"use strict";

Object.defineProperty(exports, "__esModule", {
  value: true
});
exports.reissueCredentialWithAccessToken = reissueCredentialWithAccessToken;
var _core = require("@credo-ts/core");
var _offerResolve = require("../offerResolve");
var _metadata = require("../metadata");
var _types = require("./types");
async function reissueCredentialWithAccessToken({
  agent,
  logger,
  record,
  tokenResponse,
  clientId,
  pidSchemes
}) {
  if (!record) {
    throw new Error('No credential record provided for re-issuance.');
  }
  const refreshMetaData = (0, _metadata.getRefreshCredentialMetadata)(record);
  if (!refreshMetaData) {
    throw new Error('No refresh metadata found on the record for re-issuance.');
  }
  const {
    credentialConfigurationId,
    resolvedCredentialOffer
  } = refreshMetaData;
  if (!resolvedCredentialOffer) {
    throw new Error('No resolved credential offer found in the refresh metadata for re-issuance.');
  }
  if (!tokenResponse.access_token) {
    throw new Error('No access token found in the token response for re-issuance.');
  }
  logger.info('*** Starting to get new credential via re-issuance flow ***');
  // Request a **new** credential using the *existing* configuration id
  const creds = await agent.modules.openId4VcHolder.requestCredentials({
    resolvedCredentialOffer,
    accessToken: tokenResponse.access_token,
    tokenType: tokenResponse.token_type || 'Bearer',
    cNonce: tokenResponse.c_nonce,
    clientId,
    credentialsToRequest: [credentialConfigurationId],
    verifyCredentialStatus: false,
    // you’ll check after storing
    allowedProofOfPossessionSignatureAlgorithms: [_core.JwaSignatureAlgorithm.EdDSA, _core.JwaSignatureAlgorithm.ES256],
    credentialBindingResolver: async opts => (0, _offerResolve.customCredentialBindingResolver)({
      agent,
      supportedDidMethods: opts.supportedDidMethods,
      keyType: opts.keyType,
      supportsAllDidMethods: opts.supportsAllDidMethods,
      supportsJwk: opts.supportsJwk,
      credentialFormat: opts.credentialFormat,
      supportedCredentialId: opts.supportedCredentialId,
      resolvedCredentialOffer: resolvedCredentialOffer,
      pidSchemes
    })
  });
  logger.info('*** New credential received via re-issuance flow ***.');

  // Normalize to your local record types
  const [firstCredential] = creds;
  if (!firstCredential || typeof firstCredential === 'string') {
    throw new Error('Issuer returned empty or malformed credential on re-issuance.');
  }
  let newRecord;
  if ('compact' in firstCredential.credential) {
    newRecord = new _core.SdJwtVcRecord({
      compactSdJwtVc: firstCredential.credential.compact
    });
  } else if ((firstCredential === null || firstCredential === void 0 ? void 0 : firstCredential.credential) instanceof _core.Mdoc) {
    newRecord = new _core.MdocRecord({
      mdoc: firstCredential.credential
    });
  } else {
    newRecord = new _core.W3cCredentialRecord({
      credential: firstCredential.credential,
      tags: {}
    });
  }
  const openId4VcMetadata = (0, _metadata.extractOpenId4VcCredentialMetadata)(resolvedCredentialOffer.offeredCredentials[0], {
    id: resolvedCredentialOffer.metadata.issuer,
    display: resolvedCredentialOffer.metadata.credentialIssuerMetadata.display
  });
  (0, _metadata.setOpenId4VcCredentialMetadata)(newRecord, openId4VcMetadata);
  (0, _metadata.setRefreshCredentialMetadata)(newRecord, {
    ...refreshMetaData,
    refreshToken: tokenResponse.refresh_token || refreshMetaData.refreshToken,
    lastCheckedAt: Date.now(),
    lastCheckResult: _types.RefreshStatus.Valid
  });
  return newRecord;
}
//# sourceMappingURL=reIssuance.js.map