@matter/model 0.18.0 → 0.18.1-alpha.0-20261111-b84c5d1bc

package/dist/esm/standard/elements/wi-fi-network-management.element.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../../src/standard/elements/wi-fi-network-management.element.ts"],
-  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,SAAS,wBAAwB;AACjC;AAAA,EACI,kBAAkB;AAAA,EAClB,oBAAoB;AAAA,EACpB,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,OACb;AAEA,MAAM,wBAAwB;AAAA,EACjC,EAAE,MAAM,yBAAyB,IAAI,MAAO,gBAAgB,cAAc;AAAA,EAC1E,UAAU,EAAE,MAAM,mBAAmB,IAAI,OAAQ,MAAM,mBAAmB,SAAS,EAAE,CAAC;AAAA,EACtF,UAAU,EAAE,MAAM,QAAQ,IAAI,GAAK,MAAM,UAAU,QAAQ,OAAO,aAAa,KAAK,YAAY,WAAW,SAAS,MAAM,CAAC;AAAA,EAC3H,UAAU,EAAE,MAAM,uBAAuB,IAAI,GAAK,MAAM,UAAU,QAAQ,OAAO,aAAa,KAAK,SAAS,MAAM,CAAC;AAAA,EACnH,QAAQ;AAAA,IACJ,MAAM;AAAA,IAA4B,IAAI;AAAA,IAAK,QAAQ;AAAA,IAAK,aAAa;AAAA,IAAK,WAAW;AAAA,IACrF,UAAU;AAAA,EACd,CAAC;AAAA,EACD;AAAA,IACI,EAAE,MAAM,6BAA6B,IAAI,GAAK,aAAa,KAAK,WAAW,WAAW;AAAA,IACtF,MAAM,EAAE,MAAM,cAAc,IAAI,GAAK,MAAM,UAAU,aAAa,KAAK,YAAY,SAAS,CAAC;AAAA,EACjG;AACJ;AAEA,iBAAiB,SAAS,KAAK,qBAAqB;",
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,SAAS,wBAAwB;AACjC;AAAA,EACI,kBAAkB;AAAA,EAClB,oBAAoB;AAAA,EACpB,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,OACb;AAEA,MAAM,wBAAwB;AAAA,EACjC,EAAE,MAAM,yBAAyB,IAAI,MAAO,gBAAgB,cAAc;AAAA,EAC1E,UAAU,EAAE,MAAM,mBAAmB,IAAI,OAAQ,MAAM,mBAAmB,SAAS,EAAE,CAAC;AAAA,EACtF,UAAU,EAAE,MAAM,QAAQ,IAAI,GAAK,MAAM,UAAU,QAAQ,OAAO,aAAa,KAAK,YAAY,WAAW,SAAS,MAAM,CAAC;AAAA,EAC3H,UAAU,EAAE,MAAM,uBAAuB,IAAI,GAAK,MAAM,UAAU,QAAQ,OAAO,aAAa,KAAK,SAAS,MAAM,CAAC;AAAA,EACnH,QAAQ;AAAA,IACJ,MAAM;AAAA,IAA4B,IAAI;AAAA,IAAK,QAAQ;AAAA,IAAK,aAAa;AAAA,IAAK,WAAW;AAAA,IACrF,UAAU;AAAA,EACd,CAAC;AAAA,EACD;AAAA,IACI,EAAE,MAAM,6BAA6B,IAAI,GAAK,aAAa,KAAK,WAAW,WAAW;AAAA,IACtF,MAAM,EAAE,MAAM,cAAc,IAAI,GAAK,MAAM,UAAU,aAAa,KAAK,YAAY,UAAU,UAAU,KAAK,CAAC;AAAA,EACjH;AACJ;AAEA,iBAAiB,SAAS,KAAK,qBAAqB;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@matter/model",
-    "version": "0.18.0",
+    "version": "0.18.1-alpha.0-20261111-b84c5d1bc",
     "description": "Matter data model",
     "keywords": [
         "iot",
@@ -30,10 +30,10 @@
         "coverage": "c8 matter-test esm"
     },
     "dependencies": {
-        "@matter/general": "0.18.0"
+        "@matter/general": "0.18.1-alpha.0-20261111-b84c5d1bc"
     },
     "devDependencies": {
-        "@matter/testing": "0.18.0"
+        "@matter/testing": "0.18.1-alpha.0-20261111-b84c5d1bc"
     },
     "files": [
         "dist/**/*",

package/src/decoration/decorators/index.ts

@@ -16,4 +16,5 @@ export * from "./mandatory.js";
 export * from "./nonvolatile.js";
 export * from "./nullable.js";
 export * from "./response.js";
+export * from "./secret.js";
 export * from "./writable.js";

package/src/decoration/decorators/secret.ts

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { InvalidMetadataError } from "#decoration/errors.js";
+import { FieldSemantics } from "#decoration/semantics/FieldSemantics.js";
+import { ValueModel } from "#models/ValueModel.js";
+import { Decorator } from "@matter/general";
+
+/**
+ * Mark a field as secret, such as a key or a password.  Log output replaces its value with a placeholder.
+ *
+ * @see {@link ValueModel.isSecret}
+ */
+export const secret = Decorator<Decorator.PropertyCollector>((_target, context) => {
+    const model = FieldSemantics.of(context).mutableModel;
+    if (!(model instanceof ValueModel)) {
+        throw new InvalidMetadataError("Only value models may be secret");
+    }
+    model.isSecret = true;
+});

package/src/decoration/semantics/ClassSemantics.ts

@@ -47,6 +47,7 @@ interface MatterMetadata {
 export class ClassSemantics extends Semantics {
     #new?: ClassSemantics.Constructor;
     #definedFields?: Map<string, FieldSemantics>;
+    #afterFinalizeFailure?: { error: unknown };
 
     /**
      * The model that represents the semantics for this class.
@@ -293,6 +294,9 @@ export class ClassSemantics extends Semantics {
 
     override finalize() {
         if (this.isFinal) {
+            if (this.#afterFinalizeFailure) {
+                throw this.#afterFinalizeFailure.error;
+            }
             return;
         }
 
@@ -308,6 +312,13 @@ export class ClassSemantics extends Semantics {
 
         // Apply base finalization
         super.finalize();
+
+        try {
+            this.#new?.[ClassSemantics.afterFinalize]?.(this);
+        } catch (error) {
+            this.#afterFinalizeFailure = { error };
+            throw error;
+        }
     }
 
     #applyBaseSemantics() {
@@ -375,9 +386,16 @@ export namespace ClassSemantics {
      */
     export interface Constructor extends NewableFunction {
         /**
-         * If present, invoked for custom decoration after installing constructor.
+         * If present, invoked for custom decoration at the start of finalization, before fields and model are final.
          */
         [extend]?: (semantics: ClassSemantics) => void;
+
+        /**
+         * If present, invoked once the class's model is final, for logic that needs the complete model.  Runs once.  An
+         * error it throws reaches the caller that triggered finalization and every later {@link ClassSemantics.finalize},
+         * so the class stays unusable rather than appearing valid without what the hook adds.
+         */
+        [afterFinalize]?: (semantics: ClassSemantics) => void;
     }
 
     /**
@@ -386,4 +404,5 @@ export namespace ClassSemantics {
     export type Source = Constructor | DecoratorContext | ClassSemantics;
 
     export const extend = Symbol("extend");
+    export const afterFinalize = Symbol("afterFinalize");
 }

package/src/decoration/semantics/Semantics.ts

@@ -158,6 +158,10 @@ export abstract class Semantics {
             replacement.quality = original.quality;
         }
 
+        if ("isSecret" in original && "isSecret" in replacement) {
+            replacement.isSecret = original.isSecret;
+        }
+
         this.#localModel = replacement;
     }
 

package/src/elements/ValueElement.ts

@@ -46,6 +46,12 @@ export type ValueElement = BaseElement & {
      */
     byteSize?: ValueElement.ByteSize;
 
+    /**
+     * The value is a secret such as a key, a passcode or a network credential.  Log output replaces the value with a
+     * placeholder.  This is a matter.js extension; the Matter specification has no such quality.
+     */
+    isSecret?: boolean;
+
     /**
      * The default value for the element.
      */

package/src/logic/ModelDiff.ts

@@ -93,7 +93,7 @@ function propertyChangesOf(from: Model, to: Model) {
     return changes;
 }
 
-/** Documentation, how a local override applies, and whether the element came from a seed model */
+/** Documentation, how a local override applies, whether the element came from a seed model and the matter.js secret mark */
 const IGNORED_PROPERTIES = new Set([
     "tag",
     "name",
@@ -105,6 +105,7 @@ const IGNORED_PROPERTIES = new Set([
     "asOf",
     "until",
     "isSeed",
+    "isSecret",
 ]);
 
 /**

package/src/logic/SecretRedaction.ts

@@ -0,0 +1,147 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { Logger } from "@matter/general";
+import { Metatype } from "../common/Metatype.js";
+import type { ClusterModel } from "../models/ClusterModel.js";
+import type { ValueModel } from "../models/ValueModel.js";
+
+/**
+ * Removes values marked {@link ValueModel.effectiveIsSecret} from data before it is logged.
+ *
+ * The redacting functions return their input unchanged while {@link Logger.redactSecrets} is false.
+ */
+export namespace SecretRedaction {
+    /**
+     * The text that replaces each secret value in the output of {@link redact}.
+     */
+    export const PLACEHOLDER = "(redacted)";
+
+    const containsSecretCache = new WeakMap<ValueModel, boolean>();
+
+    /**
+     * Return {@link value} with every value that {@link model} marks as secret replaced by {@link PLACEHOLDER}.
+     *
+     * The result is a copy wherever a secret was replaced, so the secret is not reachable from it.  The input is not
+     * modified.  Without a model or without a secret in the model the input is returned as is.  Properties the model
+     * does not define stay unchanged.
+     */
+    export function redact(model: ValueModel | undefined, value: unknown): unknown {
+        if (!Logger.redactSecrets || model === undefined || !containsSecret(model)) {
+            return value;
+        }
+        return redactValue(model, value);
+    }
+
+    /**
+     * {@link redact} for a single entry of the list {@link listModel} describes, such as an entry a chunked write
+     * appends.  The entry is replaced if the list itself is secret.
+     */
+    export function redactEntry(listModel: ValueModel | undefined, entry: unknown): unknown {
+        if (Logger.redactSecrets && listModel?.effectiveIsSecret && entry !== undefined && entry !== null) {
+            return PLACEHOLDER;
+        }
+        return redact(listModel?.listEntry, entry);
+    }
+
+    /**
+     * {@link redact} for attribute values of {@link cluster} keyed by property name, such as the state of a cluster.
+     */
+    export function redactAttributes(cluster: ClusterModel, values: object): object {
+        const attributes = [...cluster.attributes];
+        if (!Logger.redactSecrets || !attributes.some(containsSecret)) {
+            return values;
+        }
+        return redactProperties(attributes, values);
+    }
+
+    /**
+     * Whether {@link model} or any of its members, at any depth, is secret.
+     *
+     * Results are cached per model, so a model must be marked secret before data of it is first redacted.
+     */
+    export function containsSecret(model: ValueModel): boolean {
+        let result = containsSecretCache.get(model);
+        if (result === undefined) {
+            result = searchSecret(model, new Set());
+            containsSecretCache.set(model, result);
+        }
+        return result;
+    }
+
+    function searchSecret(model: ValueModel, visiting: Set<ValueModel>): boolean {
+        if (model.effectiveIsSecret) {
+            return true;
+        }
+        if (visiting.has(model)) {
+            return false;
+        }
+        visiting.add(model);
+        for (const child of childModelsOf(model)) {
+            if (searchSecret(child, visiting)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    function redactValue(model: ValueModel, value: unknown): unknown {
+        if (value === undefined || value === null) {
+            return value;
+        }
+
+        if (model.effectiveIsSecret) {
+            return PLACEHOLDER;
+        }
+
+        if (!containsSecret(model)) {
+            return value;
+        }
+
+        switch (model.effectiveMetatype) {
+            case Metatype.array: {
+                const entry = model.listEntry;
+                if (entry === undefined || !Array.isArray(value)) {
+                    return value;
+                }
+                return value.map(item => redactValue(entry, item));
+            }
+
+            case Metatype.object: {
+                if (typeof value !== "object" || Array.isArray(value)) {
+                    return value;
+                }
+                return redactProperties(model.members, value);
+            }
+        }
+
+        return value;
+    }
+
+    function redactProperties(members: Iterable<ValueModel>, value: object) {
+        const result: Record<string, unknown> = { ...value };
+        for (const member of members) {
+            const name = member.propertyName;
+            if (name in result) {
+                result[name] = redactValue(member, result[name]);
+            }
+        }
+        return result;
+    }
+
+    function childModelsOf(model: ValueModel): Iterable<ValueModel> {
+        switch (model.effectiveMetatype) {
+            case Metatype.array: {
+                const entry = model.listEntry;
+                return entry === undefined ? [] : [entry];
+            }
+
+            case Metatype.object:
+                return model.members;
+        }
+        return [];
+    }
+}

package/src/logic/SelectDefaultValue.ts

@@ -5,7 +5,9 @@
  */
 
 import { FieldValue, Metatype } from "../common/index.js";
+import { AttributeModel, ClusterModel } from "../models/index.js";
 import type { ValueModel } from "../models/ValueModel.js";
+import { ClusterRevision } from "../standard/elements/definitions.js";
 import { DecodedBitmap } from "./DecodedBitmap.js";
 import { DefaultValue } from "./DefaultValue.js";
 import type { Scope } from "./Scope.js";
@@ -23,6 +25,11 @@ export function SelectDefaultValue(scope: Scope, member: ValueModel): unknown {
         return;
     }
 
+    // A cluster outside the standard model shares the global ClusterRevision, which states no default
+    if (member instanceof AttributeModel && member.id === ClusterRevision.id && scope.owner instanceof ClusterModel) {
+        return scope.owner.revision;
+    }
+
     return defaultValueForMetatype(scope, member);
 }
 

package/src/logic/definition-validation/ValueValidator.ts

@@ -90,6 +90,7 @@ export class ValueValidator<T extends ValueModel> extends ModelValidator<T> {
         this.validateProperty({ name: "access", type: Access });
         this.validateProperty({ name: "quality", type: Quality });
         this.validateProperty({ name: "metatype", type: Metatype });
+        this.validateProperty({ name: "isSecret", type: "boolean" });
 
         this.#validateAspect("conformance");
         this.model.conformance.validateReferences(this, name => this.resolveReference(name));

package/src/logic/index.ts

@@ -21,6 +21,7 @@ export * from "./ModelVariantTraversal.js";
 export * from "./RequirementApplicability.js";
 export * from "./RequirementResolver.js";
 export * from "./Scope.js";
+export * from "./SecretRedaction.js";
 export * from "./SelectDefaultValue.js";
 export * from "./ValidateModel.js";
 import "./definition-validation/index.js";

package/src/models/AttributeModel.ts

@@ -5,6 +5,7 @@
  */
 
 import { Access } from "../aspects/Access.js";
+import { Metatype } from "../common/Metatype.js";
 import { AttributeElement } from "../elements/index.js";
 import { Model } from "./Model.js";
 import { PropertyModel } from "./PropertyModel.js";
@@ -31,6 +32,17 @@ export class AttributeModel extends PropertyModel<AttributeElement> implements A
         return fabric === Access.Fabric.Scoped || fabric === Access.Fabric.Sensitive;
     }
 
+    /**
+     * Whether the attribute is a fabric-scoped list: a list with fabric-scoped (`F`) or fabric-sensitive (`S`) access.
+     *
+     * @see {@link MatterSpecification.v161.Core} § 7.6.4.1
+     * @see {@link MatterSpecification.v161.Core} § 7.6.5.1
+     * @see {@link MatterSpecification.v161.Core} § 7.19.1.8.1
+     */
+    override get fabricScopedList() {
+        return this.fabricScoped && this.effectiveMetatype === Metatype.array;
+    }
+
     /**
      * Whether the attribute is fabric-sensitive; a read returns only the accessing fabric's entries of its list.
      *

package/src/models/ValueModel.ts

@@ -27,6 +27,7 @@ export abstract class ValueModel<T extends ValueElement = ValueElement>
     byteSize?: ValueElement.ByteSize;
     default?: FieldValue;
     metatype?: Metatype;
+    isSecret?: boolean;
     override isType? = true;
 
     #constraint: Constraint;
@@ -74,6 +75,19 @@ export abstract class ValueModel<T extends ValueElement = ValueElement>
         return new ModelTraversal().findAspect(this, "quality", Quality) ?? this.#quality;
     }
 
+    /**
+     * Whether this model or a model in its {@link base} chain is marked {@link ValueElement.isSecret}.  The chain
+     * includes the field a derived cluster's field shadows if both have the same type or the derived field has none.
+     */
+    get effectiveIsSecret(): boolean {
+        for (let model: ValueModel | undefined = this; model !== undefined; model = model.base) {
+            if (model.isSecret) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     get fields() {
         return Scope(this).membersOf(this, { tags: [ElementTag.Field] }) as ModelIndex<FieldModel>;
     }
@@ -152,6 +166,19 @@ export abstract class ValueModel<T extends ValueElement = ValueElement>
         return new ModelTraversal().findDefiningModel(this);
     }
 
+    /**
+     * Whether the value is a list whose entries a session of one fabric may see filtered by its fabric: a list with
+     * fabric-scoped (`F`) access.  An `AttributeModel` also counts fabric-sensitive (`S`) access, which on a
+     * struct field only hides that field from other fabrics.
+     *
+     * @see {@link MatterSpecification.v161.Core} § 7.6.4.1
+     * @see {@link MatterSpecification.v161.Core} § 7.6.5.1
+     * @see {@link MatterSpecification.v161.Core} § 7.19.1.8.1
+     */
+    get fabricScopedList() {
+        return this.effectiveAccess.fabric === Access.Fabric.Scoped && this.effectiveMetatype === Metatype.array;
+    }
+
     /**
      * Get the entry type for lists, if any.
      */
@@ -320,6 +347,7 @@ export abstract class ValueModel<T extends ValueElement = ValueElement>
 
         this.byteSize = definition.byteSize;
         this.default = definition.default;
+        this.isSecret = definition.isSecret;
         this.#constraint = Constraint.create(definition.constraint);
         this.#conformance = Conformance.create(definition.conformance);
         this.#access = Access.create(definition.access);
@@ -336,6 +364,7 @@ export abstract class ValueModel<T extends ValueElement = ValueElement>
         return super.toElement(omitResources, {
             byteSize: this.byteSize,
             default: this.default,
+            isSecret: this.isSecret,
             constraint: this.#constraint.valueOf(),
             conformance: this.#conformance.valueOf(),
             access: this.#access.valueOf(),

package/src/standard/elements/account-login.element.ts

@@ -33,13 +33,13 @@ export const AccountLogin = Cluster(
 
     Command(
         { name: "GetSetupPinResponse", id: 0x1, access: "F", conformance: "M", direction: "response" },
-        Field({ name: "SetupPin", id: 0x0, type: "string", conformance: "M", constraint: "desc" })
+        Field({ name: "SetupPin", id: 0x0, type: "string", conformance: "M", constraint: "desc", isSecret: true })
     ),
 
     Command(
         { name: "Login", id: 0x2, access: "F A T", conformance: "M", direction: "request", response: "status" },
         Field({ name: "TempAccountIdentifier", id: 0x0, type: "string", conformance: "M", constraint: "16 to 100" }),
-        Field({ name: "SetupPin", id: 0x1, type: "string", conformance: "M", constraint: "min 8" }),
+        Field({ name: "SetupPin", id: 0x1, type: "string", conformance: "M", constraint: "min 8", isSecret: true }),
         Field({ name: "Node", id: 0x2, type: "node-id", conformance: "O" })
     ),
 

package/src/standard/elements/administrator-commissioning.element.ts

@@ -32,7 +32,7 @@ export const AdministratorCommissioning = Cluster(
             response: "status"
         },
         Field({ name: "CommissioningTimeout", id: 0x0, type: "uint16", conformance: "M", constraint: "desc" }),
-        Field({ name: "PakePasscodeVerifier", id: 0x1, type: "octstr", conformance: "M", constraint: "97" }),
+        Field({ name: "PakePasscodeVerifier", id: 0x1, type: "octstr", conformance: "M", constraint: "97", isSecret: true }),
         Field({ name: "Discriminator", id: 0x2, type: "uint16", conformance: "M", constraint: "0 to 4095" }),
         Field({ name: "Iterations", id: 0x3, type: "uint32", conformance: "M", constraint: "1000 to 100000" }),
         Field({ name: "Salt", id: 0x4, type: "octstr", conformance: "M", constraint: "16 to 32" })

package/src/standard/elements/commissioner-control.element.ts

@@ -58,7 +58,7 @@ export const CommissionerControl = Cluster(
     Command(
         { name: "ReverseOpenCommissioningWindow", id: 0x2, conformance: "M", direction: "response" },
         Field({ name: "CommissioningTimeout", id: 0x0, type: "uint16", conformance: "M", constraint: "desc" }),
-        Field({ name: "PakePasscodeVerifier", id: 0x1, type: "octstr", conformance: "M", constraint: "97" }),
+        Field({ name: "PakePasscodeVerifier", id: 0x1, type: "octstr", conformance: "M", constraint: "97", isSecret: true }),
         Field({ name: "Discriminator", id: 0x2, type: "uint16", conformance: "M", constraint: "max 4095" }),
         Field({ name: "Iterations", id: 0x3, type: "uint32", conformance: "M", constraint: "1000 to 100000" }),
         Field({ name: "Salt", id: 0x4, type: "octstr", conformance: "M", constraint: "16 to 32" })

package/src/standard/elements/content-control.element.ts

@@ -76,19 +76,19 @@ export const ContentControl = Cluster(
     Event({ name: "EnteringBlockContentTimeWindow", id: 0x1, access: "V", conformance: "BTW", priority: "info" }),
     Command(
         { name: "UpdatePin", id: 0x0, access: "M T", conformance: "PM", direction: "request", response: "status" },
-        Field({ name: "OldPin", id: 0x0, type: "string", conformance: "M", constraint: "max 6" }),
-        Field({ name: "NewPin", id: 0x1, type: "string", conformance: "M", constraint: "max 6" })
+        Field({ name: "OldPin", id: 0x0, type: "string", conformance: "M", constraint: "max 6", isSecret: true }),
+        Field({ name: "NewPin", id: 0x1, type: "string", conformance: "M", constraint: "max 6", isSecret: true })
     ),
     Command({ name: "ResetPin", id: 0x1, access: "A T", conformance: "PM", direction: "request", response: "ResetPinResponse" }),
     Command(
         { name: "ResetPinResponse", id: 0x2, conformance: "PM", direction: "response" },
-        Field({ name: "PinCode", id: 0x0, type: "string", conformance: "M", constraint: "max 6" })
+        Field({ name: "PinCode", id: 0x0, type: "string", conformance: "M", constraint: "max 6", isSecret: true })
     ),
     Command({ name: "Enable", id: 0x3, access: "M T", conformance: "M", direction: "request", response: "status" }),
     Command({ name: "Disable", id: 0x4, access: "M T", conformance: "M", direction: "request", response: "status" }),
     Command(
         { name: "AddBonusTime", id: 0x5, access: "O", conformance: "ST", direction: "request", response: "status" },
-        Field({ name: "PinCode", id: 0x0, type: "string", conformance: "O", constraint: "max 6" }),
+        Field({ name: "PinCode", id: 0x0, type: "string", conformance: "O", constraint: "max 6", isSecret: true }),
         Field({ name: "BonusTime", id: 0x1, type: "elapsed-s", conformance: "M", constraint: "desc", default: 300 })
     ),
 

package/src/standard/elements/door-lock-cluster.element.ts

@@ -148,7 +148,7 @@ export const DoorLock = Cluster(
 
     Attribute({
         name: "AliroGroupResolvingKey", id: 0x84, type: "octstr", access: "R A", conformance: "ALBU",
-        constraint: "16", quality: "X"
+        constraint: "16", isSecret: true, quality: "X"
     }),
 
     Attribute(
@@ -228,11 +228,11 @@ export const DoorLock = Cluster(
 
     Command(
         { name: "LockDoor", id: 0x0, access: "O T", conformance: "M", direction: "request", response: "status" },
-        Field({ name: "PinCode", id: 0x0, type: "octstr", conformance: "[COTA & PIN]" })
+        Field({ name: "PinCode", id: 0x0, type: "octstr", conformance: "[COTA & PIN]", isSecret: true })
     ),
     Command(
         { name: "UnlockDoor", id: 0x1, access: "O T", conformance: "M", direction: "request", response: "status" },
-        Field({ name: "PinCode", id: 0x0, type: "octstr", conformance: "[COTA & PIN]" })
+        Field({ name: "PinCode", id: 0x0, type: "octstr", conformance: "[COTA & PIN]", isSecret: true })
     ),
     Command({ name: "Toggle", id: 0x2, access: "O T", conformance: "X", direction: "request", response: "status" }),
 
@@ -242,7 +242,7 @@ export const DoorLock = Cluster(
             response: "status"
         },
         Field({ name: "Timeout", id: 0x0, type: "uint16", conformance: "M" }),
-        Field({ name: "PinCode", id: 0x1, type: "octstr", conformance: "[COTA & PIN]" })
+        Field({ name: "PinCode", id: 0x1, type: "octstr", conformance: "[COTA & PIN]", isSecret: true })
     ),
 
     Command(
@@ -501,7 +501,7 @@ export const DoorLock = Cluster(
         },
         Field({ name: "OperationType", id: 0x0, type: "DataOperationTypeEnum", conformance: "M", constraint: "add, modify" }),
         Field({ name: "Credential", id: 0x1, type: "CredentialStruct", conformance: "M" }),
-        Field({ name: "CredentialData", id: 0x2, type: "octstr", conformance: "M", constraint: "desc" }),
+        Field({ name: "CredentialData", id: 0x2, type: "octstr", conformance: "M", constraint: "desc", isSecret: true }),
         Field({
             name: "UserIndex", id: 0x3, type: "uint16", conformance: "M",
             constraint: "1 to numberOfTotalUsersSupported", quality: "X"
@@ -558,7 +558,7 @@ export const DoorLock = Cluster(
 
     Command(
         { name: "UnboltDoor", id: 0x27, access: "O T", conformance: "UBOLT", direction: "request", response: "status" },
-        Field({ name: "PinCode", id: 0x0, type: "octstr", conformance: "[COTA & PIN]" })
+        Field({ name: "PinCode", id: 0x0, type: "octstr", conformance: "[COTA & PIN]", isSecret: true })
     ),
 
     Command(
@@ -566,10 +566,10 @@ export const DoorLock = Cluster(
             name: "SetAliroReaderConfig", id: 0x28, access: "A T", conformance: "ALIRO", direction: "request",
             response: "status"
         },
-        Field({ name: "SigningKey", id: 0x0, type: "octstr", conformance: "M", constraint: "32" }),
+        Field({ name: "SigningKey", id: 0x0, type: "octstr", conformance: "M", constraint: "32", isSecret: true }),
         Field({ name: "VerificationKey", id: 0x1, type: "octstr", conformance: "M", constraint: "65" }),
         Field({ name: "GroupIdentifier", id: 0x2, type: "octstr", conformance: "M", constraint: "16" }),
-        Field({ name: "GroupResolvingKey", id: 0x3, type: "octstr", conformance: "ALBU", constraint: "16" })
+        Field({ name: "GroupResolvingKey", id: 0x3, type: "octstr", conformance: "ALBU", constraint: "16", isSecret: true })
     ),
 
     Command({

package/src/standard/elements/general-diagnostics.element.ts

@@ -92,7 +92,7 @@ export const GeneralDiagnostics = Cluster(
     ),
     Command(
         { name: "TestEventTrigger", id: 0x0, access: "M", conformance: "M", direction: "request", response: "status" },
-        Field({ name: "EnableKey", id: 0x0, type: "octstr", conformance: "M", constraint: "16" }),
+        Field({ name: "EnableKey", id: 0x0, type: "octstr", conformance: "M", constraint: "16", isSecret: true }),
         Field({ name: "EventTrigger", id: 0x1, type: "uint64", conformance: "M" })
     ),
     Command({
@@ -110,7 +110,7 @@ export const GeneralDiagnostics = Cluster(
             name: "PayloadTestRequest", id: 0x3, access: "M", conformance: "DMTEST", direction: "request",
             response: "PayloadTestResponse"
         },
-        Field({ name: "EnableKey", id: 0x0, type: "octstr", conformance: "M", constraint: "16" }),
+        Field({ name: "EnableKey", id: 0x0, type: "octstr", conformance: "M", constraint: "16", isSecret: true }),
         Field({ name: "Value", id: 0x1, type: "uint8", conformance: "M" }),
         Field({ name: "Count", id: 0x2, type: "uint16", conformance: "M", constraint: "max 2048" })
     ),

package/src/standard/elements/group-key-management.element.ts

@@ -114,11 +114,20 @@ export const GroupKeyManagement = Cluster(
         { name: "GroupKeySetStruct", type: "struct" },
         Field({ name: "GroupKeySetId", id: 0x0, type: "uint16", access: "F", conformance: "M" }),
         Field({ name: "GroupKeySecurityPolicy", id: 0x1, type: "GroupKeySecurityPolicyEnum", access: "F", conformance: "M" }),
-        Field({ name: "EpochKey0", id: 0x2, type: "octstr", access: "F", conformance: "M", constraint: "16", quality: "X" }),
+        Field({
+            name: "EpochKey0", id: 0x2, type: "octstr", access: "F", conformance: "M", constraint: "16",
+            isSecret: true, quality: "X"
+        }),
         Field({ name: "EpochStartTime0", id: 0x3, type: "epoch-us", access: "F", conformance: "M", quality: "X" }),
-        Field({ name: "EpochKey1", id: 0x4, type: "octstr", access: "F", conformance: "M", constraint: "16", quality: "X" }),
+        Field({
+            name: "EpochKey1", id: 0x4, type: "octstr", access: "F", conformance: "M", constraint: "16",
+            isSecret: true, quality: "X"
+        }),
         Field({ name: "EpochStartTime1", id: 0x5, type: "epoch-us", access: "F", conformance: "M", quality: "X" }),
-        Field({ name: "EpochKey2", id: 0x6, type: "octstr", access: "F", conformance: "M", constraint: "16", quality: "X" }),
+        Field({
+            name: "EpochKey2", id: 0x6, type: "octstr", access: "F", conformance: "M", constraint: "16",
+            isSecret: true, quality: "X"
+        }),
         Field({ name: "EpochStartTime2", id: 0x7, type: "epoch-us", access: "F", conformance: "M", quality: "X" }),
         Field({
             name: "GroupKeyMulticastPolicy", id: 0x8, type: "GroupKeyMulticastPolicyEnum", access: "F",

package/src/standard/elements/groupcast.element.ts

@@ -67,7 +67,7 @@ export const Groupcast = Cluster(
             Field({ name: "entry", type: "endpoint-no" })
         ),
         Field({ name: "KeySetId", id: 0x2, type: "uint16", conformance: "M", constraint: "min 1" }),
-        Field({ name: "Key", id: 0x3, type: "octstr", conformance: "O", constraint: "16" }),
+        Field({ name: "Key", id: 0x3, type: "octstr", conformance: "O", constraint: "16", isSecret: true }),
         Field({ name: "UseAuxiliaryAcl", id: 0x4, type: "bool", conformance: "[LN]" }),
         Field({ name: "ReplaceEndpoints", id: 0x5, type: "bool", conformance: "[LN]" }),
         Field({ name: "McastAddrPolicy", id: 0x6, type: "MulticastAddrPolicyEnum", conformance: "O" })
@@ -98,7 +98,7 @@ export const Groupcast = Cluster(
         { name: "UpdateGroupKey", id: 0x3, access: "F M", conformance: "M", direction: "request", response: "status" },
         Field({ name: "GroupId", id: 0x0, type: "group-id", conformance: "M", constraint: "min 1" }),
         Field({ name: "KeySetId", id: 0x1, type: "uint16", conformance: "M", constraint: "min 1" }),
-        Field({ name: "Key", id: 0x2, type: "octstr", conformance: "O", constraint: "16" })
+        Field({ name: "Key", id: 0x2, type: "octstr", conformance: "O", constraint: "16", isSecret: true })
     ),
 
     Command(