

const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.js');
const require_TypedArrayEncoder = require('../../utils/TypedArrayEncoder.js');
const require_Hasher = require('../../crypto/hashes/Hasher.js');
require('../../utils/index.js');
const require_PublicJwk = require('../kms/jwk/PublicJwk.js');
const require_KeyManagementApi = require('../kms/KeyManagementApi.js');
require('../kms/index.js');
const require_CredoWebCrypto = require('../../crypto/webcrypto/CredoWebCrypto.js');
const require_X509Certificate = require('../x509/X509Certificate.js');
const require_X509Service = require('../x509/X509Service.js');
require('../x509/index.js');
require('../../crypto/index.js');
let __noble_hashes_sha2_js = require("@noble/hashes/sha2.js");
__noble_hashes_sha2_js = require_rolldown_runtime.__toESM(__noble_hashes_sha2_js);
let __noble_curves_nist_js = require("@noble/curves/nist.js");
__noble_curves_nist_js = require_rolldown_runtime.__toESM(__noble_curves_nist_js);
let __noble_hashes_hkdf_js = require("@noble/hashes/hkdf.js");
__noble_hashes_hkdf_js = require_rolldown_runtime.__toESM(__noble_hashes_hkdf_js);

//#region src/modules/mdoc/MdocContext.ts
const getMdocContext = (agentContext) => {
	const crypto = new require_CredoWebCrypto.CredoWebCrypto(agentContext);
	const kms = agentContext.resolve(require_KeyManagementApi.KeyManagementApi);
	return {
		crypto: {
			digest: async (input) => {
				const { bytes, digestAlgorithm } = input;
				return new Uint8Array(crypto.digest(digestAlgorithm, new Uint8Array(bytes).buffer));
			},
			random: (length) => {
				return crypto.getRandomValues(new Uint8Array(length));
			},
			calculateEphemeralMacKeyJwk: async (input) => {
				const { privateKey, publicKey, sessionTranscriptBytes } = input;
				const hk1 = (0, __noble_hashes_hkdf_js.hkdf)(__noble_hashes_sha2_js.sha256, __noble_curves_nist_js.p256.getSharedSecret(privateKey, publicKey, true).slice(1), require_Hasher.Hasher.hash(sessionTranscriptBytes, "sha-256"), require_TypedArrayEncoder.TypedArrayEncoder.fromString("EMacKey"), 32);
				return {
					key_ops: ["sign", "verify"],
					ext: true,
					kty: "oct",
					k: require_TypedArrayEncoder.TypedArrayEncoder.toBase64URL(hk1),
					alg: "HS256"
				};
			}
		},
		cose: {
			mac0: {
				sign: async (input) => {
					const { jwk, mac0 } = input;
					const { data } = mac0.getRawSigningData();
					const publicJwk = require_PublicJwk.PublicJwk.fromUnknown(jwk);
					const algorithm = mac0.algName ?? publicJwk.signatureAlgorithm;
					const { signature } = await kms.sign({
						data,
						algorithm,
						keyId: publicJwk.keyId
					});
					return signature;
				},
				verify: async (input) => {
					const { mac0, jwk, options } = input;
					const { data, signature } = mac0.getRawVerificationData(options);
					const publicJwk = require_PublicJwk.PublicJwk.fromUnknown(jwk);
					const algorithm = mac0.algName ?? publicJwk.signatureAlgorithm;
					const { verified } = await kms.verify({
						key: { publicJwk: jwk },
						data,
						algorithm,
						signature
					});
					return verified;
				}
			},
			sign1: {
				sign: async (input) => {
					const { jwk, sign1 } = input;
					const { data } = sign1.getRawSigningData();
					const publicJwk = require_PublicJwk.PublicJwk.fromUnknown(jwk);
					const algorithm = sign1.algName ?? publicJwk.signatureAlgorithm;
					const { signature } = await kms.sign({
						data,
						algorithm,
						keyId: publicJwk.keyId
					});
					return signature;
				},
				verify: async (input) => {
					const { sign1, jwk, options } = input;
					const { data, signature } = sign1.getRawVerificationData(options);
					const publicJwk = require_PublicJwk.PublicJwk.fromUnknown(jwk);
					const algorithm = sign1.algName ?? publicJwk.signatureAlgorithm;
					const { verified } = await kms.verify({
						key: { publicJwk: jwk },
						data,
						algorithm,
						signature
					});
					return verified;
				}
			}
		},
		x509: {
			getIssuerNameField: (input) => {
				const { certificate, field } = input;
				return require_X509Certificate.X509Certificate.fromRawCertificate(certificate).getIssuerNameField(field);
			},
			getPublicKey: async (input) => {
				return require_X509Certificate.X509Certificate.fromRawCertificate(input.certificate).publicJwk.toJson();
			},
			validateCertificateChain: async (input) => {
				const certificateChain = input.x5chain.map((cert) => require_X509Certificate.X509Certificate.fromRawCertificate(cert).toString("pem"));
				const trustedCertificates = input.trustedCertificates.map((cert) => require_X509Certificate.X509Certificate.fromRawCertificate(cert).toString("pem"));
				await require_X509Service.X509Service.validateCertificateChain(agentContext, {
					certificateChain,
					trustedCertificates
				});
			},
			getCertificateData: async (input) => {
				const { certificate } = input;
				const x509Certificate = require_X509Certificate.X509Certificate.fromRawCertificate(certificate);
				return {
					...x509Certificate.data,
					thumbprint: await x509Certificate.getThumprintInHex(agentContext)
				};
			}
		}
	};
};

//#endregion
exports.getMdocContext = getMdocContext;