

const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.js');
const require_TypedArrayEncoder = require('../../utils/TypedArrayEncoder.js');
require('../../utils/index.js');
const require_jwa = require('../kms/jwk/jwa.js');
const require_PublicJwk = require('../kms/jwk/PublicJwk.js');
require('../kms/index.js');
const require_X509Certificate = require('../x509/X509Certificate.js');
const require_X509ModuleConfig = require('../x509/X509ModuleConfig.js');
require('../x509/index.js');
const require_ClaimFormat = require('../vc/models/ClaimFormat.js');
require('../vc/index.js');
const require_MdocContext = require('./MdocContext.js');
const require_MdocError = require('./MdocError.js');
const require_mdocSupportedAlgs = require('./mdocSupportedAlgs.js');
let __animo_id_mdoc = require("@animo-id/mdoc");
__animo_id_mdoc = require_rolldown_runtime.__toESM(__animo_id_mdoc);

//#region src/modules/mdoc/Mdoc.ts
/**
* This class represents a IssuerSigned Mdoc Document,
* which are the actual credentials being issued to holders.
*/
var Mdoc = class Mdoc {
	constructor(issuerSignedDocument) {
		this.issuerSignedDocument = issuerSignedDocument;
		const issuerSigned = issuerSignedDocument.prepare().get("issuerSigned");
		this.base64Url = require_TypedArrayEncoder.TypedArrayEncoder.toBase64URL((0, __animo_id_mdoc.cborEncode)(issuerSigned));
	}
	/**
	* claim format is convenience method added to all credential instances
	*/
	get claimFormat() {
		return require_ClaimFormat.ClaimFormat.MsoMdoc;
	}
	/**
	* Encoded is convenience method added to all credential instances
	*/
	get encoded() {
		return this.base64Url;
	}
	/**
	* Get the device key to which the mdoc is bound
	*/
	get deviceKey() {
		const deviceKeyRaw = this.issuerSignedDocument.issuerSigned.issuerAuth.decodedPayload.deviceKeyInfo?.deviceKey;
		if (!deviceKeyRaw) return null;
		return require_PublicJwk.PublicJwk.fromUnknown(__animo_id_mdoc.COSEKey.import(deviceKeyRaw).toJWK());
	}
	static fromBase64Url(mdocBase64Url, expectedDocType) {
		return new Mdoc((0, __animo_id_mdoc.parseIssuerSigned)(require_TypedArrayEncoder.TypedArrayEncoder.fromBase64(mdocBase64Url), expectedDocType));
	}
	static fromIssuerSignedDocument(issuerSignedBase64Url, expectedDocType) {
		return new Mdoc((0, __animo_id_mdoc.parseIssuerSigned)(require_TypedArrayEncoder.TypedArrayEncoder.fromBase64(issuerSignedBase64Url), expectedDocType));
	}
	static fromDeviceSignedDocument(issuerSignedBase64Url, deviceSignedBase64Url, expectedDocType) {
		return new Mdoc((0, __animo_id_mdoc.parseDeviceSigned)(require_TypedArrayEncoder.TypedArrayEncoder.fromBase64(deviceSignedBase64Url), require_TypedArrayEncoder.TypedArrayEncoder.fromBase64(issuerSignedBase64Url), expectedDocType));
	}
	get docType() {
		return this.issuerSignedDocument.docType;
	}
	get alg() {
		const algName = this.issuerSignedDocument.issuerSigned.issuerAuth.algName;
		if (!algName) throw new require_MdocError.MdocError("Cannot extract the signature algorithm from the mdoc.");
		if (require_jwa.isKnownJwaSignatureAlgorithm(algName)) return algName;
		throw new require_MdocError.MdocError(`Cannot parse mdoc. The signature algorithm '${algName}' is not supported.`);
	}
	get validityInfo() {
		return this.issuerSignedDocument.issuerSigned.issuerAuth.decodedPayload.validityInfo;
	}
	get deviceSignedNamespaces() {
		if (this.issuerSignedDocument instanceof __animo_id_mdoc.DeviceSignedDocument === false) return null;
		return Object.fromEntries(Array.from(this.issuerSignedDocument.allDeviceSignedNamespaces.entries()).map(([namespace, value]) => [namespace, Object.fromEntries(Array.from(value.entries()))]));
	}
	get issuerSignedCertificateChain() {
		return this.issuerSignedDocument.issuerSigned.issuerAuth.certificateChain;
	}
	get signingCertificate() {
		return this.issuerSignedDocument.issuerSigned.issuerAuth.certificate;
	}
	get issuerSignedNamespaces() {
		return Object.fromEntries(Array.from(this.issuerSignedDocument.allIssuerSignedNamespaces.entries()).map(([namespace, value]) => [namespace, Object.fromEntries(Array.from(value.entries()))]));
	}
	static async sign(agentContext, options) {
		const { docType, validityInfo, namespaces, holderKey, issuerCertificate } = options;
		const mdocContext = require_MdocContext.getMdocContext(agentContext);
		const document = new __animo_id_mdoc.Document(docType, mdocContext).useDigestAlgorithm("SHA-256").addValidityInfo(validityInfo).addDeviceKeyInfo({ deviceKey: holderKey.toJson() });
		for (const [namespace, namespaceRecord] of Object.entries(namespaces)) document.addIssuerNameSpace(namespace, namespaceRecord);
		const issuerKey = issuerCertificate.publicJwk;
		const alg = issuerKey.supportedSignatureAlgorithms.find(require_mdocSupportedAlgs.isMdocSupportedSignatureAlgorithm);
		if (!alg) throw new require_MdocError.MdocError(`Unable to create sign mdoc. No supported signature algorithm found to sign mdoc for jwk with key ${issuerKey.jwkTypehumanDescription}. Key supports algs ${issuerKey.supportedSignatureAlgorithms.join(", ")}. mdoc supports algs ${require_mdocSupportedAlgs.mdocSupporteSignatureAlgorithms.join(", ")}`);
		return new Mdoc(await document.sign({
			issuerPrivateKey: issuerKey.toJson(),
			alg,
			issuerCertificate: issuerCertificate.rawCertificate
		}, mdocContext));
	}
	async verify(agentContext, options) {
		const x509ModuleConfig = agentContext.dependencyManager.resolve(require_X509ModuleConfig.X509ModuleConfig);
		const certificateChain = this.issuerSignedDocument.issuerSigned.issuerAuth.certificateChain.map((certificate) => require_X509Certificate.X509Certificate.fromRawCertificate(certificate));
		let trustedCertificates = options?.trustedCertificates;
		if (!trustedCertificates) trustedCertificates = await x509ModuleConfig.getTrustedCertificatesForVerification?.(agentContext, {
			verification: {
				type: "credential",
				credential: this
			},
			certificateChain
		}) ?? x509ModuleConfig.trustedCertificates;
		if (!trustedCertificates) throw new require_MdocError.MdocError("No trusted certificates found. Cannot verify mdoc.");
		const mdocContext = require_MdocContext.getMdocContext(agentContext);
		try {
			const verifier = new __animo_id_mdoc.Verifier();
			await verifier.verifyIssuerSignature({
				trustedCertificates: trustedCertificates.map((cert) => require_X509Certificate.X509Certificate.fromEncodedCertificate(cert).rawCertificate),
				issuerAuth: this.issuerSignedDocument.issuerSigned.issuerAuth,
				disableCertificateChainValidation: false,
				now: options?.now
			}, mdocContext);
			await verifier.verifyData({ mdoc: this.issuerSignedDocument }, mdocContext);
			return { isValid: true };
		} catch (error) {
			return {
				isValid: false,
				error: error.message
			};
		}
	}
};

//#endregion
exports.Mdoc = Mdoc;