@matter/model 0.16.0-alpha.0-20251023-bb23617e5 → 0.16.0-alpha.0-20251027-17770fb28

package/src/standard/resources/operational-credentials.resource.ts

@@ -11,14 +11,15 @@ import { Resource } from "#models/Resource.js";
 Resource.add({
     tag: "cluster", name: "OperationalCredentials", classification: "node", pics: "OPCREDS",
     xref: "core§11.18",
-    details: "This cluster is used to add or remove Node Operational credentials on a Commissionee or Node, as " +
-        "well as manage the associated Fabrics.",
+    details: "This cluster is used to add or remove Node Operational credentials on a Commissionee or " +
+        "already-configured Node, as well as manage the associated Fabrics.",
 
     children: [
         {
             tag: "attribute", name: "Nocs", xref: "core§11.18.5.1",
 
-            details: "This attribute contains all NOCs applicable to this Node, encoded as a read-only list of NOCStruct." +
+            details: "This attribute shall contain all NOCs applicable to this Node, encoded as a read-only list of " +
+                "NOCStruct." +
                 "\n" +
                 "Operational Certificates shall be added through the AddNOC command, and shall be removed through the " +
                 "RemoveFabric command." +
@@ -31,8 +32,10 @@ Resource.add({
         {
             tag: "attribute", name: "Fabrics", xref: "core§11.18.5.2",
 
-            details: "This attribute describes all fabrics to which this Node is commissioned, encoded as a read-only list " +
-                "of FabricDescriptorStruct. This information may be computed directly from the NOCs attribute." +
+            details: "Indicates all fabrics to which this Node is commissioned, encoded as a read-only list of " +
+                "FabricDescriptorStruct. This information may be computed directly from the NOCs attribute." +
+                "\n" +
+                "The Fabrics attribute is also known as \"the fabric table\"." +
                 "\n" +
                 "Upon Factory Data Reset, this attribute shall be set to a default value of an empty list." +
                 "\n" +
@@ -41,15 +44,15 @@ Resource.add({
 
         {
             tag: "attribute", name: "SupportedFabrics", xref: "core§11.18.5.3",
-            details: "This attribute contains the number of Fabrics that are supported by the device. This value is fixed " +
-                "for a particular device."
+            details: "Indicates the number of Fabrics that are supported by the device. This value is fixed for a " +
+                "particular device."
         },
 
         {
             tag: "attribute", name: "CommissionedFabrics", xref: "core§11.18.5.4",
 
-            details: "This attribute contains the number of Fabrics to which the device is currently commissioned. This " +
-                "attribute shall be equal to the following:" +
+            details: "Indicates the number of Fabrics to which the device is currently commissioned. This attribute shall " +
+                "be equal to the following:" +
                 "\n" +
                 "  • The number of entries in the NOCs attribute." +
                 "\n" +
@@ -61,8 +64,8 @@ Resource.add({
         {
             tag: "attribute", name: "TrustedRootCertificates", xref: "core§11.18.5.5",
 
-            details: "This attribute shall contain a read-only list of Trusted Root CA Certificates (RCAC) installed on " +
-                "the Node, as octet strings containing their Matter Certificate Encoding representation." +
+            details: "This attribute shall contain the list of Trusted Root CA Certificates (RCAC) installed on the Node, " +
+                "as octet strings containing their Matter Certificate Encoding representation." +
                 "\n" +
                 "These certificates are installed through the AddTrustedRootCertificate command." +
                 "\n" +
@@ -79,7 +82,7 @@ Resource.add({
 
         {
             tag: "attribute", name: "CurrentFabricIndex", xref: "core§11.18.5.6",
-            details: "This attribute shall contain accessing fabric index." +
+            details: "Indicates the accessing fabric index." +
                 "\n" +
                 "This attribute is useful to contextualize Fabric-Scoped entries obtained from response commands or " +
                 "attribute reads, since a given Fabric may be referenced by a different Fabric Index locally on a " +
@@ -88,7 +91,10 @@ Resource.add({
 
         {
             tag: "command", name: "AttestationRequest", xref: "core§11.18.6.1",
-            details: "This command shall be generated to request the Attestation Information, in the form of an " +
+
+            details: "This command is used to perform an attestation request." +
+                "\n" +
+                "This command shall be generated to request the Attestation Information, in the form of an " +
                 "AttestationResponse Command. If the AttestationNonce that is provided in the command is malformed, a " +
                 "recipient shall fail the command with a Status Code of INVALID_COMMAND. The AttestationNonce field " +
                 "shall be used in the computation of the Attestation Information."
@@ -97,7 +103,8 @@ Resource.add({
         {
             tag: "command", name: "AttestationResponse", xref: "core§11.18.6.2",
 
-            details: "This command shall be generated in response to an Attestation Request command." +
+            details: "This command is used to report the results of the AttestationRequest command. This command shall be " +
+                "generated in response to an Attestation Request command." +
                 "\n" +
                 "See Section 11.18.4.7, “Attestation Information” for details about the generation of the fields " +
                 "within this response command." +
@@ -120,13 +127,16 @@ Resource.add({
 
         {
             tag: "command", name: "CertificateChainRequest", xref: "core§11.18.6.3",
-            details: "If the CertificateType is not a valid value per CertificateChainTypeEnum then the command shall fail " +
+            details: "This command is used to request a certificate from the device attestation certificate chain." +
+                "\n" +
+                "If the CertificateType is not a valid value per CertificateChainTypeEnum then the command shall fail " +
                 "with a Status Code of INVALID_COMMAND."
         },
 
         {
             tag: "command", name: "CertificateChainResponse", xref: "core§11.18.6.4",
-            details: "This command shall be generated in response to a CertificateChainRequest command.",
+            details: "This command is used to report the results of the CertificateChainRequest command. This command " +
+                "shall be generated in response to a CertificateChainRequest command.",
             children: [{
                 tag: "field", name: "Certificate", xref: "core§11.18.6.4.1",
                 details: "This field shall be the DER encoded certificate corresponding to the CertificateType field in the " +
@@ -137,7 +147,9 @@ Resource.add({
         {
             tag: "command", name: "CsrRequest", xref: "core§11.18.6.5",
 
-            details: "This command shall be generated to execute the Node Operational CSR Procedure and subsequently " +
+            details: "This command is used to perform a CSR request." +
+                "\n" +
+                "This command shall be generated to execute the Node Operational CSR Procedure and subsequently " +
                 "return the NOCSR Information, in the form of a CSRResponse Command." +
                 "\n" +
                 "The CSRNonce field shall be used in the computation of the NOCSR Information. If the CSRNonce is " +
@@ -148,13 +160,14 @@ Resource.add({
                 "to use a resulting subsequent certificate issued from the CSR with the UpdateNOC command, which is " +
                 "forbidden over PASE sessions." +
                 "\n" +
-                "If the IsForUpdateNOC field is present and set to true, the internal state of the CSR associated " +
-                "keypair shall be tagged as being for a subsequent UpdateNOC, otherwise the internal state of the CSR " +
-                "shall be tagged as being for a subsequent AddNOC. See AddNOC and UpdateNOC for details about the " +
-                "processing." +
+                "If the IsForUpdateNOC field is present and set to true, the internal state of the CSR associated key " +
+                "pair shall be tagged as being for a subsequent UpdateNOC, otherwise the internal state of the CSR " +
+                "shall be tagged as being for a subsequent AddNOC. See Section 11.18.6.8, “AddNOC Command” and " +
+                "Section 11.18.6.9, “UpdateNOC Command” for details about the processing." +
                 "\n" +
-                "If this command is received without an armed fail-safe context (see ArmFailSafe), then this command " +
-                "shall fail with a FAILSAFE_REQUIRED status code sent back to the initiator." +
+                "If this command is received without an armed fail-safe context (see Section 11.10.7.2, “ArmFailSafe " +
+                "Command”), then this command shall fail with a FAILSAFE_REQUIRED status code sent back to the " +
+                "initiator." +
                 "\n" +
                 "If a prior UpdateNOC or AddNOC command was successfully executed within the fail-safe timer period, " +
                 "then this command shall fail with a CONSTRAINT_ERROR status code sent back to the initiator." +
@@ -168,7 +181,8 @@ Resource.add({
         {
             tag: "command", name: "CsrResponse", xref: "core§11.18.6.6",
 
-            details: "This command shall be generated in response to a CSRRequest Command." +
+            details: "This command is used to report the results of the CSRRequest command. This command shall be " +
+                "generated in response to a CSRRequest Command." +
                 "\n" +
                 "See Section 11.18.4.9, “NOCSR Information” for details about the generation of the fields within " +
                 "this response command." +
@@ -192,7 +206,9 @@ Resource.add({
         {
             tag: "command", name: "AddNoc", xref: "core§11.18.6.8",
 
-            details: "This command shall add a new NOC chain to the device and commission a new Fabric association upon " +
+            details: "This command is used to add a new NOC to the device." +
+                "\n" +
+                "This command shall add a new NOC chain to the device and commission a new Fabric association upon " +
                 "successful validation of all arguments and preconditions." +
                 "\n" +
                 "The new value shall immediately be reflected in the NOCs list attribute." +
@@ -223,7 +239,7 @@ Resource.add({
                     tag: "field", name: "CaseAdminSubject", xref: "core§11.18.6.8.2",
 
                     details: "If the AddNOC command succeeds according to the semantics of the following subsections, then the " +
-                        "Access Control SubjectID shall be used to atomically add an Access Control Entry enabling that " +
+                        "Access Control subject-id shall be used to atomically add an Access Control Entry enabling that " +
                         "Subject to subsequently administer the Node whose operational identity is being added by this " +
                         "command." +
                         "\n" +
@@ -248,10 +264,11 @@ Resource.add({
                     details: "This field shall be set to the Vendor ID of the entity issuing the AddNOC command. This value shall " +
                         "NOT be one of the reserved Vendor ID values defined in Table 1, “Vendor ID Allocations”." +
                         "\n" +
-                        "### Effect When Received" +
+                        "### Effect on Receipt" +
                         "\n" +
-                        "If this command is received without an armed fail-safe context (see ArmFailSafe), then this command " +
-                        "shall fail with a FAILSAFE_REQUIRED status code sent back to the initiator." +
+                        "If this command is received without an armed fail-safe context (see Section 11.10.7.2, “ArmFailSafe " +
+                        "Command”), then this command shall fail with a FAILSAFE_REQUIRED status code sent back to the " +
+                        "initiator." +
                         "\n" +
                         "If a prior UpdateNOC or AddNOC command was successfully executed within the fail-safe timer period, " +
                         "then this command shall fail with a CONSTRAINT_ERROR status code sent back to the initiator." +
@@ -320,10 +337,10 @@ Resource.add({
                         "       with the new FabricIndex may be added to the ARL attribute." +
                         "\n" +
                         "  8. The incoming IPKValue shall be stored in the Fabric-scoped slot within the Group Key Management " +
-                        "     cluster (see KeySetWrite), for subsequent use during CASE." +
+                        "     cluster (see Section 11.2.7.1, “KeySetWrite Command”), for subsequent use during CASE." +
                         "\n" +
-                        "  9. The Fabric Index associated with the armed fail-safe context (see ArmFailSafe) shall be updated " +
-                        "     to match the Fabric Index just allocated." +
+                        "  9. The Fabric Index associated with the armed fail-safe context (see Section 11.10.7.2, " +
+                        "     “ArmFailSafe Command”) shall be updated to match the Fabric Index just allocated." +
                         "\n" +
                         "  10. If the current secure session was established with PASE, the receiver shall:" +
                         "\n" +
@@ -343,7 +360,9 @@ Resource.add({
         {
             tag: "command", name: "UpdateNoc", xref: "core§11.18.6.9",
 
-            details: "This command shall replace the NOC and optional associated ICAC (if present) scoped under the " +
+            details: "This command is used to update an existing NOC on the device." +
+                "\n" +
+                "This command shall replace the NOC and optional associated ICAC (if present) scoped under the " +
                 "accessing fabric upon successful validation of all arguments and preconditions. The new value shall " +
                 "immediately be reflected in the NOCs list attribute." +
                 "\n" +
@@ -353,10 +372,11 @@ Resource.add({
                 "A Commissioner or Administrator SHOULD issue this command after performing the Attestation " +
                 "Procedure." +
                 "\n" +
-                "### Effect When Received" +
+                "### Effect on Receipt" +
                 "\n" +
-                "If this command is received without an armed fail-safe context (see ArmFailSafe), then this command " +
-                "shall fail with a FAILSAFE_REQUIRED status code sent back to the initiator." +
+                "If this command is received without an armed fail-safe context (see Section 11.10.7.2, “ArmFailSafe " +
+                "Command”), then this command shall fail with a FAILSAFE_REQUIRED status code sent back to the " +
+                "initiator." +
                 "\n" +
                 "If a prior UpdateNOC or AddNOC command was successfully executed within the fail-safe timer period, " +
                 "then this command shall fail with a CONSTRAINT_ERROR status code sent back to the initiator." +
@@ -404,7 +424,10 @@ Resource.add({
         {
             tag: "command", name: "NocResponse", xref: "core§11.18.6.10",
 
-            details: "This command shall be generated in response to the following commands:" +
+            details: "This command is used to report the results of the AddNOC, UpdateNOC, UpdateFabricLabel and " +
+                "RemoveFabric commands." +
+                "\n" +
+                "This command shall be generated in response to the following commands:" +
                 "\n" +
                 "  • AddNOC" +
                 "\n" +
@@ -423,8 +446,7 @@ Resource.add({
                 },
                 {
                     tag: "field", name: "FabricIndex", xref: "core§11.18.6.10.2",
-                    details: "This field shall be present whenever StatusCode has a value of OK. If present, it shall contain the " +
-                        "Fabric Index of the Fabric last added, removed or updated."
+                    details: "If present, it shall contain the Fabric Index of the Fabric last added, removed or updated."
                 },
 
                 {
@@ -439,7 +461,9 @@ Resource.add({
         {
             tag: "command", name: "UpdateFabricLabel", xref: "core§11.18.6.11",
 
-            details: "This command shall be used by an Administrator to set the user-visible Label field for a given " +
+            details: "This command is used to set the user-visible fabric label for a given Fabric." +
+                "\n" +
+                "This command shall be used by an Administrator to set the user-visible Label field for a given " +
                 "Fabric, as reflected by entries in the Fabrics attribute. An Administrator shall use this command to " +
                 "set the Label to a string (possibly selected by the user themselves) that the user can recognize and " +
                 "relate to this Administrator" +
@@ -478,12 +502,16 @@ Resource.add({
         {
             tag: "command", name: "RemoveFabric", xref: "core§11.18.6.12",
 
-            details: "This command is used by Administrators to remove a given Fabric and delete all associated " +
+            details: "This command is used to remove a Fabric from the device." +
+                "\n" +
+                "This command is used by Administrators to remove a given Fabric and delete all associated " +
                 "fabric-scoped data." +
                 "\n" +
                 "If the given Fabric being removed is the last one to reference a given Trusted Root CA Certificate " +
                 "stored in the Trusted Root Certificates list, then that Trusted Root Certificate shall be removed." +
                 "\n" +
+                "### WARNING" +
+                "\n" +
                 "This command, if referring to an already existing Fabric not under the control of the invoking " +
                 "Administrator, shall ONLY be invoked after obtaining some form of explicit user consent through some " +
                 "method executed by the Administrator or Commissioner. This method of obtaining consent SHOULD employ " +
@@ -497,8 +525,8 @@ Resource.add({
             children: [{
                 tag: "field", name: "FabricIndex", xref: "core§11.18.6.12.1",
 
-                details: "This field shall contain the Fabric Index reference (see fabric-index) associated with the Fabric " +
-                    "which is to be removed from the device." +
+                details: "This field shall contain the Fabric Index reference (see Section 7.19.2.23, “Fabric Index Type”) " +
+                    "associated with the Fabric which is to be removed from the device." +
                     "\n" +
                     "### Effect on Receipt" +
                     "\n" +
@@ -545,15 +573,18 @@ Resource.add({
         {
             tag: "command", name: "AddTrustedRootCertificate", xref: "core§11.18.6.13",
 
-            details: "This command shall add a Trusted Root CA Certificate, provided as its Matter Certificate Encoding " +
+            details: "This command is used to add a trusted root certificate to the device." +
+                "\n" +
+                "This command shall add a Trusted Root CA Certificate, provided as its Matter Certificate Encoding " +
                 "representation, to the TrustedRootCertificates Attribute list and shall ensure the next AddNOC " +
                 "command executed uses the provided certificate as its root of trust." +
                 "\n" +
                 "If the certificate from the RootCACertificate field is already installed, based on exact " +
                 "byte-for-byte equality, then this command shall succeed with no change to the list." +
                 "\n" +
-                "If this command is received without an armed fail-safe context (see ArmFailSafe), then this command " +
-                "shall fail with a FAILSAFE_REQUIRED status code sent back to the initiator." +
+                "If this command is received without an armed fail-safe context (see Section 11.10.7.2, “ArmFailSafe " +
+                "Command”), then this command shall fail with a FAILSAFE_REQUIRED status code sent back to the " +
+                "initiator." +
                 "\n" +
                 "If a prior AddTrustedRootCertificate command was successfully invoked within the fail-safe timer " +
                 "period, which would cause the new invocation to add a second root certificate within a given " +
@@ -572,6 +603,132 @@ Resource.add({
                 "root of trust using the RemoveFabric command."
         },
 
+        {
+            tag: "command", name: "SetVidVerificationStatement", xref: "core§11.18.6.14",
+
+            details: "This command is used to manage the VendorID and VIDVerificationStatement fields of the Fabrics " +
+                "attribute, and the VVSC field of an entry in the NOCs attribute." +
+                "\n" +
+                "This command shall be used to one or more of the following:" +
+                "\n" +
+                "  • Update the VendorID associated with an entry in the Fabrics attribute." +
+                "\n" +
+                "  • Associate or remove a VIDVerificationStatement associated with an entry in the Fabrics " +
+                "    attribute." +
+                "\n" +
+                "  • Associate or remove a VendorVerificationSigningCertificate (VVSC) associated with an entry in " +
+                "    the NOCs attribute." +
+                "\n" +
+                "This command shall only operate against the Fabrics and NOCs attribute entries associated with the " +
+                "accessing fabric index." +
+                "\n" +
+                "### Effect on Receipt" +
+                "\n" +
+                "If the VendorID field is present, the value of the VendorID in the Fabrics attribute entry " +
+                "associated with the accessing fabric index shall have its value replaced with the value from the " +
+                "command field." +
+                "\n" +
+                "If the VVSC field is present, but the ICAC field is already present in the NOCs attribute entry " +
+                "associated with the accessing fabric index, then the command shall fail with a status code of " +
+                "INVALID_COMMAND." +
+                "\n" +
+                "If the VIDVerificationStatement field is present:" +
+                "\n" +
+                "  • If the length of the field’s value is neither exactly 0 nor exactly 85, then the command shall " +
+                "    fail with a status code of CONSTRAINT_ERROR." +
+                "\n" +
+                "  • If the length of the field’s value is exactly 0, then the VIDVerificationStatement field in the " +
+                "    Fabrics attribute entry associated with the accessing fabric index shall be erased and the field " +
+                "    shall disappear from the Fabrics entry." +
+                "\n" +
+                "  • If the length of the field’s value is exactly 85, then the VIDVerificationStatement field in the " +
+                "    Fabrics attribute entry associated with the accessing fabric index shall have its value replaced " +
+                "    with the value from the command field." +
+                "\n" +
+                "If the VVSC field is present:" +
+                "\n" +
+                "  • If the length of the field’s value is exactly 0, then the VVSC field in the NOCs attribute entry " +
+                "    associated with the accessing fabric index shall be erased and the field shall disappear from " +
+                "    the NOCs entry." +
+                "\n" +
+                "  • If the length of the field’s value is not 0, then the VVSC field in the NOCs attribute entry " +
+                "    associated with the accessing fabric index shall have its value replaced with the value from the " +
+                "    command field. The contents of the certificate need not be validated by the server. Clients " +
+                "    shall validate the contents at time of use." +
+                "\n" +
+                "If the command was invoked within a fail-safe context after a successful AddNOC or UpdateNOC " +
+                "command, then the field updates shall apply to the pending update state that will be reverted if " +
+                "fail-safe expires prior to a CommissioningComplete command. In other words, field updates apply to " +
+                "the state of the Fabrics Attribute as currently visible, even for an existing fabric currently in " +
+                "process of being updated."
+        },
+
+        {
+            tag: "command", name: "SignVidVerificationRequest", xref: "core§11.18.6.15",
+
+            details: "This command is used to authenticate the fabric associated with the FabricIndex." +
+                "\n" +
+                "This command shall be used to request that the server authenticate the fabric associated with the " +
+                "FabricIndex given by generating the response described in Section 6.4.10, “Fabric Table Vendor ID " +
+                "Verification Procedure”." +
+                "\n" +
+                "The FabricIndex field shall contain the fabric index being targeted by the request." +
+                "\n" +
+                "The ClientChallenge field shall contain a client-provided random challenge to be used during the " +
+                "signature procedure." +
+                "\n" +
+                "### Effect on Receipt" +
+                "\n" +
+                "If the FabricIndex field contains a fabric index which does not have an associated entry in the " +
+                "Fabrics attribute, then the command shall fail with a status code of CONSTRAINT_ERROR." +
+                "\n" +
+                "Otherwise, if no other errors have occurred, the command shall generate a " +
+                "SignVIDVerificationResponse."
+        },
+
+        {
+            tag: "command", name: "SignVidVerificationResponse", xref: "core§11.18.6.16",
+
+            details: "This command is used to report the results of the SignVIDVerificationRequest command. This command " +
+                "shall contain the response of the SignVIDVerificationRequest, computed as described below." +
+                "\n" +
+                "The FabricIndex field shall contain the same value of FabricIndex as the value from the associated " +
+                "SignVIDVerificationRequest." +
+                "\n" +
+                "The FabricBindingVersion field shall contain value 0x01 for version 1.0 of the Matter Cryptographic " +
+                "Primitives." +
+                "\n" +
+                "The Signature field shall contain the octet string result of CryptoSign(noc_private_key, " +
+                "vendor_id_verification_tbs):" +
+                "\n" +
+                "  • noc_private_key is the operational private key associated with the Node Operational Key Pair for " +
+                "    the FabricIndex requested in the associated SignVIDVerificationRequest." +
+                "\n" +
+                "  • vendor_id_verification_tbs := fabric_binding_version || client_challenge || " +
+                "    attestation_challenge || fabric_index || vendor_fabric_binding_message || " +
+                "    <vid_verification_statement>" +
+                "\n" +
+                "    ◦ fabric_binding_version is the value from the FabricBindingVersion field of this " +
+                "      SignVIDVerificationResponse." +
+                "\n" +
+                "    ◦ client_challenge is the 32-octet ClientChallenge from the SignVIDVerificationRequest." +
+                "\n" +
+                "    ◦ attestation_challenge is the AttestationChallenge from a CASE session, resumed CASE session, " +
+                "      or PASE session depending on the method used to establish the current secure session context " +
+                "      over which the response will be sent." +
+                "\n" +
+                "    ◦ fabric_index is the 1-octet value of FabricIndex from the SignVIDVerificationRequest." +
+                "\n" +
+                "    ◦ vendor_fabric_binding_message is the octet string of the vendor_fabric_binding_message defined " +
+                "      in Section 6.4.10.1, “Algorithm”." +
+                "\n" +
+                "    ◦ vid_verification_statement is the 85-octet (for cryptographic primitives mapping 1.0) value " +
+                "      from the VIDVerificationStatement field of the entry in the Fabrics attribute associated with " +
+                "      the fabric_index, if present. If there is no such field in the Fabrics attribute for the " +
+                "      fabric_index specified, this field shall be omitted from the vendor_id_verification_tbs " +
+                "      message."
+        },
+
         {
             tag: "datatype", name: "CertificateChainTypeEnum", xref: "core§11.18.4.2",
             details: "This enumeration is used by the CertificateChainRequest command to convey which certificate from the " +
@@ -618,11 +775,21 @@ Resource.add({
 
         {
             tag: "datatype", name: "NOCStruct", xref: "core§11.18.4.4",
-            details: "This encodes a fabric sensitive NOC chain, underpinning a commissioned Operational Identity for a " +
-                "given Node." +
+
+            details: "This encodes a NOC chain, underpinning a commissioned Operational Identity for a given Node." +
+                "\n" +
+                "> [!NOTE]" +
+                "\n" +
+                "> The VVSC field is mutually exclusive with the ICAC field. If the ICAC field is non-null, the VVSC " +
+                "  field shall be omitted. If the VVSC field is present in the structure, the ICAC field shall be " +
+                "  null. The reason for this is to optimize storage usage, as the VID Verification Signer Certificate " +
+                "  (VVSC) is a field that is only needed in root-per-fabric situations without ICAC present." +
                 "\n" +
-                "Note that the Trusted Root CA Certificate is not included in this structure. The roots are available " +
-                "in the TrustedRootCertificates attribute of the Node Operational Credentials cluster.",
+                "> [!NOTE]" +
+                "\n" +
+                "> The Trusted Root CA Certificate (RCAC) is not included in this structure. The roots are available " +
+                "  in the TrustedRootCertificates attribute under the same associated fabric as the one for the " +
+                "  NOCStruct entry.",
 
             children: [
                 {
@@ -632,8 +799,16 @@ Resource.add({
                 },
                 {
                     tag: "field", name: "Icac", xref: "core§11.18.4.4.2",
-                    details: "This field shall contain the ICAC or the struct’s associated fabric, encoded using Matter " +
+                    details: "This field shall contain the ICAC for the struct’s associated fabric, encoded using Matter " +
                         "Certificate Encoding. If no ICAC is present in the chain, this field shall be set to null."
+                },
+
+                {
+                    tag: "field", name: "Vvsc", xref: "core§11.18.4.4.3",
+                    details: "This field shall contain the Vendor Verification Signer Certificate (VVSC) for the struct’s " +
+                        "associated fabric, encoded using Matter Certificate Encoding. If no VVSC is needed, this field shall " +
+                        "be omitted (in that there shall NOT be a value present, not even an empty octet string). If the ICAC " +
+                        "field is non-null, this field shall NOT be present."
                 }
             ]
         },
@@ -655,14 +830,18 @@ Resource.add({
                 {
                     tag: "field", name: "VendorId", xref: "core§11.18.4.5.2",
 
-                    details: "This field shall contain the value of AdminVendorID provided in the AddNOC command that led to the " +
-                        "creation of this FabricDescriptorStruct. The set of allowed values is defined in AdminVendorID." +
+                    details: "This field shall contain the value of VendorID associated with the fabric." +
                         "\n" +
-                        "The intent is to provide some measure of user transparency about which entities have Administer " +
-                        "privileges on the Node." +
+                        "This value shall have been provided by the AdminVendorID value provided in the AddNOC command that " +
+                        "led to the creation of this FabricDescriptorStruct, or the value updated via the " +
+                        "SetVIDVerificationStatement command, whichever was last completed. The set of allowed values is " +
+                        "defined in AdminVendorID." +
                         "\n" +
-                        "Clients shall consider the VendorID field value to be untrustworthy until the NOC chain associated " +
-                        "with the fabric has passed the Vendor ID Validation Procedure against the associated RCAC."
+                        "The intent is to provide user transparency about which entities have Administer privileges on the " +
+                        "Node." +
+                        "\n" +
+                        "Clients shall consider the VendorID field value to be untrustworthy until the Fabric Table Vendor ID " +
+                        "Verification Procedure has been executed against the fabric entry having this VendorID."
                 },
 
                 {
@@ -682,7 +861,15 @@ Resource.add({
                 {
                     tag: "field", name: "Label", xref: "core§11.18.4.5.5",
                     details: "This field shall contain a commissioner-set label for the fabric referenced by FabricIndex. This " +
-                        "label is set by the UpdateFabricLabel command."
+                        "field is set by the UpdateFabricLabel command."
+                },
+
+                {
+                    tag: "field", name: "VidVerificationStatement", xref: "core§11.18.4.5.6",
+                    details: "This field, if present, shall contain a previously-installed administrator-set " +
+                        "vid_verification_statement value (see Section 6.4.10, “Fabric Table Vendor ID Verification " +
+                        "Procedure”) for the fabric referenced by FabricIndex. This field is set by the " +
+                        "SetVIDVerificationStatement command."
                 }
             ]
         }

package/src/standard/resources/operational-state.resource.ts

@@ -111,8 +111,8 @@ Resource.add({
         {
             tag: "attribute", name: "OperationalError", xref: "cluster§1.14.5.6",
             details: "This attribute shall specify the details of any current error condition being experienced on the " +
-                "device when the OperationalState attribute is populated with Error. Please see ErrorStateStruct for " +
-                "general requirements on the population of this attribute." +
+                "device when the OperationalState attribute is populated with Error. See Section 1.14.4.4, " +
+                "“ErrorStateStruct Type” for general requirements on the population of this attribute." +
                 "\n" +
                 "When there is no error detected, this shall have an ErrorStateID of NoError."
         },
@@ -313,8 +313,8 @@ Resource.add({
             children: [{
                 tag: "field", name: "CommandResponseState", xref: "cluster§1.14.6.5.1",
                 details: "This shall indicate the success or otherwise of the attempted command invocation. On a successful " +
-                    "invocation of the attempted command, the ErrorStateID shall be populated with NoError. Please see " +
-                    "the individual command sections for additional specific requirements on population."
+                    "invocation of the attempted command, the ErrorStateID shall be populated with NoError. See the " +
+                    "individual command sections for additional specific requirements on population."
             }]
         },
 
@@ -356,12 +356,10 @@ Resource.add({
                     tag: "field", name: "OperationalStateId", xref: "cluster§1.14.4.2.1",
                     details: "This shall be populated with a value from the OperationalStateEnum."
                 },
-
                 {
                     tag: "field", name: "OperationalStateLabel", xref: "cluster§1.14.4.2.2",
-                    details: "This field shall be present if the OperationalStateID is from the set reserved for Manufacturer " +
-                        "Specific States, otherwise it shall NOT be present. If present, this shall contain a human-readable " +
-                        "description of the operational state."
+                    details: "This field is present when the OperationalStateID is from the set reserved for Manufacturer Specific " +
+                        "States. If present, this shall contain a human-readable description of the operational state."
                 }
             ]
         },
@@ -414,13 +412,10 @@ Resource.add({
                     tag: "field", name: "ErrorStateId", xref: "cluster§1.14.4.4.1",
                     details: "This shall be populated with a value from the ErrorStateEnum."
                 },
-
                 {
                     tag: "field", name: "ErrorStateLabel", xref: "cluster§1.14.4.4.2",
-                    details: "This field shall be present if the ErrorStateID is from the set reserved for Manufacturer Specific " +
-                        "Errors, otherwise it shall NOT be present. If present, this shall contain a human-readable " +
-                        "description of the ErrorStateID; e.g. for a manufacturer specific ErrorStateID of \"0x80\" the " +
-                        "ErrorStateLabel may contain \"My special error\"."
+                    details: "This field is present when the ErrorStateID is from the set reserved for Manufacturer Specific " +
+                        "errors. If present, this shall contain a human-readable description of the error state."
                 },
 
                 {