"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || function (mod) {
    if (mod && mod.__esModule) return mod;
    var result = {};
    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
    __setModuleDefault(result, mod);
    return result;
};
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.parse = exports.create = exports.PROTOCOL_ID = void 0;
const base62_1 = __importDefault(require("@fry/base62"));
const cbor_1 = __importDefault(require("cbor"));
const jose = __importStar(require("jose"));
const cbor_jose_js_1 = require("../../cbor-jose.js");
const lzma = __importStar(require("../../lzma.js"));
const utils_js_1 = require("../../utils.js");
exports.PROTOCOL_ID = 'mB:pigi2';
async function create(data, signingKeys, options) {
    const hash = await (0, utils_js_1.sha256)(data);
    const iterations = 200000;
    const cryptoKey = await (0, utils_js_1.pbkdf2)(data, hash, 512, iterations);
    const secret1 = cryptoKey.slice(0, 32);
    const secret2 = cryptoKey.slice(32);
    const rawCek = await (0, utils_js_1.sha256hmac)(secret1, secret2);
    const cek = await utils_js_1.crypto.subtle.importKey('raw', rawCek, { name: 'AES-GCM' }, true, ['encrypt', 'decrypt']);
    const payload = cbor_1.default.encode([options.filename, options.mimetype, data]);
    const compressed = await lzma.compress(payload, 9);
    const l0 = await new jose.GeneralEncrypt(compressed)
        .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', iter: iterations, salt: hash })
        .addRecipient(cek)
        .setUnprotectedHeader({ fid: 'bla' }) // add key id
        .encrypt();
    const cl0 = (0, cbor_jose_js_1.jose2cbor)(l0);
    const _l1 = await new jose.GeneralSign(cl0);
    for (const signingKey of signingKeys) {
        const jwk = await jose.exportJWK(signingKey);
        const kid = await jose.calculateJwkThumbprint(jwk);
        _l1.addSignature(signingKey).setProtectedHeader({ alg: 'ES256', kid: kid });
    }
    const l1 = await _l1.sign();
    const l2 = await new jose.GeneralEncrypt((0, cbor_jose_js_1.jose2cbor)(l1))
        .setProtectedHeader({ alg: 'dir', enc: 'A128CBC-HS256' })
        .addRecipient(new Uint8Array(secret1))
        .setUnprotectedHeader({ fid: 'bla2' })
        .encrypt();
    const final = (0, cbor_jose_js_1.jose2cbor)(l2);
    return {
        _secret1: secret1,
        _secret1Hex: utils_js_1.hex.bufToHex(secret1),
        _secret1Base62: base62_1.default.encode(secret1),
        _secret2: secret2,
        _secret2Hex: utils_js_1.hex.bufToHex(secret2),
        _secret2Base62: base62_1.default.encode(secret2),
        encryptedData: final,
    };
}
exports.create = create;
async function parse(data, secret1, secret2, verifyKey) {
    const rawCek = await (0, utils_js_1.sha256hmac)(secret1, secret2);
    const cek = await utils_js_1.crypto.subtle.importKey('raw', rawCek, { name: 'AES-GCM' }, true, ['encrypt', 'decrypt']);
    const l2 = (0, cbor_jose_js_1.cbor2jose)(data);
    const l2decrypted = await jose.generalDecrypt(l2, secret1);
    const l1 = (0, cbor_jose_js_1.cbor2jose)(l2decrypted.plaintext);
    const l1verify = await jose.generalVerify(l1, verifyKey);
    const l1verified = l1verify.payload;
    const l0 = (0, cbor_jose_js_1.cbor2jose)(l1verified);
    const l0decrypted = await jose.generalDecrypt(l0, cek);
    const l0decrypteddata = l0decrypted.plaintext;
    const decompressed = await lzma.decompress(l0decrypteddata);
    const [filename, mimetype, originaldata] = cbor_1.default.decode(decompressed);
    return {
        _filename: filename,
        _mimetype: mimetype,
        _plainData: originaldata,
    };
}
exports.parse = parse;
//# sourceMappingURL=data:application/json;base64, 