@kusinta/iot-schema 0.1.0-beta.2 → 0.1.0-beta.21

package/src/kusinta/iot/webrtc/v1/app_token_pb.d.ts

@@ -0,0 +1,152 @@
+// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts,import_extension=js"
+// @generated from file kusinta/iot/webrtc/v1/app_token.proto (package kusinta.iot.webrtc.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { Message } from "@bufbuild/protobuf";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import type { Role } from "../../access/v1/roles_pb.js";
+
+/**
+ * Describes the file kusinta/iot/webrtc/v1/app_token.proto.
+ */
+export declare const file_kusinta_iot_webrtc_v1_app_token: GenFile;
+
+/**
+ * AppTokenClaims is the contract for the payload of the JWT carried in
+ * AppHandshake.jwt. It is the single source of truth shared between the
+ * api-server (which mints the token) and the gateway (which validates it
+ * locally against the api-server's public key).
+ *
+ * This message is NOT sent on the wire — the wire value stays the signed,
+ * compact JWS string in AppHandshake.jwt. The fields here document the claim
+ * names and types each side must agree on. JWT libraries emit registered
+ * claims (iss/aud/sub) as flat strings and timestamps as NumericDate
+ * (seconds since the Unix epoch), so map to/from your native JWT library
+ * rather than serializing this message directly into the token.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.AppTokenClaims
+ */
+export declare type AppTokenClaims = Message<"kusinta.iot.webrtc.v1.AppTokenClaims"> & {
+  /**
+   * Registered claims (RFC 7519).
+   * Issuer: the api-server's issuer identifier, agreed out of band. A fixed
+   * string both sides compare exactly — not derived from anything here.
+   *
+   * @generated from field: string iss = 1;
+   */
+  iss: string;
+
+  /**
+   * audience: the target GatewayId value
+   *
+   * @generated from field: string aud = 2;
+   */
+  aud: string;
+
+  /**
+   * subject: the UserId value
+   *
+   * @generated from field: string sub = 3;
+   */
+  sub: string;
+
+  /**
+   * issued-at  (JWT NumericDate on the wire)
+   *
+   * @generated from field: google.protobuf.Timestamp iat = 4;
+   */
+  iat?: Timestamp | undefined;
+
+  /**
+   * expiry     (JWT NumericDate on the wire)
+   *
+   * @generated from field: google.protobuf.Timestamp exp = 5;
+   */
+  exp?: Timestamp | undefined;
+
+  /**
+   * Custom claims.
+   * A user may hold several roles at once (e.g. resident + gateway admin), so
+   * this is a list. Carried in the JWT as an array of enum NAME strings
+   * (e.g. ["ROLE_RESIDENT", "ROLE_GATEWAY_ADMIN"]), matching proto3 canonical
+   * JSON enum encoding — not integer values. This keeps the claim
+   * self-describing and aligns with text-typed role storage on the api-server.
+   *
+   * @generated from field: repeated kusinta.iot.access.v1.Role roles = 6;
+   */
+  roles: Role[];
+
+  /**
+   * RFC 7800 confirmation claim. Binds the token to the DTLS certificate of the
+   * connection it may be presented on: the validator compares this against the
+   * fingerprint of the live peer and rejects on mismatch, so a token replayed on
+   * a different connection is not usable. Without it the token is a pure bearer
+   * credential — possession alone is the whole proof.
+   *
+   * Carried in the JWT as the nested object RFC 7800 specifies:
+   *   "cnf": { "x5t#S256": "<base64url SHA-256 thumbprint of the peer's DER certificate>" }
+   *
+   * MANDATORY. The issuer MUST set it on every token, and the validator MUST
+   * reject a token that arrives without one. proto3 cannot express that, and
+   * the claim is a JSON object in a JWT rather than a field on this message on
+   * the wire, so nothing mechanical enforces it — it is a contract both sides
+   * implement or the binding is worthless. A validator that treats an absent
+   * cnf as "fall back to bearer" reopens the exact replay this claim closes,
+   * and gives any holder of a stolen token a way to opt out of the check by
+   * stripping it.
+   *
+   * Rollout order, since a mandatory claim cannot appear on both sides at once:
+   * the api-server must be issuing cnf on every token BEFORE the gateway begins
+   * rejecting tokens that lack it. Reverse that order and every live session is
+   * refused. Tokens are short-TTL, so the gap between the two deployments need
+   * only exceed one token lifetime.
+   *
+   * @generated from field: kusinta.iot.webrtc.v1.Confirmation cnf = 7;
+   */
+  cnf?: Confirmation | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.AppTokenClaims.
+ * Use `create(AppTokenClaimsSchema)` to create a new message.
+ */
+export declare const AppTokenClaimsSchema: GenMessage<AppTokenClaims>;
+
+/**
+ * RFC 7800 confirmation, the value of the "cnf" claim. A separate message
+ * because the claim is a nested JSON object in the token, not a flat string.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.Confirmation
+ */
+export declare type Confirmation = Message<"kusinta.iot.webrtc.v1.Confirmation"> & {
+  /**
+   * JWT claim name "x5t#S256" — the proto field cannot carry the "#", so the
+   * mapping to and from the JWT is by hand on both sides.
+   *
+   * ENCODING, pinned deliberately: base64url (unpadded) of the SHA-256 digest
+   * over the peer's DER-encoded certificate. WebRTC stacks hand you the same
+   * digest in the SDP `a=fingerprint:sha-256` attribute in a DIFFERENT form —
+   * uppercase, colon-separated hex — and the two will never compare equal.
+   * Issuer and validator must both normalise to the base64url form here; left
+   * unstated, each side can derive a correct value and never match.
+   *
+   * A DTLS fingerprint names a CERTIFICATE, not a connection: WebRTC permits
+   * reusing one certificate across several peer connections, and a new
+   * connection normally brings a new certificate. It is therefore neither
+   * unique per connection nor stable across reconnects, and must not be used as
+   * a session or connection key. It is a credential — it proves the peer holds
+   * the private key for the certificate the token was issued against, which is
+   * exactly and only what a confirmation claim needs.
+   *
+   * @generated from field: string x5t_s256 = 1;
+   */
+  x5tS256: string;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.Confirmation.
+ * Use `create(ConfirmationSchema)` to create a new message.
+ */
+export declare const ConfirmationSchema: GenMessage<Confirmation>;
+

package/src/kusinta/iot/webrtc/v1/app_token_pb.js

@@ -0,0 +1,28 @@
+// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts,import_extension=js"
+// @generated from file kusinta/iot/webrtc/v1/app_token.proto (package kusinta.iot.webrtc.v1, syntax proto3)
+/* eslint-disable */
+
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import { file_kusinta_iot_access_v1_roles } from "../../access/v1/roles_pb.js";
+
+/**
+ * Describes the file kusinta/iot/webrtc/v1/app_token.proto.
+ */
+export const file_kusinta_iot_webrtc_v1_app_token = /*@__PURE__*/
+  fileDesc("CiVrdXNpbnRhL2lvdC93ZWJydGMvdjEvYXBwX3Rva2VuLnByb3RvEhVrdXNpbnRhLmlvdC53ZWJydGMudjEi5wEKDkFwcFRva2VuQ2xhaW1zEgsKA2lzcxgBIAEoCRILCgNhdWQYAiABKAkSCwoDc3ViGAMgASgJEicKA2lhdBgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASJwoDZXhwGAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIqCgVyb2xlcxgGIAMoDjIbLmt1c2ludGEuaW90LmFjY2Vzcy52MS5Sb2xlEjAKA2NuZhgHIAEoCzIjLmt1c2ludGEuaW90LndlYnJ0Yy52MS5Db25maXJtYXRpb24iIAoMQ29uZmlybWF0aW9uEhAKCHg1dF9zMjU2GAEgASgJQgJIAWIGcHJvdG8z", [file_google_protobuf_timestamp, file_kusinta_iot_access_v1_roles]);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.AppTokenClaims.
+ * Use `create(AppTokenClaimsSchema)` to create a new message.
+ */
+export const AppTokenClaimsSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_app_token, 0);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.Confirmation.
+ * Use `create(ConfirmationSchema)` to create a new message.
+ */
+export const ConfirmationSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_app_token, 1);
+

package/src/kusinta/iot/webrtc/v1/command_pb.d.ts

@@ -1,10 +1,10 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts"
+// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts,import_extension=js"
 // @generated from file kusinta/iot/webrtc/v1/command.proto (package kusinta.iot.webrtc.v1, syntax proto3)
 /* eslint-disable */
 
 import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
 import type { Message } from "@bufbuild/protobuf";
-import type { DeviceId } from "../../identity/v1/identity_pb";
+import type { DeviceId } from "../../identity/v1/identity_pb.js";
 import type { Timestamp } from "@bufbuild/protobuf/wkt";
 
 /**
@@ -236,8 +236,8 @@ export declare type CommandError = Message<"kusinta.iot.webrtc.v1.CommandError">
 export declare const CommandErrorSchema: GenMessage<CommandError>;
 
 /**
- * CommandResult travels gateway → Flutter app (GatewayMessage) and
- * connector → gateway (ConnectRequest via connector.proto import).
+ * CommandResult travels gateway → app (GatewayMessage) and
+ * connector → gateway (SessionRequest via connector.proto import).
  *
  * @generated from message kusinta.iot.webrtc.v1.CommandResult
  */

package/src/kusinta/iot/webrtc/v1/command_pb.js

@@ -1,10 +1,10 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts"
+// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts,import_extension=js"
 // @generated from file kusinta/iot/webrtc/v1/command.proto (package kusinta.iot.webrtc.v1, syntax proto3)
 /* eslint-disable */
 
 import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
 import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
-import { file_kusinta_iot_identity_v1_identity } from "../../identity/v1/identity_pb";
+import { file_kusinta_iot_identity_v1_identity } from "../../identity/v1/identity_pb.js";
 
 /**
  * Describes the file kusinta/iot/webrtc/v1/command.proto.

package/src/kusinta/iot/webrtc/v1/device_state_pb.d.ts

@@ -1,13 +1,14 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts"
+// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts,import_extension=js"
 // @generated from file kusinta/iot/webrtc/v1/device_state.proto (package kusinta.iot.webrtc.v1, syntax proto3)
 /* eslint-disable */
 
 import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
 import type { Message } from "@bufbuild/protobuf";
-import type { Device } from "../../device/v1/device_pb";
-import type { EffectivePermissions } from "../../access/v1/acl_pb";
+import type { Device } from "../../device/v1/device_pb.js";
+import type { EffectivePermissions } from "../../access/v1/acl_pb.js";
 import type { Timestamp } from "@bufbuild/protobuf/wkt";
-import type { PropertyUpdate } from "../../device/v1/property_update_pb";
+import type { PropertyUpdate } from "../../device/v1/property_update_pb.js";
+import type { DeviceId } from "../../identity/v1/identity_pb.js";
 
 /**
  * Describes the file kusinta/iot/webrtc/v1/device_state.proto.
@@ -15,7 +16,7 @@ import type { PropertyUpdate } from "../../device/v1/property_update_pb";
 export declare const file_kusinta_iot_webrtc_v1_device_state: GenFile;
 
 /**
- * Full device state sent to the Flutter app on initial WebRTC connection.
+ * Full device state sent to the app on initial WebRTC connection.
  *
  * @generated from message kusinta.iot.webrtc.v1.DeviceStateSnapshot
  */
@@ -43,7 +44,7 @@ export declare type DeviceStateSnapshot = Message<"kusinta.iot.webrtc.v1.DeviceS
 export declare const DeviceStateSnapshotSchema: GenMessage<DeviceStateSnapshot>;
 
 /**
- * Single property change event streamed to the Flutter app in real time.
+ * Single property change event streamed to the app in real time.
  *
  * @generated from message kusinta.iot.webrtc.v1.DevicePropertyEvent
  */
@@ -65,3 +66,65 @@ export declare type DevicePropertyEvent = Message<"kusinta.iot.webrtc.v1.DeviceP
  */
 export declare const DevicePropertyEventSchema: GenMessage<DevicePropertyEvent>;
 
+/**
+ * A device appeared while the app was connected — the app leg's counterpart to
+ * connector.v1.DeviceAnnouncement, which the gateway can currently only drop.
+ *
+ * Carries the full Device, descriptor plus current typed properties, so the app can
+ * render it without a follow-up read — the same payload DeviceStateSnapshot gives
+ * per device.
+ *
+ * Apply as an upsert keyed on descriptor.device_id, never as an insert: a device can
+ * be in the snapshot and then announced, or announced twice across a connector
+ * reconnect.
+ *
+ * Discovery, not interest. Being told a device exists does not subscribe the app to
+ * it — that still takes AppMessage.subscribe. The gateway sends this only for devices
+ * the user is entitled to see; an unfiltered announcement would be a device
+ * enumeration channel.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.DeviceAdded
+ */
+export declare type DeviceAdded = Message<"kusinta.iot.webrtc.v1.DeviceAdded"> & {
+  /**
+   * @generated from field: kusinta.iot.device.v1.Device device = 1;
+   */
+  device?: Device | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.DeviceAdded.
+ * Use `create(DeviceAddedSchema)` to create a new message.
+ */
+export declare const DeviceAddedSchema: GenMessage<DeviceAdded>;
+
+/**
+ * A device is gone, because its connector said so via connector.v1.DeviceRemoval.
+ *
+ * A connector disconnecting is NOT a removal: an ordinary reconnect wipes the
+ * device→connector route while every device still exists, and treating that as a
+ * removal makes the whole UI flap. Unreachability is a separate signal — read
+ * device.v1.Device.last_seen for that.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.DeviceRemoved
+ */
+export declare type DeviceRemoved = Message<"kusinta.iot.webrtc.v1.DeviceRemoved"> & {
+  /**
+   * @generated from field: kusinta.iot.identity.v1.DeviceId device_id = 1;
+   */
+  deviceId?: DeviceId | undefined;
+
+  /**
+   * passed through from the connector, for logs
+   *
+   * @generated from field: string reason = 2;
+   */
+  reason: string;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.DeviceRemoved.
+ * Use `create(DeviceRemovedSchema)` to create a new message.
+ */
+export declare const DeviceRemovedSchema: GenMessage<DeviceRemoved>;
+

package/src/kusinta/iot/webrtc/v1/device_state_pb.js

@@ -1,18 +1,19 @@
-// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts"
+// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts,import_extension=js"
 // @generated from file kusinta/iot/webrtc/v1/device_state.proto (package kusinta.iot.webrtc.v1, syntax proto3)
 /* eslint-disable */
 
 import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
 import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
-import { file_kusinta_iot_device_v1_device } from "../../device/v1/device_pb";
-import { file_kusinta_iot_device_v1_property_update } from "../../device/v1/property_update_pb";
-import { file_kusinta_iot_access_v1_acl } from "../../access/v1/acl_pb";
+import { file_kusinta_iot_device_v1_device } from "../../device/v1/device_pb.js";
+import { file_kusinta_iot_device_v1_property_update } from "../../device/v1/property_update_pb.js";
+import { file_kusinta_iot_access_v1_acl } from "../../access/v1/acl_pb.js";
+import { file_kusinta_iot_identity_v1_identity } from "../../identity/v1/identity_pb.js";
 
 /**
  * Describes the file kusinta/iot/webrtc/v1/device_state.proto.
  */
 export const file_kusinta_iot_webrtc_v1_device_state = /*@__PURE__*/
-  fileDesc("CihrdXNpbnRhL2lvdC93ZWJydGMvdjEvZGV2aWNlX3N0YXRlLnByb3RvEhVrdXNpbnRhLmlvdC53ZWJydGMudjEiuwEKE0RldmljZVN0YXRlU25hcHNob3QSLgoHZGV2aWNlcxgBIAMoCzIdLmt1c2ludGEuaW90LmRldmljZS52MS5EZXZpY2USQAoLcGVybWlzc2lvbnMYAiABKAsyKy5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuRWZmZWN0aXZlUGVybWlzc2lvbnMSMgoOc25hcHNob3R0ZWRfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIoYBChNEZXZpY2VQcm9wZXJ0eUV2ZW50EjUKBnVwZGF0ZRgBIAEoCzIlLmt1c2ludGEuaW90LmRldmljZS52MS5Qcm9wZXJ0eVVwZGF0ZRI4ChRnYXRld2F5X3Byb2Nlc3NlZF9hdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCAkgBYgZwcm90bzM", [file_google_protobuf_timestamp, file_kusinta_iot_device_v1_device, file_kusinta_iot_device_v1_property_update, file_kusinta_iot_access_v1_acl]);
+  fileDesc("CihrdXNpbnRhL2lvdC93ZWJydGMvdjEvZGV2aWNlX3N0YXRlLnByb3RvEhVrdXNpbnRhLmlvdC53ZWJydGMudjEiuwEKE0RldmljZVN0YXRlU25hcHNob3QSLgoHZGV2aWNlcxgBIAMoCzIdLmt1c2ludGEuaW90LmRldmljZS52MS5EZXZpY2USQAoLcGVybWlzc2lvbnMYAiABKAsyKy5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuRWZmZWN0aXZlUGVybWlzc2lvbnMSMgoOc25hcHNob3R0ZWRfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIoYBChNEZXZpY2VQcm9wZXJ0eUV2ZW50EjUKBnVwZGF0ZRgBIAEoCzIlLmt1c2ludGEuaW90LmRldmljZS52MS5Qcm9wZXJ0eVVwZGF0ZRI4ChRnYXRld2F5X3Byb2Nlc3NlZF9hdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiPAoLRGV2aWNlQWRkZWQSLQoGZGV2aWNlGAEgASgLMh0ua3VzaW50YS5pb3QuZGV2aWNlLnYxLkRldmljZSJVCg1EZXZpY2VSZW1vdmVkEjQKCWRldmljZV9pZBgBIAEoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkRldmljZUlkEg4KBnJlYXNvbhgCIAEoCUICSAFiBnByb3RvMw", [file_google_protobuf_timestamp, file_kusinta_iot_device_v1_device, file_kusinta_iot_device_v1_property_update, file_kusinta_iot_access_v1_acl, file_kusinta_iot_identity_v1_identity]);
 
 /**
  * Describes the message kusinta.iot.webrtc.v1.DeviceStateSnapshot.
@@ -28,3 +29,17 @@ export const DeviceStateSnapshotSchema = /*@__PURE__*/
 export const DevicePropertyEventSchema = /*@__PURE__*/
   messageDesc(file_kusinta_iot_webrtc_v1_device_state, 1);
 
+/**
+ * Describes the message kusinta.iot.webrtc.v1.DeviceAdded.
+ * Use `create(DeviceAddedSchema)` to create a new message.
+ */
+export const DeviceAddedSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_device_state, 2);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.DeviceRemoved.
+ * Use `create(DeviceRemovedSchema)` to create a new message.
+ */
+export const DeviceRemovedSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_device_state, 3);
+