# Conflicts:
#	packages/node/src/behaviors/access-control/AccessControlServer.ts
#	packages/protocol/src/groups/FabricGroups.ts
#	packages/types/src/clusters/access-control.ts
#	packages/types/src/clusters/group-key-management.ts

# Conflicts:
#	packages/node/src/behaviors/general-diagnostics/GeneralDiagnosticsServer.ts
#	packages/node/src/behaviors/group-key-management/GroupKeyManagementServer.ts
#	packages/node/src/behaviors/groups/GroupsServer.ts
#	packages/protocol/src/protocol/MessageExchange.ts
#	packages/testing/src/chip/matter-js-pics.properties
#	packages/types/src/clusters/access-control.d.ts
#	packages/types/src/clusters/basic-information.ts
#	packages/types/src/clusters/general-diagnostics.ts
#	packages/types/src/clusters/group-key-management.ts
#	packages/types/src/clusters/groups.ts

The Groupcast cluster PICS code in the CHIP test harness changed from
GCAST to GC. Rename the test file, update describe/chip() labels, and
drop the stale GCAST.S=1 PICS entry (GC.S=1 is authoritative).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Post-merge codegen output:
- New: types/clusters/groupcast.{d.ts,js} cluster definition
- Schema additions driven by groupcast overrides: AccessControl (AUX feature +
  AuxiliaryACL), BasicInformation + GeneralDiagnostics (DeviceLoadStatus),
  GroupKeyManagement (GCAST feature + GroupcastAdoption), Groups
- Behavior codegen drift: GroupcastBehavior, GroupcastClient, groupcast index

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

When the AccessControl Auxiliary feature is active, Group auth mode ACL
entries with wildcard targets (empty) must not grant access to endpoint 0
(root endpoint). Groupcast commands shall not interact with clusters on
the root endpoint.

Adds auxiliaryFeatureEnabled flag to FabricAccessControl, set by
AccessControlServer during initialization and fabric updates.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Groupcast cluster's membership mappings are mirrored into GKM's
  GroupKeyMap attribute so the attribute reflects the Groupcast data
  dependency (fixes TC_SC_5_1).

- SessionManager exposes an onGroupMessage observable + emitGroupMessage()
  helper. Observable is a no-op when no listener is attached.

- New typed errors GroupSessionNoKeyError and GroupSessionDecodeError
  replace generic MatterFlowError in GroupSession.decode; SessionManager
  emits NoAvailableKey / FailedAuth events using causedBy() checks.

- ExchangeManager emits MessageReplay on DuplicateMessageError in group
  sessions. InteractionServer emits Success with accessAllowed per
  dispatched group command.

- GroupcastServer dynamically attaches/detaches a listener on the
  SessionManager observable based on fabricUnderTest state, emits the
  cluster event only for the fabric under test.

- Magic number 0xFFFF factored into UNMAPPED_KEYSET_ID constant.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CHIP's PeerAddress::Groupcast() wraps the spec-defined IANA address ff05::fa
through MakeIPv6PrefixMulticast(scope=5, prefixLen=64, prefix=0xff05000000000000,
groupId=0xfa), producing the unicast-prefix-based form ff35:40:ff05::fa. The spec
text just says "FF05::FA" without specifying this wrapping, so this looks like
CHIP using its existing helper rather than emitting the literal address.

Bind to the CHIP-emitted form so TC_SC_5_2 and other Groupcast tests pass.
Marked all touched sites with TODO(IANA-WRAP) for easy reversion when upstream
is clarified.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

… correctly

Several related fixes to make Groupcast Listener+Sender work end-to-end with
GroupKeyManagement, FabricGroups runtime dispatch, and GroupcastTesting events:

GroupcastServer:
- #syncFabricGroups: set per-group multicast policy BEFORE assigning
  groupKeyIdMap, since the latter triggers ServerGroupNetworking to bind via
  multicastAddressFor — which reads the policy. Old order fell back to
  PerGroupId-derived addresses for IanaAddr-policy groups.
- #syncFabricGroups: also mirror Membership endpoints into gkm.state.groupTable
  (spec attribute) and fabric.groups.endpoints (runtime lookup used by
  InteractionServer for wildcard group dispatch). Without this, group msgs hit
  "No endpoints mapped to group N, skipping wildcard invoke".
- Lower maxMembershipCount/maxMcastAddrCount defaults from 254 to 44 so the
  per-fabric quota floor(44/2)=22 aligns exactly with GKM's per-fabric cap.
  Even alignment avoids spillover semantics; mirror writes never exceed the
  GKM validator.
- Wrap onGroupMessage listener with this.callback so it has a fresh action
  context when invoked after the dispatching transaction has committed
  (otherwise this.state/this.events references are expired).

GroupKeyManagementServer:
- Bump maxGroupsPerFabric default from 21 to 22 (matches Groupcast quota=22).

InteractionServer:
- For group invokes that produce no dispatched commands (wildcard expansion
  filtered out by ACL or no endpoint mappings), emit one fallback
  GroupcastTesting event per requested invoke path with result=FailedAuth and
  accessAllowed=false. TC_ACE_1_6 step 13 expects this signal.

ClientNodeTest: update expected maxGroupsPerFabric attribute to 0x16.

Tests added: endpoint mirror propagation/cleanup, two-fabric quota fill-to-
M_max scenario, GKM mirror behavior, multicast policy ordering guarantee.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ddress"

This reverts commit 51ac431.

Expose GroupSession.multicastAddress and include it in info-level
OUTBOUND Write/Invoke log lines so group sends show the actual
IPv6 destination instead of only the group session id. Helper
peerAddressDiagnostic() is scoped for future expansion to other
session types.

Also fix a typo in ScenesManagementServer fabric-removal comment.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Resolves auto-generated cluster/model conflicts by accepting main's spec
1.5.1 baseline and re-running codegen so groupcast overrides reapply on
top. BasicInformation override keeps ClusterRevision=6 plus the extended
CapabilityMinimaStruct fields.

Test resolutions:
- AttributeReadResponseTest: 31 (AccessControl) keeps groupcast's +1, 40
  (BasicInformation) takes main's reduced count.
- ClientNodeTest: configurationVersion expectation set to undefined since
  the attribute is provisional (P, Rev >= v5) and not exposed.
- SpecificationVersionSchemaTest: updated for 1.6.0.

Specification.REVISION bumped 1.5.1 -> 1.6.0 (SPECIFICATION_VERSION =
0x01060000) to reflect groupcast's 1.6 target.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>