@kusinta/iot-schema 0.1.0-beta.20 → 0.1.0-beta.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kusinta/iot-schema",
-  "version": "0.1.0-beta.20",
+  "version": "0.1.0-beta.21",
   "type": "module",
   "license": "MIT",
   "files": ["src"],
@@ -23,6 +23,7 @@
     "./connector/service":      "./src/kusinta/iot/connector/v1/connector_service_pb.js",
     "./webrtc":                 "./src/kusinta/iot/webrtc/v1/envelope_pb.js",
     "./webrtc/app-token":       "./src/kusinta/iot/webrtc/v1/app_token_pb.js",
+    "./webrtc/management":      "./src/kusinta/iot/webrtc/v1/management_pb.js",
     "./registration":           "./src/kusinta/iot/registration/v1/registration_pb.js",
     "./registration/service":   "./src/kusinta/iot/registration/v1/registration_service_pb.js",
     "./signaling":              "./src/kusinta/iot/signaling/v1/signaling_pb.js",

package/src/kusinta/iot/device/v1/property_update_pb.d.ts

@@ -14,7 +14,7 @@ export declare const file_kusinta_iot_device_v1_property_update: GenFile;
 
 /**
  * PropertyUpdate carries a single attribute change from connector to gateway,
- * or from gateway to Flutter app.
+ * or from gateway to app.
  *
  * Resolution rule (normative)
  *

package/src/kusinta/iot/signaling/v1/signaling_pb.d.ts

@@ -46,7 +46,7 @@ export declare const SdpAnswerSchema: GenMessage<SdpAnswer>;
 /**
  * candidate is the SDP candidate attribute line. sdp_mid / sdp_mline_index
  * bind it to a media section: WebRTC's addIceCandidate requires a non-null
- * sdpMid (passing null NPEs in the Android JNI layer). Under BUNDLE both are
+ * sdpMid (some native WebRTC bindings crash on a null). Under BUNDLE both are
  * constant ("0" / 0) for a single-m-line session, but they must be carried so
  * candidates stay correct once additional m-lines (e.g. camera video) exist.
  *
@@ -78,7 +78,7 @@ export declare const IceCandidateSchema: GenMessage<IceCandidate>;
 /**
  * Empty keepalive. The gateway sends this periodically on the GatewayConnect
  * stream so the otherwise-idle bidi request keeps producing DATA frames, which
- * resets HAProxy's inactivity timers (timeout client/server) and stops the relay
+ * resets the inactivity timers on any proxy between the two ends and stops it
  * from tearing the stream down. Carries no routing target and is dropped on receipt.
  *
  * @generated from message kusinta.iot.signaling.v1.HeartBeat
@@ -134,7 +134,8 @@ export declare const UserHandshakeAckSchema: GenMessage<UserHandshakeAck>;
 
 /**
  * Messages sent by the building-server gateway (GatewaySignalingService.GatewayConnect stream).
- * Auth: x-client-cert-fingerprint metadata header (set by HAProxy from mTLS).
+ * Auth: x-client-cert-fingerprint metadata header, set from the client
+ * certificate by the mTLS-terminating proxy in front of this service.
  *
  * @generated from message kusinta.iot.signaling.v1.GatewayConnectRequest
  */
@@ -227,7 +228,7 @@ export declare type GatewayConnectResponse = Message<"kusinta.iot.signaling.v1.G
 export declare const GatewayConnectResponseSchema: GenMessage<GatewayConnectResponse>;
 
 /**
- * Messages sent by the Flutter app (GatewaySignalingService.UserConnect stream).
+ * Messages sent by the app (GatewaySignalingService.UserConnect stream).
  * Auth: Authorization: Bearer <jwt> in gRPC request metadata (validated by interceptor).
  *
  * @generated from message kusinta.iot.signaling.v1.UserConnectRequest
@@ -273,7 +274,7 @@ export declare type UserConnectRequest = Message<"kusinta.iot.signaling.v1.UserC
 export declare const UserConnectRequestSchema: GenMessage<UserConnectRequest>;
 
 /**
- * Messages sent by the api-server to the Flutter app.
+ * Messages sent by the api-server to the app.
  *
  * @generated from message kusinta.iot.signaling.v1.UserConnectResponse
  */

package/src/kusinta/iot/webrtc/v1/app_token_pb.d.ts

@@ -14,9 +14,9 @@ export declare const file_kusinta_iot_webrtc_v1_app_token: GenFile;
 
 /**
  * AppTokenClaims is the contract for the payload of the JWT carried in
- * AppHandshake.jwt. It is the single source of truth shared between
- * mykusinta-api-server (which mints the token) and the gateway (which validates
- * it locally against the mykusinta-api-server public key).
+ * AppHandshake.jwt. It is the single source of truth shared between the
+ * api-server (which mints the token) and the gateway (which validates it
+ * locally against the api-server's public key).
  *
  * This message is NOT sent on the wire — the wire value stays the signed,
  * compact JWS string in AppHandshake.jwt. The fields here document the claim
@@ -30,8 +30,8 @@ export declare const file_kusinta_iot_webrtc_v1_app_token: GenFile;
 export declare type AppTokenClaims = Message<"kusinta.iot.webrtc.v1.AppTokenClaims"> & {
   /**
    * Registered claims (RFC 7519).
-   *
-   * issuer: "mykusinta-api-server"
+   * Issuer: the api-server's issuer identifier, agreed out of band. A fixed
+   * string both sides compare exactly — not derived from anything here.
    *
    * @generated from field: string iss = 1;
    */
@@ -71,8 +71,7 @@ export declare type AppTokenClaims = Message<"kusinta.iot.webrtc.v1.AppTokenClai
    * this is a list. Carried in the JWT as an array of enum NAME strings
    * (e.g. ["ROLE_RESIDENT", "ROLE_GATEWAY_ADMIN"]), matching proto3 canonical
    * JSON enum encoding — not integer values. This keeps the claim
-   * self-describing and aligns with text-typed role storage in
-   * mykusinta-api-server.
+   * self-describing and aligns with text-typed role storage on the api-server.
    *
    * @generated from field: repeated kusinta.iot.access.v1.Role roles = 6;
    */
@@ -98,10 +97,10 @@ export declare type AppTokenClaims = Message<"kusinta.iot.webrtc.v1.AppTokenClai
    * stripping it.
    *
    * Rollout order, since a mandatory claim cannot appear on both sides at once:
-   * mykusinta-api-server must be issuing cnf on every token BEFORE the gateway
-   * begins rejecting tokens that lack it. Reverse that order and every live
-   * session is refused. Tokens are short-TTL, so the gap between the two
-   * deployments need only exceed one token lifetime.
+   * the api-server must be issuing cnf on every token BEFORE the gateway begins
+   * rejecting tokens that lack it. Reverse that order and every live session is
+   * refused. Tokens are short-TTL, so the gap between the two deployments need
+   * only exceed one token lifetime.
    *
    * @generated from field: kusinta.iot.webrtc.v1.Confirmation cnf = 7;
    */

package/src/kusinta/iot/webrtc/v1/command_pb.d.ts

@@ -236,7 +236,7 @@ export declare type CommandError = Message<"kusinta.iot.webrtc.v1.CommandError">
 export declare const CommandErrorSchema: GenMessage<CommandError>;
 
 /**
- * CommandResult travels gateway → Flutter app (GatewayMessage) and
+ * CommandResult travels gateway → app (GatewayMessage) and
  * connector → gateway (SessionRequest via connector.proto import).
  *
  * @generated from message kusinta.iot.webrtc.v1.CommandResult

package/src/kusinta/iot/webrtc/v1/device_state_pb.d.ts

@@ -16,7 +16,7 @@ import type { DeviceId } from "../../identity/v1/identity_pb.js";
 export declare const file_kusinta_iot_webrtc_v1_device_state: GenFile;
 
 /**
- * Full device state sent to the Flutter app on initial WebRTC connection.
+ * Full device state sent to the app on initial WebRTC connection.
  *
  * @generated from message kusinta.iot.webrtc.v1.DeviceStateSnapshot
  */
@@ -44,7 +44,7 @@ export declare type DeviceStateSnapshot = Message<"kusinta.iot.webrtc.v1.DeviceS
 export declare const DeviceStateSnapshotSchema: GenMessage<DeviceStateSnapshot>;
 
 /**
- * Single property change event streamed to the Flutter app in real time.
+ * Single property change event streamed to the app in real time.
  *
  * @generated from message kusinta.iot.webrtc.v1.DevicePropertyEvent
  */

package/src/kusinta/iot/webrtc/v1/envelope_pb.d.ts

@@ -5,6 +5,8 @@
 import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
 import type { Message } from "@bufbuild/protobuf";
 import type { DeviceId } from "../../identity/v1/identity_pb.js";
+import type { Space } from "../../space/v1/space_pb.js";
+import type { ManagementAck, ManagementRequest, SpaceTree } from "./management_pb.js";
 import type { Timestamp } from "@bufbuild/protobuf/wkt";
 import type { DeviceAdded, DevicePropertyEvent, DeviceRemoved, DeviceStateSnapshot } from "./device_state_pb.js";
 import type { LivePermissionUpdate } from "./permission_push_pb.js";
@@ -56,8 +58,8 @@ export declare type HandshakeRejected = Message<"kusinta.iot.webrtc.v1.Handshake
 export declare const HandshakeRejectedSchema: GenMessage<HandshakeRejected>;
 
 /**
- * AppHandshake must be the first message sent by the Flutter app on the data channel.
- * The gateway validates the JWT locally using the mykusinta-api-server public key,
+ * AppHandshake must be the first message sent by the app on the data channel.
+ * The gateway validates the JWT locally using the api-server's public key,
  * checks that gateway_id in the JWT matches this gateway, then extracts the role.
  *
  * @generated from message kusinta.iot.webrtc.v1.AppHandshake
@@ -65,8 +67,8 @@ export declare const HandshakeRejectedSchema: GenMessage<HandshakeRejected>;
 export declare type AppHandshake = Message<"kusinta.iot.webrtc.v1.AppHandshake"> & {
   /**
    * Signed compact JWS. Its payload claims are documented by AppTokenClaims
-   * in app_token.proto — the shared contract between mykusinta-api-server
-   * (issuer) and the gateway (validator).
+   * in app_token.proto — the shared contract between the api-server (issuer)
+   * and the gateway (validator).
    *
    * @generated from field: string jwt = 1;
    */
@@ -163,7 +165,7 @@ export declare type RefusedSubscription = Message<"kusinta.iot.webrtc.v1.Refused
 export declare const RefusedSubscriptionSchema: GenMessage<RefusedSubscription>;
 
 /**
- * Answer to SubscribeDevices / UnsubscribeDevices, gateway → Flutter app.
+ * Answer to SubscribeDevices / UnsubscribeDevices, gateway → app.
  * `subscribed` is the effective set after the change, not a delta: an app that
  * missed an ack or raced two requests re-syncs from it without reconnecting.
  *
@@ -221,7 +223,7 @@ export declare type PropertyReadRequest = Message<"kusinta.iot.webrtc.v1.Propert
 export declare const PropertyReadRequestSchema: GenMessage<PropertyReadRequest>;
 
 /**
- * Session-level error, gateway → Flutter app. Mirrors connector.v1.GatewayError
+ * Session-level error, gateway → app. Mirrors connector.v1.GatewayError
  * on the connector leg; kept separate because the two legs have different
  * authorization semantics and this one has a closed code vocabulary.
  *
@@ -255,7 +257,72 @@ export declare type GatewayError = Message<"kusinta.iot.webrtc.v1.GatewayError">
 export declare const GatewayErrorSchema: GenMessage<GatewayError>;
 
 /**
- * GatewayMessage: gateway → Flutter app
+ * Answer to a ManagementRequest, gateway → app. Lives here rather than beside the
+ * requests in management.proto because it carries GatewayError, which is declared
+ * in this file; the other direction would be an import cycle.
+ *
+ * Exactly one result arrives per request, correlated by in_reply_to. A refusal is
+ * an ordinary result, not a session-level error: a filing operation the caller may
+ * not perform says so and the session continues. Targets the caller cannot reach
+ * are refused as NOT_ENTITLED whether or not they exist, so no result here reveals
+ * which spaces or devices are out there.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.ManagementResult
+ */
+export declare type ManagementResult = Message<"kusinta.iot.webrtc.v1.ManagementResult"> & {
+  /**
+   * AppMessage.message_id of the request
+   *
+   * @generated from field: string in_reply_to = 1;
+   */
+  inReplyTo: string;
+
+  /**
+   * @generated from oneof kusinta.iot.webrtc.v1.ManagementResult.result
+   */
+  result: {
+    /**
+     * refused, or the request was malformed
+     *
+     * @generated from field: kusinta.iot.webrtc.v1.GatewayError error = 2;
+     */
+    value: GatewayError;
+    case: "error";
+  } | {
+    /**
+     * create_space, update_space
+     *
+     * @generated from field: kusinta.iot.space.v1.Space space = 3;
+     */
+    value: Space;
+    case: "space";
+  } | {
+    /**
+     * list_spaces
+     *
+     * @generated from field: kusinta.iot.webrtc.v1.SpaceTree space_tree = 4;
+     */
+    value: SpaceTree;
+    case: "spaceTree";
+  } | {
+    /**
+     * everything else
+     *
+     * @generated from field: kusinta.iot.webrtc.v1.ManagementAck ack = 5;
+     */
+    value: ManagementAck;
+    case: "ack";
+  } | { case: undefined; value?: undefined };
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.ManagementResult.
+ * Use `create(ManagementResultSchema)` to create a new message.
+ */
+export declare const ManagementResultSchema: GenMessage<ManagementResult>;
+
+/**
+ * GatewayMessage: gateway → app
  *
  * @generated from message kusinta.iot.webrtc.v1.GatewayMessage
  */
@@ -333,6 +400,12 @@ export declare type GatewayMessage = Message<"kusinta.iot.webrtc.v1.GatewayMessa
      */
     value: DeviceRemoved;
     case: "deviceRemoved";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.webrtc.v1.ManagementResult management_result = 14;
+     */
+    value: ManagementResult;
+    case: "managementResult";
   } | { case: undefined; value?: undefined };
 };
 
@@ -343,7 +416,7 @@ export declare type GatewayMessage = Message<"kusinta.iot.webrtc.v1.GatewayMessa
 export declare const GatewayMessageSchema: GenMessage<GatewayMessage>;
 
 /**
- * AppMessage: Flutter app → gateway
+ * AppMessage: app → gateway
  *
  * @generated from message kusinta.iot.webrtc.v1.AppMessage
  */
@@ -397,6 +470,12 @@ export declare type AppMessage = Message<"kusinta.iot.webrtc.v1.AppMessage"> & {
      */
     value: UnsubscribeDevices;
     case: "unsubscribe";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.webrtc.v1.ManagementRequest management = 9;
+     */
+    value: ManagementRequest;
+    case: "management";
   } | { case: undefined; value?: undefined };
 };
 

package/src/kusinta/iot/webrtc/v1/envelope_pb.js

@@ -5,15 +5,17 @@
 import { enumDesc, fileDesc, messageDesc, tsEnum } from "@bufbuild/protobuf/codegenv2";
 import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 import { file_kusinta_iot_identity_v1_identity } from "../../identity/v1/identity_pb.js";
+import { file_kusinta_iot_space_v1_space } from "../../space/v1/space_pb.js";
 import { file_kusinta_iot_webrtc_v1_command } from "./command_pb.js";
 import { file_kusinta_iot_webrtc_v1_device_state } from "./device_state_pb.js";
+import { file_kusinta_iot_webrtc_v1_management } from "./management_pb.js";
 import { file_kusinta_iot_webrtc_v1_permission_push } from "./permission_push_pb.js";
 
 /**
  * Describes the file kusinta/iot/webrtc/v1/envelope.proto.
  */
 export const file_kusinta_iot_webrtc_v1_envelope = /*@__PURE__*/
-  fileDesc("CiRrdXNpbnRhL2lvdC93ZWJydGMvdjEvZW52ZWxvcGUucHJvdG8SFWt1c2ludGEuaW90LndlYnJ0Yy52MSIGCgRQaW5nIgYKBFBvbmciIwoRSGFuZHNoYWtlUmVqZWN0ZWQSDgoGcmVhc29uGAEgASgJIlwKDEFwcEhhbmRzaGFrZRILCgNqd3QYASABKAkSPwoUc3Vic2NyaWJlX2RldmljZV9pZHMYAiADKAsyIS5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5EZXZpY2VJZCJJChBTdWJzY3JpYmVEZXZpY2VzEjUKCmRldmljZV9pZHMYASADKAsyIS5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5EZXZpY2VJZCJLChJVbnN1YnNjcmliZURldmljZXMSNQoKZGV2aWNlX2lkcxgBIAMoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkRldmljZUlkIpMBChNSZWZ1c2VkU3Vic2NyaXB0aW9uEjQKCWRldmljZV9pZBgBIAEoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkRldmljZUlkEjUKBGNvZGUYAiABKA4yJy5rdXNpbnRhLmlvdC53ZWJydGMudjEuR2F0ZXdheUVycm9yQ29kZRIPCgdtZXNzYWdlGAMgASgJIpoBCg9TdWJzY3JpcHRpb25BY2sSEwoLaW5fcmVwbHlfdG8YASABKAkSNQoKc3Vic2NyaWJlZBgCIAMoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkRldmljZUlkEjsKB3JlZnVzZWQYAyADKAsyKi5rdXNpbnRhLmlvdC53ZWJydGMudjEuUmVmdXNlZFN1YnNjcmlwdGlvbiJ7ChNQcm9wZXJ0eVJlYWRSZXF1ZXN0EjQKCWRldmljZV9pZBgBIAEoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkRldmljZUlkEhYKDmF0dHJpYnV0ZV9uYW1lGAIgASgJEhYKDmNsdXN0ZXJfaWRfaGV4GAMgASgJIswBCgxHYXRld2F5RXJyb3ISNQoEY29kZRgBIAEoDjInLmt1c2ludGEuaW90LndlYnJ0Yy52MS5HYXRld2F5RXJyb3JDb2RlEg8KB21lc3NhZ2UYAiABKAkSQwoIbWV0YWRhdGEYAyADKAsyMS5rdXNpbnRhLmlvdC53ZWJydGMudjEuR2F0ZXdheUVycm9yLk1ldGFkYXRhRW50cnkaLwoNTWV0YWRhdGFFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIuMFCg5HYXRld2F5TWVzc2FnZRISCgptZXNzYWdlX2lkGAEgASgJEisKB3NlbnRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkQKDnN0YXRlX3NuYXBzaG90GAMgASgLMioua3VzaW50YS5pb3Qud2VicnRjLnYxLkRldmljZVN0YXRlU25hcHNob3RIABJECg5wcm9wZXJ0eV9ldmVudBgEIAEoCzIqLmt1c2ludGEuaW90LndlYnJ0Yy52MS5EZXZpY2VQcm9wZXJ0eUV2ZW50SAASSAoRcGVybWlzc2lvbl91cGRhdGUYBSABKAsyKy5rdXNpbnRhLmlvdC53ZWJydGMudjEuTGl2ZVBlcm1pc3Npb25VcGRhdGVIABI+Cg5jb21tYW5kX3Jlc3VsdBgGIAEoCzIkLmt1c2ludGEuaW90LndlYnJ0Yy52MS5Db21tYW5kUmVzdWx0SAASKwoEcG9uZxgIIAEoCzIbLmt1c2ludGEuaW90LndlYnJ0Yy52MS5Qb25nSAASRgoSaGFuZHNoYWtlX3JlamVjdGVkGAkgASgLMigua3VzaW50YS5pb3Qud2VicnRjLnYxLkhhbmRzaGFrZVJlamVjdGVkSAASNAoFZXJyb3IYCiABKAsyIy5rdXNpbnRhLmlvdC53ZWJydGMudjEuR2F0ZXdheUVycm9ySAASQgoQc3Vic2NyaXB0aW9uX2FjaxgLIAEoCzImLmt1c2ludGEuaW90LndlYnJ0Yy52MS5TdWJzY3JpcHRpb25BY2tIABI6CgxkZXZpY2VfYWRkZWQYDCABKAsyIi5rdXNpbnRhLmlvdC53ZWJydGMudjEuRGV2aWNlQWRkZWRIABI+Cg5kZXZpY2VfcmVtb3ZlZBgNIAEoCzIkLmt1c2ludGEuaW90LndlYnJ0Yy52MS5EZXZpY2VSZW1vdmVkSABCCQoHcGF5bG9hZEoECAcQCCK8AwoKQXBwTWVzc2FnZRISCgptZXNzYWdlX2lkGAEgASgJEisKB3NlbnRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjgKCWhhbmRzaGFrZRgDIAEoCzIjLmt1c2ludGEuaW90LndlYnJ0Yy52MS5BcHBIYW5kc2hha2VIABI3Cgdjb21tYW5kGAQgASgLMiQua3VzaW50YS5pb3Qud2VicnRjLnYxLkRldmljZUNvbW1hbmRIABJCCgxyZWFkX3JlcXVlc3QYBSABKAsyKi5rdXNpbnRhLmlvdC53ZWJydGMudjEuUHJvcGVydHlSZWFkUmVxdWVzdEgAEisKBHBpbmcYBiABKAsyGy5rdXNpbnRhLmlvdC53ZWJydGMudjEuUGluZ0gAEjwKCXN1YnNjcmliZRgHIAEoCzInLmt1c2ludGEuaW90LndlYnJ0Yy52MS5TdWJzY3JpYmVEZXZpY2VzSAASQAoLdW5zdWJzY3JpYmUYCCABKAsyKS5rdXNpbnRhLmlvdC53ZWJydGMudjEuVW5zdWJzY3JpYmVEZXZpY2VzSABCCQoHcGF5bG9hZCr2AQoQR2F0ZXdheUVycm9yQ29kZRIiCh5HQVRFV0FZX0VSUk9SX0NPREVfVU5TUEVDSUZJRUQQABIjCh9HQVRFV0FZX0VSUk9SX0NPREVfTk9UX0VOVElUTEVEEAESJgoiR0FURVdBWV9FUlJPUl9DT0RFX0lOVkFMSURfUkVRVUVTVBACEiIKHkdBVEVXQVlfRVJST1JfQ09ERV9VTkFWQUlMQUJMRRADEh8KG0dBVEVXQVlfRVJST1JfQ09ERV9JTlRFUk5BTBAEEiwKKEdBVEVXQVlfRVJST1JfQ09ERV9TRVNTSU9OX0xJTUlUX1JFQUNIRUQQBUICSAFiBnByb3RvMw", [file_google_protobuf_timestamp, file_kusinta_iot_identity_v1_identity, file_kusinta_iot_webrtc_v1_command, file_kusinta_iot_webrtc_v1_device_state, file_kusinta_iot_webrtc_v1_permission_push]);
+  fileDesc("CiRrdXNpbnRhL2lvdC93ZWJydGMvdjEvZW52ZWxvcGUucHJvdG8SFWt1c2ludGEuaW90LndlYnJ0Yy52MSIGCgRQaW5nIgYKBFBvbmciIwoRSGFuZHNoYWtlUmVqZWN0ZWQSDgoGcmVhc29uGAEgASgJIlwKDEFwcEhhbmRzaGFrZRILCgNqd3QYASABKAkSPwoUc3Vic2NyaWJlX2RldmljZV9pZHMYAiADKAsyIS5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5EZXZpY2VJZCJJChBTdWJzY3JpYmVEZXZpY2VzEjUKCmRldmljZV9pZHMYASADKAsyIS5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5EZXZpY2VJZCJLChJVbnN1YnNjcmliZURldmljZXMSNQoKZGV2aWNlX2lkcxgBIAMoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkRldmljZUlkIpMBChNSZWZ1c2VkU3Vic2NyaXB0aW9uEjQKCWRldmljZV9pZBgBIAEoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkRldmljZUlkEjUKBGNvZGUYAiABKA4yJy5rdXNpbnRhLmlvdC53ZWJydGMudjEuR2F0ZXdheUVycm9yQ29kZRIPCgdtZXNzYWdlGAMgASgJIpoBCg9TdWJzY3JpcHRpb25BY2sSEwoLaW5fcmVwbHlfdG8YASABKAkSNQoKc3Vic2NyaWJlZBgCIAMoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkRldmljZUlkEjsKB3JlZnVzZWQYAyADKAsyKi5rdXNpbnRhLmlvdC53ZWJydGMudjEuUmVmdXNlZFN1YnNjcmlwdGlvbiJ7ChNQcm9wZXJ0eVJlYWRSZXF1ZXN0EjQKCWRldmljZV9pZBgBIAEoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkRldmljZUlkEhYKDmF0dHJpYnV0ZV9uYW1lGAIgASgJEhYKDmNsdXN0ZXJfaWRfaGV4GAMgASgJIswBCgxHYXRld2F5RXJyb3ISNQoEY29kZRgBIAEoDjInLmt1c2ludGEuaW90LndlYnJ0Yy52MS5HYXRld2F5RXJyb3JDb2RlEg8KB21lc3NhZ2UYAiABKAkSQwoIbWV0YWRhdGEYAyADKAsyMS5rdXNpbnRhLmlvdC53ZWJydGMudjEuR2F0ZXdheUVycm9yLk1ldGFkYXRhRW50cnkaLwoNTWV0YWRhdGFFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIoICChBNYW5hZ2VtZW50UmVzdWx0EhMKC2luX3JlcGx5X3RvGAEgASgJEjQKBWVycm9yGAIgASgLMiMua3VzaW50YS5pb3Qud2VicnRjLnYxLkdhdGV3YXlFcnJvckgAEiwKBXNwYWNlGAMgASgLMhsua3VzaW50YS5pb3Quc3BhY2UudjEuU3BhY2VIABI2CgpzcGFjZV90cmVlGAQgASgLMiAua3VzaW50YS5pb3Qud2VicnRjLnYxLlNwYWNlVHJlZUgAEjMKA2FjaxgFIAEoCzIkLmt1c2ludGEuaW90LndlYnJ0Yy52MS5NYW5hZ2VtZW50QWNrSABCCAoGcmVzdWx0IqkGCg5HYXRld2F5TWVzc2FnZRISCgptZXNzYWdlX2lkGAEgASgJEisKB3NlbnRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkQKDnN0YXRlX3NuYXBzaG90GAMgASgLMioua3VzaW50YS5pb3Qud2VicnRjLnYxLkRldmljZVN0YXRlU25hcHNob3RIABJECg5wcm9wZXJ0eV9ldmVudBgEIAEoCzIqLmt1c2ludGEuaW90LndlYnJ0Yy52MS5EZXZpY2VQcm9wZXJ0eUV2ZW50SAASSAoRcGVybWlzc2lvbl91cGRhdGUYBSABKAsyKy5rdXNpbnRhLmlvdC53ZWJydGMudjEuTGl2ZVBlcm1pc3Npb25VcGRhdGVIABI+Cg5jb21tYW5kX3Jlc3VsdBgGIAEoCzIkLmt1c2ludGEuaW90LndlYnJ0Yy52MS5Db21tYW5kUmVzdWx0SAASKwoEcG9uZxgIIAEoCzIbLmt1c2ludGEuaW90LndlYnJ0Yy52MS5Qb25nSAASRgoSaGFuZHNoYWtlX3JlamVjdGVkGAkgASgLMigua3VzaW50YS5pb3Qud2VicnRjLnYxLkhhbmRzaGFrZVJlamVjdGVkSAASNAoFZXJyb3IYCiABKAsyIy5rdXNpbnRhLmlvdC53ZWJydGMudjEuR2F0ZXdheUVycm9ySAASQgoQc3Vic2NyaXB0aW9uX2FjaxgLIAEoCzImLmt1c2ludGEuaW90LndlYnJ0Yy52MS5TdWJzY3JpcHRpb25BY2tIABI6CgxkZXZpY2VfYWRkZWQYDCABKAsyIi5rdXNpbnRhLmlvdC53ZWJydGMudjEuRGV2aWNlQWRkZWRIABI+Cg5kZXZpY2VfcmVtb3ZlZBgNIAEoCzIkLmt1c2ludGEuaW90LndlYnJ0Yy52MS5EZXZpY2VSZW1vdmVkSAASRAoRbWFuYWdlbWVudF9yZXN1bHQYDiABKAsyJy5rdXNpbnRhLmlvdC53ZWJydGMudjEuTWFuYWdlbWVudFJlc3VsdEgAQgkKB3BheWxvYWRKBAgHEAgi/AMKCkFwcE1lc3NhZ2USEgoKbWVzc2FnZV9pZBgBIAEoCRIrCgdzZW50X2F0GAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI4CgloYW5kc2hha2UYAyABKAsyIy5rdXNpbnRhLmlvdC53ZWJydGMudjEuQXBwSGFuZHNoYWtlSAASNwoHY29tbWFuZBgEIAEoCzIkLmt1c2ludGEuaW90LndlYnJ0Yy52MS5EZXZpY2VDb21tYW5kSAASQgoMcmVhZF9yZXF1ZXN0GAUgASgLMioua3VzaW50YS5pb3Qud2VicnRjLnYxLlByb3BlcnR5UmVhZFJlcXVlc3RIABIrCgRwaW5nGAYgASgLMhsua3VzaW50YS5pb3Qud2VicnRjLnYxLlBpbmdIABI8CglzdWJzY3JpYmUYByABKAsyJy5rdXNpbnRhLmlvdC53ZWJydGMudjEuU3Vic2NyaWJlRGV2aWNlc0gAEkAKC3Vuc3Vic2NyaWJlGAggASgLMikua3VzaW50YS5pb3Qud2VicnRjLnYxLlVuc3Vic2NyaWJlRGV2aWNlc0gAEj4KCm1hbmFnZW1lbnQYCSABKAsyKC5rdXNpbnRhLmlvdC53ZWJydGMudjEuTWFuYWdlbWVudFJlcXVlc3RIAEIJCgdwYXlsb2FkKvYBChBHYXRld2F5RXJyb3JDb2RlEiIKHkdBVEVXQVlfRVJST1JfQ09ERV9VTlNQRUNJRklFRBAAEiMKH0dBVEVXQVlfRVJST1JfQ09ERV9OT1RfRU5USVRMRUQQARImCiJHQVRFV0FZX0VSUk9SX0NPREVfSU5WQUxJRF9SRVFVRVNUEAISIgoeR0FURVdBWV9FUlJPUl9DT0RFX1VOQVZBSUxBQkxFEAMSHwobR0FURVdBWV9FUlJPUl9DT0RFX0lOVEVSTkFMEAQSLAooR0FURVdBWV9FUlJPUl9DT0RFX1NFU1NJT05fTElNSVRfUkVBQ0hFRBAFQgJIAWIGcHJvdG8z", [file_google_protobuf_timestamp, file_kusinta_iot_identity_v1_identity, file_kusinta_iot_space_v1_space, file_kusinta_iot_webrtc_v1_command, file_kusinta_iot_webrtc_v1_device_state, file_kusinta_iot_webrtc_v1_management, file_kusinta_iot_webrtc_v1_permission_push]);
 
 /**
  * Describes the message kusinta.iot.webrtc.v1.Ping.
@@ -85,19 +87,26 @@ export const PropertyReadRequestSchema = /*@__PURE__*/
 export const GatewayErrorSchema = /*@__PURE__*/
   messageDesc(file_kusinta_iot_webrtc_v1_envelope, 9);
 
+/**
+ * Describes the message kusinta.iot.webrtc.v1.ManagementResult.
+ * Use `create(ManagementResultSchema)` to create a new message.
+ */
+export const ManagementResultSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_envelope, 10);
+
 /**
  * Describes the message kusinta.iot.webrtc.v1.GatewayMessage.
  * Use `create(GatewayMessageSchema)` to create a new message.
  */
 export const GatewayMessageSchema = /*@__PURE__*/
-  messageDesc(file_kusinta_iot_webrtc_v1_envelope, 10);
+  messageDesc(file_kusinta_iot_webrtc_v1_envelope, 11);
 
 /**
  * Describes the message kusinta.iot.webrtc.v1.AppMessage.
  * Use `create(AppMessageSchema)` to create a new message.
  */
 export const AppMessageSchema = /*@__PURE__*/
-  messageDesc(file_kusinta_iot_webrtc_v1_envelope, 11);
+  messageDesc(file_kusinta_iot_webrtc_v1_envelope, 12);
 
 /**
  * Describes the enum kusinta.iot.webrtc.v1.GatewayErrorCode.

package/src/kusinta/iot/webrtc/v1/management_pb.d.ts

@@ -0,0 +1,451 @@
+// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts,import_extension=js"
+// @generated from file kusinta/iot/webrtc/v1/management.proto (package kusinta.iot.webrtc.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { Message } from "@bufbuild/protobuf";
+import type { DeviceOwnershipType, SpaceType } from "../../common/v1/types_pb.js";
+import type { DeviceId, SpaceId, UserId } from "../../identity/v1/identity_pb.js";
+import type { Space } from "../../space/v1/space_pb.js";
+
+/**
+ * Describes the file kusinta/iot/webrtc/v1/management.proto.
+ */
+export declare const file_kusinta_iot_webrtc_v1_management: GenFile;
+
+/**
+ * Creates a space. A space with no parent_space_id is top level, which is a
+ * stronger request than it looks: there is no parent whose reach could authorize
+ * it, so it is reserved to the gateway's administrator.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.CreateSpace
+ */
+export declare type CreateSpace = Message<"kusinta.iot.webrtc.v1.CreateSpace"> & {
+  /**
+   * @generated from field: kusinta.iot.common.v1.SpaceType space_type = 1;
+   */
+  spaceType: SpaceType;
+
+  /**
+   * @generated from field: string name = 2;
+   */
+  name: string;
+
+  /**
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * meaningful for FLOOR type
+   *
+   * @generated from field: int32 floor = 4;
+   */
+  floor: number;
+
+  /**
+   * unset = top level
+   *
+   * @generated from field: kusinta.iot.identity.v1.SpaceId parent_space_id = 5;
+   */
+  parentSpaceId?: SpaceId | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.CreateSpace.
+ * Use `create(CreateSpaceSchema)` to create a new message.
+ */
+export declare const CreateSpaceSchema: GenMessage<CreateSpace>;
+
+/**
+ * Changes a space in place. Every descriptive field carries explicit presence:
+ * absent means leave it alone, present means set it to this — including to the
+ * empty string, which is how a description is cleared.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.UpdateSpace
+ */
+export declare type UpdateSpace = Message<"kusinta.iot.webrtc.v1.UpdateSpace"> & {
+  /**
+   * @generated from field: kusinta.iot.identity.v1.SpaceId space_id = 1;
+   */
+  spaceId?: SpaceId | undefined;
+
+  /**
+   * @generated from field: optional kusinta.iot.common.v1.SpaceType space_type = 2;
+   */
+  spaceType?: SpaceType | undefined;
+
+  /**
+   * @generated from field: optional string name = 3;
+   */
+  name?: string | undefined;
+
+  /**
+   * @generated from field: optional string description = 4;
+   */
+  description?: string | undefined;
+
+  /**
+   * @generated from field: optional int32 floor = 5;
+   */
+  floor?: number | undefined;
+
+  /**
+   * Reparenting needs three states, not two: leave the parent alone, move to a
+   * new one, or become top level. A bare optional parent_space_id can only
+   * express the first two, so detaching gets its own case rather than being
+   * spelled as an empty id.
+   *
+   * @generated from oneof kusinta.iot.webrtc.v1.UpdateSpace.parent_change
+   */
+  parentChange: {
+    /**
+     * @generated from field: kusinta.iot.identity.v1.SpaceId parent_space_id = 6;
+     */
+    value: SpaceId;
+    case: "parentSpaceId";
+  } | {
+    /**
+     * @generated from field: bool detach = 7;
+     */
+    value: boolean;
+    case: "detach";
+  } | { case: undefined; value?: undefined };
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.UpdateSpace.
+ * Use `create(UpdateSpaceSchema)` to create a new message.
+ */
+export declare const UpdateSpaceSchema: GenMessage<UpdateSpace>;
+
+/**
+ * Deletes a space. Refused if the space still holds devices or sub-spaces unless
+ * cascade is set, so that emptying a building is always something the caller
+ * asked for rather than something a stale client did by accident.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.DeleteSpace
+ */
+export declare type DeleteSpace = Message<"kusinta.iot.webrtc.v1.DeleteSpace"> & {
+  /**
+   * @generated from field: kusinta.iot.identity.v1.SpaceId space_id = 1;
+   */
+  spaceId?: SpaceId | undefined;
+
+  /**
+   * @generated from field: bool cascade = 2;
+   */
+  cascade: boolean;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.DeleteSpace.
+ * Use `create(DeleteSpaceSchema)` to create a new message.
+ */
+export declare const DeleteSpaceSchema: GenMessage<DeleteSpace>;
+
+/**
+ * Adds a user to a space, granting them reach of it and everything beneath it.
+ * The user need not be known to the gateway beforehand — identities are minted by
+ * the token issuer, and this records that one of them belongs here.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.AssignUserToSpace
+ */
+export declare type AssignUserToSpace = Message<"kusinta.iot.webrtc.v1.AssignUserToSpace"> & {
+  /**
+   * @generated from field: kusinta.iot.identity.v1.SpaceId space_id = 1;
+   */
+  spaceId?: SpaceId | undefined;
+
+  /**
+   * @generated from field: kusinta.iot.identity.v1.UserId user_id = 2;
+   */
+  userId?: UserId | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.AssignUserToSpace.
+ * Use `create(AssignUserToSpaceSchema)` to create a new message.
+ */
+export declare const AssignUserToSpaceSchema: GenMessage<AssignUserToSpace>;
+
+/**
+ * Removes a user's membership of a space. Losing reach also drops whatever the
+ * user was streaming from it, announced by LivePermissionUpdate.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.RemoveUserFromSpace
+ */
+export declare type RemoveUserFromSpace = Message<"kusinta.iot.webrtc.v1.RemoveUserFromSpace"> & {
+  /**
+   * @generated from field: kusinta.iot.identity.v1.SpaceId space_id = 1;
+   */
+  spaceId?: SpaceId | undefined;
+
+  /**
+   * @generated from field: kusinta.iot.identity.v1.UserId user_id = 2;
+   */
+  userId?: UserId | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.RemoveUserFromSpace.
+ * Use `create(RemoveUserFromSpaceSchema)` to create a new message.
+ */
+export declare const RemoveUserFromSpaceSchema: GenMessage<RemoveUserFromSpace>;
+
+/**
+ * Files a device into a space. A device may sit in several spaces at once; this
+ * is additive, and filing a device where it already sits is a no-op.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.PlaceDeviceInSpace
+ */
+export declare type PlaceDeviceInSpace = Message<"kusinta.iot.webrtc.v1.PlaceDeviceInSpace"> & {
+  /**
+   * @generated from field: kusinta.iot.identity.v1.DeviceId device_id = 1;
+   */
+  deviceId?: DeviceId | undefined;
+
+  /**
+   * @generated from field: kusinta.iot.identity.v1.SpaceId space_id = 2;
+   */
+  spaceId?: SpaceId | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.PlaceDeviceInSpace.
+ * Use `create(PlaceDeviceInSpaceSchema)` to create a new message.
+ */
+export declare const PlaceDeviceInSpaceSchema: GenMessage<PlaceDeviceInSpace>;
+
+/**
+ * Takes a device out of one space, leaving any others intact. A device in no
+ * space and with no owner is unfiled, and visible only to the administrator.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.RemoveDeviceFromSpace
+ */
+export declare type RemoveDeviceFromSpace = Message<"kusinta.iot.webrtc.v1.RemoveDeviceFromSpace"> & {
+  /**
+   * @generated from field: kusinta.iot.identity.v1.DeviceId device_id = 1;
+   */
+  deviceId?: DeviceId | undefined;
+
+  /**
+   * @generated from field: kusinta.iot.identity.v1.SpaceId space_id = 2;
+   */
+  spaceId?: SpaceId | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.RemoveDeviceFromSpace.
+ * Use `create(RemoveDeviceFromSpaceSchema)` to create a new message.
+ */
+export declare const RemoveDeviceFromSpaceSchema: GenMessage<RemoveDeviceFromSpace>;
+
+/**
+ * Takes ownership of a device. Ownership is reach in its own right: an owner may
+ * see and control their device whatever their gateway-wide role permits, and may
+ * file it into spaces they belong to.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.ClaimDevice
+ */
+export declare type ClaimDevice = Message<"kusinta.iot.webrtc.v1.ClaimDevice"> & {
+  /**
+   * @generated from field: kusinta.iot.identity.v1.DeviceId device_id = 1;
+   */
+  deviceId?: DeviceId | undefined;
+
+  /**
+   * @generated from field: kusinta.iot.common.v1.DeviceOwnershipType ownership = 2;
+   */
+  ownership: DeviceOwnershipType;
+
+  /**
+   * @generated from field: kusinta.iot.identity.v1.SpaceId initial_space_id = 3;
+   */
+  initialSpaceId?: SpaceId | undefined;
+
+  /**
+   * Evidence the claimant is standing at the device: the serial printed on it,
+   * matched against DeviceDescriptor.serial_number. Required precisely when the
+   * caller cannot already reach the device, which is the ordinary case for a
+   * resident claiming something they just bought — an unfiled device is invisible
+   * to them, so possession is the only thing left that can distinguish them from
+   * someone guessing ids. The administrator, who can already reach it, needs no
+   * proof. A device whose connector reports no serial can only be claimed by the
+   * administrator.
+   *
+   * @generated from field: string possession_proof = 4;
+   */
+  possessionProof: string;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.ClaimDevice.
+ * Use `create(ClaimDeviceSchema)` to create a new message.
+ */
+export declare const ClaimDeviceSchema: GenMessage<ClaimDevice>;
+
+/**
+ * Gives up ownership. The device keeps whatever space filing it has; if it has
+ * none it becomes unfiled.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.ReleaseDevice
+ */
+export declare type ReleaseDevice = Message<"kusinta.iot.webrtc.v1.ReleaseDevice"> & {
+  /**
+   * @generated from field: kusinta.iot.identity.v1.DeviceId device_id = 1;
+   */
+  deviceId?: DeviceId | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.ReleaseDevice.
+ * Use `create(ReleaseDeviceSchema)` to create a new message.
+ */
+export declare const ReleaseDeviceSchema: GenMessage<ReleaseDevice>;
+
+/**
+ * Asks for the spaces the caller can reach. Unset root_space_id means all of
+ * them, which for most users is one apartment and for an administrator is the
+ * building.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.ListSpaces
+ */
+export declare type ListSpaces = Message<"kusinta.iot.webrtc.v1.ListSpaces"> & {
+  /**
+   * @generated from field: kusinta.iot.identity.v1.SpaceId root_space_id = 1;
+   */
+  rootSpaceId?: SpaceId | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.ListSpaces.
+ * Use `create(ListSpacesSchema)` to create a new message.
+ */
+export declare const ListSpacesSchema: GenMessage<ListSpaces>;
+
+/**
+ * The spaces themselves, flat: each Space carries its own parent_space_id, so the
+ * structure travels with the elements and a client rebuilds the tree from them.
+ * A flat list also degrades honestly when it is truncated — a partial tree with
+ * dangling parents is still readable, where a nested one would lose whole
+ * subtrees.
+ *
+ * device_ids on each Space are filtered to what the caller may see. An
+ * unfiltered tree would list every device on the gateway by id, which is the
+ * enumeration channel the snapshot filter exists to close.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.SpaceTree
+ */
+export declare type SpaceTree = Message<"kusinta.iot.webrtc.v1.SpaceTree"> & {
+  /**
+   * @generated from field: repeated kusinta.iot.space.v1.Space spaces = 1;
+   */
+  spaces: Space[];
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.SpaceTree.
+ * Use `create(SpaceTreeSchema)` to create a new message.
+ */
+export declare const SpaceTreeSchema: GenMessage<SpaceTree>;
+
+/**
+ * The answer to an operation that changes something and has nothing to return.
+ * Deliberately empty: ManagementResult.in_reply_to says which request succeeded,
+ * and what the change did to the caller's reach arrives on LivePermissionUpdate
+ * rather than here.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.ManagementAck
+ */
+export declare type ManagementAck = Message<"kusinta.iot.webrtc.v1.ManagementAck"> & {
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.ManagementAck.
+ * Use `create(ManagementAckSchema)` to create a new message.
+ */
+export declare const ManagementAckSchema: GenMessage<ManagementAck>;
+
+/**
+ * A single filing operation, app → gateway. One wrapper rather than ten payload
+ * cases on AppMessage: authorization for filing depends on the target, not on the
+ * message kind, so these can never be gated by a table keyed on the envelope case
+ * the way device messages are. Keeping them behind one case means one place that
+ * must authorize, and one refusal path that must not leak whether a target exists.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.ManagementRequest
+ */
+export declare type ManagementRequest = Message<"kusinta.iot.webrtc.v1.ManagementRequest"> & {
+  /**
+   * @generated from oneof kusinta.iot.webrtc.v1.ManagementRequest.request
+   */
+  request: {
+    /**
+     * @generated from field: kusinta.iot.webrtc.v1.CreateSpace create_space = 1;
+     */
+    value: CreateSpace;
+    case: "createSpace";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.webrtc.v1.UpdateSpace update_space = 2;
+     */
+    value: UpdateSpace;
+    case: "updateSpace";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.webrtc.v1.DeleteSpace delete_space = 3;
+     */
+    value: DeleteSpace;
+    case: "deleteSpace";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.webrtc.v1.AssignUserToSpace assign_user_to_space = 4;
+     */
+    value: AssignUserToSpace;
+    case: "assignUserToSpace";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.webrtc.v1.RemoveUserFromSpace remove_user_from_space = 5;
+     */
+    value: RemoveUserFromSpace;
+    case: "removeUserFromSpace";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.webrtc.v1.PlaceDeviceInSpace place_device_in_space = 6;
+     */
+    value: PlaceDeviceInSpace;
+    case: "placeDeviceInSpace";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.webrtc.v1.RemoveDeviceFromSpace remove_device_from_space = 7;
+     */
+    value: RemoveDeviceFromSpace;
+    case: "removeDeviceFromSpace";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.webrtc.v1.ClaimDevice claim_device = 8;
+     */
+    value: ClaimDevice;
+    case: "claimDevice";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.webrtc.v1.ReleaseDevice release_device = 9;
+     */
+    value: ReleaseDevice;
+    case: "releaseDevice";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.webrtc.v1.ListSpaces list_spaces = 10;
+     */
+    value: ListSpaces;
+    case: "listSpaces";
+  } | { case: undefined; value?: undefined };
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.ManagementRequest.
+ * Use `create(ManagementRequestSchema)` to create a new message.
+ */
+export declare const ManagementRequestSchema: GenMessage<ManagementRequest>;
+

package/src/kusinta/iot/webrtc/v1/management_pb.js

@@ -0,0 +1,106 @@
+// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts,import_extension=js"
+// @generated from file kusinta/iot/webrtc/v1/management.proto (package kusinta.iot.webrtc.v1, syntax proto3)
+/* eslint-disable */
+
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import { file_kusinta_iot_common_v1_types } from "../../common/v1/types_pb.js";
+import { file_kusinta_iot_identity_v1_identity } from "../../identity/v1/identity_pb.js";
+import { file_kusinta_iot_space_v1_space } from "../../space/v1/space_pb.js";
+
+/**
+ * Describes the file kusinta/iot/webrtc/v1/management.proto.
+ */
+export const file_kusinta_iot_webrtc_v1_management = /*@__PURE__*/
+  fileDesc("CiZrdXNpbnRhL2lvdC93ZWJydGMvdjEvbWFuYWdlbWVudC5wcm90bxIVa3VzaW50YS5pb3Qud2VicnRjLnYxIrABCgtDcmVhdGVTcGFjZRI0CgpzcGFjZV90eXBlGAEgASgOMiAua3VzaW50YS5pb3QuY29tbW9uLnYxLlNwYWNlVHlwZRIMCgRuYW1lGAIgASgJEhMKC2Rlc2NyaXB0aW9uGAMgASgJEg0KBWZsb29yGAQgASgFEjkKD3BhcmVudF9zcGFjZV9pZBgFIAEoCzIgLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlNwYWNlSWQizwIKC1VwZGF0ZVNwYWNlEjIKCHNwYWNlX2lkGAEgASgLMiAua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuU3BhY2VJZBI5CgpzcGFjZV90eXBlGAIgASgOMiAua3VzaW50YS5pb3QuY29tbW9uLnYxLlNwYWNlVHlwZUgBiAEBEhEKBG5hbWUYAyABKAlIAogBARIYCgtkZXNjcmlwdGlvbhgEIAEoCUgDiAEBEhIKBWZsb29yGAUgASgFSASIAQESOwoPcGFyZW50X3NwYWNlX2lkGAYgASgLMiAua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuU3BhY2VJZEgAEhAKBmRldGFjaBgHIAEoCEgAQg8KDXBhcmVudF9jaGFuZ2VCDQoLX3NwYWNlX3R5cGVCBwoFX25hbWVCDgoMX2Rlc2NyaXB0aW9uQggKBl9mbG9vciJSCgtEZWxldGVTcGFjZRIyCghzcGFjZV9pZBgBIAEoCzIgLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlNwYWNlSWQSDwoHY2FzY2FkZRgCIAEoCCJ/ChFBc3NpZ25Vc2VyVG9TcGFjZRIyCghzcGFjZV9pZBgBIAEoCzIgLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlNwYWNlSWQSMAoHdXNlcl9pZBgCIAEoCzIfLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlVzZXJJZEoECAMQBCJ7ChNSZW1vdmVVc2VyRnJvbVNwYWNlEjIKCHNwYWNlX2lkGAEgASgLMiAua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuU3BhY2VJZBIwCgd1c2VyX2lkGAIgASgLMh8ua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuVXNlcklkIn4KElBsYWNlRGV2aWNlSW5TcGFjZRI0CglkZXZpY2VfaWQYASABKAsyIS5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5EZXZpY2VJZBIyCghzcGFjZV9pZBgCIAEoCzIgLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlNwYWNlSWQigQEKFVJlbW92ZURldmljZUZyb21TcGFjZRI0CglkZXZpY2VfaWQYASABKAsyIS5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5EZXZpY2VJZBIyCghzcGFjZV9pZBgCIAEoCzIgLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlNwYWNlSWQi2AEKC0NsYWltRGV2aWNlEjQKCWRldmljZV9pZBgBIAEoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkRldmljZUlkEj0KCW93bmVyc2hpcBgCIAEoDjIqLmt1c2ludGEuaW90LmNvbW1vbi52MS5EZXZpY2VPd25lcnNoaXBUeXBlEjoKEGluaXRpYWxfc3BhY2VfaWQYAyABKAsyIC5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5TcGFjZUlkEhgKEHBvc3Nlc3Npb25fcHJvb2YYBCABKAkiRQoNUmVsZWFzZURldmljZRI0CglkZXZpY2VfaWQYASABKAsyIS5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5EZXZpY2VJZCJFCgpMaXN0U3BhY2VzEjcKDXJvb3Rfc3BhY2VfaWQYASABKAsyIC5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5TcGFjZUlkIjgKCVNwYWNlVHJlZRIrCgZzcGFjZXMYASADKAsyGy5rdXNpbnRhLmlvdC5zcGFjZS52MS5TcGFjZSIPCg1NYW5hZ2VtZW50QWNrIr4FChFNYW5hZ2VtZW50UmVxdWVzdBI6CgxjcmVhdGVfc3BhY2UYASABKAsyIi5rdXNpbnRhLmlvdC53ZWJydGMudjEuQ3JlYXRlU3BhY2VIABI6Cgx1cGRhdGVfc3BhY2UYAiABKAsyIi5rdXNpbnRhLmlvdC53ZWJydGMudjEuVXBkYXRlU3BhY2VIABI6CgxkZWxldGVfc3BhY2UYAyABKAsyIi5rdXNpbnRhLmlvdC53ZWJydGMudjEuRGVsZXRlU3BhY2VIABJIChRhc3NpZ25fdXNlcl90b19zcGFjZRgEIAEoCzIoLmt1c2ludGEuaW90LndlYnJ0Yy52MS5Bc3NpZ25Vc2VyVG9TcGFjZUgAEkwKFnJlbW92ZV91c2VyX2Zyb21fc3BhY2UYBSABKAsyKi5rdXNpbnRhLmlvdC53ZWJydGMudjEuUmVtb3ZlVXNlckZyb21TcGFjZUgAEkoKFXBsYWNlX2RldmljZV9pbl9zcGFjZRgGIAEoCzIpLmt1c2ludGEuaW90LndlYnJ0Yy52MS5QbGFjZURldmljZUluU3BhY2VIABJQChhyZW1vdmVfZGV2aWNlX2Zyb21fc3BhY2UYByABKAsyLC5rdXNpbnRhLmlvdC53ZWJydGMudjEuUmVtb3ZlRGV2aWNlRnJvbVNwYWNlSAASOgoMY2xhaW1fZGV2aWNlGAggASgLMiIua3VzaW50YS5pb3Qud2VicnRjLnYxLkNsYWltRGV2aWNlSAASPgoOcmVsZWFzZV9kZXZpY2UYCSABKAsyJC5rdXNpbnRhLmlvdC53ZWJydGMudjEuUmVsZWFzZURldmljZUgAEjgKC2xpc3Rfc3BhY2VzGAogASgLMiEua3VzaW50YS5pb3Qud2VicnRjLnYxLkxpc3RTcGFjZXNIAEIJCgdyZXF1ZXN0QgJIAWIGcHJvdG8z", [file_kusinta_iot_common_v1_types, file_kusinta_iot_identity_v1_identity, file_kusinta_iot_space_v1_space]);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.CreateSpace.
+ * Use `create(CreateSpaceSchema)` to create a new message.
+ */
+export const CreateSpaceSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_management, 0);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.UpdateSpace.
+ * Use `create(UpdateSpaceSchema)` to create a new message.
+ */
+export const UpdateSpaceSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_management, 1);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.DeleteSpace.
+ * Use `create(DeleteSpaceSchema)` to create a new message.
+ */
+export const DeleteSpaceSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_management, 2);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.AssignUserToSpace.
+ * Use `create(AssignUserToSpaceSchema)` to create a new message.
+ */
+export const AssignUserToSpaceSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_management, 3);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.RemoveUserFromSpace.
+ * Use `create(RemoveUserFromSpaceSchema)` to create a new message.
+ */
+export const RemoveUserFromSpaceSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_management, 4);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.PlaceDeviceInSpace.
+ * Use `create(PlaceDeviceInSpaceSchema)` to create a new message.
+ */
+export const PlaceDeviceInSpaceSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_management, 5);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.RemoveDeviceFromSpace.
+ * Use `create(RemoveDeviceFromSpaceSchema)` to create a new message.
+ */
+export const RemoveDeviceFromSpaceSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_management, 6);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.ClaimDevice.
+ * Use `create(ClaimDeviceSchema)` to create a new message.
+ */
+export const ClaimDeviceSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_management, 7);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.ReleaseDevice.
+ * Use `create(ReleaseDeviceSchema)` to create a new message.
+ */
+export const ReleaseDeviceSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_management, 8);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.ListSpaces.
+ * Use `create(ListSpacesSchema)` to create a new message.
+ */
+export const ListSpacesSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_management, 9);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.SpaceTree.
+ * Use `create(SpaceTreeSchema)` to create a new message.
+ */
+export const SpaceTreeSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_management, 10);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.ManagementAck.
+ * Use `create(ManagementAckSchema)` to create a new message.
+ */
+export const ManagementAckSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_management, 11);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.ManagementRequest.
+ * Use `create(ManagementRequestSchema)` to create a new message.
+ */
+export const ManagementRequestSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_management, 12);
+

package/src/kusinta/iot/webrtc/v1/permission_push_pb.d.ts

@@ -13,7 +13,7 @@ import type { DeviceId } from "../../identity/v1/identity_pb.js";
 export declare const file_kusinta_iot_webrtc_v1_permission_push: GenFile;
 
 /**
- * Pushed to the Flutter app whenever the user's effective permissions change.
+ * Pushed to the app whenever the user's effective permissions change.
  * change_reason values: "DEVICE_ASSIGNED", "DEVICE_UNASSIGNED", "RESIDENT_CHANGED", "CONSTRAINT_UPDATED"
  *
  * @generated from message kusinta.iot.webrtc.v1.LivePermissionUpdate