@verana-labs/vs-agent-sdk 2.0.0-dev.9 → 2.0.0-pr.767.1

package/build/blockchain/indexerMappers.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toParticipant = toParticipant;
+exports.toCredentialSchema = toCredentialSchema;
+const types_1 = require("./types");
+const ROLE = {
+    [types_1.ParticipantRole.Issuer]: 1,
+    [types_1.ParticipantRole.Verifier]: 2,
+    [types_1.ParticipantRole.IssuerGrantor]: 3,
+    [types_1.ParticipantRole.VerifierGrantor]: 4,
+    [types_1.ParticipantRole.Ecosystem]: 5,
+    [types_1.ParticipantRole.Holder]: 6,
+};
+const OP_STATE = {
+    PENDING: types_1.ValidationState.PENDING,
+    VALIDATED: types_1.ValidationState.VALIDATED,
+    TERMINATED: types_1.ValidationState.TERMINATED,
+};
+const ONBOARDING_MODE = {
+    OPEN: 1,
+    ECOSYSTEM_ONBOARDING_PROCESS: 2,
+    GRANTOR_ONBOARDING_PROCESS: 3,
+};
+const date = (v) => (v ? new Date(v) : undefined);
+function toParticipant(dto) {
+    var _a, _b, _c, _d, _e;
+    return {
+        id: dto.id,
+        schemaId: dto.schema_id,
+        role: (_a = ROLE[dto.role]) !== null && _a !== void 0 ? _a : 0,
+        did: (_b = dto.did) !== null && _b !== void 0 ? _b : '',
+        corporation: '',
+        validatorParticipantId: (_c = dto.validator_participant_id) !== null && _c !== void 0 ? _c : 0,
+        opState: dto.op_state ? ((_d = OP_STATE[dto.op_state]) !== null && _d !== void 0 ? _d : types_1.ValidationState.UNSPECIFIED) : undefined,
+        opSummaryDigest: (_e = dto.op_summary_digest) !== null && _e !== void 0 ? _e : '',
+        revoked: date(dto.revoked),
+        slashed: date(dto.slashed),
+    };
+}
+function toCredentialSchema(dto) {
+    var _a, _b, _c, _d;
+    return {
+        id: dto.id,
+        ecosystemId: dto.ecosystem_id,
+        jsonSchema: dto.json_schema,
+        digestAlgorithm: dto.digest_algorithm,
+        issuerOnboardingMode: (_b = ONBOARDING_MODE[(_a = dto.issuer_onboarding_mode) !== null && _a !== void 0 ? _a : '']) !== null && _b !== void 0 ? _b : 0,
+        verifierOnboardingMode: (_d = ONBOARDING_MODE[(_c = dto.verifier_onboarding_mode) !== null && _c !== void 0 ? _c : '']) !== null && _d !== void 0 ? _d : 0,
+        holderOnboardingMode: 0,
+        archived: date(dto.archived),
+    };
+}
+//# sourceMappingURL=indexerMappers.js.map

package/build/blockchain/indexerMappers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexerMappers.js","sourceRoot":"","sources":["../../src/blockchain/indexerMappers.ts"],"names":[],"mappings":";;AAgCA,sCAaC;AAED,gDAWC;AA1DD,mCAOgB;AAEhB,MAAM,IAAI,GAA2B;IACnC,CAAC,uBAAe,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3B,CAAC,uBAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7B,CAAC,uBAAe,CAAC,aAAa,CAAC,EAAE,CAAC;IAClC,CAAC,uBAAe,CAAC,eAAe,CAAC,EAAE,CAAC;IACpC,CAAC,uBAAe,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9B,CAAC,uBAAe,CAAC,MAAM,CAAC,EAAE,CAAC;CAC5B,CAAA;AAED,MAAM,QAAQ,GAAoC;IAChD,OAAO,EAAE,uBAAe,CAAC,OAAO;IAChC,SAAS,EAAE,uBAAe,CAAC,SAAS;IACpC,UAAU,EAAE,uBAAe,CAAC,UAAU;CACvC,CAAA;AAED,MAAM,eAAe,GAA2B;IAC9C,IAAI,EAAE,CAAC;IACP,4BAA4B,EAAE,CAAC;IAC/B,0BAA0B,EAAE,CAAC;CAC9B,CAAA;AAED,MAAM,IAAI,GAAG,CAAC,CAA4B,EAAoB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAE9F,SAAgB,aAAa,CAAC,GAAmB;;IAC/C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,IAAI,EAAE,MAAA,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,CAAC;QACzB,GAAG,EAAE,MAAA,GAAG,CAAC,GAAG,mCAAI,EAAE;QAClB,WAAW,EAAE,EAAE;QACf,sBAAsB,EAAE,MAAA,GAAG,CAAC,wBAAwB,mCAAI,CAAC;QACzD,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,mCAAI,uBAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3F,eAAe,EAAE,MAAA,GAAG,CAAC,iBAAiB,mCAAI,EAAE;QAC5C,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;QAC1B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;KAC3B,CAAA;AACH,CAAC;AAED,SAAgB,kBAAkB,CAAC,GAAwB;;IACzD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,eAAe,EAAE,GAAG,CAAC,gBAAgB;QACrC,oBAAoB,EAAE,MAAA,eAAe,CAAC,MAAA,GAAG,CAAC,sBAAsB,mCAAI,EAAE,CAAC,mCAAI,CAAC;QAC5E,sBAAsB,EAAE,MAAA,eAAe,CAAC,MAAA,GAAG,CAAC,wBAAwB,mCAAI,EAAE,CAAC,mCAAI,CAAC;QAChF,oBAAoB,EAAE,CAAC;QACvB,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;KAC7B,CAAA;AACH,CAAC"}

package/build/blockchain/types.d.ts

@@ -57,6 +57,10 @@ export interface IndexerSubscribeMessage {
     dids?: string[];
     corporationId?: number;
 }
+export interface IndexerSubscribedMessage {
+    type: 'subscribed';
+    block: number;
+}
 export interface IndexerEventsResponse {
     events: IndexerEventRecord[];
     count: number;
@@ -131,6 +135,7 @@ export interface CredentialSchemaDto {
     digest_algorithm: string;
     issuer_onboarding_mode?: string;
     verifier_onboarding_mode?: string;
+    holder_validation_validity_period?: number;
     archived: string | null;
     created: string;
     modified: string;
@@ -162,10 +167,16 @@ export interface ParticipantDto {
     op_state?: string;
     revoked: string | null;
     slashed: string | null;
-    effective_until?: string;
+    effective_from?: string | null;
+    effective_until?: string | null;
     modified: string;
     validator_participant_id?: number | null;
     op_summary_digest?: string;
+    validation_fees?: number;
+    issuance_fees?: number;
+    verification_fees?: number;
+    issuance_fee_discount?: number;
+    verification_fee_discount?: number;
 }
 export interface CorporationDto {
     id: number;
@@ -191,18 +202,6 @@ export interface DigestDto {
     digest: string;
     created: string;
 }
-export interface RawParticipant {
-    id: number;
-    schemaId: number;
-    role: number;
-    did: string;
-    corporationId?: number;
-    validatorParticipantId: number;
-    opState?: number;
-    opSummaryDigest?: string;
-    revoked: Date | undefined;
-    slashed: Date | undefined;
-}
 export interface Ecosystem {
     id: number;
     did: string;
@@ -220,10 +219,6 @@ export interface CredentialSchema {
     holderOnboardingMode: number;
     archived: Date | undefined;
 }
-export interface StoredDigest {
-    digest: string;
-    created: Date | undefined;
-}
 export interface OperatorAuthorization {
     id: number;
     corporationId: number;
@@ -249,64 +244,13 @@ export interface VsOperatorAuthorization {
     vsOperator: string;
     records: ParticipantAuthorizationRecord[];
 }
-export interface ParticipantQueryClient {
-    GetParticipant(req: {
-        id: number;
-    }): Promise<{
-        participant?: RawParticipant;
-    }>;
-    FindParticipantsWithDID(req: object): Promise<{
-        participants: RawParticipant[];
-    }>;
-    GetParticipantSession(req: {
-        id: string;
-    }): Promise<{
-        session?: unknown;
-    }>;
-}
-export interface EcosystemQueryClient {
-    GetEcosystem(req: {
-        id: number;
-    }): Promise<{
-        ecosystem?: Ecosystem;
-    }>;
-}
-export interface CredentialSchemaQueryClient {
-    GetCredentialSchema(req: {
-        id: number;
-    }): Promise<{
-        schema?: CredentialSchema;
-    }>;
-}
-export interface DigestQueryClient {
-    GetDigest(req: {
-        digest: string;
-    }): Promise<{
-        digest?: StoredDigest;
-    }>;
-}
-export interface DelegationQueryClient {
-    ListOperatorAuthorizations(req: {
-        corporationId: number;
-        operator: string;
-        responseMaxSize: number;
-    }): Promise<{
-        operatorAuthorizations: OperatorAuthorization[];
-    }>;
-    ListVSOperatorAuthorizations(req: {
-        corporationId: number;
-        vsOperator: string;
-        responseMaxSize: number;
-    }): Promise<{
-        vsOperatorAuthorizations: VsOperatorAuthorization[];
-    }>;
-}
 export interface VeranaChainConfig {
     rpcUrl: string;
     chainId?: string;
     mnemonic: string;
     logger: BaseLogger;
     gasPrice?: string;
+    gasAdjustment?: number;
     corporationAddress?: string;
     autoTriggerResolver?: boolean;
 }

package/build/blockchain/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/blockchain/types.ts"],"names":[],"mappings":";;;AAEA,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,mEAAe,CAAA;IACf,2DAAW,CAAA;IACX,+DAAa,CAAA;IACb,iEAAc,CAAA;AAChB,CAAC,EALW,eAAe,+BAAf,eAAe,QAK1B;AAeY,QAAA,oBAAoB,GAAG,QAAQ,CAAA;AAC/B,QAAA,SAAS,GAAG,8BAA8B,CAAA;AA0IvD,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,oCAAiB,CAAA;IACjB,wCAAqB,CAAA;IACrB,mDAAgC,CAAA;IAChC,uDAAoC,CAAA;IACpC,0CAAuB,CAAA;IACvB,oCAAiB,CAAA;AACnB,CAAC,EAPW,eAAe,+BAAf,eAAe,QAO1B;AAED,IAAY,gBAQX;AARD,WAAY,gBAAgB;IAC1B,qCAAiB,CAAA;IACjB,qCAAiB,CAAA;IACjB,yCAAqB,CAAA;IACrB,uCAAmB,CAAA;IACnB,uCAAmB,CAAA;IACnB,uCAAmB,CAAA;IACnB,qCAAiB,CAAA;AACnB,CAAC,EARW,gBAAgB,gCAAhB,gBAAgB,QAQ3B"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/blockchain/types.ts"],"names":[],"mappings":";;;AAEA,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,mEAAe,CAAA;IACf,2DAAW,CAAA;IACX,+DAAa,CAAA;IACb,iEAAc,CAAA;AAChB,CAAC,EALW,eAAe,+BAAf,eAAe,QAK1B;AAeY,QAAA,oBAAoB,GAAG,QAAQ,CAAA;AAC/B,QAAA,SAAS,GAAG,8BAA8B,CAAA;AAgJvD,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,oCAAiB,CAAA;IACjB,wCAAqB,CAAA;IACrB,mDAAgC,CAAA;IAChC,uDAAoC,CAAA;IACpC,0CAAuB,CAAA;IACvB,oCAAiB,CAAA;AACnB,CAAC,EAPW,eAAe,+BAAf,eAAe,QAO1B;AAED,IAAY,gBAQX;AARD,WAAY,gBAAgB;IAC1B,qCAAiB,CAAA;IACjB,qCAAiB,CAAA;IACjB,yCAAqB,CAAA;IACrB,uCAAmB,CAAA;IACnB,uCAAmB,CAAA;IACnB,uCAAmB,CAAA;IACnB,qCAAiB,CAAA;AACnB,CAAC,EARW,gBAAgB,gCAAhB,gBAAgB,QAQ3B"}

package/build/bootstrap/EcsBootstrapService.d.ts

@@ -16,10 +16,19 @@ export declare class EcsBootstrapService {
     run(): Promise<void>;
     private runStandalone;
     private preflight;
+    private operatorSkipReason;
     private acceptPendingOffers;
+    /**
+     * StartParticipantOP pays a trust deposit, and it cannot be undone. The onboarding request that
+     * must follow it travels over DIDComm from the chain event handler, which catches its own
+     * failure. The indexer marks that block processed all the same and never replays it, so an
+     * unreachable validator leaves the entry at PENDING for ever. This boot step closes that gap.
+     */
+    private resumePendingOnboardings;
+    private resumeOnboarding;
+    private isSelfValidated;
     private discoverEcsSchemas;
     private discoverFromEcosystem;
-    private classifySchema;
     private ensureHolderParticipant;
     private findOwnActiveRoot;
     private ensureSelfIssuedParticipant;
@@ -28,7 +37,7 @@ export declare class EcsBootstrapService {
     private triggerResolverBestEffort;
     private isUsableParticipant;
     private runDelegated;
-    private requestDelegatedServiceCredential;
-    private findParentServiceSchemaId;
-    private awaitDelegatedOutcome;
+    private findParentServiceIssuer;
+    private assertTrustedEcosystem;
+    private onboardingClaims;
 }

package/build/bootstrap/EcsBootstrapService.js

@@ -1,28 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EcsBootstrapService = void 0;
+const didcomm_1 = require("@credo-ts/didcomm");
 const credo_ts_didcomm_vt_flow_1 = require("@verana-labs/credo-ts-didcomm-vt-flow");
 const vs_agent_model_1 = require("@verana-labs/vs-agent-model");
 const blockchain_1 = require("../blockchain");
 const types_1 = require("../types");
 const didReadiness_1 = require("../utils/didReadiness");
+const VtFlowOrchestrator_1 = require("../vtFlow/VtFlowOrchestrator");
+const ecsClaims_1 = require("../utils/ecsClaims");
 const START_OP_MSG = '/verana.pp.v1.MsgStartParticipantOP';
 const SELF_CREATE_MSG = '/verana.pp.v1.MsgSelfCreateParticipant';
 const ISSUER_ONBOARDING_MODE_OPEN = 1;
 const ISSUER_ONBOARDING_MODE_GRANTOR = 3;
-const ECS_TITLE_BY_TYPE = {
-    ServiceCredential: vs_agent_model_1.ECS.SERVICE,
-    OrganizationCredential: vs_agent_model_1.ECS.ORG,
-    PersonaCredential: vs_agent_model_1.ECS.PERSONA,
-    UserAgentCredential: vs_agent_model_1.ECS.USER_AGENT,
-    BadgeCredential: vs_agent_model_1.ECS.BADGE,
-};
-const DELEGATED_OUTCOME_TIMEOUT_MS = 15 * 60000;
-// Thin safety net for any remaining transient failure (e.g. a network blip from
-// the parent's vantage point), on top of the readiness wait in waitUntilOwnDidIsPubliclyResolvable.
-const DELEGATED_REQUEST_MAX_ATTEMPTS = 2;
-const DELEGATED_REQUEST_ATTEMPT_TIMEOUT_MS = 60000;
-const DELEGATED_REQUEST_RETRY_DELAY_MS = 5000;
 class EcsBootstrapService {
     constructor(agent, indexer, options, logger) {
         this.agent = agent;
@@ -31,6 +21,10 @@ class EcsBootstrapService {
         this.logger = logger;
     }
     async run() {
+        // Both repair steps sign nothing on chain, so they run before any gate, in either mode, and
+        // also for a deployment whose participants the Corporation operator provisions out of band.
+        await this.acceptPendingOffers();
+        await this.resumePendingOnboardings();
         if (this.options.mode === 'delegated')
             return this.runDelegated();
         return this.runStandalone();
@@ -38,12 +32,11 @@ class EcsBootstrapService {
     async runStandalone() {
         const skip = await this.preflight();
         if (skip) {
-            this.logger.info(`[EcsBootstrap] standalone bootstrap skipped: ${skip}`);
+            this.logger.info(`[EcsBootstrap] standalone bootstrap skipped: ${skip}; this agent expects its participants to be provisioned out of band`);
             return;
         }
         const chain = this.agent.veranaChain;
         const indexer = this.indexer;
-        await this.acceptPendingOffers();
         const { credential, credentialType, service } = await this.discoverEcsSchemas(indexer);
         await this.ensureHolderParticipant(chain, indexer, credential, credentialType);
         await this.ensureServiceIssuer(chain, indexer, service);
@@ -59,9 +52,15 @@ class EcsBootstrapService {
             return 'the Verana indexer is not configured';
         if (!((_a = this.options.trustedEcosystemDids) === null || _a === void 0 ? void 0 : _a.length))
             return 'TRUSTED_ECS_ECOSYSTEM_DIDS is not set';
-        const operatorAuths = await chain.listOperatorAuthorizations();
-        if (!operatorAuths.some(a => a.msgTypes.includes(START_OP_MSG))) {
-            return `operator ${chain.address} has no OperatorAuthorization covering MsgStartParticipantOP`;
+        return this.operatorSkipReason(chain);
+    }
+    // StartParticipantOP costs a trust deposit and a fee, so both the authorization and the funds
+    // must be there. Neither is a misconfiguration: the operator may provision the entry itself.
+    async operatorSkipReason(chain) {
+        var _a, _b;
+        const operatorAuths = (_b = (await ((_a = this.indexer) === null || _a === void 0 ? void 0 : _a.listOperatorAuthorizations(chain.address)))) !== null && _b !== void 0 ? _b : [];
+        if (!operatorAuths.some(auth => auth.msgTypes.includes(START_OP_MSG))) {
+            return `operator ${chain.address} holds no OperatorAuthorization covering MsgStartParticipantOP`;
         }
         const balance = await chain.getBalance();
         if (Number(balance.amount) === 0) {
@@ -78,12 +77,33 @@ class EcsBootstrapService {
             role: credo_ts_didcomm_vt_flow_1.VtFlowRole.Applicant,
         });
         for (const record of pending) {
+            const connection = await this.agent.didcomm.connections.findById(record.connectionId);
+            if (!(connection === null || connection === void 0 ? void 0 : connection.isReady) && record.applicantParticipantId) {
+                try {
+                    await new VtFlowOrchestrator_1.VtFlowOrchestrator(this.agent).startOnboardingProcess({
+                        applicantParticipantId: Number(record.applicantParticipantId),
+                    });
+                    this.logger.info(`[EcsBootstrap] reconnected flow ${record.id} so the validator can offer again`);
+                }
+                catch (error) {
+                    this.logger.warn(`[EcsBootstrap] could not reconnect flow ${record.id}: ${error.message}`);
+                }
+                continue;
+            }
             if (!record.credentialExchangeRecordId)
                 continue;
             try {
-                await this.agent.didcomm.credentials.acceptOffer({
-                    credentialExchangeRecordId: record.credentialExchangeRecordId,
-                });
+                const exchange = await this.agent.didcomm.credentials.getById(record.credentialExchangeRecordId);
+                if (exchange.state === didcomm_1.DidCommCredentialState.CredentialReceived) {
+                    const { verifyCredential } = this.agent.dependencyManager.resolve(credo_ts_didcomm_vt_flow_1.VtFlowModuleConfig);
+                    const agentContext = this.agent.context;
+                    if (await (verifyCredential === null || verifyCredential === void 0 ? void 0 : verifyCredential({ agentContext, record, credentialExchangeRecord: exchange }))) {
+                        await this.agent.didcomm.credentials.acceptCredential({ credentialExchangeRecordId: exchange.id });
+                        this.logger.info(`[EcsBootstrap] accepted the verified credential of flow ${record.id}`);
+                    }
+                    continue;
+                }
+                await api.acceptCredentialOffer(record.id);
                 this.logger.info(`[EcsBootstrap] re-accepted the pending credential offer for flow ${record.id}`);
             }
             catch (error) {
@@ -91,6 +111,64 @@ class EcsBootstrapService {
             }
         }
     }
+    /**
+     * StartParticipantOP pays a trust deposit, and it cannot be undone. The onboarding request that
+     * must follow it travels over DIDComm from the chain event handler, which catches its own
+     * failure. The indexer marks that block processed all the same and never replays it, so an
+     * unreachable validator leaves the entry at PENDING for ever. This boot step closes that gap.
+     */
+    async resumePendingOnboardings() {
+        if (!this.indexer || !this.agent.did)
+            return;
+        const own = await this.indexer.listParticipants({ did: this.agent.did }).catch(() => []);
+        for (const participant of own) {
+            if (participant.op_state !== 'PENDING' || participant.revoked || participant.slashed)
+                continue;
+            try {
+                await this.resumeOnboarding(participant);
+            }
+            catch (error) {
+                this.logger.warn(`[EcsBootstrap] could not resume the onboarding of participant ${participant.id}: ${error.message}`);
+            }
+        }
+    }
+    async resumeOnboarding(participant) {
+        // A flow that a peer ended on purpose is not an interruption; only an error deserves a retry.
+        const api = this.agent.dependencyManager.resolve(credo_ts_didcomm_vt_flow_1.VtFlowApi);
+        const [latest] = (await api.findAllByQuery({
+            applicantParticipantId: String(participant.id),
+            role: credo_ts_didcomm_vt_flow_1.VtFlowRole.Applicant,
+            flowVariant: credo_ts_didcomm_vt_flow_1.VtFlowVariant.OnboardingProcess,
+        })).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+        if (latest && (0, credo_ts_didcomm_vt_flow_1.isVtFlowTerminalState)(latest.state) && latest.state !== credo_ts_didcomm_vt_flow_1.VtFlowState.Error)
+            return;
+        // The agent validates its own entry when it controls the ECOSYSTEM root of the schema, so
+        // there is no peer to send a request to: the interrupted step is the chain outcome itself.
+        if (await this.isSelfValidated(participant)) {
+            const chain = this.agent.veranaChain;
+            if (!chain)
+                return;
+            await chain.setParticipantOPToValidated({
+                id: participant.id,
+                validationFees: 0,
+                issuanceFees: 0,
+                verificationFees: 0,
+            });
+            await this.triggerResolverBestEffort(chain, participant.id);
+            this.logger.info(`[EcsBootstrap] validated the interrupted self-issued participant ${participant.id}`);
+            return;
+        }
+        await (0, didReadiness_1.waitUntilOwnDidIsPubliclyResolvable)(this.agent, this.logger);
+        const claims = await this.onboardingClaims(participant.schema_id);
+        const record = await new VtFlowOrchestrator_1.VtFlowOrchestrator(this.agent).startOnboardingProcess(Object.assign({ applicantParticipantId: participant.id }, (claims ? { claims } : {})));
+        this.logger.info(`[EcsBootstrap] checked the onboarding of participant ${participant.id} (flow ${record.id}, state ${record.state})`);
+    }
+    async isSelfValidated(participant) {
+        if (participant.validator_participant_id == null)
+            return false;
+        const validator = await this.indexer.getParticipant(participant.validator_participant_id).catch(() => undefined);
+        return (validator === null || validator === void 0 ? void 0 : validator.did) === this.agent.did;
+    }
     // WL-ECS: only ecosystems on the configured allowlist may provide the essential credential schemas.
     async discoverEcsSchemas(indexer) {
         const ecosystems = await indexer.listEcosystems();
@@ -114,7 +192,7 @@ class EcsBootstrapService {
         const schemas = await indexer.listCredentialSchemas(ecosystemId);
         const classified = await Promise.all(schemas
             .filter(schema => !schema.archived)
-            .map(async (schema) => ({ schema, type: await this.classifySchema(schema) })));
+            .map(async (schema) => ({ schema, type: await (0, vs_agent_model_1.classifyEcsSchema)(schema.json_schema) })));
         const byType = (type) => { var _a; return (_a = classified.find(c => c.type === type)) === null || _a === void 0 ? void 0 : _a.schema; };
         const service = byType(vs_agent_model_1.ECS.SERVICE);
         if (!service)
@@ -126,20 +204,6 @@ class EcsBootstrapService {
             throw new Error('no ECS Organization or Persona credential schema');
         return { credential, credentialType: org ? vs_agent_model_1.ECS.ORG : vs_agent_model_1.ECS.PERSONA, service };
     }
-    async classifySchema(schema) {
-        var _a;
-        try {
-            const parsed = JSON.parse(schema.json_schema);
-            const byDigest = await (0, vs_agent_model_1.identifySchema)(parsed);
-            if (byDigest)
-                return byDigest;
-            const title = typeof parsed.title === 'string' ? parsed.title : '';
-            return (_a = ECS_TITLE_BY_TYPE[title]) !== null && _a !== void 0 ? _a : null;
-        }
-        catch (_b) {
-            return null;
-        }
-    }
     async ensureHolderParticipant(chain, indexer, schema, credentialType) {
         // If this agent controls the schema's ECOSYSTEM root, it has no external ISSUER to seek a
         // HOLDER credential from — it must become the ISSUER itself (see ensureSelfIssuedParticipant).
@@ -222,11 +286,14 @@ class EcsBootstrapService {
             this.logger.info(`[EcsBootstrap] reusing Service ISSUER participant ${usable.id}`);
             return;
         }
-        const onChainSchema = await chain.getCredentialSchema(schema.id);
+        const onChainSchema = await indexer
+            .getCredentialSchema(schema.id)
+            .then(blockchain_1.toCredentialSchema)
+            .catch(() => undefined);
         if (!onChainSchema)
             throw new Error(`Service schema ${schema.id} not found on chain`);
         if (onChainSchema.issuerOnboardingMode === ISSUER_ONBOARDING_MODE_OPEN) {
-            const operatorAuths = await chain.listOperatorAuthorizations();
+            const operatorAuths = await indexer.listOperatorAuthorizations(chain.address);
             if (!operatorAuths.some(a => a.msgTypes.includes(SELF_CREATE_MSG))) {
                 throw new Error(`operator ${chain.address} has no OperatorAuthorization covering MsgSelfCreateParticipant (required for OPEN issuer onboarding)`);
             }
@@ -288,101 +355,91 @@ class EcsBootstrapService {
             throw new Error('delegated bootstrap requires a public DID');
         if (!this.indexer)
             throw new Error('delegated bootstrap requires the Verana indexer');
+        const chain = this.agent.veranaChain;
+        if (!chain)
+            throw new Error('delegated bootstrap requires the Verana chain');
         if (!this.options.verifyPeer) {
             throw new Error(`cannot verify parent VS ${parentDid}: verifiable public registries are not configured (set VERANA_CHAIN_ID)`);
         }
-        await (0, didReadiness_1.waitUntilOwnDidIsPubliclyResolvable)(this.agent, this.logger);
         const verified = await this.options.verifyPeer(parentDid).catch(() => false);
         if (!verified) {
             throw new Error(`parent VS ${parentDid} is not a Verifiable Service`);
         }
-        const schemaId = await this.findParentServiceSchemaId(parentDid);
-        let lastError;
-        for (let attempt = 1; attempt <= DELEGATED_REQUEST_MAX_ATTEMPTS; attempt++) {
-            try {
-                await this.requestDelegatedServiceCredential(parentDid, schemaId, attempt);
-                return;
-            }
-            catch (error) {
-                lastError = error;
-                this.logger.warn(`[EcsBootstrap] delegated issuance attempt ${attempt}/${DELEGATED_REQUEST_MAX_ATTEMPTS} failed: ${lastError.message}`);
-                if (attempt < DELEGATED_REQUEST_MAX_ATTEMPTS) {
-                    await new Promise(resolve => setTimeout(resolve, DELEGATED_REQUEST_RETRY_DELAY_MS));
-                }
+        const validator = await this.findParentServiceIssuer(parentDid);
+        await this.assertTrustedEcosystem(validator.schema_id);
+        // An existing entry means the process already ran, or the operator provisioned it.
+        const own = await this.indexer.listParticipants({
+            did: this.agent.did,
+            role: blockchain_1.ParticipantRole.Holder,
+            schemaId: validator.schema_id,
+        });
+        const existing = own.find(participant => this.isUsableParticipant(participant));
+        if (existing) {
+            // The parent named by AGENT_DELEGATED_PARENT_VS_DID must be the validator of the entry;
+            // any other validator would issue the Service credential of another accountable party.
+            if (Number(existing.validator_participant_id) !== validator.id) {
+                throw new Error(`HOLDER participant ${existing.id} for the ECS Service schema ${validator.schema_id} names validator ${existing.validator_participant_id}, not the parent VS ${parentDid} (validator ${validator.id})`);
             }
+            this.logger.info(`[EcsBootstrap] HOLDER participant ${existing.id} for the ECS Service schema ${validator.schema_id} already exists; the onboarding process continues on its own`);
+            return;
         }
-        throw lastError !== null && lastError !== void 0 ? lastError : new Error(`parent VS ${parentDid} did not complete the issuance in time`);
-    }
-    async requestDelegatedServiceCredential(parentDid, schemaId, attempt) {
-        let connectionId;
-        try {
-            const { connectionRecord } = await this.agent.didcomm.oob.receiveImplicitInvitation({
-                did: parentDid,
-                ourDid: this.agent.did,
-                label: this.agent.label,
-                didCommVersion: 'v2',
-            });
-            if (!connectionRecord)
-                throw new Error('no connection record returned');
-            const ready = await this.agent.didcomm.connections.returnWhenIsConnected(connectionRecord.id);
-            connectionId = ready.id;
-        }
-        catch (error) {
-            throw new Error(`parent VS ${parentDid} is unreachable: ${error.message}`);
+        // [VSA-VTI-FLOW-OP-NEW] step 1: the applicant submits StartParticipantOP. The agent then
+        // reacts to its own chain event and sends the onboarding request, so nothing is awaited here.
+        // Direct Issuance does not apply: it needs holder_onboarding_mode = PERMISSIONLESS, and the
+        // ECS Service schema uses ISSUER_ONBOARDING_PROCESS.
+        const skip = await this.operatorSkipReason(chain);
+        if (skip) {
+            this.logger.info(`[EcsBootstrap] delegated bootstrap skipped: ${skip}; this agent expects its HOLDER participant to be provisioned out of band, with validator ${validator.id}`);
+            return;
         }
-        const api = this.agent.dependencyManager.resolve(credo_ts_didcomm_vt_flow_1.VtFlowApi);
-        const record = await api.sendIssuanceRequest({
-            connectionId,
-            schemaId: String(schemaId),
-            agentParticipantId: '0',
-            walletAgentParticipantId: '0',
+        const { participantId } = await chain.startParticipantOP({
+            role: types_1.HOLDER_PARTICIPANT_TYPE,
+            validatorParticipantId: validator.id,
+            did: this.agent.did,
         });
-        this.logger.info(`[EcsBootstrap] requested the Service credential (schema ${schemaId}) from parent VS ${parentDid} (attempt ${attempt}/${DELEGATED_REQUEST_MAX_ATTEMPTS})`);
-        const isLastAttempt = attempt === DELEGATED_REQUEST_MAX_ATTEMPTS;
-        const timeoutMs = isLastAttempt ? DELEGATED_OUTCOME_TIMEOUT_MS : DELEGATED_REQUEST_ATTEMPT_TIMEOUT_MS;
-        await this.awaitDelegatedOutcome(record.id, parentDid, timeoutMs);
+        this.logger.info(`[EcsBootstrap] started HOLDER onboarding ${participantId} for the ECS Service schema ${validator.schema_id} with parent VS ${parentDid} (validator ${validator.id})`);
     }
-    async findParentServiceSchemaId(parentDid) {
+    async findParentServiceIssuer(parentDid) {
         const participants = await this.indexer.listParticipants({
             did: parentDid,
             role: blockchain_1.ParticipantRole.Issuer,
             participantState: blockchain_1.ParticipantState.Active,
         });
         for (const participant of participants) {
+            if (participant.revoked || participant.slashed)
+                continue;
             const schema = await this.indexer.getCredentialSchema(participant.schema_id).catch(() => undefined);
             if (!schema)
                 continue;
-            if ((await this.classifySchema(schema)) === vs_agent_model_1.ECS.SERVICE)
-                return schema.id;
+            if ((await (0, vs_agent_model_1.classifyEcsSchema)(schema.json_schema)) === vs_agent_model_1.ECS.SERVICE)
+                return participant;
         }
         throw new Error(`parent VS ${parentDid} holds no active ISSUER participant for an ECS Service schema`);
     }
-    awaitDelegatedOutcome(recordId, parentDid, timeoutMs) {
-        return new Promise((resolve, reject) => {
-            const listener = ({ payload }) => {
-                if (payload.vtFlowRecordId !== recordId)
-                    return;
-                if (payload.state === credo_ts_didcomm_vt_flow_1.VtFlowState.Completed) {
-                    cleanup();
-                    resolve();
-                }
-                else if (payload.state === credo_ts_didcomm_vt_flow_1.VtFlowState.TerminatedByValidator ||
-                    payload.state === credo_ts_didcomm_vt_flow_1.VtFlowState.Error) {
-                    cleanup();
-                    reject(new Error(`parent VS ${parentDid} rejected the Service credential request`));
-                }
-            };
-            const cleanup = () => {
-                clearTimeout(timer);
-                this.agent.events.off(credo_ts_didcomm_vt_flow_1.VtFlowEventTypes.VtFlowStateChanged, listener);
-            };
-            const timer = setTimeout(() => {
-                cleanup();
-                reject(new Error(`parent VS ${parentDid} did not complete the issuance in time`));
-            }, timeoutMs);
-            timer.unref();
-            this.agent.events.on(credo_ts_didcomm_vt_flow_1.VtFlowEventTypes.VtFlowStateChanged, listener);
-        });
+    // WL-ECS: an allowlist is optional in delegated mode, but it binds the flow once the operator sets it.
+    async assertTrustedEcosystem(schemaId) {
+        var _a;
+        const trusted = this.options.trustedEcosystemDids;
+        if (!(trusted === null || trusted === void 0 ? void 0 : trusted.length))
+            return;
+        const schema = await this.indexer.getCredentialSchema(schemaId).catch(() => undefined);
+        const ecosystem = schema
+            ? await this.indexer.getEcosystem(schema.ecosystem_id).catch(() => undefined)
+            : undefined;
+        if (!ecosystem || ecosystem.archived || !trusted.includes(ecosystem.did)) {
+            throw new Error(`the ECS Service schema ${schemaId} belongs to ecosystem ${(_a = ecosystem === null || ecosystem === void 0 ? void 0 : ecosystem.did) !== null && _a !== void 0 ? _a : '<unresolvable>'}, which TRUSTED_ECS_ECOSYSTEM_DIDS does not list`);
+        }
+    }
+    async onboardingClaims(schemaId) {
+        if (!this.agent.ecsClaims || !this.agent.did)
+            return undefined;
+        const schema = await this.agent.indexer.getCredentialSchema(schemaId);
+        const ecsKey = schema && (await (0, vs_agent_model_1.classifyEcsSchema)(schema.json_schema));
+        if (!ecsKey) {
+            this.agent.config.logger.info(`[ecs-claims] schema ${schemaId} is not an ECS schema, sending no claims`);
+            return undefined;
+        }
+        return await (0, ecsClaims_1.composeEcsClaims)(this.agent.ecsClaims, ecsKey, this.agent.config.logger);
     }
 }
 exports.EcsBootstrapService = EcsBootstrapService;