@matter/node 0.16.0-alpha.0-20251023-bb23617e5 → 0.16.0-alpha.0-20251029-bd92894d4

package/src/behavior/cluster/ClusterBehaviorUtil.ts

@@ -9,6 +9,8 @@ import { camelize, EventEmitter, GeneratedClass, ImplementationError, Observable
 import {
     ClassSemantics,
     ClusterModel,
+    Conformance,
+    DecodedBitmap,
     DefaultValue,
     ElementTag,
     FeatureMap,
@@ -20,7 +22,7 @@ import {
     ValueModel,
 } from "#model";
 import { Val } from "#protocol";
-import { Attribute, ClusterType } from "#types";
+import { ClusterType } from "#types";
 import { Behavior } from "../Behavior.js";
 import { DerivedState } from "../state/StateType.js";
 import type { ClusterBehavior } from "./ClusterBehavior.js";
@@ -82,8 +84,7 @@ export function createType<const C extends ClusterType>(
         }
     }
 
-    const newProps = {} as Record<string, ValueModel>;
-    const scope = Scope(schema);
+    const context = DerivationContext(schema, cluster, base);
 
     const type = GeneratedClass({
         name,
@@ -93,9 +94,9 @@ export function createType<const C extends ClusterType>(
         // namespace overrides.  If we instead override as static properties then we lose the automatic interface type.
         // So just publish as static properties.
         staticProperties: {
-            State: createDerivedState(cluster, scope, base, newProps),
+            State: createDerivedState(context),
 
-            Events: createDerivedEvents(cluster, scope, base, newProps),
+            Events: createDerivedEvents(context),
         },
 
         staticDescriptors: {
@@ -140,18 +141,52 @@ export type ExtensionInterfaceOf<B extends Behavior.Type> = B extends { Extensio
     ? I
     : {};
 
+interface DerivationContext {
+    cluster: ClusterType;
+    scope: Scope;
+    featuresAvailable: FeatureSet;
+    featuresSupported: FeatureSet;
+    base: Behavior.Type;
+    newProps: Record<string, ValueModel>;
+}
+
+function DerivationContext(schema: Schema, cluster: ClusterType, base: Behavior.Type): DerivationContext {
+    const scope = Scope(schema);
+    // Determine the set of features so we can test element applicability
+    let featuresAvailable, featuresSupported;
+    if (scope.owner instanceof ClusterModel) {
+        const normalized = FeatureSet.normalize(scope.owner.featureMap, scope.owner.supportedFeatures);
+        featuresAvailable = normalized.featuresAvailable;
+        featuresSupported = normalized.featuresSupported;
+    } else {
+        featuresAvailable = new FeatureSet();
+        featuresSupported = new FeatureSet();
+    }
+
+    return {
+        cluster,
+        scope: Scope(schema),
+        featuresAvailable,
+        featuresSupported,
+        base,
+        newProps: {},
+    };
+}
+
 /**
  * Create a new state subclass that inherits relevant default values from a base Behavior.Type and adds new default
  * values from cluster attributes.
  *
  * Note - we only use the cluster here for default values
  */
-function createDerivedState(
-    cluster: ClusterType,
-    scope: Scope,
-    base: Behavior.Type,
-    newProps: Record<string, ValueModel>,
-) {
+function createDerivedState({
+    cluster,
+    scope,
+    base,
+    newProps,
+    featuresAvailable,
+    featuresSupported,
+}: DerivationContext) {
     const BaseState = base["State"];
     if (BaseState === undefined) {
         throw new ImplementationError(`No state class defined for behavior class ${base.name}`);
@@ -160,17 +195,6 @@ function createDerivedState(
     const oldDefaults = new BaseState() as Record<string, any>;
     let knownDefaults = (BaseState as HasKnownDefaults)[KNOWN_DEFAULTS];
 
-    // Determine the set of features so we can test attribute applicability
-    let featuresAvailable, featuresSupported;
-    if (scope.owner instanceof ClusterModel) {
-        const normalized = FeatureSet.normalize(scope.owner.featureMap, scope.owner.supportedFeatures);
-        featuresAvailable = normalized.featuresAvailable;
-        featuresSupported = normalized.featuresSupported;
-    } else {
-        featuresAvailable = new FeatureSet();
-        featuresSupported = new FeatureSet();
-    }
-
     // Index schema members by name
     const props = {} as Record<string, ValueModel[]>;
     for (const member of scope.membersOf(scope.owner, { conformance: "deconflicted" })) {
@@ -191,21 +215,22 @@ function createDerivedState(
         let propSchema: ValueModel | undefined;
 
         // Determine whether the attribute applies
+        let applicability;
         for (const attr of attrs) {
-            const applicability = attr.effectiveConformance.applicabilityOf(featuresAvailable, featuresSupported);
+            applicability = attr.effectiveConformance.applicabilityOf(featuresAvailable, featuresSupported);
 
             // Inapplicable; ignore
             if (!applicability) {
                 continue;
             }
 
-            // Applicable; add new default.  If conditional then cluster logic must modify
+            // Use this model for the property
             propSchema = attr;
             break;
         }
 
         // If the attribute doesn't apply, erase any previous default unless conditionally applicable
-        if (propSchema === undefined) {
+        if (!propSchema) {
             // Inapplicable; ensure no default is present
             if (oldDefaults[name] !== undefined) {
                 // Save the default value so we can recreate it if a future derivative re-enables this element
@@ -234,12 +259,13 @@ function createDerivedState(
             continue;
         }
 
-        // Make sure a default value is present
+        // Make sure a default value is present if mandatory or marked as supported (note that the default value may
+        // be "undefined" to indicate that an attribute is available optionally)
         defaults[name] = selectDefaultValue(
             scope,
             oldDefaults[name] === undefined ? knownDefaults?.[name] : oldDefaults[name],
-            attribute,
             propSchema,
+            applicability,
         );
     }
 
@@ -259,19 +285,14 @@ function createDerivedState(
 /**
  * Extend events with additional implementations.
  */
-function createDerivedEvents(
-    cluster: ClusterType,
-    scope: Scope,
-    base: Behavior.Type,
-    newProps: Record<string, ValueModel>,
-) {
+function createDerivedEvents({ scope, base, newProps, featuresAvailable, featuresSupported }: DerivationContext) {
     const instanceDescriptors = {} as PropertyDescriptorMap;
 
     const baseInstance = new base.Events() as unknown as Record<string, unknown>;
 
     const eventNames = new Set<string>();
 
-    // Add mandatory events that are not present in the base class
+    // Add events that are mandatory or marked as supported and not present in the base class
     const applicableClusterEvents = new Set();
     for (const event of scope.membersOf(scope.owner as Schema, {
         conformance: "conformant",
@@ -279,7 +300,12 @@ function createDerivedEvents(
     })) {
         const name = camelize(event.name);
         applicableClusterEvents.add(name);
-        if (!cluster.events[name]?.optional && baseInstance[name] === undefined) {
+        if (
+            (event.conformance.applicabilityOf(featuresAvailable, featuresSupported) ===
+                Conformance.Applicability.Mandatory ||
+                event.isSupported) &&
+            baseInstance[name] === undefined
+        ) {
             eventNames.add(name);
             instanceDescriptors[name] = createEventDescriptor(
                 name,
@@ -312,7 +338,7 @@ function createDerivedEvents(
     // TODO - if necessary, mask out (set to undefined) events present in base cluster but not derived cluster
 
     return GeneratedClass({
-        name: `${cluster.name}$Events`,
+        name: `${base.name}$Events`,
         base: base.Events,
 
         instanceDescriptors,
@@ -413,43 +439,43 @@ function createDefaultCommandDescriptors(cluster: ClusterType, base: Behavior.Ty
     return result;
 }
 
-function selectDefaultValue(scope: Scope, oldDefault: Val, clusterAttr?: Attribute<any, any>, schemaProp?: ValueModel) {
+function selectDefaultValue(
+    scope: Scope,
+    oldDefault: Val,
+    member: ValueModel,
+    applicability?: Conformance.Applicability,
+) {
     if (oldDefault !== undefined) {
         return oldDefault;
     }
 
-    // Use cluster attribute rather than model attribute because currently "enable" modifies the cluster, not the schema
-    if (clusterAttr?.optional) {
+    // No default unless mandatory or explicitly marked as implemented
+    if (applicability !== Conformance.Applicability.Mandatory && !member.isSupported) {
         return;
     }
 
-    // Use cluster attribute rather than model attribute because currently "set" modifies the cluster, not the schema
-    if (clusterAttr?.default !== undefined) {
-        return clusterAttr.default;
-    }
-
-    // Following checks use the schema
-    if (!schemaProp) {
-        return;
+    // If there's an explicit default, use that
+    const effectiveDefault = DefaultValue(scope, member);
+    if (effectiveDefault !== undefined) {
+        if (member.effectiveMetatype === "bitmap") {
+            return DecodedBitmap(member, effectiveDefault);
+        }
+        return effectiveDefault;
     }
 
-    if (schemaProp.nullable) {
+    // Default for nullable is null
+    if (member.nullable) {
         return null;
     }
 
-    const effectiveDefault = DefaultValue(scope, schemaProp);
-    if (effectiveDefault) {
-        return effectiveDefault;
-    }
+    switch (member.effectiveMetatype) {
+        case Metatype.integer:
+        case Metatype.float:
+            return 0;
 
-    // TODO - skip the following defaults if conformance is not absolutely mandatory.  This is pretty limited, may need
-    // to use more sophisticated evaluation if insufficient
-    const conformance = schemaProp.effectiveConformance;
-    if (!conformance.isMandatory) {
-        return;
-    }
+        case Metatype.boolean:
+            return false;
 
-    switch (schemaProp.effectiveMetatype) {
         case Metatype.bitmap:
         case Metatype.object:
             // This is not a very good default but it is better than undefined

package/src/behavior/internal/BehaviorBacking.ts

@@ -13,7 +13,7 @@ import type { SupportedElements } from "#endpoint/properties/Behaviors.js";
 import {
     camelize,
     Construction,
-    Crypto,
+    Entropy,
     EventEmitter,
     ImplementationError,
     InternalError,
@@ -212,7 +212,7 @@ export abstract class BehaviorBacking {
 
     protected get datasourceOptions(): Datasource.Options {
         return {
-            crypto: this.#endpoint.env.get(Crypto),
+            entropy: this.#endpoint.env.get(Entropy),
             location: {
                 path: this.#endpoint.path.at(this.#type.id).at("state"),
                 endpoint: this.#endpoint.number,

package/src/behavior/state/managed/Datasource.ts

@@ -6,8 +6,8 @@
 
 import {
     camelize,
-    Crypto,
     deepCopy,
+    Entropy,
     ImplementationError,
     InternalError,
     isDeepEqual,
@@ -16,8 +16,7 @@ import {
     Observable,
     Transaction,
 } from "#general";
-import type { Val } from "#protocol";
-import { AccessControl, ExpiredReferenceError, hasRemoteActor } from "#protocol";
+import { AccessControl, ExpiredReferenceError, hasRemoteActor, Val } from "#protocol";
 import { RootSupervisor } from "../../supervision/RootSupervisor.js";
 import { ValueSupervisor } from "../../supervision/ValueSupervisor.js";
 import { StateType } from "../StateType.js";
@@ -154,9 +153,9 @@ export namespace Datasource {
         location: AccessControl.Location;
 
         /**
-         * Used for random data.
+         * Used to generate initial version numbers.
          */
-        crypto: Crypto;
+        entropy: Entropy;
 
         /**
          * Events triggered automatically.
@@ -328,7 +327,7 @@ function configure(options: Datasource.Options): Internals {
         ...options,
         primaryKey: options.primaryKey === "id" ? "id" : "name",
         events,
-        version: options.crypto.randomUint32,
+        version: options.entropy.randomUint32,
         values,
         featuresKey,
         manageVersion: true,
@@ -557,8 +556,16 @@ function createReference(resource: Transaction.Resource, internals: Internals, s
             if (values === internals.values) {
                 const old = values;
                 values = new internals.type();
+
+                const properties = (values as Val.Dynamic)[Val.properties]
+                    ? (values as Val.Dynamic)[Val.properties](this.rootOwner, session)
+                    : undefined;
                 for (const index of fields) {
-                    values[index] = old[index];
+                    if (properties && index in properties) {
+                        // Property is dynamic anyway, so do nothing
+                    } else {
+                        values[index] = old[index];
+                    }
                 }
 
                 // Point subreferences to the clone

package/src/behavior/state/managed/ManagedReference.ts

@@ -31,6 +31,7 @@ type Container = Record<string | number, Val>;
  * @param id the lookup ID in the case of structs
  * @param assertWriteOk enforces ACLs and read-only
  * @param clone clones the container prior to write; undefined if not transactional
+ * @param session the access control session
  *
  * @returns a reference to the property
  */
@@ -41,6 +42,7 @@ export function ManagedReference(
     id: number | undefined,
     assertWriteOk: (value: Val) => void,
     clone: (container: Val) => Val,
+    session: AccessControl.Session,
 ) {
     let expired = false;
     let location = {
@@ -51,10 +53,24 @@ export function ManagedReference(
     const key = primaryKey === "id" ? (id ?? name) : name;
     const altKey = primaryKey === "id" ? (key === name ? undefined : name) : id;
     let value: unknown;
-    if (key in (parent.value as Container)) {
-        value = (parent.value as Container)[key];
-    } else if (altKey !== undefined) {
-        value = (parent.value as Container)[altKey];
+
+    let dynamicContainer: Val.Struct | undefined;
+    if ((parent.value as Val.Dynamic)[Val.properties]) {
+        dynamicContainer = (parent.value as Val.Dynamic)[Val.properties](parent.rootOwner, session);
+        if (key in (dynamicContainer as Container)) {
+            value = (dynamicContainer as Container)[key];
+        } else if (altKey !== undefined && altKey in (dynamicContainer as Container)) {
+            value = (dynamicContainer as Container)[altKey];
+        } else {
+            dynamicContainer = undefined;
+        }
+    }
+    if (dynamicContainer === undefined) {
+        if (key in (parent.value as Container)) {
+            value = (parent.value as Container)[key];
+        } else if (altKey !== undefined) {
+            value = (parent.value as Container)[altKey];
+        }
     }
 
     const reference: Val.Reference = {
@@ -97,9 +113,16 @@ export function ManagedReference(
 
             // Now use change to complete the update
             this.change(() => {
-                (parent.value as Container)[key] = newValue;
-                if (altKey !== undefined && altKey in parent.value) {
-                    delete (parent.value as Container)[altKey];
+                if (dynamicContainer) {
+                    (dynamicContainer as Container)[key] = newValue;
+                    if (altKey !== undefined && altKey in dynamicContainer) {
+                        delete (dynamicContainer as Container)[altKey];
+                    }
+                } else {
+                    (parent.value as Container)[key] = newValue;
+                    if (altKey !== undefined && altKey in parent.value) {
+                        delete (parent.value as Container)[altKey];
+                    }
                 }
             });
         },
@@ -108,11 +131,21 @@ export function ManagedReference(
             if (!parent.original) {
                 return undefined;
             }
-            if (key in parent.original) {
-                return (parent.original as Container)[key];
-            }
-            if (altKey !== undefined) {
-                return (parent.original as Container)[altKey];
+            if (dynamicContainer !== undefined) {
+                const origProperties = (parent.original as Val.Dynamic)[Val.properties](parent.rootOwner, session);
+                if (key in (origProperties as Container)) {
+                    return (origProperties as Container)[key];
+                }
+                if (altKey !== undefined) {
+                    return (origProperties as Container)[altKey];
+                }
+            } else {
+                if (key in parent.original) {
+                    return (parent.original as Container)[key];
+                }
+                if (altKey !== undefined) {
+                    return (parent.original as Container)[altKey];
+                }
             }
         },
 
@@ -125,9 +158,16 @@ export function ManagedReference(
                 // In transactions, clone the value if we haven't done so yet
                 if (clone && value === this.original) {
                     const newValue = clone(value);
-                    (parent.value as Container)[key] = newValue;
-                    if (altKey !== undefined && altKey in (parent.value as Container)) {
-                        delete (parent.value as Container)[altKey];
+                    if (dynamicContainer !== undefined) {
+                        (dynamicContainer as Container)[key] = newValue;
+                        if (altKey !== undefined && altKey in dynamicContainer) {
+                            delete (dynamicContainer as Container)[altKey];
+                        }
+                    } else {
+                        (parent.value as Container)[key] = newValue;
+                        if (altKey !== undefined && altKey in (parent.value as Container)) {
+                            delete (parent.value as Container)[altKey];
+                        }
                     }
                     replaceValue(newValue);
                 }
@@ -149,10 +189,18 @@ export function ManagedReference(
             }
 
             let value;
-            if (key in parent.value) {
-                value = (parent.value as Container)[key];
-            } else if (altKey !== undefined && altKey in parent.value) {
-                value = (parent.value as Container)[altKey];
+            if (dynamicContainer !== undefined) {
+                if (key in dynamicContainer) {
+                    value = (dynamicContainer as Container)[key];
+                } else if (altKey !== undefined && altKey in dynamicContainer) {
+                    value = (dynamicContainer as Container)[altKey];
+                }
+            } else {
+                if (key in parent.value) {
+                    value = (parent.value as Container)[key];
+                } else if (altKey !== undefined && altKey in parent.value) {
+                    value = (parent.value as Container)[altKey];
+                }
             }
 
             replaceValue(value);

package/src/behavior/state/managed/values/ListManager.ts

@@ -160,6 +160,7 @@ function createProxy(config: ListConfig, reference: Val.Reference<Val.List>, ses
                     () => true,
 
                     val => (Array.isArray(val) ? [...(val as Val.List)] : isObject(val) ? { ...val } : val),
+                    session,
                 );
 
                 manageEntry(subref, session);

package/src/behavior/state/managed/values/StructManager.ts

@@ -279,7 +279,7 @@ function configureProperty(supervisor: RootSupervisor, schema: ValueModel) {
     };
 
     if (manage === PrimitiveManager) {
-        // For primitives we don't need a manager so just proxy reads directly
+        // For primitives, we don't need a manager so just proxy reads directly
         descriptor.get = function (this: Struct) {
             if (access.mayRead(this[Internal.session], this[Internal.reference].location)) {
                 const struct = this[Internal.reference].value as Val.Dynamic;
@@ -310,7 +310,7 @@ function configureProperty(supervisor: RootSupervisor, schema: ValueModel) {
             }
         };
     } else {
-        // For collections we create a managed value
+        // For collections, we create a managed value
         let cloneContainer: (container: Val) => Val;
         switch (schema.effectiveMetatype) {
             case Metatype.array:
@@ -373,6 +373,8 @@ function configureProperty(supervisor: RootSupervisor, schema: ValueModel) {
                 return defaultReader?.(this);
             }
 
+            // Value is null or a dynamic property, so just return it
+            // TODO Consider to also use Management for dynamic properties
             if (value === null) {
                 return value;
             }
@@ -394,7 +396,15 @@ function configureProperty(supervisor: RootSupervisor, schema: ValueModel) {
             };
 
             // Clone the container before write
-            const ref = ManagedReference(this[Internal.reference], pk, name, id, assertWriteOk, cloneContainer);
+            const ref = ManagedReference(
+                this[Internal.reference],
+                pk,
+                name,
+                id,
+                assertWriteOk,
+                cloneContainer,
+                this[Internal.session],
+            );
 
             ref.owner = manage(ref, this[Internal.session]);
 

package/src/behavior/state/validation/conformance-compiler.ts

@@ -187,7 +187,7 @@ export function astToFunction(schema: ValueModel, supervisor: RootSupervisor): V
             case Conformance.Special.Choice:
                 return createChoice(ast.param);
 
-            case Conformance.Special.Group:
+            case Conformance.Special.Otherwise:
                 return createGroup(ast.param);
 
             case Conformance.Special.Name:
@@ -281,7 +281,7 @@ export function astToFunction(schema: ValueModel, supervisor: RootSupervisor): V
      * A "group" node is a list or the entries in an optional ([ ... ]) clause. The resulting node is the value of the
      * first list member that does not report as Code.Nonconformant.
      */
-    function createGroup(param: Conformance.Ast.Group): DynamicNode {
+    function createGroup(param: Conformance.Ast.Otherwise): DynamicNode {
         if (!Array.isArray(param)) {
             throw new SchemaImplementationError(
                 DataModelPath(schema.path),
@@ -627,7 +627,12 @@ export function astToFunction(schema: ValueModel, supervisor: RootSupervisor): V
                 continue;
             }
 
-            const compiledNode = compile(member.conformance.ast);
+            // Enum choice indicates support for the value; it should not affect validation
+            let ast = member.conformance.ast;
+            if (ast.type === Conformance.Special.Choice) {
+                ast = ast.param.expr;
+            }
+            const compiledNode = compile(ast);
 
             let memberValidator: undefined | EnumMemberValidator;
             switch (compiledNode.code) {

package/src/behaviors/access-control/AccessControlServer.ts

@@ -52,13 +52,9 @@ export class AccessControlServer extends AccessControlBehavior.with("Extension")
     override initialize(): MaybePromise {
         this.reactTo(this.events.acl$Changing, this.#validateAccessControlListChanges); // Enhanced Validation
         this.reactTo(this.events.acl$Changed, this.#handleAccessControlListChange); // Event handling for changes
-        if (
-            this.state.extension !== undefined &&
-            this.events.extension$Changing !== undefined &&
-            this.events.extension$Changed !== undefined
-        ) {
-            this.reactTo(this.events.extension$Changing, this.#validateAccessControlExtensionChanges); // Enhanced Validation
-            this.reactTo(this.events.extension$Changed, this.#handleAccessControlExtensionChange); // Event handling for changes
+        if (this.state.extension !== undefined) {
+            this.maybeReactTo(this.events.extension$Changing, this.#validateAccessControlExtensionChanges); // Enhanced Validation
+            this.maybeReactTo(this.events.extension$Changed, this.#handleAccessControlExtensionChange); // Event handling for changes
         }
 
         const lifecycle = this.endpoint.lifecycle as NodeLifecycle;

package/src/behaviors/account-login/AccountLoginInterface.ts

@@ -13,13 +13,13 @@ export namespace AccountLoginInterface {
     export interface Base {
         /**
          * The purpose of this command is to determine if the active user account of the given Content App matches the
-         * active user account of a given Commissionee, and when it does, return a Setup PIN code which can be used for
+         * active user account of a given Commissionee, and when it does, return a Setup PIN which can be used for
          * password-authenticated session establishment (PASE) with the Commissionee.
          *
          * For example, a Video Player with a Content App Platform may invoke this command on one of its Content App
          * endpoints to facilitate commissioning of a Phone App made by the same vendor as the Content App. If the
-         * accounts match, then the Content App may return a setup code that can be used by the Video Player to
-         * commission the Phone App without requiring the user to physically input a setup code.
+         * accounts match, then the Content App may return a Setup PIN that can be used by the Video Player to
+         * commission the Phone App without requiring the user to physically input a Setup PIN.
          *
          * The account match is determined by the Content App using a method which is outside the scope of this
          * specification and will typically involve a central service which is in communication with both the Content
@@ -45,7 +45,7 @@ export namespace AccountLoginInterface {
          * The Setup PIN is a character string so that it can accommodate different future formats, including
          * alpha-numeric encodings. For a Commissionee it shall be populated with the Manual Pairing Code (see Manual
          * Pairing Code section in [MatterCore]) encoded as a string (11 characters) or the Passcode portion of the
-         * Manual Pairing Code (when less than 11 characters) .
+         * Manual Pairing Code (when less than 11 characters).
          *
          * The server shall implement rate limiting to prevent brute force attacks. No more than 10 unique requests in a
          * 10 minute period shall be allowed; a command response status of FAILURE should sent for additional commands
@@ -60,7 +60,7 @@ export namespace AccountLoginInterface {
 
         /**
          * The purpose of this command is to allow the Content App to assume the user account of a given Commissionee by
-         * leveraging the Setup PIN code input by the user during the commissioning process.
+         * leveraging the Setup PIN input by the user during the commissioning process.
          *
          * For example, a Video Player with a Content App Platform may invoke this command on one of its Content App
          * endpoints after the commissioning has completed of a Phone App made by the same vendor as the Content App.
@@ -87,12 +87,12 @@ export namespace AccountLoginInterface {
          *
          * The Setup PIN for a Commissionee may be populated with the Manual Pairing Code encoded as a string of decimal
          * numbers (11 characters) or the Passcode portion of the Manual Pairing Code encoded as a string of decimal
-         * numbers (8 characters) .
+         * numbers (8 characters).
          *
          * The server shall implement rate limiting to prevent brute force attacks. No more than 10 unique requests in a
          * 10 minute period shall be allowed; a command response status of FAILURE should sent for additional commands
          * received within the 10 minute period. Because access to this command is limited to nodes with Admin-level
-         * access, and the user is involved when obtaining the SetupPIN, there are in place multiple obstacles to
+         * access, and the user is involved when obtaining the Setup PIN, there are in place multiple obstacles to
          * successfully mounting a brute force attack. A Content App that supports this command shall ensure that the
          * Temporary Account Identifier used by its clients is not valid for more than 10 minutes.
          *