import { HashName } from "../../crypto/hashes/Hasher.js";
import { EncodedX509Certificate } from "../x509/X509ServiceOptions.js";
import { X509Certificate } from "../x509/X509Certificate.js";
import { PublicJwk } from "../kms/jwk/PublicJwk.js";

//#region src/modules/sd-jwt-vc/SdJwtVcOptions.d.ts
type SdJwtVcPayload = Record<string, unknown>;
type SdJwtVcHeader = Record<string, unknown>;
interface IDisclosureFrame {
  _sd?: string[];
  _sd_decoy?: number;
  [x: string]: string[] | number | IDisclosureFrame | undefined;
}
interface IPresentationFrame {
  [x: string]: boolean | IPresentationFrame;
}
interface SdJwtVcHolderDidBinding {
  method: 'did';
  didUrl: string;
}
interface SdJwtVcHolderJwkBinding {
  method: 'jwk';
  jwk: PublicJwk;
}
interface SdJwtVcIssuerDid {
  method: 'did';
  didUrl: string;
}
interface SdJwtVcIssuerX5c {
  method: 'x5c';
  /**
   *
   * Array of base64-encoded certificate strings in the DER-format.
   *
   * The certificate containing the public key corresponding to the key used to digitally sign the JWS MUST be the first certificate.
   */
  x5c: X509Certificate[];
  /**
   * The issuer of the JWT. Should be a HTTPS URI.
   *
   * The issuer value must either match a `uniformResourceIdentifier` SAN entry of the leaf entity certificate
   * or the domain name in the `iss` value matches a `dNSName` SAN entry of the leaf-entity certificate.
   */
  issuer: string;
}
type SdJwtVcHolderBinding = SdJwtVcHolderDidBinding | SdJwtVcHolderJwkBinding;
type SdJwtVcIssuer = SdJwtVcIssuerDid | SdJwtVcIssuerX5c;
interface SdJwtVcSignOptions<Payload extends SdJwtVcPayload = SdJwtVcPayload> {
  payload: Payload;
  /**
   * If holder is not provided, we don't bind the SD-JWT VC to a key (so bearer VC)
   */
  holder?: SdJwtVcHolderBinding;
  issuer: SdJwtVcIssuer;
  disclosureFrame?: IDisclosureFrame;
  /**
   * Default of sha-256 will be used if not provided
   */
  hashingAlgorithm?: HashName;
  /**
   * The header 'typ' to use for the SD-JWT VC. vc+sd-jwt is supported
   * for backwards compatibility but implementations should update to
   * dc+sd-jwt
   *
   * @default 'dc+sd-jwt'
   */
  headerType?: 'dc+sd-jwt' | 'vc+sd-jwt';
}
type SdJwtVcPresentOptions<_Payload extends SdJwtVcPayload = SdJwtVcPayload> = {
  compactSdJwtVc: string;
  /**
   * Use true to disclose everything
   */
  presentationFrame?: IPresentationFrame;
  /**
   * This information is received out-of-band from the verifier.
   * The claims will be used to create a normal JWT, used for key binding.
   *
   * If not defined, a KB-JWT will not be created
   */
  verifierMetadata?: {
    audience: string;
    nonce: string;
    issuedAt: number;
  };
  /**
   * Additional payload to include in the KB JWT
   */
  additionalPayload?: Record<string, unknown>;
};
type SdJwtVcVerifyOptions = {
  compactSdJwtVc: string;
  /**
   * If the key binding object is present, the sd-jwt is required to have a key binding jwt attached
   * and will be validated against the provided key binding options.
   */
  keyBinding?: {
    /**
     * The expected `aud` value in the payload of the KB-JWT. The value of this is dependant on the
     * exchange protocol used.
     */
    audience: string;
    /**
     * The expected `nonce` value in the payload of the KB-JWT. The value of this is dependant on the
     * exchange protocol used.
     */
    nonce: string;
  };
  requiredClaimKeys?: Array<string>;
  /**
   * Whether to fetch the `vct` type metadata if the `vct` is an https URL.
   *
   * It will will not influence the verification result if fetching of type metadata fails
   */
  fetchTypeMetadata?: boolean;
  trustedCertificates?: EncodedX509Certificate[];
  /**
   * Date that should be used as the current time. If not provided, current time will be used.
   */
  now?: Date;
};
//#endregion
export { IDisclosureFrame, IPresentationFrame, SdJwtVcHeader, SdJwtVcHolderBinding, SdJwtVcHolderDidBinding, SdJwtVcHolderJwkBinding, SdJwtVcIssuer, SdJwtVcIssuerDid, SdJwtVcIssuerX5c, SdJwtVcPayload, SdJwtVcPresentOptions, SdJwtVcSignOptions, SdJwtVcVerifyOptions };
//# sourceMappingURL=SdJwtVcOptions.d.ts.map