import crypto from "node:crypto";
const MAX_NAME_LENGTH = 120;
const PEM_BEGIN = "-----BEGIN CERTIFICATE-----";
const PEM_END = "-----END CERTIFICATE-----";
const JS_VARIABLE_REGEX = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
const JS_RESERVED_KEYWORDS = new Set([
    "break",
    "case",
    "catch",
    "class",
    "const",
    "continue",
    "debugger",
    "default",
    "delete",
    "do",
    "else",
    "export",
    "extends",
    "finally",
    "for",
    "function",
    "if",
    "import",
    "in",
    "instanceof",
    "let",
    "new",
    "return",
    "super",
    "switch",
    "this",
    "throw",
    "try",
    "typeof",
    "var",
    "void",
    "while",
    "with",
    "yield",
    "enum",
    "implements",
    "interface",
    "package",
    "private",
    "protected",
    "public",
    "static",
    "await",
]);
export function validateName(name) {
    if (name.length === 0) {
        return { message: "Name cannot be empty" };
    }
    if (name.length > MAX_NAME_LENGTH) {
        return {
            message: `Name must be ${MAX_NAME_LENGTH} characters or fewer (got ${name.length})`,
        };
    }
    if (!JS_VARIABLE_REGEX.test(name)) {
        return {
            message: "Name must be a valid JavaScript variable name (start with a letter, _, or $, and contain only letters, digits, _, or $)",
        };
    }
    if (JS_RESERVED_KEYWORDS.has(name.toLowerCase())) {
        return { message: "Name cannot be a JavaScript reserved keyword" };
    }
    return null;
}
export function parseAndValidateCaCertificate(pem, now = new Date()) {
    if (!pem.includes(PEM_BEGIN) || !pem.includes(PEM_END)) {
        if (/-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/.test(pem)) {
            return {
                message: "File is a private key, not a certificate",
                hint: "The `--cert` flag expects the public CA certificate, not a private key. " +
                    "CA certs only contain the public half; the private key stays with your PKI. " +
                    "If your CA is bundled in a single PEM file, pass it as-is — the certificate block will be picked up.",
            };
        }
        if (/-----BEGIN CERTIFICATE REQUEST-----/.test(pem)) {
            return {
                message: "File is a certificate signing request (CSR), not a certificate",
                hint: "A CSR is the request you send to a CA to get a certificate issued. Pass the issued CA certificate instead.",
            };
        }
        if (/-----BEGIN [A-Z0-9 ]+-----/.test(pem)) {
            return {
                message: "File is a PEM block but not a certificate",
                hint: `Expected a PEM block starting with "${PEM_BEGIN}".`,
            };
        }
        return {
            message: "File does not appear to be a PEM-encoded certificate",
            hint: `Expected to find "${PEM_BEGIN}" and "${PEM_END}" in the file.\n` +
                "If you have a DER-encoded certificate, convert it with:\n" +
                "  openssl x509 -in <file> -inform der -out cert.pem",
        };
    }
    let cert;
    try {
        cert = new crypto.X509Certificate(pem);
    }
    catch (err) {
        return {
            message: "Failed to parse certificate",
            hint: err instanceof Error ? err.message : String(err),
        };
    }
    if (!cert.ca) {
        return {
            message: "The certificate is not a CA certificate",
            hint: "Expected a certificate with the CA basic constraint set to TRUE " +
                "(typically the root or intermediate CA that signs your client certs), " +
                "not a leaf/client certificate.",
        };
    }
    const validTo = new Date(cert.validTo);
    if (!Number.isNaN(validTo.getTime()) && validTo < now) {
        return {
            message: `Certificate has already expired (validTo=${cert.validTo})`,
        };
    }
    return {
        subject: cert.subject,
        issuer: cert.issuer,
        validFrom: cert.validFrom,
        validTo: cert.validTo,
        serialNumber: cert.serialNumber,
        isCa: cert.ca,
    };
}
export function isValidationError(result) {
    return "message" in result;
}
//# sourceMappingURL=validation.js.map