

const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.js');
const require_humanDescription = require('../../../modules/kms/jwk/humanDescription.js');
const require_PublicJwk = require('../../../modules/kms/jwk/PublicJwk.js');
require('../../../modules/kms/index.js');
const require_CredoWebCryptoError = require('../CredoWebCryptoError.js');
const require_algorithmIdentifiers = require('../algorithmIdentifiers.js');
let __peculiar_asn1_schema = require("@peculiar/asn1-schema");
let __peculiar_asn1_x509 = require("@peculiar/asn1-x509");
let __peculiar_asn1_rsa = require("@peculiar/asn1-rsa");

//#region src/crypto/webcrypto/utils/keyAlgorithmConversion.ts
const publicJwkToCryptoKeyAlgorithm = (key) => {
	const publicJwk = key.toJson();
	if (publicJwk.kty === "EC") {
		if (publicJwk.crv === "P-256" || publicJwk.crv === "P-384" || publicJwk.crv === "P-521") return {
			name: "ECDSA",
			namedCurve: publicJwk.crv
		};
		if (publicJwk.crv === "secp256k1") return {
			name: "ECDSA",
			namedCurve: "K-256"
		};
	} else if (publicJwk.kty === "OKP") {
		if (publicJwk.crv === "Ed25519") return { name: "Ed25519" };
	}
	throw new require_CredoWebCryptoError.CredoWebCryptoError(`Unsupported ${require_humanDescription.getJwkHumanDescription(key.toJson())}`);
};
const cryptoKeyAlgorithmToCreateKeyOptions = (algorithm) => {
	const algorithmName = algorithm.name.toUpperCase();
	switch (algorithmName) {
		case "ED25519": return {
			kty: "OKP",
			crv: "Ed25519"
		};
		case "X25519": return {
			kty: "OKP",
			crv: "X25519"
		};
		case "ECDSA": {
			const crv = algorithm.namedCurve.toUpperCase();
			switch (crv) {
				case "P-256":
				case "P-384":
				case "P-521": return {
					kty: "EC",
					crv
				};
				case "K-256": return {
					kty: "EC",
					crv: "secp256k1"
				};
				default: throw new require_CredoWebCryptoError.CredoWebCryptoError(`Unsupported curve for ECDSA: ${algorithm.namedCurve}`);
			}
		}
		case "RSASSA-PKCS1-V1_5":
		case "RSA-PSS": {
			const rsaParams = algorithm;
			if (rsaParams.publicExponent) throw new require_CredoWebCryptoError.CredoWebCryptoError("Custom exponent not suported for RSA");
			if (rsaParams.modulusLength !== 2048 && rsaParams.modulusLength !== 3072 && rsaParams.modulusLength !== 4096) throw new require_CredoWebCryptoError.CredoWebCryptoError(`Unsupported modulusLength '${rsaParams.modulusLength}' for RSA key. Expected one of 2048, 3072, 4096.`);
			return {
				kty: "RSA",
				modulusLength: rsaParams.modulusLength
			};
		}
	}
	throw new require_CredoWebCryptoError.CredoWebCryptoError(`Unsupported algorithm: ${algorithmName}`);
};
const spkiToPublicJwk = (spki) => {
	if (spki.algorithm.isEqual(require_algorithmIdentifiers.ecPublicKeyWithP256AlgorithmIdentifier)) return require_PublicJwk.PublicJwk.fromPublicKey({
		kty: "EC",
		crv: "P-256",
		publicKey: new Uint8Array(spki.subjectPublicKey)
	});
	if (spki.algorithm.isEqual(require_algorithmIdentifiers.ecPublicKeyWithP384AlgorithmIdentifier)) return require_PublicJwk.PublicJwk.fromPublicKey({
		kty: "EC",
		crv: "P-384",
		publicKey: new Uint8Array(spki.subjectPublicKey)
	});
	if (spki.algorithm.isEqual(require_algorithmIdentifiers.ecPublicKeyWithP521AlgorithmIdentifier)) return require_PublicJwk.PublicJwk.fromPublicKey({
		kty: "EC",
		crv: "P-521",
		publicKey: new Uint8Array(spki.subjectPublicKey)
	});
	if (spki.algorithm.isEqual(require_algorithmIdentifiers.ecPublicKeyWithK256AlgorithmIdentifier)) return require_PublicJwk.PublicJwk.fromPublicKey({
		kty: "EC",
		crv: "secp256k1",
		publicKey: new Uint8Array(spki.subjectPublicKey)
	});
	if (spki.algorithm.isEqual(require_algorithmIdentifiers.ed25519AlgorithmIdentifier)) return require_PublicJwk.PublicJwk.fromPublicKey({
		kty: "OKP",
		crv: "Ed25519",
		publicKey: new Uint8Array(spki.subjectPublicKey)
	});
	if (spki.algorithm.isEqual(require_algorithmIdentifiers.x25519AlgorithmIdentifier)) return require_PublicJwk.PublicJwk.fromPublicKey({
		kty: "OKP",
		crv: "X25519",
		publicKey: new Uint8Array(spki.subjectPublicKey)
	});
	if (spki.algorithm.isEqual(require_algorithmIdentifiers.rsaKeyAlgorithmIdentifier)) {
		const keyWithoutUnusedBits = new Uint8Array(spki.subjectPublicKey).slice(1);
		const rsaPublicKey = __peculiar_asn1_schema.AsnParser.parse(keyWithoutUnusedBits, __peculiar_asn1_rsa.RSAPublicKey);
		return require_PublicJwk.PublicJwk.fromPublicKey({
			kty: "RSA",
			modulus: new Uint8Array(rsaPublicKey.modulus),
			exponent: new Uint8Array(rsaPublicKey.publicExponent)
		});
	}
	throw new require_CredoWebCryptoError.CredoWebCryptoError(`Unsupported algorithm: ${spki.algorithm.algorithm}, with params: ${spki.algorithm.parameters ? "yes" : "no"}`);
};
const publicJwkToSpki = (publicJwk) => {
	const publicKey = publicJwk.publicKey;
	if (publicKey.kty === "RSA") {
		const rsaPublicKey = new __peculiar_asn1_rsa.RSAPublicKey({
			modulus: new Uint8Array(publicKey.modulus).buffer,
			publicExponent: new Uint8Array(publicKey.exponent).buffer
		});
		const rsaPublicKeyDer = __peculiar_asn1_schema.AsnSerializer.serialize(rsaPublicKey);
		return new __peculiar_asn1_x509.SubjectPublicKeyInfo({
			algorithm: require_algorithmIdentifiers.rsaKeyAlgorithmIdentifier,
			subjectPublicKey: new Uint8Array([0, ...new Uint8Array(rsaPublicKeyDer)]).buffer
		});
	}
	return new __peculiar_asn1_x509.SubjectPublicKeyInfo({
		algorithm: {
			"P-256": require_algorithmIdentifiers.ecPublicKeyWithP256AlgorithmIdentifier,
			"P-384": require_algorithmIdentifiers.ecPublicKeyWithP384AlgorithmIdentifier,
			"P-521": require_algorithmIdentifiers.ecPublicKeyWithP521AlgorithmIdentifier,
			secp256k1: require_algorithmIdentifiers.ecPublicKeyWithK256AlgorithmIdentifier,
			Ed25519: require_algorithmIdentifiers.ed25519AlgorithmIdentifier,
			X25519: require_algorithmIdentifiers.x25519AlgorithmIdentifier
		}[publicKey.crv],
		subjectPublicKey: new Uint8Array(publicKey.publicKey).buffer
	});
};

//#endregion
exports.cryptoKeyAlgorithmToCreateKeyOptions = cryptoKeyAlgorithmToCreateKeyOptions;
exports.publicJwkToCryptoKeyAlgorithm = publicJwkToCryptoKeyAlgorithm;
exports.publicJwkToSpki = publicJwkToSpki;
exports.spkiToPublicJwk = spkiToPublicJwk;