@verana-labs/vs-agent-sdk 2.0.0-dev.5 → 2.0.0-dev.51

package/build/blockchain/handlers/index.js

@@ -17,5 +17,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./authorizationHandlers"), exports);
 __exportStar(require("./defaultHandlers"), exports);
 __exportStar(require("./IndexerHandlerRegistry"), exports);
+__exportStar(require("./selfIssuanceHandlers"), exports);
 __exportStar(require("./stateMutations"), exports);
 //# sourceMappingURL=index.js.map

package/build/blockchain/handlers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/blockchain/handlers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAuC;AACvC,oDAAiC;AACjC,2DAAwC;AACxC,mDAAgC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/blockchain/handlers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAuC;AACvC,oDAAiC;AACjC,2DAAwC;AACxC,yDAAsC;AACtC,mDAAgC"}

package/build/blockchain/handlers/selfIssuanceHandlers.d.ts

@@ -0,0 +1,13 @@
+import { EcsClaims } from '../../utils/ecsClaims';
+import { VeranaIndexerService } from '../VeranaIndexerService';
+import { IndexerHandlerRegistry } from './IndexerHandlerRegistry';
+/**
+ * Keeps this agent's self-issued ECS credentials in step with its own ISSUER participant.
+ *
+ * The Corporation operator provisions that participant out of band, and a third party revokes it
+ * just as asynchronously — both usually while the agent is already running. Until it exists the
+ * agent cannot anchor the digest of its ECS credentials, because the chain accepts a
+ * CreateOrUpdateParticipantSession only against an active ISSUER entry; once it is revoked the
+ * credential that anchors against it makes the whole DID fail VS-CONN-VS.
+ */
+export declare function registerSelfIssuanceAnchorHandlers(registry: IndexerHandlerRegistry, indexer: VeranaIndexerService, corporationId: number, ecsClaims: EcsClaims): void;

package/build/blockchain/handlers/selfIssuanceHandlers.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerSelfIssuanceAnchorHandlers = registerSelfIssuanceAnchorHandlers;
+const types_1 = require("../types");
+const stateMutations_1 = require("./stateMutations");
+/**
+ * Messages that can give this agent the ISSUER participant its own ECS credentials anchor
+ * against: an ECOSYSTEM-mode entry becomes usable when the validator validates it, an OPEN-mode
+ * entry as soon as its owner creates it.
+ */
+const ISSUER_READY_MSGS = ['SetParticipantOPToValidated', 'SelfCreateParticipant'];
+/** Messages that make an ISSUER participant permanently unusable, per VSA-VTI-FLOW-OP-REVOKE. */
+const ISSUER_REVOKED_MSGS = ['RevokeParticipant', 'SlashParticipantTrustDeposit'];
+/**
+ * Keeps this agent's self-issued ECS credentials in step with its own ISSUER participant.
+ *
+ * The Corporation operator provisions that participant out of band, and a third party revokes it
+ * just as asynchronously — both usually while the agent is already running. Until it exists the
+ * agent cannot anchor the digest of its ECS credentials, because the chain accepts a
+ * CreateOrUpdateParticipantSession only against an active ISSUER entry; once it is revoked the
+ * credential that anchors against it makes the whole DID fail VS-CONN-VS.
+ */
+function registerSelfIssuanceAnchorHandlers(registry, indexer, corporationId, ecsClaims) {
+    // Events arrive in bursts, and each reconciliation writes the DID record, so they run in turn.
+    let queue = Promise.resolve();
+    for (const msg of ISSUER_READY_MSGS) {
+        const original = registry.get(msg);
+        registry.register({
+            msg,
+            handle: async (activity, ctx) => {
+                if (original)
+                    await original.handle(activity, ctx);
+                const { agent } = ctx;
+                if (!agent.did || !agent.veranaChain)
+                    return;
+                try {
+                    const participant = await indexer.getParticipant(String(activity.entity_id));
+                    if ((participant === null || participant === void 0 ? void 0 : participant.did) !== agent.did || participant.role !== types_1.ParticipantRole.Issuer)
+                        return;
+                }
+                catch (error) {
+                    ctx.agent.config.logger.debug(`[SelfTR] could not read participant ${activity.entity_id}: ${error.message}`);
+                    return;
+                }
+                agent.config.logger.info(`[SelfTR] own ISSUER participant ${activity.entity_id} is ready; reconciling the ECS credentials`);
+                queue = queue
+                    .then(() => (0, stateMutations_1.reconcileVtjscPublications)(agent, indexer, corporationId, ecsClaims))
+                    .catch((error) => agent.config.logger.error(`[SelfTR] reconciliation failed: ${error.message}`));
+                await queue;
+            },
+        });
+    }
+    for (const msg of ISSUER_REVOKED_MSGS) {
+        const original = registry.get(msg);
+        registry.register({
+            msg,
+            handle: async (activity, ctx) => {
+                if (original)
+                    await original.handle(activity, ctx);
+                const { agent } = ctx;
+                if (!agent.did || !agent.veranaChain)
+                    return;
+                queue = queue
+                    .then(() => (0, stateMutations_1.removeSelfIssuedEcsCredentialsIfIssuerRevoked)(agent, String(activity.entity_id)))
+                    .catch((error) => agent.config.logger.error(`[SelfTR] withdrawal failed: ${error.message}`));
+                await queue;
+            },
+        });
+    }
+}
+//# sourceMappingURL=selfIssuanceHandlers.js.map

package/build/blockchain/handlers/selfIssuanceHandlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selfIssuanceHandlers.js","sourceRoot":"","sources":["../../../src/blockchain/handlers/selfIssuanceHandlers.ts"],"names":[],"mappings":";;AA0BA,gFAyDC;AAjFD,oCAA2D;AAG3D,qDAA4G;AAE5G;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,6BAA6B,EAAE,uBAAuB,CAAC,CAAA;AAElF,iGAAiG;AACjG,MAAM,mBAAmB,GAAG,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,CAAA;AAEjF;;;;;;;;GAQG;AACH,SAAgB,kCAAkC,CAChD,QAAgC,EAChC,OAA6B,EAC7B,aAAqB,EACrB,SAAoB;IAEpB,+FAA+F;IAC/F,IAAI,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAE5C,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAClC,QAAQ,CAAC,QAAQ,CAAC;YAChB,GAAG;YACH,MAAM,EAAE,KAAK,EAAE,QAAyB,EAAE,GAA0B,EAAE,EAAE;gBACtE,IAAI,QAAQ;oBAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;gBAElD,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAA;gBACrB,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW;oBAAE,OAAM;gBAC5C,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;oBAC5E,IAAI,CAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,GAAG,MAAK,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,IAAI,KAAK,uBAAe,CAAC,MAAM;wBAAE,OAAM;gBAC3F,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAC3B,uCAAuC,QAAQ,CAAC,SAAS,KAAM,KAAe,CAAC,OAAO,EAAE,CACzF,CAAA;oBACD,OAAM;gBACR,CAAC;gBAED,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CACtB,mCAAmC,QAAQ,CAAC,SAAS,4CAA4C,CAClG,CAAA;gBACD,KAAK,GAAG,KAAK;qBACV,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,2CAA0B,EAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;qBAChF,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE,CACtB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAC9E,CAAA;gBACH,MAAM,KAAK,CAAA;YACb,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAClC,QAAQ,CAAC,QAAQ,CAAC;YAChB,GAAG;YACH,MAAM,EAAE,KAAK,EAAE,QAAyB,EAAE,GAA0B,EAAE,EAAE;gBACtE,IAAI,QAAQ;oBAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;gBAElD,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAA;gBACrB,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW;oBAAE,OAAM;gBAC5C,KAAK,GAAG,KAAK;qBACV,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,8DAA6C,EAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;qBAC5F,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;gBACrG,MAAM,KAAK,CAAA;YACb,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/build/blockchain/handlers/stateMutations.d.ts

@@ -1,7 +1,7 @@
 import { AgentContext } from '@credo-ts/core';
 import { VtFlowRecord, VtFlowService } from '@verana-labs/credo-ts-didcomm-vt-flow';
 import { VsAgent } from '../../agent/VsAgent';
-import { SelfTrDefaults } from '../../utils/setupSelfTr';
+import { EcsClaims } from '../../utils/ecsClaims';
 import { VeranaIndexerService } from '../VeranaIndexerService';
 import { IndexerActivity, VeranaSyncState } from '../types';
 export declare function applyStateMutation(state: VeranaSyncState, activity: IndexerActivity): void;
@@ -16,11 +16,30 @@ export declare function upsertParticipant(state: VeranaSyncState, activity: Inde
 }): void;
 export declare function reconcileVtFlowRecordsForParticipant(agent: VsAgent, participantId: string, reconcile: (record: VtFlowRecord, service: VtFlowService, agentContext: AgentContext) => Promise<string | null>, errorLabel: string): Promise<void>;
 export declare function markVtFlowRecordsValidated(agent: VsAgent, participantId: string): Promise<void>;
+/**
+ * Close the onboarding records of a participant that receives no credential.
+ *
+ * Only a HOLDER takes part in a credential exchange, and the exchange is what moves a record to
+ * COMPLETED. An ISSUER, a VERIFIER or a grantor is finished the moment the chain records
+ * SetParticipantOPToValidated, so without this both sides would sit at OR_SENT and VALIDATED for
+ * ever. The applicant reaches its own record here, because it watches the same chain event.
+ */
+export declare function completeVtFlowRecordsWithoutCredential(agent: VsAgent, participantId: string): Promise<void>;
 export declare function setVtFlowRecordsParticipantRevoked(agent: VsAgent, participantId: string): Promise<void>;
 export declare function setVtFlowRecordsParticipantSlashed(agent: VsAgent, participantId: string): Promise<void>;
 /** VSA-VTI-FLOW-OP-REVOKE: a revoked/slashed HOLDER's credential is gone; drop its linked VP and stored VTC. */
 export declare function removeHolderTrustCredentialIfRevoked(agent: VsAgent, participantId: string): Promise<void>;
+/**
+ * VSA-VTI-FLOW-OP-REVOKE: an ECS credential anchored against a revoked ISSUER still verifies, but a
+ * resolver reports the Participant as REVOKED and the whole DID then fails VS-CONN-VS.
+ */
+export declare function removeSelfIssuedEcsCredentialsIfIssuerRevoked(agent: VsAgent, participantId: string): Promise<void>;
 export declare function reconcileVtFlowRecordsOnCancel(agent: VsAgent, participantId: string): Promise<void>;
 export declare function startParticipantOPAutoFlow(agent: VsAgent, activity: IndexerActivity): Promise<void>;
-export declare function reconcileVtjscPublications(agent: VsAgent, indexer: VeranaIndexerService, corporationId: number, selfTrDefaults?: SelfTrDefaults): Promise<void>;
+export declare function reconcileVtjscPublications(agent: VsAgent, indexer: VeranaIndexerService, corporationId: number, ecsClaims?: EcsClaims): Promise<void>;
+/**
+ * Publishes the one AnonCreds schema that governs every credential of a VTJSC, per [VSA-PUB-AC-5].
+ * Only the issuer of the VTJSC publishes it. The call is idempotent.
+ */
+export declare function publishAnonCredsSchemaForVtjsc(agent: VsAgent, credentialSchemaId: string | number, jsonSchema: string | object, jsonSchemaCredentialId: string): Promise<string | undefined>;
 export declare function publishVtjscIfOwner(state: VeranaSyncState, agent: VsAgent, schemaEntityId: string, agentCorporationId?: number): Promise<void>;

package/build/blockchain/handlers/stateMutations.js

@@ -7,22 +7,30 @@ exports.upsertCredentialSchema = upsertCredentialSchema;
 exports.upsertParticipant = upsertParticipant;
 exports.reconcileVtFlowRecordsForParticipant = reconcileVtFlowRecordsForParticipant;
 exports.markVtFlowRecordsValidated = markVtFlowRecordsValidated;
+exports.completeVtFlowRecordsWithoutCredential = completeVtFlowRecordsWithoutCredential;
 exports.setVtFlowRecordsParticipantRevoked = setVtFlowRecordsParticipantRevoked;
 exports.setVtFlowRecordsParticipantSlashed = setVtFlowRecordsParticipantSlashed;
 exports.removeHolderTrustCredentialIfRevoked = removeHolderTrustCredentialIfRevoked;
+exports.removeSelfIssuedEcsCredentialsIfIssuerRevoked = removeSelfIssuedEcsCredentialsIfIssuerRevoked;
 exports.reconcileVtFlowRecordsOnCancel = reconcileVtFlowRecordsOnCancel;
 exports.startParticipantOPAutoFlow = startParticipantOPAutoFlow;
 exports.reconcileVtjscPublications = reconcileVtjscPublications;
+exports.publishAnonCredsSchemaForVtjsc = publishAnonCredsSchemaForVtjsc;
 exports.publishVtjscIfOwner = publishVtjscIfOwner;
+const anoncreds_1 = require("@credo-ts/anoncreds");
 const credo_ts_didcomm_vt_flow_1 = require("@verana-labs/credo-ts-didcomm-vt-flow");
 const vs_agent_model_1 = require("@verana-labs/vs-agent-model");
+const types_1 = require("../../types");
+const agent_1 = require("../../utils/agent");
 const data_1 = require("../../utils/data");
+const didReadiness_1 = require("../../utils/didReadiness");
 const setupSelfTr_1 = require("../../utils/setupSelfTr");
+const ecsClaims_1 = require("../../utils/ecsClaims");
 const trustCredentialStore_1 = require("../../utils/trustCredentialStore");
+const util_1 = require("../../utils/util");
+const vtjscResolver_1 = require("../../utils/vtjscResolver");
 const vtFlow_1 = require("../../vtFlow");
-const types_1 = require("../types");
-const DEFAULT_CHAIN_ID = 'vna-testnet-1';
-const PARTICIPANT_ROLE_HOLDER = 6;
+const types_2 = require("../types");
 function applyStateMutation(state, activity) {
     var _a;
     switch (activity.msg) {
@@ -164,6 +172,25 @@ async function markVtFlowRecordsValidated(agent, participantId) {
         return 'VALIDATED';
     }, 'Failed to markValidated');
 }
+/**
+ * Close the onboarding records of a participant that receives no credential.
+ *
+ * Only a HOLDER takes part in a credential exchange, and the exchange is what moves a record to
+ * COMPLETED. An ISSUER, a VERIFIER or a grantor is finished the moment the chain records
+ * SetParticipantOPToValidated, so without this both sides would sit at OR_SENT and VALIDATED for
+ * ever. The applicant reaches its own record here, because it watches the same chain event.
+ */
+async function completeVtFlowRecordsWithoutCredential(agent, participantId) {
+    const participant = await agent.indexer.findParticipant(participantId).catch(() => undefined);
+    if (!participant || participant.role === types_1.HOLDER_PARTICIPANT_TYPE)
+        return;
+    await reconcileVtFlowRecordsForParticipant(agent, participantId, async (record, service, agentContext) => {
+        if (record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.Completed || (0, credo_ts_didcomm_vt_flow_1.isVtFlowTerminalState)(record.state))
+            return null;
+        await service.markCompleted(agentContext, record.id);
+        return 'COMPLETED';
+    }, 'Failed to mark COMPLETED');
+}
 async function setVtFlowRecordsParticipantRevoked(agent, participantId) {
     await reconcileVtFlowRecordsForParticipant(agent, participantId, async (record, service, agentContext) => {
         if (record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.ParticipantRevoked ||
@@ -196,9 +223,8 @@ async function setVtFlowRecordsParticipantSlashed(agent, participantId) {
 }
 /** VSA-VTI-FLOW-OP-REVOKE: a revoked/slashed HOLDER's credential is gone; drop its linked VP and stored VTC. */
 async function removeHolderTrustCredentialIfRevoked(agent, participantId) {
-    var _a;
-    const participant = await ((_a = agent.veranaChain) === null || _a === void 0 ? void 0 : _a.getParticipant(Number(participantId)).catch(() => undefined));
-    if ((participant === null || participant === void 0 ? void 0 : participant.role) !== PARTICIPANT_ROLE_HOLDER || participant.did !== agent.did)
+    const participant = await agent.indexer.findParticipant(participantId).catch(() => undefined);
+    if ((participant === null || participant === void 0 ? void 0 : participant.role) !== types_1.HOLDER_PARTICIPANT_TYPE || participant.did !== agent.did)
         return;
     if (!agent.publicApiBaseUrl)
         return;
@@ -209,7 +235,7 @@ async function removeHolderTrustCredentialIfRevoked(agent, participantId) {
         if (record.role !== credo_ts_didcomm_vt_flow_1.VtFlowRole.Applicant || !record.credentialExchangeRecordId)
             continue;
         try {
-            const credentialId = await (0, trustCredentialStore_1.removeStoredTrustCredential)(agent, agent.publicApiBaseUrl, record.credentialExchangeRecordId);
+            const credentialId = await (0, trustCredentialStore_1.removeStoredTrustCredential)(agent, record.credentialExchangeRecordId);
             if (credentialId) {
                 agent.config.logger.info(`[IndexerWS] Removed linked VP and stored credential ${credentialId} (participant=${participantId})`);
             }
@@ -219,10 +245,29 @@ async function removeHolderTrustCredentialIfRevoked(agent, participantId) {
         }
     }
 }
+/**
+ * VSA-VTI-FLOW-OP-REVOKE: an ECS credential anchored against a revoked ISSUER still verifies, but a
+ * resolver reports the Participant as REVOKED and the whole DID then fails VS-CONN-VS.
+ */
+async function removeSelfIssuedEcsCredentialsIfIssuerRevoked(agent, participantId) {
+    if (!agent.publicApiBaseUrl)
+        return;
+    const participant = await agent.indexer.findParticipant(participantId).catch(() => undefined);
+    if ((participant === null || participant === void 0 ? void 0 : participant.role) !== types_1.ISSUER_PARTICIPANT_TYPE || participant.did !== agent.did)
+        return;
+    try {
+        const withdrawn = await (0, trustCredentialStore_1.withdrawSelfIssuedEcsCredentials)(agent, participant.id);
+        for (const jscUrl of withdrawn) {
+            agent.config.logger.info(`[SelfTR] Withdrew the self-issued ECS credential bound to ${jscUrl} (issuer participant ${participantId})`);
+        }
+    }
+    catch (e) {
+        agent.config.logger.error(`[SelfTR] Failed to withdraw the ECS credentials of the revoked ISSUER participant ${participantId}`, e);
+    }
+}
 async function reconcileVtFlowRecordsOnCancel(agent, participantId) {
-    var _a;
-    const participant = await ((_a = agent.veranaChain) === null || _a === void 0 ? void 0 : _a.getParticipant(Number(participantId)).catch(() => undefined));
-    const stillValidated = Number(participant === null || participant === void 0 ? void 0 : participant.opState) === types_1.ValidationState.VALIDATED;
+    const participant = await agent.indexer.findParticipant(participantId).catch(() => undefined);
+    const stillValidated = Number(participant === null || participant === void 0 ? void 0 : participant.opState) === types_2.ValidationState.VALIDATED;
     await reconcileVtFlowRecordsForParticipant(agent, participantId, async (record, service, agentContext) => {
         if ((0, credo_ts_didcomm_vt_flow_1.isVtFlowTerminalState)(record.state))
             return null;
@@ -236,6 +281,20 @@ async function reconcileVtFlowRecordsOnCancel(agent, participantId) {
         return 'TERMINATED_BY_APPLICANT';
     }, 'Failed to reconcile record after cancel');
 }
+// [VSA-VTI-CFG-ENV-ECS]: the applicant proposes its own claims, and the validator may override
+// them. The field is omitted when the operator configured none.
+async function onboardingClaims(agent, schemaId) {
+    if (!agent.ecsClaims || !agent.did)
+        return undefined;
+    const schema = await agent.indexer.getCredentialSchema(schemaId);
+    const ecsKey = schema && (await (0, vs_agent_model_1.classifyEcsSchema)(schema.json_schema));
+    if (!ecsKey) {
+        agent.config.logger.warn(`[ecs-claims] schema ${schemaId} is not an ECS schema, sending no claims`);
+        return undefined;
+    }
+    // a digest the agent cannot compute must stop the flow, per [VSA-VTI-CFG-ENV-ECS]
+    return await (0, ecsClaims_1.composeEcsClaims)(agent.ecsClaims, ecsKey, agent.config.logger);
+}
 async function startParticipantOPAutoFlow(agent, activity) {
     const chain = agent.veranaChain;
     if (!chain)
@@ -243,62 +302,224 @@ async function startParticipantOPAutoFlow(agent, activity) {
     const applicantParticipantId = Number(activity.entity_id);
     if (!Number.isFinite(applicantParticipantId))
         return;
-    const holderParticipant = await chain.getParticipant(applicantParticipantId);
+    const holderParticipant = await agent.indexer.findParticipant(applicantParticipantId);
     if (!holderParticipant || holderParticipant.did !== agent.did)
         return;
     try {
+        await (0, didReadiness_1.waitUntilOwnDidIsPubliclyResolvable)(agent, agent.config.logger);
         const orchestrator = new vtFlow_1.VtFlowOrchestrator(agent);
-        await orchestrator.startOnboardingProcess({ applicantParticipantId });
+        const claims = await onboardingClaims(agent, holderParticipant.schemaId);
+        await orchestrator.startOnboardingProcess(Object.assign({ applicantParticipantId }, (claims ? { claims } : {})));
     }
     catch (err) {
         agent.config.logger.error(`[IndexerWS] StartParticipantOP auto-flow failed: ${err.message}\n${err.stack}`);
     }
 }
-async function reconcileVtjscPublications(agent, indexer, corporationId, selfTrDefaults) {
+async function reconcileVtjscPublications(agent, indexer, corporationId, ecsClaims) {
     var _a, _b, _c, _d;
     if (!agent.did || !agent.publicApiBaseUrl)
         return;
-    const chainId = (_b = (_a = agent.veranaChain) === null || _a === void 0 ? void 0 : _a.getChainId) !== null && _b !== void 0 ? _b : DEFAULT_CHAIN_ID;
+    const chainId = (_a = agent.veranaChain) === null || _a === void 0 ? void 0 : _a.getChainId;
+    if (!chainId) {
+        agent.config.logger.warn('[VTJSC] Skipping reconciliation: the agent is not connected to a chain');
+        return;
+    }
     const ecosystems = await indexer.listEcosystems();
-    for (const ecosystem of ecosystems.filter(entry => Number(entry.corporation_id) === corporationId)) {
+    const controlled = ecosystems.filter(entry => Number(entry.corporation_id) === corporationId);
+    const reconciled = new Set();
+    for (const ecosystem of controlled) {
         for (const schema of await indexer.listCredentialSchemas(ecosystem.id)) {
             const [didRecord] = await agent.dids.getCreatedDids({ did: agent.did });
             if (!didRecord)
                 return;
             const schemaRef = `vpr:verana:${chainId}:cs:${schema.id}`;
+            reconciled.add(schemaRef);
             const expectedDigest = (0, setupSelfTr_1.generateDigestSRI)(schema.json_schema);
             const existingJsc = (0, trustCredentialStore_1.findMetadataEntry)(didRecord, '_vt/jsc', '', schemaRef);
-            const existingDigest = (_d = (_c = existingJsc === null || existingJsc === void 0 ? void 0 : existingJsc.credential) === null || _c === void 0 ? void 0 : _c.credentialSubject) === null || _d === void 0 ? void 0 : _d.digestSRI;
-            if (!existingJsc || existingDigest !== expectedDigest) {
-                try {
-                    await (0, trustCredentialStore_1.createJsc)(agent, agent.publicApiBaseUrl, (0, data_1.getEcsSchemas)(agent.publicApiBaseUrl), {
+            const existingDigest = (_c = (_b = existingJsc === null || existingJsc === void 0 ? void 0 : existingJsc.credential) === null || _b === void 0 ? void 0 : _b.credentialSubject) === null || _c === void 0 ? void 0 : _c.digestSRI;
+            let jsonSchemaCredentialId = (_d = existingJsc === null || existingJsc === void 0 ? void 0 : existingJsc.credential) === null || _d === void 0 ? void 0 : _d.id;
+            try {
+                if (!existingJsc || existingDigest !== expectedDigest) {
+                    const credential = await (0, trustCredentialStore_1.createJsc)(agent, agent.publicApiBaseUrl, (0, data_1.getEcsSchemas)(agent.publicApiBaseUrl), {
                         schemaBaseId: String(schema.id),
                         jsonSchemaRef: schemaRef,
                         precomputedDigestSRI: expectedDigest,
                     });
+                    jsonSchemaCredentialId = credential.id;
                     agent.config.logger.info(`[VTJSC] Reconciled VTJSC for schema ${schema.id} (ecosystem ${ecosystem.id})`);
                 }
-                catch (e) {
-                    agent.config.logger.error(`[VTJSC] Failed to reconcile VTJSC for schema ${schema.id}`, e);
-                    continue;
+                else if (await (0, trustCredentialStore_1.reattachVtjscPublication)(agent, schemaRef)) {
+                    agent.config.logger.info(`[VTJSC] Re-attached the VTJSC of schema ${schema.id} (ecosystem ${ecosystem.id})`);
                 }
             }
-            if (selfTrDefaults) {
-                try {
-                    const ecsKey = await (0, vs_agent_model_1.identifySchema)(JSON.parse(schema.json_schema));
-                    if (!ecsKey)
-                        continue;
-                    await (0, trustCredentialStore_1.rebindEcsCredentialSchema)(agent, agent.publicApiBaseUrl, String(schema.id), ecsKey, selfTrDefaults);
-                }
-                catch (e) {
-                    agent.config.logger.error(`[VTJSC] Failed to rebind ECS credential for schema ${schema.id}`, e);
+            catch (e) {
+                agent.config.logger.error(`[VTJSC] Failed to reconcile VTJSC for schema ${schema.id}`, e);
+            }
+            // an agent that published a VTJSC before [VSA-PUB-AC-5] has no AnonCreds schema for it yet
+            if (!jsonSchemaCredentialId)
+                continue;
+            try {
+                await publishAnonCredsSchemaForVtjsc(agent, schema.id, schema.json_schema, jsonSchemaCredentialId);
+            }
+            catch (e) {
+                agent.config.logger.error(`[VTJSC] Failed to reconcile the AnonCreds schema of ${jsonSchemaCredentialId}`, e);
+            }
+        }
+    }
+    await detachUncontrolledVtjscPublications(agent, indexer, corporationId, chainId, reconciled);
+    if (ecsClaims)
+        await reconcileSelfIssuedEcsCredentials(agent, indexer, ecsClaims);
+}
+/** The `_vt/jsc` key that `createJsc` writes for an on-chain `CredentialSchema`. */
+const onChainSchemaRefPrefix = (chainId) => `vpr:verana:${chainId}:cs:`;
+/**
+ * VSA-VTI-VTJSC: only the controller of an Ecosystem advertises a VTJSC for its schemas. Archival
+ * is not a loss of control — the agent keeps it, and [VSA-VTI-NOTIF-ES] gives it no handler.
+ *
+ * Each entry is resolved against the VPR one by one rather than diffed against `listEcosystems`:
+ * that endpoint is unpaginated here, and a truncated page reads like a loss of control.
+ */
+async function detachUncontrolledVtjscPublications(agent, indexer, corporationId, chainId, reconciled) {
+    const [didRecord] = await agent.dids.getCreatedDids({ did: agent.did });
+    if (!didRecord)
+        return;
+    const metadata = didRecord.metadata.get('_vt/jsc');
+    if (!metadata)
+        return;
+    const prefix = onChainSchemaRefPrefix(chainId);
+    const ecosystemCache = new Map();
+    const stale = [];
+    for (const schemaRef of Object.keys(metadata)) {
+        // the agent's own schema credentials live in this bucket, keyed by public URL.
+        if (!schemaRef.startsWith(prefix))
+            continue;
+        if (reconciled.has(schemaRef))
+            continue;
+        const schemaId = schemaRef.slice(prefix.length);
+        try {
+            const schema = await indexer.getCredentialSchema(schemaId);
+            const ecosystemId = String(schema.ecosystem_id);
+            if (!ecosystemCache.has(ecosystemId)) {
+                ecosystemCache.set(ecosystemId, await indexer.getEcosystem(ecosystemId));
+            }
+            const ecosystem = ecosystemCache.get(ecosystemId);
+            if (!ecosystem)
+                continue;
+            if (Number(ecosystem.corporation_id) === corporationId)
+                continue;
+            agent.config.logger.info(`[VTJSC] Detaching the VTJSC of schema ${schemaId}: ecosystem ${ecosystemId} belongs to ` +
+                `corporation ${ecosystem.corporation_id}`);
+            stale.push(schemaRef);
+        }
+        catch (error) {
+            // A lookup the VPR cannot answer is not evidence of anything; leave the entry advertised.
+            agent.config.logger.debug(`[VTJSC] Keeping the VTJSC of schema ${schemaId}: ${error.message}`);
+        }
+    }
+    if (stale.length === 0)
+        return;
+    const detached = await (0, trustCredentialStore_1.detachVtjscPublications)(agent, stale);
+    if (detached.length > 0) {
+        agent.config.logger.info(`[VTJSC] Detached ${detached.length} VTJSC publication(s)`);
+    }
+}
+/**
+ * Rebinds and anchors this agent's own ECS credentials.
+ *
+ * It follows the ISSUER Participant entries the agent holds, not the Ecosystems its Corporation
+ * controls: an agent may issue against an Ecosystem that another Corporation owns, and an
+ * Ecosystem controller may hold no ISSUER entry at all. An entry is usable only when it names
+ * this agent's account as its vs_operator, because the chain accepts the anchoring
+ * CreateOrUpdateParticipantSession from no other signer.
+ */
+async function reconcileSelfIssuedEcsCredentials(agent, indexer, ecsClaims) {
+    const chain = agent.veranaChain;
+    if (!chain || !agent.did || !agent.publicApiBaseUrl)
+        return;
+    const chainId = chain.getChainId;
+    // A Participant revoked while the agent was down delivers no event it can still act on. Runs
+    // first, so a schema whose ISSUER entry was replaced ends up bound to the new one.
+    for (const participantState of [types_2.ParticipantState.Revoked, types_2.ParticipantState.Slashed]) {
+        try {
+            const stale = await indexer.listParticipants({
+                did: agent.did,
+                role: types_2.ParticipantRole.Issuer,
+                participantState,
+            });
+            for (const issuer of stale) {
+                const withdrawn = await (0, trustCredentialStore_1.withdrawSelfIssuedEcsCredentials)(agent, issuer.id);
+                for (const jscUrl of withdrawn) {
+                    agent.config.logger.info(`[SelfTR] Withdrew the self-issued ECS credential bound to ${jscUrl} (${participantState} issuer participant ${issuer.id})`);
                 }
             }
         }
+        catch (e) {
+            agent.config.logger.error(`[SelfTR] Failed to withdraw the ECS credentials of ${participantState} ISSUER participants`, e);
+        }
+    }
+    const issuers = await indexer.listParticipants({
+        did: agent.did,
+        role: types_2.ParticipantRole.Issuer,
+        participantState: types_2.ParticipantState.Active,
+    });
+    for (const issuer of issuers) {
+        if (issuer.revoked || issuer.slashed || issuer.vs_operator !== chain.address)
+            continue;
+        try {
+            const schema = await indexer.getCredentialSchema(issuer.schema_id);
+            const ecsKey = await (0, vs_agent_model_1.classifyEcsSchema)(schema.json_schema);
+            if (ecsKey !== 'ecs-service')
+                continue;
+            const jsonSchemaCredentialId = await (0, vtjscResolver_1.resolveJsonSchemaCredentialId)(agent, indexer, schema.id, chainId);
+            await (0, trustCredentialStore_1.rebindEcsCredentialSchema)(agent, agent.publicApiBaseUrl, String(schema.id), ecsKey, ecsClaims, jsonSchemaCredentialId, issuer.id, schema.json_schema);
+        }
+        catch (e) {
+            agent.config.logger.error(`[SelfTR] Failed to rebind the ECS credential of schema ${issuer.schema_id}`, e);
+        }
+    }
+}
+/**
+ * Publishes the one AnonCreds schema that governs every credential of a VTJSC, per [VSA-PUB-AC-5].
+ * Only the issuer of the VTJSC publishes it. The call is idempotent.
+ */
+async function publishAnonCredsSchemaForVtjsc(agent, credentialSchemaId, jsonSchema, jsonSchemaCredentialId) {
+    if (!agent.did)
+        return undefined;
+    const [published] = await agent.modules.anoncreds.getCreatedSchemas({
+        relatedJsonSchemaCredentialId: jsonSchemaCredentialId,
+    });
+    if (published)
+        return published.schemaId;
+    const { name, attrNames } = (0, util_1.anonCredsSchemaFromJsonSchema)(jsonSchema);
+    // used for consistency when a similar schema already exists
+    const version = String(credentialSchemaId);
+    const { schemaState, registrationMetadata } = await agent.modules.anoncreds.registerSchema({
+        schema: { attrNames, name, version, issuerId: agent.did },
+        options: { extraMetadata: { relatedJsonSchemaCredentialId: jsonSchemaCredentialId } },
+    });
+    if (schemaState.state !== 'finished') {
+        const detail = schemaState.state === 'failed' ? schemaState.reason : schemaState.state;
+        throw new Error(`Failed to register the AnonCreds schema of ${jsonSchemaCredentialId}: ${detail}`);
     }
+    const { schemaId } = schemaState;
+    const schemaRepository = agent.dependencyManager.resolve(anoncreds_1.AnonCredsSchemaRepository);
+    const schemaRecord = await schemaRepository.findBySchemaId(agent.context, schemaId);
+    if (schemaRecord) {
+        schemaRecord.setTag('relatedJsonSchemaCredentialId', jsonSchemaCredentialId);
+        await schemaRepository.update(agent.context, schemaRecord);
+    }
+    // the did:web layout builds no attested resource: it serves the object from the AnonCreds record
+    const { attestedResource } = registrationMetadata;
+    if (attestedResource) {
+        await (0, agent_1.saveAttestedResource)(agent, attestedResource, {
+            resourceType: 'anonCredsSchema',
+            relatedJsonSchemaCredentialId: jsonSchemaCredentialId,
+        });
+    }
+    return schemaId;
 }
 async function publishVtjscIfOwner(state, agent, schemaEntityId, agentCorporationId) {
-    var _a, _b;
+    var _a;
     const schema = state.credentialSchemas[schemaEntityId];
     if (!schema) {
         agent.config.logger.warn(`[VTJSC] Schema ${schemaEntityId} not found in state`);
@@ -313,19 +534,36 @@ async function publishVtjscIfOwner(state, agent, schemaEntityId, agentCorporatio
         agent.config.logger.debug(`[VTJSC] Skipping schema ${schema.id}: ecosystem ${ecosystem.id} belongs to corporation ${ecosystem.corporationId}`);
         return;
     }
-    const chainId = (_b = (_a = agent.veranaChain) === null || _a === void 0 ? void 0 : _a.getChainId) !== null && _b !== void 0 ? _b : DEFAULT_CHAIN_ID;
+    const chainId = (_a = agent.veranaChain) === null || _a === void 0 ? void 0 : _a.getChainId;
+    if (!chainId) {
+        agent.config.logger.warn(`[VTJSC] Skipping schema ${schema.id}: the agent is not connected to a chain`);
+        return;
+    }
     const jsonSchemaRef = `vpr:verana:${chainId}:cs:${schema.id}`;
     const digestSRI = (0, setupSelfTr_1.generateDigestSRI)(schema.jsonSchema);
+    let jsonSchemaCredentialId;
     try {
-        await (0, trustCredentialStore_1.createJsc)(agent, agent.publicApiBaseUrl, (0, data_1.getEcsSchemas)(agent.publicApiBaseUrl), {
+        const credential = await (0, trustCredentialStore_1.createJsc)(agent, agent.publicApiBaseUrl, (0, data_1.getEcsSchemas)(agent.publicApiBaseUrl), {
             schemaBaseId: String(schema.id),
             jsonSchemaRef,
             precomputedDigestSRI: digestSRI,
         });
+        jsonSchemaCredentialId = credential.id;
         agent.config.logger.info(`[VTJSC] Published VTJSC for schema ${schema.id} (Ecosystem ${schema.ecosystemId}) at block ${state.lastBlockHeight}`);
     }
     catch (e) {
         agent.config.logger.error(`[VTJSC] Failed to publish VTJSC for schema ${schema.id}`, e);
+        return;
+    }
+    // an AnonCreds failure keeps the VTJSC: the startup reconciliation retries the schema
+    if (!jsonSchemaCredentialId)
+        return;
+    try {
+        const schemaId = await publishAnonCredsSchemaForVtjsc(agent, schema.id, schema.jsonSchema, jsonSchemaCredentialId);
+        agent.config.logger.info(`[VTJSC] Published the AnonCreds schema ${schemaId} of ${jsonSchemaCredentialId}`);
+    }
+    catch (e) {
+        agent.config.logger.error(`[VTJSC] Failed to publish the AnonCreds schema of ${jsonSchemaCredentialId}`, e);
     }
 }
 //# sourceMappingURL=stateMutations.js.map