"use strict";
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
var access_control_exports = {};
__export(access_control_exports, {
  AccessControl: () => AccessControl,
  AccessControlCluster: () => AccessControlCluster
});
module.exports = __toCommonJS(access_control_exports);
var import_MutableCluster = require("../cluster/mutation/MutableCluster.js");
var import_Cluster = require("../cluster/Cluster.js");
var import_TlvArray = require("../tlv/TlvArray.js");
var import_TlvObject = require("../tlv/TlvObject.js");
var import_TlvNumber = require("../tlv/TlvNumber.js");
var import_SubjectId = require("../datatype/SubjectId.js");
var import_TlvNullable = require("../tlv/TlvNullable.js");
var import_ClusterId = require("../datatype/ClusterId.js");
var import_EndpointNumber = require("../datatype/EndpointNumber.js");
var import_DeviceTypeId = require("../datatype/DeviceTypeId.js");
var import_FabricIndex = require("../datatype/FabricIndex.js");
var import_model = require("#model");
var import_TlvString = require("../tlv/TlvString.js");
var import_NodeId = require("../datatype/NodeId.js");
var import_ClusterRegistry = require("../cluster/ClusterRegistry.js");
/**
 * @license
 * Copyright 2022-2025 Matter.js Authors
 * SPDX-License-Identifier: Apache-2.0
 */
var AccessControl;
((AccessControl2) => {
  let AccessControlEntryPrivilege;
  ((AccessControlEntryPrivilege2) => {
    AccessControlEntryPrivilege2[AccessControlEntryPrivilege2["View"] = 1] = "View";
    AccessControlEntryPrivilege2[AccessControlEntryPrivilege2["ProxyView"] = 2] = "ProxyView";
    AccessControlEntryPrivilege2[AccessControlEntryPrivilege2["Operate"] = 3] = "Operate";
    AccessControlEntryPrivilege2[AccessControlEntryPrivilege2["Manage"] = 4] = "Manage";
    AccessControlEntryPrivilege2[AccessControlEntryPrivilege2["Administer"] = 5] = "Administer";
  })(AccessControlEntryPrivilege = AccessControl2.AccessControlEntryPrivilege || (AccessControl2.AccessControlEntryPrivilege = {}));
  let AccessControlEntryAuthMode;
  ((AccessControlEntryAuthMode2) => {
    AccessControlEntryAuthMode2[AccessControlEntryAuthMode2["Pase"] = 1] = "Pase";
    AccessControlEntryAuthMode2[AccessControlEntryAuthMode2["Case"] = 2] = "Case";
    AccessControlEntryAuthMode2[AccessControlEntryAuthMode2["Group"] = 3] = "Group";
  })(AccessControlEntryAuthMode = AccessControl2.AccessControlEntryAuthMode || (AccessControl2.AccessControlEntryAuthMode = {}));
  AccessControl2.TlvAccessControlTarget = (0, import_TlvObject.TlvObject)({
    cluster: (0, import_TlvObject.TlvField)(0, (0, import_TlvNullable.TlvNullable)(import_ClusterId.TlvClusterId)),
    endpoint: (0, import_TlvObject.TlvField)(1, (0, import_TlvNullable.TlvNullable)(import_EndpointNumber.TlvEndpointNumber)),
    deviceType: (0, import_TlvObject.TlvField)(2, (0, import_TlvNullable.TlvNullable)(import_DeviceTypeId.TlvDeviceTypeId))
  });
  AccessControl2.TlvAccessControlEntry = (0, import_TlvObject.TlvObject)({
    /**
     * The privilege field shall specify the level of privilege granted by this Access Control Entry.
     *
     * NOTE The Proxy View privilege is provisional.
     *
     * Each privilege builds upon its predecessor, expanding the set of actions that can be performed upon a Node.
     * Administer is the highest privilege, and is special as it pertains to the administration of privileges
     * itself, via the Access Control Cluster.
     *
     * When a Node is granted a particular privilege, it is also implicitly granted all logically lower privilege
     * levels as well. The following diagram illustrates how the higher privilege levels subsume the lower
     * privilege levels:
     *
     * Figure 43. Access Control Privilege Levels
     *
     * Individual clusters shall define whether attributes are readable, writable, or both readable and writable.
     * Clusters also shall define which privilege is minimally required to be able to perform a particular read or
     * write action on those attributes, or invoke particular commands. Device type specifications may further
     * restrict the privilege required.
     *
     * The Access Control Cluster shall require the Administer privilege to observe and modify the Access Control
     * Cluster itself. The Administer privilege shall NOT be used on Access Control Entries which use the Group
     * auth mode.
     *
     * @see {@link MatterSpecification.v13.Core} § 9.10.4.5.1
     */
    privilege: (0, import_TlvObject.TlvField)(1, (0, import_TlvNumber.TlvEnum)()),
    /**
     * The AuthMode field shall specify the authentication mode required by this Access Control Entry.
     *
     * @see {@link MatterSpecification.v13.Core} § 9.10.4.5.2
     */
    authMode: (0, import_TlvObject.TlvField)(2, (0, import_TlvNumber.TlvEnum)()),
    /**
     * The subjects field shall specify a list of Subject IDs, to which this Access Control Entry grants access.
     *
     * Device types may impose additional constraints on the minimum number of subjects per Access Control Entry.
     *
     * An attempt to create an entry with more subjects than the node can support shall result in a
     * RESOURCE_EXHAUSTED error and the entry shall NOT be created.
     *
     * ### Subject ID shall be of type uint64 with semantics depending on the entry’s AuthMode as follows:
     *
     * Subject Semantics
     *
     * An empty subjects list indicates a wildcard; that is, this entry shall grant access to any Node that
     * successfully authenticates via AuthMode. The subjects list shall NOT be empty if the entry’s AuthMode is
     * PASE.
     *
     * The PASE AuthMode is reserved for future use (see Section 6.6.2.8, “Bootstrapping of the Access Control
     * Cluster”). An attempt to write an entry with AuthMode set to PASE shall fail with a status code of
     * CONSTRAINT_ERROR.
     *
     * For PASE authentication, the Passcode ID identifies the required passcode verifier, and shall be 0 for the
     * default commissioning passcode.
     *
     * For CASE authentication, the Subject ID is a distinguished name within the Operational Certificate shared
     * during CASE session establishment, the type of which is determined by its range to be one of:
     *
     *   • a Node ID, which identifies the required source node directly (by ID)
     *
     *   • a CASE Authenticated Tag, which identifies the required source node indirectly (by tag)
     *
     * For Group authentication, the Group ID identifies the required group, as defined in the Group Key Management
     * Cluster.
     *
     * @see {@link MatterSpecification.v13.Core} § 9.10.4.5.3
     */
    subjects: (0, import_TlvObject.TlvField)(3, (0, import_TlvNullable.TlvNullable)((0, import_TlvArray.TlvArray)(import_SubjectId.TlvSubjectId))),
    /**
     * The targets field shall specify a list of AccessControlTargetStruct, which define the clusters on this Node
     * to which this Access Control Entry grants access.
     *
     * Device types may impose additional constraints on the minimum number of targets per Access Control Entry.
     *
     * An attempt to create an entry with more targets than the node can support shall result in a
     * RESOURCE_EXHAUSTED error and the entry shall NOT be created.
     *
     * A single target shall contain at least one field (Cluster, Endpoint, or DeviceType), and shall NOT contain
     * both an Endpoint field and a DeviceType field.
     *
     * A target grants access based on the presence of fields as follows:
     *
     * Target Semantics
     *
     * An empty targets list indicates a wildcard: that is, this entry shall grant access to all cluster instances
     * on all endpoints on this Node.
     *
     * @see {@link MatterSpecification.v13.Core} § 9.10.4.5.4
     */
    targets: (0, import_TlvObject.TlvField)(4, (0, import_TlvNullable.TlvNullable)((0, import_TlvArray.TlvArray)(AccessControl2.TlvAccessControlTarget))),
    fabricIndex: (0, import_TlvObject.TlvField)(254, import_FabricIndex.TlvFabricIndex)
  });
  AccessControl2.TlvAccessControlExtension = (0, import_TlvObject.TlvObject)({
    /**
     * This field may be used by manufacturers to store arbitrary TLV-encoded data related to a fabric’s Access
     * Control Entries.
     *
     * The contents shall consist of a top-level anonymous list; each list element shall include a profile-specific
     * tag encoded in fully-qualified form.
     *
     * Administrators may iterate over this list of elements, and interpret selected elements at their discretion.
     * The content of each element is not specified, but may be coordinated among manufacturers at their discretion.
     *
     * @see {@link MatterSpecification.v13.Core} § 9.10.4.6.1
     */
    data: (0, import_TlvObject.TlvField)(1, import_TlvString.TlvByteString.bound({ maxLength: 128 })),
    fabricIndex: (0, import_TlvObject.TlvField)(254, import_FabricIndex.TlvFabricIndex)
  });
  let ChangeType;
  ((ChangeType2) => {
    ChangeType2[ChangeType2["Changed"] = 0] = "Changed";
    ChangeType2[ChangeType2["Added"] = 1] = "Added";
    ChangeType2[ChangeType2["Removed"] = 2] = "Removed";
  })(ChangeType = AccessControl2.ChangeType || (AccessControl2.ChangeType = {}));
  AccessControl2.TlvAccessControlEntryChangedEvent = (0, import_TlvObject.TlvObject)({
    /**
     * The Node ID of the Administrator that made the change, if the change occurred via a CASE session.
     *
     * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
     * CASE or PASE session; the other shall be null.
     *
     * @see {@link MatterSpecification.v13.Core} § 9.10.7.1.1
     */
    adminNodeId: (0, import_TlvObject.TlvField)(1, (0, import_TlvNullable.TlvNullable)(import_NodeId.TlvNodeId)),
    /**
     * The Passcode ID of the Administrator that made the change, if the change occurred via a PASE session.
     * Non-zero values are reserved for future use (see PasscodeId generation in PBKDFParamRequest).
     *
     * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
     * CASE or PASE session; the other shall be null.
     *
     * @see {@link MatterSpecification.v13.Core} § 9.10.7.1.2
     */
    adminPasscodeId: (0, import_TlvObject.TlvField)(2, (0, import_TlvNullable.TlvNullable)(import_TlvNumber.TlvUInt16)),
    /**
     * The type of change as appropriate.
     *
     * @see {@link MatterSpecification.v13.Core} § 9.10.7.1.3
     */
    changeType: (0, import_TlvObject.TlvField)(3, (0, import_TlvNumber.TlvEnum)()),
    /**
     * The latest value of the changed entry.
     *
     * This field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources
     * are scarce.
     *
     * @see {@link MatterSpecification.v13.Core} § 9.10.7.1.4
     */
    latestValue: (0, import_TlvObject.TlvField)(4, (0, import_TlvNullable.TlvNullable)(AccessControl2.TlvAccessControlEntry)),
    fabricIndex: (0, import_TlvObject.TlvField)(254, import_FabricIndex.TlvFabricIndex)
  });
  AccessControl2.TlvAccessControlExtensionChangedEvent = (0, import_TlvObject.TlvObject)({
    /**
     * The Node ID of the Administrator that made the change, if the change occurred via a CASE session.
     *
     * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
     * CASE or PASE session; the other shall be null.
     *
     * @see {@link MatterSpecification.v13.Core} § 9.10.7.2.1
     */
    adminNodeId: (0, import_TlvObject.TlvField)(1, (0, import_TlvNullable.TlvNullable)(import_NodeId.TlvNodeId)),
    /**
     * The Passcode ID of the Administrator that made the change, if the change occurred via a PASE session.
     * Non-zero values are reserved for future use (see PasscodeId generation in PBKDFParamRequest).
     *
     * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
     * CASE or PASE session; the other shall be null.
     *
     * @see {@link MatterSpecification.v13.Core} § 9.10.7.2.2
     */
    adminPasscodeId: (0, import_TlvObject.TlvField)(2, (0, import_TlvNullable.TlvNullable)(import_TlvNumber.TlvUInt16)),
    /**
     * The type of change as appropriate.
     *
     * @see {@link MatterSpecification.v13.Core} § 9.10.7.2.3
     */
    changeType: (0, import_TlvObject.TlvField)(3, (0, import_TlvNumber.TlvEnum)()),
    /**
     * The latest value of the changed extension.
     *
     * This field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources
     * are scarce.
     *
     * @see {@link MatterSpecification.v13.Core} § 9.10.7.2.4
     */
    latestValue: (0, import_TlvObject.TlvField)(4, (0, import_TlvNullable.TlvNullable)(AccessControl2.TlvAccessControlExtension)),
    fabricIndex: (0, import_TlvObject.TlvField)(254, import_FabricIndex.TlvFabricIndex)
  });
  AccessControl2.ClusterInstance = (0, import_MutableCluster.MutableCluster)({
    id: 31,
    name: "AccessControl",
    revision: 1,
    attributes: {
      /**
       * An attempt to add an Access Control Entry when no more entries are available shall result in a
       * RESOURCE_EXHAUSTED error being reported and the ACL attribute shall NOT have the entry added to it. See
       * access control limits.
       *
       * See the AccessControlEntriesPerFabric attribute for the actual value of the number of entries per fabric
       * supported by the server.
       *
       * Each Access Control Entry codifies a single grant of privilege on this Node, and is used by the Access
       * Control Privilege Granting algorithm to determine if a subject has privilege to interact with targets on
       * the Node.
       *
       * @see {@link MatterSpecification.v13.Core} § 9.10.5.3
       */
      acl: (0, import_Cluster.WritableFabricScopedAttribute)(
        0,
        (0, import_TlvArray.TlvArray)(AccessControl2.TlvAccessControlEntry),
        { default: [], readAcl: import_model.AccessLevel.Administer, writeAcl: import_model.AccessLevel.Administer }
      ),
      /**
       * If present, the Access Control Extensions may be used by Administrators to store arbitrary data related
       * to fabric’s Access Control Entries.
       *
       * The Access Control Extension list shall support a single extension entry per supported fabric.
       *
       * @see {@link MatterSpecification.v13.Core} § 9.10.5.4
       */
      extension: (0, import_Cluster.OptionalWritableFabricScopedAttribute)(
        1,
        (0, import_TlvArray.TlvArray)(AccessControl2.TlvAccessControlExtension),
        { default: [], readAcl: import_model.AccessLevel.Administer, writeAcl: import_model.AccessLevel.Administer }
      ),
      /**
       * This attribute shall provide the minimum number of Subjects per entry that are supported by this server.
       *
       * Since reducing this value over time may invalidate ACL entries already written, this value shall NOT
       * decrease across time as software updates occur that could impact this value. If this is a concern for a
       * given implementation, it is recommended to only use the minimum value required and avoid reporting a
       * higher value than the required minimum.
       *
       * @see {@link MatterSpecification.v13.Core} § 9.10.5.5
       */
      subjectsPerAccessControlEntry: (0, import_Cluster.FixedAttribute)(2, import_TlvNumber.TlvUInt16.bound({ min: 4 }), { default: 4 }),
      /**
       * This attribute shall provide the minimum number of Targets per entry that are supported by this server.
       *
       * Since reducing this value over time may invalidate ACL entries already written, this value shall NOT
       * decrease across time as software updates occur that could impact this value. If this is a concern for a
       * given implementation, it is recommended to only use the minimum value required and avoid reporting a
       * higher value than the required minimum.
       *
       * @see {@link MatterSpecification.v13.Core} § 9.10.5.6
       */
      targetsPerAccessControlEntry: (0, import_Cluster.FixedAttribute)(3, import_TlvNumber.TlvUInt16.bound({ min: 3 }), { default: 3 }),
      /**
       * This attribute shall provide the minimum number of ACL Entries per fabric that are supported by this
       * server.
       *
       * Since reducing this value over time may invalidate ACL entries already written, this value shall NOT
       * decrease across time as software updates occur that could impact this value. If this is a concern for a
       * given implementation, it is recommended to only use the minimum value required and avoid reporting a
       * higher value than the required minimum.
       *
       * @see {@link MatterSpecification.v13.Core} § 9.10.5.7
       */
      accessControlEntriesPerFabric: (0, import_Cluster.FixedAttribute)(4, import_TlvNumber.TlvUInt16.bound({ min: 4 }), { default: 4 })
    },
    events: {
      /**
       * The cluster shall send AccessControlEntryChanged events whenever its ACL attribute data is changed by an
       * Administrator.
       *
       *   • Each added entry shall generate an event with ChangeType Added.
       *
       *   • Each changed entry shall generate an event with ChangeType Changed.
       *
       *   • Each removed entry shall generate an event with ChangeType Removed.
       *
       * @see {@link MatterSpecification.v13.Core} § 9.10.7.1
       */
      accessControlEntryChanged: (0, import_Cluster.Event)(
        0,
        import_Cluster.EventPriority.Info,
        AccessControl2.TlvAccessControlEntryChangedEvent,
        { readAcl: import_model.AccessLevel.Administer }
      ),
      /**
       * The cluster shall send AccessControlExtensionChanged events whenever its extension attribute data is
       * changed by an Administrator.
       *
       *   • Each added extension shall generate an event with ChangeType Added.
       *
       *   • Each changed extension shall generate an event with ChangeType Changed.
       *
       *   • Each removed extension shall generate an event with ChangeType Removed.
       *
       * @see {@link MatterSpecification.v13.Core} § 9.10.7.2
       */
      accessControlExtensionChanged: (0, import_Cluster.Event)(
        1,
        import_Cluster.EventPriority.Info,
        AccessControl2.TlvAccessControlExtensionChangedEvent,
        { readAcl: import_model.AccessLevel.Administer }
      )
    }
  });
  AccessControl2.Cluster = AccessControl2.ClusterInstance;
  AccessControl2.Complete = AccessControl2.Cluster;
})(AccessControl || (AccessControl = {}));
const AccessControlCluster = AccessControl.Cluster;
import_ClusterRegistry.ClusterRegistry.register(AccessControl.Complete);
//# sourceMappingURL=access-control.js.map
