"use strict";
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
var group_key_management_exports = {};
__export(group_key_management_exports, {
  GroupKeyManagement: () => GroupKeyManagement,
  GroupKeyManagementCluster: () => GroupKeyManagementCluster
});
module.exports = __toCommonJS(group_key_management_exports);
var import_MutableCluster = require("../cluster/mutation/MutableCluster.js");
var import_BitmapSchema = require("../schema/BitmapSchema.js");
var import_Cluster = require("../cluster/Cluster.js");
var import_TlvArray = require("../tlv/TlvArray.js");
var import_TlvObject = require("../tlv/TlvObject.js");
var import_GroupId = require("../datatype/GroupId.js");
var import_TlvNumber = require("../tlv/TlvNumber.js");
var import_FabricIndex = require("../datatype/FabricIndex.js");
var import_model = require("#model");
var import_EndpointNumber = require("../datatype/EndpointNumber.js");
var import_TlvString = require("../tlv/TlvString.js");
var import_TlvNullable = require("../tlv/TlvNullable.js");
var import_TlvNoArguments = require("../tlv/TlvNoArguments.js");
var import_ClusterRegistry = require("../cluster/ClusterRegistry.js");
/**
 * @license
 * Copyright 2022-2025 Matter.js Authors
 * SPDX-License-Identifier: Apache-2.0
 */
var GroupKeyManagement;
((GroupKeyManagement2) => {
  let Feature;
  ((Feature2) => {
    Feature2["CacheAndSync"] = "CacheAndSync";
  })(Feature = GroupKeyManagement2.Feature || (GroupKeyManagement2.Feature = {}));
  GroupKeyManagement2.TlvGroupKeyMap = (0, import_TlvObject.TlvObject)({
    /**
     * This field uniquely identifies the group within the scope of the given Fabric.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.5.3.1
     */
    groupId: (0, import_TlvObject.TlvField)(1, import_GroupId.TlvGroupId),
    /**
     * This field references the set of group keys that generate operational group keys for use with this group, as
     * specified in Section 4.17.3.5.1, “Group Key Set ID”.
     *
     * A GroupKeyMapStruct shall NOT accept GroupKeySetID of 0, which is reserved for the IPK.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.5.3.2
     */
    groupKeySetId: (0, import_TlvObject.TlvField)(2, import_TlvNumber.TlvUInt16.bound({ min: 1 })),
    fabricIndex: (0, import_TlvObject.TlvField)(254, import_FabricIndex.TlvFabricIndex)
  });
  GroupKeyManagement2.TlvGroupInfoMap = (0, import_TlvObject.TlvObject)({
    /**
     * This field uniquely identifies the group within the scope of the given Fabric.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.5.5.1
     */
    groupId: (0, import_TlvObject.TlvField)(1, import_GroupId.TlvGroupId),
    /**
     * This field provides the list of Endpoint IDs on the Node to which messages to this group shall be forwarded.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.5.5.2
     */
    endpoints: (0, import_TlvObject.TlvField)(2, (0, import_TlvArray.TlvArray)(import_EndpointNumber.TlvEndpointNumber, { minLength: 1 })),
    /**
     * This field provides a name for the group. This field shall contain the last GroupName written for a given
     * GroupId on any Endpoint via the Groups cluster.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.5.5.3
     */
    groupName: (0, import_TlvObject.TlvOptionalField)(3, import_TlvString.TlvString.bound({ maxLength: 16 })),
    fabricIndex: (0, import_TlvObject.TlvField)(254, import_FabricIndex.TlvFabricIndex)
  });
  let GroupKeySecurityPolicy;
  ((GroupKeySecurityPolicy2) => {
    GroupKeySecurityPolicy2[GroupKeySecurityPolicy2["TrustFirst"] = 0] = "TrustFirst";
    GroupKeySecurityPolicy2[GroupKeySecurityPolicy2["CacheAndSync"] = 1] = "CacheAndSync";
  })(GroupKeySecurityPolicy = GroupKeyManagement2.GroupKeySecurityPolicy || (GroupKeyManagement2.GroupKeySecurityPolicy = {}));
  let GroupKeyMulticastPolicy;
  ((GroupKeyMulticastPolicy2) => {
    GroupKeyMulticastPolicy2[GroupKeyMulticastPolicy2["PerGroupId"] = 0] = "PerGroupId";
    GroupKeyMulticastPolicy2[GroupKeyMulticastPolicy2["AllNodes"] = 1] = "AllNodes";
  })(GroupKeyMulticastPolicy = GroupKeyManagement2.GroupKeyMulticastPolicy || (GroupKeyManagement2.GroupKeyMulticastPolicy = {}));
  GroupKeyManagement2.TlvGroupKeySet = (0, import_TlvObject.TlvObject)({
    /**
     * This field shall provide the fabric-unique index for the associated group key set, as specified in Section
     * 4.17.3.5.1, “Group Key Set ID”.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.5.4.1
     */
    groupKeySetId: (0, import_TlvObject.TlvField)(0, import_TlvNumber.TlvUInt16),
    /**
     * This field shall provide the security policy for an operational group key set.
     *
     * When CacheAndSync is not supported in the FeatureMap of this cluster, any action attempting to set
     * CacheAndSync in the GroupKeySecurityPolicy field shall fail with an INVALID_COMMAND error.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.5.4.2
     */
    groupKeySecurityPolicy: (0, import_TlvObject.TlvField)(1, (0, import_TlvNumber.TlvEnum)()),
    /**
     * This field, if not null, shall be the root credential used in the derivation of an operational group key for
     * epoch slot 0 of the given group key set. If EpochKey0 is not null, EpochStartTime0 shall NOT be null.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.5.4.3
     */
    epochKey0: (0, import_TlvObject.TlvField)(2, (0, import_TlvNullable.TlvNullable)(import_TlvString.TlvByteString.bound({ length: 16 }))),
    /**
     * This field, if not null, shall define when EpochKey0 becomes valid as specified by Section 4.17.3, “Epoch
     * Keys”. Units are absolute UTC time in microseconds encoded using the epoch-us representation.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.5.4.4
     */
    epochStartTime0: (0, import_TlvObject.TlvField)(3, (0, import_TlvNullable.TlvNullable)(import_TlvNumber.TlvEpochUs)),
    /**
     * This field, if not null, shall be the root credential used in the derivation of an operational group key for
     * epoch slot 1 of the given group key set. If EpochKey1 is not null, EpochStartTime1 shall NOT be null.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.5.4.5
     */
    epochKey1: (0, import_TlvObject.TlvField)(4, (0, import_TlvNullable.TlvNullable)(import_TlvString.TlvByteString.bound({ length: 16 }))),
    /**
     * This field, if not null, shall define when EpochKey1 becomes valid as specified by Section 4.17.3, “Epoch
     * Keys”. Units are absolute UTC time in microseconds encoded using the epoch-us representation.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.5.4.6
     */
    epochStartTime1: (0, import_TlvObject.TlvField)(5, (0, import_TlvNullable.TlvNullable)(import_TlvNumber.TlvEpochUs)),
    /**
     * This field, if not null, shall be the root credential used in the derivation of an operational group key for
     * epoch slot 2 of the given group key set. If EpochKey2 is not null, EpochStartTime2 shall NOT be null.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.5.4.7
     */
    epochKey2: (0, import_TlvObject.TlvField)(6, (0, import_TlvNullable.TlvNullable)(import_TlvString.TlvByteString.bound({ length: 16 }))),
    /**
     * This field, if not null, shall define when EpochKey2 becomes valid as specified by Section 4.17.3, “Epoch
     * Keys”. Units are absolute UTC time in microseconds encoded using the epoch-us representation.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.5.4.8
     */
    epochStartTime2: (0, import_TlvObject.TlvField)(7, (0, import_TlvNullable.TlvNullable)(import_TlvNumber.TlvEpochUs)),
    /**
     * This field specifies how the IPv6 Multicast Address shall be formed for groups using this operational group
     * key set.
     *
     * The PerGroupID method maximizes filtering of multicast messages, so that receiving nodes receive only
     * multicast messages for groups to which they are subscribed.
     *
     * The AllNodes method minimizes the number of multicast addresses to which a receiver node needs to subscribe.
     *
     * > [!NOTE]
     *
     * > Support for GroupKeyMulticastPolicy is provisional. Correct default behavior is that implied by value
     *   PerGroupID.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.5.4.9
     */
    groupKeyMulticastPolicy: (0, import_TlvObject.TlvOptionalField)(8, (0, import_TlvNumber.TlvEnum)())
  });
  GroupKeyManagement2.TlvKeySetWriteRequest = (0, import_TlvObject.TlvObject)({ groupKeySet: (0, import_TlvObject.TlvField)(0, GroupKeyManagement2.TlvGroupKeySet) });
  GroupKeyManagement2.TlvKeySetReadRequest = (0, import_TlvObject.TlvObject)({ groupKeySetId: (0, import_TlvObject.TlvField)(0, import_TlvNumber.TlvUInt16) });
  GroupKeyManagement2.TlvKeySetReadResponse = (0, import_TlvObject.TlvObject)({ groupKeySet: (0, import_TlvObject.TlvField)(0, GroupKeyManagement2.TlvGroupKeySet) });
  GroupKeyManagement2.TlvKeySetRemoveRequest = (0, import_TlvObject.TlvObject)({ groupKeySetId: (0, import_TlvObject.TlvField)(0, import_TlvNumber.TlvUInt16) });
  GroupKeyManagement2.TlvKeySetReadAllIndicesResponse = (0, import_TlvObject.TlvObject)({
    /**
     * This field references the set of group keys that generate operational group keys for use with the accessing
     * fabric.
     *
     * Each entry in GroupKeySetIDs is a GroupKeySetID field.
     *
     * @see {@link MatterSpecification.v142.Core} § 11.2.7.6.1
     */
    groupKeySetIDs: (0, import_TlvObject.TlvField)(0, (0, import_TlvArray.TlvArray)(import_TlvNumber.TlvUInt16))
  });
  GroupKeyManagement2.Base = import_MutableCluster.MutableCluster.Component({
    id: 63,
    name: "GroupKeyManagement",
    revision: 2,
    features: {
      /**
       * The ability to support CacheAndSync security policy and MCSP.
       */
      cacheAndSync: (0, import_BitmapSchema.BitFlag)(0)
    },
    attributes: {
      /**
       * This attribute is a list of GroupKeyMapStruct entries. Each entry associates a logical Group Id with a
       * particular group key set.
       *
       * @see {@link MatterSpecification.v142.Core} § 11.2.6.1
       */
      groupKeyMap: (0, import_Cluster.WritableFabricScopedAttribute)(
        0,
        (0, import_TlvArray.TlvArray)(GroupKeyManagement2.TlvGroupKeyMap),
        { persistent: true, default: [], writeAcl: import_model.AccessLevel.Manage }
      ),
      /**
       * This attribute is a list of GroupInfoMapStruct entries. Each entry provides read-only information about
       * how a given logical Group ID maps to a particular set of endpoints, and a name for the group.
       *
       * The content of this attribute reflects data managed via the Groups cluster (see AppClusters), and is in
       * general terms referred to as the 'node-wide Group Table'.
       *
       * The GroupTable shall NOT contain any entry whose GroupInfoMapStruct has an empty Endpoints list. If a
       * RemoveGroup or RemoveAllGroups command causes the removal of a group mapping from its last mapped
       * endpoint, the entire GroupTable entry for that given GroupId shall be removed.
       *
       * @see {@link MatterSpecification.v142.Core} § 11.2.6.2
       */
      groupTable: (0, import_Cluster.FabricScopedAttribute)(1, (0, import_TlvArray.TlvArray)(GroupKeyManagement2.TlvGroupInfoMap), { default: [] }),
      /**
       * Indicates the maximum number of groups that this node supports per fabric. The value of this attribute
       * shall be set to be no less than the required minimum supported groups as specified in Section 2.11.1.2,
       * “Group Limits”. The length of the GroupKeyMap and GroupTable list attributes shall NOT exceed the value
       * of the MaxGroupsPerFabric attribute multiplied by the number of supported fabrics.
       *
       * @see {@link MatterSpecification.v142.Core} § 11.2.6.3
       */
      maxGroupsPerFabric: (0, import_Cluster.FixedAttribute)(2, import_TlvNumber.TlvUInt16, { default: 0 }),
      /**
       * Indicates the maximum number of group key sets this node supports per fabric. The value of this attribute
       * shall be set according to the minimum number of group key sets to support as specified in Section
       * 2.11.1.2, “Group Limits”.
       *
       * @see {@link MatterSpecification.v142.Core} § 11.2.6.4
       */
      maxGroupKeysPerFabric: (0, import_Cluster.FixedAttribute)(3, import_TlvNumber.TlvUInt16.bound({ min: 1 }), { default: 1 })
    },
    commands: {
      /**
       * This command is used by Administrators to set the state of a given Group Key Set, including atomically
       * updating the state of all epoch keys.
       *
       * ### Effect on Receipt
       *
       * The following validations shall be done against the content of the GroupKeySet field:
       *
       *   • If the EpochKey0 field is null or its associated EpochStartTime0 field is null, then this command
       *     shall fail with an INVALID_COMMAND status code responded to the client.
       *
       *   • If the EpochKey0 field’s length is not exactly 16 bytes, then this command shall fail with a
       *     CONSTRAINT_ERROR status code responded to the client.
       *
       *   • If the EpochStartTime0 is set to 0, then this command shall fail with an INVALID_COMMAND status code
       *     responded to the client. Note that internally, a GroupKeySetStruct’s EpochStartTime0 may be set to
       *     zero, due to the behavior of the AddNOC command which synthesizes a GroupKeySetStruct (see Section
       *     11.18.6.8.1, “IPKValue Field”). However, the value 0 is illegal in the GroupKeySet field sent by a
       *     client.
       *
       *   • If the EpochKey1 field is not null, then the EpochKey0 field shall NOT be null. Otherwise this
       *     command shall fail with an INVALID_COMMAND status code responded to the client.
       *
       *   • If the EpochKey1 field is not null, and the field’s length is not exactly 16 bytes, then this command
       *     shall fail with a CONSTRAINT_ERROR status code responded to the client.
       *
       *   • If the EpochKey1 field is not null, its associated EpochStartTime1 field shall NOT be null and shall
       *     contain a later epoch start time than the epoch start time found in the EpochStartTime0 field.
       *     Otherwise this command shall fail with an INVALID_COMMAND status code responded to the client.
       *
       *   • If exactly one of the EpochKey1 or EpochStartTime1 is null, rather than both being null, or neither
       *     being null, then this command shall fail with an INVALID_COMMAND status code responded to the client.
       *
       *   • If the EpochKey2 field is not null, then the EpochKey1 and EpochKey0 fields shall NOT be null.
       *     Otherwise this command shall fail with an INVALID_COMMAND status code responded to the client.
       *
       *   • If the EpochKey2 field is not null, and the field’s length is not exactly 16 bytes, then this command
       *     shall fail with a CONSTRAINT_ERROR status code responded to the client.
       *
       *   • If the EpochKey2 field is not null, its associated EpochStartTime2 field shall NOT be null and shall
       *     contain a later epoch start time than the epoch start time found in the EpochStartTime1 field.
       *     Otherwise this command shall fail with an INVALID_COMMAND status code responded to the client.
       *
       *   • If exactly one of the EpochKey2 or EpochStartTime2 is null, rather than both being null, or neither
       *     being null, then this command shall fail with an INVALID_COMMAND status code responded to the client.
       *
       * If there exists a Group Key Set associated with the accessing fabric which has the same GroupKeySetID as
       * that provided in the GroupKeySet field, then the contents of that group key set shall be replaced. A
       * replacement shall be done by executing the equivalent of entirely removing the previous Group Key Set
       * with the given GroupKeySetID, followed by an addition of a Group Key Set with the provided configuration.
       * Otherwise, if the GroupKeySetID did not match an existing entry, a new Group Key Set associated with the
       * accessing fabric shall be created with the provided data. The Group Key Set shall be written to
       * non-volatile storage.
       *
       * Upon completion, this command shall send a status code back to the initiator:
       *
       *   • If the Group Key Set was properly installed or updated on the Node, the status code shall be set to
       *     SUCCESS.
       *
       *   • If there are insufficient resources on the receiver to store an additional Group Key Set, the status
       *     code shall be set to RESOURCE_EXHAUSTED (see Section 2.11.1.2, “Group Limits”);
       *
       *   • Otherwise, this status code shall be set to FAILURE.
       *
       * @see {@link MatterSpecification.v142.Core} § 11.2.7.1
       */
      keySetWrite: (0, import_Cluster.Command)(0, GroupKeyManagement2.TlvKeySetWriteRequest, 0, import_Cluster.TlvNoResponse, { invokeAcl: import_model.AccessLevel.Administer }),
      /**
       * This command is used by Administrators to read the state of a given Group Key Set.
       *
       * ### Effect on Receipt
       *
       * If there exists a Group Key Set associated with the accessing fabric which has the same GroupKeySetID as
       * that provided in the GroupKeySetID field, then the contents of that Group Key Set shall be sent in a
       * KeySetReadResponse command, but with the EpochKey0, EpochKey1 and EpochKey2 fields replaced by null.
       *
       * Otherwise, if the GroupKeySetID does not refer to a Group Key Set associated with the accessing fabric,
       * then this command shall fail with a NOT_FOUND status code.
       *
       * @see {@link MatterSpecification.v142.Core} § 11.2.7.2
       */
      keySetRead: (0, import_Cluster.Command)(
        1,
        GroupKeyManagement2.TlvKeySetReadRequest,
        2,
        GroupKeyManagement2.TlvKeySetReadResponse,
        { invokeAcl: import_model.AccessLevel.Administer }
      ),
      /**
       * This command is used by Administrators to remove all state of a given Group Key Set.
       *
       * ### Effect on Receipt
       *
       * If there exists a Group Key Set associated with the accessing fabric which has the same GroupKeySetID as
       * that provided in the GroupKeySetID field, then the contents of that Group Key Set shall be removed,
       * including all epoch keys it contains.
       *
       * If there exist any entries for the accessing fabric within the GroupKeyMap attribute that refer to the
       * GroupKeySetID just removed, then these entries shall be removed from that list.
       *
       * This command shall fail with an INVALID_COMMAND status code back to the initiator if the GroupKeySetID
       * being removed is 0, which is the Key Set associated with the Identity Protection Key (IPK). The only
       * method to remove the IPK is usage of the RemoveFabric command or any operation which causes the
       * equivalent of a RemoveFabric to occur by side-effect.
       *
       * This command shall send a SUCCESS status code back to the initiator on success, or NOT_FOUND if the
       * GroupKeySetID requested did not exist.
       *
       * @see {@link MatterSpecification.v142.Core} § 11.2.7.4
       */
      keySetRemove: (0, import_Cluster.Command)(
        3,
        GroupKeyManagement2.TlvKeySetRemoveRequest,
        3,
        import_Cluster.TlvNoResponse,
        { invokeAcl: import_model.AccessLevel.Administer }
      ),
      /**
       * This command is used by Administrators to query a list of all Group Key Sets associated with the
       * accessing fabric.
       *
       * ### Effect on Receipt
       *
       * Upon receipt, this command shall iterate all stored GroupKeySetStruct associated with the accessing
       * fabric and generate a KeySetReadAllIndicesResponse command containing the list of GroupKeySetID values
       * from those structs.
       *
       * @see {@link MatterSpecification.v142.Core} § 11.2.7.5
       */
      keySetReadAllIndices: (0, import_Cluster.Command)(
        4,
        import_TlvNoArguments.TlvNoArguments,
        5,
        GroupKeyManagement2.TlvKeySetReadAllIndicesResponse,
        { invokeAcl: import_model.AccessLevel.Administer }
      )
    },
    /**
     * This metadata controls which GroupKeyManagementCluster elements matter.js activates for specific feature
     * combinations.
     */
    extensions: import_MutableCluster.MutableCluster.Extensions()
  });
  GroupKeyManagement2.ClusterInstance = (0, import_MutableCluster.MutableCluster)(GroupKeyManagement2.Base);
  GroupKeyManagement2.Cluster = GroupKeyManagement2.ClusterInstance;
  GroupKeyManagement2.Complete = GroupKeyManagement2.Cluster;
})(GroupKeyManagement || (GroupKeyManagement = {}));
const GroupKeyManagementCluster = GroupKeyManagement.Cluster;
import_ClusterRegistry.ClusterRegistry.register(GroupKeyManagement.Complete);
//# sourceMappingURL=group-key-management.js.map
