@matter/types 0.13.0-alpha.0-20250304-d4a7592a4 → 0.13.0-alpha.0-20250307-ebf84a05a

package/dist/esm/clusters/access-control.js

@@ -6,26 +6,386 @@
 import { MutableCluster } from "../cluster/mutation/MutableCluster.js";
 import {
   WritableFabricScopedAttribute,
-  OptionalWritableFabricScopedAttribute,
-  FixedAttribute,
   Event,
-  EventPriority
+  EventPriority,
+  FixedAttribute,
+  FabricScopedAttribute,
+  Command
 } from "../cluster/Cluster.js";
 import { TlvArray } from "../tlv/TlvArray.js";
-import { TlvField, TlvObject } from "../tlv/TlvObject.js";
-import { TlvEnum, TlvUInt16 } from "../tlv/TlvNumber.js";
-import { TlvSubjectId } from "../datatype/SubjectId.js";
-import { TlvNullable } from "../tlv/TlvNullable.js";
-import { TlvClusterId } from "../datatype/ClusterId.js";
-import { TlvEndpointNumber } from "../datatype/EndpointNumber.js";
-import { TlvDeviceTypeId } from "../datatype/DeviceTypeId.js";
+import { TlvField, TlvObject, TlvOptionalField } from "../tlv/TlvObject.js";
+import { TlvByteString, TlvString } from "../tlv/TlvString.js";
 import { TlvFabricIndex } from "../datatype/FabricIndex.js";
 import { AccessLevel } from "#model";
-import { TlvByteString } from "../tlv/TlvString.js";
 import { TlvNodeId } from "../datatype/NodeId.js";
+import { TlvNullable } from "../tlv/TlvNullable.js";
+import { TlvUInt16, TlvEnum, TlvUInt32, TlvUInt64 } from "../tlv/TlvNumber.js";
+import { TlvEndpointNumber } from "../datatype/EndpointNumber.js";
+import { TlvClusterId } from "../datatype/ClusterId.js";
+import { BitFlag } from "../schema/BitmapSchema.js";
+import { TlvSubjectId } from "../datatype/SubjectId.js";
+import { TlvDeviceTypeId } from "../datatype/DeviceTypeId.js";
 import { ClusterRegistry } from "../cluster/ClusterRegistry.js";
 var AccessControl;
 ((AccessControl2) => {
+  let Feature;
+  ((Feature2) => {
+    Feature2["Extension"] = "Extension";
+    Feature2["ManagedDevice"] = "ManagedDevice";
+  })(Feature = AccessControl2.Feature || (AccessControl2.Feature = {}));
+  AccessControl2.TlvAccessControlExtension = TlvObject({
+    /**
+     * This field may be used by manufacturers to store arbitrary TLV-encoded data related to a fabric’s
+     *
+     * Access Control Entries.
+     *
+     * The contents shall consist of a top-level anonymous list; each list element shall include a profile-specific
+     * tag encoded in fully-qualified form.
+     *
+     * Administrators may iterate over this list of elements, and interpret selected elements at their discretion.
+     * The content of each element is not specified, but may be coordinated among manufacturers at their discretion.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.7.1
+     */
+    data: TlvField(1, TlvByteString.bound({ maxLength: 128 })),
+    fabricIndex: TlvField(254, TlvFabricIndex)
+  });
+  let ChangeType;
+  ((ChangeType2) => {
+    ChangeType2[ChangeType2["Changed"] = 0] = "Changed";
+    ChangeType2[ChangeType2["Added"] = 1] = "Added";
+    ChangeType2[ChangeType2["Removed"] = 2] = "Removed";
+  })(ChangeType = AccessControl2.ChangeType || (AccessControl2.ChangeType = {}));
+  AccessControl2.TlvAccessControlExtensionChangedEvent = TlvObject({
+    /**
+     * The Node ID of the Administrator that made the change, if the change occurred via a CASE session.
+     *
+     * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
+     * CASE or PASE session; the other shall be null.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.2.1
+     */
+    adminNodeId: TlvField(1, TlvNullable(TlvNodeId)),
+    /**
+     * The Passcode ID of the Administrator that made the change, if the change occurred via a PASE session.
+     * Non-zero values are reserved for future use (see PasscodeId generation in PBKDFParamRequest).
+     *
+     * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
+     * CASE or PASE session; the other shall be null.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.2.2
+     */
+    adminPasscodeId: TlvField(2, TlvNullable(TlvUInt16)),
+    /**
+     * The type of change as appropriate.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.2.3
+     */
+    changeType: TlvField(3, TlvEnum()),
+    /**
+     * The latest value of the changed extension.
+     *
+     * This field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources
+     * are scarce.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.2.4
+     */
+    latestValue: TlvField(4, TlvNullable(AccessControl2.TlvAccessControlExtension)),
+    fabricIndex: TlvField(254, TlvFabricIndex)
+  });
+  let AccessRestrictionType;
+  ((AccessRestrictionType2) => {
+    AccessRestrictionType2[AccessRestrictionType2["AttributeAccessForbidden"] = 0] = "AttributeAccessForbidden";
+    AccessRestrictionType2[AccessRestrictionType2["AttributeWriteForbidden"] = 1] = "AttributeWriteForbidden";
+    AccessRestrictionType2[AccessRestrictionType2["CommandForbidden"] = 2] = "CommandForbidden";
+    AccessRestrictionType2[AccessRestrictionType2["EventForbidden"] = 3] = "EventForbidden";
+  })(AccessRestrictionType = AccessControl2.AccessRestrictionType || (AccessControl2.AccessRestrictionType = {}));
+  AccessControl2.TlvAccessRestriction = TlvObject({
+    /**
+     * This field shall indicate the type of restriction, for example, AttributeAccessForbidden.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.8.1
+     */
+    type: TlvField(0, TlvEnum()),
+    /**
+     * This field shall indicate the element Manufacturer Extensible Identifier (MEI) associated with the element
+     * type subject to the access restriction, based upon the AccessRestrictionTypeEnum. When the Type is
+     * AttributeAccessForbidden or AttributeWriteForbidden, this value shall be considered of type attrib-id (i.e.
+     * an attribute identifier). When the Type is CommandForbidden, this value shall be considered of type
+     * command-id (i.e. an attribute identifier). When the Type is EventForbidden, this value shall be considered
+     * of type event-id (i.e. an event identifier).
+     *
+     * A null value shall indicate the wildcard value for the given value of Type (i.e. all elements associated
+     * with the Type under the associated endpoint and cluster for the containing AccessRestrictionEntryStruct).
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.8.2
+     */
+    id: TlvField(1, TlvNullable(TlvUInt32))
+  });
+  AccessControl2.TlvCommissioningAccessRestrictionEntry = TlvObject({
+    /**
+     * This field shall indicate the endpoint having associated access restrictions scoped to the associated fabric
+     * of the list containing the entry.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.10.1
+     */
+    endpoint: TlvField(0, TlvEndpointNumber),
+    /**
+     * This field shall indicate the cluster having associated access restrictions under the entry’s Endpoint,
+     * scoped to the associated fabric of the list containing the entry.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.10.2
+     */
+    cluster: TlvField(1, TlvClusterId),
+    /**
+     * This field shall indicate the set of restrictions applying to the Cluster under the given Endpoint, scoped
+     * to the associated fabric of the list containing the entry.
+     *
+     * This list shall NOT be empty.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.10.3
+     */
+    restrictions: TlvField(2, TlvArray(AccessControl2.TlvAccessRestriction, { minLength: 1 }))
+  });
+  AccessControl2.TlvAccessRestrictionEntry = TlvObject({
+    /**
+     * This field shall indicate the endpoint having associated access restrictions scoped to the associated fabric
+     * of the list containing the entry.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.9.1
+     */
+    endpoint: TlvField(0, TlvEndpointNumber),
+    /**
+     * This field shall indicate the cluster having associated access restrictions under the entry’s Endpoint,
+     * scoped to the associated fabric of the list containing the entry.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.9.2
+     */
+    cluster: TlvField(1, TlvClusterId),
+    /**
+     * This field shall indicate the set of restrictions applying to the Cluster under the given Endpoint, scoped
+     * to the associated fabric of the list containing the entry.
+     *
+     * This list shall NOT be empty.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.9.3
+     */
+    restrictions: TlvField(2, TlvArray(AccessControl2.TlvAccessRestriction, { minLength: 1 })),
+    fabricIndex: TlvField(254, TlvFabricIndex)
+  });
+  AccessControl2.TlvReviewFabricRestrictionsRequest = TlvObject({
+    /**
+     * When the ARL field is provided, it indicates the specific restrictions that are requested for review. An
+     * empty list represents a generic request for review of all restrictions.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.8.1.1
+     */
+    arl: TlvField(0, TlvArray(AccessControl2.TlvCommissioningAccessRestrictionEntry))
+  });
+  AccessControl2.TlvReviewFabricRestrictionsResponse = TlvObject({
+    /**
+     * This field shall specify a Token that can be used to correlate a ReviewFabricRestrictionsResponse with a
+     * FabricRestrictionReviewUpdate event.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.8.2.1
+     */
+    token: TlvField(0, TlvUInt64)
+  });
+  AccessControl2.TlvFabricRestrictionReviewUpdateEvent = TlvObject({
+    /**
+     * This field shall indicate the Token that can be used to correlate a ReviewFabricRestrictionsResponse with a
+     * FabricRestrictionReviewUpdate event.
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.3.1
+     */
+    token: TlvField(0, TlvUInt64),
+    /**
+     * This field shall provide human readable text that may be displayed to the user to help them locate the user
+     * interface for managing access restrictions for each fabric.
+     *
+     * A device SHOULD implement the Localization Configuration Cluster when it has no other means to determine the
+     * locale to use for this text.
+     *
+     * Examples include "Please try again and immediately access device display for further instructions." or
+     * "Please check email associated with your Acme account."
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.3.2
+     */
+    instruction: TlvOptionalField(1, TlvString.bound({ maxLength: 512 })),
+    /**
+     * This field shall indicate the URL for the service associated with the device maker which the user can visit
+     * to manage fabric limitations. The syntax of this field shall follow the syntax as specified in RFC 1738 and
+     * shall use the https scheme for internet-hosted URLs.
+     *
+     *   • The URL may embed the token, fabric index, fabric vendor, or other information transparently in order to
+     *     pass context about the originating ReviewFabricRestrictions command to the service associated with the
+     *     URL. The service associated with the device vendor may perform vendor ID verification on the fabric from
+     *     which the ReviewFabricRestrictions command originated.
+     *
+     *   • If the device grants the request, the ARL attribute in the Access Control Cluster shall be updated to
+     *     reflect the new access rights and a successful response shall be returned to the device making the
+     *     request using the MTaer field of the callbackUrl. If the request is denied, the ARL attribute shall
+     *     remain unchanged and a failure response shall be returned to the device making the request using the
+     *     MTaer field of the callbackUrl.
+     *
+     *   • The device using this mechanism shall provide a service at the URL that can accept requests for
+     *     additional access and return responses indicating whether the requests were granted or denied.
+     *
+     *   • This URL will typically lead to a server which (e.g. by looking at the User-Agent) redirects the user to
+     *     allow viewing, downloading, installing or using a manufacturer-provided means for guiding the user
+     *     through the process to review and approve or deny the request. The device manufacturer may choose to use
+     *     a constructed URL which is valid in a HTTP GET request (i.e. dedicated for the product) such as, for
+     *     example, https://domain.example/arl-app?vid=FFF1& pid=1234. If a client follows or launches the
+     *     ARLRequestFlowUrl, it shall expand it as described in Section 9.10.9.3.4, “ARLRequestFlowUrl format”.
+     *
+     *   • A manufacturer contemplating using this flow should realize that
+     *
+     *     ◦ This flow typically requires internet access to access the URL, and access extension may fail when
+     *       internet connectivity is not available.
+     *
+     *     ◦ If the flow prefers to redirect the user to an app which is available on popular platforms, it SHOULD
+     *       also provide a fallback option such as a web browser interface to ensure users can complete access
+     *       extension.
+     *
+     * ### ARLRequestFlowUrl format
+     *
+     * The ARLRequestFlowUrl shall contain a query component (see RFC 3986 section 3.4) composed of one or more
+     * key-value pairs:
+     *
+     *   • The query shall use the & delimiter between key/value pairs.
+     *
+     *   • The key-value pairs shall in the format name=<value> where name is the key name, and <value>
+     *
+     * is the contents of the value encoded with proper URL-encoded escaping.
+     *
+     *   • If key MTcu is present, it shall have a value of "_" (i.e. MTcu=_). This is the "callback URL
+     *
+     * backUrl) placeholder".
+     *
+     *   • Any key whose name begins with MT not mentioned in the previous bullets shall be reserved for future use
+     *     by this specification. Manufacturers shall NOT include query keys starting with MT in the
+     *     ARLRequestFlowUrl unless they are referenced by a version of this specification.
+     *
+     * Any other element in the ARLRequestFlowUrl query field not covered by the above rules, as well as the
+     * fragment field (if present), shall remain including the order of query key/value pairs present.
+     *
+     * Expansion of ARLRequestFlowUrl by client
+     *
+     * Once the URL is obtained, it shall be expanded to form a final URL (ExpandedARLRequestFlowUrl) by proceeding
+     * with the following substitution algorithm on the original ARLRequestFlowUrl:
+     *
+     *   1. If key MTcu is present, compute the CallbackUrl desired (see Section 9.10.9.3.5, “CallbackUrl format
+     *      for ARL Request Flow response”), and substitute the placeholder value "_" (i.e. in MTcu=_) in the
+     *      ARLRequestFlowUrl with the desired contents, encoded with proper URL-encoded escaping (see RFC 3986
+     *      section 2).
+     *
+     * The final URL after expansion (ExpandedARLRequestFlowUrl) shall be the one to follow, rather than the
+     * original value obtained from the FabricRestrictionReviewUpdate event.
+     *
+     * ### CallbackUrl format for ARL Request Flow response
+     *
+     * If a CallbackUrl field (i.e. MTcu=) query field placeholder is present in the ARLRequestFlowUrl, the client
+     * may replace the placeholder value "_" in the ExpandedARLRequestFlowUrl with a URL that the manufacturer flow
+     * can use to make a smooth return to the client when the ARL flow has terminated.
+     *
+     * This URL field may contain a query component (see RFC 3986 section 3.4). If a query is present, it shall be
+     * composed of one or more key-value pairs:
+     *
+     *   • The query shall use the & delimiter between key/value pairs.
+     *
+     *   • The key-value pairs shall follow the format name=<value> where name is the key name, and
+     *
+     * <value> is the contents of the value encoded with proper URL-encoded escaping.
+     *
+     *   • If key MTaer is present, it shall have a value of "_" (i.e. MTaer=_). This is the placeholder for a
+     *     "access extension response" provided by the manufacturer flow to the client. The manufacturer flow shall
+     *     replace this placeholder with the final status of the access extension request, which shall be formatted
+     *     following Expansion of CallbackUrl by the manufacturer custom flow and encoded with proper URL-encoded
+     *     escaping.
+     *
+     *   • Any key whose name begins with MT not mentioned in the previous bullets shall be reserved for future use
+     *     by this specification.
+     *
+     * Any other element in the CallbackUrl query field not covered by the above rules, as well as the frag
+     *
+     * ment field (if present), shall remain as provided by the client through embedding within the
+     *
+     * ExpandedARLRequestFlowUrl, including the order of query key/value pairs present.
+     *
+     * ### Expansion of CallbackUrl by the manufacturer custom flow
+     *
+     * Once the CallbackUrl is obtained by the manufacturer flow, it may be expanded to form a final
+     * ExpandedARLRequestCallbackUrl URL to be used by proceeding with the following substitution algorithm on the
+     * provided CallbackUrl:
+     *
+     *   • If key MTaer is present, the manufacturer custom flow having received the initial query containing the
+     *     CallbackUrl shall substitute the placeholder value "_" (i.e. in MTaer=_) in the CallbackUrl with the
+     *     final status of the access extension request flow which shall be one of the following. Any value
+     *     returned in the MTaer field not listed above shall be considered an error and shall be treated as
+     *     GeneralFailure.
+     *
+     *     ◦ Success - The flow completed successfully and the ARL attribute was updated. The client may now read
+     *       the ARL attribute to determine the new access restrictions.
+     *
+     *     ◦ NoChange - The ARL attribute was already listing minimum restrictions for the requesting fabric.
+     *
+     *     ◦ GeneralFailure - The flow failed for an unspecified reason.
+     *
+     *     ◦ FlowAuthFailure - The user failed to authenticate to the flow.
+     *
+     *     ◦ NotFound - Access extension failed because the target fabric was not found.
+     *
+     * A manufacturer custom flow having received an ExpandedARLRequestFlowUrl SHOULD attempt to open the
+     * ExpandedARLRequestCallbackUrl, on completion of the request, if an ExpandedARLRequestCallbackUrl was
+     * computed from the CallbackUrl and opening such a URL is supported.
+     *
+     * Examples of ARLRequestFlowUrl URLs
+     *
+     * Below are some examples of valid ExpandedARLRequestFlowUrl for several valid values of ARLRequestFlowUrl, as
+     * well as some examples of invalid values of ARLRequestFlowUrl:
+     *
+     *   • Invalid URL with no query string: http scheme is not allowed:
+     *
+     *     ◦ http://company.domain.example/matter/arl/vFFF1p1234
+     *
+     *   • Valid URL :
+     *
+     *     ◦ https://company.domain.example/matter/arl/vFFF1p1234
+     *
+     *   • Valid URL, CallbackUrl requested:
+     *
+     *     ◦ Before expansion:
+     *
+     * https://company.domain.example/matter/arl?vid=FFF1&pid=1234&MTcu=_
+     *
+     *   ◦ After expansion:
+     *
+     * https://company.domain.example/matter/arl?vid=FFF1&pid=1234&MTcu=https%3A%2F%2Fc
+     * lient.domain.example%2Fcb%3Ftoken%3DmAsJ6_vqbr-vjDiG_w%253D%253D%26MTaer%3D_
+     *
+     *   ◦ The ExpandedARLRequestFlowUrl URL contains:
+     *
+     *     ▪ A CallbackUrl with a client-provided arbitrary token= key/value pair and the MTaer= key/value pair
+     *       place-holder to indicate support for a return access extension completion status:
+     *       https://client.domain.example/cb?token=mAsJ6_vqbr-vjDiG_w%3D%3D&MTaer=_
+     *
+     *     ▪ After expansion of the CallbackUrl (MTcu key) into an ExpandedCallbackUrl, with an example return
+     *       access extension completion status of Success, the ExpandedARLRequestCallbackUrl would be:
+     *
+     * https://client.domain.example/cb?token=mAsJ6_vqbr- vjDiG_w%3D%3D&MTaer=Success
+     *
+     * Note that the MTcu key/value pair was initially provided URL-encoded within the ExpandedARLRequestFlowUrl
+     * URL and the MTaer=_ key/value pair placeholder now contains a substituted returned completion status.
+     *
+     *   • Invalid URL, due to MTza=79 key/value pair in reserved MT-prefixed keys reserved for future use:
+     *
+     *     ◦ https://company.domain.example/matter/arl?vid=FFF1&pid=1234&MTop=_&MTza=79
+     *
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.3.3
+     */
+    arlRequestFlowUrl: TlvOptionalField(2, TlvString.bound({ maxLength: 256 })),
+    fabricIndex: TlvField(254, TlvFabricIndex)
+  });
   let AccessControlEntryPrivilege;
   ((AccessControlEntryPrivilege2) => {
     AccessControlEntryPrivilege2[AccessControlEntryPrivilege2["View"] = 1] = "View";
@@ -59,7 +419,7 @@ var AccessControl;
      * levels as well. The following diagram illustrates how the higher privilege levels subsume the lower
      * privilege levels:
      *
-     * Figure 43. Access Control Privilege Levels
+     * Figure 46. Access Control Privilege Levels
      *
      * Individual clusters shall define whether attributes are readable, writable, or both readable and writable.
      * Clusters also shall define which privilege is minimally required to be able to perform a particular read or
@@ -70,13 +430,13 @@ var AccessControl;
      * Cluster itself. The Administer privilege shall NOT be used on Access Control Entries which use the Group
      * auth mode.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.4.5.1
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.6.1
      */
     privilege: TlvField(1, TlvEnum()),
     /**
      * The AuthMode field shall specify the authentication mode required by this Access Control Entry.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.4.5.2
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.6.2
      */
     authMode: TlvField(2, TlvEnum()),
     /**
@@ -95,7 +455,7 @@ var AccessControl;
      * successfully authenticates via AuthMode. The subjects list shall NOT be empty if the entry’s AuthMode is
      * PASE.
      *
-     * The PASE AuthMode is reserved for future use (see Section 6.6.2.8, “Bootstrapping of the Access Control
+     * The PASE AuthMode is reserved for future use (see Section 6.6.2.9, “Bootstrapping of the Access Control
      * Cluster”). An attempt to write an entry with AuthMode set to PASE shall fail with a status code of
      * CONSTRAINT_ERROR.
      *
@@ -112,7 +472,7 @@ var AccessControl;
      * For Group authentication, the Group ID identifies the required group, as defined in the Group Key Management
      * Cluster.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.4.5.3
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.6.3
      */
     subjects: TlvField(3, TlvNullable(TlvArray(TlvSubjectId))),
     /**
@@ -134,33 +494,11 @@ var AccessControl;
      * An empty targets list indicates a wildcard: that is, this entry shall grant access to all cluster instances
      * on all endpoints on this Node.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.4.5.4
+     * @see {@link MatterSpecification.v13.Core} § 9.10.5.6.4
      */
     targets: TlvField(4, TlvNullable(TlvArray(AccessControl2.TlvAccessControlTarget))),
     fabricIndex: TlvField(254, TlvFabricIndex)
   });
-  AccessControl2.TlvAccessControlExtension = TlvObject({
-    /**
-     * This field may be used by manufacturers to store arbitrary TLV-encoded data related to a fabric’s Access
-     * Control Entries.
-     *
-     * The contents shall consist of a top-level anonymous list; each list element shall include a profile-specific
-     * tag encoded in fully-qualified form.
-     *
-     * Administrators may iterate over this list of elements, and interpret selected elements at their discretion.
-     * The content of each element is not specified, but may be coordinated among manufacturers at their discretion.
-     *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.4.6.1
-     */
-    data: TlvField(1, TlvByteString.bound({ maxLength: 128 })),
-    fabricIndex: TlvField(254, TlvFabricIndex)
-  });
-  let ChangeType;
-  ((ChangeType2) => {
-    ChangeType2[ChangeType2["Changed"] = 0] = "Changed";
-    ChangeType2[ChangeType2["Added"] = 1] = "Added";
-    ChangeType2[ChangeType2["Removed"] = 2] = "Removed";
-  })(ChangeType = AccessControl2.ChangeType || (AccessControl2.ChangeType = {}));
   AccessControl2.TlvAccessControlEntryChangedEvent = TlvObject({
     /**
      * The Node ID of the Administrator that made the change, if the change occurred via a CASE session.
@@ -168,7 +506,7 @@ var AccessControl;
      * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
      * CASE or PASE session; the other shall be null.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.1.1
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.1.1
      */
     adminNodeId: TlvField(1, TlvNullable(TlvNodeId)),
     /**
@@ -178,13 +516,13 @@ var AccessControl;
      * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
      * CASE or PASE session; the other shall be null.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.1.2
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.1.2
      */
     adminPasscodeId: TlvField(2, TlvNullable(TlvUInt16)),
     /**
      * The type of change as appropriate.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.1.3
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.1.3
      */
     changeType: TlvField(3, TlvEnum()),
     /**
@@ -193,52 +531,227 @@ var AccessControl;
      * This field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources
      * are scarce.
      *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.1.4
+     * @see {@link MatterSpecification.v13.Core} § 9.10.9.1.4
      */
     latestValue: TlvField(4, TlvNullable(AccessControl2.TlvAccessControlEntry)),
     fabricIndex: TlvField(254, TlvFabricIndex)
   });
-  AccessControl2.TlvAccessControlExtensionChangedEvent = TlvObject({
-    /**
-     * The Node ID of the Administrator that made the change, if the change occurred via a CASE session.
-     *
-     * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
-     * CASE or PASE session; the other shall be null.
-     *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.2.1
-     */
-    adminNodeId: TlvField(1, TlvNullable(TlvNodeId)),
-    /**
-     * The Passcode ID of the Administrator that made the change, if the change occurred via a PASE session.
-     * Non-zero values are reserved for future use (see PasscodeId generation in PBKDFParamRequest).
-     *
-     * Exactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a
-     * CASE or PASE session; the other shall be null.
-     *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.2.2
-     */
-    adminPasscodeId: TlvField(2, TlvNullable(TlvUInt16)),
-    /**
-     * The type of change as appropriate.
-     *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.2.3
-     */
-    changeType: TlvField(3, TlvEnum()),
-    /**
-     * The latest value of the changed extension.
-     *
-     * This field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources
-     * are scarce.
-     *
-     * @see {@link MatterSpecification.v13.Core} § 9.10.7.2.4
-     */
-    latestValue: TlvField(4, TlvNullable(AccessControl2.TlvAccessControlExtension)),
-    fabricIndex: TlvField(254, TlvFabricIndex)
+  AccessControl2.ExtensionComponent = MutableCluster.Component({
+    attributes: {
+      /**
+       * If present, the Access Control Extensions may be used by Administrators to store arbitrary data related
+       * to fabric’s Access Control Entries.
+       *
+       * The Access Control Extension list shall support a single extension entry per supported fabric.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.6.4
+       */
+      extension: WritableFabricScopedAttribute(
+        1,
+        TlvArray(AccessControl2.TlvAccessControlExtension),
+        { default: [], readAcl: AccessLevel.Administer, writeAcl: AccessLevel.Administer }
+      )
+    },
+    events: {
+      /**
+       * The cluster shall generate AccessControlExtensionChanged events whenever its extension attribute data is
+       * changed by an Administrator.
+       *
+       *   • Each added extension shall generate an event with ChangeType Added.
+       *
+       *   • Each changed extension shall generate an event with ChangeType Changed.
+       *
+       *   • Each removed extension shall generate an event with ChangeType Removed.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.9.2
+       */
+      accessControlExtensionChanged: Event(
+        1,
+        EventPriority.Info,
+        AccessControl2.TlvAccessControlExtensionChangedEvent,
+        { readAcl: AccessLevel.Administer }
+      )
+    }
+  });
+  AccessControl2.ManagedDeviceComponent = MutableCluster.Component({
+    attributes: {
+      /**
+       * This attribute shall provide the set of CommissioningAccessRestrictionEntryStruct applied during
+       * commissioning on a managed device.
+       *
+       * When present, the CommissioningARL attribute shall indicate the access restrictions applying during
+       * commissioning.
+       *
+       * Attempts to access data model elements described by an entry in the CommissioningARL attribute during
+       * commissioning shall result in an error of ACCESS_RESTRICTED. See Access Control Model for more
+       * information about the features related to controlling access to a Node’s Endpoint Clusters ("Targets"
+       * hereafter) from other Nodes.
+       *
+       * See Section 9.10.4.2.1, “Managed Device Feature Usage Restrictions” for limitations on the use of access
+       * restrictions.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.6.8
+       */
+      commissioningArL: FixedAttribute(5, TlvArray(AccessControl2.TlvCommissioningAccessRestrictionEntry), { default: [] }),
+      /**
+       * This attribute shall provide the set of AccessRestrictionEntryStruct applied to the associated fabric on
+       * a managed device.
+       *
+       * When present, the ARL attribute shall indicate the access restrictions applying to the accessing fabric.
+       * In contrast, the CommissioningARL attribute indicates the accessing restrictions that apply when there
+       * is no accessing fabric, such as during commissioning.
+       *
+       * The access restrictions are externally added/removed based on the particular relationship the device
+       * hosting this server has with external entities such as its owner, external service provider, or end-user.
+       *
+       * Attempts to access data model elements described by an entry in the ARL attribute for the accessing
+       * fabric shall result in an error of ACCESS_RESTRICTED. See Access Control Model for more information
+       * about the features related to controlling access to a Node’s Endpoint Clusters ("Targets" hereafter)
+       * from other Nodes.
+       *
+       * See Section 9.10.4.2.1, “Managed Device Feature Usage Restrictions” for limitations on the use of access
+       * restrictions.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.6.9
+       */
+      arl: FabricScopedAttribute(6, TlvArray(AccessControl2.TlvAccessRestrictionEntry), { default: [] })
+    },
+    commands: {
+      /**
+       * This command signals to the service associated with the device vendor that the fabric administrator
+       * would like a review of the current restrictions on the accessing fabric. This command includes an
+       * optional list of ARL entries that the fabric administrator would like removed.
+       *
+       * In response, a ReviewFabricRestrictionsResponse is sent which contains a token that can be used to
+       * correlate a review request with a FabricRestrictionReviewUpdate event.
+       *
+       * Within 1 hour of the ReviewFabricRestrictionsResponse, the FabricRestrictionReviewUpdate event shall be
+       * generated, in order to indicate completion of the review and any additional steps required by the user
+       * for the review.
+       *
+       * A review may include obtaining consent from the user, which can take time. For example, the user may
+       * need to respond to an email or a push notification.
+       *
+       * The ARL attribute may change at any time due to actions taken by the user, or the service associated
+       * with the device vendor.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.8.1
+       */
+      reviewFabricRestrictions: Command(
+        0,
+        AccessControl2.TlvReviewFabricRestrictionsRequest,
+        1,
+        AccessControl2.TlvReviewFabricRestrictionsResponse,
+        { invokeAcl: AccessLevel.Administer }
+      )
+    },
+    events: {
+      /**
+       * The cluster shall generate a FabricRestrictionReviewUpdate event to indicate completion of a fabric
+       * restriction review. Due to the requirement to generate this event within a bound time frame of
+       * successful receipt of the ReviewFabricRestrictions command, this event may include additional steps that
+       * the client may present to the user in order to help the user locate the user interface for the Managed
+       * Device feature.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.9.3
+       */
+      fabricRestrictionReviewUpdate: Event(
+        2,
+        EventPriority.Info,
+        AccessControl2.TlvFabricRestrictionReviewUpdateEvent,
+        { readAcl: AccessLevel.Administer }
+      )
+    }
   });
-  AccessControl2.ClusterInstance = MutableCluster({
+  AccessControl2.Base = MutableCluster.Component({
     id: 31,
     name: "AccessControl",
-    revision: 1,
+    revision: 2,
+    features: {
+      /**
+       * Extension
+       *
+       * This feature indicates the device supports ACL Extension attribute.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.4.1
+       */
+      extension: BitFlag(0),
+      /**
+       * ManagedDevice
+       *
+       * This feature is for a device that is managed by a service associated with the device vendor and which
+       * imposes default access restrictions upon each new fabric added to it. This could arise, for example, if
+       * the device is managed by a service provider under contract to an end-user, in such a way that the
+       * manager of the device does not unconditionally grant universal access to all of a device’s
+       * functionality, even for fabric administrators. For example, many Home Routers are managed by an Internet
+       * Service Provider (a service), and these services often have a policy that requires them to obtain user
+       * consent before certain administrative functions can be delegated to a third party (e.g., a fabric
+       * Administrator). These restrictions are expressed using an Access Restriction List (ARL).
+       *
+       * The purpose of this feature on the Access Control cluster is to indicate to a fabric Administrator that
+       * access by it to specific attributes, commands and/or events for specific clusters is currently
+       * prohibited. Attempts to access these restricted data model elements shall result in an error of
+       * ACCESS_RESTRICTED.
+       *
+       * A device that implements this feature shall have a mechanism to honor the ReviewFabricRestrictions
+       * command, such as user interfaces or service interactions associated with a service provider or the
+       * device manufacturer, which allows the owner (or subscriber) to manage access restrictions for each
+       * fabric. The user interface design, which includes the way restrictions are organized and presented to
+       * the user, is not specified, but SHOULD be usable by non-expert end-users from common mobile devices,
+       * personal computers, or an on-device user interface.
+       *
+       * Controllers and clients SHOULD incorporate generic handling of the ACCESS_RESTRICTED error code, when it
+       * appears in allowed contexts, in order to gracefully handle situations where this feature is encountered.
+       * Device vendors that adopt this feature SHOULD be judicious in its use given the risk of unexpected
+       * behavior in controllers and clients.
+       *
+       * For certification testing, a device that implements this feature shall provide a way for all
+       * restrictions to be removed.
+       *
+       * The ARL attribute provides the set of restrictions currently applied to this fabric.
+       *
+       * The ReviewFabricRestrictions command provides a way for the fabric Administrator to request that the
+       * server triggers a review of the current fabric restrictions, by involving external entities such as
+       * end-users, or other services associated with the manager of the device hosting the server. This review
+       * process may involve communication between external services and the user, and may take an unpredictable
+       * amount of time to complete since an end-user may need to visit some resources, such as a mobile
+       * application or web site. A FabricRestrictionReviewUpdate event will be generated by the device within a
+       * predictable time period of the ReviewFabricRestrictionsResponse (see ReviewFabricRestrictions for
+       * specification of this time period), and this event can be correlated with the
+       * ReviewFabricRestrictionsResponse using a token provided in both. The device may provide instructions or
+       * a Redirect URL in the FabricRestrictionReviewUpdate event in order to help the user access the features
+       * required for managing per-fabric restrictions.
+       *
+       * See Section 6.6.2, “Model” for a description of how access control is impacted by the ARL attribute.
+       *
+       * ### Managed Device Feature Usage Restrictions
+       *
+       * Use of this feature shall be limited to the mandatory clusters of endpoints having a device type that
+       * explicitly permits its use in the Device Library Specification. As a reminder, the device types
+       * associated with an endpoint are listed in the Descriptor cluster of the endpoint.
+       *
+       * In addition, use of this feature shall NOT restrict the following clusters on any endpoint:
+       *
+       *   1. the Descriptor Cluster (0x001D)
+       *
+       *   2. the Binding Cluster (0x001E)
+       *
+       *   3. the Network Commissioning Cluster (0x0031)
+       *
+       *   4. the Identify Cluster (0x0003)
+       *
+       *   5. the Groups Cluster (0x0004)
+       *
+       * In addition, use of this feature shall NOT restrict the global attributes of any cluster.
+       *
+       * Because ARLs cannot be used to restrict root node access or access to any clusters required for
+       * commissioning, administrators may determine the current restrictions of the ARL at any point, including
+       * during commissioning after joining the fabric.
+       *
+       * @see {@link MatterSpecification.v13.Core} § 9.10.4.2
+       */
+      managedDevice: BitFlag(1)
+    },
     attributes: {
       /**
        * An attempt to add an Access Control Entry when no more entries are available shall result in a
@@ -252,26 +765,13 @@ var AccessControl;
        * Control Privilege Granting algorithm to determine if a subject has privilege to interact with targets on
        * the Node.
        *
-       * @see {@link MatterSpecification.v13.Core} § 9.10.5.3
+       * @see {@link MatterSpecification.v13.Core} § 9.10.6.3
        */
       acl: WritableFabricScopedAttribute(
         0,
         TlvArray(AccessControl2.TlvAccessControlEntry),
         { default: [], readAcl: AccessLevel.Administer, writeAcl: AccessLevel.Administer }
       ),
-      /**
-       * If present, the Access Control Extensions may be used by Administrators to store arbitrary data related
-       * to fabric’s Access Control Entries.
-       *
-       * The Access Control Extension list shall support a single extension entry per supported fabric.
-       *
-       * @see {@link MatterSpecification.v13.Core} § 9.10.5.4
-       */
-      extension: OptionalWritableFabricScopedAttribute(
-        1,
-        TlvArray(AccessControl2.TlvAccessControlExtension),
-        { default: [], readAcl: AccessLevel.Administer, writeAcl: AccessLevel.Administer }
-      ),
       /**
        * This attribute shall provide the minimum number of Subjects per entry that are supported by this server.
        *
@@ -280,7 +780,7 @@ var AccessControl;
        * given implementation, it is recommended to only use the minimum value required and avoid reporting a
        * higher value than the required minimum.
        *
-       * @see {@link MatterSpecification.v13.Core} § 9.10.5.5
+       * @see {@link MatterSpecification.v13.Core} § 9.10.6.5
        */
       subjectsPerAccessControlEntry: FixedAttribute(2, TlvUInt16.bound({ min: 4 }), { default: 4 }),
       /**
@@ -291,7 +791,7 @@ var AccessControl;
        * given implementation, it is recommended to only use the minimum value required and avoid reporting a
        * higher value than the required minimum.
        *
-       * @see {@link MatterSpecification.v13.Core} § 9.10.5.6
+       * @see {@link MatterSpecification.v13.Core} § 9.10.6.6
        */
       targetsPerAccessControlEntry: FixedAttribute(3, TlvUInt16.bound({ min: 3 }), { default: 3 }),
       /**
@@ -303,14 +803,14 @@ var AccessControl;
        * given implementation, it is recommended to only use the minimum value required and avoid reporting a
        * higher value than the required minimum.
        *
-       * @see {@link MatterSpecification.v13.Core} § 9.10.5.7
+       * @see {@link MatterSpecification.v13.Core} § 9.10.6.7
        */
       accessControlEntriesPerFabric: FixedAttribute(4, TlvUInt16.bound({ min: 4 }), { default: 4 })
     },
     events: {
       /**
-       * The cluster shall send AccessControlEntryChanged events whenever its ACL attribute data is changed by an
-       * Administrator.
+       * The cluster shall generate AccessControlEntryChanged events whenever its ACL attribute data is changed
+       * by an Administrator.
        *
        *   • Each added entry shall generate an event with ChangeType Added.
        *
@@ -318,36 +818,61 @@ var AccessControl;
        *
        *   • Each removed entry shall generate an event with ChangeType Removed.
        *
-       * @see {@link MatterSpecification.v13.Core} § 9.10.7.1
+       * @see {@link MatterSpecification.v13.Core} § 9.10.9.1
        */
       accessControlEntryChanged: Event(
         0,
         EventPriority.Info,
         AccessControl2.TlvAccessControlEntryChangedEvent,
         { readAcl: AccessLevel.Administer }
+      )
+    },
+    /**
+     * This metadata controls which AccessControlCluster elements matter.js activates for specific feature
+     * combinations.
+     */
+    extensions: MutableCluster.Extensions(
+      { flags: { extension: true }, component: AccessControl2.ExtensionComponent },
+      { flags: { managedDevice: true }, component: AccessControl2.ManagedDeviceComponent }
+    )
+  });
+  AccessControl2.ClusterInstance = MutableCluster(AccessControl2.Base);
+  AccessControl2.Cluster = AccessControl2.ClusterInstance;
+  const EXTS = { extension: true };
+  const MNGD = { managedDevice: true };
+  AccessControl2.CompleteInstance = MutableCluster({
+    id: AccessControl2.Cluster.id,
+    name: AccessControl2.Cluster.name,
+    revision: AccessControl2.Cluster.revision,
+    features: AccessControl2.Cluster.features,
+    attributes: {
+      ...AccessControl2.Cluster.attributes,
+      extension: MutableCluster.AsConditional(AccessControl2.ExtensionComponent.attributes.extension, { mandatoryIf: [EXTS] }),
+      commissioningArL: MutableCluster.AsConditional(
+        AccessControl2.ManagedDeviceComponent.attributes.commissioningArL,
+        { mandatoryIf: [MNGD] }
       ),
-      /**
-       * The cluster shall send AccessControlExtensionChanged events whenever its extension attribute data is
-       * changed by an Administrator.
-       *
-       *   • Each added extension shall generate an event with ChangeType Added.
-       *
-       *   • Each changed extension shall generate an event with ChangeType Changed.
-       *
-       *   • Each removed extension shall generate an event with ChangeType Removed.
-       *
-       * @see {@link MatterSpecification.v13.Core} § 9.10.7.2
-       */
-      accessControlExtensionChanged: Event(
-        1,
-        EventPriority.Info,
-        AccessControl2.TlvAccessControlExtensionChangedEvent,
-        { readAcl: AccessLevel.Administer }
+      arl: MutableCluster.AsConditional(AccessControl2.ManagedDeviceComponent.attributes.arl, { mandatoryIf: [MNGD] })
+    },
+    commands: {
+      reviewFabricRestrictions: MutableCluster.AsConditional(
+        AccessControl2.ManagedDeviceComponent.commands.reviewFabricRestrictions,
+        { mandatoryIf: [MNGD] }
+      )
+    },
+    events: {
+      ...AccessControl2.Cluster.events,
+      accessControlExtensionChanged: MutableCluster.AsConditional(
+        AccessControl2.ExtensionComponent.events.accessControlExtensionChanged,
+        { mandatoryIf: [EXTS] }
+      ),
+      fabricRestrictionReviewUpdate: MutableCluster.AsConditional(
+        AccessControl2.ManagedDeviceComponent.events.fabricRestrictionReviewUpdate,
+        { mandatoryIf: [MNGD] }
       )
     }
   });
-  AccessControl2.Cluster = AccessControl2.ClusterInstance;
-  AccessControl2.Complete = AccessControl2.Cluster;
+  AccessControl2.Complete = AccessControl2.CompleteInstance;
 })(AccessControl || (AccessControl = {}));
 const AccessControlCluster = AccessControl.Cluster;
 ClusterRegistry.register(AccessControl.Complete);