@verana-labs/vs-agent-sdk 2.0.0-dev.8 → 2.0.0-dev.80

package/build/utils/trustCredentialStore.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.signLinkedDataIntegrityPresentation = signLinkedDataIntegrityPresentation;
 exports.findMetadataEntry = findMetadataEntry;
 exports.saveMetadataEntry = saveMetadataEntry;
 exports.deleteMetadataEntry = deleteMetadataEntry;
@@ -8,22 +9,92 @@ exports.createJsc = createJsc;
 exports.removeTrustCredential = removeTrustCredential;
 exports.removeStoredTrustCredential = removeStoredTrustCredential;
 exports.migrateVtjscServiceIds = migrateVtjscServiceIds;
+exports.detachVtjscPublications = detachVtjscPublications;
+exports.reattachVtjscPublication = reattachVtjscPublication;
 exports.getTrustMetadata = getTrustMetadata;
+exports.saveVtjscTypeMetadata = saveVtjscTypeMetadata;
+exports.findVtjscTypeMetadata = findVtjscTypeMetadata;
 exports.rebindEcsCredentialSchema = rebindEcsCredentialSchema;
+exports.withdrawSelfIssuedEcsCredentials = withdrawSelfIssuedEcsCredentials;
 const core_1 = require("@credo-ts/core");
+// No type definitions available for this library
+// eslint-disable-next-line @typescript-eslint/ban-ts-comment
+//@ts-expect-error
+const jsonld_signatures_1 = require("@digitalcredentials/jsonld-signatures");
 const verre_1 = require("@verana-labs/verre");
-const adminApiService_1 = require("../did/adminApiService");
+const feePreflight_1 = require("../blockchain/feePreflight");
 const setupSelfTr_1 = require("./setupSelfTr");
+const selfIssuedEcsCredential_1 = require("./selfIssuedEcsCredential");
+const publishedDidRecord_1 = require("./publishedDidRecord");
 const data_1 = require("./data");
 async function getDidRecord(agent) {
     const [didRecord] = await agent.dids.getCreatedDids({ did: agent.did });
     return didRecord;
 }
-async function updateDidRecord(agent, didRecord) {
-    const repo = agent.context.dependencyManager.resolve(core_1.DidRepository);
-    (0, adminApiService_1.applyAdminApiServiceEntry)(didRecord.didDocument, agent.adminApiServiceEndpoint);
-    await repo.update(agent.context, didRecord);
-    await agent.dids.update({ did: didRecord.did, didDocument: didRecord.didDocument });
+/** The credential fields shared by both data models: id, credentialSchema and credentialSubject */
+function trustCredentialFields(credential) {
+    return credential instanceof core_1.W3cV2DataIntegrityVerifiableCredential
+        ? credential.resolvedCredential
+        : credential;
+}
+/**
+ * What the metadata entry stores and the DID Document service endpoint serves. A data model 1.1
+ * presentation is kept as its class instance, which serializes to JSON-LD when the DID record is
+ * saved; a Data Integrity one wraps the secured JSON, so that is what gets stored.
+ */
+function trustCredentialEntry(credential) {
+    return credential instanceof core_1.W3cV2DataIntegrityVerifiableCredential
+        ? credential.securedCredential
+        : credential.jsonCredential;
+}
+function trustPresentationEntry(presentation) {
+    return presentation instanceof core_1.W3cV2DataIntegrityVerifiablePresentation
+        ? presentation.securedPresentation
+        : presentation;
+}
+function trustPresentationId(presentation) {
+    return presentation instanceof core_1.W3cV2DataIntegrityVerifiablePresentation
+        ? presentation.securedPresentation.id
+        : presentation.id;
+}
+/**
+ * Wraps a VC Data Model 2.0 credential in a data model 2.0 presentation secured with a
+ * DataIntegrityProof under the cryptosuite the agent is configured with, the counterpart of the
+ * linked data proof a data model 1.1 linked VP carries. The presentation is published from the DID
+ * Document rather than presented to a verifier, so there is no challenge to bind; its proof purpose
+ * is `authentication`, as Data Integrity defines for presentations.
+ */
+async function signLinkedDataIntegrityPresentation(agent, options) {
+    const presentation = new core_1.W3cV2Presentation({
+        id: options.id,
+        holder: options.holder,
+        verifiableCredential: [options.credential],
+    });
+    // The options type requires a challenge for every presentation format, while a Data Integrity
+    // proof only carries one when it is given
+    return await agent.w3cV2Credentials.signPresentation({
+        format: core_1.ClaimFormat.DiVp,
+        presentation,
+        cryptosuite: (0, setupSelfTr_1.getDataIntegrityCryptosuite)(agent),
+        verificationMethod: options.verificationMethodId,
+    });
+}
+/**
+ * Wraps a VC Data Model 1.1 credential in a data model 1.1 presentation carrying an
+ * Ed25519Signature2020 linked data proof, for credentials received from issuers that still use it.
+ */
+async function signLinkedDataProofPresentation(agent, options) {
+    return await agent.w3cCredentials.signPresentation({
+        format: core_1.ClaimFormat.LdpVp,
+        presentation: new core_1.W3cPresentation({
+            id: options.id,
+            holder: options.holder,
+            verifiableCredential: [options.credential],
+        }),
+        proofType: 'Ed25519Signature2020',
+        verificationMethod: options.verificationMethodId,
+        proofPurpose: new jsonld_signatures_1.purposes.AssertionProofPurpose(),
+    });
 }
 function findMetadataEntry(didRecord, key, id, jsonSchemaRef) {
     var _a, _b;
@@ -32,59 +103,53 @@ function findMetadataEntry(didRecord, key, id, jsonSchemaRef) {
         return null;
     if (!id && !jsonSchemaRef)
         return { schemaId: '', data: metadata, didDocumentServiceId: '' };
-    for (const [schemaId, entry] of Object.entries(metadata)) {
-        if (schemaId === jsonSchemaRef) {
-            return Object.assign(Object.assign({ schemaId }, entry), { data: entry.verifiablePresentation });
-        }
-        const credId = (_a = entry.credential) === null || _a === void 0 ? void 0 : _a.id;
-        const presId = (_b = entry.verifiablePresentation) === null || _b === void 0 ? void 0 : _b.id;
-        if (credId === id) {
+    const entries = Object.entries(metadata);
+    // the metadata key identifies one entry, so it answers before any preference between entries
+    const exact = jsonSchemaRef ? entries.find(([schemaId]) => schemaId === jsonSchemaRef) : undefined;
+    if (exact)
+        return Object.assign(Object.assign({ schemaId: exact[0] }, exact[1]), { data: exact[1].verifiablePresentation });
+    const match = ([schemaId, entry]) => {
+        var _a, _b;
+        if (((_a = entry.credential) === null || _a === void 0 ? void 0 : _a.id) === id)
             return Object.assign(Object.assign({ schemaId }, entry), { data: entry.credential });
-        }
-        if (presId === id) {
+        if (((_b = entry.verifiablePresentation) === null || _b === void 0 ? void 0 : _b.id) === id)
             return Object.assign(Object.assign({ schemaId }, entry), { data: entry.verifiablePresentation });
-        }
-    }
-    return null;
+        return null;
+    };
+    // several entries can carry the same presentation URL while a binding is replaced, so the entry
+    // the DID Document announces wins over a detached leftover
+    const matched = entries.map(match).filter(entry => entry !== null);
+    return (_b = (_a = matched.find(entry => entry.attached !== false)) !== null && _a !== void 0 ? _a : matched[0]) !== null && _b !== void 0 ? _b : null;
 }
-async function saveMetadataEntry(agent, didRecord, credential, verifiablePresentation, didDocumentServiceId, key, publicApiBaseUrl) {
-    var _a, _b, _c, _d, _e, _f, _g, _h;
-    const schema = key === '_vt/vtc' ? credential.credentialSchema : credential.credentialSubject;
+async function saveMetadataEntry(agent, didRecord, credential, verifiablePresentation, didDocumentServiceId, key) {
+    var _a, _b, _c, _d, _e, _f;
+    const fields = trustCredentialFields(credential);
+    const schema = key === '_vt/vtc' ? fields.credentialSchema : fields.credentialSubject;
     const ref = Array.isArray(schema) ? (_a = schema[0]) === null || _a === void 0 ? void 0 : _a.id : schema === null || schema === void 0 ? void 0 : schema.id;
     if (!ref) {
         throw new Error('No ID was found in credentialSubject');
     }
     const record = (_b = didRecord.metadata.get(key)) !== null && _b !== void 0 ? _b : {};
     // Remove previous entry for this credential ID (if exists)
-    const found = findMetadataEntry(didRecord, key, credential.id, ref);
+    const found = findMetadataEntry(didRecord, key, fields.id, ref);
+    // [VSA-PUB-VT-5]: the Type Metadata of a schema outlives every re-issue of its VTJSC
+    const typeMetadata = (found === null || found === void 0 ? void 0 : found.schemaId) === ref ? (_c = record[ref]) === null || _c === void 0 ? void 0 : _c.typeMetadata : undefined;
     if (found) {
-        if ((_c = didRecord.didDocument) === null || _c === void 0 ? void 0 : _c.service) {
+        if ((_d = didRecord.didDocument) === null || _d === void 0 ? void 0 : _d.service) {
             didRecord.didDocument.service = didRecord.didDocument.service.filter(s => s.id !== found.didDocumentServiceId);
         }
         delete record[found.schemaId];
     }
-    record[ref] = {
-        credential: credential.jsonCredential,
-        verifiablePresentation,
-        didDocumentServiceId,
-    };
-    (_e = (_d = didRecord.didDocument) === null || _d === void 0 ? void 0 : _d.service) === null || _e === void 0 ? void 0 : _e.push(new core_1.DidDocumentService({
+    record[ref] = Object.assign(Object.assign({}, (typeof typeMetadata === 'string' ? { typeMetadata } : {})), { credential: trustCredentialEntry(credential), verifiablePresentation: trustPresentationEntry(verifiablePresentation), didDocumentServiceId });
+    (_f = (_e = didRecord.didDocument) === null || _e === void 0 ? void 0 : _e.service) === null || _f === void 0 ? void 0 : _f.push(new core_1.DidDocumentService({
         id: didDocumentServiceId,
-        serviceEndpoint: verifiablePresentation.id,
+        serviceEndpoint: trustPresentationId(verifiablePresentation),
         type: 'LinkedVerifiablePresentation',
     }));
     didRecord.metadata.set(key, record);
-    // Update #whois with new endpoint
-    const service = (_g = (_f = didRecord.didDocument) === null || _f === void 0 ? void 0 : _f.service) === null || _g === void 0 ? void 0 : _g.find(s => s.id === `${agent.did}#whois`);
-    if (service && ((_h = verifiablePresentation.id) === null || _h === void 0 ? void 0 : _h.includes('service')))
-        service.serviceEndpoint = verifiablePresentation.id;
-    // A JSON schema credential says nothing about this agent's own ECS identity, so only a real
-    // trust credential replaces the self-issued ones.
-    if (key === '_vt/vtc')
-        updateVtcEntries(didRecord, false, publicApiBaseUrl);
-    await updateDidRecord(agent, didRecord);
+    await (0, publishedDidRecord_1.updateDidRecord)(agent, didRecord);
 }
-async function deleteMetadataEntry(agent, id, didRecord, key, publicApiBaseUrl) {
+async function deleteMetadataEntry(agent, id, didRecord, key) {
     const found = findMetadataEntry(didRecord, key, id, id);
     if (!found)
         return null;
@@ -93,66 +158,22 @@ async function deleteMetadataEntry(agent, id, didRecord, key, publicApiBaseUrl)
         return null;
     delete metadata[found.schemaId];
     didRecord.metadata.set(key, metadata);
-    // If the last entry is removed, restore defaults
-    restoreDefaultVtcEntries(didRecord, publicApiBaseUrl);
-    await updateDidRecord(agent, didRecord);
+    await (0, publishedDidRecord_1.updateDidRecord)(agent, didRecord);
     return { schemaId: found.schemaId };
 }
-function restoreDefaultVtcEntries(didRecord, publicApiBaseUrl) {
-    var _a, _b;
-    const vtc = (_a = didRecord.metadata.get('_vt/vtc')) !== null && _a !== void 0 ? _a : {};
-    const jsc = (_b = didRecord.metadata.get('_vt/jsc')) !== null && _b !== void 0 ? _b : {};
-    // By default we have 2 Self-trusted VTCs
-    if (Object.keys(vtc).length < 3 && Object.keys(jsc).length < 3) {
-        updateVtcEntries(didRecord, true, publicApiBaseUrl);
-    }
-}
-function updateVtcEntries(didRecord, attach, publicApiBaseUrl) {
-    var _a;
-    const record = (_a = didRecord.metadata.get('_vt/vtc')) !== null && _a !== void 0 ? _a : {};
-    setupSelfTr_1.presentations.forEach(p => {
-        var _a, _b, _c, _d;
-        const schemaId = (0, setupSelfTr_1.mapToSelfTr)(p.schemaUrl, publicApiBaseUrl);
-        const current = record[schemaId];
-        if ((current === null || current === void 0 ? void 0 : current.attached) === attach)
-            return;
-        record[schemaId] = Object.assign(Object.assign({}, current), { attached: attach });
-        const serviceId = current === null || current === void 0 ? void 0 : current.didDocumentServiceId;
-        const serviceEndpoint = (_a = current === null || current === void 0 ? void 0 : current.verifiablePresentation) === null || _a === void 0 ? void 0 : _a.id;
-        if (!((_b = didRecord.didDocument) === null || _b === void 0 ? void 0 : _b.service))
-            return;
-        if (attach) {
-            const alreadyExists = didRecord.didDocument.service.some(s => s.id === serviceId);
-            if (!alreadyExists && serviceId && serviceEndpoint) {
-                didRecord.didDocument.service.push(new core_1.DidDocumentService({
-                    id: serviceId,
-                    serviceEndpoint,
-                    type: 'LinkedVerifiablePresentation',
-                }));
-            }
-            // Return to self-trusted VTC in #whois endpoint
-            const service = (_d = (_c = didRecord.didDocument) === null || _c === void 0 ? void 0 : _c.service) === null || _d === void 0 ? void 0 : _d.find(s => s.id === `${didRecord.did}#whois`);
-            if (service && (serviceEndpoint === null || serviceEndpoint === void 0 ? void 0 : serviceEndpoint.includes('service')))
-                service.serviceEndpoint = serviceEndpoint;
-        }
-        else {
-            didRecord.didDocument.service = didRecord.didDocument.service.filter(s => s.id !== serviceId);
-        }
-    });
-    didRecord.metadata.set('_vt/vtc', record);
-}
 async function createVtc(agent, publicApiBaseUrl, id, credential) {
     const didRecord = await getDidRecord(agent);
     const schemaId = `schemas-${id}-vtc-vp.json`;
     const didDocumentServiceId = `${agent.did}#vpr-${schemaId.replace('.json', '')}`;
     const serviceEndpoint = `${publicApiBaseUrl}/vt/${schemaId}`;
-    const unsignedPresentation = (0, setupSelfTr_1.createPresentation)({
-        id: serviceEndpoint,
-        holder: agent.did,
-        verifiableCredential: [credential],
-    });
-    const verifiablePresentation = await (0, setupSelfTr_1.signerW3c)(agent, unsignedPresentation, (0, setupSelfTr_1.getVerificationMethodId)(agent.config.logger, didRecord));
-    await saveMetadataEntry(agent, didRecord, credential, verifiablePresentation, didDocumentServiceId, '_vt/vtc', publicApiBaseUrl);
+    const verificationMethodId = (0, setupSelfTr_1.getVerificationMethodId)(agent.config.logger, didRecord);
+    // The linked VP takes the data model of the credential it carries: a Data Integrity credential
+    // cannot be embedded in a data model 1.1 presentation, nor the other way round
+    const linkedVp = { id: serviceEndpoint, holder: agent.did, verificationMethodId };
+    const verifiablePresentation = credential instanceof core_1.W3cV2DataIntegrityVerifiableCredential
+        ? await signLinkedDataIntegrityPresentation(agent, Object.assign(Object.assign({}, linkedVp), { credential }))
+        : await signLinkedDataProofPresentation(agent, Object.assign(Object.assign({}, linkedVp), { credential }));
+    await saveMetadataEntry(agent, didRecord, credential, verifiablePresentation, didDocumentServiceId, '_vt/vtc');
     return verifiablePresentation;
 }
 async function createJsc(agent, publicApiBaseUrl, ecsSchemas, options) {
@@ -161,53 +182,69 @@ async function createJsc(agent, publicApiBaseUrl, ecsSchemas, options) {
     const { id: subjectId, claims } = (0, setupSelfTr_1.createJsonSubjectRef)(jsonSchemaRef);
     const subjectClaims = precomputedDigestSRI
         ? Object.assign(Object.assign({}, claims), { digestSRI: precomputedDigestSRI }) : await (0, setupSelfTr_1.addDigestSRI)(subjectId, claims, ecsSchemas);
-    const credentialSubject = {
-        id: subjectId,
-        claims: subjectClaims,
-    };
+    const credentialSubject = Object.assign(Object.assign({}, subjectClaims), { id: subjectId });
     const schemaPresentation = `schemas-${schemaBaseId}-vtjsc-vp.json`;
     const schemaCredential = `schemas-${schemaBaseId}-jsc.json`;
     const serviceEndpoint = `${publicApiBaseUrl}/vt/${schemaPresentation}`;
     const didDocumentServiceId = `${agent.did}#vpr-schemas-${schemaBaseId}-vtjsc-vp`;
+    const credentialId = `${publicApiBaseUrl}/vt/${schemaCredential}`;
     const unsignedCredential = (0, setupSelfTr_1.createCredential)({
-        id: `${publicApiBaseUrl}/vt/${schemaCredential}`,
+        id: credentialId,
         type: ['VerifiableCredential', 'JsonSchemaCredential'],
         issuer: agent.did,
         credentialSubject,
+        credentialSchema: await (0, setupSelfTr_1.addDigestSRI)(setupSelfTr_1.createJsonSchema.id, { id: setupSelfTr_1.createJsonSchema.id, type: setupSelfTr_1.createJsonSchema.type }, ecsSchemas),
     });
-    unsignedCredential.credentialSchema = await (0, setupSelfTr_1.addDigestSRI)(setupSelfTr_1.createJsonSchema.id, setupSelfTr_1.createJsonSchema, ecsSchemas);
     const verificationMethodId = (0, setupSelfTr_1.getVerificationMethodId)(agent.config.logger, didRecord);
-    const credential = await (0, setupSelfTr_1.signerW3c)(agent, core_1.JsonTransformer.fromJSON(unsignedCredential, core_1.W3cCredential), verificationMethodId);
-    const unsignedPresentation = (0, setupSelfTr_1.createPresentation)({
+    const credential = await (0, setupSelfTr_1.signerW3c)(agent, unsignedCredential, verificationMethodId);
+    const verifiablePresentation = await signLinkedDataIntegrityPresentation(agent, {
         id: serviceEndpoint,
         holder: agent.did,
-        verifiableCredential: [credential],
+        credential,
+        verificationMethodId,
     });
-    const verifiablePresentation = await (0, setupSelfTr_1.signerW3c)(agent, unsignedPresentation, verificationMethodId);
-    await saveMetadataEntry(agent, didRecord, credential, verifiablePresentation, didDocumentServiceId, '_vt/jsc', publicApiBaseUrl);
-    return credential.jsonCredential;
+    await saveMetadataEntry(agent, didRecord, credential, verifiablePresentation, didDocumentServiceId, '_vt/jsc');
+    // the credential as published; its id is the one assigned above
+    return credential.securedCredential;
 }
-async function removeTrustCredential(agent, publicApiBaseUrl, schemaId, key) {
+async function removeTrustCredential(agent, schemaId, key) {
     var _a;
     const didRecord = await getDidRecord(agent);
-    const record = findMetadataEntry(didRecord, key, schemaId);
+    // same lookup deleteMetadataEntry performs: a self-issued entry carries the agent DID as
+    // credential id, so only its metadata key reaches it
+    const record = findMetadataEntry(didRecord, key, schemaId, schemaId);
     // Currently, we only use one serviceEndpoint per ID.
     // In the future, if multiple serviceEndpoints exist for the same ID,
     // we should review the serviceEndpoint content and remove only the specific one.
     if ((record === null || record === void 0 ? void 0 : record.didDocumentServiceId) && ((_a = didRecord.didDocument) === null || _a === void 0 ? void 0 : _a.service)) {
         didRecord.didDocument.service = didRecord.didDocument.service.filter(s => s.id !== record.didDocumentServiceId);
     }
-    return await deleteMetadataEntry(agent, schemaId, didRecord, key, publicApiBaseUrl);
+    return await deleteMetadataEntry(agent, schemaId, didRecord, key);
 }
-async function removeStoredTrustCredential(agent, publicApiBaseUrl, credentialExchangeRecordId) {
-    var _a, _b;
+/**
+ * Removes the linked VP and the stored credential an exchange delivered, as
+ * [VSA-VTI-FLOW-OP-REVOKE] requires of the applicant. The credential is read from the RFC 0809
+ * format data of the exchange; exchanges earlier versions completed over other formats are not
+ * migrated. Returns the credential id, or `undefined` when none is found, in which case nothing is
+ * removed.
+ */
+async function removeStoredTrustCredential(agent, credentialExchangeRecordId) {
+    var _a, _b, _c;
     const formatData = await agent.didcomm.credentials.getFormatData(credentialExchangeRecordId);
-    const credentialId = (_b = (_a = formatData.credential) === null || _a === void 0 ? void 0 : _a.jsonld) === null || _b === void 0 ? void 0 : _b.id;
-    if (!credentialId)
+    const credentialId = (_c = (_b = (_a = formatData.credential) === null || _a === void 0 ? void 0 : _a.dataIntegrity) === null || _b === void 0 ? void 0 : _b.credential) === null || _c === void 0 ? void 0 : _c.id;
+    if (typeof credentialId !== 'string') {
+        agent.config.logger.warn(`[trust-credential] Credential exchange ${credentialExchangeRecordId} carries no RFC 0809 credential id; its linked VP and stored credential are left in place`);
         return undefined;
-    await removeTrustCredential(agent, publicApiBaseUrl, credentialId, '_vt/vtc');
-    const stored = await agent.w3cCredentials.getAll();
-    for (const storedRecord of stored) {
+    }
+    await removeTrustCredential(agent, credentialId, '_vt/vtc');
+    // The RFC 0809 format holds a data model 2.0 credential in a W3cV2CredentialRecord and a data
+    // model 1.1 one in a W3cCredentialRecord; the credential id is tagged on both
+    for (const storedRecord of await agent.w3cV2Credentials.getAll()) {
+        if (storedRecord.getTags().givenId === credentialId) {
+            await agent.w3cV2Credentials.deleteById(storedRecord.id);
+        }
+    }
+    for (const storedRecord of await agent.w3cCredentials.getAll()) {
         if (storedRecord.getTags().givenId === credentialId) {
             await agent.w3cCredentials.deleteById(storedRecord.id);
         }
@@ -239,69 +276,220 @@ async function migrateVtjscServiceIds(agent) {
     if (!changed)
         return;
     didRecord.metadata.set('_vt/jsc', metadata);
-    await updateDidRecord(agent, didRecord);
+    await (0, publishedDidRecord_1.updateDidRecord)(agent, didRecord);
     agent.config.logger.info('[VTJSC] migrated stored service ids to the -vtjsc-vp naming');
 }
+/**
+ * Takes the linked VPs of the given `_vt/jsc` entries out of the DID Document, publishing it once.
+ *
+ * The entries stay: `SelfTrController` serves them, and issued credentials name that URL in
+ * `credentialSchema.id`. Dropping one would 404 it and leave those credentials unverifiable.
+ */
+async function detachVtjscPublications(agent, schemaRefs) {
+    var _a, _b;
+    if (schemaRefs.length === 0)
+        return [];
+    const didRecord = await getDidRecord(agent);
+    if (!((_a = didRecord === null || didRecord === void 0 ? void 0 : didRecord.didDocument) === null || _a === void 0 ? void 0 : _a.service))
+        return [];
+    const metadata = didRecord.metadata.get('_vt/jsc');
+    if (!metadata)
+        return [];
+    const detached = [];
+    for (const schemaRef of schemaRefs) {
+        const serviceId = (_b = metadata[schemaRef]) === null || _b === void 0 ? void 0 : _b.didDocumentServiceId;
+        if (!serviceId || !didRecord.didDocument.service.some(s => s.id === serviceId))
+            continue;
+        didRecord.didDocument.service = didRecord.didDocument.service.filter(s => s.id !== serviceId);
+        detached.push(schemaRef);
+    }
+    if (detached.length === 0)
+        return [];
+    await (0, publishedDidRecord_1.updateDidRecord)(agent, didRecord);
+    return detached;
+}
+/**
+ * Puts a detached `_vt/jsc` entry back in the DID Document.
+ *
+ * The publication pass skips an entry whose digest still matches, so without this the agent would
+ * keep serving a VTJSC it never announces again.
+ */
+async function reattachVtjscPublication(agent, schemaRef) {
+    var _a, _b, _c;
+    const didRecord = await getDidRecord(agent);
+    if (!(didRecord === null || didRecord === void 0 ? void 0 : didRecord.didDocument))
+        return false;
+    const entry = (_a = didRecord.metadata.get('_vt/jsc')) === null || _a === void 0 ? void 0 : _a[schemaRef];
+    const serviceId = entry === null || entry === void 0 ? void 0 : entry.didDocumentServiceId;
+    const serviceEndpoint = (_b = entry === null || entry === void 0 ? void 0 : entry.verifiablePresentation) === null || _b === void 0 ? void 0 : _b.id;
+    if (!serviceId || !serviceEndpoint)
+        return false;
+    const services = (_c = didRecord.didDocument.service) !== null && _c !== void 0 ? _c : [];
+    if (services.some(s => s.id === serviceId))
+        return false;
+    didRecord.didDocument.service = [
+        ...services,
+        new core_1.DidDocumentService({ id: serviceId, serviceEndpoint, type: 'LinkedVerifiablePresentation' }),
+    ];
+    await (0, publishedDidRecord_1.updateDidRecord)(agent, didRecord);
+    return true;
+}
 function getTrustMetadata(didRecord, key, schemaId) {
     return findMetadataEntry(didRecord, key, schemaId);
 }
-async function anchorCredentialDigest(agent, schemaId, credential) {
-    if (!agent.veranaChain)
+/**
+ * Stores the serialized SD-JWT VC Type Metadata of a VTJSC with its `_vt/jsc` entry, once. A
+ * stored document is never replaced: [VSA-PUB-VT-5] serves identical bytes while the schema exists.
+ * Returns false when the entry does not exist or already carries a document.
+ */
+async function saveVtjscTypeMetadata(agent, schemaRef, typeMetadata) {
+    const didRecord = await getDidRecord(agent);
+    const metadata = didRecord === null || didRecord === void 0 ? void 0 : didRecord.metadata.get('_vt/jsc');
+    const entry = metadata === null || metadata === void 0 ? void 0 : metadata[schemaRef];
+    if (!entry || typeof entry.typeMetadata === 'string')
+        return false;
+    entry.typeMetadata = typeMetadata;
+    didRecord.metadata.set('_vt/jsc', metadata);
+    // the DID Document does not change, so the record is saved without a DID update
+    const repo = agent.context.dependencyManager.resolve(core_1.DidRepository);
+    await repo.update(agent.context, didRecord);
+    return true;
+}
+/**
+ * The stored Type Metadata of the `CredentialSchema` with the given on-chain id, as serialized.
+ * The `_vt/jsc` key of such a schema is `vpr:verana:{chainId}:cs:{id}`.
+ */
+function findVtjscTypeMetadata(didRecord, chainId, credentialSchemaId) {
+    var _a;
+    const entry = (_a = didRecord.metadata.get('_vt/jsc')) === null || _a === void 0 ? void 0 : _a[`vpr:verana:${chainId}:cs:${credentialSchemaId}`];
+    return typeof (entry === null || entry === void 0 ? void 0 : entry.typeMetadata) === 'string' ? entry.typeMetadata : undefined;
+}
+/**
+ * Anchors a self-issued ECS credential, the same way as any other issuance: through
+ * CreateOrUpdateParticipantSession, which stores the digest in the `di` module keeper-to-keeper.
+ *
+ * `issuerParticipantId` must name an active ISSUER participant of this agent for the schema, whose
+ * vs_operator is this agent's account — the chain accepts the session from no other signer. The
+ * caller resolves it, because it already lists the agent's participants to decide what to rebind.
+ */
+async function anchorCredentialDigest(agent, schemaId, credential, issuerParticipantId) {
+    const chain = agent.veranaChain;
+    if (!chain)
         return;
     if (!credential)
         throw new Error(`[DigestAnchor] The presentation for schema ${schemaId} has no credential`);
-    const schema = await agent.veranaChain.getCredentialSchema(schemaId);
+    if (!agent.did)
+        throw new Error('[DigestAnchor] The agent has no public DID');
+    const schema = await agent.indexer.getCredentialSchema(schemaId).catch(() => undefined);
     if (!schema)
         throw new Error(`[DigestAnchor] Credential schema ${schemaId} is not on chain`);
-    const digest = (0, verre_1.computeCredentialDigestJCS)(credential, schema.digestAlgorithm);
+    // the credential as published, which is what a verifier digests
+    const digest = (0, verre_1.computeCredentialDigestJCS)(credential, schema.digest_algorithm);
     // the same credential gives the same digest on each run, so an anchored digest needs no second transaction
-    if (await agent.veranaChain.getDigest(digest))
+    if (await agent.indexer.getDigest(digest))
         return;
-    const { txHash } = await agent.veranaChain.storeDigest(digest);
-    agent.config.logger.info(`[DigestAnchor] Anchored digest ${digest} for schema ${schemaId} (tx ${txHash})`);
+    // A self-issued credential has no counterparty, so the session names only the issuer.
+    const { txHash } = await chain.createOrUpdateParticipantSession({
+        id: core_1.utils.uuid(),
+        issuerParticipantId,
+        agentParticipantId: 0,
+        walletAgentParticipantId: 0,
+        digest,
+    }, { granter: (0, feePreflight_1.feeGranterFor)(agent, issuerParticipantId) });
+    agent.config.logger.info(`[DigestAnchor] Anchored digest ${digest} for schema ${schemaId} against issuer participant ${issuerParticipantId} (tx ${txHash})`);
+    await agent.indexer.waitForDigest(digest);
 }
 // replaces the self-TR example JSC binding with the on-chain VTJSC so resolvers can link the credential to the VPR
-async function rebindEcsCredentialSchema(agent, publicApiBaseUrl, schemaId, schemaKey, defaults) {
-    var _a, _b, _c, _d;
-    if (!['ecs-service', 'ecs-org'].includes(schemaKey) || !agent.did)
+/**
+ * @param jsonSchemaCredentialId the VTJSC the Ecosystem published for this schema. Only the
+ * Ecosystem publishes it, so an agent that issues against another Corporation's Ecosystem must
+ * resolve it there — see resolveJsonSchemaCredentialId.
+ * @param issuerParticipantId this agent's ISSUER participant for the schema, which anchors the
+ * credential digest.
+ * @param schemaKey the ECS schema this agent issues against. Every ECS key is accepted; the caller
+ * reaches this function only for a schema the agent holds an active ISSUER entry on.
+ */
+async function rebindEcsCredentialSchema(agent, publicApiBaseUrl, schemaId, schemaKey, ecsClaims, jsonSchemaCredentialId, issuerParticipantId, onChainJsonSchema, effectiveUntil) {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
+    if (!agent.did)
         return;
     const vpUrl = `${publicApiBaseUrl}/vt/${schemaKey}-vtc-vp.json`;
-    const jscUrl = `${publicApiBaseUrl}/vt/schemas-${schemaId}-jsc.json`;
+    const jscUrl = jsonSchemaCredentialId;
     const didRecord = await getDidRecord(agent);
     const record = (_a = didRecord.metadata.get('_vt/vtc')) !== null && _a !== void 0 ? _a : {};
+    const stored = record[jscUrl];
+    const storedIssuer = typeof ((_b = stored === null || stored === void 0 ? void 0 : stored.credential) === null || _b === void 0 ? void 0 : _b.issuer) === 'string' ? stored.credential.issuer : (_d = (_c = stored === null || stored === void 0 ? void 0 : stored.credential) === null || _c === void 0 ? void 0 : _c.issuer) === null || _d === void 0 ? void 0 : _d.id;
+    if ((stored === null || stored === void 0 ? void 0 : stored.credential) && !stored.integrityData && storedIssuer !== agent.did) {
+        agent.config.logger.debug(`[SelfTR] Keeping the ${schemaKey} credential issued by ${storedIssuer} instead of rebinding a self-issued one`);
+        return;
+    }
     let removedStale = false;
     for (const [key, entry] of Object.entries(record)) {
         // findMetadataEntry serves the first entry matching the VP url, so stale bindings must go
         if (key !== jscUrl &&
-            ((_b = entry.verifiablePresentation) === null || _b === void 0 ? void 0 : _b.id) === vpUrl) {
+            ((_e = entry.verifiablePresentation) === null || _e === void 0 ? void 0 : _e.id) === vpUrl) {
             delete record[key];
             removedStale = true;
         }
     }
     if (removedStale) {
         didRecord.metadata.set('_vt/vtc', record);
-        await updateDidRecord(agent, didRecord);
+        await (0, publishedDidRecord_1.updateDidRecord)(agent, didRecord);
     }
-    await (0, setupSelfTr_1.generateVerifiablePresentation)(agent, vpUrl, (0, data_1.getEcsSchemas)(publicApiBaseUrl), schemaKey, ['VerifiableCredential', 'VerifiableTrustCredential'], { id: jscUrl, type: 'JsonSchemaCredential' }, defaults, async (verifiablePresentation) => {
-        var _a;
-        return await anchorCredentialDigest(agent, Number(schemaId), (_a = verifiablePresentation === null || verifiablePresentation === void 0 ? void 0 : verifiablePresentation.verifiableCredential) === null || _a === void 0 ? void 0 : _a[0]);
-    });
+    await (0, selfIssuedEcsCredential_1.publishSelfIssuedEcsPresentation)(agent, vpUrl, Object.assign(Object.assign({}, (0, data_1.getEcsSchemas)(publicApiBaseUrl)), (onChainJsonSchema ? { [schemaKey]: onChainJsonSchema } : {})), schemaKey, ['VerifiableCredential', 'VerifiableTrustCredential'], { id: jscUrl, type: 'JsonSchemaCredential' }, ecsClaims, async (verifiablePresentation) => await anchorCredentialDigest(agent, Number(schemaId), verifiablePresentation.verifiableCredential[0], issuerParticipantId), effectiveUntil);
     const freshRecord = await getDidRecord(agent);
+    let recordChanged = false;
+    const vtc = (_f = freshRecord.metadata.get('_vt/vtc')) !== null && _f !== void 0 ? _f : {};
+    const entry = vtc[jscUrl];
+    if (entry && (entry.issuerParticipantId !== issuerParticipantId || entry.schemaKey !== schemaKey)) {
+        vtc[jscUrl] = Object.assign(Object.assign({}, entry), { issuerParticipantId, schemaKey });
+        freshRecord.metadata.set('_vt/vtc', vtc);
+        recordChanged = true;
+    }
     const doc = freshRecord.didDocument;
     if (doc) {
         // resolvers match the [VT-CRED-W3C-LINKED-VP] fragment; #whois alone is not enough
         const expectedServiceId = `${agent.did}#${(0, setupSelfTr_1.linkedVpFragment)(schemaKey)}`;
-        const linked = (_c = doc.service) === null || _c === void 0 ? void 0 : _c.some(s => s.id === expectedServiceId);
+        const linked = (_g = doc.service) === null || _g === void 0 ? void 0 : _g.some(s => s.id === expectedServiceId);
         if (!linked) {
-            doc.service = (_d = doc.service) !== null && _d !== void 0 ? _d : [];
+            doc.service = (_h = doc.service) !== null && _h !== void 0 ? _h : [];
             doc.service.push(new core_1.DidDocumentService({
                 id: expectedServiceId,
                 serviceEndpoint: vpUrl,
                 type: 'LinkedVerifiablePresentation',
             }));
-            await updateDidRecord(agent, freshRecord);
+            recordChanged = true;
         }
+        if (recordChanged)
+            await (0, publishedDidRecord_1.updateDidRecord)(agent, freshRecord);
     }
     agent.config.logger.info(`[SelfTR] Rebound ${schemaKey} credential to VTJSC ${jscUrl}`);
 }
+/**
+ * Withdraws the ECS credentials anchored against `issuerParticipantId`, and the #whois entry
+ * when the Service credential is among them.
+ */
+async function withdrawSelfIssuedEcsCredentials(agent, issuerParticipantId) {
+    var _a, _b;
+    const didRecord = await getDidRecord(agent);
+    const withdrawn = [];
+    let whoisWithdrawn = false;
+    for (const [jscUrl, value] of Object.entries((_a = didRecord.metadata.get('_vt/vtc')) !== null && _a !== void 0 ? _a : {})) {
+        const entry = value;
+        if (entry.issuerParticipantId !== issuerParticipantId)
+            continue;
+        await removeTrustCredential(agent, jscUrl, '_vt/vtc');
+        withdrawn.push(jscUrl);
+        if (entry.schemaKey === 'ecs-service')
+            whoisWithdrawn = true;
+    }
+    if (whoisWithdrawn) {
+        const record = await getDidRecord(agent);
+        if ((_b = record.didDocument) === null || _b === void 0 ? void 0 : _b.service) {
+            record.didDocument.service = record.didDocument.service.filter(s => s.id !== `${agent.did}#whois`);
+            await (0, publishedDidRecord_1.updateDidRecord)(agent, record);
+        }
+    }
+    return withdrawn;
+}
 //# sourceMappingURL=trustCredentialStore.js.map