@verana-labs/vs-agent-sdk 2.0.0-dev.7 → 2.0.0-dev.70

package/build/vtFlow/VtFlowOrchestrator.js

@@ -3,10 +3,44 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.VtFlowOrchestrator = void 0;
 const core_1 = require("@credo-ts/core");
 const credo_ts_didcomm_vt_flow_1 = require("@verana-labs/credo-ts-didcomm-vt-flow");
+const verana_types_1 = require("@verana-labs/verana-types");
 const verre_1 = require("@verana-labs/verre");
+const vs_agent_model_1 = require("@verana-labs/vs-agent-model");
+const adminApi_1 = require("../adminApi");
+const ecsIssuanceExemption_1 = require("./ecsIssuanceExemption");
 const types_1 = require("../blockchain/types");
 const types_2 = require("../types");
 const utils_1 = require("../utils");
+// The chain carries a fee discount as an integer from 0 to 10000. The API and the indexer carry it
+// as a decimal from 0 to 1, so only the message is scaled.
+const DISCOUNT_SCALE = 10000;
+const TX_LOOKUP_TIMEOUT_MS = 60000;
+const TX_LOOKUP_INTERVAL_MS = 3000;
+const FEE_DENOM = 'uvna';
+const FEE_KEYS = ['validationFees', 'issuanceFees', 'verificationFees'];
+const DISCOUNT_KEYS = ['issuanceFeeDiscount', 'verificationFeeDiscount'];
+function invalidInput(message) {
+    return new adminApi_1.AdminApiError(adminApi_1.AdminApiErrorCode.InvalidInput, 400, message);
+}
+function invalidState(message) {
+    return new adminApi_1.AdminApiError(adminApi_1.AdminApiErrorCode.InvalidState, 409, message);
+}
+// AUTHZ-CHECK-3 step 1. A record's expiration is only its budget clock, not a validity window.
+function isActiveParticipant(participant) {
+    const now = Date.now();
+    if (!participant.effective_from || Date.parse(participant.effective_from) > now)
+        return false;
+    if (participant.effective_until && Date.parse(participant.effective_until) <= now)
+        return false;
+    return !participant.revoked && !participant.slashed;
+}
+function sameTerm(key, given, onEntry) {
+    const scale = DISCOUNT_KEYS.includes(key) ? DISCOUNT_SCALE : 1;
+    return Math.round(given * scale) === Math.round(onEntry * scale);
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
 class VtFlowOrchestrator {
     constructor(agent, options = {}) {
         this.agent = agent;
@@ -14,10 +48,10 @@ class VtFlowOrchestrator {
     }
     async startOnboardingProcess(input) {
         var _a, _b, _c, _d;
-        const chain = this.requireChain();
+        this.requireChain();
         if (!this.agent.did)
             throw new Error('Agent has no public DID');
-        const holderParticipant = await chain.getParticipant(input.applicantParticipantId);
+        const holderParticipant = await this.agent.indexer.findParticipant(input.applicantParticipantId);
         if (!holderParticipant) {
             throw new Error(`Applicant participant ${input.applicantParticipantId} not found on chain`);
         }
@@ -37,7 +71,7 @@ class VtFlowOrchestrator {
         if (!holderParticipant.validatorParticipantId) {
             throw new Error(`Applicant participant ${input.applicantParticipantId} has no validator_participant_id`);
         }
-        const validatorParticipant = await chain.getParticipant(Number(holderParticipant.validatorParticipantId));
+        const validatorParticipant = await this.agent.indexer.findParticipant(Number(holderParticipant.validatorParticipantId));
         if (!(validatorParticipant === null || validatorParticipant === void 0 ? void 0 : validatorParticipant.did)) {
             throw new Error(`Validator participant ${holderParticipant.validatorParticipantId} not resolvable`);
         }
@@ -47,46 +81,60 @@ class VtFlowOrchestrator {
         // Renewals resend the OR with the same session id so the validator re-attaches the finished flow.
         const vtFlowApi = this.resolveVtFlowApi();
         const [latest] = (await vtFlowApi.findAllByQuery({
-            participantId: String(holderParticipant.id),
+            applicantParticipantId: String(holderParticipant.id),
             role: credo_ts_didcomm_vt_flow_1.VtFlowRole.Applicant,
             flowVariant: credo_ts_didcomm_vt_flow_1.VtFlowVariant.OnboardingProcess,
         }))
             .filter(record => !(0, credo_ts_didcomm_vt_flow_1.isVtFlowTerminalState)(record.state))
             .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
-        if (latest && latest.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.Completed && latest.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.CredRevoked) {
-            this.agent.config.logger.info(`[vt-flow] onboarding flow ${latest.id} for participant ${holderParticipant.id} is already in progress (state ${latest.state}); not resending`);
-            return latest;
-        }
-        const existing = latest;
+        const running = latest !== undefined &&
+            latest.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.Completed &&
+            latest.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.CredRevoked;
         let connectionId;
-        if (existing) {
-            const connection = await this.agent.didcomm.connections.findById(existing.connectionId);
-            if (connection === null || connection === void 0 ? void 0 : connection.isReady)
+        if (latest) {
+            const connection = await this.agent.didcomm.connections.findById(latest.connectionId);
+            if (connection && (0, utils_1.isUsableConnectionTo)(connection, validatorParticipant.did))
                 connectionId = connection.id;
         }
+        const undelivered = running && latest.state === credo_ts_didcomm_vt_flow_1.VtFlowState.OrSent && holderParticipant.opState === types_1.ValidationState.PENDING;
+        if (running && connectionId && !undelivered) {
+            this.agent.config.logger.info(`[vt-flow] onboarding flow ${latest.id} for participant ${holderParticipant.id} is in progress (state ${latest.state}) on an open connection, not resending`);
+            return latest;
+        }
         if (!connectionId) {
-            const { connectionRecord } = await this.agent.didcomm.oob.receiveImplicitInvitation({
-                did: validatorParticipant.did,
-                ourDid: this.agent.did,
-                label: this.agent.label,
-                didCommVersion: 'v2',
-            });
-            if (!connectionRecord)
-                throw new Error('Failed to establish DIDComm connection to validator');
-            const ready = await this.agent.didcomm.connections.returnWhenIsConnected(connectionRecord.id);
-            connectionId = ready.id;
+            connectionId = await (0, utils_1.connectToPublicDid)(this.agent, validatorParticipant.did);
+        }
+        if (running) {
+            this.agent.config.logger.info(`[vt-flow] resending the onboarding request of flow ${latest.id} (state ${latest.state}) on ${connectionId === latest.connectionId ? 'its' : 'a new'} connection`);
+            return vtFlowApi.resendOnboardingRequest({ vtFlowRecordId: latest.id, connectionId });
         }
         return vtFlowApi.sendOnboardingRequest({
             connectionId,
-            participantSessionId: (_b = (_a = input.participantSessionId) !== null && _a !== void 0 ? _a : existing === null || existing === void 0 ? void 0 : existing.participantSessionId) !== null && _b !== void 0 ? _b : core_1.utils.uuid(),
-            participantId: String(holderParticipant.id),
+            participantSessionId: (_b = (_a = input.participantSessionId) !== null && _a !== void 0 ? _a : latest === null || latest === void 0 ? void 0 : latest.participantSessionId) !== null && _b !== void 0 ? _b : core_1.utils.uuid(),
+            applicantParticipantId: String(holderParticipant.id),
+            applicantParticipantRole: Number(holderParticipant.role),
+            validatorParticipantId: String(holderParticipant.validatorParticipantId),
+            schemaId: String(holderParticipant.schemaId),
             agentParticipantId: String((_c = this.options.agentParticipantId) !== null && _c !== void 0 ? _c : 0),
             walletAgentParticipantId: String((_d = this.options.walletAgentParticipantId) !== null && _d !== void 0 ? _d : 0),
             claims: input.claims,
         });
     }
-    async validateAndOfferCredential(input) {
-        var _a;
+    /**
+     * Validate an onboarding process: record the outcome on-chain, accept the onboarding request and
+     * move the record to VALIDATED. It sends no credential. Only a HOLDER takes part in a credential
+     * exchange; an ISSUER, a VERIFIER or a grantor joins the Ecosystem, and SetParticipantOPToValidated
+     * is the whole of it. The caller decides what follows, from the role of the returned participant.
+     *
+     * For a HOLDER it builds the credential before the chain write, and returns it for
+     * offerOnboardingCredential. Claims that do not satisfy the schema, or a schema fetch that fails,
+     * must stop the process while the chain holds no outcome yet and the caller can repeat the call.
+     *
+     * A record that is already VALIDATED and has no credential exchange keeps the chain outcome and
+     * only builds the credential again. A repeat call thus re-drives an offer that did not complete.
+     */
+    async validateOnboardingProcess(input) {
+        var _a, _b;
         const chain = this.requireChain();
         if (!this.agent.did)
             throw new Error('Agent has no public DID');
@@ -99,43 +147,387 @@ class VtFlowOrchestrator {
         if (record.variant !== credo_ts_didcomm_vt_flow_1.VtFlowVariant.OnboardingProcess) {
             throw new Error(`Record variant is '${record.variant}', expected OnboardingProcess`);
         }
-        if (record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingOr) {
-            throw new Error(`Record state is '${record.state}', expected '${credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingOr}'`);
-        }
-        if (!record.participantId)
-            throw new Error('Record has no participantId');
-        const holderParticipantId = Number(record.participantId);
-        const holderParticipant = await chain.getParticipant(holderParticipantId);
-        if (!holderParticipant)
-            throw new Error(`Holder participant ${holderParticipantId} not found on chain`);
-        if (!holderParticipant.did)
-            throw new Error('Holder participant has no DID');
-        const unsignedCredentialJson = await this.buildCredential({
-            credentialSchemaId: input.credentialSchemaId,
-            subjectDid: holderParticipant.did,
-            claims: ((_a = record.claims) !== null && _a !== void 0 ? _a : {}),
-            credentialType: input.credentialType,
-            credentialContext: input.credentialContext,
-        });
+        const resumeOffer = record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.Validated && !record.credentialExchangeRecordId;
+        if (record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingOr && !resumeOffer) {
+            throw new Error(`Record state is '${record.state}', expected '${credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingOr}', or ` +
+                `'${credo_ts_didcomm_vt_flow_1.VtFlowState.Validated}' with no credential exchange`);
+        }
+        if (!record.applicantParticipantId)
+            throw new Error('Record has no applicantParticipantId');
+        const participantId = Number(record.applicantParticipantId);
+        const participant = await this.agent.indexer.findParticipant(participantId);
+        if (!participant)
+            throw new Error(`Applicant participant ${participantId} not found on chain`);
+        if (!participant.did)
+            throw new Error('Applicant participant has no DID');
+        const credential = Number(participant.role) === types_2.HOLDER_PARTICIPANT_TYPE
+            ? await this.buildCredential({
+                credentialSchemaId: (_a = input.credentialSchemaId) !== null && _a !== void 0 ? _a : String(participant.schemaId),
+                subjectDid: participant.did,
+                claims: ((_b = record.claims) !== null && _b !== void 0 ? _b : {}),
+                credentialType: input.credentialType,
+                credentialContext: input.credentialContext,
+            })
+            : undefined;
+        if (resumeOffer)
+            return { record, participant, credential };
         // op_summary_digest (MOD-PP-MSG-3) digests the applicant's submission, not the credential
-        await chain.setParticipantOPToValidated({
-            id: holderParticipantId,
-            corporation: holderParticipant.corporation,
-        });
+        await chain.setParticipantOPToValidated({ id: participantId, corporation: participant.corporation });
         await vtFlowApi.acceptOnboardingRequest(record.id);
-        await vtFlowApi.markValidated(record.id);
+        const validated = await vtFlowApi.markValidated(record.id);
+        return { record: validated, participant, credential };
+    }
+    /**
+     * Offer the credential of an onboarding process to its applicant. Call it only for a HOLDER, and
+     * only after validateOnboardingProcess has moved the record to VALIDATED. Give it the credential
+     * that validateOnboardingProcess built, so that the process does not build the credential twice.
+     */
+    async offerOnboardingCredential(input) {
+        var _a, _b, _c, _d;
+        this.requireChain();
+        const vtFlowApi = this.resolveVtFlowApi();
+        const record = await vtFlowApi.findById(input.vtFlowRecordId);
+        if (!record)
+            throw new Error(`vt-flow record ${input.vtFlowRecordId} not found`);
+        if (!record.applicantParticipantId)
+            throw new Error('Record has no applicantParticipantId');
+        const participant = (_a = input.participant) !== null && _a !== void 0 ? _a : (await this.agent.indexer.findParticipant(Number(record.applicantParticipantId)));
+        if (!(participant === null || participant === void 0 ? void 0 : participant.did))
+            throw new Error('Applicant participant has no DID');
+        const unsignedCredentialJson = (_b = input.credential) !== null && _b !== void 0 ? _b : (await this.buildCredential({
+            credentialSchemaId: (_c = input.credentialSchemaId) !== null && _c !== void 0 ? _c : String(participant.schemaId),
+            subjectDid: participant.did,
+            claims: ((_d = record.claims) !== null && _d !== void 0 ? _d : {}),
+            credentialType: input.credentialType,
+            credentialContext: input.credentialContext,
+        }));
+        // W3C Data Integrity attachment format (RFC 0809). The applicant DID is the credential subject
+        // and the exchange runs over its authenticated connection, so no extra binding is required. The
+        // cryptosuite is the issuer's choice and is applied when the credential is issued.
         const { record: offered } = await vtFlowApi.offerCredentialForSession({
             vtFlowRecordId: record.id,
-            issuerParticipantId: Number(holderParticipant.validatorParticipantId),
+            issuerParticipantId: Number(participant.validatorParticipantId),
             credentialFormats: {
-                jsonld: {
-                    credential: unsignedCredentialJson,
-                    options: { proofType: 'Ed25519Signature2020', proofPurpose: 'assertionMethod' },
-                },
+                dataIntegrity: { credential: unsignedCredentialJson, bindingRequired: false },
             },
         });
         return offered;
     }
+    /**
+     * Close an onboarding process that carries no credential exchange, on the validator side. The
+     * applicant reaches the same state from the SetParticipantOPToValidated chain event.
+     */
+    async completeOnboardingProcess(vtFlowRecordId) {
+        return this.resolveVtFlowApi().markCompleted(vtFlowRecordId);
+    }
+    /** [VSA-ADM-VT-FL-VALIDATE] */
+    async validateFlow(input) {
+        this.requireChain();
+        const vtFlowApi = this.resolveVtFlowApi();
+        const record = await vtFlowApi.findById(input.vtFlowRecordId);
+        if (!record) {
+            throw new adminApi_1.AdminApiError(adminApi_1.AdminApiErrorCode.UnknownId, 404, `no flow with id "${input.vtFlowRecordId}"`);
+        }
+        if (record.role !== credo_ts_didcomm_vt_flow_1.VtFlowRole.Validator)
+            throw invalidState('validate is a validator action');
+        if (record.variant === credo_ts_didcomm_vt_flow_1.VtFlowVariant.DirectIssuance)
+            return this.validateDirectIssuance(record);
+        if (!record.applicantParticipantId)
+            throw invalidState('the flow names no applicant participant');
+        const applicant = await this.agent.indexer.getParticipant(record.applicantParticipantId);
+        const entryValidated = applicant.op_state === 'VALIDATED';
+        this.assertValidateState(record, entryValidated);
+        const terms = this.validationTerms(input, applicant, record);
+        await this.assertClaimsAndTerm(record, applicant, terms);
+        if (record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingOr)
+            await vtFlowApi.acceptOnboardingRequest(record.id);
+        if (record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.OobPending)
+            await this.sendValidating(record);
+        if (record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.ValidatedPendingClaims)
+            return this.continueAfterValidated(record.id);
+        if (entryValidated) {
+            if (record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.Validated)
+                await vtFlowApi.markValidated(record.id);
+            return this.continueAfterValidated(record.id);
+        }
+        const validation = Object.assign({ decidedAt: new Date().toISOString(), submission: await this.submissionPath(applicant) }, terms);
+        if (validation.submission === credo_ts_didcomm_vt_flow_1.VtFlowSubmission.Operator) {
+            return vtFlowApi.recordValidation(record.id, validation, credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingValidationTx);
+        }
+        return this.submitValidation(record.id, applicant, validation);
+    }
+    // A Direct Issuance flow has no entry to validate, so no transaction: check the claims, then offer.
+    async validateDirectIssuance(record) {
+        if (record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.Validating && record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.OobPending) {
+            throw invalidState(`the flow is '${record.state}', which validate does not accept`);
+        }
+        if (!record.schemaId)
+            throw invalidState('the flow names no credential schema');
+        const connection = await this.agent.didcomm.connections.findById(record.connectionId);
+        if (!(connection === null || connection === void 0 ? void 0 : connection.theirDid))
+            throw invalidState('the flow connection has no peer DID');
+        const schema = await this.agent.indexer.getCredentialSchema(record.schemaId);
+        this.assertClaims(schema.json_schema, connection.theirDid, record.claims);
+        const vtFlowApi = this.resolveVtFlowApi();
+        if (record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.OobPending)
+            await this.sendValidating(record);
+        const offer = await this.buildDirectIssuanceOffer(record.id);
+        if (!offer)
+            throw invalidState('the agent holds no active ISSUER participant for the schema of the flow');
+        const { record: offered } = await vtFlowApi.offerCredentialForSession(Object.assign({ vtFlowRecordId: record.id }, offer));
+        return offered;
+    }
+    // [VSA-ADM-VT-FL-START]: checked before the flow moves, as a failed send would leave it in VALIDATING
+    async sendValidating(record) {
+        const connection = await this.agent.didcomm.connections.findById(record.connectionId);
+        if (!(connection === null || connection === void 0 ? void 0 : connection.isReady))
+            throw invalidState('the flow connection is not ESTABLISHED');
+        await this.resolveVtFlowApi().sendValidating(record.id);
+    }
+    assertClaims(jsonSchema, subjectDid, claims) {
+        const violations = (0, utils_1.schemaViolations)(JSON.parse(jsonSchema), Object.assign({ id: subjectDid }, (claims !== null && claims !== void 0 ? claims : {})));
+        if (violations.length > 0) {
+            throw new adminApi_1.AdminApiError(adminApi_1.AdminApiErrorCode.InvalidClaims, 422, 'the claim set does not satisfy the json_schema', { violations });
+        }
+    }
+    assertValidateState(record, entryValidated) {
+        const accepted = [
+            credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingOr,
+            credo_ts_didcomm_vt_flow_1.VtFlowState.Validating,
+            credo_ts_didcomm_vt_flow_1.VtFlowState.OobPending,
+            credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxFailed,
+            credo_ts_didcomm_vt_flow_1.VtFlowState.ValidatedPendingClaims,
+        ];
+        // Once the entry is VALIDATED on chain any validator-side state resumes into issuance, which is
+        // how a backend that disabled the default notification handler drives the flow ([VSA-ADM-VT-FL-VALIDATE-11]).
+        const acceptedOnceValidated = [
+            credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingValidationTx,
+            credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxSubmitted,
+            credo_ts_didcomm_vt_flow_1.VtFlowState.Validated,
+        ];
+        if (accepted.includes(record.state))
+            return;
+        if (entryValidated && acceptedOnceValidated.includes(record.state))
+            return;
+        throw invalidState(`the flow is '${record.state}', which validate does not accept`);
+    }
+    validationTerms(input, applicant, record) {
+        var _a, _b, _c, _d, _e, _f, _g, _h;
+        for (const key of FEE_KEYS) {
+            const fee = input[key];
+            if (fee !== undefined && !(Number.isInteger(fee) && fee >= 0)) {
+                throw invalidInput(`${key} must be a non-negative integer`);
+            }
+        }
+        for (const key of DISCOUNT_KEYS) {
+            const discount = input[key];
+            if (discount !== undefined && !(discount >= 0 && discount <= 1)) {
+                throw invalidInput(`${key} must be between 0 and 1`);
+            }
+        }
+        if (input.effectiveUntil !== undefined && Number.isNaN(Date.parse(input.effectiveUntil))) {
+            throw invalidInput('effectiveUntil must be an ISO 8601 datetime');
+        }
+        const onEntry = {
+            validationFees: (_a = applicant.validation_fees) !== null && _a !== void 0 ? _a : 0,
+            issuanceFees: (_b = applicant.issuance_fees) !== null && _b !== void 0 ? _b : 0,
+            verificationFees: (_c = applicant.verification_fees) !== null && _c !== void 0 ? _c : 0,
+            issuanceFeeDiscount: (_d = applicant.issuance_fee_discount) !== null && _d !== void 0 ? _d : 0,
+            verificationFeeDiscount: (_e = applicant.verification_fee_discount) !== null && _e !== void 0 ? _e : 0,
+        };
+        const renewal = !!applicant.effective_from;
+        const recorded = record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxFailed ? record.validation : undefined;
+        const terms = {
+            effectiveUntil: (_f = input.effectiveUntil) !== null && _f !== void 0 ? _f : recorded === null || recorded === void 0 ? void 0 : recorded.effectiveUntil,
+            opSummaryDigest: (_g = input.opSummaryDigest) !== null && _g !== void 0 ? _g : recorded === null || recorded === void 0 ? void 0 : recorded.opSummaryDigest,
+        };
+        for (const key of [...FEE_KEYS, ...DISCOUNT_KEYS]) {
+            const given = input[key];
+            if (renewal) {
+                if (given !== undefined && !sameTerm(key, given, onEntry[key])) {
+                    throw invalidInput(`${key} differs from the entry, and a renewal keeps the agreed value`);
+                }
+                terms[key] = onEntry[key];
+            }
+            else {
+                terms[key] = (_h = given !== null && given !== void 0 ? given : recorded === null || recorded === void 0 ? void 0 : recorded[key]) !== null && _h !== void 0 ? _h : 0;
+            }
+        }
+        return terms;
+    }
+    async assertClaimsAndTerm(record, applicant, terms) {
+        var _a;
+        if (applicant.role !== types_1.ParticipantRole.Holder)
+            return;
+        if (!applicant.did)
+            throw invalidState('the applicant entry has no DID to issue to');
+        const schema = await this.agent.indexer.getCredentialSchema(applicant.schema_id);
+        this.assertClaims(schema.json_schema, applicant.did, record.claims);
+        // An ECS Organization or Persona credential needs a validUntil. With a validity period of 0 the
+        // VPR sets no effective_until, so the call has to carry one.
+        const ecsKey = await (0, vs_agent_model_1.classifyEcsSchema)(schema.json_schema);
+        const needsValidUntil = ecsKey === vs_agent_model_1.ECS.ORG || ecsKey === vs_agent_model_1.ECS.PERSONA;
+        if (needsValidUntil && ((_a = schema.holder_validation_validity_period) !== null && _a !== void 0 ? _a : 0) === 0 && !terms.effectiveUntil) {
+            throw invalidInput('this schema has no validity period, so effectiveUntil is required');
+        }
+    }
+    async submissionPath(applicant) {
+        const authorization = this.agent.authorizationService;
+        if (!authorization || applicant.validator_participant_id == null)
+            return credo_ts_didcomm_vt_flow_1.VtFlowSubmission.Operator;
+        const validator = await this.agent.indexer
+            .getParticipant(applicant.validator_participant_id)
+            .catch(() => undefined);
+        if (!validator || !isActiveParticipant(validator))
+            return credo_ts_didcomm_vt_flow_1.VtFlowSubmission.Operator;
+        await authorization.refreshForOperator().catch(() => undefined);
+        const grant = authorization.getVsOperatorAuthorizationRecord(validator.id);
+        return (grant === null || grant === void 0 ? void 0 : grant.msgTypes.includes(verana_types_1.veranaTypeUrls.MsgSetParticipantOPToValidated))
+            ? credo_ts_didcomm_vt_flow_1.VtFlowSubmission.Agent
+            : credo_ts_didcomm_vt_flow_1.VtFlowSubmission.Operator;
+    }
+    async submitValidation(recordId, applicant, validation) {
+        var _a, _b, _c, _d, _e;
+        const chain = this.requireChain();
+        const vtFlowApi = this.resolveVtFlowApi();
+        const fail = (reason, error) => vtFlowApi.recordValidation(recordId, Object.assign(Object.assign({}, validation), { tx: { status: credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Failed, reason, error } }), credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxFailed);
+        const grant = applicant.validator_participant_id == null
+            ? undefined
+            : (_a = this.agent.authorizationService) === null || _a === void 0 ? void 0 : _a.getVsOperatorAuthorizationRecord(applicant.validator_participant_id);
+        const granter = (grant === null || grant === void 0 ? void 0 : grant.withFeegrant) ? chain.corporation : undefined;
+        const message = chain.setParticipantOPToValidatedMsg({
+            id: applicant.id,
+            effectiveUntil: validation.effectiveUntil ? new Date(validation.effectiveUntil) : undefined,
+            validationFees: validation.validationFees,
+            issuanceFees: validation.issuanceFees,
+            verificationFees: validation.verificationFees,
+            issuanceFeeDiscount: Math.round(((_b = validation.issuanceFeeDiscount) !== null && _b !== void 0 ? _b : 0) * DISCOUNT_SCALE),
+            verificationFeeDiscount: Math.round(((_c = validation.verificationFeeDiscount) !== null && _c !== void 0 ? _c : 0) * DISCOUNT_SCALE),
+            opSummaryDigest: validation.opSummaryDigest,
+        });
+        let allowance;
+        try {
+            allowance = granter ? await chain.feeAllowance(granter, FEE_DENOM) : undefined;
+        }
+        catch (error) {
+            return fail(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.PreflightError, errorMessage(error));
+        }
+        if (granter && !allowance) {
+            return fail(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.FeegrantExpired, 'the Corporation grants the agent no active fee allowance');
+        }
+        let fee;
+        try {
+            fee = await chain.estimateFee([message], granter);
+        }
+        catch (error) {
+            return fail(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.PreflightError, errorMessage(error));
+        }
+        const amount = BigInt((_e = (_d = fee.amount.find(coin => coin.denom === FEE_DENOM)) === null || _d === void 0 ? void 0 : _d.amount) !== null && _e !== void 0 ? _e : '0');
+        if (granter && allowance) {
+            if (!allowance.unlimited && allowance.remaining < amount) {
+                return fail(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.FeegrantExhausted, `the fee allowance has ${allowance.remaining}${FEE_DENOM} left`);
+            }
+            let corporation;
+            try {
+                corporation = BigInt((await chain.getAccountBalance(granter, FEE_DENOM)).amount);
+            }
+            catch (error) {
+                return fail(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.PreflightError, errorMessage(error));
+            }
+            if (corporation < amount) {
+                return fail(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.InsufficientFundsCorporation, `the Corporation holds ${corporation}${FEE_DENOM}`);
+            }
+        }
+        else {
+            let own;
+            try {
+                own = BigInt((await chain.getBalance(FEE_DENOM)).amount);
+            }
+            catch (error) {
+                return fail(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.PreflightError, errorMessage(error));
+            }
+            if (own < amount) {
+                return fail(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.InsufficientFundsAgent, `the agent account holds ${own}${FEE_DENOM}`);
+            }
+        }
+        let hash;
+        try {
+            hash = await chain.broadcastWithoutWaiting([message], fee);
+        }
+        catch (error) {
+            return fail(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.BroadcastError, errorMessage(error));
+        }
+        const submitted = await vtFlowApi.recordValidation(recordId, Object.assign(Object.assign({}, validation), { tx: { hash, submittedAt: new Date().toISOString(), status: credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Submitted } }), credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxSubmitted);
+        void this.resolveValidationTx(recordId).catch(error => this.agent.config.logger.error(`[vt-flow] resolving the validation of ${recordId} failed`, {
+            error: errorMessage(error),
+        }));
+        return submitted;
+    }
+    // [VSA-ADM-VT-FL-VALIDATE-8]. Leaving VALIDATION_TX_SUBMITTED ends the loop, so the notification
+    // handler moving the flow first wins the race.
+    async resolveValidationTx(recordId) {
+        var _a, _b, _c;
+        const chain = this.requireChain();
+        const vtFlowApi = this.resolveVtFlowApi();
+        for (;;) {
+            const record = await vtFlowApi.findById(recordId);
+            const validation = record === null || record === void 0 ? void 0 : record.validation;
+            const hash = (_a = validation === null || validation === void 0 ? void 0 : validation.tx) === null || _a === void 0 ? void 0 : _a.hash;
+            if (!record || !validation || !hash || record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxSubmitted)
+                return;
+            const tx = await chain.findTx(hash).catch(() => undefined);
+            if (tx && tx.code === 0) {
+                await vtFlowApi.recordValidation(recordId, Object.assign(Object.assign({}, validation), { tx: Object.assign(Object.assign({}, validation.tx), { height: tx.height, status: credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Succeeded }) }));
+                await vtFlowApi.markValidated(recordId);
+                await this.continueAfterValidated(recordId);
+                return;
+            }
+            if (tx)
+                return this.failUnlessValidated(record, validation, credo_ts_didcomm_vt_flow_1.VtFlowTxReason.TxFailed, tx.rawLog, tx.height);
+            const submittedAt = (_c = (_b = validation.tx) === null || _b === void 0 ? void 0 : _b.submittedAt) !== null && _c !== void 0 ? _c : validation.decidedAt;
+            if (Date.now() - Date.parse(submittedAt) >= TX_LOOKUP_TIMEOUT_MS) {
+                return this.failUnlessValidated(record, validation, credo_ts_didcomm_vt_flow_1.VtFlowTxReason.TxNotFound, 'not found 60 seconds after the broadcast');
+            }
+            await new Promise(resolve => setTimeout(resolve, TX_LOOKUP_INTERVAL_MS));
+        }
+    }
+    // The VPR has no distinct error for a second SetParticipantOPtoValidated, so the entry tells a
+    // rejected duplicate apart from a real failure.
+    async failUnlessValidated(record, validation, reason, error, height) {
+        const vtFlowApi = this.resolveVtFlowApi();
+        const applicant = record.applicantParticipantId
+            ? await this.agent.indexer.getParticipant(record.applicantParticipantId)
+            : undefined;
+        if ((applicant === null || applicant === void 0 ? void 0 : applicant.op_state) === 'VALIDATED') {
+            await vtFlowApi.markValidated(record.id);
+            await this.continueAfterValidated(record.id);
+            return;
+        }
+        await vtFlowApi.recordValidation(record.id, Object.assign(Object.assign({}, validation), { tx: Object.assign(Object.assign({}, validation.tx), { height, status: credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Failed, reason, error }) }), credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxFailed);
+    }
+    async continueAfterValidated(recordId) {
+        const vtFlowApi = this.resolveVtFlowApi();
+        const record = await vtFlowApi.findById(recordId);
+        if (!record)
+            throw new Error(`vt-flow record ${recordId} not found`);
+        if (record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.Validated && record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.ValidatedPendingClaims) {
+            return record;
+        }
+        const participant = await this.agent.indexer.findParticipant(Number(record.applicantParticipantId));
+        if (!participant)
+            throw new Error(`Applicant participant ${record.applicantParticipantId} not found`);
+        if (Number(participant.role) !== types_2.HOLDER_PARTICIPANT_TYPE)
+            return this.completeOnboardingProcess(recordId);
+        return this.offerOnboardingCredential({ vtFlowRecordId: recordId, participant });
+    }
+    /** [VSA-ADM-VT-FL-VALIDATE-8]: at startup, resume every flow left in VALIDATION_TX_SUBMITTED. */
+    async resumeValidationSubmissions() {
+        const pending = await this.resolveVtFlowApi().findAllByQuery({
+            role: credo_ts_didcomm_vt_flow_1.VtFlowRole.Validator,
+            flowState: credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxSubmitted,
+        });
+        await Promise.all(pending.map(record => this.resolveValidationTx(record.id)));
+    }
     async acceptCredential(input) {
         const vtFlowApi = this.resolveVtFlowApi();
         const record = await vtFlowApi.findById(input.vtFlowRecordId);
@@ -154,7 +546,7 @@ class VtFlowOrchestrator {
         const chain = this.requireChain();
         if (!this.agent.did)
             throw new Error('Agent has no public DID');
-        const indexer = this.requireIndexer();
+        const indexer = this.agent.indexer;
         const vtFlowApi = this.resolveVtFlowApi();
         const record = await vtFlowApi.findById(vtFlowRecordId);
         if (!record)
@@ -185,47 +577,48 @@ class VtFlowOrchestrator {
         });
         return {
             credentialFormats: {
-                jsonld: {
-                    credential: unsignedCredentialJson,
-                    options: { proofType: 'Ed25519Signature2020', proofPurpose: 'assertionMethod' },
-                },
+                dataIntegrity: { credential: unsignedCredentialJson, bindingRequired: false },
             },
             issuerParticipantId: issuer.id,
         };
     }
+    /**
+     * Builds the unsigned VC Data Model 2.0 credential that goes into the offer. RFC 0809 derives the
+     * advertised data model version from its context, and the issuer secures it with a
+     * DataIntegrityProof once the applicant requests it.
+     */
     async buildCredential(input) {
-        var _a, _b, _c;
-        const chain = this.requireChain();
-        const didRecords = await this.agent.dids.getCreatedDids({ did: this.agent.did });
-        const didRecord = didRecords[0];
-        if (!didRecord)
-            throw new Error('Agent DID record not found');
-        const schemaRef = `vpr:verana:${chain.getChainId}:cs:${input.credentialSchemaId}`;
-        const entry = await (0, utils_1.findMetadataEntry)(didRecord, '_vt/jsc', '', schemaRef);
-        if (!entry)
-            throw new Error(`No stored VTJSC found for ${schemaRef}`);
-        const { data } = entry;
-        const unsignedCredential = (0, utils_1.createCredential)({
+        var _a;
+        const jsonSchemaCredentialId = await this.resolveJsonSchemaCredentialId(input.credentialSchemaId);
+        // A credential whose claims don't satisfy the schema's required fields is not a valid
+        // instance of that credential type — reject it here rather than issue an empty shell.
+        const schema = await this.agent.indexer.getCredentialSchema(input.credentialSchemaId);
+        (0, utils_1.validateSchema)(JSON.parse(schema.json_schema), Object.assign({ id: input.subjectDid }, input.claims));
+        // Data model 2.0 holds the claims on the credential subject itself; the applicant DID wins over
+        // any `id` claim so the credential can never name a different subject
+        const unsignedCredential = (0, utils_1.createW3cV2Credential)({
             id: `${this.agent.did}#${core_1.utils.uuid()}`,
             type: (_a = input.credentialType) !== null && _a !== void 0 ? _a : ['VerifiableCredential', 'VerifiableTrustCredential'],
             issuer: this.agent.did,
-            credentialSubject: { id: input.subjectDid, claims: input.claims },
+            context: input.credentialContext,
+            credentialSubject: Object.assign(Object.assign({}, input.claims), { id: input.subjectDid }),
+            credentialSchema: { id: jsonSchemaCredentialId, type: 'JsonSchemaCredential' },
         });
-        if (input.credentialContext)
-            unsignedCredential.context = input.credentialContext;
-        unsignedCredential.credentialSchema = {
-            id: (_c = (_b = data.verifiableCredential) === null || _b === void 0 ? void 0 : _b[0]) === null || _c === void 0 ? void 0 : _c.id,
-            type: 'JsonSchemaCredential',
-        };
-        return core_1.JsonTransformer.toJSON(unsignedCredential);
+        return (0, utils_1.toOfferedCredentialJson)(unsignedCredential);
+    }
+    async resolveJsonSchemaCredentialId(credentialSchemaId) {
+        return (0, utils_1.resolveJsonSchemaCredentialId)(this.agent, this.agent.indexer, credentialSchemaId, this.requireChain().getChainId);
     }
     /** Per the spec the algorithm comes from the schema, never from the digest value. */
     async digestAlgorithmForSchema(schemaId) {
-        const schema = await this.requireIndexer().getCredentialSchema(schemaId);
+        return (await this.credentialSchema(schemaId)).digestAlgorithm;
+    }
+    async credentialSchema(schemaId) {
+        const schema = await this.agent.indexer.getCredentialSchema(schemaId);
         if (!schema.digest_algorithm) {
             throw new Error(`Credential schema ${schemaId} has no digest_algorithm`);
         }
-        return schema.digest_algorithm;
+        return { digestAlgorithm: schema.digest_algorithm, ecsKey: await (0, vs_agent_model_1.classifyEcsSchema)(schema.json_schema) };
     }
     /** Fired after signing and before delivery, so a failure here must abort the issuance. */
     async onCredentialIssued(vtFlowRecordId, signedCredential) {
@@ -238,7 +631,7 @@ class VtFlowOrchestrator {
         if (record.issuerParticipantId == null) {
             throw new Error(`vt-flow record ${vtFlowRecordId} has no issuerParticipantId to anchor against`);
         }
-        const issuer = await this.requireIndexer().getParticipant(record.issuerParticipantId);
+        const issuer = await this.agent.indexer.getParticipant(record.issuerParticipantId);
         const algorithm = await this.digestAlgorithmForSchema(issuer.schema_id);
         const digest = (0, verre_1.computeCredentialDigestJCS)(signedCredential, algorithm);
         await chain.createOrUpdateParticipantSession({
@@ -261,7 +654,7 @@ class VtFlowOrchestrator {
         if (!record.credentialExchangeRecordId) {
             throw new Error('Record has no credentialExchangeRecordId; nothing to verify');
         }
-        const indexer = this.requireIndexer();
+        const indexer = this.agent.indexer;
         const session = await indexer.getParticipantSession(record.participantSessionId);
         if (!session) {
             throw new Error(`ParticipantSession ${record.participantSessionId} not found on indexer`);
@@ -282,13 +675,15 @@ class VtFlowOrchestrator {
         if (record.schemaId != null && Number(issuer.schema_id) !== Number(record.schemaId)) {
             throw new Error(`Issuer participant schema ${issuer.schema_id} does not match credential schema ${record.schemaId}`);
         }
-        const credentialJson = await this.getOfferedCredentialJson(record.credentialExchangeRecordId);
-        const algorithm = await this.digestAlgorithmForSchema(issuer.schema_id);
-        const digest = (0, verre_1.computeCredentialDigestJCS)(credentialJson, algorithm);
+        const credentialJson = await this.getReceivedCredentialJson(record.credentialExchangeRecordId);
+        const { digestAlgorithm, ecsKey } = await this.credentialSchema(issuer.schema_id);
+        const digest = (0, verre_1.computeCredentialDigestJCS)(credentialJson, digestAlgorithm);
         const anchored = await indexer.getDigest(digest);
         if (!anchored) {
             throw new Error(`Credential digest ${digest} is not anchored on-chain`);
         }
+        if (ecsKey)
+            await vtFlowApi.setEcsSchemaKey(record.id, ecsKey);
     }
     async onCredentialRevoked(vtFlowRecordId) {
         const vtFlowApi = this.resolveVtFlowApi();
@@ -297,7 +692,7 @@ class VtFlowOrchestrator {
             return;
         if (!this.options.publicApiBaseUrl || !record.credentialExchangeRecordId)
             return;
-        const credentialId = await (0, utils_1.removeStoredTrustCredential)(this.agent, this.options.publicApiBaseUrl, record.credentialExchangeRecordId);
+        const credentialId = await (0, utils_1.removeStoredTrustCredential)(this.agent, record.credentialExchangeRecordId);
         if (credentialId) {
             this.agent.config.logger.info(`[vt-flow] removed revoked credential and its linked VP (${credentialId})`);
         }
@@ -318,26 +713,29 @@ class VtFlowOrchestrator {
         const chain = this.agent.veranaChain;
         if (!chain || !chain.autoTriggerResolverEnabled)
             return;
-        if (record.participantId == null)
+        if (record.applicantParticipantId == null)
             return;
-        await chain.triggerResolver(Number(record.participantId));
+        await chain.triggerResolver(Number(record.applicantParticipantId));
     }
-    async getOfferedCredentialJson(credentialExchangeRecordId) {
-        var _a;
+    /** The signed credential as the issuer attached it, which is the exact JSON its digest covers. */
+    async getReceivedCredentialJson(credentialExchangeRecordId) {
+        var _a, _b;
         const formatData = await this.agent.didcomm.credentials.getFormatData(credentialExchangeRecordId);
-        const credentialJson = (_a = formatData.credential) === null || _a === void 0 ? void 0 : _a.jsonld;
+        const credentialJson = (_b = (_a = formatData.credential) === null || _a === void 0 ? void 0 : _a.dataIntegrity) === null || _b === void 0 ? void 0 : _b.credential;
         if (!credentialJson)
-            throw new Error('Offered credential has no JSON-LD body to verify');
+            throw new Error('Received credential has no data integrity credential body');
         return credentialJson;
     }
-    requireIndexer() {
-        if (!this.options.indexer) {
-            throw new Error('Agent has no indexer configured (set VERANA_INDEXER_BASE_URL)');
-        }
-        return this.options.indexer;
+    // VS-CONN-VS gate: consulted only after trust resolution rejected the peer.
+    async checkEcsIssuanceExemption(context) {
+        return (0, ecsIssuanceExemption_1.isEcsIssuanceExempt)({
+            indexer: this.agent.indexer,
+            agent: this.agent,
+            trustedEcosystemDids: this.agent.trustedEcosystemDids,
+        }, context);
     }
     async publishCredentialAsLinkedVp(vtFlowRecordId) {
-        var _a, _b;
+        var _a;
         if (!this.options.publicApiBaseUrl) {
             throw new Error('publicApiBaseUrl is required to publish a LinkedVerifiablePresentation');
         }
@@ -350,18 +748,18 @@ class VtFlowOrchestrator {
         if (!record.credentialExchangeRecordId) {
             throw new Error(`vt-flow record ${vtFlowRecordId} has no credentialExchangeRecordId`);
         }
-        const formatData = await this.agent.didcomm.credentials.getFormatData(record.credentialExchangeRecordId);
-        const jsonld = (_a = formatData.credential) === null || _a === void 0 ? void 0 : _a.jsonld;
-        if (!jsonld) {
-            throw new Error(`No jsonld credential in exchange ${record.credentialExchangeRecordId}`);
-        }
-        const schemaRef = (_b = jsonld.credentialSchema) === null || _b === void 0 ? void 0 : _b.id;
+        const credentialJson = await this.getReceivedCredentialJson(record.credentialExchangeRecordId);
+        const schemaRef = (_a = credentialJson.credentialSchema) === null || _a === void 0 ? void 0 : _a.id;
         const schemaBaseId = schemaRef ? this.extractSchemaBaseId(schemaRef) : undefined;
         if (!schemaBaseId) {
             throw new Error(`Cannot publish Linked VP: credential has no extractable schema base id (credentialSchema.id=${schemaRef !== null && schemaRef !== void 0 ? schemaRef : 'undefined'})`);
         }
-        const w3cCredential = core_1.JsonTransformer.fromJSON(jsonld, core_1.W3cJsonLdVerifiableCredential);
-        await (0, utils_1.createVtc)(this.agent, this.options.publicApiBaseUrl, schemaBaseId, w3cCredential);
+        // A data model 2.0 credential arrives secured with a DataIntegrityProof; a validator still on
+        // data model 1.1 sends a linked data proof, and both are published the same way
+        const credential = (0, utils_1.isVcdm2Credential)(credentialJson)
+            ? core_1.W3cV2DataIntegrityVerifiableCredential.fromObject(credentialJson)
+            : core_1.JsonTransformer.fromJSON(credentialJson, core_1.W3cJsonLdVerifiableCredential);
+        await (0, utils_1.createVtc)(this.agent, this.options.publicApiBaseUrl, record.ecsSchemaKey ? (0, utils_1.linkedVpSchemaId)(record.ecsSchemaKey) : schemaBaseId, credential);
     }
     extractSchemaBaseId(jscUrl) {
         var _a;