@matter/protocol 0.17.4 → 0.17.5-alpha.0-20260704-9ea70abfa

package/src/action/server/AttributeReadResponse.ts

@@ -130,11 +130,25 @@ export class AttributeReadResponse<
         };
     }
 
+    /**
+     * Read the node's current BasicInformation ConfigurationVersion (endpoint 0, cluster 0x28, attribute 0x18), or
+     * undefined when the attribute is not present.
+     */
+    #currentConfigurationVersion(): number | undefined {
+        const endpoint = this.node[0];
+        const cluster = endpoint?.[0x28];
+        if (cluster === undefined) {
+            return undefined;
+        }
+        return cluster.readState(this.session)[0x18] as number | undefined;
+    }
+
     /**
      * Validate a wildcard path and update internal state.
      */
     protected addWildcard(path: AttributePath) {
-        const { nodeId, endpointId, clusterId, attributeId, wildcardPathFlags } = path;
+        const { nodeId, endpointId, clusterId, attributeId, wildcardPathFlags, wildcardFilterConfigurationVersion } =
+            path;
 
         if (clusterId === undefined && attributeId !== undefined && !GlobalAttrIds.has(attributeId)) {
             throw new StatusResponseError(
@@ -147,7 +161,21 @@ export class AttributeReadResponse<
             return;
         }
 
-        const wpf = wildcardPathFlags ? WildcardPathFlagsCodec.encode(wildcardPathFlags) : 0;
+        let wpf = wildcardPathFlags ? WildcardPathFlagsCodec.encode(wildcardPathFlags) : 0;
+
+        // WildcardPathFlags only suppress paths while the client's WildcardFilterConfigurationVersion is current.  Once
+        // the node's ConfigurationVersion has advanced past it the configuration changed, so the flags no longer apply
+        // and all paths are reported.  An omitted filter (or 0xFFFFFFFF) is treated as the current version.
+        if (
+            wpf !== 0 &&
+            wildcardFilterConfigurationVersion !== undefined &&
+            wildcardFilterConfigurationVersion !== 0xffffffff
+        ) {
+            const current = this.#currentConfigurationVersion();
+            if (current !== undefined && wildcardFilterConfigurationVersion < current) {
+                wpf = 0;
+            }
+        }
 
         if (endpointId === undefined) {
             this.#addProducer(function* (this: AttributeReadResponse) {

package/src/advertisement/mdns/MdnsAdvertisement.ts

@@ -198,7 +198,8 @@ export abstract class MdnsAdvertisement<T extends ServiceDescription = ServiceDe
 
         Object.assign(values, this.txtValues);
 
-        if (this.description.tcp !== undefined) {
+        // The T (transport modes) key is only used during operational discovery, not by commissionable/commissioner nodes
+        if (this.description.tcp !== undefined && this.isOperational()) {
             values.T = SupportedTransportsSchema.encode(this.description.tcp); /* TCP support */
         }
 

package/src/bdx/schema/BdxAcceptMessagesSchema.ts

@@ -14,7 +14,7 @@ import {
     BdxTransferControlSchema,
 } from "./BdxInitMessagesSchema.js";
 
-/** @see {@link MatterSpecification.v141.Core}, section 11.22.5.2 */
+/** @see {@link MatterSpecification.v16.Core}, section 11.22.5.2 */
 export interface BdxSendAccept {
     /**
      * Transfer control details
@@ -37,7 +37,7 @@ export interface BdxSendAccept {
     metaData?: Bytes;
 }
 
-/** @see {@link MatterSpecification.v141.Core}, section 11.22.5.3 */
+/** @see {@link MatterSpecification.v16.Core}, section 11.22.5.3 */
 export interface BdxReceiveAccept extends BdxSendAccept {
     /**
      * Specifies a predetermined definite length for the transfer

package/src/bdx/schema/BdxBlockMessagesSchema.ts

@@ -11,26 +11,26 @@ interface BdxCounterOnly {
     blockCounter: number;
 }
 
-/** @see {@link MatterSpecification.v141.Core}, section 11.22.6.2 */
+/** @see {@link MatterSpecification.v16.Core}, section 11.22.6.2 */
 export interface BdxBlockQuery extends BdxCounterOnly {}
 
-/** @see {@link MatterSpecification.v141.Core}, section 11.22.6.6 */
+/** @see {@link MatterSpecification.v16.Core}, section 11.22.6.6 */
 export interface BdxBlockAck extends BdxCounterOnly {}
 
-/** @see {@link MatterSpecification.v141.Core}, section 11.22.6.7 */
+/** @see {@link MatterSpecification.v16.Core}, section 11.22.6.7 */
 export interface BdxBlockAckEof extends BdxCounterOnly {}
 
-/** @see {@link MatterSpecification.v141.Core}, section 11.22.6.3 */
+/** @see {@link MatterSpecification.v16.Core}, section 11.22.6.3 */
 export interface BdxBlockQueryWithSkip extends BdxCounterOnly {
     bytesToSkip: number | bigint;
 }
 
-/** @see {@link MatterSpecification.v141.Core}, section 11.22.6.4 */
+/** @see {@link MatterSpecification.v16.Core}, section 11.22.6.4 */
 export interface BdxBlock extends BdxCounterOnly {
     data: Bytes;
 }
 
-/** @see {@link MatterSpecification.v141.Core}, section 11.22.6.5 */
+/** @see {@link MatterSpecification.v16.Core}, section 11.22.6.5 */
 export interface BdxBlockEof extends BdxBlock {}
 
 /** Schema for BDX messages that only contain a block counter: BlockQuery, BlockAck, BlockAckEof. */

package/src/bdx/schema/BdxInitMessagesSchema.ts

@@ -14,7 +14,7 @@ export const BDX_VERSION = 0;
  * BDX Transfer protocol bitmap definition
  * Bit 7 is reserved for future use
  *
- * @see {@link MatterSpecification.v141.Core}, section 11.22.5.1
+ * @see {@link MatterSpecification.v16.Core}, section 11.22.5.1
  */
 export const BdxTransferControlBitmap = {
     /** Protocol Version, Only allowed version is 0.0 for now */
@@ -38,7 +38,7 @@ export const BdxTransferControlSchema = BitmapSchema(BdxTransferControlBitmap);
  * BDX Range control bitmap definition
  * Bits 2-3 and 5-7 is reserved for future use
  *
- * @see {@link MatterSpecification.v141.Core}, section 11.22.5.1
+ * @see {@link MatterSpecification.v16.Core}, section 11.22.5.1
  */
 export const BdxRangeControlBitmap = {
     /** Indicates if the transfer has a definite length */
@@ -55,7 +55,7 @@ export const BdxRangeControlBitmap = {
 };
 export const BdxRangeControlSchema = BitmapSchema(BdxRangeControlBitmap);
 
-/** @see {@link MatterSpecification.v141.Core}, section 11.22.5.1 */
+/** @see {@link MatterSpecification.v16.Core}, section 11.22.5.1 */
 export type BdxInit = {
     /**
      * Transfer protocol details

package/src/ble/BleConsts.ts

@@ -6,7 +6,7 @@
 
 import { MAX_UDP_MESSAGE_SIZE, Millis, Seconds } from "@matter/general";
 
-/** @see {@link MatterSpecification.v11.Core} § 4.17.3.2 */
+/** @see {@link MatterSpecification.v16.Core} § 4.19 */
 export namespace MatterBle {
     /** Short 16-bit form of the Matter BLE service UUID. */
     export const SERVICE_UUID_SHORT = "fff6";

package/src/certificate/kinds/Icac.ts

@@ -50,7 +50,7 @@ export class Icac extends OperationalBase<OperationalCertificate.Icac> {
 
     /**
      * Verify requirements a Matter Intermediate CA certificate must fulfill.
-     * Rules for this are listed in @see {@link MatterSpecification.v12.Core} §6.5.x
+     * Rules for this are listed in @see {@link MatterSpecification.v16.Core} §6.5.x
      */
     async verify(crypto: Crypto, root: Rcac) {
         this.generalVerify();

package/src/certificate/kinds/Noc.ts

@@ -51,7 +51,7 @@ export class Noc extends OperationalBase<OperationalCertificate.Noc> {
 
     /**
      * Verify requirements a Matter Node Operational certificate must fulfill.
-     * Rules for this are listed in @see {@link MatterSpecification.v12.Core} §6.5.x
+     * Rules for this are listed in @see {@link MatterSpecification.v16.Core} §6.5.x
      */
     async verify(crypto: Crypto, root: Rcac, ica?: Icac) {
         this.generalVerify();

package/src/certificate/kinds/OperationalBase.ts

@@ -39,7 +39,7 @@ export abstract class OperationalBase<CT extends MatterCertificate> extends Cert
 
     /**
      * Verifies general requirements a Matter certificate fields must fulfill.
-     * Rules for this are listed in @see {@link MatterSpecification.v12.Core} §6.5.x
+     * Rules for this are listed in @see {@link MatterSpecification.v16.Core} §6.5.x
      */
     generalVerify() {
         const cert = this.cert;

package/src/certificate/kinds/Rcac.ts

@@ -50,7 +50,7 @@ export class Rcac extends OperationalBase<OperationalCertificate.Rcac> {
 
     /**
      * Verify requirements a Matter Root certificate must fulfill.
-     * Rules for this are listed in @see {@link MatterSpecification.v12.Core} §6.5.x
+     * Rules for this are listed in @see {@link MatterSpecification.v16.Core} §6.5.x
      */
     async verify(crypto: Crypto) {
         this.generalVerify();

package/src/certificate/kinds/Vvsc.ts

@@ -40,7 +40,7 @@ export class Vvsc extends OperationalBase<OperationalCertificate.Vvsc> {
 
     /**
      * Verify requirements a Matter Intermediate CA certificate must fulfill.
-     * Rules for this are listed in @see {@link MatterSpecification.v12.Core} §6.5.x
+     * Rules for this are listed in @see {@link MatterSpecification.v16.Core} §6.5.x
      * // TODO ADD Verification once we know more about the chain
      */
     async verify(_crypto: Crypto) {

package/src/certificate/kinds/common.ts

@@ -7,7 +7,7 @@ import { Bytes, ImplementationError } from "@matter/general";
 
 /**
  * Matter specific Certificate Sizes
- * @see {@link MatterSpecification.v13.Core} 6.1.3.
+ * @see {@link MatterSpecification.v16.Core} 6.1.3.
  */
 export const MAX_DER_CERTIFICATE_SIZE = 600;
 

package/src/certificate/kinds/definitions/asn.ts

@@ -44,7 +44,7 @@ function uInt16To4Chars(value: number) {
 
 /**
  * Matter specific ASN.1 OIDs
- * @see {@link MatterSpecification.v12.Core} Appendix E
+ * @see {@link MatterSpecification.v16.Core} Appendix E
  */
 
 /**

package/src/certificate/kinds/definitions/operational.ts

@@ -28,7 +28,7 @@ import { ExtensionKeyUsageBitmap } from "./base.js";
 
 /**
  * Matter specific Certificate Sizes
- * @see {@link MatterSpecification.v13.Core} 6.1.3.
+ * @see {@link MatterSpecification.v16.Core} 6.1.3.
  */
 export const MAX_TLV_CERTIFICATE_SIZE = 400;
 

package/src/codec/MessageCodec.ts

@@ -173,7 +173,26 @@ function mapProtocolAndMessageType(protocolId: number, messageType: number): { t
 }
 
 export class MessageCodec {
-    static decodePacket(data: Bytes): DecodedPacket {
+    /**
+     * Decode the cleartext header prefix (flags, sessionId, securityFlags) and optionally the obfuscated
+     * header region for privacy-enhanced packets. Returns parsed fields for cleartext portion and raw
+     * obfuscated region for privacy packets.
+     */
+    static decodeFixedHeader(data: Bytes): {
+        flags: number;
+        sessionType: SessionType;
+        hasPrivacyEnhancements: boolean;
+        hasMessageExtensions: boolean;
+        sessionId: number;
+        securityFlags: number;
+        messageId?: number;
+        sourceNodeId?: bigint;
+        destNodeId?: bigint;
+        destGroupId?: number;
+        obfuscatedRegion?: Bytes;
+        /** Bytes following the fixed (and, for privacy packets, obfuscated) header — the encrypted/cleartext tail. */
+        applicationPayload: Bytes;
+    } {
         const reader = new DataReader(data, Endian.Little);
 
         const flags = reader.readUInt8();
@@ -224,11 +243,63 @@ export class MessageCodec {
                     `Privacy header length ${privacyHeaderLength} exceeds remaining message size ${reader.remainingBytesCount}.`,
                 );
             }
-            const privacyHeader = reader.readByteArray(privacyHeaderLength);
+            const obfuscatedRegion = reader.readByteArray(privacyHeaderLength);
+            return {
+                flags,
+                sessionType,
+                hasPrivacyEnhancements: true,
+                hasMessageExtensions: false,
+                sessionId,
+                securityFlags,
+                obfuscatedRegion,
+                applicationPayload: reader.remainingBytes,
+            };
+        }
+
+        const messageId = reader.readUInt32();
+        const sourceNodeId = hasSourceNodeId ? reader.readUInt64() : undefined;
+        const destNodeId = hasDestNodeId ? reader.readUInt64() : undefined;
+        const destGroupId = hasDestGroupId ? reader.readUInt16() : undefined;
+
+        return {
+            flags,
+            sessionType,
+            hasPrivacyEnhancements: false,
+            hasMessageExtensions,
+            sessionId,
+            securityFlags,
+            messageId,
+            sourceNodeId,
+            destNodeId,
+            destGroupId,
+            applicationPayload: reader.remainingBytes,
+        };
+    }
+
+    static decodePacket(data: Bytes): DecodedPacket {
+        const {
+            sessionType,
+            hasPrivacyEnhancements,
+            hasMessageExtensions,
+            sessionId,
+            securityFlags,
+            messageId,
+            sourceNodeId,
+            destNodeId,
+            destGroupId,
+            obfuscatedRegion,
+            applicationPayload,
+        } = MessageCodec.decodeFixedHeader(data);
+
+        if (hasPrivacyEnhancements) {
+            // decodeFixedHeader sets obfuscatedRegion whenever privacy is enabled; assert the invariant for the type.
+            if (obfuscatedRegion === undefined) {
+                throw new UnexpectedDataError("Privacy-enhanced packet is missing its obfuscated header region.");
+            }
             // Reject early: the privacy nonce is derived from the MIC, so a packet without a full MIC must not proceed.
-            if (reader.remainingBytesCount < CRYPTO_AEAD_MIC_LENGTH_BYTES) {
+            if (applicationPayload.byteLength < CRYPTO_AEAD_MIC_LENGTH_BYTES) {
                 throw new UnexpectedDataError(
-                    `Privacy-enhanced message too short to contain a MIC: ${reader.remainingBytesCount} bytes remaining.`,
+                    `Privacy-enhanced message too short to contain a MIC: ${applicationPayload.byteLength} bytes remaining.`,
                 );
             }
             return {
@@ -244,23 +315,23 @@ export class MessageCodec {
                     destNodeId: undefined,
                     destGroupId: undefined,
                 },
-                privacyHeader,
-                applicationPayload: reader.remainingBytes,
+                privacyHeader: obfuscatedRegion,
+                applicationPayload,
             };
         }
 
-        const messageId = reader.readUInt32();
-        const sourceNodeId = hasSourceNodeId ? NodeId(reader.readUInt64()) : undefined;
-        const destNodeId = hasDestNodeId ? NodeId(reader.readUInt64()) : undefined;
-        const destGroupId = hasDestGroupId ? GroupId(reader.readUInt16()) : undefined;
+        // decodeFixedHeader always reads the counter for non-privacy packets; assert the invariant for the type.
+        if (messageId === undefined) {
+            throw new UnexpectedDataError("Message is missing its message counter.");
+        }
 
         const header: DecodedPacketHeader = {
             securityFlags,
             sessionId,
-            sourceNodeId,
+            sourceNodeId: sourceNodeId === undefined ? undefined : NodeId(sourceNodeId),
             messageId,
-            destGroupId,
-            destNodeId,
+            destGroupId: destGroupId === undefined ? undefined : GroupId(destGroupId),
+            destNodeId: destNodeId === undefined ? undefined : NodeId(destNodeId),
             sessionType,
             hasPrivacyEnhancements: false,
             isControlMessage: false,
@@ -268,7 +339,9 @@ export class MessageCodec {
         };
 
         let messageExtension: Bytes | undefined = undefined;
+        let payload = applicationPayload;
         if (hasMessageExtensions) {
+            const reader = new DataReader(applicationPayload, Endian.Little);
             const extensionLength = reader.readUInt16();
             if (extensionLength > reader.remainingBytesCount) {
                 throw new UnexpectedDataError(
@@ -276,12 +349,13 @@ export class MessageCodec {
                 );
             }
             messageExtension = reader.readByteArray(extensionLength);
+            payload = reader.remainingBytes;
         }
 
         return {
             header,
             messageExtension,
-            applicationPayload: reader.remainingBytes,
+            applicationPayload: payload,
         };
     }
 

package/src/codec/MessagePrivacy.ts

@@ -14,7 +14,10 @@ import {
     MaybePromise,
 } from "@matter/general";
 
-/** HKDF info string for deriving a privacy key from an encryption key (Matter spec §4.9.1). */
+/**
+ * HKDF info string for deriving a privacy key from an encryption key.
+ * @see {@link MatterSpecification.v16.Core} § 4.9.1
+ */
 const PRIVACY_KEY_INFO = Bytes.fromString("PrivacyKey");
 
 const NONCE_SESSION_ID_LENGTH = 2;
@@ -22,7 +25,8 @@ const NONCE_MIC_LENGTH = CRYPTO_PRIVACY_NONCE_LENGTH_BYTES - NONCE_SESSION_ID_LE
 const NONCE_MIC_OFFSET = CRYPTO_AEAD_MIC_LENGTH_BYTES - NONCE_MIC_LENGTH;
 
 /**
- * Matter message privacy (spec §4.9): obfuscation of the packet header for privacy-enhanced messages.
+ * Matter message privacy: obfuscation of the packet header for privacy-enhanced messages.
+ * @see {@link MatterSpecification.v16.Core} § 4.9
  */
 export namespace MessagePrivacy {
     /** Derive a privacy key from an encryption key: HKDF(key, salt=[], info="PrivacyKey", 16). */

package/src/common/OperationalCredentialsTypes.ts

@@ -6,7 +6,7 @@
 
 import { TlvByteString, TlvField, TlvObject, TlvOptionalField, TlvUInt32 } from "@matter/types";
 
-/** @see {@link MatterSpecification.v11.Core} § 11.17.5.4 */
+/** @see {@link MatterSpecification.v16.Core} § 11.18.4.6 */
 export const TlvAttestation = TlvObject({
     declaration: TlvField(1, TlvByteString),
     attestationNonce: TlvField(2, TlvByteString.bound({ length: 32 })),
@@ -14,7 +14,7 @@ export const TlvAttestation = TlvObject({
     firmwareInfo: TlvOptionalField(4, TlvByteString),
 });
 
-/** @see {@link MatterSpecification.v11.Core} § 11.17.5.6 */
+/** @see {@link MatterSpecification.v16.Core} § 11.18.4.8 */
 export const TlvCertSigningRequest = TlvObject({
     certSigningRequest: TlvField(1, TlvByteString),
     csrNonce: TlvField(2, TlvByteString.bound({ length: 32 })),

package/src/groups/FabricGroups.ts

@@ -9,7 +9,7 @@ import { GroupKeySet, KeySets, OperationalKeySet } from "#groups/KeySets.js";
 import { MessagingState } from "#groups/MessagingState.js";
 import { BasicMap, Bytes, hex, InternalError, MatterFlowError, StorageContext } from "@matter/general";
 import { GroupId, MATTER_EPOCH_OFFSET_US } from "@matter/types";
-import { Groups } from "./Groups.js";
+import { GroupMulticastPolicy, Groups } from "./Groups.js";
 
 export const GROUP_SECURITY_INFO = Bytes.fromString("GroupKey v1.0");
 
@@ -96,6 +96,16 @@ export class FabricGroups {
         return this.#groups.multicastAddress(groupId);
     }
 
+    /** Sets the multicast address policy for a specific group (Groupcast cluster, Matter 1.6). */
+    setGroupMulticastPolicy(groupId: GroupId, policy: GroupMulticastPolicy) {
+        this.#groups.setGroupMulticastPolicy(groupId, policy);
+    }
+
+    /** Removes the multicast address policy for a specific group. */
+    removeGroupMulticastPolicy(groupId: GroupId) {
+        this.#groups.removeGroupMulticastPolicy(groupId);
+    }
+
     /*
     TODO for Controller to generate new epochs
     addGroupEpoch(groupKeySetId: number, startTimeMs = Time.nowMs) {

package/src/groups/Groups.ts

@@ -10,6 +10,12 @@ import { BasicMap, DataWriter, ImplementationError, ipv6BytesToString } from "@m
 import { EndpointNumber, GroupId } from "@matter/types";
 import { KeySets, OperationalKeySet } from "./KeySets.js";
 
+/** Multicast address policy for a group. IanaAddr uses the shared FF05::FA address; PerGroupId derives from GroupId. */
+export type GroupMulticastPolicy = "ianaAddr" | "perGroupId";
+
+/** IANA-assigned shared multicast address for Groupcast cluster (Matter 1.6). */
+export const IANA_GROUPCAST_MULTICAST_ADDRESS = "ff05::fa";
+
 export class Groups {
     #fabric: Fabric;
     #keySets: KeySets<OperationalKeySet>;
@@ -20,6 +26,9 @@ export class Groups {
     /** Operational variant of the group table, maps group Ids to a list of enabled endpoints. */
     readonly endpointMap = new Map<GroupId, EndpointNumber[]>();
 
+    /** Per-group multicast address policy (Groupcast cluster, Matter 1.6). Defaults to PerGroupId when not set. */
+    readonly #groupMulticastPolicy = new Map<GroupId, GroupMulticastPolicy>();
+
     constructor(fabric: Fabric, keySets: KeySets<OperationalKeySet>) {
         this.#fabric = fabric;
         this.#keySets = keySets;
@@ -51,12 +60,25 @@ export class Groups {
         });
     }
 
+    /** Sets the multicast address policy for a specific group (Groupcast cluster, Matter 1.6). */
+    setGroupMulticastPolicy(groupId: GroupId, policy: GroupMulticastPolicy) {
+        this.#groupMulticastPolicy.set(groupId, policy);
+    }
+
+    /** Removes the multicast address policy for a specific group, reverting to the default (PerGroupId). */
+    removeGroupMulticastPolicy(groupId: GroupId) {
+        this.#groupMulticastPolicy.delete(groupId);
+    }
+
     /** Returns the multicast address for a given group id for this fabric. */
     multicastAddress(groupId: GroupId) {
         GroupId.assertGroupId(groupId);
 
-        // If GroupKeyMulticastPolicy ever becomes non-provisional then we need to adjust logic here, but so far we
-        // just use the default which is PerGroupId, which means we use the GroupId to create the multicast address.
+        // When the Groupcast cluster assigns IanaAddr policy, all groups in the fabric share FF05::FA.
+        // Legacy groups and new groups without explicit policy use PerGroupId (fabric-derived address).
+        if (this.#groupMulticastPolicy.get(groupId) === "ianaAddr") {
+            return IANA_GROUPCAST_MULTICAST_ADDRESS;
+        }
 
         const writer = new DataWriter();
         writer.writeUInt16(0xff35);

package/src/groups/KeySets.ts

@@ -109,7 +109,7 @@ export class KeySets<T extends OperationalKeySet> extends BasicSet<T> {
         if (keySetId === 0) {
             // Groups: For the generation of the Destination Identifier, the originator SHALL use the operational group key with
             // the second newest EpochStartTime, if one exists, otherwise it SHALL use the single operational group key available.
-            // @see {@link MatterSpecification.v14.Core} § 4.14.2.6.
+            // @see {@link MatterSpecification.v16.Core} § 4.14.2.6.
             if (operationalKeys.length > 2) {
                 return operationalKeys[1];
             }

package/src/groups/index.ts

@@ -5,4 +5,5 @@
  */
 
 export * from "./FabricGroups.js";
+export * from "./Groups.js";
 export * from "./KeySets.js";

package/src/interaction/FabricAccessControl.ts

@@ -62,12 +62,13 @@ export class AccessDeniedError extends StatusResponseError {
 }
 
 /**
- * Implements Access Control Logic For one fabric as per Matter Specification @see {@link MatterSpecification.v12.Core}
- * § 6.6.5.2.
+ * Implements Access Control Logic For one fabric as per Matter Specification @see {@link MatterSpecification.v16.Core}
+ * § 6.6.6.2.
  */
 export class FabricAccessControl {
     #fabricIndex: FabricIndex;
     #aclList: AclList = [];
+    #auxiliaryFeatureEnabled = false;
     #extensionEntryAccessCheck: (
         aclList: AclList,
         aclEntry: AclEntry,
@@ -100,6 +101,10 @@ export class FabricAccessControl {
         );
     }
 
+    set auxiliaryFeatureEnabled(enabled: boolean) {
+        this.#auxiliaryFeatureEnabled = enabled;
+    }
+
     set extensionEntryAccessCheck(
         func: (
             aclList: AclList,
@@ -252,7 +257,15 @@ export class FabricAccessControl {
 
             // Target must match, or be "wildcard"
             if (aclEntry.targets === null || aclEntry.targets.length === 0) {
-                // Empty is wildcard, no match required
+                // Group subjects cannot grant access to Endpoint 0 when Auxiliary feature is enabled
+                if (
+                    aclEntry.authMode === AccessControl.AccessControlEntryAuthMode.Group &&
+                    this.#auxiliaryFeatureEnabled &&
+                    endpointId === EndpointNumber(0)
+                ) {
+                    continue;
+                }
+                // Otherwise, empty is wildcard, no match required
             } else {
                 // Non-empty requires a match
                 let matchedTarget = false;

package/src/ota/OtaImageHeader.ts

@@ -19,7 +19,7 @@ import {
 
 /**
  * OTA Image TLV Header
- * @see {@link MatterSpecification.v142.Core} §11.21.2.4.
+ * @see {@link MatterSpecification.v16.Core} §11.21.2.4.
  */
 export const TlvOtaImageHeader = TlvObject({
     /**

package/src/peer/ControllerCommissioningFlow.ts

@@ -366,7 +366,7 @@ export class ControllerCommissioningFlow {
                     /**
                      * Commissioner SHALL re-arm the Fail-safe timer on the Commissionee to the desired commissioning
                      * timeout within 60 seconds of the completion of a PASE session establishment, using the ArmFailSafe
-                     * command (see Section 11.9.6.2, “ArmFailSafe Command”)
+                     * command (see Section 11.10.7.2, “ArmFailSafe Command”)
                      */
                     const timeLeft = Timespan(Time.nowMs, this.#currentFailSafeEndTime).duration;
                     if (timeLeft < this.#defaultFailSafeTime / 2) {
@@ -488,7 +488,7 @@ export class ControllerCommissioningFlow {
 
     /**
      * Initialize commissioning steps and add them in the default order as defined by
-     * @see {@link MatterSpecification.v13.Core} § 5.5
+     * @see {@link MatterSpecification.v16.Core} § 5.5
      */
     #initializeCommissioningSteps() {
         this.commissioningSteps.push({
@@ -793,9 +793,9 @@ export class ControllerCommissioningFlow {
      * Step 7
      * Commissioner SHALL re-arm the Fail-safe timer on the Commissionee to the desired commissioning
      * timeout within 60 seconds of the completion of a PASE session establishment, using the
-     * ArmFailSafe command (see Section 11.10.6.2, “ArmFailSafe Command”). A Commissioner MAY
+     * ArmFailSafe command (see Section 11.10.7.2, “ArmFailSafe Command”). A Commissioner MAY
      * collect device information including guidance on the fail-safe value from the Commissionee by
-     * reading BasicCommissioningInfo attribute (see Section 11.10.5.2, “BasicCommissioningInfo
+     * reading BasicCommissioningInfo attribute (see Section 11.10.6.2, “BasicCommissioningInfo
      * Attribute”) before invoking the ArmFailSafe command.
      */
     async #armFailsafe(time?: Duration) {
@@ -1377,7 +1377,7 @@ export class ControllerCommissioningFlow {
     /**
      * Step 13-2 (we do as 99 at the end because)
      * The Administrator having established a CASE session with the Commissionee over the operational network in the
-     * previous steps SHALL invoke the CommissioningComplete command (see Section 11.9.6.6,
+     * previous steps SHALL invoke the CommissioningComplete command (see Section 11.10.7.6,
      * “CommissioningComplete Command”). A success response after invocation of the CommissioningComplete command ends
      * the commissioning process.
      */
@@ -1431,14 +1431,14 @@ export class ControllerCommissioningFlow {
     /**
      * Step 16-17
      * 16: If the Commissionee both supports it and requires it, the Commissioner SHALL configure the operational network
-     *     at the Commissionee using commands such as AddOrUpdateWiFiNetwork (see Section 11.8.7.3, “AddOrUpdateWiFiNetwork
-     *     Command”) and AddOrUpdateThreadNetwork (see Section 11.8.7.4, “AddOrUpdateThreadNetwork Command”).
+     *     at the Commissionee using commands such as AddOrUpdateWiFiNetwork (see Section 11.9.7.3, “AddOrUpdateWiFiNetwork
+     *     Command”) and AddOrUpdateThreadNetwork (see Section 11.9.7.4, “AddOrUpdateThreadNetwork Command”).
      *     A Commissionee requires network commissioning if it is not already on the desired operational network.
      *     A Commissionee supports network commissioning if it has any NetworkCommissioning cluster instances.
      *     A Commissioner MAY learn about the networks visible to the Commissionee using ScanNetworks command
-     *     (see Section 11.8.7.1, “ScanNetworks Command”).
+     *     (see Section 11.9.7.1, “ScanNetworks Command”).
      * 17: The Commissioner SHALL trigger the Commissionee to connect to the operational network using ConnectNetwork
-     *     command (see Section 11.8.7.9, “ConnectNetwork Command”) unless the Commissionee is already on the desired
+     *     command (see Section 11.9.7.8, “ConnectNetwork Command”) unless the Commissionee is already on the desired
      *     operational network.
      */
     async #validateNetwork() {
@@ -1853,7 +1853,7 @@ export class ControllerCommissioningFlow {
      * 18: Finalization of the Commissioning process begins. An Administrator configured in the ACL of the Commissionee
      *     by the Commissioner SHALL use Operational Discovery to discover the Commissionee. This Administrator MAY be
      *     the Commissioner itself, or another Node to which the Commissioner has delegated the task.
-     * 19: The Administrator SHALL open a CASE (see Section 4.13.2, “Certificate Authenticated Session Establishment
+     * 19: The Administrator SHALL open a CASE (see Section 4.14.2, “Certificate Authenticated Session Establishment
      *     (CASE)”) session with the Commissionee over the operational network.
      */
     async #reconnectWithDevice() {
@@ -1913,7 +1913,7 @@ export class ControllerCommissioningFlow {
     /**
      * Step 20
      * The Administrator having established a CASE session with the Commissionee over the operational network in the
-     * previous steps SHALL invoke the CommissioningComplete command (see Section 11.9.6.6,
+     * previous steps SHALL invoke the CommissioningComplete command (see Section 11.10.7.6,
      * “CommissioningComplete Command”). A success response after invocation of the CommissioningComplete command ends
      * the commissioning process.
      */