@verana-labs/vs-agent-sdk 2.0.0-dev.7 → 2.0.0-dev.72

package/build/vtFlow/VtFlowOrchestrator.js

@@ -3,10 +3,46 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.VtFlowOrchestrator = void 0;
 const core_1 = require("@credo-ts/core");
 const credo_ts_didcomm_vt_flow_1 = require("@verana-labs/credo-ts-didcomm-vt-flow");
+const verana_types_1 = require("@verana-labs/verana-types");
 const verre_1 = require("@verana-labs/verre");
+const vs_agent_model_1 = require("@verana-labs/vs-agent-model");
+const adminApi_1 = require("../adminApi");
+const ecsIssuanceExemption_1 = require("./ecsIssuanceExemption");
 const types_1 = require("../blockchain/types");
 const types_2 = require("../types");
 const utils_1 = require("../utils");
+// The chain carries a fee discount as an integer from 0 to 10000. The API and the indexer carry it
+// as a decimal from 0 to 1, so only the message is scaled.
+const DISCOUNT_SCALE = 10000;
+const TX_LOOKUP_TIMEOUT_MS = 60000;
+const TX_LOOKUP_INTERVAL_MS = 3000;
+const FEE_DENOM = 'uvna';
+// the notification handler and the tx lookup can both reach markValidated for one flow at the same time
+const markingValidated = new Set();
+const FEE_KEYS = ['validationFees', 'issuanceFees', 'verificationFees'];
+const DISCOUNT_KEYS = ['issuanceFeeDiscount', 'verificationFeeDiscount'];
+function invalidInput(message) {
+    return new adminApi_1.AdminApiError(adminApi_1.AdminApiErrorCode.InvalidInput, 400, message);
+}
+function invalidState(message) {
+    return new adminApi_1.AdminApiError(adminApi_1.AdminApiErrorCode.InvalidState, 409, message);
+}
+// AUTHZ-CHECK-3 step 1. A record's expiration is only its budget clock, not a validity window.
+function isActiveParticipant(participant) {
+    const now = Date.now();
+    if (!participant.effective_from || Date.parse(participant.effective_from) > now)
+        return false;
+    if (participant.effective_until && Date.parse(participant.effective_until) <= now)
+        return false;
+    return !participant.revoked && !participant.slashed;
+}
+function sameTerm(key, given, onEntry) {
+    const scale = DISCOUNT_KEYS.includes(key) ? DISCOUNT_SCALE : 1;
+    return Math.round(given * scale) === Math.round(onEntry * scale);
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
 class VtFlowOrchestrator {
     constructor(agent, options = {}) {
         this.agent = agent;
@@ -14,10 +50,10 @@ class VtFlowOrchestrator {
     }
     async startOnboardingProcess(input) {
         var _a, _b, _c, _d;
-        const chain = this.requireChain();
+        this.requireChain();
         if (!this.agent.did)
             throw new Error('Agent has no public DID');
-        const holderParticipant = await chain.getParticipant(input.applicantParticipantId);
+        const holderParticipant = await this.agent.indexer.findParticipant(input.applicantParticipantId);
         if (!holderParticipant) {
             throw new Error(`Applicant participant ${input.applicantParticipantId} not found on chain`);
         }
@@ -37,7 +73,7 @@ class VtFlowOrchestrator {
         if (!holderParticipant.validatorParticipantId) {
             throw new Error(`Applicant participant ${input.applicantParticipantId} has no validator_participant_id`);
         }
-        const validatorParticipant = await chain.getParticipant(Number(holderParticipant.validatorParticipantId));
+        const validatorParticipant = await this.agent.indexer.findParticipant(Number(holderParticipant.validatorParticipantId));
         if (!(validatorParticipant === null || validatorParticipant === void 0 ? void 0 : validatorParticipant.did)) {
             throw new Error(`Validator participant ${holderParticipant.validatorParticipantId} not resolvable`);
         }
@@ -47,46 +83,58 @@ class VtFlowOrchestrator {
         // Renewals resend the OR with the same session id so the validator re-attaches the finished flow.
         const vtFlowApi = this.resolveVtFlowApi();
         const [latest] = (await vtFlowApi.findAllByQuery({
-            participantId: String(holderParticipant.id),
+            applicantParticipantId: String(holderParticipant.id),
             role: credo_ts_didcomm_vt_flow_1.VtFlowRole.Applicant,
             flowVariant: credo_ts_didcomm_vt_flow_1.VtFlowVariant.OnboardingProcess,
         }))
             .filter(record => !(0, credo_ts_didcomm_vt_flow_1.isVtFlowTerminalState)(record.state))
             .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
-        if (latest && latest.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.Completed && latest.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.CredRevoked) {
-            this.agent.config.logger.info(`[vt-flow] onboarding flow ${latest.id} for participant ${holderParticipant.id} is already in progress (state ${latest.state}); not resending`);
-            return latest;
-        }
-        const existing = latest;
+        const running = latest !== undefined && !(0, credo_ts_didcomm_vt_flow_1.isVtFlowRenewable)(latest);
         let connectionId;
-        if (existing) {
-            const connection = await this.agent.didcomm.connections.findById(existing.connectionId);
-            if (connection === null || connection === void 0 ? void 0 : connection.isReady)
+        if (latest) {
+            const connection = await this.agent.didcomm.connections.findById(latest.connectionId);
+            if (connection && (0, utils_1.isUsableConnectionTo)(connection, validatorParticipant.did))
                 connectionId = connection.id;
         }
+        const undelivered = running && latest.state === credo_ts_didcomm_vt_flow_1.VtFlowState.OrSent && holderParticipant.opState === types_1.ValidationState.PENDING;
+        if (running && connectionId && !undelivered) {
+            this.agent.config.logger.info(`[vt-flow] onboarding flow ${latest.id} for participant ${holderParticipant.id} is in progress (state ${latest.state}) on an open connection, not resending`);
+            return latest;
+        }
         if (!connectionId) {
-            const { connectionRecord } = await this.agent.didcomm.oob.receiveImplicitInvitation({
-                did: validatorParticipant.did,
-                ourDid: this.agent.did,
-                label: this.agent.label,
-                didCommVersion: 'v2',
-            });
-            if (!connectionRecord)
-                throw new Error('Failed to establish DIDComm connection to validator');
-            const ready = await this.agent.didcomm.connections.returnWhenIsConnected(connectionRecord.id);
-            connectionId = ready.id;
+            connectionId = await (0, utils_1.connectToPublicDid)(this.agent, validatorParticipant.did);
+        }
+        if (running) {
+            this.agent.config.logger.info(`[vt-flow] resending the onboarding request of flow ${latest.id} (state ${latest.state}) on ${connectionId === latest.connectionId ? 'its' : 'a new'} connection`);
+            return vtFlowApi.resendOnboardingRequest({ vtFlowRecordId: latest.id, connectionId });
         }
         return vtFlowApi.sendOnboardingRequest({
             connectionId,
-            participantSessionId: (_b = (_a = input.participantSessionId) !== null && _a !== void 0 ? _a : existing === null || existing === void 0 ? void 0 : existing.participantSessionId) !== null && _b !== void 0 ? _b : core_1.utils.uuid(),
-            participantId: String(holderParticipant.id),
+            participantSessionId: (_b = (_a = input.participantSessionId) !== null && _a !== void 0 ? _a : latest === null || latest === void 0 ? void 0 : latest.participantSessionId) !== null && _b !== void 0 ? _b : core_1.utils.uuid(),
+            applicantParticipantId: String(holderParticipant.id),
+            applicantParticipantRole: Number(holderParticipant.role),
+            validatorParticipantId: String(holderParticipant.validatorParticipantId),
+            schemaId: String(holderParticipant.schemaId),
             agentParticipantId: String((_c = this.options.agentParticipantId) !== null && _c !== void 0 ? _c : 0),
             walletAgentParticipantId: String((_d = this.options.walletAgentParticipantId) !== null && _d !== void 0 ? _d : 0),
             claims: input.claims,
         });
     }
-    async validateAndOfferCredential(input) {
-        var _a;
+    /**
+     * Validate an onboarding process: record the outcome on-chain, accept the onboarding request and
+     * move the record to VALIDATED. It sends no credential. Only a HOLDER takes part in a credential
+     * exchange; an ISSUER, a VERIFIER or a grantor joins the Ecosystem, and SetParticipantOPToValidated
+     * is the whole of it. The caller decides what follows, from the role of the returned participant.
+     *
+     * For a HOLDER it builds the credential before the chain write, and returns it for
+     * offerOnboardingCredential. Claims that do not satisfy the schema, or a schema fetch that fails,
+     * must stop the process while the chain holds no outcome yet and the caller can repeat the call.
+     *
+     * A record that is already VALIDATED and has no credential exchange keeps the chain outcome and
+     * only builds the credential again. A repeat call thus re-drives an offer that did not complete.
+     */
+    async validateOnboardingProcess(input) {
+        var _a, _b;
         const chain = this.requireChain();
         if (!this.agent.did)
             throw new Error('Agent has no public DID');
@@ -99,43 +147,550 @@ class VtFlowOrchestrator {
         if (record.variant !== credo_ts_didcomm_vt_flow_1.VtFlowVariant.OnboardingProcess) {
             throw new Error(`Record variant is '${record.variant}', expected OnboardingProcess`);
         }
-        if (record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingOr) {
-            throw new Error(`Record state is '${record.state}', expected '${credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingOr}'`);
-        }
-        if (!record.participantId)
-            throw new Error('Record has no participantId');
-        const holderParticipantId = Number(record.participantId);
-        const holderParticipant = await chain.getParticipant(holderParticipantId);
-        if (!holderParticipant)
-            throw new Error(`Holder participant ${holderParticipantId} not found on chain`);
-        if (!holderParticipant.did)
-            throw new Error('Holder participant has no DID');
-        const unsignedCredentialJson = await this.buildCredential({
-            credentialSchemaId: input.credentialSchemaId,
-            subjectDid: holderParticipant.did,
-            claims: ((_a = record.claims) !== null && _a !== void 0 ? _a : {}),
-            credentialType: input.credentialType,
-            credentialContext: input.credentialContext,
-        });
+        const resumeOffer = record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.Validated && !record.credentialExchangeRecordId;
+        if (record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingOr && !resumeOffer) {
+            throw new Error(`Record state is '${record.state}', expected '${credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingOr}', or ` +
+                `'${credo_ts_didcomm_vt_flow_1.VtFlowState.Validated}' with no credential exchange`);
+        }
+        if (!record.applicantParticipantId)
+            throw new Error('Record has no applicantParticipantId');
+        const participantId = Number(record.applicantParticipantId);
+        const participant = await this.agent.indexer.findParticipant(participantId);
+        if (!participant)
+            throw new Error(`Applicant participant ${participantId} not found on chain`);
+        if (!participant.did)
+            throw new Error('Applicant participant has no DID');
+        const credential = Number(participant.role) === types_2.HOLDER_PARTICIPANT_TYPE
+            ? await this.buildCredential({
+                credentialSchemaId: (_a = input.credentialSchemaId) !== null && _a !== void 0 ? _a : String(participant.schemaId),
+                subjectDid: participant.did,
+                claims: ((_b = record.claims) !== null && _b !== void 0 ? _b : {}),
+                credentialType: input.credentialType,
+                credentialContext: input.credentialContext,
+            })
+            : undefined;
+        if (resumeOffer)
+            return { record, participant, credential };
         // op_summary_digest (MOD-PP-MSG-3) digests the applicant's submission, not the credential
-        await chain.setParticipantOPToValidated({
-            id: holderParticipantId,
-            corporation: holderParticipant.corporation,
-        });
+        await chain.setParticipantOPToValidated({ id: participantId, corporation: participant.corporation });
         await vtFlowApi.acceptOnboardingRequest(record.id);
-        await vtFlowApi.markValidated(record.id);
+        const validated = await vtFlowApi.markValidated(record.id);
+        return { record: validated, participant, credential };
+    }
+    /**
+     * Offer the credential of an onboarding process to its applicant. Call it only for a HOLDER, and
+     * only after validateOnboardingProcess has moved the record to VALIDATED. Give it the credential
+     * that validateOnboardingProcess built, so that the process does not build the credential twice.
+     */
+    async offerOnboardingCredential(input) {
+        var _a, _b, _c, _d, _e;
+        this.requireChain();
+        const vtFlowApi = this.resolveVtFlowApi();
+        const record = await vtFlowApi.findById(input.vtFlowRecordId);
+        if (!record)
+            throw new Error(`vt-flow record ${input.vtFlowRecordId} not found`);
+        if (!record.applicantParticipantId)
+            throw new Error('Record has no applicantParticipantId');
+        const participant = (_a = input.participant) !== null && _a !== void 0 ? _a : (await this.agent.indexer.findParticipant(Number(record.applicantParticipantId)));
+        if (!(participant === null || participant === void 0 ? void 0 : participant.did))
+            throw new Error('Applicant participant has no DID');
+        const unsignedCredentialJson = (_b = input.credential) !== null && _b !== void 0 ? _b : (await this.buildCredential({
+            credentialSchemaId: (_c = input.credentialSchemaId) !== null && _c !== void 0 ? _c : String(participant.schemaId),
+            subjectDid: participant.did,
+            claims: ((_d = record.claims) !== null && _d !== void 0 ? _d : {}),
+            credentialType: input.credentialType,
+            credentialContext: input.credentialContext,
+            // [VSA-VTI-FLOW-FMT-1]: markValidated sets it from the entry on every pass, a renewal included
+            validUntil: (_e = record.validation) === null || _e === void 0 ? void 0 : _e.effectiveUntil,
+        }));
+        // W3C Data Integrity attachment format (RFC 0809). The applicant DID is the credential subject
+        // and the exchange runs over its authenticated connection, so no extra binding is required. The
+        // cryptosuite is the issuer's choice and is applied when the credential is issued.
         const { record: offered } = await vtFlowApi.offerCredentialForSession({
             vtFlowRecordId: record.id,
-            issuerParticipantId: Number(holderParticipant.validatorParticipantId),
+            issuerParticipantId: Number(participant.validatorParticipantId),
             credentialFormats: {
-                jsonld: {
-                    credential: unsignedCredentialJson,
-                    options: { proofType: 'Ed25519Signature2020', proofPurpose: 'assertionMethod' },
-                },
+                dataIntegrity: { credential: unsignedCredentialJson, bindingRequired: false },
             },
         });
         return offered;
     }
+    /**
+     * Close an onboarding process that carries no credential exchange, on the validator side. The
+     * applicant reaches the same state from the SetParticipantOPToValidated chain event.
+     */
+    async completeOnboardingProcess(vtFlowRecordId) {
+        return this.resolveVtFlowApi().markCompleted(vtFlowRecordId);
+    }
+    /** [VSA-ADM-VT-FL-VALIDATE] */
+    async validateFlow(input) {
+        var _a, _b;
+        this.requireChain();
+        const vtFlowApi = this.resolveVtFlowApi();
+        const record = await vtFlowApi.findById(input.vtFlowRecordId);
+        if (!record) {
+            throw new adminApi_1.AdminApiError(adminApi_1.AdminApiErrorCode.UnknownId, 404, `no flow with id "${input.vtFlowRecordId}"`);
+        }
+        if (record.role !== credo_ts_didcomm_vt_flow_1.VtFlowRole.Validator)
+            throw invalidState('validate is a validator action');
+        const reissue = record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.CredOffered && ((_b = (_a = record.issuance) === null || _a === void 0 ? void 0 : _a.tx) === null || _b === void 0 ? void 0 : _b.status) === credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Failed;
+        if (reissue && record.credentialExchangeRecordId) {
+            const { record: issued } = await vtFlowApi.issueCredentialForSession({
+                vtFlowRecordId: record.id,
+                credentialExchangeRecordId: record.credentialExchangeRecordId,
+            });
+            return issued;
+        }
+        if (record.variant === credo_ts_didcomm_vt_flow_1.VtFlowVariant.DirectIssuance)
+            return this.validateDirectIssuance(record);
+        if (!record.applicantParticipantId)
+            throw invalidState('the flow names no applicant participant');
+        const applicant = await this.agent.indexer.getParticipant(record.applicantParticipantId);
+        const entryValidated = applicant.op_state === 'VALIDATED';
+        const rejectedInFlight = entryValidated && (await this.isRejectedInFlight(record));
+        if (!rejectedInFlight) {
+            this.assertValidateState(record, entryValidated);
+            if (record.connectionTerminated)
+                throw invalidState('the flow connection is TERMINATED until the applicant reconnects');
+        }
+        const terms = this.validationTerms(input, applicant, record);
+        await this.assertClaimsAndTerm(record, applicant, terms);
+        // [VSA-VTI-FLOW-OP-ISSUE-6]: the connection stays TERMINATED, so issuance waits for the applicant to reconnect
+        if (rejectedInFlight)
+            return this.markValidated(record.id, applicant);
+        if (record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.OobPending)
+            await this.sendValidating(record);
+        if (record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.ValidatedPendingClaims)
+            return this.continueAfterValidated(record.id);
+        if (entryValidated) {
+            if (record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.Validated)
+                await this.markValidated(record.id, applicant);
+            return this.continueAfterValidated(record.id);
+        }
+        const validation = Object.assign({ decidedAt: new Date().toISOString(), submission: await this.submissionPath(applicant) }, terms);
+        if (validation.submission === credo_ts_didcomm_vt_flow_1.VtFlowSubmission.Operator) {
+            return vtFlowApi.recordValidation(record.id, validation, credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingValidationTx);
+        }
+        return this.submitValidation(record.id, applicant, validation);
+    }
+    // A Direct Issuance flow has no entry to validate, so no transaction: check the claims, then offer.
+    async validateDirectIssuance(record) {
+        if (record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.Validating && record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.OobPending) {
+            throw invalidState(`the flow is '${record.state}', which validate does not accept`);
+        }
+        if (!record.schemaId)
+            throw invalidState('the flow names no credential schema');
+        const connection = await this.agent.didcomm.connections.findById(record.connectionId);
+        if (!(connection === null || connection === void 0 ? void 0 : connection.theirDid))
+            throw invalidState('the flow connection has no peer DID');
+        const schema = await this.agent.indexer.getCredentialSchema(record.schemaId);
+        this.assertClaims(schema.json_schema, connection.theirDid, record.claims);
+        const vtFlowApi = this.resolveVtFlowApi();
+        if (record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.OobPending)
+            await this.sendValidating(record);
+        const offer = await this.buildDirectIssuanceOffer(record.id);
+        if (!offer)
+            throw invalidState('the agent holds no active ISSUER participant for the schema of the flow');
+        const { record: offered } = await vtFlowApi.offerCredentialForSession(Object.assign({ vtFlowRecordId: record.id }, offer));
+        return offered;
+    }
+    // [VSA-ADM-VT-FL-START]: checked before the flow moves, as a failed send would leave it in VALIDATING
+    async sendValidating(record) {
+        const connection = await this.agent.didcomm.connections.findById(record.connectionId);
+        if (!(connection === null || connection === void 0 ? void 0 : connection.isReady))
+            throw invalidState('the flow connection is not ESTABLISHED');
+        await this.resolveVtFlowApi().sendValidating(record.id);
+    }
+    assertClaims(jsonSchema, subjectDid, claims) {
+        const violations = (0, utils_1.schemaViolations)(JSON.parse(jsonSchema), Object.assign({ id: subjectDid }, (claims !== null && claims !== void 0 ? claims : {})));
+        if (violations.length > 0) {
+            throw new adminApi_1.AdminApiError(adminApi_1.AdminApiErrorCode.InvalidClaims, 422, 'the claim set does not satisfy the json_schema', { violations });
+        }
+    }
+    assertValidateState(record, entryValidated) {
+        const accepted = [
+            credo_ts_didcomm_vt_flow_1.VtFlowState.Validating,
+            credo_ts_didcomm_vt_flow_1.VtFlowState.OobPending,
+            credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxFailed,
+            credo_ts_didcomm_vt_flow_1.VtFlowState.ValidatedPendingClaims,
+        ];
+        // Once the entry is VALIDATED on chain any validator-side state resumes into issuance, which is
+        // how a backend that disabled the default notification handler drives the flow ([VSA-ADM-VT-FL-VALIDATE-11]).
+        const acceptedOnceValidated = [
+            credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingOr,
+            credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingValidationTx,
+            credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxSubmitted,
+            credo_ts_didcomm_vt_flow_1.VtFlowState.Validated,
+        ];
+        if (accepted.includes(record.state))
+            return;
+        if (entryValidated && acceptedOnceValidated.includes(record.state))
+            return;
+        throw invalidState(`the flow is '${record.state}', which validate does not accept`);
+    }
+    validationTerms(input, applicant, record) {
+        var _a, _b, _c, _d, _e, _f, _g, _h;
+        for (const key of FEE_KEYS) {
+            const fee = input[key];
+            if (fee !== undefined && !(Number.isInteger(fee) && fee >= 0)) {
+                throw invalidInput(`${key} must be a non-negative integer`);
+            }
+        }
+        for (const key of DISCOUNT_KEYS) {
+            const discount = input[key];
+            if (discount !== undefined && !(discount >= 0 && discount <= 1)) {
+                throw invalidInput(`${key} must be between 0 and 1`);
+            }
+        }
+        if (input.effectiveUntil !== undefined && Number.isNaN(Date.parse(input.effectiveUntil))) {
+            throw invalidInput('effectiveUntil must be an ISO 8601 datetime');
+        }
+        const onEntry = {
+            validationFees: (_a = applicant.validation_fees) !== null && _a !== void 0 ? _a : 0,
+            issuanceFees: (_b = applicant.issuance_fees) !== null && _b !== void 0 ? _b : 0,
+            verificationFees: (_c = applicant.verification_fees) !== null && _c !== void 0 ? _c : 0,
+            issuanceFeeDiscount: (_d = applicant.issuance_fee_discount) !== null && _d !== void 0 ? _d : 0,
+            verificationFeeDiscount: (_e = applicant.verification_fee_discount) !== null && _e !== void 0 ? _e : 0,
+        };
+        const renewal = !!applicant.effective_from;
+        const recorded = record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxFailed ? record.validation : undefined;
+        const terms = {
+            effectiveUntil: (_f = input.effectiveUntil) !== null && _f !== void 0 ? _f : recorded === null || recorded === void 0 ? void 0 : recorded.effectiveUntil,
+            opSummaryDigest: (_g = input.opSummaryDigest) !== null && _g !== void 0 ? _g : recorded === null || recorded === void 0 ? void 0 : recorded.opSummaryDigest,
+        };
+        for (const key of [...FEE_KEYS, ...DISCOUNT_KEYS]) {
+            const given = input[key];
+            if (renewal) {
+                if (given !== undefined && !sameTerm(key, given, onEntry[key])) {
+                    throw invalidInput(`${key} differs from the entry, and a renewal keeps the agreed value`);
+                }
+                terms[key] = onEntry[key];
+            }
+            else {
+                terms[key] = (_h = given !== null && given !== void 0 ? given : recorded === null || recorded === void 0 ? void 0 : recorded[key]) !== null && _h !== void 0 ? _h : 0;
+            }
+        }
+        return terms;
+    }
+    async assertClaimsAndTerm(record, applicant, terms) {
+        var _a;
+        if (applicant.role !== types_1.ParticipantRole.Holder)
+            return;
+        if (!applicant.did)
+            throw invalidState('the applicant entry has no DID to issue to');
+        const schema = await this.agent.indexer.getCredentialSchema(applicant.schema_id);
+        this.assertClaims(schema.json_schema, applicant.did, record.claims);
+        // An ECS Organization or Persona credential needs a validUntil. With a validity period of 0 the
+        // VPR sets no effective_until, so the call has to carry one.
+        const needsValidUntil = (0, vs_agent_model_1.ecsRequiresValidUntil)(await (0, vs_agent_model_1.classifyEcsSchema)(schema.json_schema));
+        if (needsValidUntil && ((_a = schema.holder_validation_validity_period) !== null && _a !== void 0 ? _a : 0) === 0 && !terms.effectiveUntil) {
+            throw invalidInput('this schema has no validity period, so effectiveUntil is required');
+        }
+    }
+    async submissionPath(applicant) {
+        const authorization = this.agent.authorizationService;
+        if (!authorization || applicant.validator_participant_id == null)
+            return credo_ts_didcomm_vt_flow_1.VtFlowSubmission.Operator;
+        const validator = await this.agent.indexer
+            .getParticipant(applicant.validator_participant_id)
+            .catch(() => undefined);
+        if (!validator || !isActiveParticipant(validator))
+            return credo_ts_didcomm_vt_flow_1.VtFlowSubmission.Operator;
+        await authorization.refreshForOperator().catch(() => undefined);
+        const grant = authorization.getVsOperatorAuthorizationRecord(validator.id);
+        return (grant === null || grant === void 0 ? void 0 : grant.msgTypes.includes(verana_types_1.veranaTypeUrls.MsgSetParticipantOPToValidated))
+            ? credo_ts_didcomm_vt_flow_1.VtFlowSubmission.Agent
+            : credo_ts_didcomm_vt_flow_1.VtFlowSubmission.Operator;
+    }
+    async submitValidation(recordId, applicant, validation) {
+        var _a, _b;
+        const chain = this.requireChain();
+        const vtFlowApi = this.resolveVtFlowApi();
+        const fail = (reason, error) => vtFlowApi.recordValidation(recordId, Object.assign(Object.assign({}, validation), { tx: { status: credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Failed, reason, error } }), credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxFailed);
+        const message = chain.setParticipantOPToValidatedMsg({
+            id: applicant.id,
+            effectiveUntil: validation.effectiveUntil ? new Date(validation.effectiveUntil) : undefined,
+            validationFees: validation.validationFees,
+            issuanceFees: validation.issuanceFees,
+            verificationFees: validation.verificationFees,
+            issuanceFeeDiscount: Math.round(((_a = validation.issuanceFeeDiscount) !== null && _a !== void 0 ? _a : 0) * DISCOUNT_SCALE),
+            verificationFeeDiscount: Math.round(((_b = validation.verificationFeeDiscount) !== null && _b !== void 0 ? _b : 0) * DISCOUNT_SCALE),
+            opSummaryDigest: validation.opSummaryDigest,
+        });
+        const checked = await this.preflight(message, applicant.validator_participant_id);
+        if ('reason' in checked)
+            return fail(checked.reason, checked.error);
+        let hash;
+        try {
+            hash = await chain.broadcastWithoutWaiting([message], checked.fee);
+        }
+        catch (error) {
+            return fail(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.BroadcastError, errorMessage(error));
+        }
+        const submitted = await vtFlowApi.recordValidation(recordId, Object.assign(Object.assign({}, validation), { tx: { hash, submittedAt: new Date().toISOString(), status: credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Submitted } }), credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxSubmitted);
+        void this.resolveValidationTx(recordId).catch(error => this.agent.config.logger.error(`[vt-flow] resolving the validation of ${recordId} failed`, {
+            error: errorMessage(error),
+        }));
+        return submitted;
+    }
+    // [VSA-ADM-VT-FL-VALIDATE-6]: the fee payer is the Corporation when the grant of the entry has with_feegrant
+    async preflight(message, participantId) {
+        var _a, _b, _c;
+        const chain = this.requireChain();
+        const grant = participantId == null
+            ? undefined
+            : (_a = this.agent.authorizationService) === null || _a === void 0 ? void 0 : _a.getVsOperatorAuthorizationRecord(participantId);
+        const granter = (grant === null || grant === void 0 ? void 0 : grant.withFeegrant) ? chain.corporation : undefined;
+        const failed = (reason, error) => ({
+            reason,
+            error,
+        });
+        let allowance;
+        try {
+            allowance = granter ? await chain.feeAllowance(granter, FEE_DENOM) : undefined;
+        }
+        catch (error) {
+            return failed(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.PreflightError, errorMessage(error));
+        }
+        if (granter && !allowance) {
+            return failed(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.FeegrantExpired, 'the Corporation grants the agent no active fee allowance');
+        }
+        let fee;
+        try {
+            fee = await chain.estimateFee([message], granter);
+        }
+        catch (error) {
+            return failed(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.PreflightError, errorMessage(error));
+        }
+        const amount = BigInt((_c = (_b = fee.amount.find(coin => coin.denom === FEE_DENOM)) === null || _b === void 0 ? void 0 : _b.amount) !== null && _c !== void 0 ? _c : '0');
+        if (granter && allowance) {
+            if (!allowance.unlimited && allowance.remaining < amount) {
+                return failed(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.FeegrantExhausted, `the fee allowance has ${allowance.remaining}${FEE_DENOM} left`);
+            }
+            let corporation;
+            try {
+                corporation = BigInt((await chain.getAccountBalance(granter, FEE_DENOM)).amount);
+            }
+            catch (error) {
+                return failed(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.PreflightError, errorMessage(error));
+            }
+            if (corporation < amount) {
+                return failed(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.InsufficientFundsCorporation, `the Corporation holds ${corporation}${FEE_DENOM}`);
+            }
+        }
+        else {
+            let own;
+            try {
+                own = BigInt((await chain.getBalance(FEE_DENOM)).amount);
+            }
+            catch (error) {
+                return failed(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.PreflightError, errorMessage(error));
+            }
+            if (own < amount) {
+                return failed(credo_ts_didcomm_vt_flow_1.VtFlowTxReason.InsufficientFundsAgent, `the agent account holds ${own}${FEE_DENOM}`);
+            }
+        }
+        return { fee };
+    }
+    // [VSA-VTI-FLOW-ISSUE-1]: [VSA-ADM-VT-FL-VALIDATE-6] to -9 applied to the anchoring, which the delivery waits for.
+    // A transaction left SUBMITTED by a restart is looked up again, not broadcast twice.
+    async anchor(record, message, issuerParticipantId) {
+        var _a, _b, _c;
+        const chain = this.requireChain();
+        const pending = ((_b = (_a = record.issuance) === null || _a === void 0 ? void 0 : _a.tx) === null || _b === void 0 ? void 0 : _b.status) === credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Submitted ? record.issuance.tx : undefined;
+        let hash = pending === null || pending === void 0 ? void 0 : pending.hash;
+        let submittedAt = (_c = pending === null || pending === void 0 ? void 0 : pending.submittedAt) !== null && _c !== void 0 ? _c : new Date().toISOString();
+        if (!hash) {
+            const checked = await this.preflight(message, issuerParticipantId);
+            if ('reason' in checked)
+                return Object.assign({ status: credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Failed }, checked);
+            try {
+                hash = await chain.broadcastWithoutWaiting([message], checked.fee);
+            }
+            catch (error) {
+                return {
+                    status: credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Failed,
+                    reason: credo_ts_didcomm_vt_flow_1.VtFlowTxReason.BroadcastError,
+                    error: errorMessage(error),
+                };
+            }
+            submittedAt = new Date().toISOString();
+            await this.resolveVtFlowApi().recordIssuance(record.id, {
+                tx: { hash, submittedAt, status: credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Submitted },
+            });
+        }
+        for (;;) {
+            const tx = await chain.findTx(hash).catch(() => undefined);
+            if ((tx === null || tx === void 0 ? void 0 : tx.code) === 0)
+                return { hash, submittedAt, height: tx.height, status: credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Succeeded };
+            if (tx) {
+                const failure = { status: credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Failed, reason: credo_ts_didcomm_vt_flow_1.VtFlowTxReason.TxFailed, error: tx.rawLog };
+                return Object.assign({ hash, submittedAt, height: tx.height }, failure);
+            }
+            if (Date.now() - Date.parse(submittedAt) >= TX_LOOKUP_TIMEOUT_MS) {
+                const error = 'not found 60 seconds after the broadcast';
+                return { hash, submittedAt, status: credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Failed, reason: credo_ts_didcomm_vt_flow_1.VtFlowTxReason.TxNotFound, error };
+            }
+            await new Promise(resolve => setTimeout(resolve, TX_LOOKUP_INTERVAL_MS));
+        }
+    }
+    // [VSA-ADM-VT-FL-VALIDATE-8]. Leaving VALIDATION_TX_SUBMITTED ends the loop, so the notification
+    // handler moving the flow first wins the race.
+    async resolveValidationTx(recordId) {
+        var _a, _b, _c;
+        const chain = this.requireChain();
+        const vtFlowApi = this.resolveVtFlowApi();
+        let landed;
+        for (;;) {
+            const record = await vtFlowApi.findById(recordId);
+            const validation = record === null || record === void 0 ? void 0 : record.validation;
+            const hash = (_a = validation === null || validation === void 0 ? void 0 : validation.tx) === null || _a === void 0 ? void 0 : _a.hash;
+            if (!(record === null || record === void 0 ? void 0 : record.applicantParticipantId) || !validation || !hash)
+                return;
+            if (record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxSubmitted)
+                return;
+            const tx = landed !== null && landed !== void 0 ? landed : (await chain.findTx(hash).catch(() => undefined));
+            if (tx && tx.code === 0) {
+                landed = tx;
+                // the indexer can lag the block of the transaction, and the fill needs the validated entry
+                const entry = await this.agent.indexer.getParticipant(record.applicantParticipantId);
+                if (entry.op_state === 'VALIDATED') {
+                    await this.markValidated(recordId, entry, { hash, height: tx.height });
+                    await this.continueAfterValidated(recordId);
+                    return;
+                }
+            }
+            else if (tx) {
+                return this.failUnlessValidated(record, validation, credo_ts_didcomm_vt_flow_1.VtFlowTxReason.TxFailed, tx.rawLog, tx.height);
+            }
+            const submittedAt = (_c = (_b = validation.tx) === null || _b === void 0 ? void 0 : _b.submittedAt) !== null && _c !== void 0 ? _c : validation.decidedAt;
+            if (Date.now() - Date.parse(submittedAt) >= TX_LOOKUP_TIMEOUT_MS) {
+                if (tx) {
+                    this.agent.config.logger.warn(`[vt-flow] the transaction of flow ${recordId} landed, but the indexer does not show the entry VALIDATED yet: its notification completes the flow`);
+                    return;
+                }
+                return this.failUnlessValidated(record, validation, credo_ts_didcomm_vt_flow_1.VtFlowTxReason.TxNotFound, 'not found 60 seconds after the broadcast');
+            }
+            await new Promise(resolve => setTimeout(resolve, TX_LOOKUP_INTERVAL_MS));
+        }
+    }
+    // The VPR has no distinct error for a second SetParticipantOPtoValidated, so the entry tells a
+    // rejected duplicate apart from a real failure.
+    async failUnlessValidated(record, validation, reason, error, height) {
+        var _a;
+        const vtFlowApi = this.resolveVtFlowApi();
+        const applicant = record.applicantParticipantId
+            ? await this.agent.indexer.getParticipant(record.applicantParticipantId)
+            : undefined;
+        const failed = Object.assign(Object.assign({}, validation), { tx: Object.assign(Object.assign({}, validation.tx), { height, status: credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Failed, reason, error }) });
+        if ((applicant === null || applicant === void 0 ? void 0 : applicant.op_state) === 'VALIDATED') {
+            // the notification handler may have moved the flow while the tx and the entry were read
+            if (((_a = (await vtFlowApi.findById(record.id))) === null || _a === void 0 ? void 0 : _a.state) !== credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxSubmitted)
+                return;
+            if (reason === credo_ts_didcomm_vt_flow_1.VtFlowTxReason.TxFailed)
+                await vtFlowApi.recordValidation(record.id, failed);
+            await this.markValidated(record.id, applicant);
+            await this.continueAfterValidated(record.id);
+            return;
+        }
+        await vtFlowApi.recordValidation(record.id, failed, credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxFailed);
+    }
+    /**
+     * [VSA-VTI-FLOW-OP-ISSUE]: moves the flow to VALIDATED and fills `validation` from the validated
+     * entry. Without the landed transaction, a recorded broadcast keeps its tx, and its submission
+     * unless that tx failed.
+     */
+    async markValidated(recordId, entry, landed) {
+        var _a, _b, _c, _d, _e;
+        const vtFlowApi = this.resolveVtFlowApi();
+        if (markingValidated.has(recordId))
+            throw invalidState('the flow is already moving to VALIDATED');
+        markingValidated.add(recordId);
+        try {
+            const record = await vtFlowApi.findById(recordId);
+            if (!record)
+                throw new Error(`vt-flow record ${recordId} not found`);
+            if (!credo_ts_didcomm_vt_flow_1.VtFlowValidatedFromStates.has(record.state) &&
+                record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.TerminatedByValidator) {
+                throw invalidState(`the flow is '${record.state}', which does not precede VALIDATED`);
+            }
+            const recorded = record.validation;
+            const agentTx = landed && ((_a = recorded === null || recorded === void 0 ? void 0 : recorded.tx) === null || _a === void 0 ? void 0 : _a.hash) === landed.hash ? recorded.tx : undefined;
+            const validation = Object.assign(Object.assign(Object.assign({}, recorded), { decidedAt: (_c = (_b = recorded === null || recorded === void 0 ? void 0 : recorded.decidedAt) !== null && _b !== void 0 ? _b : landed === null || landed === void 0 ? void 0 : landed.timestamp) !== null && _c !== void 0 ? _c : entry.modified, submission: !landed && ((_d = recorded === null || recorded === void 0 ? void 0 : recorded.tx) === null || _d === void 0 ? void 0 : _d.hash) && recorded.tx.reason !== credo_ts_didcomm_vt_flow_1.VtFlowTxReason.TxFailed
+                    ? recorded.submission
+                    : agentTx
+                        ? credo_ts_didcomm_vt_flow_1.VtFlowSubmission.Agent
+                        : credo_ts_didcomm_vt_flow_1.VtFlowSubmission.Operator, validationFees: entry.validation_fees, issuanceFees: entry.issuance_fees, verificationFees: entry.verification_fees, issuanceFeeDiscount: entry.issuance_fee_discount, verificationFeeDiscount: entry.verification_fee_discount, effectiveUntil: (_e = entry.effective_until) !== null && _e !== void 0 ? _e : undefined }), (agentTx && {
+                tx: {
+                    hash: agentTx.hash,
+                    submittedAt: agentTx.submittedAt,
+                    height: landed === null || landed === void 0 ? void 0 : landed.height,
+                    status: credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Succeeded,
+                },
+            }));
+            return await vtFlowApi.recordValidation(recordId, validation, credo_ts_didcomm_vt_flow_1.VtFlowState.Validated);
+        }
+        finally {
+            markingValidated.delete(recordId);
+        }
+    }
+    /** rejectFlow ended the flow with its transaction in flight, and no newer flow of the applicant replaced it ([VSA-ADM-VT-FL-REJECT-2]). */
+    async isRejectedInFlight(record) {
+        if (record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.TerminatedByValidator || !record.validation)
+            return false;
+        if (!record.applicantParticipantId)
+            return false;
+        const [latest] = (await this.resolveVtFlowApi().findAllByQuery({
+            role: credo_ts_didcomm_vt_flow_1.VtFlowRole.Validator,
+            applicantParticipantId: record.applicantParticipantId,
+        })).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+        return (latest === null || latest === void 0 ? void 0 : latest.id) === record.id;
+    }
+    async continueAfterValidated(recordId) {
+        var _a;
+        const vtFlowApi = this.resolveVtFlowApi();
+        const record = await vtFlowApi.findById(recordId);
+        if (!record)
+            throw new Error(`vt-flow record ${recordId} not found`);
+        if (record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.Validated && record.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.ValidatedPendingClaims) {
+            return record;
+        }
+        const participant = await this.agent.indexer.findParticipant(Number(record.applicantParticipantId));
+        if (!participant)
+            throw new Error(`Applicant participant ${record.applicantParticipantId} not found`);
+        if (Number(participant.role) !== types_2.HOLDER_PARTICIPANT_TYPE)
+            return record;
+        const schema = await this.agent.indexer.getCredentialSchema(participant.schemaId);
+        const violations = (0, utils_1.schemaViolations)(JSON.parse(schema.json_schema), Object.assign({ id: participant.did }, ((_a = record.claims) !== null && _a !== void 0 ? _a : {})));
+        if (violations.length > 0) {
+            this.agent.config.logger.error(`[vt-flow] not offering the credential of flow ${recordId}: its claims do not satisfy the ` +
+                `json_schema of schema ${participant.schemaId}: ${violations.map(v => `${v.path} ${v.message}`.trim()).join(', ')}`);
+            return record.state === credo_ts_didcomm_vt_flow_1.VtFlowState.Validated ? vtFlowApi.markPendingClaims(recordId) : record;
+        }
+        return this.offerOnboardingCredential({ vtFlowRecordId: recordId, participant });
+    }
+    /** [VSA-ADM-VT-FL-VALIDATE-8]: at startup, resume every flow left in VALIDATION_TX_SUBMITTED. */
+    async resumeValidationSubmissions() {
+        const pending = await this.resolveVtFlowApi().findAllByQuery({
+            role: credo_ts_didcomm_vt_flow_1.VtFlowRole.Validator,
+            flowState: credo_ts_didcomm_vt_flow_1.VtFlowState.ValidationTxSubmitted,
+        });
+        await Promise.all(pending.map(record => this.resolveValidationTx(record.id)));
+    }
+    /** [VSA-VTI-FLOW-ISSUE-1]: at startup, resume every anchoring left SUBMITTED through the stored issued credential. */
+    async resumeIssuanceSubmissions() {
+        const vtFlowApi = this.resolveVtFlowApi();
+        const offered = await vtFlowApi.findAllByQuery({
+            role: credo_ts_didcomm_vt_flow_1.VtFlowRole.Validator,
+            flowState: credo_ts_didcomm_vt_flow_1.VtFlowState.CredOffered,
+        });
+        await Promise.all(offered.map(({ id, issuance, credentialExchangeRecordId }) => {
+            var _a;
+            return ((_a = issuance === null || issuance === void 0 ? void 0 : issuance.tx) === null || _a === void 0 ? void 0 : _a.status) === credo_ts_didcomm_vt_flow_1.VtFlowTxStatus.Submitted && credentialExchangeRecordId
+                ? vtFlowApi.issueCredentialForSession({ vtFlowRecordId: id, credentialExchangeRecordId })
+                : undefined;
+        }));
+    }
     async acceptCredential(input) {
         const vtFlowApi = this.resolveVtFlowApi();
         const record = await vtFlowApi.findById(input.vtFlowRecordId);
@@ -154,7 +709,7 @@ class VtFlowOrchestrator {
         const chain = this.requireChain();
         if (!this.agent.did)
             throw new Error('Agent has no public DID');
-        const indexer = this.requireIndexer();
+        const indexer = this.agent.indexer;
         const vtFlowApi = this.resolveVtFlowApi();
         const record = await vtFlowApi.findById(vtFlowRecordId);
         if (!record)
@@ -185,49 +740,51 @@ class VtFlowOrchestrator {
         });
         return {
             credentialFormats: {
-                jsonld: {
-                    credential: unsignedCredentialJson,
-                    options: { proofType: 'Ed25519Signature2020', proofPurpose: 'assertionMethod' },
-                },
+                dataIntegrity: { credential: unsignedCredentialJson, bindingRequired: false },
             },
             issuerParticipantId: issuer.id,
         };
     }
+    /**
+     * Builds the unsigned VC Data Model 2.0 credential that goes into the offer. RFC 0809 derives the
+     * advertised data model version from its context, and the issuer secures it with a
+     * DataIntegrityProof once the applicant requests it.
+     */
     async buildCredential(input) {
-        var _a, _b, _c;
-        const chain = this.requireChain();
-        const didRecords = await this.agent.dids.getCreatedDids({ did: this.agent.did });
-        const didRecord = didRecords[0];
-        if (!didRecord)
-            throw new Error('Agent DID record not found');
-        const schemaRef = `vpr:verana:${chain.getChainId}:cs:${input.credentialSchemaId}`;
-        const entry = await (0, utils_1.findMetadataEntry)(didRecord, '_vt/jsc', '', schemaRef);
-        if (!entry)
-            throw new Error(`No stored VTJSC found for ${schemaRef}`);
-        const { data } = entry;
-        const unsignedCredential = (0, utils_1.createCredential)({
+        var _a;
+        const jsonSchemaCredentialId = await this.resolveJsonSchemaCredentialId(input.credentialSchemaId);
+        // A credential whose claims don't satisfy the schema's required fields is not a valid
+        // instance of that credential type — reject it here rather than issue an empty shell.
+        const schema = await this.agent.indexer.getCredentialSchema(input.credentialSchemaId);
+        (0, utils_1.validateSchema)(JSON.parse(schema.json_schema), Object.assign({ id: input.subjectDid }, input.claims));
+        // Data model 2.0 holds the claims on the credential subject itself; the applicant DID wins over
+        // any `id` claim so the credential can never name a different subject
+        const unsignedCredential = (0, utils_1.createW3cV2Credential)({
             id: `${this.agent.did}#${core_1.utils.uuid()}`,
             type: (_a = input.credentialType) !== null && _a !== void 0 ? _a : ['VerifiableCredential', 'VerifiableTrustCredential'],
             issuer: this.agent.did,
-            credentialSubject: { id: input.subjectDid, claims: input.claims },
+            context: input.credentialContext,
+            credentialSubject: Object.assign(Object.assign({}, input.claims), { id: input.subjectDid }),
+            credentialSchema: { id: jsonSchemaCredentialId, type: 'JsonSchemaCredential' },
+            validUntil: input.validUntil,
         });
-        if (input.credentialContext)
-            unsignedCredential.context = input.credentialContext;
-        unsignedCredential.credentialSchema = {
-            id: (_c = (_b = data.verifiableCredential) === null || _b === void 0 ? void 0 : _b[0]) === null || _c === void 0 ? void 0 : _c.id,
-            type: 'JsonSchemaCredential',
-        };
-        return core_1.JsonTransformer.toJSON(unsignedCredential);
+        return (0, utils_1.toOfferedCredentialJson)(unsignedCredential);
+    }
+    async resolveJsonSchemaCredentialId(credentialSchemaId) {
+        return (0, utils_1.resolveJsonSchemaCredentialId)(this.agent, this.agent.indexer, credentialSchemaId, this.requireChain().getChainId);
     }
     /** Per the spec the algorithm comes from the schema, never from the digest value. */
     async digestAlgorithmForSchema(schemaId) {
-        const schema = await this.requireIndexer().getCredentialSchema(schemaId);
+        return (await this.credentialSchema(schemaId)).digestAlgorithm;
+    }
+    async credentialSchema(schemaId) {
+        const schema = await this.agent.indexer.getCredentialSchema(schemaId);
         if (!schema.digest_algorithm) {
             throw new Error(`Credential schema ${schemaId} has no digest_algorithm`);
         }
-        return schema.digest_algorithm;
+        return { digestAlgorithm: schema.digest_algorithm, ecsKey: await (0, vs_agent_model_1.classifyEcsSchema)(schema.json_schema) };
     }
-    /** Fired after signing and before delivery, so a failure here must abort the issuance. */
+    /** Fired after signing and before delivery. A failed anchoring comes back in `issuance`, and the credential stays undelivered. */
     async onCredentialIssued(vtFlowRecordId, signedCredential) {
         var _a, _b;
         const chain = this.requireChain();
@@ -238,17 +795,20 @@ class VtFlowOrchestrator {
         if (record.issuerParticipantId == null) {
             throw new Error(`vt-flow record ${vtFlowRecordId} has no issuerParticipantId to anchor against`);
         }
-        const issuer = await this.requireIndexer().getParticipant(record.issuerParticipantId);
+        const issuer = await this.agent.indexer.getParticipant(record.issuerParticipantId);
         const algorithm = await this.digestAlgorithmForSchema(issuer.schema_id);
         const digest = (0, verre_1.computeCredentialDigestJCS)(signedCredential, algorithm);
-        await chain.createOrUpdateParticipantSession({
+        const message = chain.createOrUpdateParticipantSessionMsg({
             id: record.participantSessionId,
             issuerParticipantId: record.issuerParticipantId,
             agentParticipantId: Number((_a = record.agentParticipantId) !== null && _a !== void 0 ? _a : 0) || 0,
             walletAgentParticipantId: Number((_b = record.walletAgentParticipantId) !== null && _b !== void 0 ? _b : 0) || 0,
             digest,
         });
-        return digest;
+        return {
+            credentialDigest: digest,
+            issuance: { tx: await this.anchor(record, message, record.issuerParticipantId) },
+        };
     }
     async verifyOfferedCredential(vtFlowRecordId) {
         var _a, _b;
@@ -261,7 +821,7 @@ class VtFlowOrchestrator {
         if (!record.credentialExchangeRecordId) {
             throw new Error('Record has no credentialExchangeRecordId; nothing to verify');
         }
-        const indexer = this.requireIndexer();
+        const indexer = this.agent.indexer;
         const session = await indexer.getParticipantSession(record.participantSessionId);
         if (!session) {
             throw new Error(`ParticipantSession ${record.participantSessionId} not found on indexer`);
@@ -282,13 +842,36 @@ class VtFlowOrchestrator {
         if (record.schemaId != null && Number(issuer.schema_id) !== Number(record.schemaId)) {
             throw new Error(`Issuer participant schema ${issuer.schema_id} does not match credential schema ${record.schemaId}`);
         }
-        const credentialJson = await this.getOfferedCredentialJson(record.credentialExchangeRecordId);
-        const algorithm = await this.digestAlgorithmForSchema(issuer.schema_id);
-        const digest = (0, verre_1.computeCredentialDigestJCS)(credentialJson, algorithm);
+        const credentialJson = await this.getReceivedCredentialJson(record.credentialExchangeRecordId);
+        await this.assertFlowCredentialFormat(credentialJson, issuer);
+        const { digestAlgorithm, ecsKey } = await this.credentialSchema(issuer.schema_id);
+        const digest = (0, verre_1.computeCredentialDigestJCS)(credentialJson, digestAlgorithm);
         const anchored = await indexer.getDigest(digest);
         if (!anchored) {
             throw new Error(`Credential digest ${digest} is not anchored on-chain`);
         }
+        if (ecsKey)
+            await vtFlowApi.setEcsSchemaKey(record.id, ecsKey);
+    }
+    /** [VSA-VTI-FLOW-FMT-1]. Credo already verified the proof and its assertionMethod key, for data model 2.0 only. */
+    async assertFlowCredentialFormat(credential, issuer) {
+        var _a, _b, _c;
+        if (!(0, utils_1.isVcdm2Credential)(credential)) {
+            throw new Error('Received credential is not a VC Data Model 2.0 credential');
+        }
+        const verificationMethod = (_a = credential.proof) === null || _a === void 0 ? void 0 : _a.verificationMethod;
+        if (!issuer.did || (verificationMethod === null || verificationMethod === void 0 ? void 0 : verificationMethod.split('#')[0]) !== issuer.did) {
+            throw new Error(`Proof verification method ${verificationMethod} is not one of the validator ${issuer.did}`);
+        }
+        const subjectId = (_b = credential.credentialSubject) === null || _b === void 0 ? void 0 : _b.id;
+        if (subjectId !== this.agent.did) {
+            throw new Error(`Credential subject ${subjectId} is not the applicant ${this.agent.did}`);
+        }
+        const schemaRef = (_c = credential.credentialSchema) === null || _c === void 0 ? void 0 : _c.id;
+        const jsonSchemaCredentialId = await this.resolveJsonSchemaCredentialId(String(issuer.schema_id));
+        if (schemaRef !== jsonSchemaCredentialId) {
+            throw new Error(`Credential schema ${schemaRef} is not the VTJSC ${jsonSchemaCredentialId} of the flow`);
+        }
     }
     async onCredentialRevoked(vtFlowRecordId) {
         const vtFlowApi = this.resolveVtFlowApi();
@@ -297,7 +880,7 @@ class VtFlowOrchestrator {
             return;
         if (!this.options.publicApiBaseUrl || !record.credentialExchangeRecordId)
             return;
-        const credentialId = await (0, utils_1.removeStoredTrustCredential)(this.agent, this.options.publicApiBaseUrl, record.credentialExchangeRecordId);
+        const credentialId = await (0, utils_1.removeStoredTrustCredential)(this.agent, record.credentialExchangeRecordId);
         if (credentialId) {
             this.agent.config.logger.info(`[vt-flow] removed revoked credential and its linked VP (${credentialId})`);
         }
@@ -318,26 +901,68 @@ class VtFlowOrchestrator {
         const chain = this.agent.veranaChain;
         if (!chain || !chain.autoTriggerResolverEnabled)
             return;
-        if (record.participantId == null)
+        if (record.applicantParticipantId == null)
             return;
-        await chain.triggerResolver(Number(record.participantId));
+        await chain.triggerResolver(Number(record.applicantParticipantId));
     }
-    async getOfferedCredentialJson(credentialExchangeRecordId) {
-        var _a;
+    /** The signed credential as the issuer attached it, which is the exact JSON its digest covers. */
+    async getReceivedCredentialJson(credentialExchangeRecordId) {
+        var _a, _b;
         const formatData = await this.agent.didcomm.credentials.getFormatData(credentialExchangeRecordId);
-        const credentialJson = (_a = formatData.credential) === null || _a === void 0 ? void 0 : _a.jsonld;
+        const credentialJson = (_b = (_a = formatData.credential) === null || _a === void 0 ? void 0 : _a.dataIntegrity) === null || _b === void 0 ? void 0 : _b.credential;
         if (!credentialJson)
-            throw new Error('Offered credential has no JSON-LD body to verify');
+            throw new Error('Received credential has no data integrity credential body');
         return credentialJson;
     }
-    requireIndexer() {
-        if (!this.options.indexer) {
-            throw new Error('Agent has no indexer configured (set VERANA_INDEXER_BASE_URL)');
+    // VS-CONN-VS gate: consulted only after trust resolution rejected the peer.
+    async checkEcsIssuanceExemption(context) {
+        return (0, ecsIssuanceExemption_1.isEcsIssuanceExempt)({
+            indexer: this.agent.indexer,
+            agent: this.agent,
+            trustedEcosystemDids: this.agent.trustedEcosystemDids,
+        }, context);
+    }
+    // the indexer can still lag the applicant's own transaction, so wait for it as a tx lookup does
+    async checkParticipantId({ record }) {
+        if (!record.applicantParticipantId || !this.agent.did)
+            return false;
+        const deadline = Date.now() + TX_LOOKUP_TIMEOUT_MS;
+        let validatedAtFirstRead;
+        for (;;) {
+            const entry = await this.agent.indexer
+                .getParticipant(record.applicantParticipantId)
+                .catch(() => undefined);
+            validatedAtFirstRead !== null && validatedAtFirstRead !== void 0 ? validatedAtFirstRead : (validatedAtFirstRead = (entry === null || entry === void 0 ? void 0 : entry.op_state) === 'VALIDATED');
+            if (entry) {
+                if (entry.revoked || entry.slashed || entry.validator_participant_id == null)
+                    return false;
+                const validator = await this.agent.indexer
+                    .getParticipant(entry.validator_participant_id)
+                    .catch(() => undefined);
+                if (validator && validator.did !== this.agent.did)
+                    return false;
+                if (validator && entry.op_state === 'PENDING')
+                    return true;
+                if (validator && entry.op_state === 'VALIDATED') {
+                    const flow = await this.resolveVtFlowApi().findById(record.id);
+                    // the flow has moved on, or another path is moving it to VALIDATED and continues it itself
+                    if ((flow === null || flow === void 0 ? void 0 : flow.state) !== credo_ts_didcomm_vt_flow_1.VtFlowState.AwaitingOr || markingValidated.has(record.id))
+                        return 'validated';
+                    // VALIDATED at the first read can be the round before this request, which it does not settle
+                    if (!validatedAtFirstRead) {
+                        await this.markValidated(record.id, entry);
+                        await this.continueAfterValidated(record.id);
+                        return 'validated';
+                    }
+                }
+            }
+            if (Date.now() >= deadline)
+                return false;
+            await new Promise(resolve => setTimeout(resolve, TX_LOOKUP_INTERVAL_MS));
         }
-        return this.options.indexer;
     }
     async publishCredentialAsLinkedVp(vtFlowRecordId) {
-        var _a, _b;
+        var _a;
         if (!this.options.publicApiBaseUrl) {
             throw new Error('publicApiBaseUrl is required to publish a LinkedVerifiablePresentation');
         }
@@ -350,18 +975,18 @@ class VtFlowOrchestrator {
         if (!record.credentialExchangeRecordId) {
             throw new Error(`vt-flow record ${vtFlowRecordId} has no credentialExchangeRecordId`);
         }
-        const formatData = await this.agent.didcomm.credentials.getFormatData(record.credentialExchangeRecordId);
-        const jsonld = (_a = formatData.credential) === null || _a === void 0 ? void 0 : _a.jsonld;
-        if (!jsonld) {
-            throw new Error(`No jsonld credential in exchange ${record.credentialExchangeRecordId}`);
-        }
-        const schemaRef = (_b = jsonld.credentialSchema) === null || _b === void 0 ? void 0 : _b.id;
+        const credentialJson = await this.getReceivedCredentialJson(record.credentialExchangeRecordId);
+        const schemaRef = (_a = credentialJson.credentialSchema) === null || _a === void 0 ? void 0 : _a.id;
         const schemaBaseId = schemaRef ? this.extractSchemaBaseId(schemaRef) : undefined;
         if (!schemaBaseId) {
             throw new Error(`Cannot publish Linked VP: credential has no extractable schema base id (credentialSchema.id=${schemaRef !== null && schemaRef !== void 0 ? schemaRef : 'undefined'})`);
         }
-        const w3cCredential = core_1.JsonTransformer.fromJSON(jsonld, core_1.W3cJsonLdVerifiableCredential);
-        await (0, utils_1.createVtc)(this.agent, this.options.publicApiBaseUrl, schemaBaseId, w3cCredential);
+        // A data model 2.0 credential arrives secured with a DataIntegrityProof; a validator still on
+        // data model 1.1 sends a linked data proof, and both are published the same way
+        const credential = (0, utils_1.isVcdm2Credential)(credentialJson)
+            ? core_1.W3cV2DataIntegrityVerifiableCredential.fromObject(credentialJson)
+            : core_1.JsonTransformer.fromJSON(credentialJson, core_1.W3cJsonLdVerifiableCredential);
+        await (0, utils_1.createVtc)(this.agent, this.options.publicApiBaseUrl, record.ecsSchemaKey ? (0, utils_1.linkedVpSchemaId)(record.ecsSchemaKey) : schemaBaseId, credential);
     }
     extractSchemaBaseId(jscUrl) {
         var _a;