import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
import { signatureAlgorithms } from '../jose/algorithms/signing/signature-algorithms.js';
/**
 * A signer that signs using a private key.
 */
export class PrivateKeySigner {
    keyId;
    algorithm;
    privateJwk;
    signatureAlgorithm;
    constructor(options) {
        if (options.keyId === undefined && options.privateJwk.kid === undefined) {
            throw new DwnError(DwnErrorCode.PrivateKeySignerUnableToDeduceKeyId, `Unable to deduce the key ID`);
        }
        // NOTE: `alg` is optional for a JWK as specified in https://datatracker.ietf.org/doc/html/rfc7517#section-4.4
        if (options.algorithm === undefined && options.privateJwk.alg === undefined) {
            throw new DwnError(DwnErrorCode.PrivateKeySignerUnableToDeduceAlgorithm, `Unable to deduce the signature algorithm`);
        }
        this.keyId = options.keyId ?? options.privateJwk.kid;
        this.algorithm = options.algorithm ?? options.privateJwk.alg;
        this.privateJwk = options.privateJwk;
        const crv = 'crv' in options.privateJwk ? options.privateJwk.crv : undefined;
        this.signatureAlgorithm = signatureAlgorithms[crv];
        if (!this.signatureAlgorithm) {
            throw new DwnError(DwnErrorCode.PrivateKeySignerUnsupportedCurve, `Unsupported crv ${crv}, crv must be one of ${Object.keys(signatureAlgorithms)}`);
        }
    }
    /**
     * Signs the given content and returns the signature as bytes.
     */
    async sign(content) {
        const signatureBytes = await this.signatureAlgorithm.sign(content, this.privateJwk);
        return signatureBytes;
    }
}
//# sourceMappingURL=private-key-signer.js.map