/**
 * NOTE: Added reference types here to avoid a `pnpm` bug during build.
 * https://github.com/enboxorg/enbox/pull/507
 */
/// <reference types="@enbox/dwn-sdk-js" />
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
    return new (P || (P = Promise))(function (resolve, reject) {
        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
        step((generator = generator.apply(thisArg, _arguments || [])).next());
    });
};
var __rest = (this && this.__rest) || function (s, e) {
    var t = {};
    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
        t[p] = s[p];
    if (s != null && typeof Object.getOwnPropertySymbols === "function")
        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
                t[p[i]] = s[p[i]];
        }
    return t;
};
import { AnonymousDwnApi, WalletConnect, Web5UserAgent } from '@enbox/agent';
import { DidDht, DidJwk, DidKey, DidResolverCacheMemory, DidWeb, UniversalResolver } from '@enbox/dids';
import { DwnRegistrar, Web5RpcClient } from '@enbox/dwn-clients';
import { DidApi } from './did-api.js';
import { DwnApi } from './dwn-api.js';
import { DwnReaderApi } from './dwn-reader-api.js';
import { PermissionGrant } from './permission-grant.js';
import { TypedWeb5 } from './typed-web5.js';
import { VcApi } from './vc-api.js';
/**
 * The main Web5 API interface. It manages the creation of a DID if needed, the connection to the
 * local DWN and all the web5 main foundational APIs such as VC, syncing, etc.
 */
export class Web5 {
    constructor({ agent, connectedDid, delegateDid }) {
        this.agent = agent;
        this.did = new DidApi({ agent, connectedDid });
        this._dwn = new DwnApi({ agent, connectedDid, delegateDid });
        this.vc = new VcApi({ agent, connectedDid });
    }
    /**
     * Returns a {@link TypedWeb5} instance scoped to the given protocol.
     *
     * This is the **primary developer interface** for interacting with
     * protocol-backed records. It auto-injects the protocol URI, protocolPath,
     * and schema into every operation, and provides compile-time path
     * autocompletion plus typed data payloads via the schema map.
     *
     * @param protocol - A typed protocol created via `defineProtocol()`.
     * @returns A `TypedWeb5` instance bound to the given protocol.
     *
     * @example
     * ```ts
     * const social = web5.using(SocialProtocol);
     *
     * await social.configure();
     *
     * const { record } = await social.records.write('friend', {
     *   data: { did: 'did:example:alice', alias: 'Alice' },
     * });
     *
     * const { records } = await social.records.query('friend');
     * ```
     */
    using(protocol) {
        return new TypedWeb5(this._dwn, protocol);
    }
    /**
     * Creates a lightweight, read-only Web5 instance for querying public DWN data.
     *
     * No identity, vault, password, or signing keys are required. The returned
     * API supports querying and reading published records and protocols from any
     * remote DWN, using **unsigned** (anonymous) DWN messages.
     *
     * @param options - Optional configuration overrides.
     * @returns A {@link Web5AnonymousApi} with a read-only `dwn` property.
     *
     * @example
     * ```ts
     * const { dwn } = Web5.anonymous();
     *
     * const { records } = await dwn.records.query({
     *   from: 'did:dht:alice...',
     *   filter: { protocol: 'https://social.example/posts', protocolPath: 'post' },
     * });
     *
     * for (const record of records) {
     *   console.log(record.id, await record.data.text());
     * }
     * ```
     *
     * @beta
     */
    static anonymous(options) {
        var _a;
        const didResolver = new UniversalResolver({
            didResolvers: (_a = options === null || options === void 0 ? void 0 : options.didResolvers) !== null && _a !== void 0 ? _a : [DidDht, DidJwk, DidKey, DidWeb],
            cache: new DidResolverCacheMemory(),
        });
        const rpcClient = new Web5RpcClient();
        const anonymousDwn = new AnonymousDwnApi({ didResolver, rpcClient });
        return {
            dwn: new DwnReaderApi(anonymousDwn),
        };
    }
    /**
     * Connects to a {@link Web5Agent}. Defaults to creating a local {@link Web5UserAgent} if one
     * isn't provided.
     *
     * If `walletConnectOptions` are provided, a WalletConnect flow will be initiated to import a delegated DID from an external wallet.
     * If there is a failure at any point during connecting and processing grants, all created DIDs and Identities as well as the provided grants
     * will be cleaned up and an error thrown. This allows for subsequent Connect attempts to be made without any errors.
     *
     * @param options - Optional overrides that can be provided when calling {@link Web5.connect}.
     * @returns A promise that resolves to a {@link Web5} instance and the connected DID.
     */
    static connect() {
        return __awaiter(this, arguments, void 0, function* ({ agent, agentVault, connectedDid, password, recoveryPhrase, sync, techPreview, didCreateOptions, registration, walletConnectOptions, } = {}) {
            var _a, _b, _c, _d;
            let delegateDid;
            if (agent === undefined) {
                let registerSync = false;
                // A custom Web5Agent implementation was not specified, so use default managed user agent.
                const userAgent = yield Web5UserAgent.create({ agentVault });
                agent = userAgent;
                // Warn the developer and application user of the security risks of using a static password.
                if (password === undefined) {
                    password = 'insecure-static-phrase';
                    console.warn('%cSECURITY WARNING:%c ' +
                        'You have not set a password, which defaults to a static, guessable value. ' +
                        'This significantly compromises the security of your data. ' +
                        'Please configure a secure, unique password.', 'font-weight: bold; color: red;', 'font-weight: normal; color: inherit;');
                }
                // Use the specified DWN endpoints or the latest TBD hosted DWN
                const serviceEndpointNodes = (_b = (_a = techPreview === null || techPreview === void 0 ? void 0 : techPreview.dwnEndpoints) !== null && _a !== void 0 ? _a : didCreateOptions === null || didCreateOptions === void 0 ? void 0 : didCreateOptions.dwnEndpoints) !== null && _b !== void 0 ? _b : ['https://enbox-dwn.fly.dev'];
                // Initialize, if necessary, and start the agent.
                if (yield userAgent.firstLaunch()) {
                    recoveryPhrase = yield userAgent.initialize({ password, recoveryPhrase, dwnEndpoints: serviceEndpointNodes });
                }
                yield userAgent.start({ password });
                // Attempt to retrieve the connected Identity if it exists.
                const connectedIdentity = yield userAgent.identity.connectedIdentity();
                let identity;
                let connectedProtocols = [];
                if (connectedIdentity) {
                    // if a connected identity is found, use it
                    // TODO: In the future, implement a way to re-connect an already connected identity and apply additional grants/protocols
                    identity = connectedIdentity;
                }
                else if (walletConnectOptions) {
                    if (sync === 'off') {
                        // Currently we require sync to be enabled when using WalletConnect
                        // This is to ensure a connected app is not in a disjointed state from any other clients/app using the connectedDid
                        throw new Error('Sync must not be disabled when using WalletConnect');
                    }
                    // Since we are connecting a new identity, we will want to register sync for the connectedDid
                    registerSync = true;
                    // No connected identity found and connectOptions are provided, attempt to import a delegated DID from an external wallet
                    try {
                        const { permissionRequests } = walletConnectOptions, connectOptions = __rest(walletConnectOptions, ["permissionRequests"]);
                        const walletPermissionRequests = permissionRequests.map(({ protocolDefinition, permissions }) => WalletConnect.createPermissionRequestForProtocol({
                            definition: protocolDefinition,
                            permissions: permissions !== null && permissions !== void 0 ? permissions : [
                                'read', 'write', 'delete', 'query', 'subscribe',
                            ],
                        }));
                        const { delegatePortableDid, connectedDid, delegateGrants } = yield WalletConnect.initClient(Object.assign(Object.assign({}, connectOptions), { permissionRequests: walletPermissionRequests }));
                        // Import the delegated DID as an Identity in the User Agent.
                        // Setting the connectedDID in the metadata applies a relationship between the signer identity and the one it is impersonating.
                        identity = yield userAgent.identity.import({ portableIdentity: {
                                portableDid: delegatePortableDid,
                                metadata: {
                                    connectedDid,
                                    name: 'Default',
                                    uri: delegatePortableDid.uri,
                                    tenant: agent.agentDid.uri,
                                }
                            } });
                        // Attempts to process the connected grants to be used by the delegateDID
                        // If the process fails, we want to clean up the identity
                        // the connected grants will return a de-duped array of protocol URIs that are used to register sync for those protocols
                        connectedProtocols = yield this.processConnectedGrants({ agent, delegateDid: delegatePortableDid.uri, grants: delegateGrants });
                    }
                    catch (error) {
                        // clean up the DID and Identity if import fails and throw
                        // TODO: Implement the ability to purge all of our messages as a tenant
                        yield this.cleanUpIdentity({ identity, userAgent });
                        throw new Error(`Failed to connect to wallet: ${error.message}`);
                    }
                }
                else {
                    // No connected (WalletConnect) identity and no walletConnectOptions provided.
                    // Look for an existing local identity, or create one on first use.
                    const identities = yield userAgent.identity.list();
                    if (identities.length === 0) {
                        registerSync = true;
                        // First use — generate a new Identity for the end-user.
                        identity = yield userAgent.identity.create({
                            didMethod: 'dht',
                            metadata: { name: 'Default' },
                            didOptions: {
                                services: [
                                    {
                                        id: 'dwn',
                                        type: 'DecentralizedWebNode',
                                        serviceEndpoint: serviceEndpointNodes,
                                        enc: '#enc',
                                        sig: '#sig',
                                    }
                                ],
                                verificationMethods: [
                                    {
                                        algorithm: 'Ed25519',
                                        id: 'sig',
                                        purposes: ['assertionMethod', 'authentication']
                                    },
                                    {
                                        algorithm: 'X25519',
                                        id: 'enc',
                                        purposes: ['keyAgreement']
                                    }
                                ]
                            }
                        });
                    }
                    else {
                        // Reconnecting — use the first local identity. When the agent manages
                        // multiple identities (e.g. created via agent.identity.create()), the
                        // first one returned by the store is used as the default for connect().
                        identity = identities[0];
                    }
                }
                // If the stored identity has a connected DID, use it as the connected DID, otherwise use the identity's DID.
                connectedDid = (_c = identity.metadata.connectedDid) !== null && _c !== void 0 ? _c : identity.did.uri;
                // If the stored identity has a connected DID, use the identity DID as the delegated DID, otherwise it is undefined.
                delegateDid = identity.metadata.connectedDid ? identity.did.uri : undefined;
                if (registration !== undefined) {
                    const updatedTokens = Object.assign({}, ((_d = registration.registrationTokens) !== null && _d !== void 0 ? _d : {}));
                    try {
                        for (const dwnEndpoint of serviceEndpointNodes) {
                            const serverInfo = yield userAgent.rpc.getServerInfo(dwnEndpoint);
                            if (serverInfo.registrationRequirements.length === 0) {
                                continue;
                            }
                            // Deduplicate DIDs to register.
                            const didsToRegister = [agent.agentDid.uri, connectedDid]
                                .filter((did, i, arr) => arr.indexOf(did) === i);
                            const hasProviderAuth = serverInfo.registrationRequirements.includes('provider-auth-v0')
                                && serverInfo.providerAuth !== undefined;
                            if (hasProviderAuth && registration.onProviderAuthRequired) {
                                // --- Provider Auth Path ---
                                let tokenData = updatedTokens[dwnEndpoint];
                                // Refresh expired tokens.
                                if ((tokenData === null || tokenData === void 0 ? void 0 : tokenData.expiresAt) !== undefined && tokenData.expiresAt < Date.now()) {
                                    if (tokenData.refreshUrl && tokenData.refreshToken) {
                                        const refreshed = yield DwnRegistrar.refreshRegistrationToken(tokenData.refreshUrl, tokenData.refreshToken);
                                        tokenData = {
                                            registrationToken: refreshed.registrationToken,
                                            refreshToken: refreshed.refreshToken,
                                            expiresAt: refreshed.expiresIn !== undefined
                                                ? Date.now() + (refreshed.expiresIn * 1000) : undefined,
                                            tokenUrl: tokenData.tokenUrl,
                                            refreshUrl: tokenData.refreshUrl,
                                        };
                                        updatedTokens[dwnEndpoint] = tokenData;
                                    }
                                    else {
                                        tokenData = undefined;
                                    }
                                }
                                // Run the auth flow if no valid token exists.
                                if (tokenData === undefined) {
                                    const state = crypto.randomUUID();
                                    const providerAuth = serverInfo.providerAuth;
                                    const separator = providerAuth.authorizeUrl.includes('?') ? '&' : '?';
                                    const authorizeUrl = `${providerAuth.authorizeUrl}${separator}`
                                        + `redirect_uri=${encodeURIComponent(dwnEndpoint)}`
                                        + `&state=${encodeURIComponent(state)}`;
                                    const authResult = yield registration.onProviderAuthRequired({
                                        authorizeUrl,
                                        dwnEndpoint,
                                        state,
                                    });
                                    if (authResult.state !== state) {
                                        throw new Error('Provider auth state mismatch — possible CSRF attack.');
                                    }
                                    const tokenResponse = yield DwnRegistrar.exchangeAuthCode(providerAuth.tokenUrl, authResult.code, dwnEndpoint);
                                    tokenData = {
                                        registrationToken: tokenResponse.registrationToken,
                                        refreshToken: tokenResponse.refreshToken,
                                        expiresAt: tokenResponse.expiresIn !== undefined
                                            ? Date.now() + (tokenResponse.expiresIn * 1000) : undefined,
                                        tokenUrl: providerAuth.tokenUrl,
                                        refreshUrl: providerAuth.refreshUrl,
                                    };
                                    updatedTokens[dwnEndpoint] = tokenData;
                                }
                                // Register each DID using the provider auth token.
                                for (const did of didsToRegister) {
                                    yield DwnRegistrar.registerTenantWithToken(dwnEndpoint, did, tokenData.registrationToken);
                                }
                            }
                            else {
                                // --- Default Path (PoW / general registration) ---
                                for (const did of didsToRegister) {
                                    yield DwnRegistrar.registerTenant(dwnEndpoint, did);
                                }
                            }
                        }
                        // Notify app of updated tokens for persistence.
                        if (registration.onRegistrationTokens) {
                            registration.onRegistrationTokens(updatedTokens);
                        }
                        registration.onSuccess();
                    }
                    catch (error) {
                        registration.onFailure(error);
                    }
                }
                // Enable sync, unless explicitly disabled.
                if (sync !== 'off') {
                    // First, register the user identity for sync.
                    // The connected protocols are used to register sync for only a subset of protocols from the connectedDid's DWN
                    if (registerSync) {
                        yield userAgent.sync.registerIdentity({
                            did: connectedDid,
                            options: {
                                delegateDid,
                                protocols: connectedProtocols
                            }
                        });
                        if (walletConnectOptions !== undefined) {
                            // If we are using WalletConnect, we should do a one-shot sync to pull down any messages that are associated with the connectedDid
                            yield userAgent.sync.sync('pull');
                        }
                    }
                    // Enable sync using the specified interval or default.
                    sync !== null && sync !== void 0 ? sync : (sync = '2m');
                    userAgent.sync.startSync({ interval: sync })
                        .catch((error) => {
                        console.error(`Sync failed: ${error}`);
                    });
                }
            }
            const web5 = new Web5({ agent, connectedDid, delegateDid });
            return { web5, did: connectedDid, delegateDid, recoveryPhrase };
        });
    }
    /**
     * Cleans up the DID, Keys and Identity. Primarily used by a failed WalletConnect import.
     * Does not throw on error, but logs to console.
     */
    static cleanUpIdentity(_a) {
        return __awaiter(this, arguments, void 0, function* ({ identity, userAgent }) {
            try {
                // Delete the DID and the Associated Keys
                yield userAgent.did.delete({
                    didUri: identity.did.uri,
                    tenant: identity.metadata.tenant,
                    deleteKey: true,
                });
            }
            catch (error) {
                console.error(`Failed to delete DID ${identity.did.uri}: ${error.message}`);
            }
            try {
                // Delete the Identity
                yield userAgent.identity.delete({ didUri: identity.did.uri });
            }
            catch (error) {
                console.error(`Failed to delete Identity ${identity.metadata.name}: ${error.message}`);
            }
        });
    }
    /**
     * A static method to process connected grants for a delegate DID.
     *
     * This will store the grants as the DWN owner to be used later when impersonating the connected DID.
     */
    static processConnectedGrants(_a) {
        return __awaiter(this, arguments, void 0, function* ({ grants, agent, delegateDid }) {
            const connectedProtocols = new Set();
            for (const grantMessage of grants) {
                // use the delegateDid as the connectedDid of the grant as they do not yet support impersonation/delegation
                const grant = PermissionGrant.parse({ connectedDid: delegateDid, agent, message: grantMessage });
                // store the grant as the owner of the DWN, this will allow the delegateDid to use the grant when impersonating the connectedDid
                const { status } = yield grant.store(true);
                if (status.code !== 202) {
                    throw new Error(`AgentDwnApi: Failed to process connected grant: ${status.detail}`);
                }
                const protocol = grant.scope.protocol;
                if (protocol) {
                    connectedProtocols.add(protocol);
                }
            }
            // currently we return a de-duped set of protocols represented by these grants, this is used to register protocols for sync
            // we expect that any connected protocols will include MessagesSync and MessagesRead grants that will allow it to sync
            return [...connectedProtocols];
        });
    }
}
//# sourceMappingURL=web5.js.map