@matter/model 0.11.9-alpha.0-20241206-22f233334 → 0.11.9-alpha.0-20241207-b604cfa44

package/dist/cjs/standard/elements/AccessControl.js

@@ -28,16 +28,18 @@ var import_elements = require("../../elements/index.js");
  * Copyright 2022-2024 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
-const AccessControl = (0, import_elements.ClusterElement)({
-  name: "AccessControl",
-  id: 31,
-  classification: "node",
-  pics: "ACL",
-  details: 'The Access Control Cluster exposes a data model view of a Node\u2019s Access Control List (ACL), which codifies the rules used to manage and enforce Access Control for the Node\u2019s endpoints and their associated cluster instances. Access to this Access Control Cluster itself requires a special Administer privilege level, such that only Nodes granted such privilege (hereafter termed "Administrators") can manage the Access Control Cluster.\nThe Access Control Cluster shall be present on the root node endpoint of each Node, and shall NOT be present on any other Endpoint of any Node.',
-  xref: { document: "core", section: "9.10" },
-  children: [
-    (0, import_elements.AttributeElement)({ name: "ClusterRevision", id: 65533, type: "ClusterRevision", default: 1 }),
-    (0, import_elements.AttributeElement)({
+const AccessControl = (0, import_elements.ClusterElement)(
+  {
+    name: "AccessControl",
+    id: 31,
+    classification: "node",
+    pics: "ACL",
+    details: 'The Access Control Cluster exposes a data model view of a Node\u2019s Access Control List (ACL), which codifies the rules used to manage and enforce Access Control for the Node\u2019s endpoints and their associated cluster instances. Access to this Access Control Cluster itself requires a special Administer privilege level, such that only Nodes granted such privilege (hereafter termed "Administrators") can manage the Access Control Cluster.\nThe Access Control Cluster shall be present on the root node endpoint of each Node, and shall NOT be present on any other Endpoint of any Node.',
+    xref: { document: "core", section: "9.10" }
+  },
+  (0, import_elements.AttributeElement)({ name: "ClusterRevision", id: 65533, type: "ClusterRevision", default: 1 }),
+  (0, import_elements.AttributeElement)(
+    {
       name: "Acl",
       id: 0,
       type: "list",
@@ -45,10 +47,12 @@ const AccessControl = (0, import_elements.ClusterElement)({
       conformance: "M",
       constraint: "desc",
       details: "An attempt to add an Access Control Entry when no more entries are available shall result in a RESOURCE_EXHAUSTED error being reported and the ACL attribute shall NOT have the entry added to it. See access control limits.\nSee the AccessControlEntriesPerFabric attribute for the actual value of the number of entries per fabric supported by the server.\nEach Access Control Entry codifies a single grant of privilege on this Node, and is used by the Access Control Privilege Granting algorithm to determine if a subject has privilege to interact with targets on the Node.",
-      xref: { document: "core", section: "9.10.5.3" },
-      children: [(0, import_elements.FieldElement)({ name: "entry", type: "AccessControlEntryStruct" })]
-    }),
-    (0, import_elements.AttributeElement)({
+      xref: { document: "core", section: "9.10.5.3" }
+    },
+    (0, import_elements.FieldElement)({ name: "entry", type: "AccessControlEntryStruct" })
+  ),
+  (0, import_elements.AttributeElement)(
+    {
       name: "Extension",
       id: 1,
       type: "list",
@@ -56,294 +60,278 @@ const AccessControl = (0, import_elements.ClusterElement)({
       conformance: "O",
       constraint: "desc",
       details: "If present, the Access Control Extensions may be used by Administrators to store arbitrary data related to fabric\u2019s Access Control Entries.\nThe Access Control Extension list shall support a single extension entry per supported fabric.",
-      xref: { document: "core", section: "9.10.5.4" },
-      children: [(0, import_elements.FieldElement)({ name: "entry", type: "AccessControlExtensionStruct" })]
+      xref: { document: "core", section: "9.10.5.4" }
+    },
+    (0, import_elements.FieldElement)({ name: "entry", type: "AccessControlExtensionStruct" })
+  ),
+  (0, import_elements.AttributeElement)({
+    name: "SubjectsPerAccessControlEntry",
+    id: 2,
+    type: "uint16",
+    access: "R V",
+    conformance: "M",
+    constraint: "min 4",
+    default: 4,
+    quality: "F",
+    details: "This attribute shall provide the minimum number of Subjects per entry that are supported by this server.\nSince reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum.",
+    xref: { document: "core", section: "9.10.5.5" }
+  }),
+  (0, import_elements.AttributeElement)({
+    name: "TargetsPerAccessControlEntry",
+    id: 3,
+    type: "uint16",
+    access: "R V",
+    conformance: "M",
+    constraint: "min 3",
+    default: 3,
+    quality: "F",
+    details: "This attribute shall provide the minimum number of Targets per entry that are supported by this server.\nSince reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum.",
+    xref: { document: "core", section: "9.10.5.6" }
+  }),
+  (0, import_elements.AttributeElement)({
+    name: "AccessControlEntriesPerFabric",
+    id: 4,
+    type: "uint16",
+    access: "R V",
+    conformance: "M",
+    constraint: "min 4",
+    default: 4,
+    quality: "F",
+    details: "This attribute shall provide the minimum number of ACL Entries per fabric that are supported by this server.\nSince reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum.",
+    xref: { document: "core", section: "9.10.5.7" }
+  }),
+  (0, import_elements.EventElement)(
+    {
+      name: "AccessControlEntryChanged",
+      id: 0,
+      access: "S A",
+      conformance: "M",
+      priority: "info",
+      details: "The cluster shall send AccessControlEntryChanged events whenever its ACL attribute data is changed by an Administrator.\n  \u2022 Each added entry shall generate an event with ChangeType Added.\n  \u2022 Each changed entry shall generate an event with ChangeType Changed.\n  \u2022 Each removed entry shall generate an event with ChangeType Removed.",
+      xref: { document: "core", section: "9.10.7.1" }
+    },
+    (0, import_elements.FieldElement)({
+      name: "AdminNodeId",
+      id: 1,
+      type: "node-id",
+      access: "S",
+      conformance: "M",
+      constraint: "desc",
+      quality: "X",
+      details: "The Node ID of the Administrator that made the change, if the change occurred via a CASE session.\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null.",
+      xref: { document: "core", section: "9.10.7.1.1" }
     }),
-    (0, import_elements.AttributeElement)({
-      name: "SubjectsPerAccessControlEntry",
+    (0, import_elements.FieldElement)({
+      name: "AdminPasscodeId",
       id: 2,
       type: "uint16",
-      access: "R V",
+      access: "S",
       conformance: "M",
-      constraint: "min 4",
-      default: 4,
-      quality: "F",
-      details: "This attribute shall provide the minimum number of Subjects per entry that are supported by this server.\nSince reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum.",
-      xref: { document: "core", section: "9.10.5.5" }
+      constraint: "desc",
+      quality: "X",
+      details: "The Passcode ID of the Administrator that made the change, if the change occurred via a PASE session. Non-zero values are reserved for future use (see PasscodeId generation in PBKDFParamRequest).\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null.",
+      xref: { document: "core", section: "9.10.7.1.2" }
     }),
-    (0, import_elements.AttributeElement)({
-      name: "TargetsPerAccessControlEntry",
+    (0, import_elements.FieldElement)({
+      name: "ChangeType",
       id: 3,
-      type: "uint16",
-      access: "R V",
+      type: "ChangeTypeEnum",
+      access: "S",
       conformance: "M",
-      constraint: "min 3",
-      default: 3,
-      quality: "F",
-      details: "This attribute shall provide the minimum number of Targets per entry that are supported by this server.\nSince reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum.",
-      xref: { document: "core", section: "9.10.5.6" }
+      details: "The type of change as appropriate.",
+      xref: { document: "core", section: "9.10.7.1.3" }
     }),
-    (0, import_elements.AttributeElement)({
-      name: "AccessControlEntriesPerFabric",
+    (0, import_elements.FieldElement)({
+      name: "LatestValue",
       id: 4,
-      type: "uint16",
-      access: "R V",
+      type: "AccessControlEntryStruct",
+      access: "S",
       conformance: "M",
-      constraint: "min 4",
-      default: 4,
-      quality: "F",
-      details: "This attribute shall provide the minimum number of ACL Entries per fabric that are supported by this server.\nSince reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum.",
-      xref: { document: "core", section: "9.10.5.7" }
+      quality: "X",
+      details: "The latest value of the changed entry.\nThis field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources are scarce.",
+      xref: { document: "core", section: "9.10.7.1.4" }
     }),
-    (0, import_elements.EventElement)({
-      name: "AccessControlEntryChanged",
-      id: 0,
-      access: "S A",
-      conformance: "M",
-      priority: "info",
-      details: "The cluster shall send AccessControlEntryChanged events whenever its ACL attribute data is changed by an Administrator.\n  \u2022 Each added entry shall generate an event with ChangeType Added.\n  \u2022 Each changed entry shall generate an event with ChangeType Changed.\n  \u2022 Each removed entry shall generate an event with ChangeType Removed.",
-      xref: { document: "core", section: "9.10.7.1" },
-      children: [
-        (0, import_elements.FieldElement)({
-          name: "AdminNodeId",
-          id: 1,
-          type: "node-id",
-          access: "S",
-          conformance: "M",
-          constraint: "desc",
-          quality: "X",
-          details: "The Node ID of the Administrator that made the change, if the change occurred via a CASE session.\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null.",
-          xref: { document: "core", section: "9.10.7.1.1" }
-        }),
-        (0, import_elements.FieldElement)({
-          name: "AdminPasscodeId",
-          id: 2,
-          type: "uint16",
-          access: "S",
-          conformance: "M",
-          constraint: "desc",
-          quality: "X",
-          details: "The Passcode ID of the Administrator that made the change, if the change occurred via a PASE session. Non-zero values are reserved for future use (see PasscodeId generation in PBKDFParamRequest).\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null.",
-          xref: { document: "core", section: "9.10.7.1.2" }
-        }),
-        (0, import_elements.FieldElement)({
-          name: "ChangeType",
-          id: 3,
-          type: "ChangeTypeEnum",
-          access: "S",
-          conformance: "M",
-          details: "The type of change as appropriate.",
-          xref: { document: "core", section: "9.10.7.1.3" }
-        }),
-        (0, import_elements.FieldElement)({
-          name: "LatestValue",
-          id: 4,
-          type: "AccessControlEntryStruct",
-          access: "S",
-          conformance: "M",
-          quality: "X",
-          details: "The latest value of the changed entry.\nThis field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources are scarce.",
-          xref: { document: "core", section: "9.10.7.1.4" }
-        }),
-        (0, import_elements.FieldElement)({ name: "FabricIndex", id: 254, type: "FabricIndex" })
-      ]
-    }),
-    (0, import_elements.EventElement)({
+    (0, import_elements.FieldElement)({ name: "FabricIndex", id: 254, type: "FabricIndex" })
+  ),
+  (0, import_elements.EventElement)(
+    {
       name: "AccessControlExtensionChanged",
       id: 1,
       access: "S A",
       conformance: "M",
       priority: "info",
       details: "The cluster shall send AccessControlExtensionChanged events whenever its extension attribute data is changed by an Administrator.\n  \u2022 Each added extension shall generate an event with ChangeType Added.\n  \u2022 Each changed extension shall generate an event with ChangeType Changed.\n  \u2022 Each removed extension shall generate an event with ChangeType Removed.",
-      xref: { document: "core", section: "9.10.7.2" },
-      children: [
-        (0, import_elements.FieldElement)({
-          name: "AdminNodeId",
-          id: 1,
-          type: "node-id",
-          access: "S",
-          conformance: "M",
-          constraint: "desc",
-          quality: "X",
-          details: "The Node ID of the Administrator that made the change, if the change occurred via a CASE session.\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null.",
-          xref: { document: "core", section: "9.10.7.2.1" }
-        }),
-        (0, import_elements.FieldElement)({
-          name: "AdminPasscodeId",
-          id: 2,
-          type: "uint16",
-          access: "S",
-          conformance: "M",
-          constraint: "desc",
-          quality: "X",
-          details: "The Passcode ID of the Administrator that made the change, if the change occurred via a PASE session. Non-zero values are reserved for future use (see PasscodeId generation in PBKDFParamRequest).\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null.",
-          xref: { document: "core", section: "9.10.7.2.2" }
-        }),
-        (0, import_elements.FieldElement)({
-          name: "ChangeType",
-          id: 3,
-          type: "ChangeTypeEnum",
-          access: "S",
-          conformance: "M",
-          details: "The type of change as appropriate.",
-          xref: { document: "core", section: "9.10.7.2.3" }
-        }),
-        (0, import_elements.FieldElement)({
-          name: "LatestValue",
-          id: 4,
-          type: "AccessControlExtensionStruct",
-          access: "S",
-          conformance: "M",
-          quality: "X",
-          details: "The latest value of the changed extension.\nThis field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources are scarce.",
-          xref: { document: "core", section: "9.10.7.2.4" }
-        }),
-        (0, import_elements.FieldElement)({ name: "FabricIndex", id: 254, type: "FabricIndex" })
-      ]
+      xref: { document: "core", section: "9.10.7.2" }
+    },
+    (0, import_elements.FieldElement)({
+      name: "AdminNodeId",
+      id: 1,
+      type: "node-id",
+      access: "S",
+      conformance: "M",
+      constraint: "desc",
+      quality: "X",
+      details: "The Node ID of the Administrator that made the change, if the change occurred via a CASE session.\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null.",
+      xref: { document: "core", section: "9.10.7.2.1" }
     }),
-    (0, import_elements.DatatypeElement)({
-      name: "ChangeTypeEnum",
-      type: "enum8",
-      xref: { document: "core", section: "9.10.4.1" },
-      children: [
-        (0, import_elements.FieldElement)({ name: "Changed", id: 0, conformance: "M", description: "Entry or extension was changed" }),
-        (0, import_elements.FieldElement)({ name: "Added", id: 1, conformance: "M", description: "Entry or extension was added" }),
-        (0, import_elements.FieldElement)({ name: "Removed", id: 2, conformance: "M", description: "Entry or extension was removed" })
-      ]
+    (0, import_elements.FieldElement)({
+      name: "AdminPasscodeId",
+      id: 2,
+      type: "uint16",
+      access: "S",
+      conformance: "M",
+      constraint: "desc",
+      quality: "X",
+      details: "The Passcode ID of the Administrator that made the change, if the change occurred via a PASE session. Non-zero values are reserved for future use (see PasscodeId generation in PBKDFParamRequest).\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null.",
+      xref: { document: "core", section: "9.10.7.2.2" }
+    }),
+    (0, import_elements.FieldElement)({
+      name: "ChangeType",
+      id: 3,
+      type: "ChangeTypeEnum",
+      access: "S",
+      conformance: "M",
+      details: "The type of change as appropriate.",
+      xref: { document: "core", section: "9.10.7.2.3" }
+    }),
+    (0, import_elements.FieldElement)({
+      name: "LatestValue",
+      id: 4,
+      type: "AccessControlExtensionStruct",
+      access: "S",
+      conformance: "M",
+      quality: "X",
+      details: "The latest value of the changed extension.\nThis field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources are scarce.",
+      xref: { document: "core", section: "9.10.7.2.4" }
     }),
-    (0, import_elements.DatatypeElement)({
+    (0, import_elements.FieldElement)({ name: "FabricIndex", id: 254, type: "FabricIndex" })
+  ),
+  (0, import_elements.DatatypeElement)(
+    { name: "ChangeTypeEnum", type: "enum8", xref: { document: "core", section: "9.10.4.1" } },
+    (0, import_elements.FieldElement)({ name: "Changed", id: 0, conformance: "M", description: "Entry or extension was changed" }),
+    (0, import_elements.FieldElement)({ name: "Added", id: 1, conformance: "M", description: "Entry or extension was added" }),
+    (0, import_elements.FieldElement)({ name: "Removed", id: 2, conformance: "M", description: "Entry or extension was removed" })
+  ),
+  (0, import_elements.DatatypeElement)(
+    {
       name: "AccessControlEntryPrivilegeEnum",
       type: "enum8",
       details: "Proxy View Value\nThis value implicitly grants View privileges",
-      xref: { document: "core", section: "9.10.4.2" },
-      children: [
-        (0, import_elements.FieldElement)({
-          name: "View",
-          id: 1,
-          conformance: "M",
-          description: "Can read and observe all (except Access Control Cluster and as seen by a non-Proxy)"
-        }),
-        (0, import_elements.FieldElement)({
-          name: "ProxyView",
-          id: 2,
-          conformance: "P, M",
-          description: "Can read and observe all (as seen by a Proxy)"
-        }),
-        (0, import_elements.FieldElement)({
-          name: "Operate",
-          id: 3,
-          conformance: "M",
-          description: "View privileges, and can perform the primary function of this Node (except Access Control Cluster)",
-          details: "This value implicitly grants View privileges",
-          xref: { document: "core", section: "9.10.4.2.1" }
-        }),
-        (0, import_elements.FieldElement)({
-          name: "Manage",
-          id: 4,
-          conformance: "M",
-          description: "Operate privileges, and can modify persistent configuration of this Node (except Access Control Cluster)",
-          details: "This value implicitly grants Operate & View privileges",
-          xref: { document: "core", section: "9.10.4.2.2" }
-        }),
-        (0, import_elements.FieldElement)({
-          name: "Administer",
-          id: 5,
-          conformance: "M",
-          description: "Manage privileges, and can observe and modify the Access Control Cluster",
-          details: "This value implicitly grants Manage, Operate, Proxy View & View privileges",
-          xref: { document: "core", section: "9.10.4.2.3" }
-        })
-      ]
+      xref: { document: "core", section: "9.10.4.2" }
+    },
+    (0, import_elements.FieldElement)({
+      name: "View",
+      id: 1,
+      conformance: "M",
+      description: "Can read and observe all (except Access Control Cluster and as seen by a non-Proxy)"
     }),
-    (0, import_elements.DatatypeElement)({
-      name: "AccessControlEntryAuthModeEnum",
-      type: "enum8",
-      xref: { document: "core", section: "9.10.4.3" },
-      children: [
-        (0, import_elements.FieldElement)({ name: "Pase", id: 1, conformance: "M", description: "Passcode authenticated session" }),
-        (0, import_elements.FieldElement)({ name: "Case", id: 2, conformance: "M", description: "Certificate authenticated session" }),
-        (0, import_elements.FieldElement)({ name: "Group", id: 3, conformance: "M", description: "Group authenticated session" })
-      ]
+    (0, import_elements.FieldElement)({
+      name: "ProxyView",
+      id: 2,
+      conformance: "P, M",
+      description: "Can read and observe all (as seen by a Proxy)"
     }),
-    (0, import_elements.DatatypeElement)({
-      name: "AccessControlTargetStruct",
-      type: "struct",
-      xref: { document: "core", section: "9.10.4.4" },
-      children: [
-        (0, import_elements.FieldElement)({ name: "Cluster", id: 0, type: "cluster-id", conformance: "M", quality: "X" }),
-        (0, import_elements.FieldElement)({ name: "Endpoint", id: 1, type: "endpoint-no", conformance: "M", quality: "X" }),
-        (0, import_elements.FieldElement)({ name: "DeviceType", id: 2, type: "devtype-id", conformance: "M", quality: "X" })
-      ]
+    (0, import_elements.FieldElement)({
+      name: "Operate",
+      id: 3,
+      conformance: "M",
+      description: "View privileges, and can perform the primary function of this Node (except Access Control Cluster)",
+      details: "This value implicitly grants View privileges",
+      xref: { document: "core", section: "9.10.4.2.1" }
     }),
-    (0, import_elements.DatatypeElement)({
-      name: "AccessControlEntryStruct",
-      type: "struct",
-      xref: { document: "core", section: "9.10.4.5" },
-      children: [
-        (0, import_elements.FieldElement)({
-          name: "Privilege",
-          id: 1,
-          type: "AccessControlEntryPrivilegeEnum",
-          access: "S",
-          conformance: "M",
-          details: "The privilege field shall specify the level of privilege granted by this Access Control Entry.\nNOTE The Proxy View privilege is provisional.\nEach privilege builds upon its predecessor, expanding the set of actions that can be performed upon a Node. Administer is the highest privilege, and is special as it pertains to the administration of privileges itself, via the Access Control Cluster.\nWhen a Node is granted a particular privilege, it is also implicitly granted all logically lower privilege levels as well. The following diagram illustrates how the higher privilege levels subsume the lower privilege levels:\nFigure 43. Access Control Privilege Levels\nIndividual clusters shall define whether attributes are readable, writable, or both readable and writable. Clusters also shall define which privilege is minimally required to be able to perform a particular read or write action on those attributes, or invoke particular commands. Device type specifications may further restrict the privilege required.\nThe Access Control Cluster shall require the Administer privilege to observe and modify the Access Control Cluster itself. The Administer privilege shall NOT be used on Access Control Entries which use the Group auth mode.",
-          xref: { document: "core", section: "9.10.4.5.1" }
-        }),
-        (0, import_elements.FieldElement)({
-          name: "AuthMode",
-          id: 2,
-          type: "AccessControlEntryAuthModeEnum",
-          access: "S",
-          conformance: "M",
-          details: "The AuthMode field shall specify the authentication mode required by this Access Control Entry.",
-          xref: { document: "core", section: "9.10.4.5.2" }
-        }),
-        (0, import_elements.FieldElement)({
-          name: "Subjects",
-          id: 3,
-          type: "list",
-          access: "S",
-          conformance: "M",
-          constraint: "max subjectsPerAccessControlEntry",
-          quality: "X",
-          details: "The subjects field shall specify a list of Subject IDs, to which this Access Control Entry grants access.\nDevice types may impose additional constraints on the minimum number of subjects per Access Control Entry.\nAn attempt to create an entry with more subjects than the node can support shall result in a RESOURCE_EXHAUSTED error and the entry shall NOT be created.\n### Subject ID shall be of type uint64 with semantics depending on the entry\u2019s AuthMode as follows:\nSubject Semantics\nAn empty subjects list indicates a wildcard; that is, this entry shall grant access to any Node that successfully authenticates via AuthMode. The subjects list shall NOT be empty if the entry\u2019s AuthMode is PASE.\nThe PASE AuthMode is reserved for future use (see Section 6.6.2.8, \u201CBootstrapping of the Access Control Cluster\u201D). An attempt to write an entry with AuthMode set to PASE shall fail with a status code of CONSTRAINT_ERROR.\nFor PASE authentication, the Passcode ID identifies the required passcode verifier, and shall be 0 for the default commissioning passcode.\nFor CASE authentication, the Subject ID is a distinguished name within the Operational Certificate shared during CASE session establishment, the type of which is determined by its range to be one of:\n  \u2022 a Node ID, which identifies the required source node directly (by ID)\n  \u2022 a CASE Authenticated Tag, which identifies the required source node indirectly (by tag)\nFor Group authentication, the Group ID identifies the required group, as defined in the Group Key Management Cluster.",
-          xref: { document: "core", section: "9.10.4.5.3" },
-          children: [(0, import_elements.FieldElement)({ name: "entry", type: "subject-id" })]
-        }),
-        (0, import_elements.FieldElement)({
-          name: "Targets",
-          id: 4,
-          type: "list",
-          access: "S",
-          conformance: "M",
-          constraint: "max targetsPerAccessControlEntry",
-          quality: "X",
-          details: "The targets field shall specify a list of AccessControlTargetStruct, which define the clusters on this Node to which this Access Control Entry grants access.\nDevice types may impose additional constraints on the minimum number of targets per Access Control Entry.\nAn attempt to create an entry with more targets than the node can support shall result in a RESOURCE_EXHAUSTED error and the entry shall NOT be created.\nA single target shall contain at least one field (Cluster, Endpoint, or DeviceType), and shall NOT contain both an Endpoint field and a DeviceType field.\nA target grants access based on the presence of fields as follows:\nTarget Semantics\nAn empty targets list indicates a wildcard: that is, this entry shall grant access to all cluster instances on all endpoints on this Node.",
-          xref: { document: "core", section: "9.10.4.5.4" },
-          children: [(0, import_elements.FieldElement)({ name: "entry", type: "AccessControlTargetStruct" })]
-        }),
-        (0, import_elements.FieldElement)({ name: "FabricIndex", id: 254, type: "FabricIndex" })
-      ]
+    (0, import_elements.FieldElement)({
+      name: "Manage",
+      id: 4,
+      conformance: "M",
+      description: "Operate privileges, and can modify persistent configuration of this Node (except Access Control Cluster)",
+      details: "This value implicitly grants Operate & View privileges",
+      xref: { document: "core", section: "9.10.4.2.2" }
     }),
-    (0, import_elements.DatatypeElement)({
-      name: "AccessControlExtensionStruct",
-      type: "struct",
-      xref: { document: "core", section: "9.10.4.6" },
-      children: [
-        (0, import_elements.FieldElement)({
-          name: "Data",
-          id: 1,
-          type: "octstr",
-          access: "S",
-          conformance: "M",
-          constraint: "max 128",
-          details: "This field may be used by manufacturers to store arbitrary TLV-encoded data related to a fabric\u2019s Access Control Entries.\nThe contents shall consist of a top-level anonymous list; each list element shall include a profile-specific tag encoded in fully-qualified form.\nAdministrators may iterate over this list of elements, and interpret selected elements at their discretion. The content of each element is not specified, but may be coordinated among manufacturers at their discretion.",
-          xref: { document: "core", section: "9.10.4.6.1" }
-        }),
-        (0, import_elements.FieldElement)({ name: "FabricIndex", id: 254, type: "FabricIndex" })
-      ]
+    (0, import_elements.FieldElement)({
+      name: "Administer",
+      id: 5,
+      conformance: "M",
+      description: "Manage privileges, and can observe and modify the Access Control Cluster",
+      details: "This value implicitly grants Manage, Operate, Proxy View & View privileges",
+      xref: { document: "core", section: "9.10.4.2.3" }
     })
-  ]
-});
+  ),
+  (0, import_elements.DatatypeElement)(
+    { name: "AccessControlEntryAuthModeEnum", type: "enum8", xref: { document: "core", section: "9.10.4.3" } },
+    (0, import_elements.FieldElement)({ name: "Pase", id: 1, conformance: "M", description: "Passcode authenticated session" }),
+    (0, import_elements.FieldElement)({ name: "Case", id: 2, conformance: "M", description: "Certificate authenticated session" }),
+    (0, import_elements.FieldElement)({ name: "Group", id: 3, conformance: "M", description: "Group authenticated session" })
+  ),
+  (0, import_elements.DatatypeElement)(
+    { name: "AccessControlTargetStruct", type: "struct", xref: { document: "core", section: "9.10.4.4" } },
+    (0, import_elements.FieldElement)({ name: "Cluster", id: 0, type: "cluster-id", conformance: "M", quality: "X" }),
+    (0, import_elements.FieldElement)({ name: "Endpoint", id: 1, type: "endpoint-no", conformance: "M", quality: "X" }),
+    (0, import_elements.FieldElement)({ name: "DeviceType", id: 2, type: "devtype-id", conformance: "M", quality: "X" })
+  ),
+  (0, import_elements.DatatypeElement)(
+    { name: "AccessControlEntryStruct", type: "struct", xref: { document: "core", section: "9.10.4.5" } },
+    (0, import_elements.FieldElement)({
+      name: "Privilege",
+      id: 1,
+      type: "AccessControlEntryPrivilegeEnum",
+      access: "S",
+      conformance: "M",
+      details: "The privilege field shall specify the level of privilege granted by this Access Control Entry.\nNOTE The Proxy View privilege is provisional.\nEach privilege builds upon its predecessor, expanding the set of actions that can be performed upon a Node. Administer is the highest privilege, and is special as it pertains to the administration of privileges itself, via the Access Control Cluster.\nWhen a Node is granted a particular privilege, it is also implicitly granted all logically lower privilege levels as well. The following diagram illustrates how the higher privilege levels subsume the lower privilege levels:\nFigure 43. Access Control Privilege Levels\nIndividual clusters shall define whether attributes are readable, writable, or both readable and writable. Clusters also shall define which privilege is minimally required to be able to perform a particular read or write action on those attributes, or invoke particular commands. Device type specifications may further restrict the privilege required.\nThe Access Control Cluster shall require the Administer privilege to observe and modify the Access Control Cluster itself. The Administer privilege shall NOT be used on Access Control Entries which use the Group auth mode.",
+      xref: { document: "core", section: "9.10.4.5.1" }
+    }),
+    (0, import_elements.FieldElement)({
+      name: "AuthMode",
+      id: 2,
+      type: "AccessControlEntryAuthModeEnum",
+      access: "S",
+      conformance: "M",
+      details: "The AuthMode field shall specify the authentication mode required by this Access Control Entry.",
+      xref: { document: "core", section: "9.10.4.5.2" }
+    }),
+    (0, import_elements.FieldElement)(
+      {
+        name: "Subjects",
+        id: 3,
+        type: "list",
+        access: "S",
+        conformance: "M",
+        constraint: "max subjectsPerAccessControlEntry",
+        quality: "X",
+        details: "The subjects field shall specify a list of Subject IDs, to which this Access Control Entry grants access.\nDevice types may impose additional constraints on the minimum number of subjects per Access Control Entry.\nAn attempt to create an entry with more subjects than the node can support shall result in a RESOURCE_EXHAUSTED error and the entry shall NOT be created.\n### Subject ID shall be of type uint64 with semantics depending on the entry\u2019s AuthMode as follows:\nSubject Semantics\nAn empty subjects list indicates a wildcard; that is, this entry shall grant access to any Node that successfully authenticates via AuthMode. The subjects list shall NOT be empty if the entry\u2019s AuthMode is PASE.\nThe PASE AuthMode is reserved for future use (see Section 6.6.2.8, \u201CBootstrapping of the Access Control Cluster\u201D). An attempt to write an entry with AuthMode set to PASE shall fail with a status code of CONSTRAINT_ERROR.\nFor PASE authentication, the Passcode ID identifies the required passcode verifier, and shall be 0 for the default commissioning passcode.\nFor CASE authentication, the Subject ID is a distinguished name within the Operational Certificate shared during CASE session establishment, the type of which is determined by its range to be one of:\n  \u2022 a Node ID, which identifies the required source node directly (by ID)\n  \u2022 a CASE Authenticated Tag, which identifies the required source node indirectly (by tag)\nFor Group authentication, the Group ID identifies the required group, as defined in the Group Key Management Cluster.",
+        xref: { document: "core", section: "9.10.4.5.3" }
+      },
+      (0, import_elements.FieldElement)({ name: "entry", type: "subject-id" })
+    ),
+    (0, import_elements.FieldElement)(
+      {
+        name: "Targets",
+        id: 4,
+        type: "list",
+        access: "S",
+        conformance: "M",
+        constraint: "max targetsPerAccessControlEntry",
+        quality: "X",
+        details: "The targets field shall specify a list of AccessControlTargetStruct, which define the clusters on this Node to which this Access Control Entry grants access.\nDevice types may impose additional constraints on the minimum number of targets per Access Control Entry.\nAn attempt to create an entry with more targets than the node can support shall result in a RESOURCE_EXHAUSTED error and the entry shall NOT be created.\nA single target shall contain at least one field (Cluster, Endpoint, or DeviceType), and shall NOT contain both an Endpoint field and a DeviceType field.\nA target grants access based on the presence of fields as follows:\nTarget Semantics\nAn empty targets list indicates a wildcard: that is, this entry shall grant access to all cluster instances on all endpoints on this Node.",
+        xref: { document: "core", section: "9.10.4.5.4" }
+      },
+      (0, import_elements.FieldElement)({ name: "entry", type: "AccessControlTargetStruct" })
+    ),
+    (0, import_elements.FieldElement)({ name: "FabricIndex", id: 254, type: "FabricIndex" })
+  ),
+  (0, import_elements.DatatypeElement)(
+    { name: "AccessControlExtensionStruct", type: "struct", xref: { document: "core", section: "9.10.4.6" } },
+    (0, import_elements.FieldElement)({
+      name: "Data",
+      id: 1,
+      type: "octstr",
+      access: "S",
+      conformance: "M",
+      constraint: "max 128",
+      details: "This field may be used by manufacturers to store arbitrary TLV-encoded data related to a fabric\u2019s Access Control Entries.\nThe contents shall consist of a top-level anonymous list; each list element shall include a profile-specific tag encoded in fully-qualified form.\nAdministrators may iterate over this list of elements, and interpret selected elements at their discretion. The content of each element is not specified, but may be coordinated among manufacturers at their discretion.",
+      xref: { document: "core", section: "9.10.4.6.1" }
+    }),
+    (0, import_elements.FieldElement)({ name: "FabricIndex", id: 254, type: "FabricIndex" })
+  )
+);
 import_MatterDefinition.MatterDefinition.children.push(AccessControl);
 //# sourceMappingURL=AccessControl.js.map