@verana-labs/vs-agent-sdk 2.0.0-dev.7 → 2.0.0-dev.72

package/build/utils/util.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SOVRIN_STAGING_NET = exports.BCOVRIN_TEST_GENESIS = void 0;
 exports.fetchJson = fetchJson;
+exports.anonCredsSchemaFromJsonSchema = anonCredsSchemaFromJsonSchema;
 exports.BCOVRIN_TEST_GENESIS = `{"reqSignature":{},"txn":{"data":{"data":{"alias":"Node1","blskey":"4N8aUNHSgjQVgkpm8nhNEfDf6txHznoYREg9kirmJrkivgL4oSEimFF6nsQ6M41QvhM2Z33nves5vfSn9n1UwNFJBYtWVnHYMATn76vLuL3zU88KyeAYcHfsih3He6UHcXDxcaecHVz6jhCYz1P2UZn2bDVruL5wXpehgBfBaLKm3Ba","blskey_pop":"RahHYiCvoNCtPTrVtP7nMC5eTYrsUA8WjXbdhNc8debh1agE9bGiJxWBXYNFbnJXoXhWFMvyqhqhRoq737YQemH5ik9oL7R4NTTCz2LEZhkgLJzB3QRQqJyBNyv7acbdHrAT8nQ9UkLbaVL9NBpnWXBTw4LEMePaSHEw66RzPNdAX1","client_ip":"138.197.138.255","client_port":9702,"node_ip":"138.197.138.255","node_port":9701,"services":["VALIDATOR"]},"dest":"Gw6pDLhcBcoQesN72qfotTgFa7cbuqZpkX3Xo6pLhPhv"},"metadata":{"from":"Th7MpTaRZVRYnPiabds81Y"},"type":"0"},"txnMetadata":{"seqNo":1,"txnId":"fea82e10e894419fe2bea7d96296a6d46f50f93f9eeda954ec461b2ed2950b62"},"ver":"1"}
 {"reqSignature":{},"txn":{"data":{"data":{"alias":"Node2","blskey":"37rAPpXVoxzKhz7d9gkUe52XuXryuLXoM6P6LbWDB7LSbG62Lsb33sfG7zqS8TK1MXwuCHj1FKNzVpsnafmqLG1vXN88rt38mNFs9TENzm4QHdBzsvCuoBnPH7rpYYDo9DZNJePaDvRvqJKByCabubJz3XXKbEeshzpz4Ma5QYpJqjk","blskey_pop":"Qr658mWZ2YC8JXGXwMDQTzuZCWF7NK9EwxphGmcBvCh6ybUuLxbG65nsX4JvD4SPNtkJ2w9ug1yLTj6fgmuDg41TgECXjLCij3RMsV8CwewBVgVN67wsA45DFWvqvLtu4rjNnE9JbdFTc1Z4WCPA3Xan44K1HoHAq9EVeaRYs8zoF5","client_ip":"138.197.138.255","client_port":9704,"node_ip":"138.197.138.255","node_port":9703,"services":["VALIDATOR"]},"dest":"8ECVSk179mjsjKRLWiQtssMLgp6EPhWXtaYyStWPSGAb"},"metadata":{"from":"EbP4aYNeTHL6q385GuVpRV"},"type":"0"},"txnMetadata":{"seqNo":2,"txnId":"1ac8aece2a18ced660fef8694b61aac3af08ba875ce3026a160acbc3a3af35fc"},"ver":"1"}
 {"reqSignature":{},"txn":{"data":{"data":{"alias":"Node3","blskey":"3WFpdbg7C5cnLYZwFZevJqhubkFALBfCBBok15GdrKMUhUjGsk3jV6QKj6MZgEubF7oqCafxNdkm7eswgA4sdKTRc82tLGzZBd6vNqU8dupzup6uYUf32KTHTPQbuUM8Yk4QFXjEf2Usu2TJcNkdgpyeUSX42u5LqdDDpNSWUK5deC5","blskey_pop":"QwDeb2CkNSx6r8QC8vGQK3GRv7Yndn84TGNijX8YXHPiagXajyfTjoR87rXUu4G4QLk2cF8NNyqWiYMus1623dELWwx57rLCFqGh7N4ZRbGDRP4fnVcaKg1BcUxQ866Ven4gw8y4N56S5HzxXNBZtLYmhGHvDtk6PFkFwCvxYrNYjh","client_ip":"138.197.138.255","client_port":9706,"node_ip":"138.197.138.255","node_port":9705,"services":["VALIDATOR"]},"dest":"DKVxG2fXXTU8yT5N7hGEbXB3dfdAnYv1JczDUHpmDxya"},"metadata":{"from":"4cU41vWW82ArfxJxHkzXPG"},"type":"0"},"txnMetadata":{"seqNo":3,"txnId":"7e9f355dffa78ed24668f0e0e369fd8c224076571c51e2ea8be5f26479edebe4"},"ver":"1"}
@@ -160,4 +161,19 @@ async function fetchJson(url, arg) {
             clearTimeout(timer);
     }
 }
+/**
+ * Maps `title` to the schema name and the `credentialSubject` properties to `attrNames`, per
+ * [VSA-PUB-AC-5]. The VTJSC issuer and every accredited issuer must derive the same values.
+ */
+function anonCredsSchemaFromJsonSchema(jsonSchema) {
+    var _a, _b, _c;
+    const parsed = (typeof jsonSchema === 'string' ? JSON.parse(jsonSchema) : jsonSchema);
+    const name = parsed === null || parsed === void 0 ? void 0 : parsed.title;
+    if (!name)
+        throw new Error('The JSON Schema carries no title');
+    const attrNames = Object.keys((_c = (_b = (_a = parsed === null || parsed === void 0 ? void 0 : parsed.properties) === null || _a === void 0 ? void 0 : _a.credentialSubject) === null || _b === void 0 ? void 0 : _b.properties) !== null && _c !== void 0 ? _c : {}).map(String);
+    if (attrNames.length === 0)
+        throw new Error(`The JSON Schema "${name}" defines no credentialSubject property`);
+    return { name, attrNames };
+}
 //# sourceMappingURL=util.js.map

package/build/utils/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","sourceRoot":"","sources":["../../src/utils/util.ts"],"names":[],"mappings":";;;AAkJA,8BAkBC;AApKY,QAAA,oBAAoB,GAAG;;;2wBAGuuB,CAAA;AAE9vB,QAAA,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsIjC,CAAA;AAOM,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,GAA8D;IAE9D,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAA;IAChE,MAAM,aAAa,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,CAAA;IAC3E,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAChE,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACtF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACpF,IAAI,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAA;QACzD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,KAAK,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;IAChC,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;AACH,CAAC"}
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../../src/utils/util.ts"],"names":[],"mappings":";;;AAkJA,8BAkBC;AAYD,sEAcC;AA9LY,QAAA,oBAAoB,GAAG;;;2wBAGuuB,CAAA;AAE9vB,QAAA,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsIjC,CAAA;AAOM,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,GAA8D;IAE9D,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAA;IAChE,MAAM,aAAa,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,CAAA;IAC3E,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAChE,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACtF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACpF,IAAI,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAA;QACzD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,KAAK,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;IAChC,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAQD;;;GAGG;AACH,SAAgB,6BAA6B,CAAC,UAA2B;;IACvE,MAAM,MAAM,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAGnF,CAAA;IAED,MAAM,IAAI,GAAG,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA;IAC1B,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAE9D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,UAAU,0CAAE,iBAAiB,0CAAE,UAAU,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAClG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,yCAAyC,CAAC,CAAA;IAEpF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;AAC5B,CAAC"}

package/build/utils/vcdm2.d.ts

@@ -0,0 +1,34 @@
+import { type JsonObject, W3cV2Credential, type W3cV2CredentialOptions } from '@credo-ts/core';
+/**
+ * The W3C context that gives terms no other context defines an IRI under
+ * `https://www.w3.org/ns/credentials/undefined-term#`, which is what schema-driven ECS claims are to
+ * a JSON-LD consumer: issuer-dependent terms, not examples.
+ */
+export declare const CREDENTIALS_UNDEFINED_TERMS_V2_URL = "https://www.w3.org/ns/credentials/undefined-terms/v2";
+/**
+ * JSON-LD context of the VC Data Model 2.0 credentials the agent issues: the trust credentials it
+ * publishes from its DID Document and the ones it issues over DIDComm with the W3C Data Integrity
+ * attachment format (Aries RFC 0809).
+ *
+ * The undefined-terms context supplies the `@vocab` that lets schema-driven credential subject
+ * claims expand when a third party processes the credential as JSON-LD. The `eddsa-jcs-2022`
+ * cryptosuite securing these credentials canonicalizes JSON and never expands the context itself.
+ */
+export declare const CREDENTIALS_V2_CONTEXT: string[];
+/**
+ * Builds an unsigned VC Data Model 2.0 credential. Unless told otherwise it uses
+ * {@link CREDENTIALS_V2_CONTEXT} and is valid from now, with no `validUntil`.
+ */
+export declare function createW3cV2Credential(options: W3cV2CredentialOptions): W3cV2Credential;
+/** The plain JSON an RFC 0809 credential offer carries the unsigned credential as. */
+export declare function toOfferedCredentialJson(credential: W3cV2Credential): JsonObject;
+/** Whether a credential JSON uses the VC Data Model 2.0 base context, as RFC 0809 decides the data model version. */
+export declare function isVcdm2Credential(credential: {
+    '@context'?: unknown;
+}): boolean;
+/**
+ * Whether a stored credential is what the agent publishes today: VC Data Model 2.0 secured with
+ * Data Integrity proofs. An agent upgraded from a version that published data model 1.1 linked
+ * data proofs rebuilds its trust credentials when this is false.
+ */
+export declare function isDataIntegrityVcdm2Credential(credential: unknown): boolean;

package/build/utils/vcdm2.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CREDENTIALS_V2_CONTEXT = exports.CREDENTIALS_UNDEFINED_TERMS_V2_URL = void 0;
+exports.createW3cV2Credential = createW3cV2Credential;
+exports.toOfferedCredentialJson = toOfferedCredentialJson;
+exports.isVcdm2Credential = isVcdm2Credential;
+exports.isDataIntegrityVcdm2Credential = isDataIntegrityVcdm2Credential;
+const core_1 = require("@credo-ts/core");
+/**
+ * The W3C context that gives terms no other context defines an IRI under
+ * `https://www.w3.org/ns/credentials/undefined-term#`, which is what schema-driven ECS claims are to
+ * a JSON-LD consumer: issuer-dependent terms, not examples.
+ */
+exports.CREDENTIALS_UNDEFINED_TERMS_V2_URL = 'https://www.w3.org/ns/credentials/undefined-terms/v2';
+/**
+ * JSON-LD context of the VC Data Model 2.0 credentials the agent issues: the trust credentials it
+ * publishes from its DID Document and the ones it issues over DIDComm with the W3C Data Integrity
+ * attachment format (Aries RFC 0809).
+ *
+ * The undefined-terms context supplies the `@vocab` that lets schema-driven credential subject
+ * claims expand when a third party processes the credential as JSON-LD. The `eddsa-jcs-2022`
+ * cryptosuite securing these credentials canonicalizes JSON and never expands the context itself.
+ */
+exports.CREDENTIALS_V2_CONTEXT = [
+    core_1.CREDENTIALS_CONTEXT_V2_URL,
+    exports.CREDENTIALS_UNDEFINED_TERMS_V2_URL,
+];
+/**
+ * Builds an unsigned VC Data Model 2.0 credential. Unless told otherwise it uses
+ * {@link CREDENTIALS_V2_CONTEXT} and is valid from now, with no `validUntil`.
+ */
+function createW3cV2Credential(options) {
+    var _a, _b;
+    return new core_1.W3cV2Credential(Object.assign(Object.assign({}, options), { context: (_a = options.context) !== null && _a !== void 0 ? _a : exports.CREDENTIALS_V2_CONTEXT, validFrom: (_b = options.validFrom) !== null && _b !== void 0 ? _b : new Date().toISOString() }));
+}
+/** The plain JSON an RFC 0809 credential offer carries the unsigned credential as. */
+function toOfferedCredentialJson(credential) {
+    return core_1.JsonTransformer.toJSON(credential);
+}
+/** Whether a credential JSON uses the VC Data Model 2.0 base context, as RFC 0809 decides the data model version. */
+function isVcdm2Credential(credential) {
+    const context = credential['@context'];
+    const base = Array.isArray(context) ? context[0] : context;
+    return base === core_1.CREDENTIALS_CONTEXT_V2_URL;
+}
+/**
+ * Whether a stored credential is what the agent publishes today: VC Data Model 2.0 secured with
+ * Data Integrity proofs. An agent upgraded from a version that published data model 1.1 linked
+ * data proofs rebuilds its trust credentials when this is false.
+ */
+function isDataIntegrityVcdm2Credential(credential) {
+    if (!credential || typeof credential !== 'object')
+        return false;
+    const { proof } = credential;
+    const proofs = Array.isArray(proof) ? proof : proof ? [proof] : [];
+    return (isVcdm2Credential(credential) &&
+        proofs.length > 0 &&
+        proofs.every(entry => (entry === null || entry === void 0 ? void 0 : entry.type) === 'DataIntegrityProof'));
+}
+//# sourceMappingURL=vcdm2.js.map

package/build/utils/vcdm2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vcdm2.js","sourceRoot":"","sources":["../../src/utils/vcdm2.ts"],"names":[],"mappings":";;;AAiCA,sDAMC;AAGD,0DAEC;AAGD,8CAIC;AAOD,wEASC;AAnED,yCAMuB;AAEvB;;;;GAIG;AACU,QAAA,kCAAkC,GAAG,sDAAsD,CAAA;AAExG;;;;;;;;GAQG;AACU,QAAA,sBAAsB,GAAa;IAC9C,iCAA0B;IAC1B,0CAAkC;CACnC,CAAA;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,OAA+B;;IACnE,OAAO,IAAI,sBAAe,iCACrB,OAAO,KACV,OAAO,EAAE,MAAA,OAAO,CAAC,OAAO,mCAAI,8BAAsB,EAClD,SAAS,EAAE,MAAA,OAAO,CAAC,SAAS,mCAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IACxD,CAAA;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAgB,uBAAuB,CAAC,UAA2B;IACjE,OAAO,sBAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;AAC3C,CAAC;AAED,qHAAqH;AACrH,SAAgB,iBAAiB,CAAC,UAAoC;IACpE,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAC1D,OAAO,IAAI,KAAK,iCAA0B,CAAA;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAgB,8BAA8B,CAAC,UAAmB;IAChE,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC/D,MAAM,EAAE,KAAK,EAAE,GAAG,UAAiC,CAAA;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,OAAO,CACL,iBAAiB,CAAC,UAAsC,CAAC;QACzD,MAAM,CAAC,MAAM,GAAG,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAmC,aAAnC,KAAK,uBAAL,KAAK,CAAgC,IAAI,MAAK,oBAAoB,CAAC,CAC3F,CAAA;AACH,CAAC"}

package/build/utils/vtjscResolver.d.ts

@@ -0,0 +1,18 @@
+import type { VsAgent } from '../agent/VsAgent';
+import type { VeranaIndexerService } from '../blockchain/VeranaIndexerService';
+/**
+ * Resolves the VTJSC that a credential of a given schema must name as its `credentialSchema`.
+ *
+ * The Ecosystem publishes the VTJSC, and it is the only party that does. An issuer that the
+ * Ecosystem's Corporation assigned an ISSUER Participant entry usually belongs to another
+ * Corporation: it holds no local copy and MUST NOT publish one. It reads the Ecosystem
+ * controller's DID Document instead, and follows the Linked Verifiable Presentation that carries
+ * the VTJSC of this schema.
+ *
+ * An agent that controls the Ecosystem itself already stores the same presentation, so it answers
+ * from its own record and makes no network call.
+ *
+ * Returns the id of the JsonSchemaCredential, which is the value a credential carries in
+ * `credentialSchema.id`.
+ */
+export declare function resolveJsonSchemaCredentialId(agent: VsAgent, indexer: VeranaIndexerService, credentialSchemaId: string | number, chainId: string): Promise<string>;

package/build/utils/vtjscResolver.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveJsonSchemaCredentialId = resolveJsonSchemaCredentialId;
+const trustCredentialStore_1 = require("./trustCredentialStore");
+const util_1 = require("./util");
+const VTJSC_FETCH_TIMEOUT_MS = 30000;
+/**
+ * Resolves the VTJSC that a credential of a given schema must name as its `credentialSchema`.
+ *
+ * The Ecosystem publishes the VTJSC, and it is the only party that does. An issuer that the
+ * Ecosystem's Corporation assigned an ISSUER Participant entry usually belongs to another
+ * Corporation: it holds no local copy and MUST NOT publish one. It reads the Ecosystem
+ * controller's DID Document instead, and follows the Linked Verifiable Presentation that carries
+ * the VTJSC of this schema.
+ *
+ * An agent that controls the Ecosystem itself already stores the same presentation, so it answers
+ * from its own record and makes no network call.
+ *
+ * Returns the id of the JsonSchemaCredential, which is the value a credential carries in
+ * `credentialSchema.id`.
+ */
+async function resolveJsonSchemaCredentialId(agent, indexer, credentialSchemaId, chainId) {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
+    const schemaId = String(credentialSchemaId);
+    const schemaRef = `vpr:verana:${chainId}:cs:${schemaId}`;
+    if (agent.did) {
+        const [didRecord] = await agent.dids.getCreatedDids({ did: agent.did });
+        const localId = didRecord
+            ? (_d = (_c = (_b = (_a = (0, trustCredentialStore_1.findMetadataEntry)(didRecord, '_vt/jsc', '', schemaRef)) === null || _a === void 0 ? void 0 : _a.data) === null || _b === void 0 ? void 0 : _b.verifiableCredential) === null || _c === void 0 ? void 0 : _c[0]) === null || _d === void 0 ? void 0 : _d.id
+            : undefined;
+        if (localId)
+            return localId;
+    }
+    const schema = await indexer.getCredentialSchema(schemaId);
+    const ecosystem = await indexer.getEcosystem(schema.ecosystem_id);
+    if (!(ecosystem === null || ecosystem === void 0 ? void 0 : ecosystem.did)) {
+        throw new Error(`Ecosystem ${schema.ecosystem_id} of schema ${schemaId} has no DID`);
+    }
+    // createJsc registers the presentation under this exact service id.
+    const serviceId = `${ecosystem.did}#vpr-schemas-${schemaId}-vtjsc-vp`;
+    const { didDocument } = await agent.dids.resolve(ecosystem.did);
+    const endpoint = (_f = (_e = didDocument === null || didDocument === void 0 ? void 0 : didDocument.service) === null || _e === void 0 ? void 0 : _e.find(service => service.id === serviceId)) === null || _f === void 0 ? void 0 : _f.serviceEndpoint;
+    if (typeof endpoint !== 'string') {
+        throw new Error(`Ecosystem ${ecosystem.did} publishes no VTJSC for schema ${schemaId} (no service ${serviceId})`);
+    }
+    // fetchJson applies the timeout and turns a non-2xx answer into an error that names the URL.
+    const presentation = await (0, util_1.fetchJson)(endpoint, VTJSC_FETCH_TIMEOUT_MS);
+    const jsonSchemaCredentialId = (_h = (_g = presentation.verifiableCredential) === null || _g === void 0 ? void 0 : _g[0]) === null || _h === void 0 ? void 0 : _h.id;
+    if (!jsonSchemaCredentialId) {
+        throw new Error(`The VTJSC presentation at ${endpoint} carries no credential`);
+    }
+    return jsonSchemaCredentialId;
+}
+//# sourceMappingURL=vtjscResolver.js.map

package/build/utils/vtjscResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vtjscResolver.js","sourceRoot":"","sources":["../../src/utils/vtjscResolver.ts"],"names":[],"mappings":";;AA4BA,sEAwCC;AAjED,iEAA0D;AAC1D,iCAAkC;AAElC,MAAM,sBAAsB,GAAG,KAAM,CAAA;AAOrC;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,6BAA6B,CACjD,KAAc,EACd,OAA6B,EAC7B,kBAAmC,EACnC,OAAe;;IAEf,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,cAAc,OAAO,OAAO,QAAQ,EAAE,CAAA;IAExD,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;QACvE,MAAM,OAAO,GAAG,SAAS;YACvB,CAAC,CAAC,MAAA,MAAA,MAAA,MAAA,IAAA,wCAAiB,EAAC,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,CAAC,0CAAE,IAAI,0CAAE,oBAAoB,0CAAG,CAAC,CAAC,0CAAE,EAAE;YAC7F,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;IAC7B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACjE,IAAI,CAAC,CAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,GAAG,CAAA,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,CAAC,YAAY,cAAc,QAAQ,aAAa,CAAC,CAAA;IACtF,CAAC;IAED,oEAAoE;IACpE,MAAM,SAAS,GAAG,GAAG,SAAS,CAAC,GAAG,gBAAgB,QAAQ,WAAW,CAAA;IACrE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC/D,MAAM,QAAQ,GAAG,MAAA,MAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,OAAO,0CAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,0CAAE,eAAe,CAAA;IACjG,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,aAAa,SAAS,CAAC,GAAG,kCAAkC,QAAQ,gBAAgB,SAAS,GAAG,CACjG,CAAA;IACH,CAAC;IAED,6FAA6F;IAC7F,MAAM,YAAY,GAAG,MAAM,IAAA,gBAAS,EAAoB,QAAQ,EAAE,sBAAsB,CAAC,CAAA;IACzF,MAAM,sBAAsB,GAAG,MAAA,MAAA,YAAY,CAAC,oBAAoB,0CAAG,CAAC,CAAC,0CAAE,EAAE,CAAA;IACzE,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,wBAAwB,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,sBAAsB,CAAA;AAC/B,CAAC"}

package/build/vtFlow/VtFlowOrchestrator.d.ts

@@ -1,10 +1,10 @@
-import { type DidCommJsonLdCredentialDetailFormat, type JsonCredential } from '@credo-ts/didcomm';
-import { VtFlowRecord } from '@verana-labs/credo-ts-didcomm-vt-flow';
+import type { JsonObject } from '@credo-ts/core';
+import type { DidCommDataIntegrityOfferCredentialFormat } from '@credo-ts/didcomm';
+import { VtFlowRecord, type VtFlowCheckParticipantIdContext, type VtFlowEcsIssuanceExemptionContext, type VtFlowIssuance } from '@verana-labs/credo-ts-didcomm-vt-flow';
 import { BaseAgentModules, VsAgent } from '../agent';
-import { VeranaIndexerService } from '../blockchain/VeranaIndexerService';
+import { Participant, ParticipantDto } from '../blockchain/types';
 export interface VtFlowOrchestratorOptions {
     publicApiBaseUrl?: string;
-    indexer?: VeranaIndexerService;
     agentParticipantId?: number;
     walletAgentParticipantId?: number;
 }
@@ -13,13 +13,33 @@ export interface StartOnboardingProcessInput {
     participantSessionId?: string;
     claims?: Record<string, unknown>;
 }
-export interface ValidateAndOfferCredentialInput {
+export interface ValidateOnboardingProcessInput {
     vtFlowRecordId: string;
+    /** Only for a HOLDER. It defaults to the schema of the applicant participant. */
+    credentialSchemaId?: string;
+    credentialType?: string[];
+    credentialContext?: string[];
+}
+export interface ValidateFlowInput {
+    vtFlowRecordId: string;
+    validationFees?: number;
+    issuanceFees?: number;
+    verificationFees?: number;
+    issuanceFeeDiscount?: number;
+    verificationFeeDiscount?: number;
+    effectiveUntil?: string;
+    opSummaryDigest?: string;
+}
+export interface OfferOnboardingCredentialInput {
+    vtFlowRecordId: string;
+    /** The credential validateOnboardingProcess built. Without it the method builds one. */
+    credential?: JsonObject;
+    /** It defaults to the schema of the applicant participant. */
+    credentialSchemaId?: string;
+    /** The participant validateOnboardingProcess returned; saves a second chain read. */
+    participant?: Participant;
     credentialType?: string[];
     credentialContext?: string[];
-    credentialSchemaId: string;
-    agentParticipantId?: number;
-    walletAgentParticipantId?: number;
 }
 export interface AcceptCredentialInput {
     vtFlowRecordId: string;
@@ -29,25 +49,98 @@ export declare class VtFlowOrchestrator {
     private readonly options;
     constructor(agent: VsAgent<BaseAgentModules>, options?: VtFlowOrchestratorOptions);
     startOnboardingProcess(input: StartOnboardingProcessInput): Promise<VtFlowRecord>;
-    validateAndOfferCredential(input: ValidateAndOfferCredentialInput): Promise<VtFlowRecord>;
+    /**
+     * Validate an onboarding process: record the outcome on-chain, accept the onboarding request and
+     * move the record to VALIDATED. It sends no credential. Only a HOLDER takes part in a credential
+     * exchange; an ISSUER, a VERIFIER or a grantor joins the Ecosystem, and SetParticipantOPToValidated
+     * is the whole of it. The caller decides what follows, from the role of the returned participant.
+     *
+     * For a HOLDER it builds the credential before the chain write, and returns it for
+     * offerOnboardingCredential. Claims that do not satisfy the schema, or a schema fetch that fails,
+     * must stop the process while the chain holds no outcome yet and the caller can repeat the call.
+     *
+     * A record that is already VALIDATED and has no credential exchange keeps the chain outcome and
+     * only builds the credential again. A repeat call thus re-drives an offer that did not complete.
+     */
+    validateOnboardingProcess(input: ValidateOnboardingProcessInput): Promise<{
+        record: VtFlowRecord;
+        participant: Participant;
+        credential?: JsonObject;
+    }>;
+    /**
+     * Offer the credential of an onboarding process to its applicant. Call it only for a HOLDER, and
+     * only after validateOnboardingProcess has moved the record to VALIDATED. Give it the credential
+     * that validateOnboardingProcess built, so that the process does not build the credential twice.
+     */
+    offerOnboardingCredential(input: OfferOnboardingCredentialInput): Promise<VtFlowRecord>;
+    /**
+     * Close an onboarding process that carries no credential exchange, on the validator side. The
+     * applicant reaches the same state from the SetParticipantOPToValidated chain event.
+     */
+    completeOnboardingProcess(vtFlowRecordId: string): Promise<VtFlowRecord>;
+    /** [VSA-ADM-VT-FL-VALIDATE] */
+    validateFlow(input: ValidateFlowInput): Promise<VtFlowRecord>;
+    private validateDirectIssuance;
+    private sendValidating;
+    private assertClaims;
+    private assertValidateState;
+    private validationTerms;
+    private assertClaimsAndTerm;
+    private submissionPath;
+    private submitValidation;
+    private preflight;
+    private anchor;
+    resolveValidationTx(recordId: string): Promise<void>;
+    private failUnlessValidated;
+    /**
+     * [VSA-VTI-FLOW-OP-ISSUE]: moves the flow to VALIDATED and fills `validation` from the validated
+     * entry. Without the landed transaction, a recorded broadcast keeps its tx, and its submission
+     * unless that tx failed.
+     */
+    markValidated(recordId: string, entry: ParticipantDto, landed?: {
+        hash: string;
+        height: number;
+        timestamp?: string;
+    }): Promise<VtFlowRecord>;
+    /** rejectFlow ended the flow with its transaction in flight, and no newer flow of the applicant replaced it ([VSA-ADM-VT-FL-REJECT-2]). */
+    isRejectedInFlight(record: VtFlowRecord): Promise<boolean>;
+    continueAfterValidated(recordId: string): Promise<VtFlowRecord>;
+    /** [VSA-ADM-VT-FL-VALIDATE-8]: at startup, resume every flow left in VALIDATION_TX_SUBMITTED. */
+    resumeValidationSubmissions(): Promise<void>;
+    /** [VSA-VTI-FLOW-ISSUE-1]: at startup, resume every anchoring left SUBMITTED through the stored issued credential. */
+    resumeIssuanceSubmissions(): Promise<void>;
     acceptCredential(input: AcceptCredentialInput): Promise<VtFlowRecord>;
     buildDirectIssuanceOffer(vtFlowRecordId: string): Promise<{
         credentialFormats: {
-            jsonld: DidCommJsonLdCredentialDetailFormat;
+            dataIntegrity: DidCommDataIntegrityOfferCredentialFormat;
         };
         issuerParticipantId: number;
     } | null>;
+    /**
+     * Builds the unsigned VC Data Model 2.0 credential that goes into the offer. RFC 0809 derives the
+     * advertised data model version from its context, and the issuer secures it with a
+     * DataIntegrityProof once the applicant requests it.
+     */
     private buildCredential;
+    private resolveJsonSchemaCredentialId;
     /** Per the spec the algorithm comes from the schema, never from the digest value. */
     private digestAlgorithmForSchema;
-    /** Fired after signing and before delivery, so a failure here must abort the issuance. */
-    onCredentialIssued(vtFlowRecordId: string, signedCredential: JsonCredential): Promise<string>;
+    private credentialSchema;
+    /** Fired after signing and before delivery. A failed anchoring comes back in `issuance`, and the credential stays undelivered. */
+    onCredentialIssued(vtFlowRecordId: string, signedCredential: Record<string, unknown>): Promise<{
+        credentialDigest: string;
+        issuance: VtFlowIssuance;
+    }>;
     verifyOfferedCredential(vtFlowRecordId: string): Promise<void>;
+    /** [VSA-VTI-FLOW-FMT-1]. Credo already verified the proof and its assertionMethod key, for data model 2.0 only. */
+    private assertFlowCredentialFormat;
     onCredentialRevoked(vtFlowRecordId: string): Promise<void>;
     onCredentialCompleted(vtFlowRecordId: string): Promise<void>;
     private triggerResolver;
-    private getOfferedCredentialJson;
-    private requireIndexer;
+    /** The signed credential as the issuer attached it, which is the exact JSON its digest covers. */
+    private getReceivedCredentialJson;
+    checkEcsIssuanceExemption(context: VtFlowEcsIssuanceExemptionContext): Promise<boolean>;
+    checkParticipantId({ record }: VtFlowCheckParticipantIdContext): Promise<boolean | 'validated'>;
     publishCredentialAsLinkedVp(vtFlowRecordId: string): Promise<void>;
     private extractSchemaBaseId;
     rotateRequesterDidToPeer(connectionId: string): Promise<void>;