@matter/node 0.17.4 → 0.17.5-alpha.0-20260704-9ea70abfa

package/dist/esm/tags/LaundryTag.d.ts

@@ -9,7 +9,7 @@ import { SemanticNamespace } from "../endpoint/type/SemanticNamespace.js";
  * The tags contained in this namespace are restricted for use in the laundry domain and shall NOT be used in any other
  * domain or context.
  *
- * @see {@link MatterSpecification.v151.Namespace} § 13
+ * @see {@link MatterSpecification.v16.Namespace} § 13
  */
 export declare const LaundryTag: SemanticNamespace.Of<{
     readonly id: 14;

package/dist/esm/tags/PowerSourceTag.d.ts

@@ -9,7 +9,7 @@ import { SemanticNamespace } from "../endpoint/type/SemanticNamespace.js";
  * The tags contained in this namespace are restricted for use in the power source domain and shall NOT be used in any
  * other domain or context.
  *
- * @see {@link MatterSpecification.v151.Namespace} § 14
+ * @see {@link MatterSpecification.v16.Namespace} § 14
  */
 export declare const PowerSourceTag: SemanticNamespace.Of<{
     readonly id: 15;
@@ -26,7 +26,7 @@ export declare const PowerSourceTag: SemanticNamespace.Of<{
          *
          * Power Source clusters with this tag shall implement the WIRED feature.
          *
-         * @see {@link MatterSpecification.v151.Namespace} § 14.1
+         * @see {@link MatterSpecification.v16.Namespace} § 14.1
          */
         readonly Grid: {
             readonly id: 1;
@@ -37,7 +37,7 @@ export declare const PowerSourceTag: SemanticNamespace.Of<{
          *
          * Power Source clusters with this tag shall implement the WIRED feature.
          *
-         * @see {@link MatterSpecification.v151.Namespace} § 14.2
+         * @see {@link MatterSpecification.v16.Namespace} § 14.2
          */
         readonly Solar: {
             readonly id: 2;
@@ -48,7 +48,7 @@ export declare const PowerSourceTag: SemanticNamespace.Of<{
          *
          * Power Source clusters with this tag shall implement the BAT feature.
          *
-         * @see {@link MatterSpecification.v151.Namespace} § 14.3
+         * @see {@link MatterSpecification.v16.Namespace} § 14.3
          */
         readonly Battery: {
             readonly id: 3;
@@ -59,7 +59,7 @@ export declare const PowerSourceTag: SemanticNamespace.Of<{
          *
          * Power Source clusters with this tag shall implement the BAT feature.
          *
-         * @see {@link MatterSpecification.v151.Namespace} § 14.4
+         * @see {@link MatterSpecification.v16.Namespace} § 14.4
          */
         readonly Ev: {
             readonly id: 4;

package/dist/esm/tags/PowerSourceTag.js

@@ -16,7 +16,7 @@ const PowerSourceTag = SemanticNamespace({
      *
      * Power Source clusters with this tag shall implement the WIRED feature.
      *
-     * @see {@link MatterSpecification.v151.Namespace} § 14.1
+     * @see {@link MatterSpecification.v16.Namespace} § 14.1
      */
     Grid: { id: 1, label: "Grid" },
     /**
@@ -24,7 +24,7 @@ const PowerSourceTag = SemanticNamespace({
      *
      * Power Source clusters with this tag shall implement the WIRED feature.
      *
-     * @see {@link MatterSpecification.v151.Namespace} § 14.2
+     * @see {@link MatterSpecification.v16.Namespace} § 14.2
      */
     Solar: { id: 2, label: "Solar" },
     /**
@@ -32,7 +32,7 @@ const PowerSourceTag = SemanticNamespace({
      *
      * Power Source clusters with this tag shall implement the BAT feature.
      *
-     * @see {@link MatterSpecification.v151.Namespace} § 14.3
+     * @see {@link MatterSpecification.v16.Namespace} § 14.3
      */
     Battery: { id: 3, label: "Battery" },
     /**
@@ -40,7 +40,7 @@ const PowerSourceTag = SemanticNamespace({
      *
      * Power Source clusters with this tag shall implement the BAT feature.
      *
-     * @see {@link MatterSpecification.v151.Namespace} § 14.4
+     * @see {@link MatterSpecification.v16.Namespace} § 14.4
      */
     Ev: { id: 4, label: "Ev" }
   }

package/dist/esm/tags/RefrigeratorTag.d.ts

@@ -9,7 +9,7 @@ import { SemanticNamespace } from "../endpoint/type/SemanticNamespace.js";
  * The tags contained in this namespace are restricted for use in the refrigerator domain and shall NOT be used in any
  * other domain or context.
  *
- * @see {@link MatterSpecification.v151.Namespace} § 19
+ * @see {@link MatterSpecification.v16.Namespace} § 19
  */
 export declare const RefrigeratorTag: SemanticNamespace.Of<{
     readonly id: 65;

package/dist/esm/tags/RoomAirConditionerTag.d.ts

@@ -9,7 +9,7 @@ import { SemanticNamespace } from "../endpoint/type/SemanticNamespace.js";
  * The tags contained in this namespace are restricted for use in the room air conditioner domain and shall NOT be used
  * in any other domain or context.
  *
- * @see {@link MatterSpecification.v151.Namespace} § 20
+ * @see {@link MatterSpecification.v16.Namespace} § 20
  */
 export declare const RoomAirConditionerTag: SemanticNamespace.Of<{
     readonly id: 66;

package/dist/esm/tags/SwitchesTag.d.ts

@@ -14,7 +14,7 @@ import { SemanticNamespace } from "../endpoint/type/SemanticNamespace.js";
  * See the rules for applying these and other tags for switch devices, e.g. from the Common Position Namespace and the
  * Common Number Namespace in the Generic Switch device type section in the Device Library.
  *
- * @see {@link MatterSpecification.v151.Namespace} § 21
+ * @see {@link MatterSpecification.v16.Namespace} § 21
  */
 export declare const SwitchesTag: SemanticNamespace.Of<{
     readonly id: 67;
@@ -73,7 +73,7 @@ export declare const SwitchesTag: SemanticNamespace.Of<{
          * description of the function indicated on the button, such as a label or icon printed on the button, e.g.
          * "dining".
          *
-         * @see {@link MatterSpecification.v151.Namespace} § 21.1
+         * @see {@link MatterSpecification.v16.Namespace} § 21.1
          */
         readonly Custom: {
             readonly id: 8;

package/dist/esm/tags/SwitchesTag.js

@@ -37,7 +37,7 @@ const SwitchesTag = SemanticNamespace({
      * description of the function indicated on the button, such as a label or icon printed on the button, e.g.
      * "dining".
      *
-     * @see {@link MatterSpecification.v151.Namespace} § 21.1
+     * @see {@link MatterSpecification.v16.Namespace} § 21.1
      */
     Custom: { id: 8, label: "Custom" },
     /**

package/dist/esm/tags/index.d.ts

@@ -24,6 +24,9 @@ export * from "./CommonNumberTag.js";
 export * from "./CommonPositionTag.js";
 export * from "./CommonRelativePositionTag.js";
 export * from "./ElectricalMeasurementTag.js";
+export * from "./IdentifiedHumanActivityTag.js";
+export * from "./IdentifiedObjectTag.js";
+export * from "./IdentifiedSoundTag.js";
 export * from "./LaundryTag.js";
 export * from "./PowerSourceTag.js";
 export * from "./RefrigeratorTag.js";

package/dist/esm/tags/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tags/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,6CAA6C;AAE7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yBAAyB,CAAC;AACxC,cAAc,iCAAiC,CAAC;AAChD,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tags/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,6CAA6C;AAE7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yBAAyB,CAAC;AACxC,cAAc,iCAAiC,CAAC;AAChD,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC"}

package/dist/esm/tags/index.js

@@ -23,6 +23,9 @@ export * from "./CommonNumberTag.js";
 export * from "./CommonPositionTag.js";
 export * from "./CommonRelativePositionTag.js";
 export * from "./ElectricalMeasurementTag.js";
+export * from "./IdentifiedHumanActivityTag.js";
+export * from "./IdentifiedObjectTag.js";
+export * from "./IdentifiedSoundTag.js";
 export * from "./LaundryTag.js";
 export * from "./PowerSourceTag.js";
 export * from "./RefrigeratorTag.js";

package/dist/esm/tags/index.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../src/tags/index.ts"],
-  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;",
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@matter/node",
-    "version": "0.17.4",
+    "version": "0.17.5-alpha.0-20260704-9ea70abfa",
     "description": "API for building Matter nodes",
     "keywords": [
         "iot",
@@ -36,14 +36,14 @@
         "#*": "./src/*"
     },
     "dependencies": {
-        "@matter/general": "0.17.4",
-        "@matter/model": "0.17.4",
-        "@matter/types": "0.17.4",
-        "@matter/protocol": "0.17.4"
+        "@matter/general": "0.17.5-alpha.0-20260704-9ea70abfa",
+        "@matter/model": "0.17.5-alpha.0-20260704-9ea70abfa",
+        "@matter/types": "0.17.5-alpha.0-20260704-9ea70abfa",
+        "@matter/protocol": "0.17.5-alpha.0-20260704-9ea70abfa"
     },
     "devDependencies": {
         "@nacho-iot/js-tools": "^0.1.7",
-        "@matter/testing": "0.17.4"
+        "@matter/testing": "0.17.5-alpha.0-20260704-9ea70abfa"
     },
     "files": [
         "dist/**/*",

package/src/behavior/context/ActionContext.ts

@@ -28,6 +28,6 @@ import type { RemoteActorContext } from "./server/RemoteActorContext.js";
  *
  *   - When responding to network requests, low-level contextual information such as the wire {@link message}
  *
- * For the formal definition of an "action" see {@link MatterSpecification.v12.Core} § 8.2.4
+ * For the formal definition of an "action" see {@link MatterSpecification.v16.Core} § 8.2.4
  */
 export type ActionContext = LocalActorContext | RemoteActorContext;

package/src/behavior/state/validation/FabricIndexSentinel.ts

@@ -11,8 +11,9 @@ const FIELD_NAME = FabricIndexElement.name;
 
 /**
  * True when `schema` is the spec-defined fabric-scoped struct FabricIndex sentinel field — same id/name match
- * `ObjectSchema.encodeEntryToTlv` uses to gate the wire-level strip (Matter §7.13.6).  Per spec the id+name
- * combination is reserved for this purpose; no other struct field can re-use it.
+ * `ObjectSchema.encodeEntryToTlv` uses to gate the wire-level strip.  Per spec the id+name combination is reserved
+ * for this purpose; no other struct field can re-use it.
+ * @see {@link MatterSpecification.v16.Core} § 7.13.6
  */
 export function isFabricIndexSentinel(schema: ValueModel): boolean {
     return schema instanceof FieldModel && schema.id === FIELD_ID && schema.name === FIELD_NAME;

package/src/behavior/supervision/ValueSupervisor.ts

@@ -85,8 +85,9 @@ export namespace ValueSupervisor {
 
         /**
          * Present on contexts rooted at a ClientNode (peer node).  Drives substitution of the
-         * {@link FabricIndex.OMIT_FABRIC} sentinel on fabric-scoped struct writes (Matter §7.13.6) so the local
-         * cache mirrors the post-write peer state.
+         * {@link FabricIndex.OMIT_FABRIC} sentinel on fabric-scoped struct writes so the local cache mirrors the
+         * post-write peer state.
+         * @see {@link MatterSpecification.v16.Core} § 7.13.6
          */
         clientPeerContext?: {
             /** Fabric index the peer assigned to our identity, when known. */

package/src/behavior/system/network/ServerGroupNetworking.ts

@@ -94,10 +94,14 @@ export class ServerGroupNetworking {
             return;
         }
         const address = fabric.groups.multicastAddressFor(groupId);
-        logger.debug(
-            `Adding membership for group ${groupId} on fabric ${fabric.fabricId} (index ${fabricIndex}) with address ${address}`,
-        );
-        await this.#udpInterface.addMembership(address);
+        // Only join the multicast group if no other group in this fabric already uses the same address
+        // (multiple IanaAddr groups all share ff05::fa)
+        if (!Array.from(memberships.values()).includes(address)) {
+            logger.debug(
+                `Adding membership for group ${groupId} on fabric ${fabric.fabricId} (index ${fabricIndex}) with address ${address}`,
+            );
+            await this.#udpInterface.addMembership(address);
+        }
         memberships.set(groupId, address);
         this.#activeGroupMemberships.set(fabricIndex, memberships);
     }
@@ -108,12 +112,17 @@ export class ServerGroupNetworking {
         if (memberships === undefined || memberships.size === 0) {
             return;
         }
-        const address = fabric.groups.multicastAddressFor(groupId);
-        logger.debug(
-            `Dropping membership for group ${groupId} on fabric ${fabric.fabricId} (index ${fabricIndex}) with address ${address}`,
-        );
-        await this.#udpInterface.dropMembership(address);
+        // Use the stored address (safer than re-deriving, policy may have changed)
+        const address = memberships.get(groupId) ?? fabric.groups.multicastAddressFor(groupId);
         memberships.delete(groupId);
+        // Only leave the multicast group if no other group in this fabric still uses the same address
+        // (multiple IanaAddr groups all share ff05::fa)
+        if (!Array.from(memberships.values()).includes(address)) {
+            logger.debug(
+                `Dropping membership for group ${groupId} on fabric ${fabric.fabricId} (index ${fabricIndex}) with address ${address}`,
+            );
+            await this.#udpInterface.dropMembership(address);
+        }
         if (!memberships.size) {
             this.#activeGroupMemberships.delete(fabricIndex);
         }

package/src/behavior/system/software-update/SoftwareUpdateManager.ts

@@ -185,7 +185,7 @@ export class SoftwareUpdateManager extends Behavior {
         if (!ownFabric) {
             // Can only happen if the SoftwareUpdateManager is used without any commissioned nodes
             logger.info(`No commissioned peers yet, cannot check for OTA updates. Wait for Fabric being added.`);
-            fabricAuthority.fabricAdded.once(this.callback(this.#nodeOnline));
+            this.reactTo(fabricAuthority.fabricAdded, this.#nodeOnline, { once: true });
             return;
         }
         this.internal.announcements = new OtaAnnouncements(this.endpoint, ownFabric);

package/src/behaviors/access-control/AccessControlServer.ts

@@ -5,8 +5,17 @@
  */
 
 import { ActionContext } from "#behavior/context/ActionContext.js";
+import { OnlineEvent } from "#behavior/Events.js";
 import { NodeLifecycle } from "#node/NodeLifecycle.js";
-import { Bytes, deepCopy, InternalError, Logger } from "@matter/general";
+import {
+    Bytes,
+    deepCopy,
+    ImplementationError,
+    InternalError,
+    isDeepEqual,
+    Logger,
+    ObservableValue,
+} from "@matter/general";
 import {
     AccessControl,
     AclEndpointContext,
@@ -39,6 +48,7 @@ import { AccessControl as AccessControlTypes } from "@matter/types/clusters/acce
 import { AccessControlBehavior } from "./AccessControlBehavior.js";
 
 const logger = Logger.get("AccessControlServer");
+const AccessControlBase = AccessControlBehavior.with("Extension");
 
 /**
  * This is the default server implementation of AccessControlBehavior.
@@ -46,10 +56,19 @@ const logger = Logger.get("AccessControlServer");
  * When custom extensions are used, the `extensionEntryValidator` and `extensionEntryAccessCheck` methods can be
  * overridden to implement custom validation and access checks for the extension entries.
  */
-export class AccessControlServer extends AccessControlBehavior.with("Extension") {
+export class AccessControlServer extends AccessControlBase {
     declare internal: AccessControlServer.Internal;
+    declare readonly state: AccessControlServer.State;
+    declare readonly events: AccessControlServer.Events;
 
     override initialize() {
+        // TODO: remove this guard once the Auxiliary feature leaves provisional state in the Matter specification
+        if (this.features.auxiliary) {
+            throw new ImplementationError(
+                "The Auxiliary feature of AccessControl is provisional in Matter 1.6. Do not enable it.",
+            );
+        }
+
         // Spec 1.5.1 tightened constraints to "4 to 65534" / "3 to 65534" — ensure valid defaults
         if (!this.state.subjectsPerAccessControlEntry) {
             this.state.subjectsPerAccessControlEntry = 4;
@@ -94,6 +113,7 @@ export class AccessControlServer extends AccessControlBehavior.with("Extension")
                 fabricAcls.push(fallbackAcl);
             }
             fabric.accessControl.aclList = fabricAcls;
+            fabric.accessControl.auxiliaryFeatureEnabled = this.features.auxiliary;
             fabric.accessControl.extensionEntryAccessCheck = this.extensionEntryAccessCheck.bind(this);
         }
 
@@ -439,7 +459,82 @@ export class AccessControlServer extends AccessControlBehavior.with("Extension")
     /** A fabric was added or updated, so we need to initialize the ACL for this fabric */
     #updateFabricAcls(fabric: Fabric) {
         const fabricIndex = fabric.fabricIndex;
-        fabric.accessControl.aclList = deepCopy(this.state.acl).filter(entry => entry.fabricIndex === fabricIndex);
+        const realAcl = deepCopy(this.state.acl).filter(entry => entry.fabricIndex === fabricIndex);
+        const syntheticAcl = this.state.auxiliaryAcl?.filter(entry => entry.fabricIndex === fabricIndex) ?? [];
+        fabric.accessControl.auxiliaryFeatureEnabled = this.features.auxiliary;
+        fabric.accessControl.aclList = [...realAcl, ...syntheticAcl];
+    }
+
+    /**
+     * Register an observable that supplies auxiliary ACL entries. AccessControlServer subscribes to the observable
+     * and rebuilds fabric ACLs whenever it emits new entries. Multiple providers are supported.
+     *
+     * The observable should emit `AccessControlEntry[]` (all entries for all fabrics from this provider).
+     * AccessControlServer reads the current `observable.value` immediately on registration for initial sync.
+     */
+    registerAuxAclProvider(observable: AccessControlServer.AuxAclObservable) {
+        this.internal.auxiliaryAclProviders.add(observable);
+        this.reactTo(observable, this.callback(this.#onProviderAuxAclChanged));
+        // Sync initial value without emitting events (node is still initializing)
+        if (observable.value?.length) {
+            this.#syncAuxAcl(false);
+        }
+    }
+
+    /** When provider entries change after initialization, rebuild auxiliaryAcl and update changed fabrics. */
+    #onProviderAuxAclChanged(_entries: AccessControlTypes.AccessControlEntry[], context?: ActionContext) {
+        this.#syncAuxAcl(true, context);
+    }
+
+    /**
+     * Recompute auxiliaryAcl from all registered providers.
+     * Updates state once, then updates fabric ACL lists for any fabric whose entries changed.
+     * Only emits auxiliaryAccessUpdated events when emitEvents is true and entries actually changed.
+     */
+    #syncAuxAcl(emitEvents: boolean, providerContext?: ActionContext) {
+        // Collect all new aux entries from all providers in one pass
+        const newAuxAcl: AccessControlTypes.AccessControlEntry[] = [];
+        for (const obs of this.internal.auxiliaryAclProviders) {
+            for (const entry of obs.value ?? []) {
+                newAuxAcl.push({ ...entry });
+            }
+        }
+
+        const oldAuxAcl = deepCopy(this.state.auxiliaryAcl ?? []);
+
+        // Determine which fabrics have changed entries
+        const allFabrics = new Set([...oldAuxAcl.map(e => e.fabricIndex), ...newAuxAcl.map(e => e.fabricIndex)]);
+        const changedFabrics = [...allFabrics].filter(fi => {
+            const oldEntries = oldAuxAcl.filter(e => e.fabricIndex === fi);
+            const newEntries = newAuxAcl.filter(e => e.fabricIndex === fi);
+            return !isDeepEqual(oldEntries, newEntries);
+        });
+
+        if (changedFabrics.length === 0) {
+            return;
+        }
+
+        // Update the attribute once for all fabrics
+        this.state.auxiliaryAcl = newAuxAcl;
+
+        const fabrics = this.env.get(FabricManager);
+
+        // Extract admin node ID: prefer provider context (the command handler that triggered the
+        // change), fall back to this behavior's own session context
+        const ctx = providerContext ?? this.context;
+        const session = hasRemoteActor(ctx) ? ctx.session : undefined;
+        const { adminNodeId } = this.#adminDataFromSession(session);
+
+        // Update fabric ACL lists and optionally emit change events
+        for (const fi of changedFabrics) {
+            if (!fabrics.has(fi)) {
+                continue;
+            }
+            this.#updateFabricAcls(fabrics.for(fi));
+            if (emitEvents) {
+                this.events.auxiliaryAccessUpdated?.emit({ adminNodeId, fabricIndex: fi }, this.context);
+            }
+        }
     }
 
     /**
@@ -500,7 +595,10 @@ export class AccessControlServer extends AccessControlBehavior.with("Extension")
             // No interaction registered, so we apply directly because local/offline change
             logger.debug("ACL attribute updated, applying update to ACL manager", fabricIndex);
 
-            fabric.accessControl.aclList = deepCopy(acl).filter(entry => entry.fabricIndex === fabricIndex);
+            fabric.accessControl.aclList = [
+                ...deepCopy(acl).filter(entry => entry.fabricIndex === fabricIndex),
+                ...this.#auxiliaryAclFor(fabricIndex),
+            ];
         }
     }
 
@@ -523,8 +621,9 @@ export class AccessControlServer extends AccessControlBehavior.with("Extension")
 
         const fabrics = this.env.get(FabricManager);
         for (const fabric of fabrics) {
-            // Update all Fabrics and set the ACL list for each fabric, empty ACLs when none are present
-            fabric.accessControl.aclList = aclsForFabric.get(fabric.fabricIndex) ?? [];
+            const realAcl = aclsForFabric.get(fabric.fabricIndex) ?? [];
+            const syntheticAcl = this.state.auxiliaryAcl?.filter(e => e.fabricIndex === fabric.fabricIndex) ?? [];
+            fabric.accessControl.aclList = [...realAcl, ...syntheticAcl];
         }
     }
 
@@ -558,6 +657,23 @@ export class AccessControlServer extends AccessControlBehavior.with("Extension")
         );
     }
 
+    /**
+     * Collect auxiliary ACL entries for a fabric from the registered providers. Reads the provider observable values
+     * directly, which is context-free and therefore safe from reactors that run after an interaction context has
+     * exited — unlike the managed {@link AccessControlServer.State.auxiliaryAcl} state, which throws there.
+     */
+    #auxiliaryAclFor(fabricIndex: FabricIndex) {
+        const entries = new Array<AccessControlTypes.AccessControlEntry>();
+        for (const obs of this.internal.auxiliaryAclProviders) {
+            for (const entry of obs.value ?? []) {
+                if (entry.fabricIndex === fabricIndex) {
+                    entries.push({ ...entry });
+                }
+            }
+        }
+        return entries;
+    }
+
     /** Applies the delayed ACL update for a specific fabric index, if existing */
     #applyDelayedAclUpdateFor(fabricIndex: FabricIndex) {
         const updateDelayed = !!this.internal.aclUpdateDelayed.get(fabricIndex);
@@ -566,12 +682,30 @@ export class AccessControlServer extends AccessControlBehavior.with("Extension")
         this.internal.delayedAclData.delete(fabricIndex);
         this.internal.aclUpdateDelayed.delete(fabricIndex);
         if (updateDelayed && delayedData !== undefined) {
-            this.env.get(FabricManager).for(fabricIndex).accessControl.aclList = delayedData;
+            this.env.get(FabricManager).for(fabricIndex).accessControl.aclList = [
+                ...delayedData,
+                ...this.#auxiliaryAclFor(fabricIndex),
+            ];
         }
     }
 }
 
 export namespace AccessControlServer {
+    export class State extends AccessControlBase.State {
+        /**
+         * Synthesized read-only ACL entries supplied by auxiliary providers (e.g. Groupcast).  Only present when the
+         * provisional Auxiliary feature is enabled.
+         */
+        declare auxiliaryAcl?: AccessControlTypes.AccessControlEntry[];
+    }
+
+    export class Events extends AccessControlBase.Events {
+        /** Emitted when auxiliary ACL entries change.  Only present when the provisional Auxiliary feature is enabled. */
+        declare auxiliaryAccessUpdated?: OnlineEvent<
+            [payload: AccessControlTypes.AuxiliaryAccessUpdatedEvent, context: ActionContext]
+        >;
+    }
+
     export class Internal {
         /** Is the cluster logic initialized? Used to block events before full initialization. */
         initialized = false;
@@ -584,6 +718,9 @@ export namespace AccessControlServer {
 
         /** Latest delayed data of acl attribute */
         delayedAclData = new Map<FabricIndex, AccessControlTypes.AccessControlEntry[]>();
+
+        /** Registered observable providers that supply auxiliary ACL entries. */
+        auxiliaryAclProviders = new Set<AccessControlServer.AuxAclObservable>();
     }
 
     export declare const ExtensionInterface: {
@@ -596,4 +733,13 @@ export namespace AccessControlServer {
             clusterId: ClusterId,
         ) => boolean;
     };
+
+    /**
+     * An observable that supplies auxiliary ACL entries to {@link AccessControlServer}.
+     * Register via {@link AccessControlServer.registerAuxAclProvider}.
+     *
+     * Emit `AccessControlEntry[]` (all entries across all fabrics) whenever the provider's entries change.
+     * AccessControlServer subscribes and rebuilds its ACL cache automatically.
+     */
+    export type AuxAclObservable = ObservableValue<[AccessControlTypes.AccessControlEntry[], ActionContext?]>;
 }

package/src/behaviors/ambient-context-sensing/AmbientContextSensingBehavior.ts

@@ -0,0 +1,27 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/*** THIS FILE IS GENERATED, DO NOT EDIT ***/
+
+import { AmbientContextSensing } from "@matter/types/clusters/ambient-context-sensing";
+import { ClusterBehavior } from "../../behavior/cluster/ClusterBehavior.js";
+import { Identity } from "@matter/general";
+
+/**
+ * AmbientContextSensingBehavior is the base class for objects that support interaction with
+ * {@link AmbientContextSensing.Cluster}.
+ *
+ * AmbientContextSensing.Cluster requires you to enable one or more optional features. You can do so using
+ * {@link AmbientContextSensingBehavior.with}.
+ */
+export const AmbientContextSensingBehaviorConstructor = ClusterBehavior.for(AmbientContextSensing);
+
+export interface AmbientContextSensingBehaviorConstructor extends Identity<typeof AmbientContextSensingBehaviorConstructor> {}
+export const AmbientContextSensingBehavior: AmbientContextSensingBehaviorConstructor = AmbientContextSensingBehaviorConstructor;
+export interface AmbientContextSensingBehavior extends InstanceType<AmbientContextSensingBehaviorConstructor> {}
+export namespace AmbientContextSensingBehavior {
+    export interface State extends InstanceType<typeof AmbientContextSensingBehavior.State> {}
+}

package/src/behaviors/ambient-context-sensing/AmbientContextSensingClient.ts

@@ -0,0 +1,16 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/*** THIS FILE IS GENERATED, DO NOT EDIT ***/
+
+import { AmbientContextSensing } from "@matter/types/clusters/ambient-context-sensing";
+import { ClientBehavior } from "../../behavior/cluster/ClientBehavior.js";
+import { Identity } from "@matter/general";
+
+export const AmbientContextSensingClientConstructor = ClientBehavior(AmbientContextSensing);
+export interface AmbientContextSensingClient extends InstanceType<typeof AmbientContextSensingClientConstructor> {}
+export interface AmbientContextSensingClientConstructor extends Identity<typeof AmbientContextSensingClientConstructor> {}
+export const AmbientContextSensingClient: AmbientContextSensingClientConstructor = AmbientContextSensingClientConstructor;

package/src/behaviors/ambient-context-sensing/AmbientContextSensingServer.ts

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/*** THIS FILE WILL BE REGENERATED IF YOU DO NOT REMOVE THIS MESSAGE ***/
+
+import { AmbientContextSensingBehavior } from "./AmbientContextSensingBehavior.js";
+
+/**
+ * This is the default server implementation of {@link AmbientContextSensingBehavior}.
+ *
+ * The Matter specification requires the AmbientContextSensing cluster to support features we do not enable by default.
+ * You should use {@link AmbientContextSensingServer.with} to specialize the class for the features your implementation
+ * supports.
+ */
+export class AmbientContextSensingServer extends AmbientContextSensingBehavior {}

package/src/behaviors/ambient-context-sensing/index.ts

@@ -0,0 +1,11 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/*** THIS FILE WILL BE REGENERATED IF YOU DO NOT REMOVE THIS MESSAGE ***/
+
+export * from "./AmbientContextSensingBehavior.js";
+export * from "./AmbientContextSensingServer.js";
+export * from "./AmbientContextSensingClient.js";