

const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.js');
const require_CredoError = require('../../../error/CredoError.js');
require('../../../error/index.js');
const require_JsonTransformer = require('../../../utils/JsonTransformer.js');
require('../../../utils/index.js');
const require_types = require('../../../types.js');
const require_JwtPayload = require('../../../crypto/jose/jwt/JwtPayload.js');
require('../../../crypto/jose/jwt/index.js');
const require_W3cCredential = require('../models/credential/W3cCredential.js');
const require_util = require('../util.js');
let class_validator = require("class-validator");
class_validator = require_rolldown_runtime.__toESM(class_validator);

//#region src/modules/vc/jwt-vc/credentialTransformer.ts
function getJwtPayloadFromCredential(credential) {
	const vc = require_JsonTransformer.JsonTransformer.toJSON(credential);
	const payloadOptions = { additionalClaims: { vc } };
	const issuanceDate = Date.parse(credential.issuanceDate);
	if (Number.isNaN(issuanceDate)) throw new require_CredoError.CredoError("JWT VCs must have a valid issuance date");
	payloadOptions.nbf = Math.floor(issuanceDate / 1e3);
	delete vc.issuanceDate;
	if (credential.expirationDate) {
		const expirationDate = Date.parse(credential.expirationDate);
		if (!Number.isNaN(expirationDate)) {
			payloadOptions.exp = Math.floor(expirationDate / 1e3);
			delete vc.expirationDate;
		}
	}
	payloadOptions.iss = credential.issuerId;
	if (typeof vc.issuer === "string") delete vc.issuer;
	else if (typeof vc.issuer === "object") {
		delete vc.issuer.id;
		if (Object.keys(vc.issuer).length === 0) delete vc.issuer;
	}
	if (credential.id) {
		payloadOptions.jti = credential.id;
		delete vc.id;
	}
	if (Array.isArray(credential.credentialSubject) && credential.credentialSubject.length !== 1) throw new require_CredoError.CredoError("JWT VCs must have exactly one credential subject");
	const [credentialSubjectId] = credential.credentialSubjectIds;
	if (credentialSubjectId) {
		payloadOptions.sub = credentialSubjectId;
		if (Array.isArray(vc.credentialSubject)) delete vc.credentialSubject[0].id;
		else delete vc.credentialSubject?.id;
	}
	return new require_JwtPayload.JwtPayload(payloadOptions);
}
function getCredentialFromJwtPayload(jwtPayload) {
	if (!("vc" in jwtPayload.additionalClaims) || !require_types.isJsonObject(jwtPayload.additionalClaims.vc)) throw new require_CredoError.CredoError("JWT does not contain a valid 'vc' claim");
	const jwtVc = jwtPayload.additionalClaims.vc;
	if (!jwtPayload.nbf || !jwtPayload.iss) throw new require_CredoError.CredoError("JWT does not contain valid 'nbf' and 'iss' claims");
	if (Array.isArray(jwtVc.credentialSubject) && jwtVc.credentialSubject.length !== 1) throw new require_CredoError.CredoError("JWT VCs must have exactly one credential subject");
	if (Array.isArray(jwtVc.credentialSubject) && !(0, class_validator.isObject)(jwtVc.credentialSubject[0])) throw new require_CredoError.CredoError("JWT VCs must have a credential subject of type object");
	const credentialSubject = Array.isArray(jwtVc.credentialSubject) ? jwtVc.credentialSubject[0] : jwtVc.credentialSubject;
	if (!require_types.isJsonObject(credentialSubject)) throw new require_CredoError.CredoError("JWT VC does not have a valid credential subject");
	const subjectWithId = jwtPayload.sub ? {
		...credentialSubject,
		id: jwtPayload.sub
	} : credentialSubject;
	if (jwtVc.id && jwtPayload.jti !== jwtVc.id) throw new require_CredoError.CredoError("JWT jti and vc.id do not match");
	if (typeof jwtVc.issuer === "string" && jwtPayload.iss !== jwtVc.issuer || require_types.isJsonObject(jwtVc.issuer) && jwtVc.issuer.id && jwtPayload.iss !== jwtVc.issuer.id) throw new require_CredoError.CredoError("JWT iss and vc.issuer(.id) do not match");
	if (jwtVc.issuanceDate) {
		if (typeof jwtVc.issuanceDate !== "string") throw new require_CredoError.CredoError("JWT vc.issuanceDate must be a string");
		const issuanceDate = Date.parse(jwtVc.issuanceDate) / 1e3;
		if (jwtPayload.nbf !== issuanceDate) throw new require_CredoError.CredoError("JWT nbf and vc.issuanceDate do not match");
	}
	if (jwtVc.expirationDate) {
		if (typeof jwtVc.expirationDate !== "string") throw new require_CredoError.CredoError("JWT vc.expirationDate must be a string");
		if (Date.parse(jwtVc.expirationDate) / 1e3 !== jwtPayload.exp) throw new require_CredoError.CredoError("JWT exp and vc.expirationDate do not match");
	}
	if (require_types.isJsonObject(jwtVc.credentialSubject) && jwtVc.credentialSubject.id && jwtPayload.sub !== jwtVc.credentialSubject.id || Array.isArray(jwtVc.credentialSubject) && require_types.isJsonObject(jwtVc.credentialSubject[0]) && jwtVc.credentialSubject[0].id && jwtPayload.sub !== jwtVc.credentialSubject[0].id) throw new require_CredoError.CredoError("JWT sub and vc.credentialSubject.id do not match");
	const dataModelVc = {
		...jwtVc,
		issuanceDate: require_util.w3cDate(jwtPayload.nbf * 1e3),
		expirationDate: jwtPayload.exp ? require_util.w3cDate(jwtPayload.exp * 1e3) : void 0,
		issuer: typeof jwtVc.issuer === "object" ? {
			...jwtVc.issuer,
			id: jwtPayload.iss
		} : jwtPayload.iss,
		id: jwtPayload.jti,
		credentialSubject: Array.isArray(jwtVc.credentialSubject) ? [subjectWithId] : subjectWithId
	};
	return require_JsonTransformer.JsonTransformer.fromJSON(dataModelVc, require_W3cCredential.W3cCredential);
}

//#endregion
exports.getCredentialFromJwtPayload = getCredentialFromJwtPayload;
exports.getJwtPayloadFromCredential = getJwtPayloadFromCredential;