

const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.js');
const require_KeyManagementError = require('../error/KeyManagementError.js');
const require_humanDescription = require('./humanDescription.js');
const require_zod = require('../../../utils/zod.js');
let zod = require("zod");

//#region src/modules/kms/jwk/keyOps.ts
const zKnownJwkUse = zod.z.union([zod.z.literal("sig").describe("signature"), zod.z.literal("enc").describe("encryption")]);
const zJwkUse = zod.z.union([zKnownJwkUse, zod.z.string()]);
const zKnownJwkKeyOps = zod.z.union([
	zod.z.literal("sign").describe("compute digital signature or MAC"),
	zod.z.literal("verify").describe("verify digital signature or MAC"),
	zod.z.literal("encrypt").describe("encrypt content"),
	zod.z.literal("decrypt").describe("decrypt content and validate decryption, if applicable"),
	zod.z.literal("wrapKey").describe("encrypt key"),
	zod.z.literal("unwrapKey").describe("decrypt key and validate decryption, if applicable"),
	zod.z.literal("deriveKey").describe("derive key"),
	zod.z.literal("deriveBits").describe("derive bits not to be used as a key")
]);
const zJwkKeyOps = require_zod.zUniqueArray(zod.z.union([zKnownJwkKeyOps, zod.z.string()]));
function keyAllowsDerive(key) {
	if (key.use && key.use !== "enc") return false;
	if (key.key_ops && !key.key_ops.includes("deriveKey")) return false;
	return true;
}
function assertKeyAllowsDerive(jwk) {
	if (!keyAllowsDerive(jwk)) throw new require_KeyManagementError.KeyManagementError(`${require_humanDescription.getJwkHumanDescription(jwk)} usage does not allow key derivation operations`);
}
function keyAllowsVerify(key) {
	if (key.use && key.use !== "sig") return false;
	if (key.key_ops && !key.key_ops.includes("verify")) return false;
	return true;
}
function assertKeyAllowsVerify(jwk) {
	if (!keyAllowsVerify(jwk)) throw new require_KeyManagementError.KeyManagementError(`${require_humanDescription.getJwkHumanDescription(jwk)} usage does not allow verification operations`);
}
function keyAllowsSign(key) {
	if (key.use && key.use !== "sig") return false;
	if (key.key_ops && !key.key_ops.includes("sign")) return false;
	return true;
}
function assertKeyAllowsSign(jwk) {
	if (!keyAllowsSign(jwk)) throw new require_KeyManagementError.KeyManagementError(`${require_humanDescription.getJwkHumanDescription(jwk)} usage does not allow signing operations`);
}
function keyAllowsEncrypt(key) {
	if (key.use && key.use !== "enc") return false;
	if (key.key_ops && !key.key_ops.includes("encrypt")) return false;
	return true;
}
function assertKeyAllowsEncrypt(jwk) {
	if (!keyAllowsEncrypt(jwk)) throw new require_KeyManagementError.KeyManagementError(`${require_humanDescription.getJwkHumanDescription(jwk)} usage does not allow encryption operations`);
}
function keyAllowsDecrypt(key) {
	if (key.use && key.use !== "enc") return false;
	if (key.key_ops && !key.key_ops.includes("decrypt")) return false;
	return true;
}
function assertKeyAllowsDecrypt(jwk) {
	if (!keyAllowsDecrypt(jwk)) throw new require_KeyManagementError.KeyManagementError(`${require_humanDescription.getJwkHumanDescription(jwk)} usage does not allow decryption operations`);
}

//#endregion
exports.assertKeyAllowsDecrypt = assertKeyAllowsDecrypt;
exports.assertKeyAllowsDerive = assertKeyAllowsDerive;
exports.assertKeyAllowsEncrypt = assertKeyAllowsEncrypt;
exports.assertKeyAllowsSign = assertKeyAllowsSign;
exports.assertKeyAllowsVerify = assertKeyAllowsVerify;
exports.keyAllowsDecrypt = keyAllowsDecrypt;
exports.keyAllowsEncrypt = keyAllowsEncrypt;
exports.keyAllowsSign = keyAllowsSign;
exports.keyAllowsVerify = keyAllowsVerify;
exports.zJwkKeyOps = zJwkKeyOps;
exports.zJwkUse = zJwkUse;