@matter/protocol 0.17.4 → 0.17.5-alpha.0-20260704-9ea70abfa

package/src/peer/PeerExchangeProvider.ts

@@ -31,6 +31,14 @@ export class PeerExchangeProvider extends ExchangeProvider {
         return this.#peer.sessionParameters.maxPathsPerInvoke;
     }
 
+    override get readPathsSupported() {
+        return this.#peer.limits.readPathsSupported ?? super.readPathsSupported;
+    }
+
+    override get subscribePathsSupported() {
+        return this.#peer.limits.subscribePathsSupported ?? super.subscribePathsSupported;
+    }
+
     get peerAddress() {
         return this.#peer.address;
     }

package/src/protocol/ExchangeManager.ts

@@ -8,6 +8,7 @@ import { DecodedMessage, Message, MessageCodec, SessionType } from "#codec/Messa
 import { Mark } from "#common/Mark.js";
 import { PeerAddress } from "#peer/PeerAddress.js";
 import { SecureChannelMessenger } from "#securechannel/SecureChannelMessenger.js";
+import { GroupSession } from "#session/GroupSession.js";
 import { NodeSession } from "#session/NodeSession.js";
 import { Session } from "#session/Session.js";
 import { SessionManager, ShutdownError } from "#session/SessionManager.js";
@@ -36,7 +37,8 @@ import {
     UdpTransport,
     UnexpectedDataError,
 } from "@matter/general";
-import { FabricIndex, NodeId, SECURE_CHANNEL_PROTOCOL_ID, SecureMessageType } from "@matter/types";
+import { FabricIndex, GroupId, NodeId, SECURE_CHANNEL_PROTOCOL_ID, SecureMessageType } from "@matter/types";
+import { Groupcast } from "@matter/types/clusters/groupcast";
 import { MessageExchange, MessageExchangeContext } from "./MessageExchange.js";
 import { DuplicateMessageError } from "./MessageReceptionState.js";
 import { MRP } from "./MRP.js";
@@ -127,8 +129,8 @@ export class ExchangeManager implements Transport.Provider {
         return this.#transports.hasInterfaceFor(type, address);
     }
 
-    initiateExchange(address: PeerAddress, protocolId: number) {
-        return this.initiateExchangeForSession(this.#sessions.sessionFor(address), protocolId);
+    initiateExchange(address: PeerAddress, protocolId: number, options?: MessageExchange.Options) {
+        return this.initiateExchangeForSession(this.#sessions.sessionFor(address), protocolId, options);
     }
 
     initiateExchangeForSession(session: Session, protocolId: number, options?: MessageExchange.Options) {
@@ -271,6 +273,15 @@ export class ExchangeManager implements Transport.Provider {
             } catch (e) {
                 DuplicateMessageError.accept(e);
                 isDuplicate = true;
+                // Report replay for Groupcast testing — observable is a no-op without listeners.
+                this.#sessions.emitGroupMessage({
+                    result: Groupcast.GroupcastTestResult.MessageReplay,
+                    fabric: (session as GroupSession).fabric,
+                    groupId:
+                        message.packetHeader.destGroupId !== undefined
+                            ? GroupId(message.packetHeader.destGroupId)
+                            : undefined,
+                });
             }
         } else {
             throw new MatterFlowError(`Unsupported session type: ${packet.header.sessionType}`);

package/src/protocol/ExchangeProvider.ts

@@ -76,6 +76,17 @@ export abstract class ExchangeProvider {
     abstract readonly peerAddress?: PeerAddress;
     abstract readonly maxPathsPerInvoke?: number;
 
+    /**
+     * Peer-advertised CapabilityMinima path floors.  Base values are the spec minimums.
+     * @see {@link MatterSpecification.v16.Core} § 11.1
+     */
+    get readPathsSupported(): number {
+        return 9;
+    }
+    get subscribePathsSupported(): number {
+        return 3;
+    }
+
     /**
      * Dedicated secure session backing this provider, if any.
      *

package/src/protocol/MRP.ts

@@ -26,7 +26,7 @@ export namespace MRP {
     /** The number of retransmissions before transitioning from linear to exponential backoff. */
     export const BACKOFF_THRESHOLD = 1;
 
-    /** @see {@link MatterSpecification.v12.Core}, section 4.11.8 */
+    /** @see {@link MatterSpecification.v16.Core}, section 4.12.8 */
     export const STANDALONE_ACK_TIMEOUT = Millis(200);
 
     /**
@@ -120,7 +120,7 @@ export namespace MRP {
      * When `calculateMaximum` is set to true, we calculate the maximum time without any randomness.
      * Otherwise, the caller-supplied `additionalDelay` (default 0) is added to the base interval.
      *
-     * @see {@link MatterSpecification.v10.Core}, section 4.11.2.1
+     * @see {@link MatterSpecification.v16.Core}, section 4.12.2.1
      */
     export function retransmissionIntervalOf(
         { transmissionNumber, sessionParameters, isPeerActive, additionalDelay = Millis(0) }: RetryDelayInputs,

package/src/protocol/MessageChannel.ts

@@ -218,7 +218,7 @@ export class MessageChannel implements Channel<Message> {
      *
      * When `calculateMaximum` is set to true, we calculate the maximum time without any randomness.
      *
-     * @see {@link MatterSpecification.v10.Core}, section 4.11.2.1
+     * @see {@link MatterSpecification.v16.Core}, section 4.12.2.1
      */
     getMrpResubmissionBackOffTime(
         retransmissionCount: number,

package/src/protocol/MessageExchange.ts

@@ -196,8 +196,8 @@ export class MessageExchange {
     readonly #isInitiator: boolean;
     readonly #messagesQueue = new DataReadQueue<Message>();
     readonly #lifetime: Lifetime;
-    readonly #onSend?: MessageExchange.SendNotifier;
-    readonly #onReceive?: MessageExchange.ReceiveNotifier;
+    #onSend?: MessageExchange.SendNotifier;
+    #onReceive?: MessageExchange.ReceiveNotifier;
     readonly #addressOverride?: ServerAddressUdp;
     readonly #peerAdditionalMrpDelay?: Duration;
     #receivedMessageToAck: Message | undefined;
@@ -306,6 +306,26 @@ export class MessageExchange {
         return this.#isInitiator;
     }
 
+    /**
+     * Sets the receive-notifier when none was provided at construction time.  This allows code that obtains an exchange
+     * after its creation (e.g. via protocol handler dispatch) to hook into message receipt.
+     */
+    set onReceive(fn: MessageExchange.ReceiveNotifier) {
+        if (this.#onReceive === undefined) {
+            this.#onReceive = fn;
+        }
+    }
+
+    /**
+     * Sets the send-notifier when none was provided at construction time.  Mirrors {@link onReceive} for code that
+     * obtains an exchange after its creation and needs to observe transmissions.
+     */
+    set onSend(fn: MessageExchange.SendNotifier) {
+        if (this.#onSend === undefined) {
+            this.#onSend = fn;
+        }
+    }
+
     /** Emits when the exchange is actually closed. This happens after all Retries and Communication are done. */
     get closed() {
         return this.#closed;
@@ -570,9 +590,13 @@ export class MessageExchange {
             if (!GroupSession.is(session)) {
                 throw new InternalError("Session is not a GroupSession, but session type is Group.");
             }
-            const destGroupId = GroupId.fromNodeId(this.#peerNodeId!); // TODO !!! Where get from?
+            const peerNodeId = this.#peerNodeId;
+            if (peerNodeId === undefined) {
+                throw new InternalError("Group message exchange requires a peer NodeId.");
+            }
+            const destGroupId = GroupId.fromNodeId(peerNodeId);
             if (destGroupId === 0) {
-                throw new InternalError(`Invalid GroupId extracted from NodeId ${this.#peerNodeId}`);
+                throw new InternalError(`Invalid GroupId extracted from NodeId ${peerNodeId}`);
             }
             const messageId = await abort.attempt(this.session.getIncrementedMessageCounter());
             if (messageId === undefined) {

package/src/session/GroupSession.ts

@@ -32,6 +32,20 @@ import { SecureSession } from "./SecureSession.js";
 import { Session } from "./Session.js";
 import { SessionManager } from "./SessionManager.js";
 
+/** Thrown by {@link GroupSession.decode} when no installed key can be a candidate for the received group message. */
+export class GroupSessionNoKeyError extends MatterFlowError {
+    constructor(message = "No key candidate found for group session decryption") {
+        super(message);
+    }
+}
+
+/** Thrown by {@link GroupSession.decode} when decryption failed with all candidate keys. */
+export class GroupSessionDecodeError extends MatterFlowError {
+    constructor(message = "Failed to decode group message with any key candidate") {
+        super(message);
+    }
+}
+
 const logger = Logger.get("SecureGroupSession");
 
 /** Secure Group session instance */
@@ -41,6 +55,7 @@ export class GroupSession extends SecureSession {
     readonly #peerNodeId: NodeId;
     readonly #operationalGroupKey: Bytes;
     readonly #operationalPrivacyKey?: Bytes;
+    readonly #multicastAddress: string;
     readonly supportsMRP = false;
     readonly closingAfterExchangeFinished = false; // Group sessions do not close after exchange finished, they are long-lived
 
@@ -55,6 +70,7 @@ export class GroupSession extends SecureSession {
             id,
             peerNodeId,
             keySetId,
+            multicastAddress,
             messageCounter,
         } = config;
         super({
@@ -68,6 +84,7 @@ export class GroupSession extends SecureSession {
         this.keySetId = keySetId;
         this.#operationalGroupKey = operationalGroupKey;
         this.#operationalPrivacyKey = operationalPrivacyKey;
+        this.#multicastAddress = multicastAddress;
 
         manager?.registerGroupSession(this);
         fabric.addSession(this);
@@ -75,6 +92,11 @@ export class GroupSession extends SecureSession {
         logger.debug(this.via, `Created secure GROUP session for fabric index ${fabric.fabricIndex}`);
     }
 
+    /** IPv6 multicast destination address this group session sends to. */
+    get multicastAddress(): string {
+        return this.#multicastAddress;
+    }
+
     /**
      * Create an outbound group session.
      */
@@ -113,6 +135,7 @@ export class GroupSession extends SecureSession {
             peerNodeId: groupNodeId,
             operationalGroupKey,
             operationalPrivacyKey: Bytes.of(await MessagePrivacy.deriveKey(fabric.crypto, operationalGroupKey)),
+            multicastAddress,
             messageCounter,
         });
     }
@@ -263,7 +286,7 @@ export class GroupSession extends SecureSession {
             }
         }
         if (keys.length === 0) {
-            throw new MatterFlowError("No key candidate found for group session decryption.");
+            throw new GroupSessionNoKeyError();
         }
 
         const messageFlags = Bytes.of(aad)[0];
@@ -330,7 +353,7 @@ export class GroupSession extends SecureSession {
             }
         }
         if (!found || !message || !key || keySetId === undefined || !fabric || sourceNodeId === undefined) {
-            throw new MatterFlowError("Failed to decode group message with any key candidate.");
+            throw new GroupSessionDecodeError();
         }
 
         if (message.payloadHeader.hasSecuredExtension) {
@@ -356,6 +379,7 @@ export namespace GroupSession {
         peerNodeId: NodeId; //The Target Group Node Id
         operationalGroupKey: Bytes; // The Operational Group Key that was used to encrypt the incoming group message.
         operationalPrivacyKey?: Bytes;
+        multicastAddress: string; // IPv6 multicast destination address this session sends to.
         messageCounter: MessageCounter;
     }
 

package/src/session/SessionManager.ts

@@ -12,10 +12,11 @@ import { PeerAddress, PeerAddressMap } from "#peer/PeerAddress.js";
 import { PeerShutdownError } from "#peer/PeerCommunicationError.js";
 import { PeerLossContext } from "#peer/PeerLossContext.js";
 import { SessionClosedError } from "#protocol/errors.js";
-import { GroupSession } from "#session/GroupSession.js";
+import { GroupSession, GroupSessionDecodeError, GroupSessionNoKeyError } from "#session/GroupSession.js";
 import {
     BasicSet,
     Bytes,
+    causedBy,
     Channel,
     ClosedError,
     Construction,
@@ -41,7 +42,8 @@ import {
     Transport,
     UnexpectedDataError,
 } from "@matter/general";
-import { CaseAuthenticatedTag, FabricId, FabricIndex, GroupId, NodeId } from "@matter/types";
+import { CaseAuthenticatedTag, ClusterId, EndpointNumber, FabricId, FabricIndex, GroupId, NodeId } from "@matter/types";
+import { Groupcast } from "@matter/types/clusters/groupcast";
 import type { ExposedFabricInformation, Fabric } from "../fabric/Fabric.js";
 import { MessageCounter, PersistedMessageCounter } from "../protocol/MessageCounter.js";
 import { NodeSession } from "./NodeSession.js";
@@ -114,6 +116,24 @@ export interface ActiveSessionInformation {
     numberOfActiveSubscriptions: number;
 }
 
+/**
+ * Metadata about a received group message, emitted via {@link SessionManager.onGroupMessage} for Groupcast testing.
+ * Uses {@link Groupcast.GroupcastTestResult} directly so consumers can forward the value without mapping.
+ */
+export interface GroupMessageEventInfo {
+    result: Groupcast.GroupcastTestResult;
+    fabric?: Fabric;
+    groupId?: GroupId;
+    sourceIp?: string;
+    destIp?: string;
+    endpointId?: EndpointNumber;
+    clusterId?: ClusterId;
+    elementId?: number;
+
+    /** Whether the ACL granted access for the dispatched command (only set for Success). */
+    accessAllowed?: boolean;
+}
+
 /**
  * Interfaces {@link SessionManager} with other components.
  */
@@ -141,7 +161,8 @@ const GROUP_DATA_COUNTER_KEY = "groupDataCounter";
 
 /**
  * Reserve block size for the persisted group data counter; matches CHIP `GROUP_MSG_COUNTER_MIN_INCREMENT`. The counter
- * is persisted this far ahead so an unclean restart never rolls it back (Matter spec §4.6.1.3).
+ * is persisted this far ahead so an unclean restart never rolls it back.
+ * @see {@link MatterSpecification.v16.Core} § 4.6.1.3
  */
 const GROUP_DATA_COUNTER_RESERVE = 1000;
 
@@ -180,6 +201,7 @@ export class SessionManager {
 
     readonly #subscriptionsChanged = Observable<[session: NodeSession, subscription: Subscription]>();
     readonly #retry = Observable<[session: Session, number: number]>();
+    readonly #onGroupMessage = Observable<[info: GroupMessageEventInfo]>();
 
     constructor(context: SessionManagerContext) {
         this.#context = context;
@@ -239,7 +261,10 @@ export class SessionManager {
         return this.#context.fabrics.crypto;
     }
 
-    /** The single node-global Group Encrypted Data Message Counter shared by all group sessions (spec §4.6.1.3). */
+    /**
+     * The single node-global Group Encrypted Data Message Counter shared by all group sessions.
+     * @see {@link MatterSpecification.v16.Core} § 4.6.1.3
+     */
     get groupDataMessageCounter() {
         this.#construction.assert();
         return this.#groupDataMessageCounter;
@@ -304,6 +329,14 @@ export class SessionManager {
         return this.#retry;
     }
 
+    /**
+     * Emits for each received group message (success or failure).  Observers remain inactive until at least one
+     * listener attaches, so fabrics not under test incur no emission overhead.
+     */
+    get onGroupMessage() {
+        return this.#onGroupMessage;
+    }
+
     /**
      * Convenience function for accessing a fabric by address.
      */
@@ -595,17 +628,29 @@ export class SessionManager {
      */
     groupSessionFromPacket(packet: DecodedPacket, aad: Bytes) {
         this.#construction.assert();
-        const { message, key, privacyKey, sessionId, sourceNodeId, keySetId, fabric } = GroupSession.decode(
-            this.#context.fabrics,
-            packet,
-            aad,
-        );
+        let decoded;
+        try {
+            decoded = GroupSession.decode(this.#context.fabrics, packet, aad);
+        } catch (error) {
+            // Groupcast testing event on decode failure.  Observable is a no-op unless a listener is attached.  A failed
+            // decode is unauthenticated, so per the Groupcast spec we report only the result, never a group id.
+            if (causedBy(error, GroupSessionNoKeyError)) {
+                this.#onGroupMessage.emit({ result: Groupcast.GroupcastTestResult.NoAvailableKey });
+            } else if (causedBy(error, GroupSessionDecodeError)) {
+                this.#onGroupMessage.emit({ result: Groupcast.GroupcastTestResult.FailedAuth });
+            }
+            throw error;
+        }
 
-        const groupId = message.packetHeader.destGroupId;
-        if (groupId === undefined) {
+        const { message, key, privacyKey, sessionId, sourceNodeId, keySetId, fabric } = decoded;
+
+        // The group id is only authoritative after decode, since privacy obfuscates it in the wire header.
+        const rawGroupId = message.packetHeader.destGroupId;
+        if (rawGroupId === undefined) {
             throw new UnexpectedDataError("Group ID is required for GroupSession fromPacket.");
         }
-        GroupId.assertGroupId(GroupId(groupId));
+        const groupId = GroupId(rawGroupId);
+        GroupId.assertGroupId(groupId);
 
         let session = this.#groupSessions.get(sourceNodeId)?.get("id", sessionId);
         if (session === undefined) {
@@ -617,6 +662,7 @@ export class SessionManager {
                 operationalGroupKey: key,
                 operationalPrivacyKey: privacyKey,
                 peerNodeId: sourceNodeId,
+                multicastAddress: fabric.groups.multicastAddressFor(groupId),
                 messageCounter: this.#groupDataMessageCounter,
             });
         }
@@ -624,6 +670,11 @@ export class SessionManager {
         return { session, message, key };
     }
 
+    /** Report a group message event (used by ExchangeManager for replay and InteractionServer for dispatch). */
+    emitGroupMessage(info: GroupMessageEventInfo) {
+        this.#onGroupMessage.emit(info);
+    }
+
     registerGroupSession(session: GroupSession) {
         const sourceNodeId = session.peerNodeId;
         const peerSessions = this.#groupSessions.get(sourceNodeId) ?? new BasicSet();
@@ -783,7 +834,8 @@ export class SessionManager {
     /**
      * Build the node-global group data message counter. On the first run after upgrading from the legacy per-key
      * model, seed it above every value any per-key counter could already have used so it never rolls back below a
-     * value already sent with a surviving key (spec §4.6.1.3); then clear the legacy entries.
+     * value already sent with a surviving key; then clear the legacy entries.
+     * @see {@link MatterSpecification.v16.Core} § 4.6.1.3
      */
     async #createGroupDataMessageCounter() {
         const storage = this.#context.storage;

package/src/session/case/CaseMessages.ts

@@ -24,7 +24,7 @@ export const KDFSR3_INFO = Bytes.fromString("Sigma3");
 export const TBE_DATA2_NONCE = Bytes.fromString("NCASE_Sigma2N");
 export const TBE_DATA3_NONCE = Bytes.fromString("NCASE_Sigma3N");
 
-/** @see {@link MatterSpecification.v13.Core} § 4.14.2.3 */
+/** @see {@link MatterSpecification.v16.Core} § 4.14.2.3 */
 export const TlvCaseSigma1 = TlvObject({
     initiatorRandom: TlvField(1, TlvByteString.bound({ length: 32 })),
     initiatorSessionId: TlvField(2, TlvUInt16),
@@ -36,7 +36,7 @@ export const TlvCaseSigma1 = TlvObject({
 });
 export type CaseSigma1 = WithDurationSessionParameters<TypeFromSchema<typeof TlvCaseSigma1>, "initiatorSessionParams">;
 
-/** @see {@link MatterSpecification.v13.Core} § 4.14.2.3 */
+/** @see {@link MatterSpecification.v16.Core} § 4.14.2.3 */
 export const TlvCaseSigma2 = TlvObject({
     responderRandom: TlvField(1, TlvByteString.bound({ length: 32 })),
     responderSessionId: TlvField(2, TlvUInt16),
@@ -46,7 +46,7 @@ export const TlvCaseSigma2 = TlvObject({
 });
 export type CaseSigma2 = WithDurationSessionParameters<TypeFromSchema<typeof TlvCaseSigma2>, "responderSessionParams">;
 
-/** @see {@link MatterSpecification.v13.Core} § 4.14.2.3 */
+/** @see {@link MatterSpecification.v16.Core} § 4.14.2.3 */
 export const TlvCaseSigma2Resume = TlvObject({
     resumptionId: TlvField(1, TlvByteString.bound({ length: 16 })),
     resumeMic: TlvField(2, TlvByteString.bound({ length: 16 })),
@@ -58,13 +58,13 @@ export type CaseSigma2Resume = WithDurationSessionParameters<
     "responderSessionParams"
 >;
 
-/** @see {@link MatterSpecification.v13.Core} § 4.14.2.3 */
+/** @see {@link MatterSpecification.v16.Core} § 4.14.2.3 */
 export const TlvCaseSigma3 = TlvObject({
     encrypted: TlvField(1, TlvByteString),
 });
 export type CaseSigma3 = TypeFromSchema<typeof TlvCaseSigma3>;
 
-/** @see {@link MatterSpecification.v10.Core} § 4.13.2.3 */
+/** @see {@link MatterSpecification.v16.Core} § 4.14.2.3 */
 export const TlvSignedData = TlvObject({
     responderNoc: TlvField(1, TlvByteString),
     responderIcac: TlvOptionalField(2, TlvByteString),
@@ -73,7 +73,7 @@ export const TlvSignedData = TlvObject({
 });
 export type SignedData = TypeFromSchema<typeof TlvSignedData>;
 
-/** @see {@link MatterSpecification.v10.Core} § 4.13.2.3 */
+/** @see {@link MatterSpecification.v16.Core} § 4.14.2.3 */
 export const TlvEncryptedDataSigma2 = TlvObject({
     responderNoc: TlvField(1, TlvByteString),
     responderIcac: TlvOptionalField(2, TlvByteString),
@@ -82,7 +82,7 @@ export const TlvEncryptedDataSigma2 = TlvObject({
 });
 export type EncryptedDataSigma2 = TypeFromSchema<typeof TlvEncryptedDataSigma2>;
 
-/** @see {@link MatterSpecification.v10.Core} § 4.13.2.3 */
+/** @see {@link MatterSpecification.v16.Core} § 4.14.2.3 */
 export const TlvEncryptedDataSigma3 = TlvObject({
     responderNoc: TlvField(1, TlvByteString),
     responderIcac: TlvOptionalField(2, TlvByteString),

package/src/session/pase/PaseMessages.ts

@@ -19,7 +19,7 @@ import {
     TypeFromSchema,
 } from "@matter/types";
 
-/** @see {@link MatterSpecification.v13.Core} § 4.12.8 */
+/** @see {@link MatterSpecification.v16.Core} § 4.13.1 */
 export const TlvSessionParameters = TlvObject({
     /** Maximum sleep interval of node when in idle mode. */
     idleInterval: TlvOptionalField(1, TlvUInt32) /* default: SESSION_IDLE_INTERVAL */,
@@ -60,7 +60,7 @@ export type WithDurationSessionParameters<T, K extends keyof T> = Omit<T, K> & {
     [P in K]?: SessionParametersWithDurations;
 };
 
-/** @see {@link MatterSpecification.v13.Core} § 4.14.1.2 */
+/** @see {@link MatterSpecification.v16.Core} § 4.14.1.2 */
 export const TlvPbkdfParamRequest = TlvObject({
     initiatorRandom: TlvField(1, TlvByteString.bound({ length: 32 })),
     initiatorSessionId: TlvField(2, TlvUInt16), // Specs: range: 16bits
@@ -73,7 +73,7 @@ export type PbkdfParamRequest = WithDurationSessionParameters<
     "initiatorSessionParams"
 >;
 
-/** @see {@link MatterSpecification.v13.Core} § 4.14.1.2 */
+/** @see {@link MatterSpecification.v16.Core} § 4.14.1.2 */
 export const TlvPbkdfParamResponse = TlvObject({
     initiatorRandom: TlvField(1, TlvByteString.bound({ length: 32 })),
     responderRandom: TlvField(2, TlvByteString.bound({ length: 32 })),
@@ -92,20 +92,20 @@ export type PbkdfParamResponse = WithDurationSessionParameters<
     "responderSessionParams"
 >;
 
-/** @see {@link MatterSpecification.v13.Core} § 4.14.1.2 */
+/** @see {@link MatterSpecification.v16.Core} § 4.14.1.2 */
 export const TlvPasePake1 = TlvObject({
     x: TlvField(1, TlvByteString.bound({ length: CRYPTO_PUBLIC_KEY_SIZE_BYTES })), // pA
 });
 export type PasePake1 = TypeFromSchema<typeof TlvPasePake1>;
 
-/** @see {@link MatterSpecification.v13.Core} § 4.14.1.2 */
+/** @see {@link MatterSpecification.v16.Core} § 4.14.1.2 */
 export const TlvPasePake2 = TlvObject({
     y: TlvField(1, TlvByteString.bound({ length: CRYPTO_PUBLIC_KEY_SIZE_BYTES })), // pB
     verifier: TlvField(2, TlvByteString.bound({ length: CRYPTO_HASH_LEN_BYTES })), // cB
 });
 export type PasePake2 = TypeFromSchema<typeof TlvPasePake2>;
 
-/** @see {@link MatterSpecification.v13.Core} § 4.14.1.2 */
+/** @see {@link MatterSpecification.v16.Core} § 4.14.1.2 */
 export const TlvPasePake3 = TlvObject({
     verifier: TlvField(1, TlvByteString.bound({ length: CRYPTO_HASH_LEN_BYTES })), // cA
 });