

import { PublicJwk } from "../../modules/kms/jwk/PublicJwk.mjs";
import { KeyManagementApi } from "../../modules/kms/KeyManagementApi.mjs";
import "../../modules/kms/index.mjs";
import { CredoWebCryptoKey } from "./CredoWebCryptoKey.mjs";
import { CredoWebCryptoError } from "./CredoWebCryptoError.mjs";
import { keyParamsToJwaAlgorithm } from "./types.mjs";
import { cryptoKeyAlgorithmToCreateKeyOptions, publicJwkToSpki, spkiToPublicJwk } from "./utils/keyAlgorithmConversion.mjs";
import "./utils/index.mjs";
import { sha256, sha384 } from "@noble/hashes/sha2";
import { AsnConvert, AsnParser } from "@peculiar/asn1-schema";
import { p384 } from "@noble/curves/p384";
import { SubjectPublicKeyInfo } from "@peculiar/asn1-x509";
import { p256 } from "@noble/curves/p256";

//#region src/crypto/webcrypto/CredoWalletWebCrypto.ts
var CredoWalletWebCrypto = class {
	constructor(agentContext) {
		this.agentContext = agentContext;
		this.kms = agentContext.resolve(KeyManagementApi);
	}
	generateRandomValues(array) {
		if (!array) return array;
		return this.kms.randomBytes({ length: array.byteLength });
	}
	async sign(key, message, algorithm) {
		const jwaAlgorithm = keyParamsToJwaAlgorithm(algorithm, key);
		const keyId = key.publicJwk.keyId;
		const { signature } = await this.kms.sign({
			keyId,
			data: message,
			algorithm: jwaAlgorithm
		});
		return signature;
	}
	async verify(key, algorithm, message, signature) {
		const publicKey = key.publicJwk.publicKey;
		if (algorithm.name === "ECDSA") {
			const hashAlg = typeof algorithm.hash === "string" ? algorithm.hash : algorithm.hash.name;
			if (publicKey.kty === "EC" && publicKey.crv === "P-256" && hashAlg !== "SHA-256") {
				if (hashAlg !== "SHA-384") throw new CredoWebCryptoError(`Hash Alg: ${hashAlg} is not supported with key type ${publicKey.crv} currently`);
				return p256.verify(signature, sha384(message), publicKey.publicKey);
			}
			if (publicKey.kty === "EC" && publicKey.crv === "P-384" && hashAlg !== "SHA-384") {
				if (hashAlg !== "SHA-256") throw new CredoWebCryptoError(`Hash Alg: ${hashAlg} is not supported with key type ${publicKey.crv} currently`);
				return p384.verify(signature, sha256(message), publicKey.publicKey);
			}
		}
		const jwaAlgorithm = keyParamsToJwaAlgorithm(algorithm, key);
		const { verified } = await this.kms.verify({
			key: { publicJwk: key.publicJwk.toJson() },
			algorithm: jwaAlgorithm,
			signature,
			data: message
		});
		return verified;
	}
	async generate(algorithm) {
		return await this.kms.createKey({ type: cryptoKeyAlgorithmToCreateKeyOptions(algorithm) });
	}
	async importKey(format, keyData, algorithm, extractable, keyUsages) {
		if (format === "jwk" && keyData instanceof Uint8Array) throw new Error("JWK format is only allowed with a jwk as key data");
		if (format !== "jwk" && !(keyData instanceof Uint8Array)) throw new Error("non-jwk formats are only allowed with a uint8array as key data");
		switch (format.toLowerCase()) {
			case "jwk": return new CredoWebCryptoKey(PublicJwk.fromUnknown(keyData), algorithm, extractable, "public", keyUsages);
			case "spki": return new CredoWebCryptoKey(spkiToPublicJwk(AsnParser.parse(keyData, SubjectPublicKeyInfo)), algorithm, extractable, "public", keyUsages);
			default: throw new Error(`Unsupported export format: ${format}`);
		}
	}
	async exportKey(format, key) {
		switch (format.toLowerCase()) {
			case "jwk": return key.publicJwk.toJson();
			case "spki": {
				const publicKeyInfo = publicJwkToSpki(key.publicJwk);
				const derEncoded = AsnConvert.serialize(publicKeyInfo);
				return new Uint8Array(derEncoded);
			}
			default: throw new Error(`Unsupported export format: ${format}`);
		}
	}
};

//#endregion
export { CredoWalletWebCrypto };
//# sourceMappingURL=CredoWalletWebCrypto.mjs.map