },
+    eventSchemas: {
+        set_reputation: {
+            description: "Authority sets an address's reputation to an absolute score",
+            required: ["subject", "score"],
+            properties: {
+                subject: { type: "address" },
+                score: { type: "integer" },
+            },
+        },
+        adjust_reputation: {
+            description: "Authority adjusts an address's reputation by a signed delta",
+            required: ["subject", "delta"],
+            properties: {
+                subject: { type: "address" },
+                delta: { type: "integer" },
+            },
+        },
+        grant_role: {
+            description: "Authority grants a role attestation (ARBITER|SLASHER|ISSUER|BOARD_MEMBER) to an address",
+            required: ["subject", "role"],
+            properties: {
+                subject: { type: "address" },
+                role: {
+                    type: "string",
+                    enum: ["ARBITER", "SLASHER", "ISSUER", "BOARD_MEMBER"],
+                },
+            },
+        },
+        revoke_role: {
+            description: "Authority revokes a role attestation from an address",
+            required: ["subject", "role"],
+            properties: {
+                subject: { type: "address" },
+                role: {
+                    type: "string",
+                    enum: ["ARBITER", "SLASHER", "ISSUER", "BOARD_MEMBER"],
+                },
+            },
+        },
+    },
+    states: {
+        ACTIVE: {
+            id: "ACTIVE",
+            isFinal: false,
+            metadata: {
+                label: "Active",
+                description: "Registry accepting authority writes",
+                category: "active",
+            },
+        },
+    },
+    initialState: "ACTIVE",
+    transitions: [
+        // ACTIVE → ACTIVE: set_reputation (absolute)
+        {
+            from: "ACTIVE",
+            to: "ACTIVE",
+            eventName: "set_reputation",
+            guard: (0, guards_js_1.signerIsParty)("state.authority"),
+            effect: {
+                merge: [
+                    { var: "state" },
+                    {
+                        reputations: {
+                            set: [
+                                { var: "state.reputations" },
+                                { var: "event.subject" },
+                                { var: "event.score" },
+                            ],
+                        },
+                    },
+                ],
+            },
+            dependencies: [],
+        },
+        // ACTIVE → ACTIVE: adjust_reputation (signed delta; absent subject starts from 0)
+        {
+            from: "ACTIVE",
+            to: "ACTIVE",
+            eventName: "adjust_reputation",
+            guard: (0, guards_js_1.signerIsParty)("state.authority"),
+            effect: {
+                merge: [
+                    { var: "state" },
+                    {
+                        reputations: {
+                            set: [
+                                { var: "state.reputations" },
+                                { var: "event.subject" },
+                                {
+                                    "+": [
+                                        {
+                                            get: [
+                                                { var: "state.reputations" },
+                                                { var: "event.subject" },
+                                            ],
+                                        },
+                                        { var: "event.delta" },
+                                    ],
+                                },
+                            ],
+                        },
+                    },
+                ],
+            },
+            dependencies: [],
+        },
+        // ACTIVE → ACTIVE: grant_role (cascade selects the flat per-role map)
+        {
+            from: "ACTIVE",
+            to: "ACTIVE",
+            eventName: "grant_role",
+            guard: (0, guards_js_1.signerIsParty)("state.authority"),
+            effect: {
+                merge: [
+                    { var: "state" },
+                    {
+                        arbiters: {
+                            if: [
+                                { "==": [{ var: "event.role" }, "ARBITER"] },
+                                {
+                                    set: [
+                                        { var: "state.arbiters" },
+                                        { var: "event.subject" },
+                                        true,
+                                    ],
+                                },
+                                { var: "state.arbiters" },
+                            ],
+                        },
+                        slashers: {
+                            if: [
+                                { "==": [{ var: "event.role" }, "SLASHER"] },
+                                {
+                                    set: [
+                                        { var: "state.slashers" },
+                                        { var: "event.subject" },
+                                        true,
+                                    ],
+                                },
+                                { var: "state.slashers" },
+                            ],
+                        },
+                        issuers: {
+                            if: [
+                                { "==": [{ var: "event.role" }, "ISSUER"] },
+                                {
+                                    set: [
+                                        { var: "state.issuers" },
+                                        { var: "event.subject" },
+                                        true,
+                                    ],
+                                },
+                                { var: "state.issuers" },
+                            ],
+                        },
+                        boardMembers: {
+                            if: [
+                                { "==": [{ var: "event.role" }, "BOARD_MEMBER"] },
+                                {
+                                    set: [
+                                        { var: "state.boardMembers" },
+                                        { var: "event.subject" },
+                                        true,
+                                    ],
+                                },
+                                { var: "state.boardMembers" },
+                            ],
+                        },
+                    },
+                ],
+            },
+            dependencies: [],
+        },
+        // ACTIVE → ACTIVE: revoke_role (cascade unsets from the flat per-role map)
+        {
+            from: "ACTIVE",
+            to: "ACTIVE",
+            eventName: "revoke_role",
+            guard: (0, guards_js_1.signerIsParty)("state.authority"),
+            effect: {
+                merge: [
+                    { var: "state" },
+                    {
+                        arbiters: {
+                            if: [
+                                { "==": [{ var: "event.role" }, "ARBITER"] },
+                                { unset: [{ var: "state.arbiters" }, { var: "event.subject" }] },
+                                { var: "state.arbiters" },
+                            ],
+                        },
+                        slashers: {
+                            if: [
+                                { "==": [{ var: "event.role" }, "SLASHER"] },
+                                { unset: [{ var: "state.slashers" }, { var: "event.subject" }] },
+                                { var: "state.slashers" },
+                            ],
+                        },
+                        issuers: {
+                            if: [
+                                { "==": [{ var: "event.role" }, "ISSUER"] },
+                                { unset: [{ var: "state.issuers" }, { var: "event.subject" }] },
+                                { var: "state.issuers" },
+                            ],
+                        },
+                        boardMembers: {
+                            if: [
+                                { "==": [{ var: "event.role" }, "BOARD_MEMBER"] },
+                                {
+                                    unset: [
+                                        { var: "state.boardMembers" },
+                                        { var: "event.subject" },
+                                    ],
+                                },
+                                { var: "state.boardMembers" },
+                            ],
+                        },
+                    },
+                ],
+            },
+            dependencies: [],
+        },
+    ],
+});

package/dist/cjs/apps/identity/state-machines/identity-universal.js

@@ -57,9 +57,33 @@ exports.identityUniversalDef = (0, fiber_app_js_1.defineFiberApp)({
         },
     },
     states: {
-        CREATED: { id: "CREATED", isFinal: false },
-        ACTIVE: { id: "ACTIVE", isFinal: false },
-        INACTIVE: { id: "INACTIVE", isFinal: true },
+        CREATED: {
+            id: "CREATED",
+            isFinal: false,
+            metadata: {
+                label: "Created",
+                description: "Identity registered but not yet activated",
+                category: "initial",
+            },
+        },
+        ACTIVE: {
+            id: "ACTIVE",
+            isFinal: false,
+            metadata: {
+                label: "Active",
+                description: "Identity is active and can be updated",
+                category: "active",
+            },
+        },
+        INACTIVE: {
+            id: "INACTIVE",
+            isFinal: true,
+            metadata: {
+                label: "Inactive",
+                description: "Identity deactivated by its owner (terminal)",
+                category: "terminal",
+            },
+        },
     },
     initialState: "CREATED",
     transitions: [
@@ -71,7 +95,7 @@ exports.identityUniversalDef = (0, fiber_app_js_1.defineFiberApp)({
             effect: {
                 merge: [
                     { var: "state" },
-                    { status: "ACTIVE", activatedAt: { var: "$timestamp" } },
+                    { status: "ACTIVE", activatedAt: { var: "$ordinal" } },
                 ],
             },
         },
@@ -84,7 +108,7 @@ exports.identityUniversalDef = (0, fiber_app_js_1.defineFiberApp)({
                 merge: [
                     { var: "state" },
                     {
-                        updatedAt: { var: "$timestamp" },
+                        updatedAt: { var: "$ordinal" },
                         metadata: { var: "event.metadata" },
                     },
                 ],
@@ -98,7 +122,7 @@ exports.identityUniversalDef = (0, fiber_app_js_1.defineFiberApp)({
             effect: {
                 merge: [
                     { var: "state" },
-                    { status: "INACTIVE", deactivatedAt: { var: "$timestamp" } },
+                    { status: "INACTIVE", deactivatedAt: { var: "$ordinal" } },
                 ],
             },
         },