/**
 * @license
 * Copyright 2022-2026 Matter.js Authors
 * SPDX-License-Identifier: Apache-2.0
 */
import { CertificateError, Diagnostic } from "#general";
import { OperationalCertificate } from "./definitions/operational.js";
import { OperationalBase } from "./OperationalBase.js";
class Vvsc extends OperationalBase {
  /** Construct the class from a Tlv version of the certificate */
  static fromTlv(tlv) {
    return new Vvsc(OperationalCertificate.TlvVvsc.decode(tlv));
  }
  /** Validates all basic certificate fields on construction. */
  validateFields() {
    const {
      extensions: {
        basicConstraints: { isCa }
      }
    } = this.cert;
    if (!isCa) {
      throw new CertificateError("Intermediate certificate must be a CA.");
    }
  }
  /**
   * Encodes the certificate with the signature as Matter Tlv.
   * If the certificate is not signed, it throws a CertificateError.
   */
  asSignedTlv() {
    return OperationalCertificate.TlvVvsc.encode({ ...this.cert, signature: this.signature.bytes });
  }
  /**
   * Verify requirements a Matter Intermediate CA certificate must fulfill.
   * Rules for this are listed in @see {@link MatterSpecification.v12.Core} §6.5.x
   * // TODO ADD Verification once we know more about the chain
   */
  async verify(_crypto) {
    this.generalVerify();
    const { subject } = this.cert;
    const { vvsId } = subject;
    if (vvsId === void 0 || Array.isArray(vvsId)) {
      throw new CertificateError(`Invalid vvsId in Vsc certificate: ${Diagnostic.json(vvsId)}`);
    }
    if ("nodeId" in subject) {
      throw new CertificateError(`Vsc certificate must not contain a nodeId.`);
    }
    if ("fabricId" in subject) {
      throw new CertificateError(`Vsc certificate must not contain a fabricId.`);
    }
    if ("caseAuthenticatedTags" in subject) {
      throw new CertificateError(`Vvsc certificate must not contain a caseAuthenticatedTags.`);
    }
  }
}
export {
  Vvsc
};
//# sourceMappingURL=Vvsc.js.map
