@ottochain/sdk 2.3.0 → 2.5.0

package/dist/cjs/apps/markets/state-machines/market-universal.js

@@ -7,119 +7,113 @@ const fiber_app_js_1 = require("../../../schema/fiber-app.js");
  */
 exports.marketUniversalDef = (0, fiber_app_js_1.defineFiberApp)({
     metadata: {
-        name: "MarketUniversal",
-        app: "markets",
-        type: "universal",
-        version: "1.0.0",
-        description: "Minimal market state machine - extend for custom use cases",
+        name: 'MarketUniversal',
+        app: 'markets',
+        type: 'universal',
+        version: '1.0.0',
+        description: 'Minimal market state machine - extend for custom use cases',
     },
     createSchema: {
         properties: {},
     },
     stateSchema: {
         properties: {
-            status: { type: "string" },
-            totalCommitted: { type: "number", computed: true },
+            status: { type: 'string' },
+            totalCommitted: { type: 'number', computed: true },
         },
     },
     eventSchemas: {
-        open: { description: "Open the market for participation" },
-        cancel: { description: "Cancel the market" },
+        open: { description: 'Open the market for participation' },
+        cancel: { description: 'Cancel the market' },
         commit: {
-            description: "Commit funds to the market",
+            description: 'Commit funds to the market',
             properties: {
-                amount: { type: "number", minimum: 0 },
+                amount: { type: 'number', minimum: 0 },
             },
         },
-        close: { description: "Close the market to new commits" },
-        settle: { description: "Settle the market" },
+        close: { description: 'Close the market to new commits' },
+        settle: { description: 'Settle the market' },
     },
     states: {
         PROPOSED: {
-            id: "PROPOSED",
+            id: 'PROPOSED',
             isFinal: false,
             metadata: {
-                label: "Proposed",
-                description: "Market created but not yet open",
-                category: "initial",
+                label: 'Proposed',
+                description: 'Market created but not yet open',
+                category: 'initial',
             },
         },
         OPEN: {
-            id: "OPEN",
+            id: 'OPEN',
             isFinal: false,
             metadata: {
-                label: "Open",
-                description: "Market is open for participation",
-                category: "active",
+                label: 'Open',
+                description: 'Market is open for participation',
+                category: 'active',
             },
         },
         CLOSED: {
-            id: "CLOSED",
+            id: 'CLOSED',
             isFinal: false,
             metadata: {
-                label: "Closed",
-                description: "Participation closed; awaiting settlement",
-                category: "pending",
+                label: 'Closed',
+                description: 'Participation closed; awaiting settlement',
+                category: 'pending',
             },
         },
         SETTLED: {
-            id: "SETTLED",
+            id: 'SETTLED',
             isFinal: true,
             metadata: {
-                label: "Settled",
-                description: "Market settled and payouts available (terminal)",
-                category: "terminal",
+                label: 'Settled',
+                description: 'Market settled and payouts available (terminal)',
+                category: 'terminal',
             },
         },
         CANCELLED: {
-            id: "CANCELLED",
+            id: 'CANCELLED',
             isFinal: true,
             metadata: {
-                label: "Cancelled",
-                description: "Market cancelled before settlement (terminal)",
-                category: "terminal",
+                label: 'Cancelled',
+                description: 'Market cancelled before settlement (terminal)',
+                category: 'terminal',
             },
         },
     },
-    initialState: "PROPOSED",
+    initialState: 'PROPOSED',
     transitions: [
         {
-            from: "PROPOSED",
-            to: "OPEN",
-            eventName: "open",
-            guard: { "==": [1, 1] },
+            from: 'PROPOSED',
+            to: 'OPEN',
+            eventName: 'open',
+            guard: { '==': [1, 1] },
             effect: {
-                merge: [
-                    { var: "state" },
-                    { status: "OPEN", openedAt: { var: "$timestamp" } },
-                ],
+                merge: [{ var: 'state' }, { status: 'OPEN', openedAt: { var: '$ordinal' } }],
             },
             dependencies: [],
         },
         {
-            from: "PROPOSED",
-            to: "CANCELLED",
-            eventName: "cancel",
-            guard: { "==": [1, 1] },
+            from: 'PROPOSED',
+            to: 'CANCELLED',
+            eventName: 'cancel',
+            guard: { '==': [1, 1] },
             effect: {
-                merge: [
-                    { var: "state" },
-                    { status: "CANCELLED", cancelledAt: { var: "$timestamp" } },
-                ],
+                merge: [{ var: 'state' }, { status: 'CANCELLED', cancelledAt: { var: '$ordinal' } }],
             },
             dependencies: [],
         },
         {
-            from: "OPEN",
-            to: "OPEN",
-            eventName: "commit",
-            guard: { ">": [{ var: "event.amount" }, 0] },
+            from: 'OPEN',
+            to: 'OPEN',
+            eventName: 'commit',
+            guard: { '>': [{ var: 'event.amount' }, 0] },
             effect: {
                 merge: [
-                    { var: "state" },
+                    { var: 'state' },
                     {
                         totalCommitted: {
-                            "+": [{ var: "state.totalCommitted" }, { var: "event.amount" }],
+                            '+': [{ var: 'state.totalCommitted' }, { var: 'event.amount' }],
                         },
                     },
                 ],
@@ -127,41 +121,32 @@ exports.marketUniversalDef = (0, fiber_app_js_1.defineFiberApp)({
             dependencies: [],
         },
         {
-            from: "OPEN",
-            to: "CLOSED",
-            eventName: "close",
-            guard: { "==": [1, 1] },
+            from: 'OPEN',
+            to: 'CLOSED',
+            eventName: 'close',
+            guard: { '==': [1, 1] },
             effect: {
-                merge: [
-                    { var: "state" },
-                    { status: "CLOSED", closedAt: { var: "$timestamp" } },
-                ],
+                merge: [{ var: 'state' }, { status: 'CLOSED', closedAt: { var: '$ordinal' } }],
             },
             dependencies: [],
         },
         {
-            from: "CLOSED",
-            to: "SETTLED",
-            eventName: "settle",
-            guard: { "==": [1, 1] },
+            from: 'CLOSED',
+            to: 'SETTLED',
+            eventName: 'settle',
+            guard: { '==': [1, 1] },
             effect: {
-                merge: [
-                    { var: "state" },
-                    { status: "SETTLED", settledAt: { var: "$timestamp" } },
-                ],
+                merge: [{ var: 'state' }, { status: 'SETTLED', settledAt: { var: '$ordinal' } }],
             },
             dependencies: [],
         },
         {
-            from: "CLOSED",
-            to: "CANCELLED",
-            eventName: "cancel",
-            guard: { "==": [1, 1] },
+            from: 'CLOSED',
+            to: 'CANCELLED',
+            eventName: 'cancel',
+            guard: { '==': [1, 1] },
             effect: {
-                merge: [
-                    { var: "state" },
-                    { status: "CANCELLED", cancelledAt: { var: "$timestamp" } },
-                ],
+                merge: [{ var: 'state' }, { status: 'CANCELLED', cancelledAt: { var: '$ordinal' } }],
             },
             dependencies: [],
         },

package/dist/cjs/apps/oracles/index.js

@@ -9,7 +9,8 @@
  * @packageDocumentation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_ORACLE_CONFIG = exports.getOracleDefinition = exports.oracleStateToJSON = exports.oracleStateFromJSON = exports.OracleDefinition = exports.WithdrawOracleRequest = exports.AddStakeRequest = exports.ActivateOracleRequest = exports.RegisterOracleRequest = exports.Oracle = exports.SlashingEvent = exports.OracleReputation = exports.OracleState = void 0;
+exports.DEFAULT_ORACLE_CONFIG = exports.oracleStateToJSON = exports.oracleStateFromJSON = exports.OracleDefinition = exports.WithdrawOracleRequest = exports.AddStakeRequest = exports.ActivateOracleRequest = exports.RegisterOracleRequest = exports.Oracle = exports.SlashingEvent = exports.OracleReputation = exports.OracleState = void 0;
+exports.getOracleDefinition = getOracleDefinition;
 var index_js_1 = require("../identity/index.js");
 Object.defineProperty(exports, "OracleState", { enumerable: true, get: function () { return index_js_1.IdentityState; } });
 Object.defineProperty(exports, "OracleReputation", { enumerable: true, get: function () { return index_js_1.Reputation; } });
@@ -25,9 +26,8 @@ Object.defineProperty(exports, "oracleStateToJSON", { enumerable: true, get: fun
 const index_js_2 = require("../identity/index.js");
 /** @deprecated Use `getIdentityDefinition('oracle')` from `@ottochain/sdk/apps/identity` */
 function getOracleDefinition(_type) {
-    return (0, index_js_2.getIdentityDefinition)("oracle");
+    return (0, index_js_2.getIdentityDefinition)('oracle');
 }
-exports.getOracleDefinition = getOracleDefinition;
 /** @deprecated Use `DEFAULT_REPUTATION_CONFIG` from `@ottochain/sdk/apps/identity` */
 exports.DEFAULT_ORACLE_CONFIG = {
     minStake: 100,

package/dist/cjs/apps/privacy/index.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * Privacy Application — note-layer privacy primitives.
+ *
+ * Σ-protocol / ZK-backed fibers that carry real privacy on the OttoChain note
+ * layer. The flagship is `sigma-mixer`, a CDS OR-of-`dhtuple` ring mixer whose
+ * anonymity comes from a `sigma_verify` ring proof and whose double-spend safety
+ * comes from a witness-bound nullifier (`Nf = x_j·H`, `H` a NUMS base of unknown
+ * dlog w.r.t. `G`).
+ *
+ * The std-lib UTXO primitive is `shielded-note-pool` ({@link notePoolDef}): a
+ * fixed-denomination Tornado-style private asset pool over the `zk-shielded`
+ * Groth16 circuit. ⚠ UNAUDITED / TEST-ASSETS-ONLY (BN254 ~100-bit, single trusted
+ * relayer for root advancement) — see note-pool.ts.
+ *
+ * @example
+ * ```typescript
+ * import { getPrivacyDefinition, PRIVACY_DEFINITIONS, sigmaDdhRingOf, notePoolDef } from '@ottochain/sdk/apps/privacy';
+ *
+ * const mixerDef = getPrivacyDefinition('sigma-mixer');
+ * // Build a custom n-member OR-of-dhtuple proposition for an audited H:
+ * const prop = sigmaDdhRingOf('state.points', 'event.nullifier', G_HEX, H_HEX, 8);
+ * // Instantiate a shielded note-pool (pin the circuit vkey + denomination + relayer):
+ * const pool = notePoolDef({ vkey, depth: 8, denom: 100, poolPolicyRef, feeAsset, relayer });
+ * ```
+ *
+ * @packageDocumentation
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRIVACY_DEFINITIONS = exports.shieldedNotePoolDef = exports.pmtMembership = exports.pvField = exports.ZERO_WORD = exports.PV_LAYOUT = exports.NOTE_POOL_STATE = exports.notePoolDef = exports.sigmaDdhRingOf = exports.mixerDdhRingDef = void 0;
+exports.getPrivacyDefinition = getPrivacyDefinition;
+const index_js_1 = require("./state-machines/index.js");
+Object.defineProperty(exports, "mixerDdhRingDef", { enumerable: true, get: function () { return index_js_1.mixerDdhRingDef; } });
+Object.defineProperty(exports, "sigmaDdhRingOf", { enumerable: true, get: function () { return index_js_1.sigmaDdhRingOf; } });
+Object.defineProperty(exports, "notePoolDef", { enumerable: true, get: function () { return index_js_1.notePoolDef; } });
+Object.defineProperty(exports, "NOTE_POOL_STATE", { enumerable: true, get: function () { return index_js_1.NOTE_POOL_STATE; } });
+Object.defineProperty(exports, "PV_LAYOUT", { enumerable: true, get: function () { return index_js_1.PV_LAYOUT; } });
+Object.defineProperty(exports, "ZERO_WORD", { enumerable: true, get: function () { return index_js_1.ZERO_WORD; } });
+Object.defineProperty(exports, "pvField", { enumerable: true, get: function () { return index_js_1.pvField; } });
+Object.defineProperty(exports, "pmtMembership", { enumerable: true, get: function () { return index_js_1.pmtMembership; } });
+/**
+ * A documented DEFAULT shielded-note-pool instance for the registry/lint surface, with PLACEHOLDER
+ * pin values (the real vkey comes from the SP1 `zk-shielded` toolchain; relayer/policy are
+ * deployment-specific). Downstream callers should build their own via {@link notePoolDef}; this
+ * instance exists so the privacy app group exposes a concrete `shielded-note-pool` definition.
+ * ⚠ UNAUDITED / TEST-ASSETS-ONLY.
+ */
+exports.shieldedNotePoolDef = (0, index_js_1.notePoolDef)({
+    vkey: index_js_1.ZERO_WORD,
+    depth: 8,
+    denom: 100,
+    poolPolicyRef: 'std.privacy.note-pool',
+    feeAsset: index_js_1.ZERO_WORD,
+    relayer: 'DAG0000000000000000000000000000000000000000',
+});
+/** All privacy (note-layer) state machine definitions. */
+exports.PRIVACY_DEFINITIONS = {
+    'sigma-mixer': index_js_1.mixerDdhRingDef,
+    'shielded-note-pool': exports.shieldedNotePoolDef,
+};
+/**
+ * Get a privacy state machine definition by type.
+ * @param type - 'sigma-mixer' (default) | 'shielded-note-pool'.
+ */
+function getPrivacyDefinition(type = 'sigma-mixer') {
+    return exports.PRIVACY_DEFINITIONS[type];
+}

package/dist/cjs/apps/privacy/state-machines/index.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * Privacy (note-layer) state machine definitions.
+ * Re-exports from TypeScript definition files.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pmtMembership = exports.pvField = exports.ZERO_WORD = exports.PV_LAYOUT = exports.NOTE_POOL_STATE = exports.notePoolDef = exports.sigmaDdhRingOf = exports.mixerDdhRingDef = void 0;
+var mixer_ddhRing_js_1 = require("./mixer-ddhRing.js");
+Object.defineProperty(exports, "mixerDdhRingDef", { enumerable: true, get: function () { return mixer_ddhRing_js_1.mixerDdhRingDef; } });
+Object.defineProperty(exports, "sigmaDdhRingOf", { enumerable: true, get: function () { return mixer_ddhRing_js_1.sigmaDdhRingOf; } });
+var note_pool_js_1 = require("./note-pool.js");
+Object.defineProperty(exports, "notePoolDef", { enumerable: true, get: function () { return note_pool_js_1.notePoolDef; } });
+Object.defineProperty(exports, "NOTE_POOL_STATE", { enumerable: true, get: function () { return note_pool_js_1.NOTE_POOL_STATE; } });
+Object.defineProperty(exports, "PV_LAYOUT", { enumerable: true, get: function () { return note_pool_js_1.PV_LAYOUT; } });
+Object.defineProperty(exports, "ZERO_WORD", { enumerable: true, get: function () { return note_pool_js_1.ZERO_WORD; } });
+Object.defineProperty(exports, "pvField", { enumerable: true, get: function () { return note_pool_js_1.pvField; } });
+Object.defineProperty(exports, "pmtMembership", { enumerable: true, get: function () { return note_pool_js_1.pmtMembership; } });

package/dist/cjs/apps/privacy/state-machines/mixer-ddhRing.js

@@ -0,0 +1,286 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mixerDdhRingDef = void 0;
+exports.sigmaDdhRingOf = sigmaDdhRingOf;
+const fiber_app_js_1 = require("../../../schema/fiber-app.js");
+/**
+ * sigma-mixer — a CDS OR-of-`dhtuple` Σ-protocol ring mixer.
+ *
+ * Anonymity comes from a Cramer–Damgård–Schoenmakers OR-proof over the deposited
+ * ring, verified by the `sigma_verify` JLVM opcode; double-spend safety comes
+ * from a WITNESS-BOUND nullifier carried as the shared DDH point of an
+ * OR-of-`dhtuple` proposition.
+ *
+ * Each ring branch is a DDH tuple `dhtuple(G, H, P_i, Nf)`. A satisfied dhtuple
+ * proves knowledge of one `x` with `P_i = x·G` AND `Nf = x·H` (the verifier uses
+ * a SINGLE shared response `z` for both coordinate reconstructions
+ * `a1 = z·G − e·P_i`, `a2 = z·H − e·Nf`). The OR uses the SAME
+ * `v = event.nullifier` in every branch, so it hides which branch while forcing
+ * `event.nullifier = x_j·H` for the one real branch `j`. With `H` a NUMS base of
+ * unknown dlog w.r.t. `G`, the map `x ↦ x·H` is injective, so the nullifier is
+ * cryptographically bound to the proven secret — closing the
+ * witness-unbound-nullifier double-spend hole an OR-of-`dlog` ring leaves open.
+ *
+ * Verified against `@constellation-network/metagraph-sdk-jlvm@1.8.0-rc.5`: the
+ * `sigma_verify` dhtuple operands are exactly `["type","g","h","u","v"]` (each a
+ * 64-byte G1 hex), the OR child challenges XOR to the node challenge, and the
+ * strong-FS root challenge folds the bound message. Array append uses `merge`
+ * (`merge([arr,[item]])` flattens one level == append). All operators used
+ * (`sigma_verify`, `has`, `set`, `none`, `cat`, `substr`, `merge`) are in
+ * KNOWN_OPERATORS.
+ *
+ * SCOPE: this base definition is CRYPTO + LIFECYCLE. Production custody
+ * (`_transferAsset` in on deposit / out on withdraw), a signer-bound deposit-auth
+ * clause, and a `mixerId`-prefixed bound message are layered on by a downstream
+ * specialization (see the §8 production-hardening note in the design doc).
+ */
+// =============================================================================
+// sigmaDdhRingOf — the OR-of-dhtuple proposition builder
+// =============================================================================
+/**
+ * Emit the `or`-of-`dhtuple` proposition for an `n`-member ring, unrolling
+ * `{"var":"<pointsVar>.k"}` for `k in 0..n-1` as the `u` (commitment) of each
+ * branch, with `g = gHex`, `h = hHex` (literal 64-byte G1 hex) and a shared
+ * `v = {"var":"<nullifierVar>"}` across ALL branches.
+ *
+ * `n` is FIXED at definition time (the proposition shape is closed). `u` and `v`
+ * are `{"var":...}` map-node values that the evaluator resolves element-wise.
+ *
+ * @param pointsVar    state var holding the ordered ring points, e.g. `"state.points"`.
+ * @param nullifierVar event var holding the revealed nullifier, e.g. `"event.nullifier"`.
+ * @param gHex         the verifier generator `G=(1,2)` as 64-byte `0x` hex.
+ * @param hHex         the NUMS second base `H` as 64-byte `0x` hex (unknown dlog wrt G).
+ * @param n            ring size (number of unrolled branches).
+ */
+function sigmaDdhRingOf(pointsVar, nullifierVar, gHex, hHex, n) {
+    const children = [];
+    for (let k = 0; k < n; k++) {
+        children.push({
+            type: 'dhtuple',
+            g: gHex,
+            h: hHex,
+            u: { var: `${pointsVar}.${k}` },
+            v: { var: nullifierVar },
+        });
+    }
+    return { type: 'or', children };
+}
+/**
+ * The shared withdraw verify clauses (ring proof ∧ freshness ∧ recipient-bind).
+ * The lifecycle clause (`→drained` vs `→open`) is appended per transition.
+ */
+function withdrawVerifyClauses(gHex, hHex, n) {
+    return [
+        {
+            sigma_verify: [
+                sigmaDdhRingOf('state.points', 'event.nullifier', gHex, hHex, n),
+                { var: 'event.proof' },
+                { var: 'event.message' },
+            ],
+        },
+        // Double-withdraw prevention: the witness-bound nullifier must be unseen.
+        { '!': { has: [{ var: 'state.spentNullifiers' }, { var: 'event.nullifier' }] } },
+        // Recipient binding (anti-front-run): message == Nf ‖ recipientHex.
+        {
+            '===': [
+                { var: 'event.message' },
+                {
+                    cat: ['0x', { substr: [{ var: 'event.nullifier' }, 2] }, { substr: [{ var: 'event.recipientHex' }, 2] }],
+                },
+            ],
+        },
+    ];
+}
+// The withdraw effect: record the nullifier, advance the counter (+ optional status).
+function withdrawEffect(extra) {
+    return {
+        merge: [
+            { var: 'state' },
+            {
+                spentNullifiers: {
+                    set: [{ var: 'state.spentNullifiers' }, { var: 'event.nullifier' }, true],
+                },
+                withdrawCount: { '+': [{ var: 'state.withdrawCount' }, 1] },
+                ...extra,
+            },
+        ],
+    };
+}
+// G=(1,2) and the NUMS H are the e2e defaults (derived by scripts/gen-sigma-mixer-fixture.ts).
+// Downstream apps pass their own audited H via the builder; these are the pinned-ring v1 demo values.
+const G_HEX = '0x00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002';
+const H_HEX = '0x039c846e3a79217fd140d094eec09fe4f398085d01dee70506edde1eb6a9d81608922722cc3a6c3a7ae4929e78e82dc5f25e91598a69f7f8b9b3adb95badb3d0';
+const RING_N = 4;
+/**
+ * sigma-mixer fiber definition (pinned-ring v1, n=4).
+ *
+ * Trust model: PUBLIC. Anyone may deposit a ring point or submit a withdrawal.
+ * Privacy = a CDS OR-proof hides which of the n branches is being spent;
+ * anonymity set = exactly n (the ring size is public). Double-spend safety =
+ * the witness-bound nullifier + spent-set. Replay/front-run safety = the
+ * message-bound recipient.
+ */
+exports.mixerDdhRingDef = (0, fiber_app_js_1.defineFiberApp)({
+    metadata: {
+        name: 'MixerDdhRing',
+        app: 'privacy',
+        type: 'sigma-mixer',
+        version: '1.0.0',
+        description: 'CDS OR-of-dhtuple Σ-protocol ring mixer. Anonymity via sigma_verify over an ' +
+            'OR of DDH tuples (G,H,P_i,nullifier); the revealed nullifier Nf=x_j·H is ' +
+            'witness-bound (H has unknown dlog wrt G), closing the ring-drain double-spend. ' +
+            'Frozen-ring lifecycle (filling→open→drained) + message-bound recipient.',
+    },
+    createSchema: {
+        required: ['mixerId', 'denomination', 'anonymityTarget'],
+        properties: {
+            mixerId: { type: 'string', immutable: true, description: 'Mixer instance id.' },
+            denomination: {
+                type: 'integer',
+                immutable: true,
+                description: 'Equal denomination per deposit/withdraw (production custody).',
+            },
+            nullifierBaseH: {
+                type: 'string',
+                immutable: true,
+                description: 'The NUMS second base H (64B G1 hex); informational — H is inlined in the proposition.',
+            },
+            anonymityTarget: {
+                type: 'integer',
+                immutable: true,
+                description: 'Ring size n; the ring opens once depositCount == anonymityTarget.',
+            },
+            points: {
+                type: 'array',
+                items: { type: 'string' },
+                default: [],
+                description: 'Ordered ring commitments P_i = x_i·G (64B G1 hex).',
+            },
+            spentNullifiers: {
+                type: 'object',
+                default: {},
+                description: 'FLAT map nullifierHex -> true. MUST be {} (never null): has/set throw on null.',
+            },
+            depositCount: { type: 'integer', default: 0 },
+            withdrawCount: { type: 'integer', default: 0 },
+            status: { type: 'string', default: 'filling', description: 'filling → open → drained.' },
+        },
+    },
+    stateSchema: {
+        properties: {
+            mixerId: { type: 'string', immutable: true },
+            denomination: { type: 'integer', immutable: true },
+            nullifierBaseH: { type: 'string', immutable: true },
+            anonymityTarget: { type: 'integer', immutable: true },
+            points: { type: 'array', items: { type: 'string' }, computed: true },
+            spentNullifiers: { type: 'object', computed: true },
+            depositCount: { type: 'integer', computed: true },
+            withdrawCount: { type: 'integer', computed: true },
+            status: { type: 'string', computed: true },
+        },
+    },
+    eventSchemas: {
+        deposit: { description: 'Register a ring commitment point P_i = x_i·G.' },
+        withdraw: {
+            description: 'Spend one ring slot: a CDS OR-of-dhtuple proof + witness-bound nullifier + bound recipient.',
+        },
+    },
+    states: {
+        filling: {
+            id: 'filling',
+            isFinal: false,
+            metadata: { label: 'Filling', description: 'Ring accepting deposits.', category: 'active' },
+        },
+        open: {
+            id: 'open',
+            isFinal: false,
+            metadata: { label: 'Open', description: 'Ring frozen; withdrawals allowed.', category: 'active' },
+        },
+        drained: {
+            id: 'drained',
+            isFinal: true,
+            metadata: { label: 'Drained', description: 'All slots withdrawn; one-shot.', category: 'terminal' },
+        },
+    },
+    initialState: 'filling',
+    // ORDER IS LOAD-BEARING: the open-flip deposit is declared FIRST (exact
+    // boundary), the drained-flip withdraw is declared FIRST (exact boundary).
+    transitions: [
+        // Deposit A — the LAST deposit: filling → open. Declared FIRST.
+        {
+            from: 'filling',
+            to: 'open',
+            eventName: 'deposit',
+            guard: {
+                and: [
+                    { '===': [{ '+': [{ var: 'state.depositCount' }, 1] }, { var: 'state.anonymityTarget' }] },
+                    { '!!': [{ var: 'event.point' }] },
+                    { none: [{ var: 'state.points' }, { '===': [{ var: '' }, { var: 'event.point' }] }] },
+                ],
+            },
+            effect: {
+                merge: [
+                    { var: 'state' },
+                    {
+                        // Array append = merge([arr,[item]]) (verified: opMerge flattens one level).
+                        points: { merge: [{ var: 'state.points' }, [{ var: 'event.point' }]] },
+                        depositCount: { '+': [{ var: 'state.depositCount' }, 1] },
+                        status: 'open',
+                    },
+                ],
+            },
+            dependencies: [],
+        },
+        // Deposit B — not-yet-last: filling → filling. Declared SECOND.
+        {
+            from: 'filling',
+            to: 'filling',
+            eventName: 'deposit',
+            guard: {
+                and: [
+                    { '<': [{ '+': [{ var: 'state.depositCount' }, 1] }, { var: 'state.anonymityTarget' }] },
+                    { '!!': [{ var: 'event.point' }] },
+                    { none: [{ var: 'state.points' }, { '===': [{ var: '' }, { var: 'event.point' }] }] },
+                ],
+            },
+            effect: {
+                merge: [
+                    { var: 'state' },
+                    {
+                        points: { merge: [{ var: 'state.points' }, [{ var: 'event.point' }]] },
+                        depositCount: { '+': [{ var: 'state.depositCount' }, 1] },
+                    },
+                ],
+            },
+            dependencies: [],
+        },
+        // Withdraw → drained (the LAST withdrawal). Declared FIRST.
+        {
+            from: 'open',
+            to: 'drained',
+            eventName: 'withdraw',
+            guard: {
+                and: [
+                    ...withdrawVerifyClauses(G_HEX, H_HEX, RING_N),
+                    { '===': [{ '+': [{ var: 'state.withdrawCount' }, 1] }, { var: 'state.anonymityTarget' }] },
+                ],
+            },
+            effect: withdrawEffect({ status: 'drained' }),
+            dependencies: [],
+        },
+        // Withdraw → open (not-yet-last). Declared SECOND.
+        {
+            from: 'open',
+            to: 'open',
+            eventName: 'withdraw',
+            guard: {
+                and: [
+                    ...withdrawVerifyClauses(G_HEX, H_HEX, RING_N),
+                    { '<': [{ '+': [{ var: 'state.withdrawCount' }, 1] }, { var: 'state.anonymityTarget' }] },
+                ],
+            },
+            effect: withdrawEffect({}),
+            dependencies: [],
+        },
+    ],
+});