import { HashName } from "../../crypto/hashes/Hasher.mjs";
import { X509Certificate } from "../x509/X509Certificate.mjs";
import { EncodedX509Certificate } from "../x509/X509ServiceOptions.mjs";
import "../x509/index.mjs";
import { SdJwtVc } from "./SdJwtVcService.mjs";
import { SdJwtVcRecord } from "./repository/SdJwtVcRecord.mjs";
import "./repository/index.mjs";
import { TrustedIssuer } from "../../agent/TrustedIssuersForVerification.mjs";
import { X509VerificationTrustedCertificates } from "../x509/X509ModuleConfig.mjs";
import "../../crypto/index.mjs";
import { PublicJwk } from "../kms/jwk/PublicJwk.mjs";
import "../kms/index.mjs";
import { SdJwtVcPayload } from "@sd-jwt/sd-jwt-vc";
//#region src/modules/sd-jwt-vc/SdJwtVcOptions.d.ts
export interface SdJwtVcStoreOptions {
  record: SdJwtVcRecord;
}
export type SdJwtVcHeader = Record<string, unknown>;
export interface IDisclosureFrame {
  /**
   * The claims that are selectively disclosable: property names in an object, element positions in an array.
   */
  _sd?: Array<string | number>;
  _sd_decoy?: number;
  [x: string]: Array<string | number> | number | IDisclosureFrame | undefined;
}
export interface IPresentationFrame {
  [x: string]: boolean | IPresentationFrame;
}
export interface SdJwtVcHolderDidBinding {
  method: 'did';
  didUrl: string;
}
export interface SdJwtVcHolderJwkBinding {
  method: 'jwk';
  jwk: PublicJwk;
}
export interface SdJwtVcIssuerDid {
  method: 'did';
  didUrl: string;
}
export interface SdJwtVcIssuerX5c {
  method: 'x5c';
  /**
   *
   * Array of X509 certificates.
   *
   * The certificate containing the public key corresponding to the key used to digitally sign the JWS MUST be the first certificate.
   */
  x5c: X509Certificate[];
  /**
   * The issuer of the SD-JWT VC.
   *
   * NOTE: in the latest draft of SD-JWT VC the issuer field is optional when using an X509 certificates
   * to sign the SD-JWT VC.
   *
   * Since it's not clear what the iss value should be Credo will likely require
   * the value to be undefined in a future version, but for now if the issuer value
   * is defined it MUST match an SAN URI or DNS entry in the leaf certificate, mimicking
   * previous behavior.
   */
  issuer?: string;
}
export type SdJwtVcHolderBinding = SdJwtVcHolderDidBinding | SdJwtVcHolderJwkBinding;
export type SdJwtVcIssuer = SdJwtVcIssuerDid | SdJwtVcIssuerX5c;
export interface SdJwtVcSignOptions<Payload extends SdJwtVcPayload = SdJwtVcPayload> {
  /**
   * If `iat` is omitted from the payload, the current time will be used.
   * If `iat` is explicitly set to `null`, no `iat` claim will be included in the issued credential.
   */
  payload: Omit<Payload, 'iat'> & {
    iat?: number | null;
  };
  /**
   * If holder is not provided, we don't bind the SD-JWT VC to a key (so bearer VC)
   */
  holder?: SdJwtVcHolderBinding;
  issuer: SdJwtVcIssuer;
  disclosureFrame?: IDisclosureFrame;
  /**
   * The hashing algorithm used for the disclosure digests, and placed in the
   * `_sd_alg` claim of the SD-JWT VC.
   *
   * `sha-1` is not supported, as SD-JWT VC requires a hash algorithm that is
   * considered secure at the time of issuance.
   *
   * @default 'sha-256'
   */
  hashingAlgorithm?: Exclude<HashName, 'sha-1'>;
  /**
   * The header 'typ' to use for the SD-JWT VC. vc+sd-jwt is supported
   * for backwards compatibility but implementations should update to
   * dc+sd-jwt
   *
   * @default 'dc+sd-jwt'
   */
  headerType?: 'dc+sd-jwt' | 'vc+sd-jwt';
}
export type SdJwtVcPresentOptions<_Payload extends SdJwtVcPayload = SdJwtVcPayload> = {
  sdJwtVc: string | SdJwtVc;
  /**
   * Use true to disclose everything
   */
  presentationFrame?: IPresentationFrame;
  /**
   * This information is received out-of-band from the verifier.
   * The claims will be used to create a normal JWT, used for key binding.
   *
   * If not defined, a KB-JWT will not be created
   */
  verifierMetadata?: {
    audience: string;
    nonce: string;
    issuedAt: number;
  };
  /**
   * Additional payload to include in the KB JWT
   */
  additionalPayload?: Record<string, unknown>;
};
export type SdJwtVcVerifyOptions = {
  compactSdJwtVc: string;
  /**
   * If the key binding object is present, the sd-jwt is required to have a key binding jwt attached
   * and will be validated against the provided key binding options.
   */
  keyBinding?: {
    /**
     * The expected `aud` value in the payload of the KB-JWT. The value of this is dependant on the
     * exchange protocol used.
     */
    audience: string;
    /**
     * The expected `nonce` value in the payload of the KB-JWT. The value of this is dependant on the
     * exchange protocol used.
     */
    nonce: string;
  };
  requiredClaimKeys?: Array<string>;
  /**
   * Whether to fetch the `vct` type metadata
   *
   * It will will not influence the verification result if fetching of type metadata fails
   *
   * @default false
   */
  fetchTypeMetadata?: boolean;
  /**
   * Whether to verify the status of the credential. If set to false and the credential
   * has a status, it will not be checked and the status list will not be fetched.
   *
   * @default true
   * @deprecated use `disableStatusValidation`
   */
  verifyCredentialStatus?: boolean;
  /**
   * Whether to verify the status of the credential. If set to true and the credential
   * has a status, it will not be checked and the status list will not be fetched.
   *
   * @default false
   */
  disableStatusValidation?: boolean;
  /**
   * Trusted certificates for the verification.
   *
   * @deprecated use `trustedIssuers` instead.
   */
  trustedCertificates?: EncodedX509Certificate[] | X509VerificationTrustedCertificates[];
  /**
   * Trusted issuers for the verification. Only entries whose `method` matches the credential signer
   * method are considered (x509 entries gate x5c-signed credentials, did entries gate did-signed ones).
   */
  trustedIssuers?: TrustedIssuer[];
  /**
   * Date that should be used as the current time. If not provided, current time will be used.
   */
  now?: Date;
};
//#endregion
export type { SdJwtVcPayload };
//# sourceMappingURL=SdJwtVcOptions.d.mts.map