@matter/types 0.13.0-alpha.0-20250304-d4a7592a4 → 0.13.0-alpha.0-20250307-ebf84a05a

package/dist/cjs/clusters/access-control.js

@@ -26,16 +26,17 @@ var import_MutableCluster = require("../cluster/mutation/MutableCluster.js");
 var import_Cluster = require("../cluster/Cluster.js");
 var import_TlvArray = require("../tlv/TlvArray.js");
 var import_TlvObject = require("../tlv/TlvObject.js");
-var import_TlvNumber = require("../tlv/TlvNumber.js");
-var import_SubjectId = require("../datatype/SubjectId.js");
-var import_TlvNullable = require("../tlv/TlvNullable.js");
-var import_ClusterId = require("../datatype/ClusterId.js");
-var import_EndpointNumber = require("../datatype/EndpointNumber.js");
-var import_DeviceTypeId = require("../datatype/DeviceTypeId.js");
+var import_TlvString = require("../tlv/TlvString.js");
 var import_FabricIndex = require("../datatype/FabricIndex.js");
 var import_model = require("#model");
-var import_TlvString = require("../tlv/TlvString.js");
 var import_NodeId = require("../datatype/NodeId.js");
+var import_TlvNullable = require("../tlv/TlvNullable.js");
+var import_TlvNumber = require("../tlv/TlvNumber.js");
+var import_EndpointNumber = require("../datatype/EndpointNumber.js");
+var import_ClusterId = require("../datatype/ClusterId.js");
+var import_BitmapSchema = require("../schema/BitmapSchema.js");
+var import_SubjectId = require("../datatype/SubjectId.js");
+var import_DeviceTypeId = require("../datatype/DeviceTypeId.js");
 var import_ClusterRegistry = require("../cluster/ClusterRegistry.js");
 /**
  * @license
@@ -44,6 +45,364 @@ var import_ClusterRegistry = require("../cluster/ClusterRegistry.js");
  */
 var AccessControl;
 ((AccessControl2) => {
+  let Feature;
+  ((Feature2) => {
+    Feature2["Extension"] = "Extension";
+    Feature2["ManagedDevice"] = "ManagedDevice";
+  })(Feature = AccessControl2.Feature || (AccessControl2.Feature = {}));
+  AccessControl2.TlvAccessControlExtension = (0, import_TlvObject.TlvObject)({
+    /**
+     * This field may be used by manufacturers to store arbitrary TLV-encoded data related to a fabric’s
+     *
+     * Access Control Entries.
+     *
+     * The contents shall consist of a top-level anonymous list; each list element shall include a profile-specific
+     * tag encoded in fully-qualified form.
+     *
+     * Administrators may iterate over this list of elements, and interpret selected elements at their discretion.
+     * The content of each element is not specified, but may be coordinated among manufacturers at their discretion.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.7.1
+     */
+    data: (0, import_TlvObject.TlvField)(1, import_TlvString.TlvByteString.bound({ maxLength: 128 })),
+    fabricIndex: (0, import_TlvObject.TlvField)(254, import_FabricIndex.TlvFabricIndex)
+  });
+  let ChangeType;
+  ((ChangeType2) => {
+    ChangeType2[ChangeType2["Changed"] = 0] = "Changed";
+    ChangeType2[ChangeType2["Added"] = 1] = "Added";
+    ChangeType2[ChangeType2["Removed"] = 2] = "Removed";
+  })(ChangeType = AccessControl2.ChangeType || (AccessControl2.ChangeType = {}));
+  AccessControl2.TlvAccessControlExtensionChangedEvent = (0, import_TlvObject.TlvObject)({
+    /**
+     * The Node ID of the Administrator that made the change, if the change occurred via a CASE session.
+     *
+     * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
+     * CASE or PASE session; the other shall be null.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.2.1
+     */
+    adminNodeId: (0, import_TlvObject.TlvField)(1, (0, import_TlvNullable.TlvNullable)(import_NodeId.TlvNodeId)),
+    /**
+     * The Passcode ID of the Administrator that made the change, if the change occurred via a PASE session.
+     * Non-zero values are reserved for future use (see PasscodeId generation in PBKDFParamRequest).
+     *
+     * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
+     * CASE or PASE session; the other shall be null.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.2.2
+     */
+    adminPasscodeId: (0, import_TlvObject.TlvField)(2, (0, import_TlvNullable.TlvNullable)(import_TlvNumber.TlvUInt16)),
+    /**
+     * The type of change as appropriate.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.2.3
+     */
+    changeType: (0, import_TlvObject.TlvField)(3, (0, import_TlvNumber.TlvEnum)()),
+    /**
+     * The latest value of the changed extension.
+     *
+     * This field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources
+     * are scarce.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.2.4
+     */
+    latestValue: (0, import_TlvObject.TlvField)(4, (0, import_TlvNullable.TlvNullable)(AccessControl2.TlvAccessControlExtension)),
+    fabricIndex: (0, import_TlvObject.TlvField)(254, import_FabricIndex.TlvFabricIndex)
+  });
+  let AccessRestrictionType;
+  ((AccessRestrictionType2) => {
+    AccessRestrictionType2[AccessRestrictionType2["AttributeAccessForbidden"] = 0] = "AttributeAccessForbidden";
+    AccessRestrictionType2[AccessRestrictionType2["AttributeWriteForbidden"] = 1] = "AttributeWriteForbidden";
+    AccessRestrictionType2[AccessRestrictionType2["CommandForbidden"] = 2] = "CommandForbidden";
+    AccessRestrictionType2[AccessRestrictionType2["EventForbidden"] = 3] = "EventForbidden";
+  })(AccessRestrictionType = AccessControl2.AccessRestrictionType || (AccessControl2.AccessRestrictionType = {}));
+  AccessControl2.TlvAccessRestriction = (0, import_TlvObject.TlvObject)({
+    /**
+     * This field shall indicate the type of restriction, for example, AttributeAccessForbidden.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.8.1
+     */
+    type: (0, import_TlvObject.TlvField)(0, (0, import_TlvNumber.TlvEnum)()),
+    /**
+     * This field shall indicate the element Manufacturer Extensible Identifier (MEI) associated with the element
+     * type subject to the access restriction, based upon the AccessRestrictionTypeEnum. When the Type is
+     * AttributeAccessForbidden or AttributeWriteForbidden, this value shall be considered of type attrib-id (i.e.
+     * an attribute identifier). When the Type is CommandForbidden, this value shall be considered of type
+     * command-id (i.e. an attribute identifier). When the Type is EventForbidden, this value shall be considered
+     * of type event-id (i.e. an event identifier).
+     *
+     * A null value shall indicate the wildcard value for the given value of Type (i.e. all elements associated
+     * with the Type under the associated endpoint and cluster for the containing AccessRestrictionEntryStruct).
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.8.2
+     */
+    id: (0, import_TlvObject.TlvField)(1, (0, import_TlvNullable.TlvNullable)(import_TlvNumber.TlvUInt32))
+  });
+  AccessControl2.TlvCommissioningAccessRestrictionEntry = (0, import_TlvObject.TlvObject)({
+    /**
+     * This field shall indicate the endpoint having associated access restrictions scoped to the associated fabric
+     * of the list containing the entry.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.10.1
+     */
+    endpoint: (0, import_TlvObject.TlvField)(0, import_EndpointNumber.TlvEndpointNumber),
+    /**
+     * This field shall indicate the cluster having associated access restrictions under the entry’s Endpoint,
+     * scoped to the associated fabric of the list containing the entry.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.10.2
+     */
+    cluster: (0, import_TlvObject.TlvField)(1, import_ClusterId.TlvClusterId),
+    /**
+     * This field shall indicate the set of restrictions applying to the Cluster under the given Endpoint, scoped
+     * to the associated fabric of the list containing the entry.
+     *
+     * This list shall NOT be empty.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.10.3
+     */
+    restrictions: (0, import_TlvObject.TlvField)(2, (0, import_TlvArray.TlvArray)(AccessControl2.TlvAccessRestriction, { minLength: 1 }))
+  });
+  AccessControl2.TlvAccessRestrictionEntry = (0, import_TlvObject.TlvObject)({
+    /**
+     * This field shall indicate the endpoint having associated access restrictions scoped to the associated fabric
+     * of the list containing the entry.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.9.1
+     */
+    endpoint: (0, import_TlvObject.TlvField)(0, import_EndpointNumber.TlvEndpointNumber),
+    /**
+     * This field shall indicate the cluster having associated access restrictions under the entry’s Endpoint,
+     * scoped to the associated fabric of the list containing the entry.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.9.2
+     */
+    cluster: (0, import_TlvObject.TlvField)(1, import_ClusterId.TlvClusterId),
+    /**
+     * This field shall indicate the set of restrictions applying to the Cluster under the given Endpoint, scoped
+     * to the associated fabric of the list containing the entry.
+     *
+     * This list shall NOT be empty.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.9.3
+     */
+    restrictions: (0, import_TlvObject.TlvField)(2, (0, import_TlvArray.TlvArray)(AccessControl2.TlvAccessRestriction, { minLength: 1 })),
+    fabricIndex: (0, import_TlvObject.TlvField)(254, import_FabricIndex.TlvFabricIndex)
+  });
+  AccessControl2.TlvReviewFabricRestrictionsRequest = (0, import_TlvObject.TlvObject)({
+    /**
+     * When the ARL field is provided, it indicates the specific restrictions that are requested for review. An
+     * empty list represents a generic request for review of all restrictions.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.8.1.1
+     */
+    arl: (0, import_TlvObject.TlvField)(0, (0, import_TlvArray.TlvArray)(AccessControl2.TlvCommissioningAccessRestrictionEntry))
+  });
+  AccessControl2.TlvReviewFabricRestrictionsResponse = (0, import_TlvObject.TlvObject)({
+    /**
+     * This field shall specify a Token that can be used to correlate a ReviewFabricRestrictionsResponse with a
+     * FabricRestrictionReviewUpdate event.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.8.2.1
+     */
+    token: (0, import_TlvObject.TlvField)(0, import_TlvNumber.TlvUInt64)
+  });
+  AccessControl2.TlvFabricRestrictionReviewUpdateEvent = (0, import_TlvObject.TlvObject)({
+    /**
+     * This field shall indicate the Token that can be used to correlate a ReviewFabricRestrictionsResponse with a
+     * FabricRestrictionReviewUpdate event.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.3.1
+     */
+    token: (0, import_TlvObject.TlvField)(0, import_TlvNumber.TlvUInt64),
+    /**
+     * This field shall provide human readable text that may be displayed to the user to help them locate the user
+     * interface for managing access restrictions for each fabric.
+     *
+     * A device SHOULD implement the Localization Configuration Cluster when it has no other means to determine the
+     * locale to use for this text.
+     *
+     * Examples include "Please try again and immediately access device display for further instructions." or
+     * "Please check email associated with your Acme account."
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.3.2
+     */
+    instruction: (0, import_TlvObject.TlvOptionalField)(1, import_TlvString.TlvString.bound({ maxLength: 512 })),
+    /**
+     * This field shall indicate the URL for the service associated with the device maker which the user can visit
+     * to manage fabric limitations. The syntax of this field shall follow the syntax as specified in RFC 1738 and
+     * shall use the https scheme for internet-hosted URLs.
+     *
+     *   • The URL may embed the token, fabric index, fabric vendor, or other information transparently in order to
+     *     pass context about the originating ReviewFabricRestrictions command to the service associated with the
+     *     URL. The service associated with the device vendor may perform vendor ID verification on the fabric from
+     *     which the ReviewFabricRestrictions command originated.
+     *
+     *   • If the device grants the request, the ARL attribute in the Access Control Cluster shall be updated to
+     *     reflect the new access rights and a successful response shall be returned to the device making the
+     *     request using the MTaer field of the callbackUrl. If the request is denied, the ARL attribute shall
+     *     remain unchanged and a failure response shall be returned to the device making the request using the
+     *     MTaer field of the callbackUrl.
+     *
+     *   • The device using this mechanism shall provide a service at the URL that can accept requests for
+     *     additional access and return responses indicating whether the requests were granted or denied.
+     *
+     *   • This URL will typically lead to a server which (e.g. by looking at the User-Agent) redirects the user to
+     *     allow viewing, downloading, installing or using a manufacturer-provided means for guiding the user
+     *     through the process to review and approve or deny the request. The device manufacturer may choose to use
+     *     a constructed URL which is valid in a HTTP GET request (i.e. dedicated for the product) such as, for
+     *     example, https://domain.example/arl-app?vid=FFF1& pid=1234. If a client follows or launches the
+     *     ARLRequestFlowUrl, it shall expand it as described in Section 9.10.9.3.4, “ARLRequestFlowUrl format”.
+     *
+     *   • A manufacturer contemplating using this flow should realize that
+     *
+     *     ◦ This flow typically requires internet access to access the URL, and access extension may fail when
+     *       internet connectivity is not available.
+     *
+     *     ◦ If the flow prefers to redirect the user to an app which is available on popular platforms, it SHOULD
+     *       also provide a fallback option such as a web browser interface to ensure users can complete access
+     *       extension.
+     *
+     * ### ARLRequestFlowUrl format
+     *
+     * The ARLRequestFlowUrl shall contain a query component (see RFC 3986 section 3.4) composed of one or more
+     * key-value pairs:
+     *
+     *   • The query shall use the & delimiter between key/value pairs.
+     *
+     *   • The key-value pairs shall in the format name=<value> where name is the key name, and <value>
+     *
+     * is the contents of the value encoded with proper URL-encoded escaping.
+     *
+     *   • If key MTcu is present, it shall have a value of "_" (i.e. MTcu=_). This is the "callback URL
+     *
+     * backUrl) placeholder".
+     *
+     *   • Any key whose name begins with MT not mentioned in the previous bullets shall be reserved for future use
+     *     by this specification. Manufacturers shall NOT include query keys starting with MT in the
+     *     ARLRequestFlowUrl unless they are referenced by a version of this specification.
+     *
+     * Any other element in the ARLRequestFlowUrl query field not covered by the above rules, as well as the
+     * fragment field (if present), shall remain including the order of query key/value pairs present.
+     *
+     * Expansion of ARLRequestFlowUrl by client
+     *
+     * Once the URL is obtained, it shall be expanded to form a final URL (ExpandedARLRequestFlowUrl) by proceeding
+     * with the following substitution algorithm on the original ARLRequestFlowUrl:
+     *
+     *   1. If key MTcu is present, compute the CallbackUrl desired (see Section 9.10.9.3.5, “CallbackUrl format
+     *      for ARL Request Flow response”), and substitute the placeholder value "_" (i.e. in MTcu=_) in the
+     *      ARLRequestFlowUrl with the desired contents, encoded with proper URL-encoded escaping (see RFC 3986
+     *      section 2).
+     *
+     * The final URL after expansion (ExpandedARLRequestFlowUrl) shall be the one to follow, rather than the
+     * original value obtained from the FabricRestrictionReviewUpdate event.
+     *
+     * ### CallbackUrl format for ARL Request Flow response
+     *
+     * If a CallbackUrl field (i.e. MTcu=) query field placeholder is present in the ARLRequestFlowUrl, the client
+     * may replace the placeholder value "_" in the ExpandedARLRequestFlowUrl with a URL that the manufacturer flow
+     * can use to make a smooth return to the client when the ARL flow has terminated.
+     *
+     * This URL field may contain a query component (see RFC 3986 section 3.4). If a query is present, it shall be
+     * composed of one or more key-value pairs:
+     *
+     *   • The query shall use the & delimiter between key/value pairs.
+     *
+     *   • The key-value pairs shall follow the format name=<value> where name is the key name, and
+     *
+     * <value> is the contents of the value encoded with proper URL-encoded escaping.
+     *
+     *   • If key MTaer is present, it shall have a value of "_" (i.e. MTaer=_). This is the placeholder for a
+     *     "access extension response" provided by the manufacturer flow to the client. The manufacturer flow shall
+     *     replace this placeholder with the final status of the access extension request, which shall be formatted
+     *     following Expansion of CallbackUrl by the manufacturer custom flow and encoded with proper URL-encoded
+     *     escaping.
+     *
+     *   • Any key whose name begins with MT not mentioned in the previous bullets shall be reserved for future use
+     *     by this specification.
+     *
+     * Any other element in the CallbackUrl query field not covered by the above rules, as well as the frag
+     *
+     * ment field (if present), shall remain as provided by the client through embedding within the
+     *
+     * ExpandedARLRequestFlowUrl, including the order of query key/value pairs present.
+     *
+     * ### Expansion of CallbackUrl by the manufacturer custom flow
+     *
+     * Once the CallbackUrl is obtained by the manufacturer flow, it may be expanded to form a final
+     * ExpandedARLRequestCallbackUrl URL to be used by proceeding with the following substitution algorithm on the
+     * provided CallbackUrl:
+     *
+     *   • If key MTaer is present, the manufacturer custom flow having received the initial query containing the
+     *     CallbackUrl shall substitute the placeholder value "_" (i.e. in MTaer=_) in the CallbackUrl with the
+     *     final status of the access extension request flow which shall be one of the following. Any value
+     *     returned in the MTaer field not listed above shall be considered an error and shall be treated as
+     *     GeneralFailure.
+     *
+     *     ◦ Success - The flow completed successfully and the ARL attribute was updated. The client may now read
+     *       the ARL attribute to determine the new access restrictions.
+     *
+     *     ◦ NoChange - The ARL attribute was already listing minimum restrictions for the requesting fabric.
+     *
+     *     ◦ GeneralFailure - The flow failed for an unspecified reason.
+     *
+     *     ◦ FlowAuthFailure - The user failed to authenticate to the flow.
+     *
+     *     ◦ NotFound - Access extension failed because the target fabric was not found.
+     *
+     * A manufacturer custom flow having received an ExpandedARLRequestFlowUrl SHOULD attempt to open the
+     * ExpandedARLRequestCallbackUrl, on completion of the request, if an ExpandedARLRequestCallbackUrl was
+     * computed from the CallbackUrl and opening such a URL is supported.
+     *
+     * Examples of ARLRequestFlowUrl URLs
+     *
+     * Below are some examples of valid ExpandedARLRequestFlowUrl for several valid values of ARLRequestFlowUrl, as
+     * well as some examples of invalid values of ARLRequestFlowUrl:
+     *
+     *   • Invalid URL with no query string: http scheme is not allowed:
+     *
+     *     ◦ http://company.domain.example/matter/arl/vFFF1p1234
+     *
+     *   • Valid URL :
+     *
+     *     ◦ https://company.domain.example/matter/arl/vFFF1p1234
+     *
+     *   • Valid URL, CallbackUrl requested:
+     *
+     *     ◦ Before expansion:
+     *
+     * https://company.domain.example/matter/arl?vid=FFF1&pid=1234&MTcu=_
+     *
+     *   ◦ After expansion:
+     *
+     * https://company.domain.example/matter/arl?vid=FFF1&pid=1234&MTcu=https%3A%2F%2Fc
+     * lient.domain.example%2Fcb%3Ftoken%3DmAsJ6_vqbr-vjDiG_w%253D%253D%26MTaer%3D_
+     *
+     *   ◦ The ExpandedARLRequestFlowUrl URL contains:
+     *
+     *     ▪ A CallbackUrl with a client-provided arbitrary token= key/value pair and the MTaer= key/value pair
+     *       place-holder to indicate support for a return access extension completion status:
+     *       https://client.domain.example/cb?token=mAsJ6_vqbr-vjDiG_w%3D%3D&MTaer=_
+     *
+     *     ▪ After expansion of the CallbackUrl (MTcu key) into an ExpandedCallbackUrl, with an example return
+     *       access extension completion status of Success, the ExpandedARLRequestCallbackUrl would be:
+     *
+     * https://client.domain.example/cb?token=mAsJ6_vqbr- vjDiG_w%3D%3D&MTaer=Success
+     *
+     * Note that the MTcu key/value pair was initially provided URL-encoded within the ExpandedARLRequestFlowUrl
+     * URL and the MTaer=_ key/value pair placeholder now contains a substituted returned completion status.
+     *
+     *   • Invalid URL, due to MTza=79 key/value pair in reserved MT-prefixed keys reserved for future use:
+     *
+     *     ◦ https://company.domain.example/matter/arl?vid=FFF1&pid=1234&MTop=_&MTza=79
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.3.3
+     */
+    arlRequestFlowUrl: (0, import_TlvObject.TlvOptionalField)(2, import_TlvString.TlvString.bound({ maxLength: 256 })),
+    fabricIndex: (0, import_TlvObject.TlvField)(254, import_FabricIndex.TlvFabricIndex)
+  });
   let AccessControlEntryPrivilege;
   ((AccessControlEntryPrivilege2) => {
     AccessControlEntryPrivilege2[AccessControlEntryPrivilege2["View"] = 1] = "View";
@@ -77,7 +436,7 @@ var AccessControl;
      * levels as well. The following diagram illustrates how the higher privilege levels subsume the lower
      * privilege levels:
      *
-     * Figure 43. Access Control Privilege Levels
+     * Figure 46. Access Control Privilege Levels
      *
      * Individual clusters shall define whether attributes are readable, writable, or both readable and writable.
      * Clusters also shall define which privilege is minimally required to be able to perform a particular read or
@@ -88,13 +447,13 @@ var AccessControl;
      * Cluster itself. The Administer privilege shall NOT be used on Access Control Entries which use the Group
      * auth mode.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.4.5.1
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.6.1
      */
     privilege: (0, import_TlvObject.TlvField)(1, (0, import_TlvNumber.TlvEnum)()),
     /**
      * The AuthMode field shall specify the authentication mode required by this Access Control Entry.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.4.5.2
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.6.2
      */
     authMode: (0, import_TlvObject.TlvField)(2, (0, import_TlvNumber.TlvEnum)()),
     /**
@@ -113,7 +472,7 @@ var AccessControl;
      * successfully authenticates via AuthMode. The subjects list shall NOT be empty if the entry’s AuthMode is
      * PASE.
      *
-     * The PASE AuthMode is reserved for future use (see Section 6.6.2.8, “Bootstrapping of the Access Control
+     * The PASE AuthMode is reserved for future use (see Section 6.6.2.9, “Bootstrapping of the Access Control
      * Cluster”). An attempt to write an entry with AuthMode set to PASE shall fail with a status code of
      * CONSTRAINT_ERROR.
      *
@@ -130,7 +489,7 @@ var AccessControl;
      * For Group authentication, the Group ID identifies the required group, as defined in the Group Key Management
      * Cluster.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.4.5.3
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.6.3
      */
     subjects: (0, import_TlvObject.TlvField)(3, (0, import_TlvNullable.TlvNullable)((0, import_TlvArray.TlvArray)(import_SubjectId.TlvSubjectId))),
     /**
@@ -152,33 +511,11 @@ var AccessControl;
      * An empty targets list indicates a wildcard: that is, this entry shall grant access to all cluster instances
      * on all endpoints on this Node.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.4.5.4
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.6.4
      */
     targets: (0, import_TlvObject.TlvField)(4, (0, import_TlvNullable.TlvNullable)((0, import_TlvArray.TlvArray)(AccessControl2.TlvAccessControlTarget))),
     fabricIndex: (0, import_TlvObject.TlvField)(254, import_FabricIndex.TlvFabricIndex)
   });
-  AccessControl2.TlvAccessControlExtension = (0, import_TlvObject.TlvObject)({
-    /**
-     * This field may be used by manufacturers to store arbitrary TLV-encoded data related to a fabric’s Access
-     * Control Entries.
-     *
-     * The contents shall consist of a top-level anonymous list; each list element shall include a profile-specific
-     * tag encoded in fully-qualified form.
-     *
-     * Administrators may iterate over this list of elements, and interpret selected elements at their discretion.
-     * The content of each element is not specified, but may be coordinated among manufacturers at their discretion.
-     *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.4.6.1
-     */
-    data: (0, import_TlvObject.TlvField)(1, import_TlvString.TlvByteString.bound({ maxLength: 128 })),
-    fabricIndex: (0, import_TlvObject.TlvField)(254, import_FabricIndex.TlvFabricIndex)
-  });
-  let ChangeType;
-  ((ChangeType2) => {
-    ChangeType2[ChangeType2["Changed"] = 0] = "Changed";
-    ChangeType2[ChangeType2["Added"] = 1] = "Added";
-    ChangeType2[ChangeType2["Removed"] = 2] = "Removed";
-  })(ChangeType = AccessControl2.ChangeType || (AccessControl2.ChangeType = {}));
   AccessControl2.TlvAccessControlEntryChangedEvent = (0, import_TlvObject.TlvObject)({
     /**
      * The Node ID of the Administrator that made the change, if the change occurred via a CASE session.
@@ -186,7 +523,7 @@ var AccessControl;
      * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
      * CASE or PASE session; the other shall be null.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.1.1
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.1.1
      */
     adminNodeId: (0, import_TlvObject.TlvField)(1, (0, import_TlvNullable.TlvNullable)(import_NodeId.TlvNodeId)),
     /**
@@ -196,13 +533,13 @@ var AccessControl;
      * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
      * CASE or PASE session; the other shall be null.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.1.2
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.1.2
      */
     adminPasscodeId: (0, import_TlvObject.TlvField)(2, (0, import_TlvNullable.TlvNullable)(import_TlvNumber.TlvUInt16)),
     /**
      * The type of change as appropriate.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.1.3
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.1.3
      */
     changeType: (0, import_TlvObject.TlvField)(3, (0, import_TlvNumber.TlvEnum)()),
     /**
@@ -211,52 +548,227 @@ var AccessControl;
      * This field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources
      * are scarce.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.1.4
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.1.4
      */
     latestValue: (0, import_TlvObject.TlvField)(4, (0, import_TlvNullable.TlvNullable)(AccessControl2.TlvAccessControlEntry)),
     fabricIndex: (0, import_TlvObject.TlvField)(254, import_FabricIndex.TlvFabricIndex)
   });
-  AccessControl2.TlvAccessControlExtensionChangedEvent = (0, import_TlvObject.TlvObject)({
-    /**
-     * The Node ID of the Administrator that made the change, if the change occurred via a CASE session.
-     *
-     * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
-     * CASE or PASE session; the other shall be null.
-     *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.2.1
-     */
-    adminNodeId: (0, import_TlvObject.TlvField)(1, (0, import_TlvNullable.TlvNullable)(import_NodeId.TlvNodeId)),
-    /**
-     * The Passcode ID of the Administrator that made the change, if the change occurred via a PASE session.
-     * Non-zero values are reserved for future use (see PasscodeId generation in PBKDFParamRequest).
-     *
-     * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
-     * CASE or PASE session; the other shall be null.
-     *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.2.2
-     */
-    adminPasscodeId: (0, import_TlvObject.TlvField)(2, (0, import_TlvNullable.TlvNullable)(import_TlvNumber.TlvUInt16)),
-    /**
-     * The type of change as appropriate.
-     *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.2.3
-     */
-    changeType: (0, import_TlvObject.TlvField)(3, (0, import_TlvNumber.TlvEnum)()),
-    /**
-     * The latest value of the changed extension.
-     *
-     * This field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources
-     * are scarce.
-     *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.2.4
-     */
-    latestValue: (0, import_TlvObject.TlvField)(4, (0, import_TlvNullable.TlvNullable)(AccessControl2.TlvAccessControlExtension)),
-    fabricIndex: (0, import_TlvObject.TlvField)(254, import_FabricIndex.TlvFabricIndex)
+  AccessControl2.ExtensionComponent = import_MutableCluster.MutableCluster.Component({
+    attributes: {
+      /**
+       * If present, the Access Control Extensions may be used by Administrators to store arbitrary data related
+       * to fabric’s Access Control Entries.
+       *
+       * The Access Control Extension list shall support a single extension entry per supported fabric.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.6.4
+       */
+      extension: (0, import_Cluster.WritableFabricScopedAttribute)(
+        1,
+        (0, import_TlvArray.TlvArray)(AccessControl2.TlvAccessControlExtension),
+        { default: [], readAcl: import_model.AccessLevel.Administer, writeAcl: import_model.AccessLevel.Administer }
+      )
+    },
+    events: {
+      /**
+       * The cluster shall generate AccessControlExtensionChanged events whenever its extension attribute data is
+       * changed by an Administrator.
+       *
+       *   • Each added extension shall generate an event with ChangeType Added.
+       *
+       *   • Each changed extension shall generate an event with ChangeType Changed.
+       *
+       *   • Each removed extension shall generate an event with ChangeType Removed.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.9.2
+       */
+      accessControlExtensionChanged: (0, import_Cluster.Event)(
+        1,
+        import_Cluster.EventPriority.Info,
+        AccessControl2.TlvAccessControlExtensionChangedEvent,
+        { readAcl: import_model.AccessLevel.Administer }
+      )
+    }
   });
-  AccessControl2.ClusterInstance = (0, import_MutableCluster.MutableCluster)({
+  AccessControl2.ManagedDeviceComponent = import_MutableCluster.MutableCluster.Component({
+    attributes: {
+      /**
+       * This attribute shall provide the set of CommissioningAccessRestrictionEntryStruct applied during
+       * commissioning on a managed device.
+       *
+       * When present, the CommissioningARL attribute shall indicate the access restrictions applying during
+       * commissioning.
+       *
+       * Attempts to access data model elements described by an entry in the CommissioningARL attribute during
+       * commissioning shall result in an error of ACCESS_RESTRICTED. See Access Control Model for more
+       * information about the features related to controlling access to a Node’s Endpoint Clusters ("Targets"
+       * hereafter) from other Nodes.
+       *
+       * See Section 9.10.4.2.1, “Managed Device Feature Usage Restrictions” for limitations on the use of access
+       * restrictions.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.6.8
+       */
+      commissioningArL: (0, import_Cluster.FixedAttribute)(5, (0, import_TlvArray.TlvArray)(AccessControl2.TlvCommissioningAccessRestrictionEntry), { default: [] }),
+      /**
+       * This attribute shall provide the set of AccessRestrictionEntryStruct applied to the associated fabric on
+       * a managed device.
+       *
+       * When present, the ARL attribute shall indicate the access restrictions applying to the accessing fabric.
+       * In contrast, the CommissioningARL attribute indicates the accessing restrictions that apply when there
+       * is no accessing fabric, such as during commissioning.
+       *
+       * The access restrictions are externally added/removed based on the particular relationship the device
+       * hosting this server has with external entities such as its owner, external service provider, or end-user.
+       *
+       * Attempts to access data model elements described by an entry in the ARL attribute for the accessing
+       * fabric shall result in an error of ACCESS_RESTRICTED. See Access Control Model for more information
+       * about the features related to controlling access to a Node’s Endpoint Clusters ("Targets" hereafter)
+       * from other Nodes.
+       *
+       * See Section 9.10.4.2.1, “Managed Device Feature Usage Restrictions” for limitations on the use of access
+       * restrictions.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.6.9
+       */
+      arl: (0, import_Cluster.FabricScopedAttribute)(6, (0, import_TlvArray.TlvArray)(AccessControl2.TlvAccessRestrictionEntry), { default: [] })
+    },
+    commands: {
+      /**
+       * This command signals to the service associated with the device vendor that the fabric administrator
+       * would like a review of the current restrictions on the accessing fabric. This command includes an
+       * optional list of ARL entries that the fabric administrator would like removed.
+       *
+       * In response, a ReviewFabricRestrictionsResponse is sent which contains a token that can be used to
+       * correlate a review request with a FabricRestrictionReviewUpdate event.
+       *
+       * Within 1 hour of the ReviewFabricRestrictionsResponse, the FabricRestrictionReviewUpdate event shall be
+       * generated, in order to indicate completion of the review and any additional steps required by the user
+       * for the review.
+       *
+       * A review may include obtaining consent from the user, which can take time. For example, the user may
+       * need to respond to an email or a push notification.
+       *
+       * The ARL attribute may change at any time due to actions taken by the user, or the service associated
+       * with the device vendor.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.8.1
+       */
+      reviewFabricRestrictions: (0, import_Cluster.Command)(
+        0,
+        AccessControl2.TlvReviewFabricRestrictionsRequest,
+        1,
+        AccessControl2.TlvReviewFabricRestrictionsResponse,
+        { invokeAcl: import_model.AccessLevel.Administer }
+      )
+    },
+    events: {
+      /**
+       * The cluster shall generate a FabricRestrictionReviewUpdate event to indicate completion of a fabric
+       * restriction review. Due to the requirement to generate this event within a bound time frame of
+       * successful receipt of the ReviewFabricRestrictions command, this event may include additional steps that
+       * the client may present to the user in order to help the user locate the user interface for the Managed
+       * Device feature.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.9.3
+       */
+      fabricRestrictionReviewUpdate: (0, import_Cluster.Event)(
+        2,
+        import_Cluster.EventPriority.Info,
+        AccessControl2.TlvFabricRestrictionReviewUpdateEvent,
+        { readAcl: import_model.AccessLevel.Administer }
+      )
+    }
+  });
+  AccessControl2.Base = import_MutableCluster.MutableCluster.Component({
     id: 31,
     name: "AccessControl",
-    revision: 1,
+    revision: 2,
+    features: {
+      /**
+       * Extension
+       *
+       * This feature indicates the device supports ACL Extension attribute.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.4.1
+       */
+      extension: (0, import_BitmapSchema.BitFlag)(0),
+      /**
+       * ManagedDevice
+       *
+       * This feature is for a device that is managed by a service associated with the device vendor and which
+       * imposes default access restrictions upon each new fabric added to it. This could arise, for example, if
+       * the device is managed by a service provider under contract to an end-user, in such a way that the
+       * manager of the device does not unconditionally grant universal access to all of a device’s
+       * functionality, even for fabric administrators. For example, many Home Routers are managed by an Internet
+       * Service Provider (a service), and these services often have a policy that requires them to obtain user
+       * consent before certain administrative functions can be delegated to a third party (e.g., a fabric
+       * Administrator). These restrictions are expressed using an Access Restriction List (ARL).
+       *
+       * The purpose of this feature on the Access Control cluster is to indicate to a fabric Administrator that
+       * access by it to specific attributes, commands and/or events for specific clusters is currently
+       * prohibited. Attempts to access these restricted data model elements shall result in an error of
+       * ACCESS_RESTRICTED.
+       *
+       * A device that implements this feature shall have a mechanism to honor the ReviewFabricRestrictions
+       * command, such as user interfaces or service interactions associated with a service provider or the
+       * device manufacturer, which allows the owner (or subscriber) to manage access restrictions for each
+       * fabric. The user interface design, which includes the way restrictions are organized and presented to
+       * the user, is not specified, but SHOULD be usable by non-expert end-users from common mobile devices,
+       * personal computers, or an on-device user interface.
+       *
+       * Controllers and clients SHOULD incorporate generic handling of the ACCESS_RESTRICTED error code, when it
+       * appears in allowed contexts, in order to gracefully handle situations where this feature is encountered.
+       * Device vendors that adopt this feature SHOULD be judicious in its use given the risk of unexpected
+       * behavior in controllers and clients.
+       *
+       * For certification testing, a device that implements this feature shall provide a way for all
+       * restrictions to be removed.
+       *
+       * The ARL attribute provides the set of restrictions currently applied to this fabric.
+       *
+       * The ReviewFabricRestrictions command provides a way for the fabric Administrator to request that the
+       * server triggers a review of the current fabric restrictions, by involving external entities such as
+       * end-users, or other services associated with the manager of the device hosting the server. This review
+       * process may involve communication between external services and the user, and may take an unpredictable
+       * amount of time to complete since an end-user may need to visit some resources, such as a mobile
+       * application or web site. A FabricRestrictionReviewUpdate event will be generated by the device within a
+       * predictable time period of the ReviewFabricRestrictionsResponse (see ReviewFabricRestrictions for
+       * specification of this time period), and this event can be correlated with the
+       * ReviewFabricRestrictionsResponse using a token provided in both. The device may provide instructions or
+       * a Redirect URL in the FabricRestrictionReviewUpdate event in order to help the user access the features
+       * required for managing per-fabric restrictions.
+       *
+       * See Section 6.6.2, “Model” for a description of how access control is impacted by the ARL attribute.
+       *
+       * ### Managed Device Feature Usage Restrictions
+       *
+       * Use of this feature shall be limited to the mandatory clusters of endpoints having a device type that
+       * explicitly permits its use in the Device Library Specification. As a reminder, the device types
+       * associated with an endpoint are listed in the Descriptor cluster of the endpoint.
+       *
+       * In addition, use of this feature shall NOT restrict the following clusters on any endpoint:
+       *
+       *   1. the Descriptor Cluster (0x001D)
+       *
+       *   2. the Binding Cluster (0x001E)
+       *
+       *   3. the Network Commissioning Cluster (0x0031)
+       *
+       *   4. the Identify Cluster (0x0003)
+       *
+       *   5. the Groups Cluster (0x0004)
+       *
+       * In addition, use of this feature shall NOT restrict the global attributes of any cluster.
+       *
+       * Because ARLs cannot be used to restrict root node access or access to any clusters required for
+       * commissioning, administrators may determine the current restrictions of the ARL at any point, including
+       * during commissioning after joining the fabric.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.4.2
+       */
+      managedDevice: (0, import_BitmapSchema.BitFlag)(1)
+    },
     attributes: {
       /**
        * An attempt to add an Access Control Entry when no more entries are available shall result in a
@@ -270,26 +782,13 @@ var AccessControl;
        * Control Privilege Granting algorithm to determine if a subject has privilege to interact with targets on
        * the Node.
        *
-       * @see {@link MatterSpecification.v13.Core} § 9.10.5.3
+       * @see {@link MatterSpecification.v13.Core} § 9.10.6.3
        */
       acl: (0, import_Cluster.WritableFabricScopedAttribute)(
         0,
         (0, import_TlvArray.TlvArray)(AccessControl2.TlvAccessControlEntry),
         { default: [], readAcl: import_model.AccessLevel.Administer, writeAcl: import_model.AccessLevel.Administer }
       ),
-      /**
-       * If present, the Access Control Extensions may be used by Administrators to store arbitrary data related
-       * to fabric’s Access Control Entries.
-       *
-       * The Access Control Extension list shall support a single extension entry per supported fabric.
-       *
-       * @see {@link MatterSpecification.v13.Core} § 9.10.5.4
-       */
-      extension: (0, import_Cluster.OptionalWritableFabricScopedAttribute)(
-        1,
-        (0, import_TlvArray.TlvArray)(AccessControl2.TlvAccessControlExtension),
-        { default: [], readAcl: import_model.AccessLevel.Administer, writeAcl: import_model.AccessLevel.Administer }
-      ),
       /**
        * This attribute shall provide the minimum number of Subjects per entry that are supported by this server.
        *
@@ -298,7 +797,7 @@ var AccessControl;
        * given implementation, it is recommended to only use the minimum value required and avoid reporting a
        * higher value than the required minimum.
        *
-       * @see {@link MatterSpecification.v13.Core} § 9.10.5.5
+       * @see {@link MatterSpecification.v13.Core} § 9.10.6.5
        */
       subjectsPerAccessControlEntry: (0, import_Cluster.FixedAttribute)(2, import_TlvNumber.TlvUInt16.bound({ min: 4 }), { default: 4 }),
       /**
@@ -309,7 +808,7 @@ var AccessControl;
        * given implementation, it is recommended to only use the minimum value required and avoid reporting a
        * higher value than the required minimum.
        *
-       * @see {@link MatterSpecification.v13.Core} § 9.10.5.6
+       * @see {@link MatterSpecification.v13.Core} § 9.10.6.6
        */
       targetsPerAccessControlEntry: (0, import_Cluster.FixedAttribute)(3, import_TlvNumber.TlvUInt16.bound({ min: 3 }), { default: 3 }),
       /**
@@ -321,14 +820,14 @@ var AccessControl;
        * given implementation, it is recommended to only use the minimum value required and avoid reporting a
        * higher value than the required minimum.
        *
-       * @see {@link MatterSpecification.v13.Core} § 9.10.5.7
+       * @see {@link MatterSpecification.v13.Core} § 9.10.6.7
        */
       accessControlEntriesPerFabric: (0, import_Cluster.FixedAttribute)(4, import_TlvNumber.TlvUInt16.bound({ min: 4 }), { default: 4 })
     },
     events: {
       /**
-       * The cluster shall send AccessControlEntryChanged events whenever its ACL attribute data is changed by an
-       * Administrator.
+       * The cluster shall generate AccessControlEntryChanged events whenever its ACL attribute data is changed
+       * by an Administrator.
        *
        *   • Each added entry shall generate an event with ChangeType Added.
        *
@@ -336,36 +835,61 @@ var AccessControl;
        *
        *   • Each removed entry shall generate an event with ChangeType Removed.
        *
-       * @see {@link MatterSpecification.v13.Core} § 9.10.7.1
+       * @see {@link MatterSpecification.v13.Core} § 9.10.9.1
        */
       accessControlEntryChanged: (0, import_Cluster.Event)(
         0,
         import_Cluster.EventPriority.Info,
         AccessControl2.TlvAccessControlEntryChangedEvent,
         { readAcl: import_model.AccessLevel.Administer }
+      )
+    },
+    /**
+     * This metadata controls which AccessControlCluster elements matter.js activates for specific feature
+     * combinations.
+     */
+    extensions: import_MutableCluster.MutableCluster.Extensions(
+      { flags: { extension: true }, component: AccessControl2.ExtensionComponent },
+      { flags: { managedDevice: true }, component: AccessControl2.ManagedDeviceComponent }
+    )
+  });
+  AccessControl2.ClusterInstance = (0, import_MutableCluster.MutableCluster)(AccessControl2.Base);
+  AccessControl2.Cluster = AccessControl2.ClusterInstance;
+  const EXTS = { extension: true };
+  const MNGD = { managedDevice: true };
+  AccessControl2.CompleteInstance = (0, import_MutableCluster.MutableCluster)({
+    id: AccessControl2.Cluster.id,
+    name: AccessControl2.Cluster.name,
+    revision: AccessControl2.Cluster.revision,
+    features: AccessControl2.Cluster.features,
+    attributes: {
+      ...AccessControl2.Cluster.attributes,
+      extension: import_MutableCluster.MutableCluster.AsConditional(AccessControl2.ExtensionComponent.attributes.extension, { mandatoryIf: [EXTS] }),
+      commissioningArL: import_MutableCluster.MutableCluster.AsConditional(
+        AccessControl2.ManagedDeviceComponent.attributes.commissioningArL,
+        { mandatoryIf: [MNGD] }
       ),
-      /**
-       * The cluster shall send AccessControlExtensionChanged events whenever its extension attribute data is
-       * changed by an Administrator.
-       *
-       *   • Each added extension shall generate an event with ChangeType Added.
-       *
-       *   • Each changed extension shall generate an event with ChangeType Changed.
-       *
-       *   • Each removed extension shall generate an event with ChangeType Removed.
-       *
-       * @see {@link MatterSpecification.v13.Core} § 9.10.7.2
-       */
-      accessControlExtensionChanged: (0, import_Cluster.Event)(
-        1,
-        import_Cluster.EventPriority.Info,
-        AccessControl2.TlvAccessControlExtensionChangedEvent,
-        { readAcl: import_model.AccessLevel.Administer }
+      arl: import_MutableCluster.MutableCluster.AsConditional(AccessControl2.ManagedDeviceComponent.attributes.arl, { mandatoryIf: [MNGD] })
+    },
+    commands: {
+      reviewFabricRestrictions: import_MutableCluster.MutableCluster.AsConditional(
+        AccessControl2.ManagedDeviceComponent.commands.reviewFabricRestrictions,
+        { mandatoryIf: [MNGD] }
+      )
+    },
+    events: {
+      ...AccessControl2.Cluster.events,
+      accessControlExtensionChanged: import_MutableCluster.MutableCluster.AsConditional(
+        AccessControl2.ExtensionComponent.events.accessControlExtensionChanged,
+        { mandatoryIf: [EXTS] }
+      ),
+      fabricRestrictionReviewUpdate: import_MutableCluster.MutableCluster.AsConditional(
+        AccessControl2.ManagedDeviceComponent.events.fabricRestrictionReviewUpdate,
+        { mandatoryIf: [MNGD] }
       )
     }
   });
-  AccessControl2.Cluster = AccessControl2.ClusterInstance;
-  AccessControl2.Complete = AccessControl2.Cluster;
+  AccessControl2.Complete = AccessControl2.CompleteInstance;
 })(AccessControl || (AccessControl = {}));
 const AccessControlCluster = AccessControl.Cluster;
 import_ClusterRegistry.ClusterRegistry.register(AccessControl.Complete);