/**
 * @license
 * Copyright 2022-2026 Matter.js Authors
 * SPDX-License-Identifier: Apache-2.0
 */
import {
  TlvArray,
  TlvBitmap,
  TlvBoolean,
  TlvByteString,
  TlvCaseAuthenticatedTag,
  TlvFabricId,
  TlvField,
  TlvNodeId,
  TlvObject,
  TlvObjectWithMaxSize,
  TlvOptionalField,
  TlvOptionalRepeatedField,
  TlvString,
  TlvTaggedList,
  TlvUInt16,
  TlvUInt32,
  TlvUInt64,
  TlvUInt8
} from "#types";
import { ExtensionKeyUsageBitmap } from "./base.js";
const MAX_TLV_CERTIFICATE_SIZE = 400;
const TlvCertificateExtension = TlvTaggedList({
  basicConstraints: TlvField(
    1,
    TlvObject({
      isCa: TlvField(1, TlvBoolean),
      pathLen: TlvOptionalField(2, TlvUInt8)
    })
  ),
  keyUsage: TlvField(2, TlvBitmap(TlvUInt16, ExtensionKeyUsageBitmap)),
  extendedKeyUsage: TlvOptionalField(3, TlvArray(TlvUInt8)),
  subjectKeyIdentifier: TlvField(4, TlvByteString.bound({ length: 20 })),
  authorityKeyIdentifier: TlvField(5, TlvByteString.bound({ length: 20 })),
  futureExtension: TlvOptionalRepeatedField(6, TlvByteString)
});
var OperationalCertificate;
((OperationalCertificate2) => {
  const AllowedSubjectAndIssuerMatterFields = {
    nodeId: TlvOptionalField(17, TlvNodeId),
    firmwareSigningId: TlvOptionalField(18, TlvUInt32),
    icacId: TlvOptionalField(19, TlvUInt64),
    rcacId: TlvOptionalField(20, TlvUInt64),
    fabricId: TlvOptionalField(21, TlvFabricId),
    caseAuthenticatedTags: TlvOptionalRepeatedField(22, TlvCaseAuthenticatedTag, { maxLength: 3 })
  };
  const TlvGenericMatterSubjectOrIssuerTaggedList = (matterFields) => {
    const fields = {
      // Standard DNs
      commonName: TlvOptionalField(1, TlvString),
      surName: TlvOptionalField(2, TlvString),
      serialNum: TlvOptionalField(3, TlvString),
      countryName: TlvOptionalField(4, TlvString),
      localityName: TlvOptionalField(5, TlvString),
      stateOrProvinceName: TlvOptionalField(6, TlvString),
      orgName: TlvOptionalField(7, TlvString),
      orgUnitName: TlvOptionalField(8, TlvString),
      title: TlvOptionalField(9, TlvString),
      name: TlvOptionalField(10, TlvString),
      givenName: TlvOptionalField(11, TlvString),
      initials: TlvOptionalField(12, TlvString),
      genQualifier: TlvOptionalField(13, TlvString),
      dnQualifier: TlvOptionalField(14, TlvString),
      pseudonym: TlvOptionalField(15, TlvString),
      domainComponent: TlvOptionalField(16, TlvString),
      // Matter specific DNs
      ...matterFields,
      // Standard DNs when encoded as Printable String
      commonNamePs: TlvOptionalField(129, TlvString),
      surNamePs: TlvOptionalField(130, TlvString),
      serialNumPs: TlvOptionalField(131, TlvString),
      countryNamePs: TlvOptionalField(132, TlvString),
      localityNamePs: TlvOptionalField(133, TlvString),
      stateOrProvinceNamePs: TlvOptionalField(134, TlvString),
      orgNamePs: TlvOptionalField(135, TlvString),
      orgUnitNamePs: TlvOptionalField(136, TlvString),
      titlePs: TlvOptionalField(137, TlvString),
      namePs: TlvOptionalField(138, TlvString),
      givenNamePs: TlvOptionalField(139, TlvString),
      initialsPs: TlvOptionalField(140, TlvString),
      genQualifierPs: TlvOptionalField(141, TlvString),
      dnQualifierPs: TlvOptionalField(142, TlvString),
      pseudonymPs: TlvOptionalField(143, TlvString)
    };
    return TlvTaggedList(fields);
  };
  const BaseMatterCertificate = (matterFields) => TlvObjectWithMaxSize(
    {
      serialNumber: TlvField(1, TlvByteString.bound({ maxLength: 20 })),
      signatureAlgorithm: TlvField(2, TlvUInt8),
      issuer: TlvField(
        3,
        TlvGenericMatterSubjectOrIssuerTaggedList({
          ...AllowedSubjectAndIssuerMatterFields,
          ...matterFields?.issuer ?? {}
        })
      ),
      notBefore: TlvField(4, TlvUInt32),
      notAfter: TlvField(5, TlvUInt32),
      subject: TlvField(
        6,
        TlvGenericMatterSubjectOrIssuerTaggedList({
          ...AllowedSubjectAndIssuerMatterFields,
          ...matterFields?.subject ?? {}
        })
      ),
      publicKeyAlgorithm: TlvField(7, TlvUInt8),
      ellipticCurveIdentifier: TlvField(8, TlvUInt8),
      ellipticCurvePublicKey: TlvField(9, TlvByteString),
      extensions: TlvField(10, TlvCertificateExtension),
      signature: TlvField(11, TlvByteString)
    },
    MAX_TLV_CERTIFICATE_SIZE
  );
  OperationalCertificate2.TlvRcac = BaseMatterCertificate({
    subject: {
      rcacId: TlvField(20, TlvUInt64),
      fabricId: TlvOptionalField(21, TlvFabricId)
    },
    issuer: AllowedSubjectAndIssuerMatterFields
  });
  OperationalCertificate2.TlvNoc = BaseMatterCertificate({
    subject: {
      nodeId: TlvField(17, TlvNodeId),
      fabricId: TlvField(21, TlvFabricId),
      caseAuthenticatedTags: TlvOptionalRepeatedField(22, TlvCaseAuthenticatedTag, { maxLength: 3 })
    },
    issuer: AllowedSubjectAndIssuerMatterFields
  });
  OperationalCertificate2.TlvIcac = BaseMatterCertificate({
    subject: {
      icacId: TlvField(19, TlvUInt64),
      fabricId: TlvOptionalField(21, TlvFabricId)
    },
    issuer: AllowedSubjectAndIssuerMatterFields
  });
  OperationalCertificate2.TlvVvsc = BaseMatterCertificate({
    subject: {
      vvsId: TlvField(23, TlvUInt64)
    },
    issuer: AllowedSubjectAndIssuerMatterFields
  });
})(OperationalCertificate || (OperationalCertificate = {}));
export {
  MAX_TLV_CERTIFICATE_SIZE,
  OperationalCertificate,
  TlvCertificateExtension
};
//# sourceMappingURL=operational.js.map
